@opengeni/db 0.27.9 → 0.27.11

package/dist/index.js

@@ -5,6 +5,7 @@ import {
   billingCustomers,
   capabilityCatalogItems,
   capabilityInstallations,
+  codexAppsSettings,
   codexCapacityWaiters,
   codexCredentialLeases,
   codexResetRedemptionAttempts,
@@ -114,7 +115,7 @@ import {
   workspaceVariableSetVariables,
   workspaceVariableSets,
   workspaces
-} from "./chunk-NX2JNJJP.js";
+} from "./chunk-JYQPJ6Y5.js";
 import {
   migrate,
   runMigrations
@@ -134,7 +135,7 @@ import {
   inspectRuntimeDatabasePosture,
   provisionRoles,
   runtimeDatabaseReadyCheck
-} from "./chunk-2JFRTKTG.js";
+} from "./chunk-RPHPNVWW.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/index.ts
@@ -20451,11 +20452,10 @@ async function upsertCodexSubscriptionCredential(db, input) {
           // it when still null) so a re-connect never clobbers a rename.
           accountEmail: input.accountEmail ?? null,
           label: sql15`coalesce(${codexSubscriptionCredentials.label}, ${input.label ?? null})`,
-          // Ownership follows the most recent connection exactly. A
-          // configured/delegated/API-key reconnect is intentionally
-          // nonhuman and clears the prior human owner, making the row
-          // view-only until a direct managed-cookie human reconnects it.
-          connectedBySubjectId: input.connectedBySubjectId ?? null,
+          // Reconnect refreshes credential material, never ownership. A row
+          // without an owner may be claimed by its first direct managed human;
+          // after that, disconnect is the explicit ownership-reset boundary.
+          connectedBySubjectId: sql15`coalesce(${codexSubscriptionCredentials.connectedBySubjectId}, ${input.connectedBySubjectId ?? null})`,
           status: "active",
           lastError: null,
           version: sql15`${codexSubscriptionCredentials.version} + 1`,
@@ -20474,6 +20474,198 @@ async function upsertCodexSubscriptionCredential(db, input) {
     }
   );
 }
+async function getCodexAppsSettings(db, workspaceId) {
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const [row] = await scopedDb.select({
+      credentialId: codexAppsSettings.credentialId,
+      version: codexAppsSettings.version,
+      designatedAt: codexAppsSettings.designatedAt
+    }).from(codexAppsSettings).where(eq18(codexAppsSettings.workspaceId, workspaceId)).limit(1);
+    return row ?? { credentialId: null, version: 0, designatedAt: null };
+  });
+}
+function canManageCodexApps(permissions) {
+  return Array.isArray(permissions) && (permissions.includes("connections:write") || permissions.includes("workspace:admin"));
+}
+var CodexAppsAuthorizationRevokedError = class extends Error {
+  constructor() {
+    super("Codex Apps authorization is no longer active");
+    this.name = "CodexAppsAuthorizationRevokedError";
+  }
+};
+async function getCodexAppsCredentialAuthorizationForRun(db, workspaceId) {
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const [row] = await scopedDb.select({
+      credentialId: codexAppsSettings.credentialId,
+      ownerSubjectId: codexSubscriptionCredentials.connectedBySubjectId
+    }).from(codexAppsSettings).innerJoin(
+      codexSubscriptionCredentials,
+      and17(
+        eq18(codexSubscriptionCredentials.id, codexAppsSettings.credentialId),
+        eq18(codexSubscriptionCredentials.accountId, codexAppsSettings.accountId),
+        eq18(codexSubscriptionCredentials.workspaceId, workspaceId),
+        eq18(codexSubscriptionCredentials.status, "active")
+      )
+    ).where(eq18(codexAppsSettings.workspaceId, workspaceId)).limit(1);
+    return row?.credentialId && row.ownerSubjectId ? { credentialId: row.credentialId, ownerSubjectId: row.ownerSubjectId } : null;
+  });
+}
+async function withCodexAppsRequestAuthorization(db, input, use) {
+  return await withWorkspaceRls(db, input.workspaceId, async (scopedDb) => {
+    await scopedDb.execute(
+      sql15`select pg_advisory_xact_lock(hashtextextended(${`codex-apps-settings:${input.workspaceId}`}, 0))`
+    );
+    const [designation] = await scopedDb.select({ credentialId: codexAppsSettings.credentialId }).from(codexAppsSettings).where(eq18(codexAppsSettings.workspaceId, input.workspaceId)).for("share").limit(1);
+    if (designation?.credentialId !== input.credentialId) {
+      throw new CodexAppsAuthorizationRevokedError();
+    }
+    const [credential] = await scopedDb.select({
+      ownerSubjectId: codexSubscriptionCredentials.connectedBySubjectId,
+      status: codexSubscriptionCredentials.status
+    }).from(codexSubscriptionCredentials).where(
+      and17(
+        eq18(codexSubscriptionCredentials.workspaceId, input.workspaceId),
+        eq18(codexSubscriptionCredentials.id, input.credentialId)
+      )
+    ).for("share").limit(1);
+    if (!credential?.ownerSubjectId || credential.status !== "active") {
+      throw new CodexAppsAuthorizationRevokedError();
+    }
+    const [membership] = await scopedDb.select({ permissions: workspaceMemberships.permissions }).from(workspaceMemberships).where(
+      and17(
+        eq18(workspaceMemberships.workspaceId, input.workspaceId),
+        eq18(workspaceMemberships.subjectId, credential.ownerSubjectId)
+      )
+    ).for("share").limit(1);
+    if (!canManageCodexApps(membership?.permissions)) {
+      throw new CodexAppsAuthorizationRevokedError();
+    }
+    return await use();
+  });
+}
+async function designateCodexAppsCredential(db, input) {
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      await scopedDb.execute(
+        sql15`select pg_advisory_xact_lock(hashtextextended(${`codex-apps-settings:${input.workspaceId}`}, 0))`
+      );
+      const [currentRow] = await scopedDb.select().from(codexAppsSettings).where(eq18(codexAppsSettings.workspaceId, input.workspaceId)).for("update").limit(1);
+      const current = currentRow ? {
+        credentialId: currentRow.credentialId,
+        version: currentRow.version,
+        designatedAt: currentRow.designatedAt
+      } : { credentialId: null, version: 0, designatedAt: null };
+      if (current.version !== input.expectedVersion) return { kind: "conflict", ...current };
+      if (current.credentialId !== null) return { kind: "already_designated", ...current };
+      const [credential] = await scopedDb.select({
+        connectedBySubjectId: codexSubscriptionCredentials.connectedBySubjectId,
+        status: codexSubscriptionCredentials.status
+      }).from(codexSubscriptionCredentials).where(
+        and17(
+          eq18(codexSubscriptionCredentials.accountId, input.accountId),
+          eq18(codexSubscriptionCredentials.workspaceId, input.workspaceId),
+          eq18(codexSubscriptionCredentials.id, input.credentialId)
+        )
+      ).for("update").limit(1);
+      if (!credential) return { kind: "not_found" };
+      if (credential.connectedBySubjectId !== input.subjectId) return { kind: "not_owner" };
+      if (credential.status !== "active") return { kind: "unavailable" };
+      const [membership] = await scopedDb.select({ permissions: workspaceMemberships.permissions }).from(workspaceMemberships).where(
+        and17(
+          eq18(workspaceMemberships.accountId, input.accountId),
+          eq18(workspaceMemberships.workspaceId, input.workspaceId),
+          eq18(workspaceMemberships.subjectId, input.subjectId)
+        )
+      ).for("update").limit(1);
+      if (!canManageCodexApps(membership?.permissions)) return { kind: "forbidden" };
+      const now = /* @__PURE__ */ new Date();
+      const version = current.version + 1;
+      const [updated] = await scopedDb.insert(codexAppsSettings).values({
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        credentialId: input.credentialId,
+        version,
+        designatedAt: now,
+        updatedAt: now
+      }).onConflictDoUpdate({
+        target: codexAppsSettings.workspaceId,
+        set: {
+          credentialId: input.credentialId,
+          version,
+          designatedAt: now,
+          updatedAt: now
+        }
+      }).returning({
+        credentialId: codexAppsSettings.credentialId,
+        version: codexAppsSettings.version,
+        designatedAt: codexAppsSettings.designatedAt
+      });
+      if (!updated?.credentialId || !updated.designatedAt) {
+        throw new Error("Codex Apps designation was not persisted");
+      }
+      await scopedDb.insert(auditEvents).values({
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        subjectId: input.subjectId,
+        action: "codex_apps.designated",
+        targetType: "codex_subscription_credential",
+        targetId: input.credentialId,
+        metadata: { version }
+      });
+      return { kind: "updated", ...updated };
+    }
+  );
+}
+async function clearCodexAppsCredential(db, input) {
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      await scopedDb.execute(
+        sql15`select pg_advisory_xact_lock(hashtextextended(${`codex-apps-settings:${input.workspaceId}`}, 0))`
+      );
+      const [row] = await scopedDb.select().from(codexAppsSettings).where(eq18(codexAppsSettings.workspaceId, input.workspaceId)).for("update").limit(1);
+      const current = row ? { credentialId: row.credentialId, version: row.version, designatedAt: row.designatedAt } : { credentialId: null, version: 0, designatedAt: null };
+      const [membership] = await scopedDb.select({ permissions: workspaceMemberships.permissions }).from(workspaceMemberships).where(
+        and17(
+          eq18(workspaceMemberships.accountId, input.accountId),
+          eq18(workspaceMemberships.workspaceId, input.workspaceId),
+          eq18(workspaceMemberships.subjectId, input.subjectId)
+        )
+      ).for("update").limit(1);
+      if (!canManageCodexApps(membership?.permissions)) {
+        return { kind: "forbidden", ...current };
+      }
+      if (current.version !== input.expectedVersion) return { kind: "conflict", ...current };
+      if (current.credentialId === null) return { kind: "unchanged", ...current };
+      const now = /* @__PURE__ */ new Date();
+      const version = current.version + 1;
+      const [updated] = await scopedDb.update(codexAppsSettings).set({
+        credentialId: null,
+        version,
+        designatedAt: null,
+        updatedAt: now
+      }).where(eq18(codexAppsSettings.workspaceId, input.workspaceId)).returning({
+        credentialId: codexAppsSettings.credentialId,
+        version: codexAppsSettings.version,
+        designatedAt: codexAppsSettings.designatedAt
+      });
+      if (!updated) throw new Error("Codex Apps designation clear was not persisted");
+      await scopedDb.insert(auditEvents).values({
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        subjectId: input.subjectId,
+        action: "codex_apps.cleared",
+        targetType: "codex_subscription_credential",
+        targetId: current.credentialId,
+        metadata: { version }
+      });
+      return { kind: "updated", ...updated };
+    }
+  );
+}
 async function loadCodexCredentialForRun(db, settings, workspaceId, credentialId) {
   const key = environmentsEncryptionKeyBytes(settings);
   if (!key) {
@@ -20708,8 +20900,6 @@ function mapCodexLeaseCandidate(row, activeCredentialId) {
     secondaryResetAt: codexMetadataDate(row.secondary_reset_at),
     usageCheckedAt: codexMetadataDate(row.usage_checked_at),
     exhaustedUntil: codexMetadataDate(row.exhausted_until),
-    connectorNamespaces: row.connector_namespaces,
-    connectorsCheckedAt: codexMetadataDate(row.connectors_checked_at),
     selectionCount: Number(row.selection_count),
     lastSelectedAt: codexMetadataDate(row.last_selected_at),
     activeLeaseCount: Number(row.active_lease_count)
@@ -20750,8 +20940,6 @@ async function listCodexLeaseCandidatesInTransaction(tx, input) {
       c.secondary_reset_at,
       c.usage_checked_at,
       c.exhausted_until,
-      c.connector_namespaces,
-      c.connectors_checked_at,
       c.selection_count,
       c.last_selected_at,
       count(l.id) filter (
@@ -20809,18 +20997,6 @@ async function acquireCodexCredentialLease(db, input, select) {
         throw new Error(`Session turn not found for Codex lease: ${input.turnId}`);
       }
       const policyScope = input.resolvePolicyScope?.(turns[0].metadata ?? {}) ?? null;
-      const continuationRows = input.continuationCredentialId ? await tx.execute(
-        sql15`
-              select frozen_codex_credential_id
-              from agent_run_states
-              where account_id = ${input.accountId}
-                and workspace_id = ${input.workspaceId}
-                and turn_id = ${input.turnId}
-              order by state_version desc
-              limit 1
-            `
-      ) : [];
-      const validatedContinuationCredentialId = continuationRows[0]?.frozen_codex_credential_id === input.continuationCredentialId ? input.continuationCredentialId : null;
       const activeCredentialId = settingsRow.active_credential_id;
       const rotationEnabled = settingsRow.rotation_enabled;
       const leaseRotationEnabled = settingsRow.rotation_enabled && settingsRow.lease_rotation_enabled;
@@ -20847,7 +21023,7 @@ async function acquireCodexCredentialLease(db, input, select) {
         activeCredentialId,
         excludeTurnId: input.turnId
       });
-      const sameTurnCredentialId = existingCredentialId ?? validatedContinuationCredentialId;
+      const sameTurnCredentialId = existingCredentialId;
       const selectionContext = (accounts2, unavailableDiagnostics2) => ({
         accounts: accounts2,
         activeCredentialId,
@@ -20903,7 +21079,7 @@ async function acquireCodexCredentialLease(db, input, select) {
       if (!selectedAccount) {
         throw new Error("Codex lease selector returned a credential outside the workspace pool");
       }
-      if (!selectedAccount.allocatorEnabled && selectedAccount.id !== existingCredentialId && selectedAccount.id !== validatedContinuationCredentialId) {
+      if (!selectedAccount.allocatorEnabled && selectedAccount.id !== existingCredentialId) {
         throw new Error("Codex lease selector returned a credential disabled for new allocations");
       }
       const advanceActivePointer = input.advanceActivePointer && selected.advanceActivePointer !== false;
@@ -21816,10 +21992,7 @@ async function listCodexAccountStatuses(db, workspaceId) {
       secondaryUsedPercent: codexSubscriptionCredentials.secondaryUsedPercent,
       secondaryResetAt: codexSubscriptionCredentials.secondaryResetAt,
       usageCheckedAt: codexSubscriptionCredentials.usageCheckedAt,
-      exhaustedUntil: codexSubscriptionCredentials.exhaustedUntil,
-      // P4 connector-set cache — metadata-only, rides along on this read.
-      connectorNamespaces: codexSubscriptionCredentials.connectorNamespaces,
-      connectorsCheckedAt: codexSubscriptionCredentials.connectorsCheckedAt
+      exhaustedUntil: codexSubscriptionCredentials.exhaustedUntil
     }).from(codexSubscriptionCredentials).where(eq18(codexSubscriptionCredentials.workspaceId, workspaceId)).orderBy(
       asc8(codexSubscriptionCredentials.createdAt),
       asc8(codexSubscriptionCredentials.id)
@@ -21834,7 +22007,6 @@ async function listCodexAccountStatuses(db, workspaceId) {
       secondaryResetAt: codexMetadataDate(row.secondaryResetAt),
       usageCheckedAt: codexMetadataDate(row.usageCheckedAt),
       exhaustedUntil: codexMetadataDate(row.exhaustedUntil),
-      connectorsCheckedAt: codexMetadataDate(row.connectorsCheckedAt),
       isActive: row.id === activeId
     }));
   });
@@ -22552,23 +22724,6 @@ async function countConsecutiveReactiveRotations(db, workspaceId, sessionId) {
     return Number(rotated);
   });
 }
-async function recordCodexAccountConnectors(db, workspaceId, credentialId, namespaces) {
-  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    const updated = await scopedDb.update(codexSubscriptionCredentials).set({
-      connectorNamespaces: namespaces,
-      connectorsCheckedAt: /* @__PURE__ */ new Date()
-      // NB: no `version` bump and no `updatedAt` touch — connector set is non-credential
-      // metadata and must NOT race the (id, version) refresh CAS (same discipline as
-      // recordCodexAccountUsage / setCodexCredentialExhausted).
-    }).where(
-      and17(
-        eq18(codexSubscriptionCredentials.id, credentialId),
-        eq18(codexSubscriptionCredentials.workspaceId, workspaceId)
-      )
-    ).returning({ id: codexSubscriptionCredentials.id });
-    return updated.length > 0;
-  });
-}
 var CODEX_ROTATION_STRATEGIES = [
   "most_remaining",
   "round_robin",
@@ -22667,14 +22822,21 @@ async function recordSessionActiveCodexCredential(db, workspaceId, sessionId, cr
     await scopedDb.update(sessions).set({ codexLastCredentialId: credentialId, updatedAt: /* @__PURE__ */ new Date() }).where(and17(eq18(sessions.workspaceId, workspaceId), eq18(sessions.id, sessionId)));
   });
 }
-async function disconnectCodexAccount(db, workspaceId, credentialId) {
+async function disconnectCodexAccount(db, workspaceId, credentialId, actorSubjectId = null) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
     await scopedDb.execute(sql15`
       select id from codex_rotation_settings
       where workspace_id = ${workspaceId}
       for update
     `);
-    const [credential] = await scopedDb.select({ id: codexSubscriptionCredentials.id }).from(codexSubscriptionCredentials).where(
+    await scopedDb.execute(
+      sql15`select pg_advisory_xact_lock(hashtextextended(${`codex-apps-settings:${workspaceId}`}, 0))`
+    );
+    const [appsSettings] = await scopedDb.select().from(codexAppsSettings).where(eq18(codexAppsSettings.workspaceId, workspaceId)).for("update").limit(1);
+    const [credential] = await scopedDb.select({
+      id: codexSubscriptionCredentials.id,
+      accountId: codexSubscriptionCredentials.accountId
+    }).from(codexSubscriptionCredentials).where(
       and17(
         eq18(codexSubscriptionCredentials.id, credentialId),
         eq18(codexSubscriptionCredentials.workspaceId, workspaceId)
@@ -22704,6 +22866,24 @@ async function disconnectCodexAccount(db, workspaceId, credentialId) {
         blockedByUnresolvedRedemption: true
       };
     }
+    if (appsSettings?.credentialId === credentialId) {
+      const version = appsSettings.version + 1;
+      await scopedDb.update(codexAppsSettings).set({
+        credentialId: null,
+        version,
+        designatedAt: null,
+        updatedAt: /* @__PURE__ */ new Date()
+      }).where(eq18(codexAppsSettings.id, appsSettings.id));
+      await scopedDb.insert(auditEvents).values({
+        accountId: credential.accountId,
+        workspaceId,
+        subjectId: actorSubjectId,
+        action: "codex_apps.cleared_on_disconnect",
+        targetType: "codex_subscription_credential",
+        targetId: credentialId,
+        metadata: { version }
+      });
+    }
     const removedRows = await scopedDb.delete(codexSubscriptionCredentials).where(
       and17(
         eq18(codexSubscriptionCredentials.id, credentialId),
@@ -22735,9 +22915,16 @@ async function disconnectCodexAccount(db, workspaceId, credentialId) {
     };
   });
 }
-async function disconnectAllCodexAccounts(db, workspaceId) {
+async function disconnectAllCodexAccounts(db, workspaceId, actorSubjectId = null) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    const credentials = await scopedDb.select({ id: codexSubscriptionCredentials.id }).from(codexSubscriptionCredentials).where(eq18(codexSubscriptionCredentials.workspaceId, workspaceId)).orderBy(asc8(codexSubscriptionCredentials.id)).for("update");
+    await scopedDb.execute(
+      sql15`select pg_advisory_xact_lock(hashtextextended(${`codex-apps-settings:${workspaceId}`}, 0))`
+    );
+    const [appsSettings] = await scopedDb.select().from(codexAppsSettings).where(eq18(codexAppsSettings.workspaceId, workspaceId)).for("update").limit(1);
+    const credentials = await scopedDb.select({
+      id: codexSubscriptionCredentials.id,
+      accountId: codexSubscriptionCredentials.accountId
+    }).from(codexSubscriptionCredentials).where(eq18(codexSubscriptionCredentials.workspaceId, workspaceId)).orderBy(asc8(codexSubscriptionCredentials.id)).for("update");
     if (credentials.length === 0) return { removed: 0, blockedCredentialIds: [] };
     const blocked = await scopedDb.selectDistinct({
       credentialId: codexResetRedemptionAttempts.credentialId
@@ -22753,6 +22940,24 @@ async function disconnectAllCodexAccounts(db, workspaceId) {
         blockedCredentialIds: blocked.map((row) => row.credentialId).sort()
       };
     }
+    if (appsSettings?.credentialId) {
+      const version = appsSettings.version + 1;
+      await scopedDb.update(codexAppsSettings).set({
+        credentialId: null,
+        version,
+        designatedAt: null,
+        updatedAt: /* @__PURE__ */ new Date()
+      }).where(eq18(codexAppsSettings.id, appsSettings.id));
+      await scopedDb.insert(auditEvents).values({
+        accountId: credentials[0].accountId,
+        workspaceId,
+        subjectId: actorSubjectId,
+        action: "codex_apps.cleared_on_disconnect",
+        targetType: "codex_subscription_credential",
+        targetId: appsSettings.credentialId,
+        metadata: { version }
+      });
+    }
     const rows = await scopedDb.delete(codexSubscriptionCredentials).where(eq18(codexSubscriptionCredentials.workspaceId, workspaceId)).returning({ id: codexSubscriptionCredentials.id });
     return { removed: rows.length, blockedCredentialIds: [] };
   });
@@ -23707,6 +23912,13 @@ async function lockSessionCreateIdempotencyKey(tx, workspaceId, createIdempotenc
     sql15`select pg_advisory_xact_lock(hashtext(${`session-create:${workspaceId}:${createIdempotencyKey}`}))`
   );
 }
+async function lockAgentSessionCreate(tx, input) {
+  const actorSessionId = input.createdByActor?.sessionId;
+  if (!actorSessionId) return;
+  await tx.execute(
+    sql15`select pg_advisory_xact_lock(hashtextextended(${`agent-session-create:${input.workspaceId}:${actorSessionId}`}, 0))`
+  );
+}
 async function existingSpawnDenialForKey(tx, workspaceId, createIdempotencyKey) {
   const [existing] = await tx.select().from(sessionSpawnDenials).where(
     and17(
@@ -23780,6 +23992,7 @@ async function createSessionInTransaction(tx, input, id) {
       };
     }
   }
+  await lockAgentSessionCreate(tx, input);
   const decision = await resolveSessionDepthDecision(tx, input, id, workspace, deploymentPolicy);
   if (decision.denied) {
     return {
@@ -25754,7 +25967,6 @@ async function getLatestRunState(db, workspaceId, sessionId) {
       turnId: row.turnId ?? null,
       serializedRunState: row.serializedRunState,
       pendingApprovals: row.pendingApprovals,
-      frozenCodexCredentialId: row.frozenCodexCredentialId ?? null,
       providerArtifactInvalidatedAt: row.providerArtifactInvalidatedAt ?? null
     } : null;
   });
@@ -26255,7 +26467,6 @@ async function appendSessionHistoryItems(db, input) {
             workspaceId: input.workspaceId,
             sessionId: input.sessionId,
             turnId: input.turnId,
-            producerCodexCredentialId: input.producerCodexCredentialId ?? null,
             position: entry.position,
             // This is the canonical model-memory boundary. The pending-call
             // ledger and audit event may retain their separate raw/preview
@@ -26497,9 +26708,9 @@ async function getSessionHistoryItems(db, workspaceId, sessionId) {
 async function getActiveSessionHistoryItems(db, workspaceId, sessionId) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
     const rows = await scopedDb.select({
+      id: sessionHistoryItems.id,
       position: sessionHistoryItems.position,
       item: sessionHistoryItems.item,
-      producerCodexCredentialId: sessionHistoryItems.producerCodexCredentialId,
       providerArtifactInvalidatedAt: sessionHistoryItems.providerArtifactInvalidatedAt
     }).from(sessionHistoryItems).where(
       and17(
@@ -26633,8 +26844,7 @@ async function applyContextCompaction(db, input) {
               turnId: null,
               position: supersededFrom + index,
               item: sanitizeModelPayload(item),
-              active: true,
-              ...input.producerCodexCredentialId ? { producerCodexCredentialId: input.producerCodexCredentialId } : {}
+              active: true
             }))
           );
         }
@@ -26646,8 +26856,7 @@ async function applyContextCompaction(db, input) {
           turnId: input.turnId,
           position: summaryPosition,
           item: sanitizeModelPayload(input.summaryItem),
-          active: true,
-          ...input.producerCodexCredentialId ? { producerCodexCredentialId: input.producerCodexCredentialId } : {}
+          active: true
         });
         const insertedEvents = input.eventPayload ? await tx.insert(sessionEvents).values({
           accountId: input.accountId,
@@ -33784,8 +33993,7 @@ async function saveRunState(db, input) {
           turnId: input.turnId,
           stateVersion: Number(maxVersion) + 1,
           serializedRunState: input.serializedRunState,
-          pendingApprovals: input.pendingApprovals,
-          frozenCodexCredentialId: input.frozenCodexCredentialId ?? null
+          pendingApprovals: input.pendingApprovals
         });
         return true;
       });
@@ -35621,8 +35829,7 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
           sessionId,
           turnId,
           position: Number(position),
-          item: sanitizeModelPayload(delivered2.historyItem),
-          producerCodexCredentialId: null
+          item: sanitizeModelPayload(delivered2.historyItem)
         });
       };
       const workspaceControl = await lockWorkspaceInferenceControl(
@@ -36408,8 +36615,7 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
         item: durableUserHistoryItem(
           row.prompt,
           Array.isArray(row.resources) ? row.resources : []
-        ),
-        producerCodexCredentialId: null
+        )
       });
       const providerDelegatedTurn = isSessionRealtimeDelegationTurnMetadata(row.metadata);
       const delivered = providerDelegatedTurn ? {
@@ -37625,8 +37831,7 @@ async function applySessionTurnSettlement(db, workspaceId, input, hooks = {}) {
           turnId: input.turnId,
           stateVersion: Number(maxVersion) + 1,
           serializedRunState: input.runState.serializedRunState,
-          pendingApprovals: input.runState.pendingApprovals,
-          frozenCodexCredentialId: input.runState.frozenCodexCredentialId ?? null
+          pendingApprovals: input.runState.pendingApprovals
         });
         if (humanInputRequests.length > 0) {
           for (const request of humanInputRequests) {
@@ -38426,7 +38631,8 @@ async function requestSessionTurnRecovery(db, workspaceId, input) {
       }
       let providerArtifactsInvalidated = 0;
       if (input.providerArtifactInvalidation) {
-        const invalidatedHistory = await tx.update(sessionHistoryItems).set({
+        const historyItemIds = [...new Set(input.providerArtifactInvalidation.historyItemIds)];
+        const invalidatedHistory = historyItemIds.length > 0 ? await tx.update(sessionHistoryItems).set({
           providerArtifactInvalidatedAt: now,
           providerArtifactInvalidationReason: input.providerArtifactInvalidation.reason,
           providerArtifactInvalidatedByAttemptId: input.attemptId
@@ -38436,35 +38642,37 @@ async function requestSessionTurnRecovery(db, workspaceId, input) {
             eq18(sessionHistoryItems.workspaceId, workspaceId),
             eq18(sessionHistoryItems.sessionId, input.sessionId),
             eq18(sessionHistoryItems.active, true),
-            eq18(
-              sessionHistoryItems.producerCodexCredentialId,
-              input.providerArtifactInvalidation.codexCredentialId
-            ),
+            inArray11(sessionHistoryItems.id, historyItemIds),
             isNull6(sessionHistoryItems.providerArtifactInvalidatedAt),
-            sql15`${sessionHistoryItems.item} ->> 'type' in ('reasoning', 'compaction')`
+            sql15`${sessionHistoryItems.item} ->> 'type' in ('reasoning', 'compaction')`,
+            sql15`(
+                      nullif(${sessionHistoryItems.item} ->> 'encrypted_content', '') is not null
+                      or nullif(${sessionHistoryItems.item} ->> 'encryptedContent', '') is not null
+                      or nullif(${sessionHistoryItems.item} -> 'providerData' ->> 'encrypted_content', '') is not null
+                      or nullif(${sessionHistoryItems.item} -> 'providerData' ->> 'encryptedContent', '') is not null
+                    )`
           )
-        ).returning({ id: sessionHistoryItems.id });
-        const [latestRunState] = await tx.select({ id: agentRunStates.id }).from(agentRunStates).where(
-          and17(
-            eq18(agentRunStates.accountId, session.accountId),
-            eq18(agentRunStates.workspaceId, workspaceId),
-            eq18(agentRunStates.sessionId, input.sessionId),
-            eq18(agentRunStates.turnId, input.turnId),
-            eq18(
-              agentRunStates.frozenCodexCredentialId,
-              input.providerArtifactInvalidation.codexCredentialId
-            ),
-            isNull6(agentRunStates.providerArtifactInvalidatedAt)
-          )
-        ).orderBy(desc8(agentRunStates.stateVersion)).limit(1);
-        const invalidatedRunState = latestRunState ? await tx.update(agentRunStates).set({
+        ).returning({ id: sessionHistoryItems.id }) : [];
+        const invalidatedRunState = input.providerArtifactInvalidation.runStateId ? await tx.update(agentRunStates).set({
           providerArtifactInvalidatedAt: now,
           providerArtifactInvalidationReason: input.providerArtifactInvalidation.reason,
           providerArtifactInvalidatedByAttemptId: input.attemptId
         }).where(
           and17(
-            eq18(agentRunStates.id, latestRunState.id),
-            isNull6(agentRunStates.providerArtifactInvalidatedAt)
+            eq18(agentRunStates.accountId, session.accountId),
+            eq18(agentRunStates.workspaceId, workspaceId),
+            eq18(agentRunStates.sessionId, input.sessionId),
+            eq18(agentRunStates.turnId, input.turnId),
+            eq18(agentRunStates.id, input.providerArtifactInvalidation.runStateId),
+            isNull6(agentRunStates.providerArtifactInvalidatedAt),
+            sql15`${agentRunStates.stateVersion} = (
+                    select max(latest.state_version)
+                    from agent_run_states latest
+                    where latest.account_id = ${session.accountId}
+                      and latest.workspace_id = ${workspaceId}
+                      and latest.session_id = ${input.sessionId}
+                      and latest.turn_id = ${input.turnId}
+                  )`
           )
         ).returning({ id: agentRunStates.id }) : [];
         providerArtifactsInvalidated = invalidatedHistory.length + invalidatedRunState.length;
@@ -41040,6 +41248,7 @@ export {
   CODEX_CREDENTIAL_LEASE_TTL_MS,
   CODEX_RESET_REDEMPTION_OUTCOMES,
   CODEX_ROTATION_STRATEGIES,
+  CodexAppsAuthorizationRevokedError,
   ConnectionDisconnectGenerationError,
   ConnectionDisconnectIdempotencyError,
   ConnectionRefreshHttpError,
@@ -41244,6 +41453,7 @@ export {
   claimSlackInteractionProgressDelivery,
   claimTerminalRetainedProcesses,
   claimWorkspaceArchiveCapture,
+  clearCodexAppsCredential,
   clearDurablePendingSessionToolCalls,
   clearEnrollmentWentOffline,
   clearPendingSessionToolspaceCall,
@@ -41350,6 +41560,7 @@ export {
   deleteWorkspaceEnvironmentVariable,
   deleteWorkspacePack,
   denyDeviceEnrollmentRequest,
+  designateCodexAppsCredential,
   diffWorkspaceInstructionPolicyContent,
   diffWorkspaceInstructionPolicyRevisions,
   disableCapabilityInstallation,
@@ -41400,6 +41611,8 @@ export {
   getBillingCustomer,
   getCapabilityCatalogItem,
   getCapabilityInstallation,
+  getCodexAppsCredentialAuthorizationForRun,
+  getCodexAppsSettings,
   getCodexCapacityWaitForSession,
   getCodexCredentialStatus,
   getCodexResetRedemptionAttempt,
@@ -41671,7 +41884,6 @@ export {
   reconcileColdLostLeaseInstanceBlockers,
   reconcileSessionAttemptQuiescence,
   recordAuditEvent,
-  recordCodexAccountConnectors,
   recordCodexAccountUsage,
   recordCodexAccountUsageWithWakeTargets,
   recordCodexTokenRefresh,
@@ -41872,6 +42084,7 @@ export {
   verifyRetainedProcessMutationSettlement,
   verifyWorkspaceMutationSettlement,
   withAccountRls,
+  withCodexAppsRequestAuthorization,
   withCodexCapacityMutation,
   withCodexCredentialRefreshLock,
   withCodexTokenDeadline,