@opengeni/db 0.27.7 → 0.27.9

package/src/index.ts

@@ -154,7 +154,12 @@ import {
   VERCEL_AI_GATEWAY_CONNECTION_ROLE,
   type Settings,
 } from "@opengeni/config";
-import { boundModelToolOutputItem, isCodexBilledModel } from "@opengeni/codex";
+import {
+  boundModelToolOutputItem,
+  isCodexBilledModel,
+  refreshCodexToken,
+  type CodexFetch,
+} from "@opengeni/codex";
 // Re-exported so consumers get the whole codex-billed detection surface (the pure
 // prefix test + the credential-aware predicates below) from a single import.
 export { isCodexBilledModel } from "@opengeni/codex";
@@ -187,16 +192,10 @@ import {
   type FrozenTurnInitiator,
 } from "./turn-initiator";
 export { frozenInitiatorForCommandActor, type FrozenTurnInitiator } from "./turn-initiator";
-import type { PgDatabase, PgTransactionConfig } from "drizzle-orm/pg-core";
-import { drizzle } from "drizzle-orm/postgres-js";
-import postgres from "postgres";
-import { decryptEnvironmentValue } from "./environment-crypto";
+import { decryptEnvironmentValue, encryptEnvironmentValue } from "./environment-crypto";
 import { sanitizeEventPayload, sanitizeModelPayload } from "./event-payload-sanitizer";
 import { seedNewSessionDraftInTransaction } from "./new-session-drafts";
-import {
-  runIdempotentPersistenceTransaction,
-  type IdempotentPersistenceTransactionOptions,
-} from "./persistence-errors";
+import { runIdempotentPersistenceTransaction } from "./persistence-errors";
 import {
   closePendingSessionToolCallsInTransaction,
   historyCallId,
@@ -303,22 +302,58 @@ export {
 // Workspace Memory V1 pure domain surface (gates, render, canonical prompt text).
 export * from "./memory-domain";
 
-// §7.7 driver widening (Step I). `Database` is the structural, cross-driver
-// query-layer port: every helper in this file accepts `db: Database` and uses
-// only the methods present on drizzle's base `PgDatabase` (select/insert/update/
-// delete/transaction/execute). Widening from the concrete
-// `PostgresJsDatabase<typeof schema>` to `PgDatabase<any, typeof schema>` is a
-// pure TYPE change — no runtime behavior changes — that lets an embedded host
-// inject ANY drizzle pg driver handle (node-postgres, neon-http, etc.) bound to
-// OpenGeni's schema, not just the postgres-js handle `createDb` builds. The
-// `any` for the query-result HKT is deliberate: it keeps `db.execute(sql\`…\`)`
-// callable across drivers whose raw-result shapes differ (postgres-js returns a
-// row array; node-postgres returns `{ rows }`). The three raw `db.execute(…)`
-// reads that index a row array (`getManagedUserByEmail` here is the only
-// host-facing one — see `userLookup`) stay postgres-js-shaped for standalone;
-// `userLookup` is the injection seam for hosts on a different driver.
-// `PostgresJsDatabase<typeof schema>` is assignable to this, so standalone is
-// unaffected.
+import {
+  dbBindingFor,
+  rawRows,
+  retryRlsPersistence,
+  retryWorkspacePersistence,
+  rlsContextForWorkspace,
+  setRlsContext,
+  setSubjectRlsContext,
+  withAccountRls,
+  withRlsContext,
+  withWorkspaceRls,
+  withWorkspaceSubjectRls,
+  withWorkspaceUsageLock,
+  type Database,
+} from "./database";
+export {
+  createDb,
+  registerDbBinding,
+  rlsContextForWorkspace,
+  rlsStrategyFor,
+  setRlsContext,
+  setSubjectRlsContext,
+  withAccountRls,
+  withDatabaseStatementTimeout,
+  withRlsContext,
+  withWorkspaceRls,
+  withWorkspaceSubjectRls,
+  withWorkspaceUsageLock,
+  type CreateDbOptions,
+  type Database,
+  type DbClient,
+  type RlsContext,
+  type RlsStrategy,
+  type UserLookup,
+} from "./database";
+import {
+  buildCodexTokenResolver as buildCodexTokenResolverCore,
+  fetchCodexRateLimitResetCreditsForAccount as fetchCodexRateLimitResetCreditsForAccountCore,
+  fetchCodexUsageForAccount as fetchCodexUsageForAccountCore,
+  type CodexAccountUsageSnapshot,
+  type CodexAuthDeps,
+  type CodexCredentialForRun,
+  type CodexCredentialTokens,
+} from "./codex-token-resolver";
+import {
+  buildConnectionTokenResolver as buildConnectionTokenResolverCore,
+  refreshOAuthConnectionCredential as refreshOAuthConnectionCredentialCore,
+  type ConnectionBrokerDeps,
+  type ConnectionCredentialForBroker,
+  type ConnectionTokenResolverOptions,
+} from "./connection-token-resolver";
+
 function parsedPersonalConnectionDelegations(
   value: unknown,
   context: string,
@@ -330,8 +365,6 @@ function parsedPersonalConnectionDelegations(
   return parsed.data.map((delegation) => ({ ...delegation }));
 }
 
-export type Database = PgDatabase<any, typeof schema>;
-
 /** Raised when a durable session tool-policy write lost its version fence. */
 export class SessionToolPolicyVersionConflictError extends Error {
   readonly code = "SESSION_TOOL_POLICY_CONFLICT";
@@ -342,16 +375,6 @@ export class SessionToolPolicyVersionConflictError extends Error {
   }
 }
 
-export type DbClient = {
-  db: Database;
-  close: () => Promise<void>;
-};
-
-export type RlsContext = {
-  accountId: string;
-  workspaceId?: string | null;
-};
-
 export type NestedAgentDepthPolicySource = "session" | "workspace" | "deployment" | "default";
 
 export type SessionDepthPolicy = {
@@ -414,165 +437,6 @@ export class SessionSpawnDeniedDbError extends Error {
   }
 }
 
-/**
- * RLS posture for the connection OpenGeni's query layer runs over (Step I, §7.7).
- *
- * - `"force"` (DEFAULT — today's standalone behavior, byte-for-byte): OpenGeni
- *   connects as a NON-OWNER role (`opengeni_app`) and every table carries
- *   `FORCE ROW LEVEL SECURITY`, so the workspace/account GUCs set by
- *   `setRlsContext` are the ONLY thing that admits rows — even the table owner
- *   is subject to RLS. This is the Fork-A isolation guarantee.
- * - `"scoped"` (embedded Fork-B opt-in): the host runs OpenGeni's queries over a
- *   role that OWNS the dedicated schema (RLS need not be forced for that role),
- *   relying on the host's own tenant boundary. OpenGeni STILL emits the
- *   `set_config('opengeni.account_id'/'workspace_id', …)` GUCs defensively on
- *   every scoped query, so the application query path is byte-identical between
- *   the two strategies and the app code is RLS-mode-agnostic. The strategy is a
- *   declared posture (consumed by `provisionRoles` and as a documented
- *   invariant), NOT a query-path branch — there is deliberately no `if
- *   (strategy === …)` anywhere in the helpers below. Picking `"scoped"` does not
- *   relax any GUC; it only changes which DB role the host provisions/connects as
- *   and asserts that the host accepts owning the isolation boundary.
- */
-export type RlsStrategy = "force" | "scoped";
-
-/**
- * Resolve a host-IdP/Better-Auth user *identifier* by email. Injected via
- * `createDb({ userLookup })` (Step I). UNSET → today's raw parameterized select
- * against Better Auth's `auth_users` table (see `getManagedUserByEmail`), which
- * relies on the postgres-js array-shaped `db.execute` result. An embedded host
- * whose identity lives elsewhere (a different IdP table, a different driver, or
- * a non-`auth_users` user store) injects this closure so OpenGeni never touches
- * `auth_users` directly. Returns the user id, or null when no such user exists.
- */
-export type UserLookup = (db: Database, email: string) => Promise<string | null>;
-
-export type CreateDbOptions = {
-  /**
-   * The Postgres `search_path` for this connection (Step I, §7.8 runtime half).
-   * UNSET → today's behavior: NO `search_path` startup parameter is sent, so the
-   * server default applies (`public` for standalone, where every table + the
-   * `vector` extension + `gen_random_uuid()` live). For an embedded dedicated
-   * schema, pass e.g. `"opengeni,opengeni_private,public"` — postgres-js sends
-   * it as a per-session startup parameter (the supported, query-param-free way;
-   * URL `?search_path=` is IGNORED by postgres-js). Keep `public` LAST so the
-   * `vector` type and `gen_random_uuid()` (which live in `public` on the
-   * pgvector image) still resolve — the schema-isolation contract live footgun.
-   */
-  searchPath?: string;
-  /** RLS posture; defaults to `"force"` (today's standalone). */
-  rlsStrategy?: RlsStrategy;
-  /** Host-provided user-by-email resolver; unset → today's raw `auth_users` query. */
-  userLookup?: UserLookup;
-  /** postgres-js pool size; defaults to today's `10`. */
-  max?: number;
-  /**
-   * Connection-local default transaction isolation sent in the postgres-js
-   * startup parameters. This is intentionally not a role/database default:
-   * tests and embedded callers can exercise a different ambient isolation
-   * without mutating a shared PostgreSQL role or affecting other connections.
-   */
-  isolationLevel?: postgres.ConnectionParameters["default_transaction_isolation"];
-};
-
-/**
- * The active RLS strategy + userLookup for an injected `Database`, recorded in a
- * side WeakMap so helpers (and `getManagedUserByEmail`) can consult the host's
- * binding without changing every call signature. A handle with no recorded
- * config (e.g. one built outside `createDb`, or in a test) falls back to the
- * standalone defaults: `rlsStrategy: "force"`, raw `auth_users` lookup.
- */
-type DbBinding = { rlsStrategy: RlsStrategy; userLookup?: UserLookup };
-const dbBindings = new WeakMap<object, DbBinding>();
-
-/** The strategy bound to a handle (or the `"force"` default). */
-export function rlsStrategyFor(db: Database): RlsStrategy {
-  return dbBindings.get(db as unknown as object)?.rlsStrategy ?? "force";
-}
-
-/**
- * Run a raw SQL query and read its rows as a typed array.
- *
- * Why this exists: the Step I driver widening (`Database = PgDatabase<any, …>`)
- * deliberately sets the query-result HKT to `any` so `db.execute(…)` is callable
- * across drivers whose raw-result shapes differ (postgres-js → row array;
- * node-postgres → `{ rows }`). A side effect is that `db.execute<T>(…)` now
- * resolves to `any`, erasing the per-row element type at the call site. OpenGeni's
- * OWN internal raw queries usually run over the postgres-js handle `createDb`
- * builds (array result), while an embedded host may inject a node-postgres style
- * driver (`{ rows }`). Normalize those two standard shapes in one place; reject
- * an unknown driver result rather than silently treating it as an empty query.
- */
-async function rawRows<T extends Record<string, unknown>>(
-  executor: Pick<Database, "execute">,
-  query: SQL,
-): Promise<T[]> {
-  const result = await executor.execute<T>(query);
-  if (Array.isArray(result)) {
-    return result as unknown as T[];
-  }
-  const rows = (result as unknown as { rows?: unknown }).rows;
-  if (Array.isArray(rows)) {
-    return rows as T[];
-  }
-  throw new Error("Unsupported database execute() result shape");
-}
-
-export function createDb(databaseUrl: string, options: CreateDbOptions = {}): DbClient {
-  // `prepare: false` is REQUIRED for Azure Database for PostgreSQL Flexible
-  // Server's transaction-pooling PgBouncer: postgres-js's default named prepared
-  // statements (`s_N`) are bound to one backend, but a transaction pooler hands
-  // each transaction a different backend, so a later `execute` intermittently
-  // throws `prepared statement "s_N" does not exist`. Every RLS read in this
-  // module (set_config + SELECT inside one db.transaction) rides on this pool, so
-  // the failure surfaces as a "worked, then didn't" credential/permission read.
-  // idle_timeout + max_lifetime recycle connections so a pooler-recycled backend
-  // is never reused indefinitely; application_name aids server-side diagnostics.
-  const client = postgres(databaseUrl, {
-    max: options.max ?? 10,
-    prepare: false,
-    idle_timeout: 30,
-    max_lifetime: 1800,
-    // `connection` carries per-session Postgres STARTUP parameters. `application_name`
-    // (always) aids server-side diagnostics; `search_path` (embedded only) is the
-    // supported, query-param-free way to scope a connection to a dedicated schema —
-    // postgres-js IGNORES a URL `?search_path=`. Unset searchPath → omit it so the
-    // server default (`public`) is unchanged for standalone.
-    connection: {
-      application_name: "opengeni",
-      ...(options.searchPath ? { search_path: options.searchPath } : {}),
-      ...(options.isolationLevel ? { default_transaction_isolation: options.isolationLevel } : {}),
-    },
-  });
-  const db = drizzle(client, { schema });
-  dbBindings.set(db as unknown as object, {
-    rlsStrategy: options.rlsStrategy ?? "force",
-    ...(options.userLookup ? { userLookup: options.userLookup } : {}),
-  });
-  return {
-    db,
-    close: async () => {
-      await client.end();
-    },
-  };
-}
-
-/**
- * Register a host's `rlsStrategy`/`userLookup` against an externally-constructed
- * `Database` handle (e.g. one the embedded host built from its own driver and
- * injected, rather than via `createDb`). Lets the same WeakMap-backed lookups
- * work for injected handles. Standalone never calls this (it uses `createDb`).
- */
-export function registerDbBinding(
-  db: Database,
-  binding: { rlsStrategy?: RlsStrategy; userLookup?: UserLookup },
-): void {
-  dbBindings.set(db as unknown as object, {
-    rlsStrategy: binding.rlsStrategy ?? "force",
-    ...(binding.userLookup ? { userLookup: binding.userLookup } : {}),
-  });
-}
-
 // ---------------------------------------------------------------------------
 // Durable host export
 // ---------------------------------------------------------------------------
@@ -1048,187 +912,6 @@ export async function getHostExportConsumerStatus(
   };
 }
 
-export async function setRlsContext(db: Database, context: RlsContext): Promise<void> {
-  // Fail loud on an empty/blank account id: a "" account would set an RLS GUC
-  // that matches no tenant row, silently returning zero rows from every scoped
-  // read (a phantom "not found" / "no active subscription"). An RLS context with
-  // no account is always a bug at the call site, never a valid query scope.
-  if (typeof context.accountId !== "string" || context.accountId.trim() === "") {
-    throw new Error("setRlsContext: a non-empty accountId is required to establish an RLS context");
-  }
-  await db.execute(sql`select set_config('opengeni.account_id', ${context.accountId}, true)`);
-  await db.execute(
-    sql`select set_config('opengeni.workspace_id', ${context.workspaceId ?? ""}, true)`,
-  );
-  await db.execute(sql`select set_config('opengeni.sandbox_recovery_protocol_v2', '1', true)`);
-}
-
-export async function withRlsContext<T>(
-  db: Database,
-  context: RlsContext,
-  fn: (db: Database) => Promise<T>,
-  transactionConfig?: PgTransactionConfig,
-): Promise<T> {
-  return await db.transaction(async (tx) => {
-    const scoped = tx as unknown as Database;
-    await setRlsContext(scoped, context);
-    // Defense-in-depth: read the LOCAL GUC back on THIS backend BEFORE running
-    // the scoped query. The set_config and this read share one db.transaction,
-    // which a transaction pooler pins to a single backend — so a mismatch here
-    // means the context was genuinely lost (a torn transaction / pooler backend
-    // swap), not normal operation. Without this guard such an event runs the
-    // scoped read with an empty account_id and returns zero RLS-visible rows,
-    // manufacturing a phantom "no active subscription" from a credential that is
-    // in fact active. Convert that silent false into a loud, root-cause-bearing
-    // error so the caller can retry rather than permanently mis-decide.
-    const applied = await tx.execute<{
-      account_id: string | null;
-      workspace_id: string | null;
-    }>(
-      sql`select
-        current_setting('opengeni.account_id', true) as account_id,
-        current_setting('opengeni.workspace_id', true) as workspace_id`,
-    );
-    const appliedAccountId = applied[0]?.account_id ?? "";
-    const expectedWorkspaceId = context.workspaceId ?? "";
-    const appliedWorkspaceId = applied[0]?.workspace_id ?? "";
-    if (appliedAccountId !== context.accountId) {
-      throw new Error(
-        `RLS context not applied on the active backend: expected account ${context.accountId}, got "${appliedAccountId}"`,
-      );
-    }
-    if (appliedWorkspaceId !== expectedWorkspaceId) {
-      throw new Error(
-        `RLS context not applied on the active backend: expected workspace "${expectedWorkspaceId}", got "${appliedWorkspaceId}"`,
-      );
-    }
-    return await fn(scoped);
-  }, transactionConfig);
-}
-
-/**
- * Run one bounded database operation on a transaction-pinned backend.
- *
- * Callers that also have an application deadline should check their abort
- * signal before returning from `fn`; throwing there rolls the transaction back
- * even when the application deadline won a surrounding Promise race.
- */
-export async function withDatabaseStatementTimeout<T>(
-  db: Database,
-  timeoutMs: number,
-  fn: (db: Database) => Promise<T>,
-): Promise<T> {
-  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
-    throw new Error("withDatabaseStatementTimeout requires a positive timeout");
-  }
-  const boundedTimeoutMs = Math.max(1, Math.floor(timeoutMs));
-  return await db.transaction(async (tx) => {
-    const scoped = tx as unknown as Database;
-    await scoped.execute(
-      sql`select set_config('statement_timeout', ${`${boundedTimeoutMs}ms`}, true)`,
-    );
-    return await fn(scoped);
-  });
-}
-
-export async function rlsContextForWorkspace(
-  db: Database,
-  workspaceId: string,
-): Promise<RlsContext> {
-  const [row] = await db
-    .select({ accountId: schema.workspaces.accountId })
-    .from(schema.workspaces)
-    .where(eq(schema.workspaces.id, workspaceId))
-    .limit(1);
-  if (!row) {
-    throw new Error(`Workspace not found: ${workspaceId}`);
-  }
-  return { accountId: row.accountId, workspaceId };
-}
-
-export async function withWorkspaceRls<T>(
-  db: Database,
-  workspaceId: string,
-  fn: (db: Database) => Promise<T>,
-): Promise<T> {
-  return await withRlsContext(db, await rlsContextForWorkspace(db, workspaceId), fn);
-}
-
-async function retryWorkspacePersistence<T>(
-  db: Database,
-  workspaceId: string,
-  options: IdempotentPersistenceTransactionOptions,
-  fn: (db: Database) => Promise<T>,
-): Promise<T> {
-  return await runIdempotentPersistenceTransaction(options, async () => {
-    return await withWorkspaceRls(db, workspaceId, fn);
-  });
-}
-
-async function retryRlsPersistence<T>(
-  db: Database,
-  context: RlsContext,
-  options: IdempotentPersistenceTransactionOptions,
-  fn: (db: Database) => Promise<T>,
-): Promise<T> {
-  return await runIdempotentPersistenceTransaction(options, async () => {
-    return await withRlsContext(db, context, fn);
-  });
-}
-
-/**
- * Personal workspace data needs both tenant and authenticated-principal GUCs.
- * `session_pins` uses this helper so FORCE RLS rejects another member's rows
- * even if a future query accidentally omits its explicit subject predicate.
- */
-export async function withWorkspaceSubjectRls<T>(
-  db: Database,
-  workspaceId: string,
-  subjectId: string,
-  fn: (db: Database) => Promise<T>,
-  transactionConfig?: PgTransactionConfig,
-): Promise<T> {
-  if (!subjectId.trim()) {
-    throw new Error("withWorkspaceSubjectRls: a non-empty subjectId is required");
-  }
-  const context = await rlsContextForWorkspace(db, workspaceId);
-  return await withRlsContext(
-    db,
-    context,
-    async (scopedDb) => {
-      await setSubjectRlsContext(scopedDb, subjectId);
-      return await fn(scopedDb);
-    },
-    transactionConfig,
-  );
-}
-
-/** Apply and verify actor-private RLS on an already transaction-pinned handle. */
-export async function setSubjectRlsContext(db: Database, subjectId: string): Promise<void> {
-  if (!subjectId.trim()) {
-    throw new Error("setSubjectRlsContext: a non-empty subjectId is required");
-  }
-  await db.execute(sql`select set_config('opengeni.subject_id', ${subjectId}, true)`);
-  const applied = await db.execute<{ subject_id: string | null }>(
-    sql`select current_setting('opengeni.subject_id', true) as subject_id`,
-  );
-  if ((applied[0]?.subject_id ?? "") !== subjectId) {
-    throw new Error("Authenticated subject RLS context was not applied on the active backend");
-  }
-}
-
-export async function withWorkspaceUsageLock<T>(
-  db: Database,
-  workspaceId: string,
-  fn: (db: Database) => Promise<T>,
-): Promise<T> {
-  const context = await rlsContextForWorkspace(db, workspaceId);
-  return await withRlsContext(db, context, async (scopedDb) => {
-    await scopedDb.execute(sql`select pg_advisory_xact_lock(hashtext(${`usage:${workspaceId}`}))`);
-    return await fn(scopedDb);
-  });
-}
-
 export type DocumentIndexAuthority = {
   authorityKind: DocumentAuthorityKind;
   authorityWorkspaceId: string | null;
@@ -1278,14 +961,6 @@ export async function resolveDocumentIndexAuthority(
   };
 }
 
-export async function withAccountRls<T>(
-  db: Database,
-  accountId: string,
-  fn: (db: Database) => Promise<T>,
-): Promise<T> {
-  return await withRlsContext(db, { accountId, workspaceId: null }, fn);
-}
-
 export const allWorkspacePermissions: Permission[] = [
   "workspace:read",
   "workspace:admin",
@@ -2096,7 +1771,7 @@ export async function removeWorkspaceMember(
  * unknown users are deferred.
  */
 export async function getManagedUserByEmail(db: Database, email: string): Promise<string | null> {
-  const binding = dbBindings.get(db as unknown as object);
+  const binding = dbBindingFor(db);
   if (binding?.userLookup) {
     return await binding.userLookup(db, email);
   }
@@ -3499,6 +3174,7 @@ export type WorkspaceStateMemoryRecord = {
 export type CreateSocialConnectionInput = {
   accountId: string;
   workspaceId: string;
+  subjectId?: string | null;
   provider: SocialProvider;
   accountHandle: string;
   accountName?: string | null;
@@ -3514,6 +3190,7 @@ export type CreateSocialConnectionInput = {
 export type UpsertSocialOAuthConnectionInput = {
   accountId: string;
   workspaceId: string;
+  subjectId?: string | null;
   provider: SocialProvider;
   accountHandle: string;
   accountName?: string | null;
@@ -3526,6 +3203,7 @@ export type UpsertSocialOAuthConnectionInput = {
 export type UpdateSocialConnectionCredentialInput = {
   workspaceId: string;
   connectionId: string;
+  subjectId?: string | null;
   credentialEncrypted?: string | null;
   status?: SocialConnectionStatus;
   tokenMetadata?: Record<string, unknown>;
@@ -3534,6 +3212,7 @@ export type UpdateSocialConnectionCredentialInput = {
 export type CreateSocialPostInput = {
   accountId: string;
   workspaceId: string;
+  subjectId?: string | null;
   connectionId: string;
   externalPostId?: string | null;
   url?: string | null;
@@ -3672,22 +3351,6 @@ export type SlackBotDeleteOperation = {
   updatedAt: Date;
 };
 
-export type ConnectionCredentialForBroker = {
-  id: string;
-  accountId: string;
-  workspaceId: string;
-  subjectId: string | null;
-  providerDomain: string;
-  kind: ConnectionKind;
-  status: ConnectionStatus;
-  credential: Record<string, unknown>;
-  grantedScopes: string[];
-  expiresAt: Date | null;
-  lastRefreshAt: Date | null;
-  version: number;
-  metadata: Record<string, unknown>;
-};
-
 export type IntegrationOAuthClientForUse = {
   id: string;
   issuer: string;
@@ -9262,11 +8925,13 @@ export async function createSocialConnection(
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
+      if (input.subjectId) await setSubjectRlsContext(scopedDb, input.subjectId);
       const [row] = await scopedDb
         .insert(schema.socialConnections)
         .values({
           accountId: input.accountId,
           workspaceId: input.workspaceId,
+          subjectId: input.subjectId ?? null,
           provider: input.provider,
           accountHandle: input.accountHandle,
           accountName: input.accountName ?? null,
@@ -9300,11 +8965,13 @@ export async function upsertSocialOAuthConnection(
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
+      if (input.subjectId) await setSubjectRlsContext(scopedDb, input.subjectId);
       const [row] = await scopedDb
         .insert(schema.socialConnections)
         .values({
           accountId: input.accountId,
           workspaceId: input.workspaceId,
+          subjectId: input.subjectId ?? null,
           provider: input.provider,
           accountHandle: input.accountHandle,
           accountName: input.accountName ?? null,
@@ -9315,12 +8982,21 @@ export async function upsertSocialOAuthConnection(
           tokenMetadata: input.tokenMetadata ?? {},
         })
         .onConflictDoUpdate({
-          target: [
-            schema.socialConnections.workspaceId,
-            schema.socialConnections.provider,
-            schema.socialConnections.accountHandle,
-          ],
+          target: input.subjectId
+            ? [
+                schema.socialConnections.workspaceId,
+                schema.socialConnections.subjectId,
+                schema.socialConnections.provider,
+              ]
+            : [
+                schema.socialConnections.workspaceId,
+                schema.socialConnections.provider,
+                schema.socialConnections.accountHandle,
+              ],
+          targetWhere: input.subjectId ? sql`subject_id is not null` : sql`subject_id is null`,
           set: {
+            accountId: input.accountId,
+            accountHandle: input.accountHandle,
             accountName: input.accountName ?? null,
             externalAccountId: input.externalAccountId ?? null,
             status: "connected",
@@ -9348,8 +9024,9 @@ export async function loadSocialConnectionCredential(
   db: Database,
   workspaceId: string,
   connectionId: string,
+  subjectId?: string | null,
 ): Promise<{ connection: SocialConnection; credentialEncrypted: string | null } | null> {
-  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+  return await withSocialConnectionSubjectRls(db, workspaceId, subjectId, async (scopedDb) => {
     const [row] = await scopedDb
       .select()
       .from(schema.socialConnections)
@@ -9357,6 +9034,7 @@ export async function loadSocialConnectionCredential(
         and(
           eq(schema.socialConnections.workspaceId, workspaceId),
           eq(schema.socialConnections.id, connectionId),
+          socialConnectionSubjectVisibility(subjectId),
         ),
       )
       .limit(1);
@@ -9371,26 +9049,32 @@ export async function updateSocialConnectionCredential(
   db: Database,
   input: UpdateSocialConnectionCredentialInput,
 ): Promise<SocialConnection | null> {
-  return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
-    const [row] = await scopedDb
-      .update(schema.socialConnections)
-      .set({
-        ...(input.credentialEncrypted !== undefined
-          ? { credentialEncrypted: input.credentialEncrypted }
-          : {}),
-        ...(input.status !== undefined ? { status: input.status } : {}),
-        ...(input.tokenMetadata !== undefined ? { tokenMetadata: input.tokenMetadata } : {}),
-        updatedAt: new Date(),
-      })
-      .where(
-        and(
-          eq(schema.socialConnections.workspaceId, input.workspaceId),
-          eq(schema.socialConnections.id, input.connectionId),
-        ),
-      )
-      .returning();
-    return row ? mapSocialConnection(row) : null;
-  });
+  return await withSocialConnectionSubjectRls(
+    db,
+    input.workspaceId,
+    input.subjectId,
+    async (scopedDb) => {
+      const [row] = await scopedDb
+        .update(schema.socialConnections)
+        .set({
+          ...(input.credentialEncrypted !== undefined
+            ? { credentialEncrypted: input.credentialEncrypted }
+            : {}),
+          ...(input.status !== undefined ? { status: input.status } : {}),
+          ...(input.tokenMetadata !== undefined ? { tokenMetadata: input.tokenMetadata } : {}),
+          updatedAt: new Date(),
+        })
+        .where(
+          and(
+            eq(schema.socialConnections.workspaceId, input.workspaceId),
+            eq(schema.socialConnections.id, input.connectionId),
+            socialConnectionSubjectVisibility(input.subjectId),
+          ),
+        )
+        .returning();
+      return row ? mapSocialConnection(row) : null;
+    },
+  );
 }
 
 // List/get never select credential_encrypted (same posture as the broker
@@ -9403,12 +9087,18 @@ export async function listSocialConnections(
   db: Database,
   workspaceId: string,
   limit = 100,
+  subjectId?: string | null,
 ): Promise<SocialConnection[]> {
-  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+  return await withSocialConnectionSubjectRls(db, workspaceId, subjectId, async (scopedDb) => {
     const rows = await scopedDb
       .select(socialConnectionPublicColumns)
       .from(schema.socialConnections)
-      .where(eq(schema.socialConnections.workspaceId, workspaceId))
+      .where(
+        and(
+          eq(schema.socialConnections.workspaceId, workspaceId),
+          socialConnectionSubjectVisibility(subjectId),
+        ),
+      )
       .orderBy(desc(schema.socialConnections.createdAt))
       .limit(limit);
     return rows.map(mapSocialConnection);
@@ -9419,8 +9109,9 @@ export async function getSocialConnection(
   db: Database,
   workspaceId: string,
   connectionId: string,
+  subjectId?: string | null,
 ): Promise<SocialConnection | null> {
-  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+  return await withSocialConnectionSubjectRls(db, workspaceId, subjectId, async (scopedDb) => {
     const [row] = await scopedDb
       .select(socialConnectionPublicColumns)
       .from(schema.socialConnections)
@@ -9428,6 +9119,7 @@ export async function getSocialConnection(
         and(
           eq(schema.socialConnections.workspaceId, workspaceId),
           eq(schema.socialConnections.id, connectionId),
+          socialConnectionSubjectVisibility(subjectId),
         ),
       )
       .limit(1);
@@ -9439,8 +9131,9 @@ export async function requireSocialConnection(
   db: Database,
   workspaceId: string,
   connectionId: string,
+  subjectId?: string | null,
 ): Promise<SocialConnection> {
-  const connection = await getSocialConnection(db, workspaceId, connectionId);
+  const connection = await getSocialConnection(db, workspaceId, connectionId, subjectId);
   if (!connection) {
     throw new Error(`Social connection not found: ${connectionId}`);
   }
@@ -9455,10 +9148,12 @@ export async function createSocialPost(
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
+      if (input.subjectId) await setSubjectRlsContext(scopedDb, input.subjectId);
       const connection = await requireSocialConnection(
         scopedDb,
         input.workspaceId,
         input.connectionId,
+        input.subjectId,
       );
       const [row] = await scopedDb
         .insert(schema.socialPosts)
@@ -9495,6 +9190,7 @@ export async function recordSyncedSocialPosts(
     accountId: string;
     workspaceId: string;
     connectionId: string;
+    subjectId?: string | null;
     posts: Array<{
       externalPostId: string;
       url?: string | null;
@@ -9513,10 +9209,12 @@ export async function recordSyncedSocialPosts(
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
+      if (input.subjectId) await setSubjectRlsContext(scopedDb, input.subjectId);
       const connection = await requireSocialConnection(
         scopedDb,
         input.workspaceId,
         input.connectionId,
+        input.subjectId,
       );
       const rows = await scopedDb
         .insert(schema.socialPosts)
@@ -9552,6 +9250,7 @@ export async function listSocialPosts(
   db: Database,
   options: {
     workspaceId: string;
+    subjectId?: string | null;
     connectionIds?: string[];
     since?: Date;
     limit?: number;
@@ -9565,15 +9264,20 @@ export async function listSocialPosts(
     conditions.push(gte(schema.socialPosts.publishedAt, options.since));
   }
   const limit = options.limit ?? 100;
-  return await withWorkspaceRls(db, options.workspaceId, async (scopedDb) => {
-    const rows = await scopedDb
-      .select()
-      .from(schema.socialPosts)
-      .where(and(...conditions))
-      .orderBy(desc(schema.socialPosts.publishedAt))
-      .limit(limit);
-    return rows.map(mapSocialPost);
-  });
+  return await withSocialConnectionSubjectRls(
+    db,
+    options.workspaceId,
+    options.subjectId,
+    async (scopedDb) => {
+      const rows = await scopedDb
+        .select()
+        .from(schema.socialPosts)
+        .where(and(...conditions))
+        .orderBy(desc(schema.socialPosts.publishedAt))
+        .limit(limit);
+      return rows.map(mapSocialPost);
+    },
+  );
 }
 
 export async function createScheduledTask(
@@ -11646,27 +11350,6 @@ export type WorkspaceEnvironmentForRun = VariableSetForRun;
 // `getCodexCredentialStatus` returns metadata only (never the secret column).
 // ---------------------------------------------------------------------------
 
-export type CodexCredentialTokens = {
-  accessToken: string;
-  refreshToken: string;
-  idToken: string;
-};
-
-export type CodexCredentialForRun = {
-  id: string; // row id — for compare-and-set writes (P1-c)
-  version: number; // optimistic-concurrency version loaded with this snapshot
-  workspaceId: string;
-  tokens: CodexCredentialTokens; // decrypted — never logged, never returned by a route
-  chatgptAccountId: string | null;
-  scopes: string | null;
-  planType: string | null;
-  isFedramp: boolean;
-  expiresAt: Date | null;
-  lastRefreshAt: Date | null;
-  status: string;
-  lastError: string | null;
-};
-
 /**
  * Login / rotation write (multi-account P1). Caller passes the PRE-encrypted
  * credential blob. Keyed on the composite partial index (workspace, chatgpt
@@ -15111,16 +14794,6 @@ export async function completeCodexResetRedemption(
 }
 
 /** The P2 usage-cache snapshot written by the refreshing usage wrapper. */
-export type CodexAccountUsageSnapshot = {
-  primaryUsedPercent?: number | null;
-  primaryResetAt?: Date | null;
-  secondaryUsedPercent?: number | null;
-  secondaryResetAt?: Date | null;
-  /** Present only when the quota body parsed successfully. */
-  checkedAt?: Date;
-  resetCreditAvailableCount?: number | null;
-  resetCreditsCheckedAt?: Date | null;
-};
 
 /**
  * Cache-write for P2 quota bars: persist the five plaintext usage columns on a
@@ -37554,6 +37227,7 @@ export async function claimSessionWorkForAttempt(
                 "delivered",
                 "acknowledged",
                 "settled",
+                "rejected_stale",
               ]),
               isNull(schema.sessionTurnAttempts.quiescedAt),
             ),
@@ -38481,28 +38155,6 @@ export async function claimSessionWorkForAttempt(
             turn: mapSessionTurnForExecution(internalTurn),
           };
         }
-        const predecessorAttemptId = queuedSteerReplacementAttemptId(queuedTurn.metadata);
-        if (predecessorAttemptId) {
-          const [predecessor] = await tx
-            .select({ quiescedAt: schema.sessionTurnAttempts.quiescedAt })
-            .from(schema.sessionTurnAttempts)
-            .where(
-              and(
-                eq(schema.sessionTurnAttempts.workspaceId, workspaceId),
-                eq(schema.sessionTurnAttempts.sessionId, sessionId),
-                eq(schema.sessionTurnAttempts.id, predecessorAttemptId),
-              ),
-            )
-            .limit(1);
-          if (!predecessor) {
-            throw new SessionControlInvariantError(
-              `Queued Steer ${id} points to missing predecessor attempt ${predecessorAttemptId}`,
-            );
-          }
-          if (!predecessor.quiescedAt) {
-            return { action: "unclaimed", reason: "control-pending" };
-          }
-        }
         // The database guard makes this function the only supported
         // queued-to-running transition. Raw or stale claimers cannot bypass the
         // generation/active-pointer transaction.
@@ -39136,6 +38788,14 @@ export async function settleSessionAttemptInterruptions(
               interruptions.map((interruption) => interruption.id),
             ),
           );
+        await enqueueSessionWorkflowWakeInTransaction(tx as unknown as Database, {
+          accountId: session.accountId,
+          workspaceId,
+          sessionId,
+          temporalWorkflowId: session.temporalWorkflowId ?? `session-${sessionId}`,
+          reason: "attempt_interruption_rejected_stale",
+          controlRequested: true,
+        });
         return {
           action: effectiveControl.state === "paused" ? "paused" : "continue",
           events: [],
@@ -39327,6 +38987,14 @@ export async function settleSessionAttemptInterruptions(
             interruptions.map((interruption) => interruption.id),
           ),
         );
+      await enqueueSessionWorkflowWakeInTransaction(tx as unknown as Database, {
+        accountId: session.accountId,
+        workspaceId,
+        sessionId,
+        temporalWorkflowId: session.temporalWorkflowId ?? `session-${sessionId}`,
+        reason: "attempt_interruption_settled",
+        controlRequested: true,
+      });
       return {
         action: effectiveControl.state === "paused" ? "paused" : "continue",
         events: [...closedTools.events, ...eventRows.map(mapEvent)],
@@ -39355,6 +39023,50 @@ export type SessionWorkPeek =
   | { kind: "cancellation-wait"; attemptId: string }
   | { kind: "idle" };
 
+/**
+ * Return the oldest exact attempt whose logical interruption settled but whose
+ * physical quiescence receipt is still missing. This deliberately searches all
+ * attempts: a provider-recovery race can create a newer generation before the
+ * predecessor receipt is reconciled, and looking only at the newest attempt
+ * would strand the replacement forever.
+ */
+async function nextSessionAttemptAwaitingQuiescence(
+  db: Database,
+  workspaceId: string,
+  sessionId: string,
+): Promise<{
+  attemptId: string;
+} | null> {
+  const [row] = await db
+    .select({
+      attemptId: schema.sessionTurnAttempts.id,
+    })
+    .from(schema.sessionTurnAttempts)
+    .innerJoin(
+      schema.sessionAttemptInterruptions,
+      and(
+        eq(schema.sessionAttemptInterruptions.workspaceId, schema.sessionTurnAttempts.workspaceId),
+        eq(schema.sessionAttemptInterruptions.sessionId, schema.sessionTurnAttempts.sessionId),
+        eq(schema.sessionAttemptInterruptions.attemptId, schema.sessionTurnAttempts.id),
+      ),
+    )
+    .where(
+      and(
+        eq(schema.sessionTurnAttempts.workspaceId, workspaceId),
+        eq(schema.sessionTurnAttempts.sessionId, sessionId),
+        eq(schema.sessionTurnAttempts.state, "closed"),
+        isNull(schema.sessionTurnAttempts.quiescedAt),
+        inArray(schema.sessionAttemptInterruptions.state, ["settled", "rejected_stale"]),
+      ),
+    )
+    .orderBy(
+      asc(schema.sessionAttemptInterruptions.requestedAt),
+      asc(schema.sessionAttemptInterruptions.id),
+    )
+    .limit(1);
+  return row ?? null;
+}
+
 async function latestSessionAttemptInterruption(
   db: Database,
   workspaceId: string,
@@ -39402,6 +39114,43 @@ async function latestSessionAttemptInterruption(
     : null;
 }
 
+async function queuedSteerHasUnquiescedPredecessor(
+  db: Database,
+  workspaceId: string,
+  sessionId: string,
+  predecessorAttemptIds: string[],
+): Promise<boolean> {
+  if (predecessorAttemptIds.length === 0) return false;
+  const [row] = await db
+    .select({ attemptId: schema.sessionTurnAttempts.id })
+    .from(schema.sessionTurnAttempts)
+    .innerJoin(
+      schema.sessionAttemptInterruptions,
+      and(
+        eq(schema.sessionAttemptInterruptions.workspaceId, schema.sessionTurnAttempts.workspaceId),
+        eq(schema.sessionAttemptInterruptions.sessionId, schema.sessionTurnAttempts.sessionId),
+        eq(schema.sessionAttemptInterruptions.attemptId, schema.sessionTurnAttempts.id),
+      ),
+    )
+    .where(
+      and(
+        eq(schema.sessionTurnAttempts.workspaceId, workspaceId),
+        eq(schema.sessionTurnAttempts.sessionId, sessionId),
+        inArray(schema.sessionTurnAttempts.id, predecessorAttemptIds),
+        isNull(schema.sessionTurnAttempts.quiescedAt),
+        inArray(schema.sessionAttemptInterruptions.state, [
+          "pending",
+          "delivered",
+          "acknowledged",
+          "settled",
+          "rejected_stale",
+        ]),
+      ),
+    )
+    .limit(1);
+  return row !== undefined;
+}
+
 /** Read durable session state without reserving a turn-worker slot or mutating it. */
 export async function peekSessionWork(
   db: Database,
@@ -39445,19 +39194,15 @@ export async function peekSessionWork(
     }
     if (effectiveControl.state !== "active") return { kind: "idle" };
 
-    const latestInterruption = await latestSessionAttemptInterruption(
+    const awaitingQuiescence = await nextSessionAttemptAwaitingQuiescence(
       scopedDb,
       workspaceId,
       sessionId,
     );
-    if (
-      latestInterruption &&
-      latestInterruption.quiescedAt === null &&
-      latestInterruption.interruptionState === "settled"
-    ) {
+    if (awaitingQuiescence) {
       return {
         kind: "cancellation-wait",
-        attemptId: latestInterruption.attemptId,
+        attemptId: awaitingQuiescence.attemptId,
       };
     }
 
@@ -41315,6 +41060,7 @@ export type RequestSessionTurnRecoveryInput = {
   attemptId: string;
   reason: string;
   detail?: Record<string, unknown>;
+  providerRecoveryCount?: number;
   fromStatuses?: SessionTurnStatus[];
   providerArtifactInvalidation?: {
     codexCredentialId: string;
@@ -41368,6 +41114,25 @@ export async function requestSessionTurnRecovery(
         { workspaceControl: locks.control ?? undefined },
       );
       const turnStatus = (turn?.status as SessionTurnStatus | undefined) ?? null;
+      const [pendingInterruption] = attempt
+        ? await tx
+            .select({ id: schema.sessionAttemptInterruptions.id })
+            .from(schema.sessionAttemptInterruptions)
+            .where(
+              and(
+                eq(schema.sessionAttemptInterruptions.workspaceId, workspaceId),
+                eq(schema.sessionAttemptInterruptions.sessionId, input.sessionId),
+                eq(schema.sessionAttemptInterruptions.attemptId, input.attemptId),
+                inArray(schema.sessionAttemptInterruptions.state, [
+                  "pending",
+                  "delivered",
+                  "acknowledged",
+                ]),
+              ),
+            )
+            .limit(1)
+            .for("update")
+        : [];
       if (
         !locks.workspace ||
         !turn ||
@@ -41381,7 +41146,8 @@ export async function requestSessionTurnRecovery(
         effectiveControl.state !== "active" ||
         session.activeTurnId !== input.turnId ||
         !fromStatuses.includes(turnStatus as SessionTurnStatus) ||
-        turn.activeAttemptId !== input.attemptId
+        turn.activeAttemptId !== input.attemptId ||
+        pendingInterruption !== undefined
       ) {
         return {
           action: "stale" as const,
@@ -41392,6 +41158,12 @@ export async function requestSessionTurnRecovery(
       }
 
       const now = new Date();
+      if (
+        input.providerRecoveryCount !== undefined &&
+        (!Number.isSafeInteger(input.providerRecoveryCount) || input.providerRecoveryCount <= 0)
+      ) {
+        throw new Error("providerRecoveryCount must be a positive safe integer");
+      }
       let providerArtifactsInvalidated = 0;
       if (input.providerArtifactInvalidation) {
         const invalidatedHistory = await tx
@@ -41533,7 +41305,12 @@ export async function requestSessionTurnRecovery(
           cancelledBy: null,
           cancelReason: null,
           version: turn.version + 1,
-          metadata: metadataWithoutTurnDispatchAttempt(turn.metadata),
+          metadata: {
+            ...metadataWithoutTurnDispatchAttempt(turn.metadata),
+            ...(input.providerRecoveryCount !== undefined
+              ? { providerRecoveryCount: input.providerRecoveryCount }
+              : {}),
+          },
           updatedAt: now,
         })
         .where(
@@ -42142,12 +41919,25 @@ export async function getSessionQueueSnapshot(
         asc(schema.sessionSystemUpdates.createdAt),
         asc(schema.sessionSystemUpdates.id),
       );
+    const items = rows.map(mapSessionTurn);
     const latestInterruption = await latestSessionAttemptInterruption(
       scopedDb,
       workspaceId,
       sessionId,
     );
-    const items = rows.map(mapSessionTurn);
+    const queuedSteerPredecessorIds = items
+      .map((turn) => queuedSteerReplacementAttemptId(turn.metadata))
+      .filter((attemptId): attemptId is string => attemptId !== null);
+    const stoppingPreviousAttempt =
+      (latestInterruption !== null &&
+        latestInterruption.interruptionState !== "rejected_stale" &&
+        latestInterruption.quiescedAt === null) ||
+      (await queuedSteerHasUnquiescedPredecessor(
+        scopedDb,
+        workspaceId,
+        sessionId,
+        queuedSteerPredecessorIds,
+      ));
     const nextInputBatch = selectBoundedSystemUpdateBatch(pendingInputs);
     const hasPendingAgentSteer = pendingInputs.some(
       (update) => update.kind === "agent_steer_instruction",
@@ -42159,10 +41949,7 @@ export async function getSessionQueueSnapshot(
       version: session.queueVersion,
       effectiveControl: serializeEffectiveSessionControl(effectiveControl),
       activePersonalConnections,
-      stoppingPreviousAttempt:
-        latestInterruption !== null &&
-        latestInterruption.interruptionState !== "rejected_stale" &&
-        latestInterruption.quiescedAt === null,
+      stoppingPreviousAttempt,
       items,
       pendingInputs: pendingInputs.map((update) => {
         const canonical = mapSessionSystemUpdate(update);
@@ -42201,7 +41988,9 @@ function queuedSteerReplacementAttemptId(metadata: Record<string, unknown>): str
   ) {
     return attemptId;
   }
-  throw new SessionControlInvariantError("Queued Steer has malformed predecessor metadata");
+  // The interruption ledger is authoritative. Historical or malformed display
+  // metadata must not make the read-only queue projection fail.
+  return null;
 }
 
 async function enqueueFailedChildOutboxForTurnTx(
@@ -42418,6 +42207,7 @@ export async function enqueueSessionWorkflowWakeInTransaction(
     temporalWorkflowId: string;
     reason: string;
     notBefore?: Date;
+    controlRequested?: boolean;
   },
 ): Promise<number> {
   const now = new Date();
@@ -42429,6 +42219,7 @@ export async function enqueueSessionWorkflowWakeInTransaction(
       workspaceId: input.workspaceId,
       sessionId: input.sessionId,
       temporalWorkflowId: input.temporalWorkflowId,
+      controlRevision: input.controlRequested ? 1 : 0,
       reason: input.reason,
       nextAttemptAt,
     })
@@ -42437,6 +42228,9 @@ export async function enqueueSessionWorkflowWakeInTransaction(
       set: {
         temporalWorkflowId: input.temporalWorkflowId,
         wakeRevision: sql`${schema.sessionWorkflowWakeOutbox.wakeRevision} + 1`,
+        controlRevision: input.controlRequested
+          ? sql`${schema.sessionWorkflowWakeOutbox.wakeRevision} + 1`
+          : sql`${schema.sessionWorkflowWakeOutbox.controlRevision}`,
         reason: input.reason,
         attempts: 0,
         // Coalescing a delayed retry must never postpone an already-due wake
@@ -42462,6 +42256,7 @@ export async function enqueueSessionWorkflowWake(
     temporalWorkflowId: string;
     reason: string;
     notBefore?: Date;
+    controlRequested?: boolean;
   },
 ): Promise<number> {
   return await withRlsContext(
@@ -42485,6 +42280,7 @@ export async function enqueueSessionWorkflowWakeIfRunnable(
     temporalWorkflowId: string;
     reason: string;
     notBefore?: Date;
+    controlRequested?: boolean;
   },
 ): Promise<number | null> {
   return await withRlsContext(
@@ -44686,6 +44482,7 @@ function mapSocialConnection(
     accountHandle: row.accountHandle,
     accountName: row.accountName,
     externalAccountId: row.externalAccountId,
+    ownership: row.subjectId ? "personal" : "workspace",
     status: row.status as SocialConnectionStatus,
     scopes: row.scopes,
     credentialRef: row.credentialRef,
@@ -44696,6 +44493,25 @@ function mapSocialConnection(
   };
 }
 
+function socialConnectionSubjectVisibility(subjectId?: string | null): SQL {
+  return subjectId
+    ? or(
+        isNull(schema.socialConnections.subjectId),
+        eq(schema.socialConnections.subjectId, subjectId),
+      )!
+    : isNull(schema.socialConnections.subjectId);
+}
+async function withSocialConnectionSubjectRls<T>(
+  db: Database,
+  workspaceId: string,
+  subjectId: string | null | undefined,
+  fn: (db: Database) => Promise<T>,
+): Promise<T> {
+  return subjectId
+    ? await withWorkspaceSubjectRls(db, workspaceId, subjectId, fn)
+    : await withWorkspaceRls(db, workspaceId, fn);
+}
+
 function mapApiKey(row: typeof schema.apiKeys.$inferSelect): ApiKey {
   return {
     id: row.id,
@@ -44904,11 +44720,118 @@ function shortHash(value: string): string {
   return (hash >>> 0).toString(36).padStart(7, "0").slice(0, 7);
 }
 
-// Shared, refreshing, id-addressed Codex token resolver + the per-account usage
-// wrapper (P2). Placed at the END so every accessor it orchestrates
-// (loadCodexCredentialForRun / recordCodexTokenRefresh / setCodexCredentialStatus /
-// recordCodexAccountUsage) is already initialized when its default-deps bag
-// evaluates under the index↔resolver module cycle.
-export * from "./codex-token-resolver";
-export * from "./connection-token-resolver";
+// The resolver modules are cycle-free orchestration leaves. The root barrel is
+// the composition point that supplies their existing persistence accessors while
+// retaining the historical public builder/fetcher signatures.
+function codexAuthDeps(): CodexAuthDeps {
+  return {
+    loadCredential: loadCodexCredentialForRun,
+    recordRefresh: recordCodexTokenRefresh,
+    setStatus: setCodexCredentialStatus,
+    refresh: refreshCodexToken,
+    encrypt: encryptEnvironmentValue,
+    keyBytes: environmentsEncryptionKeyBytes,
+    withRefreshLock: withCodexCredentialRefreshLock,
+    recordUsage: recordCodexAccountUsage,
+  };
+}
+
+function connectionBrokerDeps(): ConnectionBrokerDeps {
+  return {
+    loadCredential: loadConnectionCredentialForBroker,
+    recordRefresh: recordConnectionTokenRefresh,
+    setStatus: setConnectionStatus,
+    recordUsed: recordConnectionUsed,
+    refresh: refreshOAuthConnectionCredentialCore,
+    encrypt: encryptEnvironmentValue,
+    keyBytes: environmentsEncryptionKeyBytes,
+    now: () => new Date(),
+  };
+}
+
+export function buildCodexTokenResolver(
+  db: Database,
+  settings: Settings,
+  workspaceId: string,
+  credentialId: string,
+  deps: CodexAuthDeps = codexAuthDeps(),
+): ReturnType<typeof buildCodexTokenResolverCore> {
+  return buildCodexTokenResolverCore(db, settings, workspaceId, credentialId, deps);
+}
+
+export async function fetchCodexUsageForAccount(
+  db: Database,
+  settings: Settings,
+  workspaceId: string,
+  credentialId: string,
+  fetchImpl: CodexFetch = fetch,
+): ReturnType<typeof fetchCodexUsageForAccountCore> {
+  return await fetchCodexUsageForAccountCore(
+    db,
+    settings,
+    workspaceId,
+    credentialId,
+    codexAuthDeps(),
+    fetchImpl,
+  );
+}
+
+export async function fetchCodexRateLimitResetCreditsForAccount(
+  db: Database,
+  settings: Settings,
+  workspaceId: string,
+  credentialId: string,
+  fetchImpl: CodexFetch = fetch,
+): ReturnType<typeof fetchCodexRateLimitResetCreditsForAccountCore> {
+  return await fetchCodexRateLimitResetCreditsForAccountCore(
+    db,
+    settings,
+    workspaceId,
+    credentialId,
+    codexAuthDeps(),
+    fetchImpl,
+  );
+}
+
+export function buildConnectionTokenResolver(
+  db: Database,
+  settings: Settings,
+  deps: ConnectionBrokerDeps = connectionBrokerDeps(),
+  options: ConnectionTokenResolverOptions = {},
+): ReturnType<typeof buildConnectionTokenResolverCore> {
+  return buildConnectionTokenResolverCore(db, settings, deps, options);
+}
+
+export {
+  withCodexTokenDeadline,
+  type CodexAccountUsageSnapshot,
+  type CodexAuthDeps,
+  type CodexCredentialForRun,
+  type CodexCredentialTokens,
+  type CodexRateLimitResetCreditsAccountResult,
+  type CodexTokenDeadlineClock,
+  type CodexTokenDeadlineOptions,
+} from "./codex-token-resolver";
+
+export {
+  buildHostConnectionTokenResolver,
+  ConnectionRefreshHttpError,
+  HostMcpCredentialBindingError,
+  HostMcpCredentialScopeError,
+  isPrivateAddress,
+  normalizeBearerScheme,
+  refreshOAuthConnectionCredential,
+  type ConnectionBrokerDeps,
+  type ConnectionCredentialForBroker,
+  type ConnectionCredentialLookupInput,
+  type ConnectionStatusGuard,
+  type ConnectionTokenRefreshInput,
+  type ConnectionTokenResolverOptions,
+  type HostMcpCredentialResolverContext,
+  type PermanentConnectionRefreshFailure,
+  type RefreshTransportOptions,
+  type ResolveConnectionCredentialInput,
+  type ResolveConnectionCredentialResult,
+} from "./connection-token-resolver";
+
 export * from "./workspace-artifacts";