@opengeni/db 0.31.1 → 0.36.0

package/dist/index.d.ts

@@ -1,5 +1,6 @@
-import type { AccessContext, AccessGrant, AccessPrincipalKind, ApiKey, AttemptToolResult, BillingBalance, CapabilityCatalogItem, CapabilityInstallation, CapabilityKind, CapabilityPack, CapabilitySource, ConnectionKind, ConnectionMetadata, ConnectionStatus, DocumentAuthorityKind, McpServerConnectionRef, FileAsset, FileUploadStatus, FirstPartyMcpToolName, HumanInputQuestion, HumanInputResponse, KnowledgeMemory, KnowledgeMemoryKind, KnowledgeMemoryStatus, KnowledgeSourceRef, GitHubInstallationAuthorityKind, GitHubRepositoryScope, HostEventExportBatch, HostUsageExportBatch, ManagedAccount, McpPersonalConnectionDelegation, Permission, PackInstallation, PackInstallationStatus, ResourceRef, SandboxBackend, SandboxOs, ScheduledTask, ScheduledTaskAction, ScheduledTaskActionKind, KnowledgeSourceSyncAction, ScheduledTaskAgentConfig, ScheduledTaskOverlapPolicy, ScheduledTaskRun, ScheduledTaskRunMode, ScheduledTaskRunStatus, ScheduledTaskScheduleSpec, ScheduledTaskStatus, ScheduledTaskTriggerType, SlackInstallationBinding, Session, SessionAuthorizationListScope, SessionListResponse, SessionEvent, SessionEventPayloadMode, SessionEventReadDirection, SessionEventSemanticClass, SessionEventType, SessionGoal, SessionGoalCreatedBy, SessionGoalStatus, SessionHumanInputRequest, LineageNode, SessionMcpApprovalPolicy, SessionSkill, SessionMcpServerMetadata, SessionStatus, SessionToolPolicy, SessionTurn, SessionQueueSnapshot, SessionSystemUpdate, SessionSystemUpdateKind, SystemUpdateClassification, SessionTurnSource, SessionTurnStatus, TurnInitiator, TurnInitiatorContext, SocialConnection, SocialConnectionStatus, SocialPost, SocialProvider, ToolRef, ReasoningEffort, UsageEvent, Workspace, WorkspaceControlEvent, VariableSet, VariableSetSecret, VariableSetVariableMetadata, WorkspaceMember, WorkspaceRegisteredPack, Rig, RigProviderImage, RigProviderImages, RigVersion, RigChange, RigChangeKind, RigChangeStatus, RigCheck, NativeSnapshotDescriptor, TarWorkspaceArchiveDescriptor, WorkspaceArchiveDescriptor, ModalCheckpointProviderBinding, SandboxProviderContinuityRecovery } from "@opengeni/contracts";
-import { type TimelineAnnotation } from "@opengeni/contracts";
+import { SessionGoalSnapshot } from "@opengeni/contracts";
+import type { AccessContext, AccessGrant, AccessPrincipalKind, ApiKey, AttemptToolResult, BillingBalance, CapabilityCatalogItem, CapabilityInstallation, CapabilityPack, CapabilitySource, ConnectionKind, ConnectionMetadata, ConnectionStatus, DocumentAuthorityKind, McpServerConnectionRef, FileAsset, FileUploadStatus, FirstPartyMcpToolName, HumanInputQuestion, HumanInputResponse, KnowledgeMemory, KnowledgeMemoryKind, KnowledgeMemoryStatus, KnowledgeSourceRef, GitHubInstallationAuthorityKind, GitHubRepositoryScope, HostEventExportBatch, HostUsageExportBatch, ManagedAccount, ManagedOrganizationMembershipProjection, McpPersonalConnectionDelegation, Permission, PackInstallation, PackInstallationStatus, ResourceRef, SandboxBackend, SandboxOs, ScheduledTask, ScheduledTaskAction, ScheduledTaskActionKind, KnowledgeSourceSyncAction, ScheduledTaskAgentConfig, ScheduledTaskOverlapPolicy, ScheduledTaskRun, ScheduledTaskRunMode, ScheduledTaskRunStatus, ScheduledTaskScheduleSpec, ScheduledTaskStatus, ScheduledTaskTriggerType, SlackInstallationBinding, Session, SessionAuthorizationListScope, SessionListResponse, SessionEvent, SessionEventPayloadMode, SessionEventReadDirection, SessionEventSemanticClass, SessionEventType, SessionGoal, SessionGoalChangeKind, SessionGoalCreatedBy, SessionGoalMutationPolicy, SessionGoalRevision, SessionGoalStatus, SessionHumanInputRequest, LineageNode, SessionMcpApprovalPolicy, SessionSkill, SessionMcpServerMetadata, SessionStatus, SessionToolPolicy, SessionTurn, SessionQueueSnapshot, SessionSystemUpdate, SessionSystemUpdateKind, SystemUpdateClassification, SessionTurnSource, SessionTurnStatus, TurnInitiator, TurnInitiatorContext, SocialConnection, SocialConnectionStatus, SocialPost, SocialProvider, ToolRef, ReasoningEffort, UsageEvent, Workspace, WorkspaceControlEvent, VariableSet, VariableSetSecret, VariableSetVariableMetadata, WorkspaceMember, WorkspaceMemoryPromptMode, WorkspaceRegisteredPack, Channel, Rig, RigProviderImage, RigProviderImages, RigVersion, RigChange, RigChangeKind, RigChangeStatus, RigCheck, NativeSnapshotDescriptor, TarWorkspaceArchiveDescriptor, WorkspaceArchiveDescriptor, ModalCheckpointProviderBinding, SandboxProviderContinuityRecovery } from "@opengeni/contracts";
+import { RequestHumanInteractionToolInput, XaiProviderAccountAuthoritySnapshotV1, type TimelineAnnotation } from "@opengeni/contracts";
 import { type LatencyMode, SessionSystemUpdatePayload, TurnExecutionPolicyV1 } from "@opengeni/contracts";
 import { type Settings } from "@opengeni/config";
 import { type CodexFetch } from "@opengeni/codex";
@@ -20,14 +21,17 @@ export * from "./new-session-drafts.js";
 export * from "./workspace-instruction-policies.js";
 export * from "./company-profile.js";
 export * from "./workspace-learning-policy.js";
+export * from "./slack-task-policy.js";
 export * from "./preference-registry.js";
 export * from "./memory-governance.js";
 export * from "./memory-slack-delivery.js";
 export * from "./scoped-knowledge.js";
 export * from "./knowledge-source-sync.js";
+export * from "./task-notes.js";
 export * from "./generated-images.js";
 export * from "./slack-user-link-access.js";
 export * from "./video-generation.js";
+export * from "./xai-subscription.js";
 export { interruptedToolCallResult } from "./session-tool-call-settlement.js";
 export { decryptEnvironmentValue, encryptEnvironmentValue } from "./environment-crypto.js";
 export { decryptEnvironmentValue as decryptVariableSetValue, encryptEnvironmentValue as encryptVariableSetValue, } from "./environment-crypto.js";
@@ -35,14 +39,15 @@ export * from "./persistence-errors.js";
 export * from "./runtime-posture.js";
 export * from "./capability-integrations.js";
 export * from "./integration-bindings.js";
-export * from "./integration-features.js";
+export * from "./integration-facets.js";
 export * from "./insights.js";
 export { memoryTextForStorage } from "./memory-domain.js";
 export { migrate, runMigrations } from "./migrate.js";
 export { provisionRoles, type ProvisionResult, type ProvisionRolesOptions, } from "./provision-roles.js";
 export * from "./memory-domain.js";
 import { type Database, type SessionActivityDatabase } from "./database.js";
-export { createDb, registerDbBinding, retrySessionActivityRls, rlsContextForWorkspace, rlsStrategyFor, setRlsContext, setSubjectRlsContext, withAccountRls, withDatabaseStatementTimeout, withRlsContext, withSessionActivityRlsContext, withSessionActivitySavepoint, withWorkspaceRls, withWorkspaceSessionActivityRls, withWorkspaceSubjectRls, withWorkspaceSubjectSessionActivityRls, withWorkspaceUsageLock, withSandboxProviderReadLock, SandboxProviderReadLockUnavailableError, type CreateDbOptions, type Database, type DbClient, type SessionActivityDatabase, type RlsContext, type RlsStrategy, type SandboxProviderReadLockIdentity, type UserLookup, } from "./database.js";
+export { createDb, registerDbBinding, retrySessionActivityRls, rlsContextForWorkspace, rlsStrategyFor, setRlsContext, setSubjectRlsContext, withAccountRls, withDatabaseStatementTimeout, withRlsContext, withSessionActivityRlsContext, withSessionActivitySavepoint, withWorkspaceRls, withWorkspaceSessionActivityRls, withWorkspaceSubjectRls, withWorkspaceSubjectSessionActivityRls, withWorkspaceUsageLock, withSandboxProviderReadLock, SandboxProviderReadLockUnavailableError, type CreateDbOptions, type Database, type DbClient, type SessionActivityDatabase, type RlsContext, type SessionRlsActorContext, type RlsStrategy, type SandboxProviderReadLockIdentity, type UserLookup, } from "./database.js";
+export { withSessionRlsActorContext } from "./database.js";
 import { buildCodexTokenResolver as buildCodexTokenResolverCore, fetchCodexRateLimitResetCreditsForAccount as fetchCodexRateLimitResetCreditsForAccountCore, fetchCodexUsageForAccount as fetchCodexUsageForAccountCore, type CodexAccountUsageSnapshot, type CodexAuthDeps, type CodexCredentialForRun } from "./codex-token-resolver.js";
 import { buildConnectionTokenResolver as buildConnectionTokenResolverCore, type ConnectionBrokerDeps, type ConnectionCredentialForBroker, type ConnectionTokenResolverOptions } from "./connection-token-resolver.js";
 /** Raised when a durable session tool-policy write lost its version fence. */
@@ -246,6 +251,15 @@ export declare function ensureManagedAccessForUser(db: Database, input: {
     email: string;
     name: string;
 }): Promise<AccessContext>;
+export type ManagedAccessProvisioningResult = {
+    accessContext: AccessContext;
+    organizationMemberships: ManagedOrganizationMembershipProjection[];
+};
+export declare function ensureManagedAccessForUserWithOrganizationMemberships(db: Database, input: {
+    userId: string;
+    email: string;
+    name: string;
+}): Promise<ManagedAccessProvisioningResult>;
 export declare function getWorkspace(db: Database, workspaceId: string): Promise<Workspace | null>;
 export declare function getManagedAccount(db: Database, accountId: string): Promise<ManagedAccount | null>;
 export declare function requireWorkspace(db: Database, workspaceId: string): Promise<Workspace>;
@@ -598,6 +612,7 @@ export type CreateScheduledTaskInput = {
     createdByContext?: TurnInitiatorContext;
     createdByActor?: AgentSessionCreationActor | null;
     personalConnectionDelegations?: McpPersonalConnectionDelegation[];
+    xaiProviderAccountAuthoritySnapshot?: XaiProviderAccountAuthoritySnapshotV1;
     targetSessionId?: string | null;
     variableSetId?: string | null;
     rigId?: string | null;
@@ -817,9 +832,10 @@ export type SlackBotPostOperation = {
     targetKind: "channel" | "user";
     targetId: string;
     requestDigest: string;
-    status: "provider_started" | "completed";
+    status: "pending" | "provider_started" | "outcome_unknown" | "completed";
     claimHolderId: string | null;
     claimExpiresAt: Date | null;
+    claimMode: "send" | "reconcile" | null;
     attemptCount: number;
     lastFailureCode: string | null;
     slackChannelId: string | null;
@@ -828,6 +844,24 @@ export type SlackBotPostOperation = {
     createdAt: Date;
     updatedAt: Date;
 };
+export type SlackBotUpdateOperation = {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    operationId: string;
+    slackChannelId: string;
+    slackMessageTimestamp: string;
+    requestDigest: string;
+    status: "provider_started" | "completed";
+    claimHolderId: string | null;
+    claimExpiresAt: Date | null;
+    attemptCount: number;
+    lastFailureCode: string | null;
+    completedAt: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+};
 export type SlackBotDeleteOperation = {
     id: string;
     accountId: string;
@@ -897,7 +931,7 @@ export type CreateCapabilityCatalogItemInput = {
     accountId: string;
     workspaceId: string;
     id: string;
-    kind: Exclude<CapabilityKind, "pack">;
+    kind: "mcp";
     source: CapabilitySource;
     name: string;
     description?: string | null;
@@ -972,7 +1006,7 @@ export type EnableCapabilityInstallationInput = {
     accountId: string;
     workspaceId: string;
     capabilityId: string;
-    kind: CapabilityKind;
+    kind: "mcp";
     config?: Record<string, unknown>;
     metadata?: Record<string, unknown>;
 };
@@ -982,13 +1016,18 @@ export type InstallPortableSkillInput = {
     subjectId: string;
     capabilityId: string;
     pluginKey: string;
-    source: "github" | "skills_sh" | "pack";
+    source: "library" | "github" | "skills_sh" | "pack";
     sourceUrl: string;
     repositoryUrl: string;
+    version?: string;
     sourceCommit: string;
     sourcePath: string;
     name: string;
     description: string;
+    category?: string;
+    tags?: string[];
+    provenance?: "platform" | "deployment" | "registry" | "workspace";
+    sourceProvenance?: string;
     contentSha256: string;
     totalBytes: number;
     license?: string | null;
@@ -1002,6 +1041,7 @@ export type InstallPortableSkillInput = {
     expectedInstallationVersion?: number;
 };
 export type InstalledPortableSkill = {
+    created: boolean;
     capabilityId: string;
     pluginId: string;
     pluginVersionId: string;
@@ -1009,7 +1049,8 @@ export type InstalledPortableSkill = {
     pluginInstallationId: string;
     facetInstallationId: string;
     installationVersion: number;
-    source: "github" | "skills_sh" | "pack";
+    source: "library" | "github" | "skills_sh" | "pack";
+    version: string;
     sourceUrl: string;
     sourceCommit: string;
     contentSha256: string;
@@ -1017,6 +1058,8 @@ export type InstalledPortableSkill = {
 };
 export type PortableSkillRuntime = {
     capabilityId: string;
+    source: "library" | "github" | "skills_sh" | "pack";
+    version: string;
     name: string;
     description: string;
     sourceUrl: string;
@@ -1028,6 +1071,29 @@ export type PortableSkillRuntime = {
         content: string;
     }>;
 };
+export type InstalledSkillSummary = {
+    capabilityId: string;
+    pluginKey: string;
+    installationVersion: number;
+    name: string;
+    description: string;
+    category: string;
+    tags: string[];
+    provenance: string;
+    source: "library" | "github" | "skills_sh" | "pack";
+    version: string;
+    sourceUrl: string;
+    repositoryUrl: string;
+    sourceCommit: string;
+    sourcePath: string;
+    contentSha256: string;
+    fileCount: number;
+    totalBytes: number;
+    license: string | null;
+    installedAt: string;
+    updatedAt: string;
+    owners: PortableSkillOwner[];
+};
 export type PortableSkillOwner = {
     kind: "direct" | "plugin" | "pack" | "migration";
     id: string;
@@ -1126,6 +1192,7 @@ export type EnqueueSessionTurnInput = {
     initiator: TurnInitiator;
     initiatorContext?: TurnInitiatorContext;
     personalConnectionDelegations?: McpPersonalConnectionDelegation[];
+    xaiProviderAccountAuthoritySnapshot?: XaiProviderAccountAuthoritySnapshotV1;
     /** Steer inserts before all waiting prompts; Send appends after them. */
     placement?: "head" | "tail";
 };
@@ -1138,6 +1205,8 @@ export type SessionTurnForExecution = SessionTurn & {
     personalConnectionDelegations: McpPersonalConnectionDelegation[];
     /** Worker-only causal authority; never inferred from the current worker. */
     initiatingHumanSubjectId: string | null;
+    xaiProviderAccountAuthoritySnapshot: XaiProviderAccountAuthoritySnapshotV1;
+    goalSnapshot: SessionGoalSnapshot;
 };
 export declare function createFileUpload(db: Database, input: {
     accountId: string;
@@ -1418,14 +1487,16 @@ export declare function upsertCapabilityCatalogItem(db: Database, input: CreateC
 export declare function listCapabilityCatalogItems(db: Database, workspaceId: string): Promise<CapabilityCatalogItem[]>;
 export declare function getCapabilityCatalogItem(db: Database, workspaceId: string, capabilityId: string): Promise<CapabilityCatalogItem | null>;
 /**
- * Install one immutable, already-validated portable Skill through the v2
- * Plugin/facet ownership model and dual-write the v1 compatibility projection.
- * Repeating the same exact source is idempotent; changing a commit's content
- * fails instead of silently rewriting immutable history.
+ * Install one immutable, already-validated Skill through the authoritative
+ * Plugin/Skill-Facet ownership model. Repeating the same exact source is
+ * idempotent; changing a commit's content fails instead of silently rewriting
+ * immutable history.
  */
 export declare function installPortableSkill(db: Database, input: InstallPortableSkillInput): Promise<InstalledPortableSkill>;
-/** Return exact text artifacts for active v2 Skill installations. */
+/** Return exact text artifacts for active authoritative Skill installations. */
 export declare function listInstalledPortableSkills(db: Database, workspaceId: string): Promise<PortableSkillRuntime[]>;
+/** Return secret-free lifecycle summaries from the authoritative Skill ledger. */
+export declare function listInstalledSkills(db: Database, workspaceId: string): Promise<InstalledSkillSummary[]>;
 export declare function getPortableSkillUninstallPreview(db: Database, workspaceId: string, capabilityId: string): Promise<PortableSkillUninstallPreview>;
 export declare function uninstallPortableSkill(db: Database, input: {
     accountId: string;
@@ -1512,7 +1583,7 @@ export type SlackBotUserLink = {
     createdAt: Date;
     updatedAt: Date;
 };
-export type SlackInteractionTriggerKind = "app_mention" | "dm" | "reaction" | "slash_command" | "message_shortcut" | "thread_reply";
+export type SlackInteractionTriggerKind = "app_mention" | "dm" | "reaction" | "slash_command" | "message_shortcut" | "thread_reply" | "block_action";
 export type SlackInteractionInboxEntry = {
     id: string;
     accountId: string;
@@ -1527,6 +1598,7 @@ export type SlackInteractionInboxEntry = {
     slackThreadTs: string | null;
     triggerKind: SlackInteractionTriggerKind;
     text: string;
+    hasFiles: boolean;
     status: "pending" | "processing" | "processed" | "failed";
     claimHolderId: string | null;
     claimExpiresAt: Date | null;
@@ -1548,6 +1620,7 @@ export type SlackInteraction = {
     slackThreadTs: string;
     routeKey: string;
     triggeringProviderEventId: string;
+    initiatingSlackUserId: string | null;
     owningSubjectId: string;
     visibility: "private" | "workspace";
     sessionReservationId: string;
@@ -1574,6 +1647,29 @@ export type SlackInteractionProgressDelivery = {
     operationId: string;
     createdAt: Date;
 };
+export type SlackInteractionActionKind = "approval_approve" | "approval_reject" | "human_input_select" | "human_input_skip" | "session_status" | "session_pause" | "session_resume" | "shared_result_publish";
+export type SlackInteractionActionHandle = {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    interactionId: string;
+    sessionId: string;
+    sessionEventSequence: number;
+    actionKind: SlackInteractionActionKind;
+    actionKey: string;
+    targetId: string | null;
+    targetValue: string | null;
+    authorizedSubjectId: string;
+    authorizedSlackUserId: string;
+    messageOperationId: string;
+    status: "pending" | "completed" | "stale";
+    result: string | null;
+    expiresAt: Date;
+    completedAt: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+};
 export declare function resolveSlackInstallationRoute(db: Database, slackTeamId: string): Promise<SlackInstallationRoute | null>;
 export declare function saveSlackBotUserLink(db: Database, input: Omit<SlackBotUserLink, "id" | "createdAt" | "updatedAt">): Promise<SlackBotUserLink>;
 export declare function getSlackBotUserLink(db: Database, workspaceId: string, connectionId: string, slackUserId: string): Promise<SlackBotUserLink | null>;
@@ -1600,11 +1696,42 @@ export declare function releaseSlackInteractionInbox(db: Database, input: {
     errorCode: string;
     retryAt: Date;
 }): Promise<boolean>;
-export declare function getOrCreateSlackInteraction(db: Database, input: Omit<SlackInteraction, "id" | "sessionReservationId" | "sessionId" | "lastDeliveredSessionEventSequence" | "deliveryClaimHolderId" | "deliveryClaimExpiresAt" | "deliveryAttemptCount" | "deliveryRetryAt" | "deliveryLastErrorCode" | "ackSlackMessageTs" | "progressCount" | "terminalDeliveryState" | "createdAt" | "updatedAt">): Promise<{
+export declare function getOrCreateSlackInteraction(db: Database, input: Omit<SlackInteraction, "id" | "initiatingSlackUserId" | "sessionReservationId" | "sessionId" | "lastDeliveredSessionEventSequence" | "deliveryClaimHolderId" | "deliveryClaimExpiresAt" | "deliveryAttemptCount" | "deliveryRetryAt" | "deliveryLastErrorCode" | "ackSlackMessageTs" | "progressCount" | "terminalDeliveryState" | "createdAt" | "updatedAt"> & {
+    initiatingSlackUserId?: string | null;
+}): Promise<{
     created: boolean;
     interaction: SlackInteraction;
 }>;
 export declare function getSlackInteractionByRoute(db: Database, workspaceId: string, connectionId: string, routeKey: string): Promise<SlackInteraction | null>;
+export declare function getSlackInteractionById(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    interactionId: string;
+}): Promise<SlackInteraction | null>;
+export declare function reserveSlackInteractionActionHandles(db: Database, input: {
+    interaction: Pick<SlackInteraction, "id" | "accountId" | "workspaceId" | "connectionId" | "sessionId" | "owningSubjectId" | "initiatingSlackUserId">;
+    sessionEventSequence: number;
+    messageOperationId: string;
+    expiresAt: Date;
+    actions: Array<{
+        actionKind: SlackInteractionActionKind;
+        actionKey: string;
+        targetId?: string | null;
+        targetValue?: string | null;
+    }>;
+}): Promise<SlackInteractionActionHandle[]>;
+export declare function getSlackInteractionActionHandle(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    handleId: string;
+}): Promise<SlackInteractionActionHandle | null>;
+export declare function settleSlackInteractionActionHandles(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    handleId: string;
+    result: string;
+    stale?: boolean;
+}): Promise<SlackInteractionActionHandle | null>;
 /**
  * Resolve an already-durable Slack task to its canonical interaction.
  *
@@ -1747,7 +1874,7 @@ export declare function recordSlackBotInstallCallbackFailure(db: Database, input
     reason: SlackBotInstallCallbackFailureReason;
 }): Promise<boolean>;
 export type ClaimSlackBotPostOperationResult = {
-    kind: "claimed" | "in_progress" | "completed";
+    kind: "claimed" | "reconcile" | "in_progress" | "completed";
     operation: SlackBotPostOperation;
 } | {
     kind: "conflict" | "connection_not_found";
@@ -1755,8 +1882,8 @@ export type ClaimSlackBotPostOperationResult = {
 /**
  * Claims one durable Slack post identity. The insert occurs before any provider
  * call; retries retain the original client_msg_id and immutable request digest.
- * A live claim suppresses concurrent sends, while a released/expired claim can
- * be reclaimed after response loss or process death.
+ * A live claim suppresses concurrent work. An expired provider_started claim is
+ * conservatively converted to outcome_unknown and may only be reconciled.
  */
 export declare function claimSlackBotPostOperation(db: Database, input: {
     accountId: string;
@@ -1769,12 +1896,20 @@ export declare function claimSlackBotPostOperation(db: Database, input: {
     claimHolderId: string;
     claimLeaseMs: number;
 }): Promise<ClaimSlackBotPostOperationResult>;
+export declare function markSlackBotPostOperationProviderStarted(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    operationId: string;
+    claimHolderId: string;
+}): Promise<boolean>;
 export declare function releaseSlackBotPostOperationClaim(db: Database, input: {
     accountId: string;
     workspaceId: string;
     connectionId: string;
     operationId: string;
     claimHolderId: string;
+    outcomeUnknown: boolean;
     failureCode: string;
 }): Promise<boolean>;
 export type CompleteSlackBotPostOperationResult = {
@@ -1797,6 +1932,40 @@ export declare function completeSlackBotPostOperation(db: Database, input: {
     auditMetadata: Record<string, unknown>;
 }): Promise<CompleteSlackBotPostOperationResult>;
 export declare function getSlackBotPostOperation(db: Database, workspaceId: string, connectionId: string, operationId: string): Promise<SlackBotPostOperation | null>;
+export type ClaimSlackBotUpdateOperationResult = {
+    kind: "claimed" | "in_progress" | "completed";
+    operation: SlackBotUpdateOperation;
+} | {
+    kind: "conflict" | "connection_not_found";
+};
+export declare function claimSlackBotUpdateOperation(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    operationId: string;
+    slackChannelId: string;
+    slackMessageTimestamp: string;
+    requestDigest: string;
+    claimHolderId: string;
+    claimLeaseMs: number;
+}): Promise<ClaimSlackBotUpdateOperationResult>;
+export declare function releaseSlackBotUpdateOperationClaim(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    operationId: string;
+    claimHolderId: string;
+    failureCode: string;
+}): Promise<boolean>;
+export declare function completeSlackBotUpdateOperation(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    operationId: string;
+    claimHolderId: string;
+    subjectId?: string | null;
+    auditMetadata: Record<string, unknown>;
+}): Promise<"completed" | "not_found" | "not_owned">;
 export type ClaimSlackBotDeleteOperationResult = {
     kind: "claimed" | "reconcile" | "in_progress" | "completed";
     operation: SlackBotDeleteOperation;
@@ -1956,6 +2125,8 @@ export type WorkspaceMemorySearchInput = {
     kind?: KnowledgeMemoryKind | undefined;
     limit?: number | undefined;
     mode?: WorkspaceMemorySearchMode | undefined;
+    /** Agent-only containment. Human audit/search callers omit this. */
+    agentPromptMode?: WorkspaceMemoryPromptMode | undefined;
 };
 export type WorkspaceMemorySearchResult = {
     memory: KnowledgeMemory;
@@ -2023,6 +2194,7 @@ export declare function createScheduledTask(db: Database, input: CreateScheduled
 export declare function updateScheduledTask(db: Database, workspaceId: string, taskId: string, input: UpdateScheduledTaskInput): Promise<ScheduledTask>;
 export declare function getScheduledTask(db: Database, workspaceId: string, taskId: string): Promise<ScheduledTask | null>;
 export declare function getScheduledTaskPersonalConnectionDelegations(db: Database, workspaceId: string, taskId: string): Promise<McpPersonalConnectionDelegation[]>;
+export declare function getScheduledTaskXaiProviderAccountAuthoritySnapshot(db: Database, workspaceId: string, taskId: string): Promise<XaiProviderAccountAuthoritySnapshotV1>;
 export declare function requireScheduledTask(db: Database, workspaceId: string, taskId: string): Promise<ScheduledTask>;
 export declare class ScheduledTaskTargetConflictError extends Error {
     constructor();
@@ -2183,6 +2355,31 @@ export declare function deleteRigIfNoActiveSessions(db: Database, workspaceId: s
     deleted: boolean;
     activeSessionCount: number;
 }>;
+export declare class ChannelNameConflictError extends Error {
+    constructor(name: string);
+}
+export declare class ChannelNotFoundError extends Error {
+    constructor(channelId: string);
+}
+export declare function createChannel(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    name: string;
+    description?: string | null;
+    createdBy?: string | null;
+}): Promise<Channel>;
+export declare function listChannels(db: Database, workspaceId: string): Promise<Channel[]>;
+export declare function getChannel(db: Database, workspaceId: string, channelId: string): Promise<Channel | null>;
+export declare function updateChannel(db: Database, workspaceId: string, channelId: string, input: {
+    name?: string | undefined;
+    description?: string | null | undefined;
+}): Promise<Channel | null>;
+export declare function deleteChannel(db: Database, workspaceId: string, channelId: string): Promise<boolean>;
+export declare function setSessionChannel(db: Database, input: {
+    workspaceId: string;
+    sessionId: string;
+    channelId: string | null;
+}): Promise<boolean>;
 export declare function countRigs(db: Database, workspaceId: string): Promise<number>;
 export declare function countSessionsUsingRig(db: Database, workspaceId: string, rigId: string): Promise<number>;
 export declare function createRigVersion(db: Database, workspaceId: string, rigId: string, input: RigVersionContentInput, options?: {
@@ -2866,6 +3063,101 @@ export declare function reconcileCodexCapacityWait<TPolicyScope = never, TUnavai
     resolvePolicyScope?: CodexCredentialLeasePolicyScopeResolver<TPolicyScope>;
     filterNewAllocationCandidates?: CodexCredentialLeaseCandidateFilter<TPolicyScope, TUnavailableDiagnostic>;
 }): Promise<ReconcileCodexCapacityWaitResult>;
+export type XaiCapacityWait = {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    goalId: string | null;
+    goalVersion: number | null;
+    blockedTurnId: string;
+    blockedTurnGeneration: number;
+    workflowId: string;
+    authorityScope: "workspace" | "user";
+    ownerOrganizationMembershipId: string | null;
+    status: CodexCapacityWaitStatus;
+    generation: number;
+    earliestResetAt: Date | null;
+    nextCheckAt: Date;
+    wakeRevision: number;
+    observedWakeRevision: number;
+    lastWakeReason: string;
+    createdAt: Date;
+    updatedAt: Date;
+};
+export type XaiCredentialLeaseQuarantine = {
+    kind: "status";
+    status: "needs_relogin" | "error";
+    lastError: string;
+} | {
+    kind: "cooldown";
+    until: Date;
+};
+export type ArmXaiCapacityWaitResult = {
+    action: "waiting";
+    waiter: XaiCapacityWait;
+    events: SessionEvent[];
+} | {
+    action: "stale";
+    waiter: XaiCapacityWait | null;
+    events: SessionEvent[];
+};
+export type ReconcileXaiCapacityWaitResult = {
+    action: "waiting";
+    waiter: XaiCapacityWait;
+    events: SessionEvent[];
+} | {
+    action: "resumed";
+    waiter: XaiCapacityWait;
+    events: SessionEvent[];
+} | {
+    action: "paused";
+    waiter: XaiCapacityWait;
+    events: SessionEvent[];
+} | {
+    action: "superseded";
+    waiter: XaiCapacityWait;
+    events: SessionEvent[];
+} | {
+    action: "stale";
+    waiter: XaiCapacityWait | null;
+    events: SessionEvent[];
+};
+/**
+ * Atomically close one exact xAI attempt and preserve its logical turn behind a
+ * durable provider-capacity waiter. The immutable authority snapshot and, for
+ * private pools, exact initiating human are revalidated under FORCE RLS before
+ * any session/turn projection changes.
+ */
+export declare function armXaiCapacityWait(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    workflowId: string;
+    authoritySnapshot: XaiProviderAccountAuthoritySnapshotV1;
+    goalId?: string | null;
+    goalVersion?: number | null;
+    earliestResetAt: Date | null;
+    failurePayload: Record<string, unknown>;
+    leaseFence?: {
+        holderId: string;
+        generation: number;
+    };
+    credentialQuarantine?: XaiCredentialLeaseQuarantine;
+    now?: Date;
+}): Promise<ArmXaiCapacityWaitResult>;
+export declare function getXaiCapacityWaitForSession(db: Database, workspaceId: string, sessionId: string): Promise<XaiCapacityWait | null>;
+export declare function reconcileXaiCapacityWait(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    waiterId: string;
+    generation: number;
+    now?: Date;
+}): Promise<ReconcileXaiCapacityWaitResult>;
 /**
  * Extend a live holder and return the database-confirmed expiry. A
  * missing/expired/released row returns null. A successful result lets the worker
@@ -3385,6 +3677,7 @@ export type SessionCreateInput = {
     variableSetId?: string | null;
     rigId?: string | null;
     rigVersionId?: string | null;
+    channelId?: string | null;
     firstPartyMcpPermissions?: Permission[] | null;
     firstPartyMcpTools?: FirstPartyMcpToolName[];
     instructions?: string | null;
@@ -3395,9 +3688,14 @@ export type SessionCreateInput = {
     sandboxOs?: SandboxOs;
     mcpServers?: CreateSessionMcpServerInput[];
     personalConnectionDelegations?: McpPersonalConnectionDelegation[];
+    initialXaiProviderAccountAuthoritySnapshot?: XaiProviderAccountAuthoritySnapshotV1;
     maxNestedAgentDepthOverride?: number | null;
     allowNestedAgentDepthIncrease?: boolean;
     subjectId?: string | null;
+    /** Trusted, transaction-local linkage run after the exact session row and
+     * MCP metadata exist but before either can commit. It must perform database
+     * work only; throwing rolls the complete create/replay transaction back. */
+    beforeCreateCommit?: (tx: Database, sessionId: string) => Promise<void>;
 };
 export declare function createSession(db: Database, input: SessionCreateInput): Promise<DbSession>;
 /**
@@ -3423,8 +3721,17 @@ export declare function createSessionWithIdempotencyKey(db: Database, input: Ses
 }): Promise<SessionCreateSuccessResult>;
 export declare function getSessionByCreateIdempotencyKey(db: Database, workspaceId: string, createIdempotencyKey: string): Promise<Session | null>;
 export declare function getSession(db: Database, workspaceId: string, sessionId: string): Promise<Session | null>;
+export type SessionAuthorityProjection = {
+    sessionId: string;
+    rootSessionId: string;
+    visibility: "user_private" | "workspace_shared";
+    ownerSubjectId: string | null;
+};
+export declare function getSessionAuthorityProjection(db: Database, workspaceId: string, sessionId: string): Promise<SessionAuthorityProjection | null>;
+export declare function getSessionTurnXaiProviderAccountAuthoritySnapshot(db: Database, workspaceId: string, sessionId: string, turnId: string): Promise<XaiProviderAccountAuthoritySnapshotV1>;
 export declare function getSessionTurnPersonalConnectionDelegations(db: Database, workspaceId: string, sessionId: string, turnId: string): Promise<McpPersonalConnectionDelegation[]>;
 export declare function getSessionParentPersonalConnectionDelegations(db: Database, workspaceId: string, childSessionId: string): Promise<McpPersonalConnectionDelegation[]>;
+export declare function getSessionParentXaiProviderAccountAuthority(db: Database, workspaceId: string, childSessionId: string): Promise<FrozenXaiExecutionAuthority>;
 export declare function getSessionSpawnDenial(db: Database, workspaceId: string, denialId: string): Promise<SessionSpawnDenial | null>;
 export declare function getSessionSpawnDenialByIdempotencyKey(db: Database, workspaceId: string, createIdempotencyKey: string): Promise<SessionSpawnDenial | null>;
 export declare function listSessionSpawnDenials(db: Database, workspaceId: string, options?: {
@@ -3885,6 +4192,8 @@ export declare function registerPendingSessionToolCall(db: Database, input: Pend
 /** Record the raw SDK result without dropping the call receipt. */
 export declare function recordPendingSessionToolCallResult(db: Database, input: Omit<PendingSessionToolCallInput, "callType" | "callItem"> & {
     resultItem: Record<string, unknown>;
+    /** Exact agent.toolCall.output value, separate from model-facing history. */
+    eventOutput?: unknown;
     /** Commit a durable async-video acceptance fence with this exact result. */
     videoGenerationAcceptance?: {
         operationId: string;
@@ -3933,9 +4242,9 @@ export declare function getActiveSessionHistoryItems(db: Database, workspaceId:
  * pod OOM killer as admission.
  */
 export declare const ACTIVE_SESSION_HISTORY_MAX_JSON_BYTES: number;
-export declare const ACTIVE_SESSION_HISTORY_MAX_ROWS = 4096;
-export declare const ACTIVE_SESSION_HISTORY_MAX_JSON_NODES = 65536;
-export declare const ACTIVE_SESSION_HISTORY_MAX_JSON_PROPERTIES = 32768;
+export declare const ACTIVE_SESSION_HISTORY_MAX_ROWS = 8192;
+export declare const ACTIVE_SESSION_HISTORY_MAX_JSON_NODES = 131072;
+export declare const ACTIVE_SESSION_HISTORY_MAX_JSON_PROPERTIES = 65536;
 export type ActiveSessionHistoryLimitKind = "json_bytes" | "rows" | "json_nodes" | "json_properties";
 export declare class ActiveSessionHistoryLimitExceededError extends Error {
     readonly actualBytes: number;
@@ -4384,6 +4693,9 @@ export interface LeaseSnapshot {
     rigVersionId: string | null;
     dataPlaneUrl: string | null;
     terminalDataPlaneUrl: string | null;
+    /** Cached browserd controller tunnel (7682), fenced to this lease epoch and
+     * provider instance. Null until the first controller provisioning/resolution. */
+    controllerDataPlaneUrl: string | null;
     leaseEpoch: number;
     /** Monotonic filesystem mutation intent for the exact live workspace. */
     workspaceGeneration: number;
@@ -6007,6 +6319,17 @@ export declare function recordLeaseTerminalDataPlaneUrl(db: Database, input: {
     expectedEpoch: number;
     terminalDataPlaneUrl: string | null;
 }): Promise<LeaseSnapshot | null>;
+/** Record the browserd controller tunnel for one exact warm provider instance.
+ * Unlike desktop/terminal viewer URLs, this endpoint is an internal transport
+ * cache: controller bearer tokens still enforce per-resource authority. */
+export declare function recordLeaseControllerDataPlaneUrl(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    expectedEpoch: number;
+    expectedInstanceId: string;
+    controllerDataPlaneUrl: string | null;
+}): Promise<LeaseSnapshot | null>;
 export type SandboxKind = (typeof schema.sandboxKindValues)[number];
 export type EnrollmentExposure = (typeof schema.enrollmentExposureValues)[number];
 export type EnrollmentStatus = (typeof schema.enrollmentStatusValues)[number];
@@ -6088,11 +6411,12 @@ export declare class MachineRemovalRevisionConflictError extends Error {
     constructor(message: string, currentUpdatedAt: string);
 }
 /**
- * Remove one connected-machine enrollment without touching the durable identity
- * or any session/route/archive evidence. The enrollment row is the lifecycle
- * truth: status -> revoked rejects future auth-callout/heartbeat/reconnect
- * attempts, while a fresh device-flow re-enrollment can reactivate the same
- * public-key identity with a new credential family.
+ * Remove one connected-machine enrollment without deleting durable identity,
+ * conversation, or audit evidence. Idle sessions using the machine are detached
+ * to `none`; active work and recovery fences still block removal. The enrollment
+ * row is the lifecycle truth: status -> revoked rejects future auth-callout/
+ * heartbeat/reconnect attempts, while a fresh device-flow re-enrollment can
+ * reactivate the same public-key identity with a new credential family.
  *
  * The operation key is scoped to the workspace and is receipt-backed. A retry
  * with the same key and request fingerprint replays the exact committed result;
@@ -6457,6 +6781,12 @@ export type CreateSessionGoalInput = {
     text: string;
     successCriteria?: string | null;
     maxAutoContinuations?: number | null;
+    mutationPolicy?: SessionGoalMutationPolicy;
+    expectedObjectiveRevision?: number;
+    expectedGoalId?: string;
+    changeKind?: SessionGoalChangeKind;
+    changeRationale?: string;
+    sourceProposalId?: string;
     createdBy: SessionGoalCreatedBy;
 };
 export declare function createSessionGoal(db: Database, input: CreateSessionGoalInput): Promise<SessionGoal>;
@@ -6504,15 +6834,21 @@ export declare function upsertSessionGoalWithEvent(db: Database, input: CreateSe
 }): Promise<{
     goal: SessionGoal;
     replaced: boolean;
+    workflowWakeRevision: number | null;
     events: SessionEvent[];
 }>;
+export declare function listSessionGoalRevisions(db: Database, workspaceId: string, sessionId: string): Promise<SessionGoalRevision[]>;
+export declare function getSessionGoalRevision(db: Database, workspaceId: string, sessionId: string, revisionId: string): Promise<SessionGoalRevision | null>;
 /**
- * goal_update semantics: revise text/criteria without changing status. The
- * version bump counts as progress for the no-progress detector.
+ * Low-level semantic goal revision. The established lifecycle version still
+ * advances so stale continuation updates are cancelled, while the migration
+ * trigger advances the separate objective revision. A semantic rewrite is not
+ * execution progress and therefore never resets the no-progress streak.
  */
 export declare function updateSessionGoal(db: Database, workspaceId: string, sessionId: string, input: {
     text?: string;
     successCriteria?: string | null;
+    mutationPolicy?: SessionGoalMutationPolicy;
 }): Promise<SessionGoal>;
 /**
  * Agent goal_update: session sequence ownership, goal mutation, and its audit
@@ -6523,7 +6859,12 @@ export declare function updateSessionGoal(db: Database, workspaceId: string, ses
 export declare function updateSessionGoalWithEvent(db: Database, workspaceId: string, sessionId: string, input: {
     text?: string;
     successCriteria?: string | null;
+    mutationPolicy?: SessionGoalMutationPolicy;
+    /** @deprecated A semantic rewrite never counts as progress; use goal_progress. */
     progressNote?: string;
+    changeKind?: SessionGoalChangeKind;
+    rationale?: string;
+    expectedObjectiveRevision?: number;
     actor: "agent" | "api";
     command?: {
         accountId: string;
@@ -6537,6 +6878,28 @@ export declare function updateSessionGoalWithEvent(db: Database, workspaceId: st
     events: SessionEvent[];
     operationId: string | null;
     replay: boolean;
+    outcome: "applied" | "proposed";
+    proposalId: string | null;
+}>;
+/**
+ * Record execution progress without changing goal semantics or either goal
+ * revision. The attempt-fenced operation receipt makes a recovered tool call
+ * converge on the original event instead of manufacturing progress twice.
+ */
+export declare function recordSessionGoalProgressWithEvent(db: Database, workspaceId: string, sessionId: string, input: {
+    progressNote: string;
+    command: {
+        accountId: string;
+        actor: Extract<SessionCommandActor, {
+            type: "agent_attempt";
+        }>;
+        operationKey: string;
+    };
+}): Promise<{
+    goal: SessionGoal;
+    events: SessionEvent[];
+    operationId: string;
+    replay: boolean;
 }>;
 /**
  * Sets a session's display title. The clobber guard lives entirely in this
@@ -6683,6 +7046,7 @@ export type InitializeSessionStartInput = {
         text: string;
         successCriteria?: string | null;
         maxAutoContinuations?: number | null;
+        mutationPolicy?: SessionGoalMutationPolicy;
     } | null;
     consumeNewSessionDraft?: {
         subjectId: string;
@@ -6717,6 +7081,10 @@ export type SessionWorkTrigger = {
 export declare const MAX_INTERNAL_UPDATE_BYTES: number;
 export declare const MAX_INTERNAL_UPDATE_BATCH_MEMBERS = 100;
 export declare const MAX_INTERNAL_UPDATE_BATCH_BYTES: number;
+export type FrozenXaiExecutionAuthority = {
+    snapshot: XaiProviderAccountAuthoritySnapshotV1;
+    subjectId: string | null;
+};
 export type ClaimSessionWorkForAttemptInput = {
     sessionId: string;
     workflowId: string;
@@ -6732,6 +7100,11 @@ export type ClaimSessionWorkForAttemptResult = {
     action: "unclaimed";
     reason: "gate-closed" | "no-work" | "stale-approval" | "control-pending";
 };
+/**
+ * Bound legacy exact goal content only at the immutable model-context snapshot
+ * boundary. The canonical goal/revision remains byte-for-byte unchanged.
+ */
+export declare function projectSessionGoalPromptField(value: string, maxBytes: number): string;
 /**
  * Claim and register one inference attempt after a turn worker has accepted the
  * Temporal activity. This is the only transition into `running`: queue choice,
@@ -6845,6 +7218,7 @@ export type SessionWorkPeek = {
 } | {
     kind: "approval-wait";
     humanInputRequestId?: string;
+    interactionInterventionId?: string;
     expiresAt?: string;
 } | {
     kind: "capacity-wait";
@@ -6928,6 +7302,12 @@ export type ApplySessionTurnSettlementInput = {
             allowSkip: boolean;
             expiresAt?: Date | null;
         }>;
+        interactionInterventionRequests?: Array<{
+            id: string;
+            operationId: string;
+            toolCallId: string;
+            input: RequestHumanInteractionToolInput;
+        }>;
     };
     recording?: SessionTurnRecordingSettlement;
     /**
@@ -7137,6 +7517,7 @@ export type SessionSystemUpdateOutboxDelivery = {
     payload: ChildTerminalResultPayload;
     lineage: Record<string, unknown>;
     personalConnectionDelegations: McpPersonalConnectionDelegation[];
+    xaiProviderAccountAuthoritySnapshot: XaiProviderAccountAuthoritySnapshotV1;
 };
 /**
  * Read the exact durable parent-update row created by terminal turn settlement.
@@ -7243,6 +7624,7 @@ export type AddSessionSystemUpdateInput = {
     summary: string;
     lineage?: Record<string, unknown>;
     personalConnectionDelegations?: McpPersonalConnectionDelegation[];
+    xaiProviderAccountAuthoritySnapshot?: XaiProviderAccountAuthoritySnapshotV1;
 } & SessionSystemUpdateInputVariant;
 export type AddSessionSystemUpdateResult = {
     added: false;
@@ -7288,7 +7670,29 @@ export declare function acceptSessionApprovalDecision(db: Database, input: {
     subjectId: string;
     payload: Record<string, unknown>;
     clientEventId?: string | null;
+    interactionIntervention?: {
+        interventionId: string;
+        operationId: string;
+        expectedVersion: number;
+        outcome: "completed" | "dismissed";
+    };
 }): Promise<AcceptSessionApprovalDecisionResult>;
+export type ExpireSessionInteractionInterventionResult = {
+    action: "expired" | "stale" | "not_found";
+    events: SessionEvent[];
+};
+/**
+ * Expire one model-owned intervention through the same exact approval boundary
+ * as a human rejection. The resource settlement and rejection event commit
+ * together inside acceptSessionApprovalDecision; a race with a human response
+ * becomes an event-free stale result.
+ */
+export declare function expireSessionInteractionIntervention(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    interventionId: string;
+}): Promise<ExpireSessionInteractionInterventionResult>;
 /**
  * Durable attempt fence for activity-produced events. A cancelled or replaced
  * attempt may still flush SDK callbacks after Temporal cancellation; those late
@@ -7399,5 +7803,10 @@ export * from "./codemode-operations.js";
 export * from "./browser-sessions.js";
 export * from "./computer-sessions.js";
 export * from "./browser-identities.js";
+export * from "./browser-state-artifacts.js";
 export * from "./browser-auth.js";
+export * from "./browser-downloads.js";
 export * from "./attached-browser-devices.js";
+export * from "./interaction-revisions.js";
+export * from "./canonical-human-identities.js";
+export * from "./session-tenancy.js";