@opengeni/db 0.28.1 → 0.31.1

package/dist/index.d.ts

@@ -1,39 +1,50 @@
-import type { AccessContext, AccessGrant, AccessPrincipalKind, ApiKey, BillingBalance, CapabilityCatalogItem, CapabilityInstallation, CapabilityKind, CapabilityPack, CapabilitySource, ConnectionKind, ConnectionMetadata, ConnectionStatus, DocumentAuthorityKind, McpServerConnectionRef, FileAsset, FileUploadStatus, FirstPartyMcpToolName, HumanInputQuestion, HumanInputResponse, KnowledgeMemory, KnowledgeMemoryKind, KnowledgeMemoryStatus, KnowledgeSourceRef, GitHubInstallationAuthorityKind, GitHubRepositoryScope, HostEventExportBatch, HostUsageExportBatch, ManagedAccount, McpPersonalConnectionDelegation, Permission, PackInstallation, PackInstallationStatus, ResourceRef, SandboxBackend, SandboxOs, ScheduledTask, ScheduledTaskAgentConfig, ScheduledTaskOverlapPolicy, ScheduledTaskRun, ScheduledTaskRunMode, ScheduledTaskRunStatus, ScheduledTaskScheduleSpec, ScheduledTaskStatus, ScheduledTaskTriggerType, Session, SessionAuthorizationListScope, SessionListResponse, SessionEvent, SessionEventPayloadMode, SessionEventReadDirection, SessionEventSemanticClass, SessionEventType, SessionGoal, SessionGoalCreatedBy, SessionGoalStatus, SessionHumanInputRequest, LineageNode, SessionMcpApprovalPolicy, SessionSkill, SessionMcpServerMetadata, SessionStatus, SessionToolPolicy, SessionTurn, SessionQueueSnapshot, SessionSystemUpdate, SessionSystemUpdateKind, SystemUpdateClassification, SessionTurnSource, SessionTurnStatus, TurnInitiator, TurnInitiatorContext, SocialConnection, SocialConnectionStatus, SocialPost, SocialProvider, ToolRef, ReasoningEffort, UsageEvent, Workspace, WorkspaceControlEvent, VariableSet, VariableSetVariableMetadata, WorkspaceMember, WorkspaceRegisteredPack, Rig, RigVersion, RigChange, RigChangeKind, RigChangeStatus, RigCheck, NativeSnapshotDescriptor, TarWorkspaceArchiveDescriptor, WorkspaceArchiveDescriptor, ModalCheckpointProviderBinding } from "@opengeni/contracts";
+import type { AccessContext, AccessGrant, AccessPrincipalKind, ApiKey, AttemptToolResult, BillingBalance, CapabilityCatalogItem, CapabilityInstallation, CapabilityKind, CapabilityPack, CapabilitySource, ConnectionKind, ConnectionMetadata, ConnectionStatus, DocumentAuthorityKind, McpServerConnectionRef, FileAsset, FileUploadStatus, FirstPartyMcpToolName, HumanInputQuestion, HumanInputResponse, KnowledgeMemory, KnowledgeMemoryKind, KnowledgeMemoryStatus, KnowledgeSourceRef, GitHubInstallationAuthorityKind, GitHubRepositoryScope, HostEventExportBatch, HostUsageExportBatch, ManagedAccount, McpPersonalConnectionDelegation, Permission, PackInstallation, PackInstallationStatus, ResourceRef, SandboxBackend, SandboxOs, ScheduledTask, ScheduledTaskAction, ScheduledTaskActionKind, KnowledgeSourceSyncAction, ScheduledTaskAgentConfig, ScheduledTaskOverlapPolicy, ScheduledTaskRun, ScheduledTaskRunMode, ScheduledTaskRunStatus, ScheduledTaskScheduleSpec, ScheduledTaskStatus, ScheduledTaskTriggerType, SlackInstallationBinding, Session, SessionAuthorizationListScope, SessionListResponse, SessionEvent, SessionEventPayloadMode, SessionEventReadDirection, SessionEventSemanticClass, SessionEventType, SessionGoal, SessionGoalCreatedBy, SessionGoalStatus, SessionHumanInputRequest, LineageNode, SessionMcpApprovalPolicy, SessionSkill, SessionMcpServerMetadata, SessionStatus, SessionToolPolicy, SessionTurn, SessionQueueSnapshot, SessionSystemUpdate, SessionSystemUpdateKind, SystemUpdateClassification, SessionTurnSource, SessionTurnStatus, TurnInitiator, TurnInitiatorContext, SocialConnection, SocialConnectionStatus, SocialPost, SocialProvider, ToolRef, ReasoningEffort, UsageEvent, Workspace, WorkspaceControlEvent, VariableSet, VariableSetSecret, VariableSetVariableMetadata, WorkspaceMember, WorkspaceRegisteredPack, Rig, RigProviderImage, RigProviderImages, RigVersion, RigChange, RigChangeKind, RigChangeStatus, RigCheck, NativeSnapshotDescriptor, TarWorkspaceArchiveDescriptor, WorkspaceArchiveDescriptor, ModalCheckpointProviderBinding, SandboxProviderContinuityRecovery } from "@opengeni/contracts";
+import { type TimelineAnnotation } from "@opengeni/contracts";
 import { type LatencyMode, SessionSystemUpdatePayload, TurnExecutionPolicyV1 } from "@opengeni/contracts";
 import { type Settings } from "@opengeni/config";
 import { type CodexFetch } from "@opengeni/codex";
 export { isCodexBilledModel } from "@opengeni/codex";
 import { type SQL } from "drizzle-orm";
-export { frozenInitiatorForCommandActor, type FrozenTurnInitiator } from "./turn-initiator";
-import { type SessionDiscoveryControl, type SessionCommandActor, type SessionTurnAttemptOutcome } from "./session-control";
-import { type SessionRealtimeContinuityEntry } from "./session-realtime-context";
-import * as schema from "./schema";
+export { frozenInitiatorForCommandActor, type FrozenTurnInitiator } from "./turn-initiator.js";
+export { LOSSLESS_TEXT_PREFIX } from "./lossless-json.js";
+import { type SessionDiscoveryControl, type SessionCommandActor, type SessionTurnAttemptOutcome } from "./session-control.js";
+import { type SessionRealtimeContinuityEntry } from "./session-realtime-context.js";
+import * as schema from "./schema.js";
 export { sql as dbSql } from "drizzle-orm";
-export * from "./session-control";
-export * from "./session-queue-commands";
-export * from "./session-realtime";
-export * from "./session-realtime-context";
-export * from "./session-realtime-ledger";
-export * from "./new-session-drafts";
-export * from "./workspace-instruction-policies";
-export * from "./preference-registry";
-export * from "./memory-governance";
-export * from "./scoped-knowledge";
-export { interruptedToolCallResult } from "./session-tool-call-settlement";
-export { decryptEnvironmentValue, encryptEnvironmentValue } from "./environment-crypto";
-export { decryptEnvironmentValue as decryptVariableSetValue, encryptEnvironmentValue as encryptVariableSetValue, } from "./environment-crypto";
-export { sanitizeEventPayload, sanitizeEventString, sanitizeModelPayload, } from "./event-payload-sanitizer";
-export * from "./persistence-errors";
-export * from "./runtime-posture";
-export * from "./insights";
-export { sanitizeMemoryText } from "./memory-domain";
-export { migrate, runMigrations } from "./migrate";
-export { provisionRoles, type ProvisionResult, type ProvisionRolesOptions, } from "./provision-roles";
-export * from "./memory-domain";
-import { type Database } from "./database";
-export { createDb, registerDbBinding, rlsContextForWorkspace, rlsStrategyFor, setRlsContext, setSubjectRlsContext, withAccountRls, withDatabaseStatementTimeout, withRlsContext, withWorkspaceRls, withWorkspaceSubjectRls, withWorkspaceUsageLock, type CreateDbOptions, type Database, type DbClient, type RlsContext, type RlsStrategy, type UserLookup, } from "./database";
-import { buildCodexTokenResolver as buildCodexTokenResolverCore, fetchCodexRateLimitResetCreditsForAccount as fetchCodexRateLimitResetCreditsForAccountCore, fetchCodexUsageForAccount as fetchCodexUsageForAccountCore, type CodexAccountUsageSnapshot, type CodexAuthDeps, type CodexCredentialForRun } from "./codex-token-resolver";
-import { buildConnectionTokenResolver as buildConnectionTokenResolverCore, type ConnectionBrokerDeps, type ConnectionCredentialForBroker, type ConnectionTokenResolverOptions } from "./connection-token-resolver";
+export * from "./session-control.js";
+export * from "./session-queue-commands.js";
+export * from "./session-realtime.js";
+export * from "./session-realtime-context.js";
+export * from "./session-realtime-ledger.js";
+export * from "./new-session-drafts.js";
+export * from "./workspace-instruction-policies.js";
+export * from "./company-profile.js";
+export * from "./workspace-learning-policy.js";
+export * from "./preference-registry.js";
+export * from "./memory-governance.js";
+export * from "./memory-slack-delivery.js";
+export * from "./scoped-knowledge.js";
+export * from "./knowledge-source-sync.js";
+export * from "./generated-images.js";
+export * from "./slack-user-link-access.js";
+export * from "./video-generation.js";
+export { interruptedToolCallResult } from "./session-tool-call-settlement.js";
+export { decryptEnvironmentValue, encryptEnvironmentValue } from "./environment-crypto.js";
+export { decryptEnvironmentValue as decryptVariableSetValue, encryptEnvironmentValue as encryptVariableSetValue, } from "./environment-crypto.js";
+export * from "./persistence-errors.js";
+export * from "./runtime-posture.js";
+export * from "./capability-integrations.js";
+export * from "./integration-bindings.js";
+export * from "./integration-features.js";
+export * from "./insights.js";
+export { memoryTextForStorage } from "./memory-domain.js";
+export { migrate, runMigrations } from "./migrate.js";
+export { provisionRoles, type ProvisionResult, type ProvisionRolesOptions, } from "./provision-roles.js";
+export * from "./memory-domain.js";
+import { type Database, type SessionActivityDatabase } from "./database.js";
+export { createDb, registerDbBinding, retrySessionActivityRls, rlsContextForWorkspace, rlsStrategyFor, setRlsContext, setSubjectRlsContext, withAccountRls, withDatabaseStatementTimeout, withRlsContext, withSessionActivityRlsContext, withSessionActivitySavepoint, withWorkspaceRls, withWorkspaceSessionActivityRls, withWorkspaceSubjectRls, withWorkspaceSubjectSessionActivityRls, withWorkspaceUsageLock, withSandboxProviderReadLock, SandboxProviderReadLockUnavailableError, type CreateDbOptions, type Database, type DbClient, type SessionActivityDatabase, type RlsContext, type RlsStrategy, type SandboxProviderReadLockIdentity, type UserLookup, } from "./database.js";
+import { buildCodexTokenResolver as buildCodexTokenResolverCore, fetchCodexRateLimitResetCreditsForAccount as fetchCodexRateLimitResetCreditsForAccountCore, fetchCodexUsageForAccount as fetchCodexUsageForAccountCore, type CodexAccountUsageSnapshot, type CodexAuthDeps, type CodexCredentialForRun } from "./codex-token-resolver.js";
+import { buildConnectionTokenResolver as buildConnectionTokenResolverCore, type ConnectionBrokerDeps, type ConnectionCredentialForBroker, type ConnectionTokenResolverOptions } from "./connection-token-resolver.js";
 /** Raised when a durable session tool-policy write lost its version fence. */
 export declare class SessionToolPolicyVersionConflictError extends Error {
     readonly currentVersion: number;
@@ -287,6 +298,49 @@ export declare function removeWorkspaceMember(db: Database, workspaceId: string,
  */
 export declare function getManagedUserByEmail(db: Database, email: string): Promise<string | null>;
 export declare function deleteWorkspace(db: Database, workspaceId: string): Promise<void>;
+export type TemporalScheduleCleanupClaim = {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    temporalScheduleId: string;
+    claimId: string;
+    attemptCount: number;
+};
+export type DeleteWorkspaceIfQuiescentResult = {
+    status: "deleted";
+    temporalScheduleCleanups: TemporalScheduleCleanupClaim[];
+} | {
+    status: "not_found" | "only_workspace" | "active_sessions" | "active_video_generations" | "live_sandboxes";
+};
+/**
+ * Atomically prove a workspace has no live runtime ownership and delete it.
+ *
+ * The account/workspace parent locks block concurrent child inserts through
+ * their foreign-key key-share locks. Existing session and lease rows are then
+ * locked before their state is inspected, so a cold lease cannot become live
+ * between a preflight count and the cascade. Schedule ids are copied under the
+ * same fence and returned for post-commit Temporal cleanup.
+ */
+export declare function deleteWorkspaceIfQuiescent(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+}): Promise<DeleteWorkspaceIfQuiescentResult>;
+/** Claim a bounded cross-workspace batch after abandoned claims expire. */
+export declare function claimTemporalScheduleCleanups(db: Database, input: {
+    claimId: string;
+    limit?: number;
+    claimSeconds?: number;
+}): Promise<TemporalScheduleCleanupClaim[]>;
+/**
+ * Settle only the exact claimed cleanup. A null error acknowledges the
+ * idempotent external deletion and removes the durable receipt; an error
+ * releases it with bounded exponential backoff.
+ */
+export declare function settleTemporalScheduleCleanup(db: Database, input: {
+    id: string;
+    claimId: string;
+    error?: string | null;
+}): Promise<boolean>;
 export declare function createApiKey(db: Database, input: {
     accountId: string;
     workspaceId?: string | null;
@@ -419,6 +473,8 @@ export type ModelCallFact = {
     reasoningTokens: number | null;
     totalTokens: number | null;
     pricedCostMicros: number;
+    estimatedProviderCostMicros: number | null;
+    pricingSource: "configured_list_price" | "gateway_reported" | null;
     occurredAt: Date;
     recordedAt: Date;
 };
@@ -438,6 +494,8 @@ export declare function recordModelCallFact(db: Database, input: {
     model: string;
     billingPath: ModelCallBillingPath;
     pricedCostMicros: number;
+    estimatedProviderCostMicros?: number | null;
+    pricingSource?: "configured_list_price" | "gateway_reported" | null;
     inputTokens?: number | null;
     outputTokens?: number | null;
     cachedTokens?: number | null;
@@ -534,11 +592,13 @@ export type CreateScheduledTaskInput = {
     temporalScheduleId: string;
     runMode: ScheduledTaskRunMode;
     overlapPolicy: ScheduledTaskOverlapPolicy;
+    action?: ScheduledTaskAction;
     agentConfig: ScheduledTaskAgentConfig;
     createdBy?: TurnInitiator;
     createdByContext?: TurnInitiatorContext;
     createdByActor?: AgentSessionCreationActor | null;
     personalConnectionDelegations?: McpPersonalConnectionDelegation[];
+    targetSessionId?: string | null;
     variableSetId?: string | null;
     rigId?: string | null;
     metadata: Record<string, unknown>;
@@ -549,9 +609,11 @@ export type UpdateScheduledTaskInput = Partial<{
     schedule: ScheduledTaskScheduleSpec;
     runMode: ScheduledTaskRunMode;
     overlapPolicy: ScheduledTaskOverlapPolicy;
+    action: ScheduledTaskAction;
     agentConfig: ScheduledTaskAgentConfig;
     personalConnectionDelegations: McpPersonalConnectionDelegation[];
     reusableSessionId: string | null;
+    targetSessionId: string | null;
     variableSetId: string | null;
     rigId: string | null;
     metadata: Record<string, unknown>;
@@ -560,6 +622,11 @@ export type CreatePackInstallationInput = {
     accountId: string;
     workspaceId: string;
     packId: string;
+    status?: PackInstallationStatus;
+    manifestSnapshot?: CapabilityPack | null;
+    manifestDigest?: string | null;
+    selectedRigId?: string | null;
+    installedBySubjectId?: string | null;
     metadata?: Record<string, unknown>;
 };
 export type RegisterWorkspacePackInput = {
@@ -689,6 +756,23 @@ export type UpdateConnectionInput = {
     metadata?: Record<string, unknown>;
     updatedBySubjectId?: string | null;
 };
+export type PersistProviderOAuthConnectionInput = CreateConnectionInput & {
+    visibleToSubjectId: string;
+    credentialRole: string;
+    providerFamily: string;
+    providerPrincipalId: string;
+    requestedConnectionId?: string;
+    requestedConnectionVersion?: number;
+};
+export type UpdateSlackBotDocumentDestinationInput = {
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    visibleToSubjectId: string;
+    expectedVersion: number;
+    metadata: Record<string, unknown>;
+    updatedBySubjectId: string;
+};
 export type TransitionConnectionStateInput = {
     workspaceId: string;
     connectionId: string;
@@ -892,6 +976,86 @@ export type EnableCapabilityInstallationInput = {
     config?: Record<string, unknown>;
     metadata?: Record<string, unknown>;
 };
+export type InstallPortableSkillInput = {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    capabilityId: string;
+    pluginKey: string;
+    source: "github" | "skills_sh" | "pack";
+    sourceUrl: string;
+    repositoryUrl: string;
+    sourceCommit: string;
+    sourcePath: string;
+    name: string;
+    description: string;
+    contentSha256: string;
+    totalBytes: number;
+    license?: string | null;
+    files: Array<{
+        path: string;
+        content: string;
+        byteSize: number;
+        contentSha256: string;
+    }>;
+    owner?: PortableSkillOwner;
+    expectedInstallationVersion?: number;
+};
+export type InstalledPortableSkill = {
+    capabilityId: string;
+    pluginId: string;
+    pluginVersionId: string;
+    facetId: string;
+    pluginInstallationId: string;
+    facetInstallationId: string;
+    installationVersion: number;
+    source: "github" | "skills_sh" | "pack";
+    sourceUrl: string;
+    sourceCommit: string;
+    contentSha256: string;
+    name: string;
+};
+export type PortableSkillRuntime = {
+    capabilityId: string;
+    name: string;
+    description: string;
+    sourceUrl: string;
+    sourceCommit: string;
+    sourcePath: string;
+    contentSha256: string;
+    files: Array<{
+        path: string;
+        content: string;
+    }>;
+};
+export type PortableSkillOwner = {
+    kind: "direct" | "plugin" | "pack" | "migration";
+    id: string;
+    removable: boolean;
+};
+export type PortableSkillUninstallPreview = {
+    capabilityId: string;
+    installed: boolean;
+    installationVersion: number | null;
+    directOwner: PortableSkillOwner | null;
+    remainingOwners: PortableSkillOwner[];
+    removesRuntimeSkill: boolean;
+};
+export type UninstallPortableSkillResult = {
+    capabilityId: string;
+    status: "not_installed" | "uninstalled" | "retained_by_other_owners";
+    remainingOwners: PortableSkillOwner[];
+};
+export declare class PortableSkillInstallationVersionConflictError extends Error {
+    readonly capabilityId: string;
+    readonly expectedVersion: number;
+    readonly actualVersion: number;
+    readonly name = "PortableSkillInstallationVersionConflictError";
+    constructor(capabilityId: string, expectedVersion: number, actualVersion: number);
+}
+export declare class PortableSkillInstallationVersionRequiredError extends Error {
+    readonly name = "PortableSkillInstallationVersionRequiredError";
+}
 export type EnabledMcpCapabilityServer = {
     capabilityId: string;
     id: string;
@@ -900,6 +1064,7 @@ export type EnabledMcpCapabilityServer = {
     allowedTools?: string[];
     timeoutMs?: number;
     cacheToolsList?: boolean;
+    requireApproval?: SessionMcpApprovalPolicy;
     /**
      * Credential request headers stored encrypted at enable time
      * (AES-256-GCM under the workspace-variableSets key). Decrypted only at
@@ -971,6 +1136,8 @@ export type EnqueueSessionTurnInput = {
 export type SessionTurnForExecution = SessionTurn & {
     turnInstructions: string | null;
     personalConnectionDelegations: McpPersonalConnectionDelegation[];
+    /** Worker-only causal authority; never inferred from the current worker. */
+    initiatingHumanSubjectId: string | null;
 };
 export declare function createFileUpload(db: Database, input: {
     accountId: string;
@@ -989,12 +1156,36 @@ export declare function createFileUpload(db: Database, input: {
     uploadId: string;
     expiresAt: string;
 }>;
+export type PrepareGeneratedWorkspaceFileInput = {
+    accountId: string;
+    workspaceId: string;
+    fileId: string;
+    uploadId: string;
+    filename: string;
+    safeFilename: string;
+    contentType: string;
+    sizeBytes: number;
+    sha256: string;
+    bucket: string;
+    objectKey: string;
+    expiresAt: Date;
+};
+/**
+ * Prepare one deterministic upload intent for a generated workspace file.
+ * Retries return the same pending/ready file only when every immutable byte and
+ * storage fact matches; identity reuse with different content fails closed.
+ */
+export declare function prepareGeneratedWorkspaceFile(db: Database, input: PrepareGeneratedWorkspaceFileInput): Promise<{
+    file: FileAsset;
+    uploadId: string;
+    created: boolean;
+}>;
 export declare function getFile(db: Database, workspaceId: string, fileId: string): Promise<FileAsset | null>;
 export declare function requireFile(db: Database, workspaceId: string, fileId: string): Promise<FileAsset>;
 /** One RLS-scoped query for all attachment metadata needed by a model turn. */
 export declare function getFiles(db: Database, workspaceId: string, fileIds: readonly string[]): Promise<FileAsset[]>;
 /** Build the canonical user row with stable attachment refs, never inline bytes. */
-export declare function durableUserHistoryItem(prompt: string, resources: readonly ResourceRef[]): Record<string, unknown>;
+export declare function durableUserHistoryItem(prompt: string, resources: readonly ResourceRef[], annotations?: readonly TimelineAnnotation[]): Record<string, unknown>;
 export type RetainedFileArtifact = {
     file: FileAsset;
     uploadStatus: FileUploadStatus | null;
@@ -1006,6 +1197,138 @@ export type RetainedFileArtifact = {
  * location remain in the existing FileAsset/object-storage seam.
  */
 export declare function getRetainedFileArtifact(db: Database, workspaceId: string, fileId: string): Promise<RetainedFileArtifact | null>;
+export type RetainedScreenshotArtifactStatus = "pending" | "reconciling" | "ready" | "cleanup_queued" | "cleanup_pending" | "failed" | "expired" | "deleted";
+export type RetainedScreenshotQuotaState = "reserved" | "ready" | "released";
+export type RetainedScreenshotArtifact = {
+    artifactId: string;
+    accountId: string;
+    workspaceId: string;
+    sessionId: string | null;
+    turnId: string | null;
+    attemptId: string | null;
+    settlementKey: string;
+    toolCallId: string;
+    toolOutputId: string;
+    status: RetainedScreenshotArtifactStatus;
+    quotaState: RetainedScreenshotQuotaState;
+    mediaType: string;
+    sizeBytes: number;
+    sha256: string;
+    width: number;
+    height: number;
+    retentionExpiresAt: Date;
+    readyAt: Date | null;
+    cleanupReason: string | null;
+    lastError: string | null;
+    maintenanceClaimId: string | null;
+    maintenanceClaimedAt: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+    file: FileAsset;
+};
+export declare class RetainedScreenshotQuotaExceededError extends Error {
+    readonly quotaBytes: number;
+    readonly usedBytes: number;
+    readonly requestedBytes: number;
+    readonly code = "retained_screenshot_workspace_quota_exceeded";
+    constructor(quotaBytes: number, usedBytes: number, requestedBytes: number);
+}
+export type PrepareRetainedScreenshotArtifactInput = {
+    artifactId: string;
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    settlementKey: string;
+    toolCallId: string;
+    toolOutputId: string;
+    mediaType: "image/png" | "image/jpeg" | "image/webp";
+    sizeBytes: number;
+    sha256: string;
+    width: number;
+    height: number;
+    retentionExpiresAt: Date;
+    bucket: string;
+    objectKey: string;
+    workspaceQuotaBytes: number;
+};
+/**
+ * Reserve quota and create one deterministic pending file/artifact pair.
+ * Replays return the original row only when every immutable identity and byte
+ * fact matches; a UUID/settlement collision fails closed.
+ */
+export declare function prepareRetainedScreenshotArtifact(db: Database, input: PrepareRetainedScreenshotArtifactInput): Promise<{
+    artifact: RetainedScreenshotArtifact;
+    created: boolean;
+}>;
+/** Settle one exact pending/reconciling artifact ready and move its quota once. */
+export declare function settleRetainedScreenshotArtifactReady(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    artifactId: string;
+    settlementKey: string;
+    maintenanceClaimId?: string;
+}): Promise<RetainedScreenshotArtifact>;
+/** Record a bounded diagnostic while preserving retryable pending truth. */
+export declare function recordRetainedScreenshotArtifactError(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    artifactId: string;
+    settlementKey: string;
+    error: string;
+}): Promise<void>;
+/** Session-qualified lookup: a screenshot from another session is indistinguishable from absent. */
+export declare function getRetainedScreenshotArtifact(db: Database, workspaceId: string, sessionId: string, artifactId: string): Promise<RetainedScreenshotArtifact | null>;
+export type RetainedScreenshotMaintenanceClaim = {
+    action: "reconcile" | "delete";
+    claimId: string;
+    artifactId: string;
+    accountId: string;
+    workspaceId: string;
+    sessionId: string | null;
+    objectKey: string;
+    mediaType: string;
+    sizeBytes: number;
+    sha256: string;
+    width: number;
+    height: number;
+    retentionExpiresAt: Date;
+    cleanupReason: string | null;
+};
+/** Bounded global claim through the migration's sole FORCE-RLS bypass. */
+export declare function claimRetainedScreenshotMaintenance(db: Database, input: {
+    pendingGraceMs: number;
+    claimTimeoutMs: number;
+    limit: number;
+}): Promise<RetainedScreenshotMaintenanceClaim[]>;
+/**
+ * Atomically transfer one exact reconcile claim into cleanup ownership before
+ * any provider delete. A concurrent ready settlement clears/replaces the claim
+ * and makes this a stale no-op.
+ */
+export declare function promoteRetainedScreenshotMaintenanceCleanup(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    artifactId: string;
+    claimId: string;
+    cleanupReason: string;
+}): Promise<boolean>;
+/**
+ * Complete a claimed reconcile/delete operation and release exactly one quota
+ * bucket. A lost response is idempotent on the requested terminal state.
+ */
+export declare function completeRetainedScreenshotMaintenance(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    artifactId: string;
+    claimId: string;
+    outcome: "ready" | "failed" | "expired" | "deleted";
+}): Promise<boolean>;
+export declare function getWorkspaceScreenshotQuota(db: Database, workspaceId: string): Promise<{
+    reservedBytes: number;
+    readyBytes: number;
+} | null>;
 export declare function getFileUpload(db: Database, workspaceId: string, uploadId: string): Promise<{
     id: string;
     status: FileUploadStatus;
@@ -1094,6 +1417,22 @@ export declare function markStaleRegistryCatalogItems(db: Database, activeKeys:
 export declare function upsertCapabilityCatalogItem(db: Database, input: CreateCapabilityCatalogItemInput): Promise<CapabilityCatalogItem>;
 export declare function listCapabilityCatalogItems(db: Database, workspaceId: string): Promise<CapabilityCatalogItem[]>;
 export declare function getCapabilityCatalogItem(db: Database, workspaceId: string, capabilityId: string): Promise<CapabilityCatalogItem | null>;
+/**
+ * Install one immutable, already-validated portable Skill through the v2
+ * Plugin/facet ownership model and dual-write the v1 compatibility projection.
+ * Repeating the same exact source is idempotent; changing a commit's content
+ * fails instead of silently rewriting immutable history.
+ */
+export declare function installPortableSkill(db: Database, input: InstallPortableSkillInput): Promise<InstalledPortableSkill>;
+/** Return exact text artifacts for active v2 Skill installations. */
+export declare function listInstalledPortableSkills(db: Database, workspaceId: string): Promise<PortableSkillRuntime[]>;
+export declare function getPortableSkillUninstallPreview(db: Database, workspaceId: string, capabilityId: string): Promise<PortableSkillUninstallPreview>;
+export declare function uninstallPortableSkill(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    capabilityId: string;
+    expectedInstallationVersion: number;
+}): Promise<UninstallPortableSkillResult>;
 export declare function enableCapabilityInstallation(db: Database, input: EnableCapabilityInstallationInput): Promise<CapabilityInstallation>;
 export declare function disableCapabilityInstallation(db: Database, workspaceId: string, capabilityId: string): Promise<CapabilityInstallation>;
 export declare function listCapabilityInstallations(db: Database, workspaceId: string): Promise<CapabilityInstallation[]>;
@@ -1110,14 +1449,26 @@ export declare function decryptedCapabilityHeaders(server: EnabledMcpCapabilityS
  * Returns the encrypted credential-header map stored on a capability
  * installation, or null when none is stored. This is the only read path for
  * the ciphertext besides listEnabledMcpCapabilityServers; the generic
- * installation mapping redacts it to header names.
+ * installation mapping projects it to header names.
  */
 export declare function getStoredCapabilityHeaderCiphertext(db: Database, workspaceId: string, capabilityId: string): Promise<Record<string, string> | null>;
 export declare function mcpServerIdForCapability(capabilityId: string, metadata?: Record<string, unknown>): string;
 export declare function createConnection(db: Database, input: CreateConnectionInput): Promise<ConnectionMetadataWithVerification>;
+/**
+ * Serialize one provider-principal/owner connection generation. Distinct OAuth
+ * starts for the same principal converge on one row, while an explicit
+ * reconnect remains fenced to the exact Connection version captured in state.
+ */
+export declare function persistProviderOAuthConnection(db: Database, input: PersistProviderOAuthConnectionInput): Promise<ConnectionMetadataWithVerification | null>;
 export declare function listConnectionsMetadata(db: Database, workspaceId: string, subjectId?: string | null): Promise<ConnectionMetadataWithVerification[]>;
 export declare function getConnectionMetadata(db: Database, workspaceId: string, connectionId: string, subjectId?: string | null): Promise<ConnectionMetadataWithVerification | null>;
 export declare function updateConnection(db: Database, input: UpdateConnectionInput): Promise<ConnectionMetadataWithVerification | null>;
+/**
+ * Updates only pre-validated workspace Slack-bot destination metadata while
+ * atomically advancing its install proof to the new connection generation.
+ * A stale version or already-invalid proof returns null without writing.
+ */
+export declare function updateSlackBotDocumentDestination(db: Database, input: UpdateSlackBotDocumentDestinationInput): Promise<ConnectionMetadataWithVerification | null>;
 /**
  * Applies a metadata/status lifecycle transition behind the connection's
  * existing `(id, version)` fence. Unlike ordinary metadata edits, every
@@ -1141,6 +1492,14 @@ export type SlackInstallationRoute = {
     botId: string;
     botUserId: string;
 };
+export declare class SlackInstallationBindingConflictError extends Error {
+    readonly reason: "conflicting_workspace" | "conflicting_principal" | "legacy_quarantine" | "stale_reinstall";
+    constructor(reason: "conflicting_workspace" | "conflicting_principal" | "legacy_quarantine" | "stale_reinstall");
+}
+export declare function listSlackInstallationBindings(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+}): Promise<SlackInstallationBinding[]>;
 export type SlackBotUserLink = {
     id: string;
     accountId: string;
@@ -1282,6 +1641,24 @@ export type SlackInteractionProgressClaim = {
 } | {
     kind: "not_owned";
 };
+export type SlackInteractionProgressDeliveryEvidence = {
+    sessionEventSequence: number;
+    operationId: string;
+    text: string;
+    turnId: string | null;
+};
+/**
+ * Read the at-most-three durable progress identities for terminal-delivery
+ * reconciliation. A reserved operation may still be provider-started after a
+ * response loss, so callers must retry the same operation id rather than
+ * inventing a second final post.
+ */
+export declare function listSlackInteractionProgressDeliveryEvidence(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    interactionId: string;
+    sessionId: string;
+}): Promise<SlackInteractionProgressDeliveryEvidence[]>;
 /**
  * Reserve one globally bounded progress slot before any Slack provider call.
  * The interaction row lock serializes replicas and expired delivery claim
@@ -1297,8 +1674,10 @@ export declare function claimSlackInteractionProgressDelivery(db: Database, inpu
 }): Promise<SlackInteractionProgressClaim>;
 export declare function rekeySlackInteractionRoute(db: Database, input: Pick<SlackInteraction, "id" | "accountId" | "workspaceId"> & {
     routeKey: string;
+    slackChannelId?: string;
     slackThreadTs: string;
     ackSlackMessageTs: string;
+    repairUnacknowledgedPrivateShortcutDelivery?: boolean;
 }): Promise<SlackInteraction | null>;
 export declare function claimSlackInteractionDelivery(db: Database, claimHolderId: string, claimLeaseMs: number): Promise<SlackInteraction | null>;
 export declare function reopenSlackInteractionDelivery(db: Database, input: Pick<SlackInteraction, "id" | "accountId" | "workspaceId">): Promise<boolean>;
@@ -1332,6 +1711,20 @@ type SlackBotLifecycleSuccessAuditInput = {
     credentialLabel: string;
     slackTeamId: string;
 };
+export type PersistSlackBotInstallationInput = SlackBotLifecycleSuccessAuditInput & {
+    requestedConnectionId?: string;
+    requestedConnectionVersion?: number;
+    credentialEncrypted: string;
+    grantedScopes: string[];
+    verifiedInstallAt: Date;
+    metadata: Record<string, unknown> & {
+        slackTeamId: string;
+        slackTeamName: string;
+        botId: string;
+        botUserId: string;
+    };
+};
+export declare function persistSlackBotInstallationWithSuccessAudit(db: Database, input: PersistSlackBotInstallationInput): Promise<ConnectionMetadataWithVerification>;
 export declare function createConnectionWithSlackBotSuccessAudit(db: Database, input: SlackBotLifecycleSuccessAuditInput & {
     connection: CreateConnectionInput;
 }): Promise<ConnectionMetadataWithVerification>;
@@ -1468,8 +1861,25 @@ export declare function loadConnectionCredentialForBroker(db: Database, settings
     allowSubjectOwned?: boolean;
 }): Promise<ConnectionCredentialForBroker | null>;
 export declare function workspaceVercelAiGatewayConnectionActive(db: Database, workspaceId: string): Promise<boolean>;
+/** Metadata-only capability revision input; never selects/decrypts the API key. */
+export declare function getWorkspaceVercelAiGatewayConnectionMetadata(db: Database, workspaceId: string): Promise<{
+    connectionId: string;
+    version: number;
+} | null>;
 /** Resolve only the reviewed workspace-shared AI Gateway credential shape. */
 export declare function loadWorkspaceVercelAiGatewayApiKey(db: Database, settings: Settings, workspaceId: string): Promise<string | null>;
+/**
+ * Worker-only immutable credential lease for an asynchronous video operation.
+ * The operation copies the already-encrypted credential envelope before its
+ * accepted receipt commits, so a later workspace disconnect cannot strand a
+ * paid provider job. Never expose this return value from an API route.
+ */
+export declare function loadWorkspaceVercelAiGatewayCredentialLease(db: Database, settings: Settings, workspaceId: string): Promise<{
+    connectionId: string;
+    version: number;
+    credentialEncrypted: string;
+    apiKey: string;
+} | null>;
 export declare function recordConnectionTokenRefresh(db: Database, input: {
     id: string;
     version: number;
@@ -1525,7 +1935,6 @@ export type SaveWorkspaceMemoryResult = {
     superseded: KnowledgeMemory | null;
     supersededId: string | null;
     updated: boolean;
-    redactionCount: number;
     embedded: boolean;
 };
 export type CorrectWorkspaceMemoryInput = {
@@ -1615,7 +2024,29 @@ export declare function updateScheduledTask(db: Database, workspaceId: string, t
 export declare function getScheduledTask(db: Database, workspaceId: string, taskId: string): Promise<ScheduledTask | null>;
 export declare function getScheduledTaskPersonalConnectionDelegations(db: Database, workspaceId: string, taskId: string): Promise<McpPersonalConnectionDelegation[]>;
 export declare function requireScheduledTask(db: Database, workspaceId: string, taskId: string): Promise<ScheduledTask>;
-export declare function listScheduledTasks(db: Database, workspaceId: string, limit?: number): Promise<ScheduledTask[]>;
+export declare class ScheduledTaskTargetConflictError extends Error {
+    constructor();
+}
+/**
+ * DB-only delivery fence used inside the system-update source transaction.
+ * The task row is locked after the target session row, so a concurrent retarget
+ * linearizes before or after the complete scheduled occurrence instead of
+ * delivering one fire to a stale session snapshot.
+ */
+export declare function requireScheduledTaskTargetInTransaction(tx: Database, input: {
+    workspaceId: string;
+    taskId: string;
+    targetSessionId: string;
+}): Promise<void>;
+export declare function listScheduledTasks(db: Database, workspaceId: string, limit?: number, offset?: number): Promise<ScheduledTask[]>;
+/**
+ * Internal connector-control traversal. Keep the whole keyset walk on one
+ * repeatable-read snapshot so task creation/update performed after discovery
+ * cannot make an older row move between offset pages or hide a matching task.
+ */
+export declare function listKnowledgeSourceSyncTasksForConnection(db: Database, workspaceId: string, connectionId: string, pageSize?: number): Promise<Array<ScheduledTask & {
+    action: KnowledgeSourceSyncAction;
+}>>;
 export declare function deleteScheduledTask(db: Database, workspaceId: string, taskId: string): Promise<void>;
 export declare function createScheduledTaskRun(db: Database, input: {
     workspaceId: string;
@@ -1632,6 +2063,10 @@ export declare function updateScheduledTaskRun(db: Database, workspaceId: string
     status: ScheduledTaskRunStatus;
     sessionId: string | null;
     triggerEventId: string | null;
+    actionKind: ScheduledTaskActionKind;
+    knowledgeSyncRunId: string | null;
+    knowledgeSummary: Record<string, unknown> | null;
+    completedAt: Date | null;
     error: string | null;
 }>): Promise<ScheduledTaskRun>;
 /** DB-only source mutation callback for durable scheduled delivery. */
@@ -1656,6 +2091,37 @@ export declare function createVariableSet(db: Database, input: {
 export declare function listVariableSets(db: Database, workspaceId: string): Promise<VariableSet[]>;
 export declare function getVariableSet(db: Database, workspaceId: string, variableSetId: string): Promise<VariableSet | null>;
 export declare function getVariableSetByName(db: Database, workspaceId: string, name: string): Promise<VariableSet | null>;
+export type VariableSetSecretAuditActor = {
+    kind: "subject";
+} | {
+    kind: "agent_attempt";
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+};
+export declare class VariableSetSecretReadAuthorityError extends Error {
+    readonly code = "VARIABLE_SET_SECRET_READ_AUTHORITY_STALE";
+    constructor();
+}
+/**
+ * Read one encrypted value, decrypt it, and commit its metadata-only audit in
+ * one RLS transaction. Agent reads lock and recheck the canonical attempt/control
+ * fence in that same transaction, so cancellation or replacement linearizes
+ * either before the read (denied) or after its committed audit. The plaintext is
+ * returned only after the audit insert commits; an audit failure rolls back and
+ * rejects the whole operation.
+ */
+export declare function readVariableSetSecretAtomically(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    variableSetId?: string;
+    variableSetName?: string;
+    name: string;
+    actor: VariableSetSecretAuditActor;
+    decrypt: (valueEncrypted: string) => string;
+}): Promise<VariableSetSecret | null>;
 export declare function updateVariableSet(db: Database, workspaceId: string, variableSetId: string, input: {
     name?: string;
     description?: string | null;
@@ -1724,6 +2190,7 @@ export declare function createRigVersion(db: Database, workspaceId: string, rigI
 }): Promise<RigVersion>;
 export declare function createRigVersionForChangePromotion(db: Database, workspaceId: string, rigId: string, changeId: string, input: RigVersionContentInput & {
     expectedActiveVersionId: string;
+    providerImages?: RigProviderImages;
 }): Promise<{
     version: RigVersion;
     change: RigChange;
@@ -1753,6 +2220,33 @@ export declare function listRigVersionMonitoringSummaries(db: Database, workspac
 }>;
 export declare function getRigVersion(db: Database, workspaceId: string, rigId: string, versionId: string): Promise<RigVersion | null>;
 export declare function getRigVersionById(db: Database, workspaceId: string, versionId: string): Promise<RigVersion | null>;
+export type RigProviderImageBuildClaim = {
+    status: "claimed";
+    image: RigProviderImage;
+} | {
+    status: "ready" | "in_progress" | "unsupported" | "conflict";
+    image: RigProviderImage;
+};
+/**
+ * Claim the one provider-image build slot for an existing immutable rig
+ * version. A finalized ready image is never overwritten in place: if the
+ * effective base/content identity changed, callers must mint/verify a new rig
+ * version and runtime setup remains the truthful fallback for this one.
+ */
+export declare function claimRigVersionProviderImageBuild(db: Database, input: {
+    workspaceId: string;
+    versionId: string;
+    image: RigProviderImage;
+    staleAfterMs: number;
+    /** Retry a same-content unsupported record only after runtime support exists. */
+    retryUnsupported?: boolean;
+}): Promise<RigProviderImageBuildClaim>;
+/** Finalize only the exact claimed build request; late callbacks are fenced. */
+export declare function finalizeRigVersionProviderImageBuild(db: Database, input: {
+    workspaceId: string;
+    versionId: string;
+    image: RigProviderImage;
+}): Promise<boolean>;
 export declare function getRigName(db: Database, workspaceId: string, rigId: string): Promise<string | null>;
 export declare function activateRigVersion(db: Database, workspaceId: string, rigId: string, versionId: string): Promise<RigVersion>;
 export declare function createRigChange(db: Database, input: {
@@ -2119,7 +2613,7 @@ export type CodexCredentialLeasePolicyScopeResolver<TPolicyScope> = (turnMetadat
 export type CodexCredentialLeaseCandidateFilterResult<TUnavailableDiagnostic = never> = {
     /** Candidates from exactly one selected policy scope; never a union-ranked pool list. */
     accounts: readonly CodexLeaseAccountStatus[];
-    /** Downstream-owned, secret-safe diagnostics for rejected primary/fallback scopes. */
+    /** Downstream-owned, value-free metadata diagnostics for rejected primary/fallback scopes. */
     unavailableDiagnostics?: readonly TUnavailableDiagnostic[];
 };
 export type CodexCredentialLeaseCandidateFilter<TPolicyScope, TUnavailableDiagnostic = never> = (input: {
@@ -2331,17 +2825,23 @@ export declare function armCodexCapacityWait(db: Database, input: {
     now?: Date;
 }): Promise<ArmCodexCapacityWaitResult>;
 export declare function getCodexCapacityWaitForSession(db: Database, workspaceId: string, sessionId: string): Promise<CodexCapacityWait | null>;
+type CodexCapacityMutationInput = {
+    workspaceId: string;
+    reason: string;
+    policyHash?: string | null;
+};
 /**
  * Same-transaction capacity-mutation/outbox seam for eligibility and
  * membership/default changes. The allocator rotation row is always the
  * first lock. Mutations report whether capacity truth changed; only then are
  * matching waiter wake revisions advanced and returned for best-effort signal.
  */
-export declare function withCodexCapacityMutation<T>(db: Database, input: {
-    workspaceId: string;
-    reason: string;
-    policyHash?: string | null;
-}, mutate: (tx: Database) => Promise<{
+export declare function withCodexCapacityMutation<T>(db: Database, input: CodexCapacityMutationInput, mutate: (tx: Database) => Promise<{
+    result: T;
+    changed: boolean;
+}>): Promise<CodexCapacityMutationResult<T>>;
+/** Capacity mutation whose atomic callback also changes session activity. */
+export declare function withSessionCodexCapacityMutation<T>(db: Database, input: CodexCapacityMutationInput, mutate: (tx: SessionActivityDatabase) => Promise<{
     result: T;
     changed: boolean;
 }>): Promise<CodexCapacityMutationResult<T>>;
@@ -2706,6 +3206,7 @@ export declare function getSessionCodexState(db: Database, workspaceId: string,
  * Validates the id belongs to the workspace when non-null. Returns false if the
  * session is unknown or the id is invalid.
  */
+export declare function setSessionCodexPinInTransaction(db: SessionActivityDatabase, workspaceId: string, sessionId: string, pinnedCredentialId: string | null, source?: CodexPinSource, options?: SetSessionCodexPinOptions): Promise<boolean>;
 export declare function setSessionCodexPin(db: Database, workspaceId: string, sessionId: string, pinnedCredentialId: string | null, source?: CodexPinSource, options?: SetSessionCodexPinOptions): Promise<boolean>;
 /** Written by the worker at the turn boundary; drives the in-session indicator. */
 export declare function recordSessionActiveCodexCredential(db: Database, workspaceId: string, sessionId: string, credentialId: string): Promise<void>;
@@ -2781,6 +3282,8 @@ export type ConnectorActionInvocation = {
     serverId: string;
     toolName: string;
     arguments: unknown;
+    /** Explicit per-session MCP approval, rather than a connector-policy decision. */
+    approvalMode?: "session_mcp";
 };
 export type PrepareConnectorActionApprovalResult = {
     managed: false;
@@ -2812,6 +3315,12 @@ type ResolvedConnectorActionPolicy = {
     managed: true;
     source: "explicit";
     entry: ConnectorActionPolicySnapshotEntry;
+} | {
+    managed: true;
+    source: "explicit";
+    entry: null;
+    decision: "ask";
+    actionName: string;
 } | {
     managed: true;
     source: "ambiguous";
@@ -3075,6 +3584,8 @@ export type SessionDiscoverySummary = {
     title: string | null;
     titleOriginalChars: number | null;
     parentSessionId: string | null;
+    rootSessionId: string;
+    nestedAgentDepth: number;
     status: SessionStatus;
     effectiveControl: SessionDiscoveryControl;
     goal: {
@@ -3107,6 +3618,9 @@ export declare function listSessionDiscoverySummaries(db: Database, workspaceId:
     includeLastMessage?: boolean;
     orderBy?: SessionDiscoveryOrderBy;
     updatedAfter?: string;
+    parentSessionId?: string | null;
+    search?: string;
+    subjectId?: string;
     authorizationScope?: SessionAuthorizationListScope;
 }): Promise<{
     sessions: SessionDiscoverySummary[];
@@ -3119,6 +3633,17 @@ export declare function listSessionDiscoverySummaries(db: Database, workspaceId:
     updatedThrough: string | null;
     updatedAfter: string | null;
 }>;
+export type SessionDiscoveryAncestor = {
+    id: string;
+    title: string | null;
+    titleOriginalChars: number | null;
+};
+/**
+ * Return bounded root-to-parent paths for a bounded discovery result page.
+ * Authorization is re-applied to every ancestor so exact-session grants never
+ * acquire parent metadata merely by searching for their target.
+ */
+export declare function listSessionDiscoveryAncestorPaths(db: Database, workspaceId: string, sessionIds: string[], authorizationScope?: SessionAuthorizationListScope): Promise<Map<string, SessionDiscoveryAncestor[]>>;
 export type SessionLineage = {
     ancestors: Session[];
     children: LineageNode[];
@@ -3189,64 +3714,16 @@ export type SessionEventPage = {
 };
 export declare const SESSION_EVENT_DB_PAGE_MAX_BYTES: number;
 /**
- * Read one direction-aware session-event page without transferring legacy raw
- * payloads or malformed free-form envelope strings out of PostgreSQL.
- *
- * Migration 0067 deliberately leaves historical rows untouched. This query
- * invokes its immutable payload projector in SQL and mirrors the rolling
- * envelope guard in SQL, then accumulates small batches under one RLS
- * transaction. `bytes` is the exact UTF-8 size of `JSON.stringify(events)`;
- * `hasMore` is true whenever count or byte selection stopped before the durable
- * range ended. A nonempty durable range can therefore never become an empty,
- * non-advancing HTTP page.
+ * Read one direction-aware session-event page. Full mode selects the canonical
+ * row exactly; summary/none modes derive bounded monitoring projections in SQL
+ * without rewriting the retained source. `bytes` is the exact UTF-8 size of
+ * `JSON.stringify(events)`; `hasMore` is true whenever count or byte selection
+ * stopped before the durable range ended.
  */
 export declare function listSessionEventPage(db: Database, workspaceId: string, sessionId: string, options?: ListSessionEventPageOptions): Promise<SessionEventPage>;
 export declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string): Promise<SessionEvent[]>;
 export declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string, after: number, limit?: number): Promise<SessionEvent[]>;
 export declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string, options: ListSessionEventsOptions): Promise<SessionEvent[]>;
-export type ToolspaceCallReservation = {
-    reserved: true;
-    count: number;
-    turn: SessionTurnForExecution;
-} | {
-    reserved: false;
-    reason: TurnAttemptFenceRejectReason | "budget_exhausted";
-};
-export type ToolspaceTurnAttemptClaims = {
-    sessionId: string;
-    turnId: string;
-    attemptId: string;
-    executionGeneration: number;
-};
-/**
- * Admit one exact Toolspace bearer before any session credential is decrypted or
- * any upstream schema is enumerated. This intentionally reuses the canonical
- * activity write fence so Pause/Steer, attempt replacement, generation changes,
- * and terminal settlement revoke a copied token at the same linearization point
- * as other attempt-owned writes.
- */
-export declare function admitToolspaceTurnAttempt(db: Database, workspaceId: string, claims: ToolspaceTurnAttemptClaims): Promise<boolean>;
-/**
- * Atomically reserve one toolspace call against a turn's per-turn budget.
- *
- * A single conditional UPDATE increments `toolspace_call_count` only while it is
- * below `limit` and returns the post-increment value. Concurrent reservations
- * for the same turn serialize on the row lock, so exactly `limit` of N
- * simultaneous callers observe `reserved: true` — closing the read-then-append
- * TOCTOU the event-count approach had. The returned attempt id is captured by
- * that same UPDATE, so callers cannot accidentally execute under a successor
- * attempt. `reserved: false` means the turn is not executable, at/over budget,
- * or no longer exists.
- */
-export declare function reserveToolspaceCallForAttempt(db: Database, input: {
-    accountId: string;
-    workspaceId: string;
-    sessionId: string;
-    turnId: string;
-    executionGeneration: number;
-    attemptId: string;
-    limit: number;
-}): Promise<ToolspaceCallReservation>;
 export declare function getSessionEvent(db: Database, workspaceId: string, eventId: string): Promise<SessionEvent | null>;
 export declare function listWorkspaceControlEvents(db: Database, workspaceId: string, after?: number, limit?: number): Promise<WorkspaceControlEvent[]>;
 export declare function getWorkspaceControlEvent(db: Database, workspaceId: string, eventId: string): Promise<WorkspaceControlEvent | null>;
@@ -3256,7 +3733,31 @@ export declare function getWorkspaceControlEvent(db: Database, workspaceId: stri
  * a session, while the workspace predicate remains the tenancy boundary.
  */
 export declare function getSessionEventByClientEventId(db: Database, workspaceId: string, sessionId: string, clientEventId: string): Promise<SessionEvent | null>;
-export declare function getLatestRunState(db: Database, workspaceId: string, sessionId: string): Promise<{
+export declare const APPROVAL_RUN_STATE_MAX_JSON_BYTES: number;
+export declare const APPROVAL_RUN_STATE_MAX_JSON_NODES = 65536;
+export declare const APPROVAL_RUN_STATE_MAX_JSON_PROPERTIES = 32768;
+export declare const APPROVAL_PENDING_MAX_JSON_BYTES: number;
+export declare const APPROVAL_PENDING_MAX_ITEMS = 256;
+export type ApprovalRunStateMaterializationLimits = {
+    maximumJsonBytes: number;
+    maximumJsonNodes: number;
+    maximumJsonProperties: number;
+    maximumPendingApprovalBytes: number;
+    maximumPendingApprovalItems: number;
+};
+export type ApprovalRunStateLimitKind = "json_bytes" | "json_nodes" | "json_properties" | "invalid_json" | "pending_approval_bytes" | "pending_approval_items";
+export declare class ApprovalRunStateLimitExceededError extends Error {
+    readonly limitKind: ApprovalRunStateLimitKind;
+    readonly actual: number;
+    readonly maximum: number;
+    readonly code = "approval_run_state_too_large";
+    constructor(limitKind: ApprovalRunStateLimitKind, actual: number, maximum: number);
+}
+/**
+ * Read the one approval/human-input RunState through a server-measured envelope.
+ * Ordinary turns never call this path; they use canonical history items only.
+ */
+export declare function getLatestRunState(db: Database, workspaceId: string, sessionId: string, limitOverrides?: Partial<ApprovalRunStateMaterializationLimits>): Promise<{
     id: string;
     turnId: string | null;
     serializedRunState: string;
@@ -3372,8 +3873,8 @@ export type PendingSessionToolCallInput = {
 };
 /**
  * Durably capture the raw SDK call item at the exact attempt boundary. This is
- * model-facing truth, deliberately separate from the redacted session-event
- * projection. The receipt belongs to the logical turn so an approval resume can
+ * model-facing truth, deliberately separate from the session-event timeline.
+ * The receipt belongs to the logical turn so an approval resume can
  * settle it from a newer attempt. Duplicate SDK delivery converges on the
  * unique (turn, call) identity.
  */
@@ -3381,19 +3882,14 @@ export declare function registerPendingSessionToolCall(db: Database, input: Pend
     accepted: boolean;
     registered: boolean;
 }>;
-/**
- * Clear one completed Toolspace receipt after its attempt-fenced output event is
- * durable. If control already replaced the attempt, its settlement transaction
- * owns the receipt and will retain an explicit outcome-unknown or the durable
- * output event instead.
- */
-export declare function clearPendingSessionToolspaceCall(db: Database, input: Omit<PendingSessionToolCallInput, "callType" | "callItem">): Promise<{
-    accepted: boolean;
-    cleared: boolean;
-}>;
 /** Record the raw SDK result without dropping the call receipt. */
 export declare function recordPendingSessionToolCallResult(db: Database, input: Omit<PendingSessionToolCallInput, "callType" | "callItem"> & {
     resultItem: Record<string, unknown>;
+    /** Commit a durable async-video acceptance fence with this exact result. */
+    videoGenerationAcceptance?: {
+        operationId: string;
+        requestDigest: string;
+    };
 }): Promise<{
     accepted: boolean;
     recorded: boolean;
@@ -3427,6 +3923,40 @@ export declare function getActiveSessionHistoryItems(db: Database, workspaceId:
     item: Record<string, unknown>;
     providerArtifactInvalidatedAt: Date | null;
 }>>;
+/**
+ * Profiled upper envelope for one session's complete active, model-facing
+ * transcript. Bytes alone do not bound the decoded object graph, so rows, JSON
+ * nodes, and object properties are independently limited. Normal token-driven
+ * compaction keeps active history far below these boundaries. The limits are a
+ * final materialization guard: a corrupt/imported/pathological transcript fails
+ * deterministically before a Postgres driver decodes it instead of using the
+ * pod OOM killer as admission.
+ */
+export declare const ACTIVE_SESSION_HISTORY_MAX_JSON_BYTES: number;
+export declare const ACTIVE_SESSION_HISTORY_MAX_ROWS = 4096;
+export declare const ACTIVE_SESSION_HISTORY_MAX_JSON_NODES = 65536;
+export declare const ACTIVE_SESSION_HISTORY_MAX_JSON_PROPERTIES = 32768;
+export type ActiveSessionHistoryLimitKind = "json_bytes" | "rows" | "json_nodes" | "json_properties";
+export declare class ActiveSessionHistoryLimitExceededError extends Error {
+    readonly actualBytes: number;
+    readonly maximumBytes: number;
+    readonly limitKind: ActiveSessionHistoryLimitKind;
+    readonly actual: number;
+    readonly maximum: number;
+    readonly code = "active_history_too_large";
+    constructor(actualBytes: number, maximumBytes: number, limitKind?: ActiveSessionHistoryLimitKind, actual?: number, maximum?: number);
+}
+/**
+ * Memory-bounded active-history read for model input and compaction. PostgreSQL
+ * first measures the complete logical window without returning any JSONB item,
+ * then keyset-pages the admitted rows on the same repeatable-read snapshot.
+ */
+export declare function getActiveSessionHistoryItemsPaged(db: Database, workspaceId: string, sessionId: string, pageSize?: number, maximumJsonBytes?: number, maximumRows?: number, maximumJsonNodes?: number, maximumJsonProperties?: number): Promise<Array<{
+    id: string;
+    position: number;
+    item: Record<string, unknown>;
+    providerArtifactInvalidatedAt: Date | null;
+}>>;
 /** Bounded finalized voice turns used only to resume a later realtime call. */
 export declare function getSessionRealtimeContinuityEntries(db: Database, workspaceId: string, sessionId: string, maximumEntries?: number): Promise<SessionRealtimeContinuityEntry[]>;
 /**
@@ -3789,7 +4319,7 @@ export declare function closePtySession(db: Database, input: {
 /** List a session's OPEN PTYs (reattach + reap). */
 export declare function listOpenPtySessions(db: Database, workspaceId: string, sessionId: string): Promise<SandboxOpenPtySessionRow[]>;
 export type SandboxLeaseLiveness = "cold" | "warming" | "warm" | "draining";
-export type LeaseHolderKind = "turn" | "viewer" | "direct" | "process";
+export type LeaseHolderKind = "turn" | "viewer" | "direct" | "process" | "interaction";
 export type SandboxProviderExistence = "not_created" | "creating" | "exists" | "missing" | "unknown";
 export type SandboxArchiveAvailability = "none" | "available" | "unverified" | "invalid";
 export type SandboxRestoreStatus = "not_required" | "pending" | "restoring" | "verifying" | "ready" | "degraded" | "unrecoverable";
@@ -3823,6 +4353,22 @@ export type SandboxRecoveryState = {
         verifiedRevision: string | null;
         verifiedAt: string | null;
     };
+    /** Provider-specific proof that an elected recovery owner may replace only
+     * the disposable execution wrapper while retaining the same workspace. */
+    continuity?: SandboxProviderContinuityRecovery;
+    /** A provider disappeared while a non-cancellable capture response could
+     * still settle. The cold lease retains this exact source/lineage receipt so a
+     * late verified archive can repair recovery without reopening the old box. */
+    lateArchiveCapture?: {
+        version: 1;
+        captureId: string;
+        providerRequestId: string;
+        sourceLeaseId: string;
+        sourceLeaseEpoch: number;
+        sourceInstanceId: string;
+        sourceWorkspaceGeneration: number;
+        recordedAt: string;
+    };
 };
 export interface LeaseSnapshot {
     id: string;
@@ -3850,9 +4396,24 @@ export interface LeaseSnapshot {
     /** Exact provider capture currently holding the lease-local admission gate. */
     archiveCapture: {
         id: string;
+        operationId: string;
+        providerRequestId: string;
+        providerReplaySafe: boolean;
+        takeoverSafe: boolean;
+        attempt: number;
         workspaceGeneration: number;
         startedAt: Date;
         deadlineAt: Date;
+        /** Durable proof that this exact draining capture already published a
+         * verified current-generation archive. Null while capture is outstanding. */
+        publishedAt: Date | null;
+    } | null;
+    /** Bounded exact operator hold. Active holds stop reaper capture/teardown but
+     * deliberately do not stop a user from re-arming a resumable drain. */
+    reaperHold: {
+        id: string;
+        until: Date;
+        reason: string;
     } | null;
     resumeBackendId: string | null;
     resumeState: Record<string, unknown> | null;
@@ -3868,7 +4429,7 @@ export interface LeaseSnapshot {
     /** Once set, new holders and new filesystem mutations are fenced while the
      * current holders quiesce and the reaper creates a successor. */
     rotationRequestedAt: Date | null;
-    rotationReason: "provider_deadline" | "operator" | null;
+    rotationReason: "provider_deadline" | "operator" | "teardown_claim" | null;
     currentCheckpointArtifactId: string | null;
     previousCheckpointArtifactId: string | null;
     expiresAt: Date;
@@ -3895,8 +4456,13 @@ export interface AcquireLeaseInput {
     warmingLeaseTtlMs?: number;
     expectedEpoch?: number;
     /** Bounded wait for an exact provider-native capture claim to settle. The
-     * transaction is released between retries; every retry re-reads the lease. */
+     * transaction is released between retries; every retry re-reads the lease.
+     * The same wait also covers a requested provider rotation. The legacy field
+     * name is retained at the API boundary so rolling workers remain compatible. */
     captureWaitMs?: number;
+    /** Optional owner cancellation for the transition wait. No holder exists
+     * while a capture/rotation fence is observed, so cancellation is leak-free. */
+    waitSignal?: AbortSignal;
 }
 export type AcquireLeaseResult = {
     role: "spawner";
@@ -3913,12 +4479,32 @@ export type AcquireLeaseResult = {
     lease: LeaseSnapshot;
 } | {
     role: "fenced";
+    reason: "superseded" | "capture_in_progress" | "rotation_in_progress" | "provider_recovery_in_progress";
     lease: LeaseSnapshot;
 };
 export declare class SandboxLeaseSupersededError extends Error {
     readonly sandboxGroupId: string;
     readonly leaseEpoch: number;
-    constructor(sandboxGroupId: string, leaseEpoch: number);
+    readonly diagnostic?: {
+        backend: string;
+        instanceId: string | null;
+        liveness: SandboxLeaseLiveness;
+    } | undefined;
+    constructor(sandboxGroupId: string, leaseEpoch: number, diagnostic?: {
+        backend: string;
+        instanceId: string | null;
+        liveness: SandboxLeaseLiveness;
+    } | undefined);
+}
+export declare class SandboxLeaseTransitionError extends Error {
+    readonly sandboxGroupId: string;
+    readonly leaseEpoch: number;
+    readonly reason: "capture_in_progress" | "rotation_in_progress" | "provider_recovery_in_progress";
+    readonly backend: string;
+    readonly instanceId: string | null;
+    readonly liveness: SandboxLeaseLiveness;
+    readonly name = "SandboxLeaseTransitionError";
+    constructor(sandboxGroupId: string, leaseEpoch: number, reason: "capture_in_progress" | "rotation_in_progress" | "provider_recovery_in_progress", backend: string, instanceId: string | null, liveness: SandboxLeaseLiveness);
 }
 export type SandboxViewerForceDrainReason = "balance" | "warm_cap";
 export declare class SandboxViewerAdmissionBlockedError extends Error {
@@ -4011,6 +4597,7 @@ export declare function failSandboxRematerialization(db: Database, input: {
     rematerializationId: string;
     failureCode: string;
     retryable: boolean;
+    discardContinuity?: boolean;
 }): Promise<{
     failed: boolean;
     lease: LeaseSnapshot | null;
@@ -4041,11 +4628,14 @@ export declare function commitWarmingToWarm(db: Database, input: {
         id: string;
         verifiedRevision: string;
     };
+    /** Exact durable same-workspace receipt returned by the elected provider
+     * continuity recovery. Mutually exclusive with archive hydration. */
+    continuityRecovery?: SandboxProviderContinuityRecovery;
     leaseTtlMs: number;
 }): Promise<{
     committed: boolean;
     lease: LeaseSnapshot | null;
-    reason?: "stale_epoch" | "rematerialization_required" | "rematerialization_mismatch" | "archive_revision_mismatch" | "archive_generation_mismatch";
+    reason?: "stale_epoch" | "rematerialization_required" | "rematerialization_mismatch" | "recovery_mode_conflict" | "continuity_mismatch" | "archive_revision_mismatch" | "archive_generation_mismatch";
 }>;
 export declare function recordWarmingSandboxCreated(db: Database, input: {
     accountId: string;
@@ -4056,6 +4646,7 @@ export declare function recordWarmingSandboxCreated(db: Database, input: {
      *  archive-less create. Provider attribution is accepted only while the
      *  warming row still carries this same attempt as well as this epoch. */
     rematerializationId?: string | null;
+    continuityRecovery?: SandboxProviderContinuityRecovery;
     instanceId: string;
     resumeBackendId?: string | null;
     resumeState?: Record<string, unknown> | null;
@@ -4453,6 +5044,7 @@ export declare function failWarmingToCold(db: Database, input: {
     workspaceId: string;
     sandboxGroupId: string;
     expectedEpoch: number;
+    discardContinuity?: boolean;
 }): Promise<void>;
 export declare function releaseLeaseHolder(db: Database, input: {
     accountId: string;
@@ -4461,6 +5053,11 @@ export declare function releaseLeaseHolder(db: Database, input: {
     kind: LeaseHolderKind;
     holderId: string;
     idleGraceMs: number;
+    /** The caller has crossed the non-detachable physical boundary for this
+     * exact turn holder: every admitted attempt-owned workspace writer has
+     * resolved, rejected, or been physically quiesced. A cancellation listener
+     * that merely prevents a holder leak must leave this false. */
+    workspaceWritersQuiesced?: boolean;
 }): Promise<{
     liveness: SandboxLeaseLiveness;
     refcount: number;
@@ -4504,11 +5101,16 @@ export declare function reapStaleLeaseHolders(db: Database, input: {
      *  10s turn heartbeat, so only a DEAD worker's holder ever crosses it). 0/absent
      *  = legacy never-reap. */
     turnHolderTtlMs?: number;
+    /** Delete placement-controller holders after their BrowserSession or
+     *  ComputerSession heartbeat dies. Active controllers refresh both the
+     *  resource and holder in one API heartbeat; zero disables only for tests. */
+    interactionHolderTtlMs?: number;
     idleGraceMs: number;
 }): Promise<{
     reapedViewers: number;
     reapedDirect: number;
     reapedTurns: number;
+    reapedInteractions: number;
     warmingReset: number;
     drained: ReapDrainable[];
 }>;
@@ -4517,6 +5119,7 @@ export declare function reapStaleLeaseHoldersGlobal(db: Database, input: {
     /** Reap DEAD-WORKER turn holders staler than this (the lease TTL; see
      *  reapStaleLeaseHolders). 0/absent = never (legacy). */
     turnHolderTtlMs?: number;
+    interactionHolderTtlMs?: number;
     idleGraceMs: number;
 }): Promise<ReapDrainable[]>;
 export interface MeterableWarmLease {
@@ -4551,6 +5154,9 @@ export declare function confirmDrainCold(db: Database, input: {
     workspaceId: string;
     sandboxGroupId: string;
     expectedEpoch: number;
+    /** Exact durable teardown ownership. Omission asserts that no claim exists;
+     *  a replaced, newly installed, or expired claim always fences this commit. */
+    expectedCaptureId?: string;
     /** Definitive provider NotFound before this drain could capture /workspace.
      *  With no durable archive this must become typed unrecoverable, never a
      *  clean cold lease that can expose an empty replacement. */
@@ -4679,6 +5285,8 @@ export declare function advanceWorkspaceGeneration(db: Database, input: {
     /** Wait before provider admission while an exact archive capture owns this
      * lease. The attempt/route fences are re-read on every bounded retry. */
     captureWaitMs?: number;
+    /** Cancel the bounded transition wait without creating an admission. */
+    waitSignal?: AbortSignal;
     /** Active-routed mutations bind to the exact session pointer. Omitted means
      * an intentional home-provider write outside the routing surface. */
     routeKind?: "home" | "active";
@@ -4701,6 +5309,7 @@ export declare function advanceWorkspaceGenerationForDirectRequest(db: Database,
     routeEpoch: number;
     operation: string;
     captureWaitMs?: number;
+    waitSignal?: AbortSignal;
 }): Promise<SandboxWorkspaceMutationAdmission>;
 /** Admit one model/user-visible stdin write for an exact retained process. The
  * process's original provider and route are authoritative even if the session's
@@ -4712,6 +5321,7 @@ export declare function advanceWorkspaceGenerationForRetainedProcess(db: Databas
     processId: string;
     operation: string;
     captureWaitMs?: number;
+    waitSignal?: AbortSignal;
 }): Promise<SandboxWorkspaceMutationAdmission>;
 /** Physically settle one exact provider mutation admission after its promise
  * resolves or rejects. Rejections need no output acceptance, but still clear
@@ -4896,8 +5506,58 @@ export declare function readWorkspaceArchiveCapturePreflight(db: Database, input
     archiveGeneration: number | null;
     archiveComplete: boolean;
 } | null>;
+export declare const SANDBOX_REAPER_HOLD_MAX_TTL_MS: number;
+/** Read the exact operator-hold target without exposing it across an
+ * account/workspace mismatch. The operator CLI projects only non-secret fields
+ * from this snapshot; resumeState remains an internal DB contract. */
+export declare function readSandboxLeaseReaperHoldTarget(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+}): Promise<LeaseSnapshot | null>;
+export type SandboxLeaseReaperHoldResult = {
+    status: "held";
+    renewed: boolean;
+    lease: LeaseSnapshot;
+} | {
+    status: "lease_fenced" | "not_live" | "held_by_other" | "teardown_in_progress" | "rotation_in_progress" | "provider_deadline_conflict" | "reason_conflict";
+    lease: LeaseSnapshot | null;
+};
+/**
+ * Install or renew a bounded operator preservation gate on one exact physical
+ * lease. The row lock serializes this decision with reaper claim acquisition.
+ * A hold never creates/resumes a provider and never overrides teardown already
+ * issued: callers must receive a positive receipt before relying on it.
+ */
+export declare function acquireSandboxLeaseReaperHold(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    expectedEpoch: number;
+    expectedInstanceId: string;
+    holdId: string;
+    ttlMs: number;
+    /** Preserve this much configured rotation headroom after the hold expires.
+     *  Callers should pass the deployment's sandboxRotationLeadMs. */
+    providerDeadlineHeadroomMs: number;
+    reason: string;
+}): Promise<SandboxLeaseReaperHoldResult>;
+/** Release only the exact operator receipt on the exact physical lease. */
+export declare function releaseSandboxLeaseReaperHold(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    expectedEpoch: number;
+    expectedInstanceId: string;
+    holdId: string;
+}): Promise<boolean>;
 export type WorkspaceArchiveCaptureClaim = {
     id: string;
+    operationId: string;
+    providerRequestId: string;
+    providerReplaySafe: boolean;
+    takeoverSafe: boolean;
+    attempt: number;
     leaseId: string;
     leaseEpoch: number;
     instanceId: string;
@@ -4906,13 +5566,29 @@ export type WorkspaceArchiveCaptureClaim = {
     archiveComplete: boolean;
     startedAt: Date;
     deadlineAt: Date;
+    /** Non-null only after a verified drain archive was atomically published
+     * under this exact capture. Such a claim may finish teardown, never recapture
+     * or release/re-arm. */
+    publishedAt: Date | null;
 };
+/** Read the authoritative takeover clock for one exact unpublished capture.
+ * Provider recovery must never compare a Postgres deadline with an application
+ * wall clock: clock skew could otherwise fence a still-accepted provider
+ * request early. The eventual replacement remains a separate exact CAS. */
+export declare function workspaceArchiveCaptureDeadlineElapsed(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    captureId: string;
+    expectedEpoch: number;
+    expectedInstanceId: string;
+}): Promise<boolean>;
 export type ClaimWorkspaceArchiveCaptureResult = {
     status: "claimed";
     claim: WorkspaceArchiveCaptureClaim;
     lease: LeaseSnapshot;
 } | {
-    status: "lease_fenced" | "attempt_fenced" | "capture_in_progress" | "holder_in_progress" | "mutation_in_progress" | "throttled";
+    status: "lease_fenced" | "attempt_fenced" | "reaper_held" | "capture_in_progress" | "holder_in_progress" | "mutation_in_progress" | "throttled";
 };
 /**
  * Atomically reserve one live provider for archive capture. Modal pauses a box
@@ -4925,11 +5601,19 @@ export declare function claimWorkspaceArchiveCapture(db: Database, input: {
     workspaceId: string;
     sandboxGroupId: string;
     captureId: string;
+    /** Stable logical request across retries. Old callers default to the exact
+     * capture id and are normalized the same way by migration 0184's trigger. */
+    operationId?: string;
+    attempt?: number;
     expectedEpoch: number;
     expectedInstanceId: string;
     liveness: "warm" | "draining";
     captureTimeoutMs: number;
     minIntervalMs: number;
+    /** Explicit provider-registry proof. Optional false defaults preserve safe
+     * rolling behavior for pre-policy callers. */
+    providerReplaySafe?: boolean;
+    takeoverSafe?: boolean;
     warmAttempt?: {
         sessionId: string;
         turnId: string;
@@ -4948,17 +5632,21 @@ export declare function releaseWorkspaceArchiveCapture(db: Database, input: {
     expectedInstanceId: string;
 }): Promise<boolean>;
 /**
- * Replace an expired capture claim without ever opening the admission gate.
- * This is reserved for the zero-holder drain reaper after it has independently
- * proved the exact provider is command-ready (and therefore no longer paused by
- * the dead owner's capture). The old claim remains authoritative on every miss.
+ * Replace a capture attempt without ever opening the admission gate. A generic
+ * provider remains deadline-gated. A provider registration explicitly recorded
+ * as takeover-safe may retry immediately, using either same-request idempotency
+ * or an independently repeatable read-only capture.
+ * captureId changes to fence teardown ownership; providerRequestId deliberately
+ * does not, so a predecessor success remains adoptable by its successor.
  */
-export declare function replaceExpiredWorkspaceArchiveCapture(db: Database, input: {
+export declare function replaceWorkspaceArchiveCaptureAfterProof(db: Database, input: {
     accountId: string;
     workspaceId: string;
     sandboxGroupId: string;
     priorCaptureId: string;
     captureId: string;
+    operationId: string;
+    attempt: number;
     expectedEpoch: number;
     expectedInstanceId: string;
     captureTimeoutMs: number;
@@ -4989,6 +5677,15 @@ export declare function registerSandboxCheckpointArtifact(db: Database, input: {
     providerBinding: Record<string, unknown>;
     workspaceArchive: string;
     workspaceArchiveMeta: SandboxArchiveRevision;
+    /**
+     * Workspace checkpoints are identified by their exact capture source.
+     * Provider-image builds instead use a provider-owned idempotency key: a
+     * retry may run from a successor verifier lease but must converge on the
+     * same exact immutable object. The first source remains immutable
+     * provenance; only a byte-identical object in the same tenant/group may be
+     * reused.
+     */
+    registrationIdentity?: "capture" | "provider_object";
 }): Promise<SandboxCheckpointArtifactRegistration>;
 /** Hand an unpublished candidate to asynchronous GC. Referenced artifacts are
  * protected both here and by the global claim function. */
@@ -5064,10 +5761,14 @@ export declare function persistDrainSnapshot(db: Database, input: {
     accountId: string;
     workspaceId: string;
     sandboxGroupId: string;
+    /** Exact source lease identity. Required for cold late-result adoption. */
+    expectedLeaseId?: string;
     expectedEpoch: number;
     expectedInstanceId: string;
     expectedWorkspaceGeneration: number;
     captureId: string;
+    /** Stable provider-operation lineage across atomic claim replacements. */
+    providerRequestId?: string;
 } & ({
     /** Null performs only the epoch/instance/generation CAS check. */
     workspaceArchive: null;
@@ -5323,6 +6024,7 @@ export type EnrollmentRecord = {
     desktopUnavailableReason: string | null;
     allowScreenControl: boolean;
     status: EnrollmentStatus;
+    credentialGeneration: number;
     os: EnrollmentOs;
     arch: string;
     lastSeenAt: string | null;
@@ -5360,6 +6062,51 @@ export declare function getEnrollment(db: Database, workspaceId: string, enrollm
 export declare function listEnrollments(db: Database, workspaceId: string, options?: {
     status?: EnrollmentStatus;
 }): Promise<EnrollmentRecord[]>;
+export type MachineRemovalOutcome = (typeof schema.machineRemovalOperationOutcomeValues)[number];
+export type MachineRemovalBlockCode = "active_route" | "active_commands" | "machine_home" | "active_lease" | "recovery_pending" | "not_selfhosted";
+export type MachineRemovalResult = {
+    enrollmentId: string;
+    outcome: MachineRemovalOutcome;
+    removed: boolean;
+    machineName: string | null;
+    lastSeenAt: string | null;
+    revokedAt: string | null;
+    code: MachineRemovalBlockCode | null;
+    message: string;
+    action: string;
+    dependentSessions: Array<{
+        id: string;
+        title: string | null;
+    }>;
+};
+export declare class MachineRemovalIdempotencyError extends Error {
+    readonly name = "MachineRemovalIdempotencyError";
+}
+export declare class MachineRemovalRevisionConflictError extends Error {
+    readonly currentUpdatedAt: string;
+    readonly name = "MachineRemovalRevisionConflictError";
+    constructor(message: string, currentUpdatedAt: string);
+}
+/**
+ * Remove one connected-machine enrollment without touching the durable identity
+ * or any session/route/archive evidence. The enrollment row is the lifecycle
+ * truth: status -> revoked rejects future auth-callout/heartbeat/reconnect
+ * attempts, while a fresh device-flow re-enrollment can reactivate the same
+ * public-key identity with a new credential family.
+ *
+ * The operation key is scoped to the workspace and is receipt-backed. A retry
+ * with the same key and request fingerprint replays the exact committed result;
+ * a different fingerprint is rejected rather than risking an accidental replay
+ * against a changed control-plane revision.
+ */
+export declare function removeEnrollment(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    enrollmentId: string;
+    operationKey: string;
+    expectedUpdatedAt?: string;
+    subjectId?: string | null;
+}): Promise<MachineRemovalResult | null>;
 export declare function revokeEnrollment(db: Database, input: {
     accountId: string;
     workspaceId: string;
@@ -5367,6 +6114,14 @@ export declare function revokeEnrollment(db: Database, input: {
 }): Promise<{
     revoked: boolean;
 }>;
+export declare function revokeEnrollmentByGeneration(db: Database, input: {
+    workspaceId: string;
+    enrollmentId: string;
+    credentialGeneration: number;
+}): Promise<{
+    matched: boolean;
+    revoked: boolean;
+}>;
 export declare function touchEnrollmentLastSeen(db: Database, input: {
     accountId: string;
     workspaceId: string;
@@ -5941,6 +6696,8 @@ export type InitializeSessionStartResult = {
     turn: SessionTurn | null;
     temporalWorkflowId: string;
     workflowWakeRevision: number | null;
+    /** True when this call installed/repaired start state or committed a new wake revision. */
+    changed: boolean;
 };
 /**
  * Install a newly created session's complete first runnable unit atomically.
@@ -5998,9 +6755,12 @@ export type SessionAttemptInterruptionSettlement = {
  * exact turn -> exact attempt lock order and require the durable interruption.
  * Temporal activity cancellation/terminalization is transport state only. The
  * workflow admits a replacement from this durable receipt, never from the
- * activity promise.
+ * activity promise. The same boundary also applies when the activity itself
+ * durably requested same-turn recovery (for example during a worker rollout):
+ * that recovery event is the logical settlement cause in place of a
+ * Pause/Steer interruption row.
  */
-export declare function markSessionAttemptQuiesced(db: Database, input: {
+export type MarkSessionAttemptQuiescedInput = {
     accountId?: string;
     workspaceId: string;
     sessionId: string;
@@ -6015,7 +6775,19 @@ export declare function markSessionAttemptQuiesced(db: Database, input: {
      * admission remains strict because only a durable interruption needs this
      * receipt. */
     allowUninterrupted?: boolean;
-}): Promise<SessionEvent[]>;
+};
+export type SessionAttemptQuiescenceCommit = {
+    events: SessionEvent[];
+    /** The exact still-undelivered outbox fact created by this commit, or found
+     * on an idempotent replay after a post-commit caller failure. Postgres remains
+     * the durable fallback; callers may deliver this fact immediately. */
+    workflowWake: SessionWorkflowWake | null;
+};
+export declare function commitSessionAttemptQuiescence(db: Database, input: MarkSessionAttemptQuiescedInput): Promise<SessionAttemptQuiescenceCommit>;
+/** Compatibility projection for callers that only publish the committed
+ * events. The turn activity uses `commitSessionAttemptQuiescence` so it can
+ * immediately deliver the returned durable wake without waiting for repair. */
+export declare function markSessionAttemptQuiesced(db: Database, input: MarkSessionAttemptQuiescedInput): Promise<SessionEvent[]>;
 export type ReconcileSessionAttemptQuiescenceResult = {
     action: "quiesced";
     events: SessionEvent[];
@@ -6490,7 +7262,7 @@ export declare function addSessionSystemUpdate(db: Database, input: AddSessionSy
  * Persist one internal update without fabricating a user prompt or queue row.
  * Dedupe and any producer/outbox mutation commit in the same transaction.
  */
-export declare function addSessionSystemUpdateWithSourceMutation(db: Database, input: AddSessionSystemUpdateInput, mutateSource: (tx: Database, wakeEventId: string | null) => Promise<void>): Promise<AddSessionSystemUpdateResult>;
+export declare function addSessionSystemUpdateWithSourceMutation(db: Database, input: AddSessionSystemUpdateInput, mutateSource: (tx: Database, wakeEventId: string | null, updateId: string | null) => Promise<void>): Promise<AddSessionSystemUpdateResult>;
 export declare function listOutstandingSessionSystemUpdates(db: Database, workspaceId: string, sessionId: string): Promise<SessionSystemUpdate[]>;
 /** Internal updates atomically attached when this inference was claimed. */
 export declare function listSessionSystemUpdatesForTurn(db: Database, workspaceId: string, sessionId: string, turnId: string): Promise<SessionSystemUpdate[]>;
@@ -6527,6 +7299,46 @@ export declare function appendSessionEventsForTurnAttempt(db: Database, workspac
     events: SessionEvent[];
     accepted: boolean;
 }>;
+/**
+ * Commit one exact-attempt mutation and its timeline projection together. The
+ * mutation runs first so Codemode's operation-row lock order remains stable;
+ * returning false leaves both the mutation and projection absent.
+ */
+export declare function mutateAndAppendSessionEventsForTurnAttempt(db: Database, workspaceId: string, sessionId: string, turnId: string, executionGeneration: number, attemptId: string, inputs: AppendEventInput[], mutate: (tx: Database) => Promise<boolean>): Promise<{
+    events: SessionEvent[];
+    accepted: boolean;
+    mutationApplied: boolean;
+}>;
+export type SettleCodemodeOperationWithOutputInput = {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+    operationId: string;
+    claimId: string;
+    producerId: string;
+    settlement: {
+        state: "completed";
+        result: AttemptToolResult;
+    } | {
+        state: "failed" | "outcome_unknown";
+        errorCode: string;
+        errorMessage: string;
+    };
+};
+/**
+ * The Codemode terminal journal row and its visible tool-call output are one
+ * PostgreSQL commit. A worker crash can lose only live NATS fanout, which the
+ * ordinary durable event replay repairs; it cannot leave a completed call
+ * permanently spinning in the timeline.
+ */
+export declare function settleCodemodeOperationWithOutput(db: Database, input: SettleCodemodeOperationWithOutputInput): Promise<{
+    committed: boolean;
+    events: SessionEvent[];
+    accepted: boolean;
+}>;
 export declare function appendSessionEventToSandboxGroup(db: Database, workspaceId: string, sandboxGroupId: string, input: AppendEventInput): Promise<SessionEvent[]>;
 export declare function appendSessionEventsAndUpdateSession(db: Database, workspaceId: string, sessionId: string, inputs: AppendEventInput[], update: {
     resources?: ResourceRef[];
@@ -6557,7 +7369,14 @@ type LockedSessionUpdateResult = {
         activeTurnId?: string | null;
     };
 };
-export declare function appendSessionEventsWithLockedSessionUpdate(db: Database, workspaceId: string, sessionId: string, build: (session: Session, context: LockedSessionUpdateContext) => LockedSessionUpdateResult | Promise<LockedSessionUpdateResult>, options?: {
+/**
+ * Serialize a callback with the session/event lock prefix and append its result.
+ * Callers must declare whether the callback can produce semantic activity. A
+ * raw-only declaration skips the commit gate and is verified before any event
+ * or session-row write; conditional semantic callbacks may legitimately no-op.
+ */
+export declare function appendSessionEventsWithLockedSessionUpdate(db: Database, workspaceId: string, sessionId: string, build: (session: Session, context: LockedSessionUpdateContext) => LockedSessionUpdateResult | Promise<LockedSessionUpdateResult>, options: {
+    activity: "raw-only" | "semantic";
     lockParentSession?: boolean;
 }): Promise<SessionEvent[]>;
 export declare function sessionSubject(workspaceId: string, sessionId: string): string;
@@ -6565,7 +7384,20 @@ export declare function buildCodexTokenResolver(db: Database, settings: Settings
 export declare function fetchCodexUsageForAccount(db: Database, settings: Settings, workspaceId: string, credentialId: string, fetchImpl?: CodexFetch): ReturnType<typeof fetchCodexUsageForAccountCore>;
 export declare function fetchCodexRateLimitResetCreditsForAccount(db: Database, settings: Settings, workspaceId: string, credentialId: string, fetchImpl?: CodexFetch): ReturnType<typeof fetchCodexRateLimitResetCreditsForAccountCore>;
 export declare function buildConnectionTokenResolver(db: Database, settings: Settings, deps?: ConnectionBrokerDeps, options?: ConnectionTokenResolverOptions): ReturnType<typeof buildConnectionTokenResolverCore>;
-export { withCodexTokenDeadline, type CodexAccountUsageSnapshot, type CodexAuthDeps, type CodexCredentialForRun, type CodexCredentialTokens, type CodexRateLimitResetCreditsAccountResult, type CodexTokenDeadlineClock, type CodexTokenDeadlineOptions, } from "./codex-token-resolver";
-export { buildHostConnectionTokenResolver, ConnectionRefreshHttpError, HostMcpCredentialBindingError, HostMcpCredentialScopeError, isPrivateAddress, normalizeBearerScheme, refreshOAuthConnectionCredential, type ConnectionBrokerDeps, type ConnectionCredentialForBroker, type ConnectionCredentialLookupInput, type ConnectionStatusGuard, type ConnectionTokenRefreshInput, type ConnectionTokenResolverOptions, type HostMcpCredentialResolverContext, type PermanentConnectionRefreshFailure, type RefreshTransportOptions, type ResolveConnectionCredentialInput, type ResolveConnectionCredentialResult, } from "./connection-token-resolver";
-export * from "./workspace-artifacts";
-export * from "./transcription-recordings";
+export { withCodexTokenDeadline, type CodexAccountUsageSnapshot, type CodexAuthDeps, type CodexCredentialForRun, type CodexCredentialTokens, type CodexRateLimitResetCreditsAccountResult, type CodexTokenDeadlineClock, type CodexTokenDeadlineOptions, } from "./codex-token-resolver.js";
+export { buildHostConnectionTokenResolver, ConnectionRefreshHttpError, HostMcpCredentialBindingError, HostMcpCredentialScopeError, isPrivateAddress, normalizeBearerScheme, refreshOAuthConnectionCredential, type ConnectionBrokerDeps, type ConnectionCredentialForBroker, type ConnectionCredentialLookupInput, type ConnectionStatusGuard, type ConnectionTokenRefreshInput, type ConnectionTokenResolverOptions, type HostMcpCredentialResolverContext, type PermanentConnectionRefreshFailure, type RefreshTransportOptions, type ResolveConnectionCredentialInput, type ResolveConnectionCredentialResult, } from "./connection-token-resolver.js";
+export { CapabilityComponentVersionConflictError, cleanupOrphanedCapabilityComponents, effectiveCapabilityOwnerSql, type CapabilityComponentOwnerIdentity, } from "./capability-components.js";
+export { adoptPackComponentReferences, finalizePackComponentOwnership, listPackInstallationComponents, PackComponentResolutionError, previewPackComponentRelease, recordPackInlineSkillComponent, releasePackComponents, resolvePackComponentReferences, resolvePackInlineSkillReferences, type PackInlineSkillRequirement, type StoredPackInstallationComponent, } from "./pack-components.js";
+export { deferPackInstallationOperation, finalizePackInstallationOperation, finalizePackUninstallOperation, PackManifestChangedError, PackOperationClaimLostError, PackOperationInProgressError, PackInstallationVersionConflictError, PackInstallationVersionRequiredError, PackOperationIdempotencyError, preparePackInstallationOperation, preparePackUninstallOperation, touchPackInstallationOperation, type PreparedPackInstallation, } from "./pack-installations.js";
+export { checkpointPluginPackageOperation, deferPluginPackageOperation, finalizePluginPackageInstall, getInstalledPluginPackage, getPluginPackageUninstallPreview, installPluginMcpReference, listInstalledPluginPackages, PluginInstallationVersionConflictError, PluginInstallationVersionRequiredError, PluginOperationIdempotencyError, preparePluginPackageInstall, uninstallPluginPackage, type InstalledPluginPackage, type InstalledPluginPackageSummary, type PluginBomComponent, type PreparedPluginPackage, } from "./plugin-packages.js";
+export * from "./workspace-artifacts.js";
+export * from "./transcription-recordings.js";
+export * from "./editable-artifacts.js";
+export * from "./editable-artifact-materialization.js";
+export * from "./attempt-tool-catalogs.js";
+export * from "./codemode-operations.js";
+export * from "./browser-sessions.js";
+export * from "./computer-sessions.js";
+export * from "./browser-identities.js";
+export * from "./browser-auth.js";
+export * from "./attached-browser-devices.js";