@opengeni/db 0.36.0 → 1.0.1

package/dist/index.js

@@ -3,7 +3,7 @@ import {
   canonicalSessionVisibilityTransitionHash,
   forkSessionContent,
   transitionSessionVisibility
-} from "./chunk-F32YT7MP.js";
+} from "./chunk-WD5ROSLL.js";
 import {
   migrate,
   runMigrations
@@ -27,7 +27,7 @@ import {
   inspectRuntimeDatabasePosture,
   provisionRoles,
   runtimeDatabaseReadyCheck
-} from "./chunk-VKLB2ZGI.js";
+} from "./chunk-NXAFLCQX.js";
 import {
   CanonicalHumanIdentityAuthorityError,
   CanonicalHumanIdentityConflictError,
@@ -39,7 +39,7 @@ import {
   getCanonicalHumanIdentityProjection,
   synchronizeCanonicalHumanLoginBindings,
   validateCanonicalHumanSession
-} from "./chunk-TAUTWOS5.js";
+} from "./chunk-LTG3S6ZY.js";
 import {
   EDITABLE_ARTIFACT_INTENT_MAX_BYTES,
   EDITABLE_ARTIFACT_KERNEL_TAIL_MAX_BYTES,
@@ -50,7 +50,7 @@ import {
   PostgresEditableArtifactStore,
   listEditableArtifactIdsForSession,
   touchEditableArtifactSessionLink
-} from "./chunk-P3RE4D2B.js";
+} from "./chunk-4SR4HKKA.js";
 import {
   ACTIVE_VIDEO_GENERATION_STATUSES,
   VideoGenerationCapacityError,
@@ -82,7 +82,7 @@ import {
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy
-} from "./chunk-CQZ4QSP5.js";
+} from "./chunk-CUPM3FGB.js";
 import {
   SandboxProviderReadLockUnavailableError,
   SessionEventPersistenceError,
@@ -90,6 +90,7 @@ import {
   databaseFailureCode,
   dbBindingFor,
   isDatabasePersistenceFailure,
+  isRetryableDatabaseTransportFailure,
   isRetryablePersistenceSqlState,
   isSessionEventPersistenceError,
   nestedPostgresSqlState,
@@ -116,7 +117,7 @@ import {
   withWorkspaceSubjectRls,
   withWorkspaceSubjectSessionActivityRls,
   withWorkspaceUsageLock
-} from "./chunk-JC5QPLUM.js";
+} from "./chunk-ZWREYEWA.js";
 import {
   LOSSLESS_CONTENT_CODEC_VERSION,
   LOSSLESS_TEXT_PREFIX,
@@ -177,6 +178,8 @@ import {
   generatedImageArtifacts,
   githubInstallationRepositories,
   githubInstallations,
+  googleDriveObjectAclEvidence,
+  googleDriveObjectAclPrincipals,
   imageGenerationOperations,
   importBatches,
   integrationFacetBindingOwners,
@@ -322,11 +325,11 @@ import {
   xaiRotationSettings,
   xaiSessionAccountPins,
   xaiSubscriptionCredentials
-} from "./chunk-5KTIEDX7.js";
+} from "./chunk-6ZYKCRFO.js";
 import "./chunk-PZ5AY32C.js";
 
 // src/index.ts
-import { createHash as createHash28, randomUUID as randomUUID10 } from "crypto";
+import { createHash as createHash29, randomUUID as randomUUID10 } from "crypto";
 import {
   SESSION_GOAL_PROGRESS_MAX_BYTES,
   SESSION_GOAL_RATIONALE_MAX_BYTES,
@@ -3914,7 +3917,7 @@ import {
   MODEL_ATTACHMENT_REFS_FIELD,
   MODEL_TIMELINE_ANNOTATIONS_FIELD,
   TimelineAnnotations as TimelineAnnotations2,
-  renderTimelineAnnotationsForModel as renderTimelineAnnotationsForModel2,
+  renderUserMessageContentForModel,
   SessionMcpApprovalPolicy as SessionMcpApprovalPolicySchema,
   RequestHumanInteractionToolInput as RequestHumanInteractionToolInput2,
   WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1 as WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V13,
@@ -9056,7 +9059,7 @@ async function submitHumanPromptInTransaction(db, input) {
     expectedDraftRevision: input.expectedDraftRevision ?? null,
     text: input.text,
     annotations,
-    turnInstructions: input.turnInstructions ?? null,
+    modelContext: input.modelContext ?? null,
     resources: withCanonicalResourceMountPaths(input.resources),
     model: input.model ?? null,
     reasoningEffort: input.reasoningEffort ?? null,
@@ -9188,7 +9191,7 @@ async function submitHumanPromptInTransaction(db, input) {
     }
   }
   let editedSourceTurn;
-  let editedSourceTurnInstructions;
+  let editedSourceModelContext;
   if (draft?.sourceTurnId) {
     const sourceLocks = await lockSessionEventWriteRows(db, {
       workspaceId: input.workspaceId,
@@ -9212,7 +9215,7 @@ async function submitHumanPromptInTransaction(db, input) {
       );
     }
     editedSourceTurn = sourceTurn;
-    editedSourceTurnInstructions = sourceTurn.turnInstructions ?? null;
+    editedSourceModelContext = sourceTurn.modelContext ?? null;
   }
   for (const update of input.mcpCredentialUpdates ?? []) {
     const [server] = await db.update(sessionMcpServers).set({
@@ -9259,6 +9262,7 @@ async function submitHumanPromptInTransaction(db, input) {
   const acceptedEventId = crypto.randomUUID();
   const turnId = crypto.randomUUID();
   const workflowId = session.temporalWorkflowId ?? `session-${session.id}`;
+  const effectiveModelContext = editedSourceModelContext !== void 0 ? editedSourceModelContext : input.modelContext ?? null;
   let sequence = session.lastSequence;
   const eventValues = [
     {
@@ -9279,6 +9283,7 @@ async function submitHumanPromptInTransaction(db, input) {
           }
         } : {},
         ...input.resources.length ? { resources: input.resources } : {},
+        ...effectiveModelContext ? { modelContext: effectiveModelContext } : {},
         ...input.model ? { model: input.model } : {},
         ...input.reasoningEffort ? { reasoningEffort: input.reasoningEffort } : {},
         ...input.latencyMode ? { latencyMode: input.latencyMode } : {},
@@ -9303,7 +9308,7 @@ async function submitHumanPromptInTransaction(db, input) {
         position: input.delivery === "steer" ? 0 : existingQueued.length + 1,
         prompt: input.text,
         annotations,
-        turnInstructions: editedSourceTurnInstructions !== void 0 ? editedSourceTurnInstructions : input.turnInstructions ?? null,
+        modelContext: effectiveModelContext,
         resources: input.resources,
         tools: [],
         toolsProvided: false,
@@ -10144,7 +10149,8 @@ async function flushSessionRealtimeTranscriptTailInTransaction(db, input) {
     text: sessionRealtimeEntries.text,
     textCodecVersion: sessionRealtimeEntries.textCodecVersion,
     payload: sessionRealtimeEntries.payload,
-    payloadCodecVersion: sessionRealtimeEntries.payloadCodecVersion
+    payloadCodecVersion: sessionRealtimeEntries.payloadCodecVersion,
+    modelContext: sessionRealtimeEntries.modelContext
   }).from(sessionRealtimeEntries).where(
     and12(
       eq13(sessionRealtimeEntries.realtimeId, mode.id),
@@ -10161,6 +10167,20 @@ async function flushSessionRealtimeTranscriptTailInTransaction(db, input) {
   }));
   const rendered = renderSessionRealtimeTail(decodedRows);
   if (!rendered.context) return null;
+  const renderedRows = decodedRows.slice(decodedRows.length - rendered.includedEntryCount);
+  let foundUserTranscript = false;
+  let modelContext = null;
+  for (let index = renderedRows.length - 1; index >= 0; index -= 1) {
+    const entry = renderedRows[index];
+    if (entry.role === "user") {
+      foundUserTranscript = true;
+      modelContext = entry.modelContext;
+      break;
+    }
+  }
+  if (!foundUserTranscript) {
+    modelContext = renderedRows.at(-1)?.modelContext ?? null;
+  }
   const [session] = await db.select({ metadata: sessions.metadata }).from(sessions).where(
     and12(
       eq13(sessions.workspaceId, input.workspaceId),
@@ -10184,6 +10204,7 @@ async function flushSessionRealtimeTranscriptTailInTransaction(db, input) {
     operationKey: deterministicUuid2(`opengeni:session-realtime-tail-flush:${mode.id}`),
     delivery: "steer",
     text: rendered.context,
+    modelContext,
     messagePresentation: {
       kind: "realtime_voice_handoff",
       text: "Voice session ended. Remaining conversation context was sent to the agent.",
@@ -11555,10 +11576,37 @@ function canonicalJsonValue2(value) {
   }
   return value;
 }
-function inboundReplayMatches(row, input, role, text, payload) {
+function normalizedModelContext(input) {
+  const value = input.modelContext?.trim();
+  if (!value) {
+    if (input.modelContext !== void 0) {
+      throw new Error("Realtime modelContext must not be empty");
+    }
+    return null;
+  }
+  if (value.length > 32768) {
+    throw new Error("Realtime modelContext exceeds the server limit");
+  }
+  if (input.kind !== "delegation_call" && input.kind !== "user_transcript" && input.kind !== "assistant_transcript") {
+    throw new Error("Realtime modelContext requires a delegation or finalized transcript");
+  }
+  return value;
+}
+function inboundReplayMatches(row, input, role, text, payload, modelContext) {
   const storedText = row.text === null ? null : fromPostgresLosslessText(row.text, row.textCodecVersion);
   const storedPayload = fromPostgresLosslessJson(row.payload, row.payloadCodecVersion);
-  return row.direction === "provider_in" && row.kind === input.kind && row.role === role && row.providerEventId === (input.providerEventId ?? null) && row.delegationItemId === (input.delegationItemId ?? null) && row.sourceUpdateId === null && storedText === text && JSON.stringify(canonicalJsonValue2(storedPayload)) === JSON.stringify(canonicalJsonValue2(payload));
+  return row.direction === "provider_in" && row.kind === input.kind && row.role === role && row.providerEventId === (input.providerEventId ?? null) && row.delegationItemId === (input.delegationItemId ?? null) && row.sourceUpdateId === null && storedText === text && row.modelContext === modelContext && JSON.stringify(canonicalJsonValue2(storedPayload)) === JSON.stringify(canonicalJsonValue2(payload));
+}
+async function delegationModelContextMatches(db, row, modelContext) {
+  if (row.kind !== "delegation_call" || row.turnId === null) return true;
+  const [turn] = await db.select({ modelContext: sessionTurns.modelContext }).from(sessionTurns).where(
+    and15(
+      eq16(sessionTurns.workspaceId, row.workspaceId),
+      eq16(sessionTurns.sessionId, row.sessionId),
+      eq16(sessionTurns.id, row.turnId)
+    )
+  ).limit(1);
+  return turn?.modelContext === modelContext;
 }
 async function appendInvalidDelegationFailure(db, input, accountId, incoming, failure, sequence, now) {
   await db.insert(sessionRealtimeEntries).values({
@@ -11583,7 +11631,7 @@ async function appendInvalidDelegationFailure(db, input, accountId, incoming, fa
     updatedAt: now
   });
 }
-async function admitRealtimeDelegationInTransaction(db, input, accountId, incoming, entryId) {
+async function admitRealtimeDelegationInTransaction(db, input, accountId, incoming, entryId, modelContext) {
   const [session] = await db.select().from(sessions).where(
     and15(
       eq16(sessions.workspaceId, input.workspaceId),
@@ -11633,6 +11681,7 @@ async function admitRealtimeDelegationInTransaction(db, input, accountId, incomi
     operationKey: incoming.operationId,
     delivery: "steer",
     text: incoming.text,
+    modelContext,
     messagePresentation: {
       kind: "realtime_voice",
       text: inputTranscript,
@@ -11805,6 +11854,7 @@ async function syncSessionRealtimeLedgerInTransaction(db, input, hooks = {}) {
     const payload = boundedPayload3(incoming.payload);
     const role = expectedRole(incoming);
     const text = incoming.text ?? null;
+    const modelContext = normalizedModelContext(incoming);
     assertBoundedString(text, SESSION_REALTIME_LEDGER_MAX_TEXT_BYTES, "Realtime text");
     if ((incoming.kind === "user_transcript" || incoming.kind === "assistant_transcript") && !text) {
       throw new Error("Finalized realtime transcript text is required");
@@ -11829,7 +11879,7 @@ async function syncSessionRealtimeLedgerInTransaction(db, input, hooks = {}) {
       )
     ).limit(1);
     if (existing) {
-      if (!inboundReplayMatches(existing, incoming, role, text, payload)) {
+      if (!inboundReplayMatches(existing, incoming, role, text, payload, modelContext) || !await delegationModelContextMatches(db, existing, modelContext)) {
         throw new SessionRealtimeConflictError(
           incoming.kind === "delegation_call" ? "REALTIME_DELEGATION_CHANGED" : "REALTIME_ENTRY_CHANGED",
           "Realtime ledger operation was already used with different input"
@@ -11856,6 +11906,7 @@ async function syncSessionRealtimeLedgerInTransaction(db, input, hooks = {}) {
       textCodecVersion: LOSSLESS_CONTENT_CODEC_VERSION,
       payload,
       payloadCodecVersion: LOSSLESS_CONTENT_CODEC_VERSION,
+      modelContext,
       createdAt: now,
       updatedAt: now
     }).returning();
@@ -11878,7 +11929,8 @@ async function syncSessionRealtimeLedgerInTransaction(db, input, hooks = {}) {
           input,
           modeRow.accountId,
           incoming,
-          entry.id
+          entry.id,
+          modelContext
         );
         const [linked] = await db.update(sessionRealtimeEntries).set({ turnId: admission.turnId, updatedAt: now }).where(eq16(sessionRealtimeEntries.id, entry.id)).returning();
         if (!linked) throw new Error("Failed to link realtime delegation turn");
@@ -18975,6 +19027,7 @@ import {
   KnowledgeSourceSyncAction,
   KnowledgeSourceSyncRunSummary
 } from "@opengeni/contracts";
+import { createHash as createHash16 } from "crypto";
 import { and as and23, eq as eq24, inArray as inArray13, sql as sql21 } from "drizzle-orm";
 function compareCanonicalDecimalProviderRevisions(candidate, floor) {
   if (candidate === floor) return 0;
@@ -19817,6 +19870,260 @@ async function recordKnowledgeSourceSyncAclEvidence(db, input) {
     }
   );
 }
+async function recordGoogleDriveObjectAclEvidence(db, input) {
+  const observedAt = exactDate(input.observedAt, "Google Drive ACL observedAt");
+  const expiresAt = exactDate(input.expiresAt, "Google Drive ACL expiresAt");
+  if (expiresAt.getTime() <= observedAt.getTime()) {
+    throw new Error("Google Drive ACL evidence must expire after it was observed");
+  }
+  if (input.principals.length > 1e3) {
+    throw new Error("Google Drive ACL evidence exceeds 1000 principals");
+  }
+  const principals = input.principals.map(normalizeGoogleDriveAclPrincipal);
+  const canonicalAcl = principals.map((principal) => JSON.stringify(principal)).sort((left, right) => left.localeCompare(right));
+  const aclHash = sha256Hex(JSON.stringify(canonicalAcl));
+  const sourcePrincipalHash = principalHash("permission", input.sourceGooglePermissionId);
+  const inputHash = sha256Hex(
+    JSON.stringify({
+      version: 1,
+      obligationId: input.obligationId,
+      connectionId: input.connectionId,
+      connectionVersion: input.connectionVersion,
+      sourcePrincipalHash,
+      sourceSyncGeneration: input.sourceSyncGeneration,
+      sourceConfigGeneration: input.sourceConfigGeneration,
+      sourceLifecycleGeneration: input.sourceLifecycleGeneration,
+      objectLifecycleGeneration: input.objectLifecycleGeneration,
+      objectVersionGeneration: input.objectVersionGeneration,
+      providerRevision: input.providerRevision,
+      driveId: input.driveId,
+      aclRevision: input.aclRevision,
+      aclHash,
+      eligibility: input.eligibility,
+      observedAt: observedAt.toISOString(),
+      expiresAt: expiresAt.toISOString(),
+      citationLocator: input.citationLocator
+    })
+  );
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => await scopedDb.transaction(async (tx) => {
+      const [observedObligation] = await tx.select().from(knowledgeSourceSyncIndexObligations).where(eq24(knowledgeSourceSyncIndexObligations.id, input.obligationId)).limit(1);
+      if (!observedObligation) {
+        throw new Error("Google Drive ACL evidence obligation was not found");
+      }
+      await setSubjectRlsContext(tx, observedObligation.initiatingSubjectId);
+      const [state] = await tx.select().from(knowledgeSourceSyncStates).where(eq24(knowledgeSourceSyncStates.sourceId, observedObligation.sourceId)).for("update").limit(1);
+      if (!state) throw new Error("Google Drive sync authorization is no longer active");
+      await tx.execute(sql21`
+          SELECT knowledge_source_sync_lock_authority(
+            ${input.accountId}::uuid,
+            ${observedObligation.sourceId}::uuid,
+            ${observedObligation.knowledgeSourceObjectId}::uuid
+          )
+        `);
+      const [[source], [object], [version], [obligation], [connection]] = await Promise.all([
+        tx.select().from(knowledgeSources).where(eq24(knowledgeSources.id, observedObligation.sourceId)).limit(1),
+        tx.select().from(knowledgeSourceObjects).where(eq24(knowledgeSourceObjects.id, observedObligation.knowledgeSourceObjectId)).limit(1),
+        tx.select().from(knowledgeDocumentVersions).where(
+          eq24(
+            knowledgeDocumentVersions.id,
+            observedObligation.knowledgeDocumentVersionId
+          )
+        ).limit(1),
+        tx.select().from(knowledgeSourceSyncIndexObligations).where(eq24(knowledgeSourceSyncIndexObligations.id, input.obligationId)).for("update").limit(1),
+        tx.select().from(connections).where(eq24(connections.id, input.connectionId)).limit(1)
+      ]);
+      const [provider] = source ? await tx.select().from(knowledgeProviders).where(eq24(knowledgeProviders.id, source.providerId)).limit(1) : [];
+      const [document] = obligation ? await tx.select().from(documents).where(eq24(documents.id, obligation.documentId)).for("update").limit(1) : [];
+      const metadata = connection?.metadata ?? {};
+      const connectionPermissionId = cleanBoundedString(metadata.googlePermissionId, 256);
+      const connectionLifecycle = metadata.lifecycle && typeof metadata.lifecycle === "object" ? cleanBoundedString(metadata.lifecycle.state, 64) : null;
+      const hasDriveReadScope = Array.isArray(connection?.grantedScopes) && connection.grantedScopes.some(
+        (scope) => scope === "https://www.googleapis.com/auth/drive" || scope === "https://www.googleapis.com/auth/drive.readonly"
+      );
+      if (!obligation || !source || !object || !version || !provider || !document || !connection || provider.providerKey !== "google-drive" || provider.lifecycleState !== "active" || state.connectionId !== input.connectionId || state.connectionProviderDomain !== "googleapis.com" || state.connectionKind !== "oauth2" || state.connectionOwnerSubjectId !== connection.subjectId || state.reconnectRequired || connection.accountId !== input.accountId || connection.subjectId !== observedObligation.initiatingSubjectId || connection.providerDomain !== "googleapis.com" || connection.kind !== "oauth2" || connection.status !== "active" || connection.version !== input.connectionVersion || connection.version < state.connectionVersion || metadata.accessMode !== "readonly" || connectionLifecycle !== null && connectionLifecycle !== "active" || !hasDriveReadScope || !connectionPermissionId || principalHash("permission", connectionPermissionId) !== sourcePrincipalHash || input.sourceSyncGeneration !== obligation.sourceSyncGeneration || state.sourceSyncGeneration < obligation.sourceSyncGeneration || state.sourceConfigGeneration !== input.sourceConfigGeneration || state.sourceConfigGeneration !== obligation.sourceConfigGeneration || state.sourceLifecycleGeneration !== input.sourceLifecycleGeneration || state.sourceLifecycleGeneration !== obligation.sourceLifecycleGeneration || source.lifecycleState !== "active" || source.syncGeneration < obligation.sourceSyncGeneration || source.lifecycleGeneration !== obligation.sourceLifecycleGeneration || source.currentAclGeneration !== version.aclGeneration || object.sourceId !== obligation.sourceId || object.externalObjectId !== obligation.externalObjectId || object.lifecycleState !== "active" || object.lifecycleGeneration !== obligation.objectLifecycleGeneration || object.versionGeneration !== obligation.objectVersionGeneration || object.currentVersionId !== obligation.knowledgeDocumentVersionId || version.sourceId !== obligation.sourceId || version.objectId !== obligation.knowledgeSourceObjectId || version.versionGeneration !== obligation.objectVersionGeneration || version.documentId !== obligation.documentId || version.fileId !== document.fileId || document.accountId !== input.accountId || document.workspaceId !== input.workspaceId || document.sourceExternalId !== obligation.externalObjectId || !document.knowledgeSourceIdentity || obligation.sourceLifecycleGeneration !== input.sourceLifecycleGeneration || obligation.objectLifecycleGeneration !== input.objectLifecycleGeneration || obligation.objectVersionGeneration !== input.objectVersionGeneration) {
+        throw new Error("Google Drive ACL evidence authority changed");
+      }
+      if (input.eligibility === "eligible" && obligation.status !== "indexed") {
+        throw new Error("Google Drive ACL eligibility requires a completed index obligation");
+      }
+      const evidenceValues = {
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        sourceId: obligation.sourceId,
+        knowledgeSourceObjectId: obligation.knowledgeSourceObjectId,
+        knowledgeDocumentVersionId: obligation.knowledgeDocumentVersionId,
+        documentId: obligation.documentId,
+        fileId: document.fileId,
+        indexObligationId: obligation.id,
+        connectionId: input.connectionId,
+        connectionVersion: input.connectionVersion,
+        sourcePrincipalHash,
+        sourceSyncGeneration: input.sourceSyncGeneration,
+        sourceConfigGeneration: input.sourceConfigGeneration,
+        sourceLifecycleGeneration: input.sourceLifecycleGeneration,
+        objectLifecycleGeneration: input.objectLifecycleGeneration,
+        objectVersionGeneration: input.objectVersionGeneration,
+        providerRevision: input.providerRevision,
+        driveId: cleanBoundedString(input.driveId, 1024),
+        aclRevision: exactBoundedString(input.aclRevision, 1024, "Google Drive ACL revision"),
+        aclHash,
+        eligibility: input.eligibility,
+        observedAt,
+        expiresAt,
+        citationLocator: input.citationLocator,
+        operationId: exactBoundedString(input.operationId, 256, "Google Drive ACL operation id"),
+        inputHash
+      };
+      const [inserted] = await tx.insert(googleDriveObjectAclEvidence).values(evidenceValues).onConflictDoNothing({
+        target: [
+          googleDriveObjectAclEvidence.indexObligationId,
+          googleDriveObjectAclEvidence.operationId
+        ]
+      }).returning();
+      const [evidence] = inserted ? [inserted] : await tx.select().from(googleDriveObjectAclEvidence).where(
+        and23(
+          eq24(googleDriveObjectAclEvidence.indexObligationId, obligation.id),
+          eq24(googleDriveObjectAclEvidence.operationId, evidenceValues.operationId)
+        )
+      ).limit(1);
+      if (!evidence || evidence.inputHash !== inputHash) {
+        throw new Error("Google Drive ACL evidence operation conflicted");
+      }
+      if (inserted && principals.length > 0) {
+        await tx.insert(googleDriveObjectAclPrincipals).values(
+          principals.map((principal, ordinal) => ({
+            evidenceId: evidence.id,
+            ordinal,
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            ...principal
+          }))
+        );
+      }
+      const now = /* @__PURE__ */ new Date();
+      await tx.update(knowledgeSourceSyncIndexObligations).set({
+        googleDriveAclEvidenceId: evidence.id,
+        aclEligibility: input.eligibility,
+        updatedAt: now
+      }).where(eq24(knowledgeSourceSyncIndexObligations.id, obligation.id));
+      await tx.update(knowledgeSourceSyncItemOutcomes).set({
+        aclEligibility: input.eligibility,
+        aclEvidence: {
+          version: 1,
+          provider: "google_drive",
+          evidenceId: evidence.id,
+          aclRevision: evidence.aclRevision,
+          observedAt: evidence.observedAt.toISOString(),
+          expiresAt: evidence.expiresAt.toISOString()
+        }
+      }).where(eq24(knowledgeSourceSyncItemOutcomes.indexObligationId, obligation.id));
+      const [updatedDocument] = await tx.update(documents).set({
+        agentAccess: input.eligibility === "eligible",
+        ...input.eligibility === "denied" ? { chunkCount: 0 } : {},
+        updatedAt: now
+      }).where(eq24(documents.id, obligation.documentId)).returning({ id: documents.id });
+      if (!updatedDocument) {
+        throw new Error("Google Drive ACL evidence document authority changed");
+      }
+      if (input.eligibility === "denied") {
+        await tx.delete(documentChunks).where(eq24(documentChunks.documentId, obligation.documentId));
+      }
+      return { evidenceId: evidence.id, aclHash };
+    })
+  );
+}
+async function beginGoogleDriveObjectAclRefresh(db, input) {
+  await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => await scopedDb.transaction(async (tx) => {
+      const [observed] = await tx.select().from(knowledgeSourceSyncIndexObligations).where(eq24(knowledgeSourceSyncIndexObligations.id, input.obligationId)).limit(1);
+      if (!observed) throw new Error("Google Drive ACL refresh obligation was not found");
+      await setSubjectRlsContext(tx, observed.initiatingSubjectId);
+      const [state] = await tx.select().from(knowledgeSourceSyncStates).where(eq24(knowledgeSourceSyncStates.sourceId, observed.sourceId)).for("update").limit(1);
+      if (!state) throw new Error("Google Drive sync authorization is no longer active");
+      await tx.execute(sql21`
+          SELECT knowledge_source_sync_lock_authority(
+            ${input.accountId}::uuid,
+            ${observed.sourceId}::uuid,
+            ${observed.knowledgeSourceObjectId}::uuid
+          )
+        `);
+      const [[source], [object], [version], [obligation]] = await Promise.all([
+        tx.select().from(knowledgeSources).where(eq24(knowledgeSources.id, observed.sourceId)).limit(1),
+        tx.select().from(knowledgeSourceObjects).where(eq24(knowledgeSourceObjects.id, observed.knowledgeSourceObjectId)).limit(1),
+        tx.select().from(knowledgeDocumentVersions).where(eq24(knowledgeDocumentVersions.id, observed.knowledgeDocumentVersionId)).limit(1),
+        tx.select().from(knowledgeSourceSyncIndexObligations).where(eq24(knowledgeSourceSyncIndexObligations.id, input.obligationId)).for("update").limit(1)
+      ]);
+      const [document] = obligation ? await tx.select().from(documents).where(eq24(documents.id, obligation.documentId)).for("update").limit(1) : [];
+      if (!source || !object || !version || !obligation || !document || state.reconnectRequired || state.sourceSyncGeneration < input.sourceSyncGeneration || state.sourceConfigGeneration !== input.sourceConfigGeneration || state.sourceLifecycleGeneration !== input.sourceLifecycleGeneration || source.lifecycleState !== "active" || source.syncGeneration < obligation.sourceSyncGeneration || source.lifecycleGeneration !== input.sourceLifecycleGeneration || source.currentAclGeneration !== version.aclGeneration || object.lifecycleState !== "active" || object.lifecycleGeneration !== input.objectLifecycleGeneration || object.versionGeneration !== input.objectVersionGeneration || object.currentVersionId !== version.id || version.documentId !== document.id || version.fileId !== document.fileId || obligation.sourceSyncGeneration !== input.sourceSyncGeneration || obligation.sourceConfigGeneration !== input.sourceConfigGeneration || obligation.sourceLifecycleGeneration !== input.sourceLifecycleGeneration || obligation.objectLifecycleGeneration !== input.objectLifecycleGeneration || obligation.objectVersionGeneration !== input.objectVersionGeneration || obligation.status !== "indexed") {
+        throw new Error("Google Drive ACL refresh authority changed");
+      }
+      const now = /* @__PURE__ */ new Date();
+      await tx.update(knowledgeSourceSyncIndexObligations).set({
+        googleDriveAclEvidenceId: null,
+        aclEligibility: "denied",
+        updatedAt: now
+      }).where(eq24(knowledgeSourceSyncIndexObligations.id, obligation.id));
+      await tx.update(knowledgeSourceSyncItemOutcomes).set({
+        aclEligibility: "denied",
+        aclEvidence: { version: 1, provider: "google_drive", state: "refresh_pending" }
+      }).where(eq24(knowledgeSourceSyncItemOutcomes.indexObligationId, obligation.id));
+      await tx.update(documents).set({ agentAccess: false, updatedAt: now }).where(eq24(documents.id, obligation.documentId));
+    })
+  );
+}
+function normalizeGoogleDriveAclPrincipal(principal) {
+  const permissionId = cleanBoundedString(principal.permissionId, 1024);
+  const emailAddress = cleanBoundedString(principal.emailAddress, 320)?.toLowerCase() ?? null;
+  const domain = cleanBoundedString(principal.domain, 320)?.toLowerCase() ?? null;
+  if (principal.type === "user" || principal.type === "group") {
+    if (!permissionId && !emailAddress) {
+      throw new Error(`Google Drive ${principal.type} principal is missing identity`);
+    }
+  } else if (principal.type === "domain") {
+    if (!domain) throw new Error("Google Drive domain principal is missing its domain");
+  } else if (principal.type !== "anyone") {
+    throw new Error("Google Drive ACL principal type is invalid");
+  }
+  const expirationTime = principal.expirationTime ? exactDate(principal.expirationTime, "Google Drive ACL principal expiration") : null;
+  return {
+    principalType: principal.type,
+    permissionIdHash: permissionId ? principalHash("permission", permissionId) : null,
+    emailHash: emailAddress ? principalHash("email", emailAddress) : null,
+    domainHash: domain ? principalHash("domain", domain) : null,
+    role: principal.role,
+    inherited: principal.inherited === true,
+    allowFileDiscovery: principal.allowFileDiscovery === void 0 ? null : principal.allowFileDiscovery,
+    expirationTime
+  };
+}
+function principalHash(kind, value) {
+  return sha256Hex(`${kind}:${value.trim().toLowerCase()}`);
+}
+function sha256Hex(value) {
+  return createHash16("sha256").update(value).digest("hex");
+}
+function exactDate(value, label) {
+  const parsed = new Date(value);
+  if (!value || !Number.isFinite(parsed.getTime()) || parsed.toISOString() !== value) {
+    throw new Error(`${label} must be an exact UTC timestamp`);
+  }
+  return parsed;
+}
+function exactBoundedString(value, max, label) {
+  const normalized = cleanBoundedString(value, max);
+  if (!normalized || normalized !== value) throw new Error(`${label} is invalid`);
+  return normalized;
+}
+function cleanBoundedString(value, max) {
+  if (typeof value !== "string") return null;
+  const normalized = value.trim();
+  return normalized && normalized.length <= max ? normalized : null;
+}
 async function pruneKnowledgeSourceSyncEvidence(db, input) {
   const limit = Math.max(1, Math.min(input.limit ?? 500, 5e3));
   return await withRlsContext(
@@ -20496,7 +20803,7 @@ function assertImageGenerationOperationMatches(operation, input) {
 }
 
 // src/slack-user-link-access.ts
-import { createHash as createHash16 } from "crypto";
+import { createHash as createHash17 } from "crypto";
 import {
   SlackUserLinkAccessRequest as SlackUserLinkAccessRequestSchema
 } from "@opengeni/contracts";
@@ -20951,7 +21258,7 @@ function assertExactClaims(row, input) {
   }
 }
 function digestOperation(value) {
-  return createHash16("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash17("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function mapRequest(row) {
   return {
@@ -20971,12 +21278,12 @@ function mapRequest(row) {
 }
 
 // src/capability-integrations.ts
-import { createHash as createHash18 } from "crypto";
+import { createHash as createHash19 } from "crypto";
 import { stableJson as stableJson5 } from "@opengeni/contracts";
 import { and as and27, asc as asc14, eq as eq28, inArray as inArray15, ne as ne2, or as or6, sql as sql25 } from "drizzle-orm";
 
 // src/integration-bindings.ts
-import { createHash as createHash17 } from "crypto";
+import { createHash as createHash18 } from "crypto";
 import { stableJson as stableJson4 } from "@opengeni/contracts";
 import { and as and26, asc as asc13, eq as eq27, or as or5, sql as sql24 } from "drizzle-orm";
 var IntegrationFacetBindingVersionConflictError = class extends Error {
@@ -21260,7 +21567,7 @@ function assertBindingKey(value) {
   }
 }
 function sha2563(value) {
-  return createHash17("sha256").update(value).digest("hex");
+  return createHash18("sha256").update(value).digest("hex");
 }
 
 // src/capability-integrations.ts
@@ -22275,11 +22582,11 @@ function stringValue(value) {
   return typeof value === "string" && value.length > 0 ? value : void 0;
 }
 function sha2564(value) {
-  return createHash18("sha256").update(value).digest("hex");
+  return createHash19("sha256").update(value).digest("hex");
 }
 
 // src/integration-facets.ts
-import { createHash as createHash19 } from "crypto";
+import { createHash as createHash20 } from "crypto";
 import { stableJson as stableJson6 } from "@opengeni/contracts";
 import { and as and28, asc as asc15, eq as eq29, ne as ne3, sql as sql26 } from "drizzle-orm";
 var IntegrationFacetNotFoundError = class extends Error {
@@ -22844,7 +23151,7 @@ function objectValue2(value) {
   return value && typeof value === "object" && !Array.isArray(value) ? value : {};
 }
 function sha2565(value) {
-  return createHash19("sha256").update(value).digest("hex");
+  return createHash20("sha256").update(value).digest("hex");
 }
 
 // src/insights.ts
@@ -24460,7 +24767,7 @@ async function cancelResponseBody(response) {
 }
 
 // src/pack-components.ts
-import { createHash as createHash20 } from "crypto";
+import { createHash as createHash21 } from "crypto";
 import {
   stableJson as stableJson7
 } from "@opengeni/contracts";
@@ -25098,11 +25405,11 @@ function stringArray2(value) {
   return Array.isArray(value) ? value.filter((entry) => typeof entry === "string") : [];
 }
 function sha2566(value) {
-  return createHash20("sha256").update(value).digest("hex");
+  return createHash21("sha256").update(value).digest("hex");
 }
 
 // src/pack-installations.ts
-import { createHash as createHash21 } from "crypto";
+import { createHash as createHash22 } from "crypto";
 import {
   CapabilityPack as CapabilityPackSchema,
   stableJson as stableJson8
@@ -25666,7 +25973,7 @@ async function assertRegisteredPackManifestCurrent(db, input) {
     )
   ).for("update").limit(1);
   const parsed = registration ? CapabilityPackSchema.safeParse(registration.manifest) : null;
-  const currentDigest = parsed?.success === true ? createHash21("sha256").update(stableJson8(parsed.data)).digest("hex") : null;
+  const currentDigest = parsed?.success === true ? createHash22("sha256").update(stableJson8(parsed.data)).digest("hex") : null;
   if (input.expectedDigest !== input.admittedDigest || currentDigest !== input.expectedDigest) {
     throw new PackManifestChangedError(
       "Pack manifest changed after preview; review the current installation plan"
@@ -25711,7 +26018,7 @@ function mapPackInstallation(row) {
 }
 
 // src/plugin-packages.ts
-import { createHash as createHash22 } from "crypto";
+import { createHash as createHash23 } from "crypto";
 import { stableJson as stableJson9 } from "@opengeni/contracts";
 import { and as and32, asc as asc17, eq as eq33, inArray as inArray19, ne as ne6, or as or8, sql as sql30 } from "drizzle-orm";
 var PluginOperationIdempotencyError = class extends Error {
@@ -26501,7 +26808,7 @@ function safeHttpUrl(value) {
   }
 }
 function sha2567(value) {
-  return createHash22("sha256").update(value).digest("hex");
+  return createHash23("sha256").update(value).digest("hex");
 }
 
 // src/workspace-artifacts.ts
@@ -28011,7 +28318,7 @@ async function purgeExpiredTranscriptionRecordings(db, input) {
 }
 
 // src/editable-artifact-materialization.ts
-import { createHash as createHash23 } from "crypto";
+import { createHash as createHash24 } from "crypto";
 import { EDITABLE_ARTIFACT_KERNEL_VERSION_MAX_BYTES } from "@opengeni/contracts/editable-artifacts";
 import { sql as sql33 } from "drizzle-orm";
 var EDITABLE_ARTIFACT_MATERIALIZATION_MAX_CLAIM = 1e3;
@@ -28487,7 +28794,7 @@ function validateDatabaseNormalizedOptions(value, expectedHash) {
   } catch (error) {
     throw contractViolation("Materialization row contains invalid normalized options", error);
   }
-  const actualHash = `sha256:${createHash23("sha256").update(normalized, "utf8").digest("hex")}`;
+  const actualHash = `sha256:${createHash24("sha256").update(normalized, "utf8").digest("hex")}`;
   if (actualHash !== expectedHash) {
     throw contractViolation("Materialization options hash does not bind its exact canonical bytes");
   }
@@ -28644,7 +28951,7 @@ async function attemptToolCatalogByAttemptTx(tx, workspaceId, attemptId) {
 }
 
 // src/browser-sessions.ts
-import { createHash as createHash24, randomUUID as randomUUID7 } from "crypto";
+import { createHash as createHash25, randomUUID as randomUUID7 } from "crypto";
 import {
   BrowserSession,
   BrowserSessionCapabilities,
@@ -29116,7 +29423,7 @@ async function loadOperation2(db, workspaceId, operationId) {
   return row ?? null;
 }
 function requestDigest(value) {
-  return createHash24("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash25("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function browserSessionCreateRequestDigest(input) {
   const revisionSelection = input.identityId ? input.resolveDefaultRevision ? { kind: "identity_default" } : input.baseRevisionId ? { kind: "exact", revisionId: input.baseRevisionId } : { kind: "blank_identity" } : { kind: "none" };
@@ -30468,7 +30775,7 @@ function postgresConstraint2(error) {
 }
 
 // src/computer-sessions.ts
-import { createHash as createHash25, randomUUID as randomUUID8 } from "crypto";
+import { createHash as createHash26, randomUUID as randomUUID8 } from "crypto";
 import {
   ComputerSession,
   ComputerSessionCapabilities,
@@ -30613,7 +30920,7 @@ async function loadOperation3(db, workspaceId, operationId) {
   return row ?? null;
 }
 function requestDigest2(value) {
-  return createHash25("sha256").update(JSON.stringify(value)).digest("hex");
+  return createHash26("sha256").update(JSON.stringify(value)).digest("hex");
 }
 function computerSessionCreateRequestDigest(input) {
   return requestDigest2({
@@ -31274,7 +31581,7 @@ function assertOperationResource2(operation, computerSessionId, kind) {
 }
 
 // src/browser-identities.ts
-import { createHash as createHash26, randomUUID as randomUUID9 } from "crypto";
+import { createHash as createHash27, randomUUID as randomUUID9 } from "crypto";
 import {
   BrowserIdentity,
   BrowserIdentityListResponse,
@@ -31511,7 +31818,7 @@ async function updateBrowserIdentity(db, input) {
     ...input.defaultRevisionId !== void 0 ? { defaultRevisionId: input.defaultRevisionId } : {}
   });
   const { operationId: _operationId, ...digestRequest } = request;
-  const requestDigest4 = createHash26("sha256").update(
+  const requestDigest4 = createHash27("sha256").update(
     JSON.stringify({
       version: 1,
       identityId: input.identityId,
@@ -31622,7 +31929,7 @@ async function updateBrowserIdentity(db, input) {
   }
 }
 function browserRevisionPublicationRequestDigest(input) {
-  return createHash26("sha256").update(
+  return createHash27("sha256").update(
     JSON.stringify({
       version: 1,
       browserSessionId: input.browserSessionId,
@@ -32225,7 +32532,7 @@ function postgresConstraint3(error) {
 }
 
 // src/browser-downloads.ts
-import { createHash as createHash27 } from "crypto";
+import { createHash as createHash28 } from "crypto";
 import {
   BrowserDownload,
   BrowserDownloadSaveRequest,
@@ -32463,7 +32770,7 @@ function parseIdentity(input) {
   };
 }
 function requestDigest3(input) {
-  return createHash27("sha256").update(
+  return createHash28("sha256").update(
     JSON.stringify({
       browserSessionId: input.browserSessionId,
       destinationPath: input.request.destinationPath,
@@ -34834,6 +35141,57 @@ async function requireFile(db, workspaceId, fileId) {
   }
   return file;
 }
+async function requireFileForSubject(db, input) {
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      if (input.subjectId) await setSubjectRlsContext(scopedDb, input.subjectId);
+      const subjectIdSql = input.subjectId === null ? sql39`NULL::text` : sql39`${input.subjectId}`;
+      const [row] = await scopedDb.select().from(files).where(
+        and42(
+          eq43(files.accountId, input.accountId),
+          eq43(files.workspaceId, input.workspaceId),
+          eq43(files.id, input.fileId),
+          sql39`google_drive_file_authorized(
+              ${input.accountId}::uuid,
+              ${input.workspaceId}::uuid,
+              ${subjectIdSql},
+              ${input.fileId}::uuid
+            )`
+        )
+      ).limit(1);
+      if (!row) throw new Error(`File not found: ${input.fileId}`);
+      return mapFile2(row);
+    }
+  );
+}
+async function getFilesForSubject(db, input) {
+  const ids = [...new Set(input.fileIds)];
+  if (ids.length === 0) return [];
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      if (input.subjectId) await setSubjectRlsContext(scopedDb, input.subjectId);
+      const subjectIdSql = input.subjectId === null ? sql39`NULL::text` : sql39`${input.subjectId}`;
+      const rows = await scopedDb.select().from(files).where(
+        and42(
+          eq43(files.accountId, input.accountId),
+          eq43(files.workspaceId, input.workspaceId),
+          inArray25(files.id, ids),
+          sql39`google_drive_file_authorized(
+              ${input.accountId}::uuid,
+              ${input.workspaceId}::uuid,
+              ${subjectIdSql},
+              ${files.id}
+            )`
+        )
+      );
+      return rows.map(mapFile2);
+    }
+  );
+}
 async function getFiles(db, workspaceId, fileIds) {
   const ids = [...new Set(fileIds)];
   if (ids.length === 0) return [];
@@ -34842,14 +35200,14 @@ async function getFiles(db, workspaceId, fileIds) {
     return rows.map(mapFile2);
   });
 }
-function durableUserHistoryItem(prompt, resources, annotations = []) {
+function durableUserHistoryItem(prompt, resources, annotations = [], modelContext) {
   const attachmentRefs = resources.filter(
     (resource) => resource.kind === "file"
   );
   return {
     type: "message",
     role: "user",
-    content: renderTimelineAnnotationsForModel2(prompt, annotations),
+    content: renderUserMessageContentForModel(prompt, annotations, modelContext),
     ...attachmentRefs.length > 0 ? { [MODEL_ATTACHMENT_REFS_FIELD]: attachmentRefs } : {},
     ...annotations.length > 0 ? {
       [MODEL_TIMELINE_ANNOTATIONS_FIELD]: TimelineAnnotations2.parse(annotations)
@@ -35945,7 +36303,7 @@ async function installPortableSkill(db, input) {
         fileCount: input.files.length,
         totalBytes: input.totalBytes
       };
-      const manifestDigest = createHash28("sha256").update(stableJson10(manifest)).digest("hex");
+      const manifestDigest = createHash29("sha256").update(stableJson10(manifest)).digest("hex");
       const [versionByName] = await tx.select().from(capabilityPluginVersions).where(
         and42(
           eq43(capabilityPluginVersions.pluginId, plugin.id),
@@ -41435,7 +41793,7 @@ async function retainRigProviderImageArtifacts(db, workspaceId, images) {
         inArray25(sandboxCheckpointArtifacts.state, ["candidate", "current"])
       )
     ).for("update").limit(1);
-    const bindingHash = artifact ? `sha256:${createHash28("sha256").update(artifact.providerBindingKey, "utf8").digest("hex")}` : null;
+    const bindingHash = artifact ? `sha256:${createHash29("sha256").update(artifact.providerBindingKey, "utf8").digest("hex")}` : null;
     if (!artifact || bindingHash !== image.providerBindingKeyHash) continue;
     retained[backend] = image;
   }
@@ -45590,7 +45948,7 @@ function connectorActionPolicyDecision(resolved) {
   return resolved.decision;
 }
 function connectorActionFingerprint(input) {
-  return createHash28("sha256").update(
+  return createHash29("sha256").update(
     stableJson10({
       workspaceId: input.workspaceId,
       connectionId: input.connectionId,
@@ -45899,6 +46257,93 @@ async function upsertConnectorActionPolicy(db, input) {
     })
   );
 }
+async function ensureConnectorActionPolicyDefault(db, input) {
+  const scope = {
+    connectionId: boundedConnectorActionText(
+      input.connectionId,
+      "connector connection id",
+      CONNECTOR_ACTION_CONNECTION_ID_MAX
+    ),
+    serverId: boundedConnectorActionText(
+      input.serverId,
+      "connector server id",
+      CONNECTOR_ACTION_SERVER_ID_MAX
+    ),
+    toolName: boundedConnectorActionText(
+      input.toolName,
+      "connector tool name",
+      CONNECTOR_ACTION_NAME_MAX
+    ),
+    actionName: boundedConnectorActionText(
+      input.actionName,
+      "connector action name",
+      CONNECTOR_ACTION_NAME_MAX
+    )
+  };
+  const subjectId = boundedConnectorActionText(input.subjectId, "policy actor", 1024);
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => await scopedDb.transaction(async (tx) => {
+      await assertWorkspaceAccountPairInScope(tx, input.accountId, input.workspaceId);
+      const [inserted] = await tx.insert(connectorActionPolicies).values({
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        ...scope,
+        policy: input.policy,
+        createdBySubjectId: subjectId,
+        updatedBySubjectId: subjectId
+      }).onConflictDoNothing({
+        target: [
+          connectorActionPolicies.workspaceId,
+          connectorActionPolicies.connectionId,
+          connectorActionPolicies.serverId,
+          connectorActionPolicies.toolName,
+          connectorActionPolicies.actionName
+        ]
+      }).returning();
+      if (!inserted) {
+        const [existing] = await tx.select().from(connectorActionPolicies).where(
+          and42(
+            eq43(connectorActionPolicies.workspaceId, input.workspaceId),
+            eq43(connectorActionPolicies.connectionId, scope.connectionId),
+            eq43(connectorActionPolicies.serverId, scope.serverId),
+            eq43(connectorActionPolicies.toolName, scope.toolName),
+            eq43(connectorActionPolicies.actionName, scope.actionName)
+          )
+        ).limit(1);
+        if (!existing) throw new Error("Failed to reconcile connector action policy default");
+        return { policy: existing, changed: false };
+      }
+      await tx.insert(auditEvents).values(
+        withLosslessContentWriteVersion(
+          {
+            accountId: input.accountId,
+            workspaceId: input.workspaceId,
+            subjectId,
+            action: "connector.action.policy_changed",
+            targetType: "connector_action_policy",
+            targetId: inserted.id,
+            metadata: {
+              connectionId: inserted.connectionId,
+              serverId: inserted.serverId,
+              toolName: inserted.toolName,
+              actionName: inserted.actionName,
+              policy: inserted.policy,
+              version: inserted.version,
+              previousPolicy: null,
+              previousVersion: null,
+              source: "connector_default"
+            }
+          },
+          "metadata",
+          "metadataCodecVersion"
+        )
+      );
+      return { policy: inserted, changed: true };
+    })
+  );
+}
 async function prepareConnectorActionApproval(db, identity, invocation) {
   const normalized = normalizedConnectorActionInvocation(identity, invocation);
   if (!normalized.connectionId) {
@@ -46398,7 +46843,7 @@ async function createSessionInTransaction(tx, input, id) {
           accountId: input.accountId,
           workspaceId: input.workspaceId,
           initialMessage: input.initialMessage,
-          initialTurnInstructions: input.initialTurnInstructions ?? null,
+          initialModelContext: input.initialModelContext ?? null,
           resources: input.resources,
           skills: input.skills ?? [],
           tools: input.tools ?? [],
@@ -51081,7 +51526,7 @@ function validatedLegacyNativeSnapshotAdoption(value) {
   if (Buffer.from(bytes).toString("base64") !== value.archiveBase64) return null;
   const descriptor = parseArchiveRevision(value.descriptor);
   const native = decodeNativeSnapshotRef(bytes);
-  if (descriptor?.version !== 2 || !native || descriptor.archiveBytes !== bytes.length || descriptor.archiveSha256 !== createHash28("sha256").update(bytes).digest("hex") || descriptor.provider !== native.provider || descriptor.snapshotId !== native.snapshotId || descriptor.workspacePersistence !== native.workspacePersistence) {
+  if (descriptor?.version !== 2 || !native || descriptor.archiveBytes !== bytes.length || descriptor.archiveSha256 !== createHash29("sha256").update(bytes).digest("hex") || descriptor.provider !== native.provider || descriptor.snapshotId !== native.snapshotId || descriptor.workspacePersistence !== native.workspacePersistence) {
     return null;
   }
   return { archiveBase64: value.archiveBase64, descriptor };
@@ -51730,7 +52175,7 @@ var MODAL_ARCHIVE_PREFIXES = [
 var COLD_LOST_PROVIDER_OBSERVATION_MAX_AGE_MS = 5 * 60 * 1e3;
 var COLD_LOST_PROVIDER_OBSERVATION_MAX_FUTURE_MS = 60 * 1e3;
 function sha256String(value) {
-  return createHash28("sha256").update(value).digest("hex");
+  return createHash29("sha256").update(value).digest("hex");
 }
 function decodeCanonicalBase64(value) {
   if (typeof value !== "string" || value.length === 0 || value.length % 4 !== 0 || !/^[A-Za-z0-9+/]+={0,2}$/.test(value)) {
@@ -55676,7 +56121,7 @@ function validatedModalCheckpoint(input) {
     throw new Error("Checkpoint artifact archive is not canonical base64");
   }
   const native = decodeNativeSnapshotRef(bytes);
-  const sha2568 = createHash28("sha256").update(bytes).digest("hex");
+  const sha2568 = createHash29("sha256").update(bytes).digest("hex");
   if (!native || native.provider !== descriptor.provider || native.snapshotId !== descriptor.snapshotId || native.workspacePersistence !== descriptor.workspacePersistence || descriptor.archiveBytes !== bytes.length || descriptor.archiveSha256 !== sha2568) {
     throw new Error("Checkpoint artifact receipt does not match its verified descriptor");
   }
@@ -57059,7 +57504,7 @@ var MachineRemovalRevisionConflictError = class extends Error {
   name = "MachineRemovalRevisionConflictError";
 };
 function machineRemovalFingerprint(enrollmentId, expectedUpdatedAt) {
-  return createHash28("sha256").update(
+  return createHash29("sha256").update(
     JSON.stringify({
       enrollmentId,
       expectedUpdatedAt: expectedUpdatedAt ?? null
@@ -59876,7 +60321,7 @@ async function materializeGoalContinuation(db, input) {
           eq43(sessionGoals.sessionId, input.sessionId)
         )
       ).for("update").limit(1);
-      if (!goalRead || goalRead.status !== "active" || session.status === "cancelled" || effectiveControl.state !== "active") {
+      if (!goalRead || goalRead.status !== "active" || session.status === "failed" || session.status === "cancelled" || effectiveControl.state !== "active") {
         return { action: "none", events: [] };
       }
       const malformedGoalVersionEvidence = sql39`
@@ -60453,6 +60898,7 @@ async function initializeSessionStartAtomically(db, input) {
                 type: "user.message",
                 payload: {
                   ...initialPayload,
+                  ...session.initialModelContext ? { modelContext: session.initialModelContext } : {},
                   initiator: creator.initiator
                 },
                 clientEventId: input.clientEventId ?? `session-initial:${session.id}`
@@ -60499,7 +60945,7 @@ async function initializeSessionStartAtomically(db, input) {
               source: "user",
               position: queueTailPosition,
               prompt: canonicalInitialMessage,
-              turnInstructions: session.initialTurnInstructions ?? null,
+              modelContext: session.initialModelContext ?? null,
               resources: session.resources,
               tools: session.tools,
               toolsProvided: session.toolPolicy?.mode === "explicit",
@@ -60654,7 +61100,7 @@ async function enqueueSessionTurn(db, input) {
             source: input.source,
             position,
             prompt: input.prompt,
-            turnInstructions: input.turnInstructions ?? null,
+            modelContext: input.modelContext ?? null,
             resources: input.resources,
             tools: input.tools,
             toolsProvided: input.toolsProvided ?? false,
@@ -60870,9 +61316,14 @@ async function goalSnapshotForAcceptedTurnInTransaction(tx, row) {
 }
 async function claimSessionWorkForAttempt(db, workspaceId, input) {
   const { sessionId, workflowId } = input;
-  return await withWorkspaceSessionActivityRls(
+  return await retrySessionActivityRls(
     db,
     workspaceId,
+    {
+      stage: "session_attempts.claim",
+      eventTypes: ["session.turn.attempt_claimed"],
+      maxAttempts: 3
+    },
     async (scopedDb) => await withSessionActivitySavepoint(scopedDb, async (tx) => {
       const deliverPendingUpdates = async (accountId, turnId, turnGeneration, nextSequence, occurredAt, triggerEventId, expectedXaiAuthority) => {
         const [agentSteer] = await tx.select().from(sessionSystemUpdates).where(
@@ -61929,7 +62380,8 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
             item: durableUserHistoryItem(
               fromPostgresLosslessText(row.prompt, row.promptCodecVersion),
               Array.isArray(row.resources) ? row.resources : [],
-              TimelineAnnotations2.parse(row.annotations)
+              TimelineAnnotations2.parse(row.annotations),
+              row.modelContext
             )
           },
           "item",
@@ -63026,6 +63478,317 @@ async function peekSessionWork(db, workspaceId, sessionId) {
     return pendingAgentSteer ? { kind: "runnable" } : { kind: "idle" };
   });
 }
+async function failSessionWorkBeforeAttemptClaim(db, workspaceId, input) {
+  return await retrySessionActivityRls(
+    db,
+    workspaceId,
+    {
+      stage: "session_lifecycle_outbox.fail_before_attempt_claim",
+      eventTypes: ["child_terminal_result", "session.status.changed", "turn.failed"],
+      maxAttempts: 3
+    },
+    async (scopedDb) => await scopedDb.transaction(async (tx) => {
+      const baseLocks = await lockChildLifecycleOutboxWriteRowsTx(
+        tx,
+        workspaceId,
+        { sessionId: input.sessionId }
+      );
+      const session = baseLocks.session;
+      if (session.accountId !== input.accountId) {
+        throw new SessionControlInvariantError(
+          `Session ${input.sessionId} does not belong to account ${input.accountId}`
+        );
+      }
+      if (session.status === "failed" || session.status === "cancelled") {
+        return { action: "terminal", turnId: null, events: [] };
+      }
+      if (session.temporalWorkflowId !== null && session.temporalWorkflowId !== input.workflowId) {
+        return { action: "stale", turnId: null, events: [] };
+      }
+      const effectiveControl = await evaluateSessionControl(
+        tx,
+        workspaceId,
+        input.sessionId,
+        { workspaceControl: baseLocks.control ?? void 0 }
+      );
+      if (!baseLocks.workspace || effectiveControl.state !== "active") {
+        return { action: "stale", turnId: null, events: [] };
+      }
+      const [liveAttempt] = await tx.select({ id: sessionTurnAttempts.id }).from(sessionTurnAttempts).where(
+        and42(
+          eq43(sessionTurnAttempts.workspaceId, workspaceId),
+          eq43(sessionTurnAttempts.sessionId, input.sessionId),
+          inArray25(sessionTurnAttempts.state, ["claimed", "running"])
+        )
+      ).limit(1);
+      if (liveAttempt) {
+        return { action: "stale", turnId: null, events: [] };
+      }
+      let turn = null;
+      if (session.activeTurnId) {
+        const exactLocks = await lockSessionEventWriteRows(tx, {
+          workspaceId,
+          controlLock: "already_locked",
+          workspaceLock: "already_locked",
+          turnIds: [session.activeTurnId]
+        });
+        turn = exactLocks.turns[0] ?? null;
+        if (!turn || turn.accountId !== session.accountId || turn.sessionId !== input.sessionId) {
+          turn = null;
+        }
+        if (turn && isTerminalSessionTurnStatus(turn.status)) {
+          turn = null;
+        } else if (turn && input.trigger.kind === "approval") {
+          if (turn.status !== "requires_action" || !await isNewerApprovalTrigger(
+            tx,
+            workspaceId,
+            input.sessionId,
+            turn.triggerEventId,
+            input.trigger.triggerEventId
+          )) {
+            return { action: "stale", turnId: null, events: [] };
+          }
+        } else if (turn) {
+          if (turn.status === "requires_action") {
+            return { action: "stale", turnId: null, events: [] };
+          }
+          if (turn.status === "waiting_capacity") {
+            const [codexWaiter] = await tx.select({ id: codexCapacityWaiters.id }).from(codexCapacityWaiters).where(
+              and42(
+                eq43(codexCapacityWaiters.workspaceId, workspaceId),
+                eq43(codexCapacityWaiters.sessionId, input.sessionId),
+                eq43(codexCapacityWaiters.status, "waiting")
+              )
+            ).limit(1);
+            const xaiWaiter = await getXaiCapacityWaitForSessionInTransaction(
+              tx,
+              workspaceId,
+              input.sessionId
+            );
+            if (codexWaiter || xaiWaiter) {
+              return { action: "stale", turnId: null, events: [] };
+            }
+          }
+        }
+      } else {
+        if (input.trigger.kind === "approval") {
+          return { action: "stale", turnId: null, events: [] };
+        }
+        const [pendingAgentSteer] = await tx.select({ id: sessionSystemUpdates.id }).from(sessionSystemUpdates).where(
+          and42(
+            eq43(sessionSystemUpdates.workspaceId, workspaceId),
+            eq43(sessionSystemUpdates.sessionId, input.sessionId),
+            eq43(sessionSystemUpdates.kind, "agent_steer_instruction"),
+            eq43(sessionSystemUpdates.state, "pending")
+          )
+        ).orderBy(
+          desc17(sessionSystemUpdates.createdAt),
+          desc17(sessionSystemUpdates.id)
+        ).limit(1);
+        const queuedRows = await rawRows(
+          tx,
+          sql39`select id from session_turns
+                where workspace_id = ${workspaceId} and session_id = ${input.sessionId}
+                  and status = 'queued' and source in ('user', 'api')
+                  and (
+                    ${Boolean(pendingAgentSteer)} = false
+                    or metadata->>'delivery' = 'steer'
+                  )
+                order by position asc, created_at asc, id asc
+                limit 1`
+        );
+        const queuedPreview = queuedRows[0];
+        if (queuedPreview) {
+          const exactLocks = await lockSessionEventWriteRows(tx, {
+            workspaceId,
+            controlLock: "already_locked",
+            workspaceLock: "already_locked",
+            turnIds: [queuedPreview.id]
+          });
+          turn = exactLocks.turns[0] ?? null;
+          if (!turn || turn.accountId !== session.accountId || turn.sessionId !== input.sessionId || turn.status !== "queued" || turn.activeAttemptId !== null) {
+            return { action: "stale", turnId: null, events: [] };
+          }
+        } else if (!session.compactRequested) {
+          if (!pendingAgentSteer && await latestFinishedTurnHasFailureCodeTx(
+            tx,
+            workspaceId,
+            input.sessionId,
+            "context_compaction_failed"
+          )) {
+            return { action: "stale", turnId: null, events: [] };
+          }
+          const [pendingUpdate] = await tx.select({ id: sessionSystemUpdates.id }).from(sessionSystemUpdates).where(
+            and42(
+              eq43(sessionSystemUpdates.workspaceId, workspaceId),
+              eq43(sessionSystemUpdates.sessionId, input.sessionId),
+              eq43(sessionSystemUpdates.state, "pending")
+            )
+          ).limit(1).for("update");
+          if (!pendingUpdate) {
+            return { action: "stale", turnId: null, events: [] };
+          }
+        }
+      }
+      const now = /* @__PURE__ */ new Date();
+      let sequence = session.lastSequence;
+      let closedToolEvents = [];
+      if (turn) {
+        await cancelTurnInteractionInterventionsInTransaction(tx, {
+          accountId: session.accountId,
+          workspaceId,
+          sessionId: input.sessionId,
+          turnId: turn.id
+        });
+        const closedTools = await closePendingSessionToolCallsInTransaction(
+          tx,
+          {
+            accountId: session.accountId,
+            workspaceId,
+            sessionId: input.sessionId,
+            turnId: turn.id,
+            reason: "turn_failed",
+            sequence,
+            now
+          }
+        );
+        sequence = closedTools.sequence;
+        closedToolEvents = closedTools.events;
+        await tx.update(sessionHumanInputRequests).set({
+          status: "cancelled",
+          response: { outcome: "cancelled" },
+          respondedBy: "system:turn_failed",
+          respondedAt: now,
+          updatedAt: now
+        }).where(
+          and42(
+            eq43(sessionHumanInputRequests.workspaceId, workspaceId),
+            eq43(sessionHumanInputRequests.sessionId, input.sessionId),
+            eq43(sessionHumanInputRequests.turnId, turn.id),
+            eq43(sessionHumanInputRequests.status, "pending")
+          )
+        );
+      }
+      await settleSessionMaintenanceInTransaction(tx, {
+        accountId: session.accountId,
+        workspaceId,
+        sessionId: input.sessionId
+      });
+      if (!turn) {
+        await tx.update(sessionSystemUpdates).set({ state: "failed" }).where(
+          and42(
+            eq43(sessionSystemUpdates.workspaceId, workspaceId),
+            eq43(sessionSystemUpdates.sessionId, input.sessionId),
+            eq43(sessionSystemUpdates.state, "pending")
+          )
+        );
+      }
+      const values = [
+        ...turn ? [
+          {
+            accountId: session.accountId,
+            workspaceId,
+            sessionId: input.sessionId,
+            sequence: ++sequence,
+            type: "turn.failed",
+            payload: {
+              triggerEventId: turn.triggerEventId,
+              code: "pre_claim_failure",
+              error: input.error
+            },
+            turnId: turn.id,
+            turnGeneration: turn.executionGeneration,
+            turnAttemptId: null,
+            turnAssociation: "current",
+            occurredAt: now
+          }
+        ] : [],
+        {
+          accountId: session.accountId,
+          workspaceId,
+          sessionId: input.sessionId,
+          sequence: ++sequence,
+          type: "session.status.changed",
+          payload: { status: "failed", code: "pre_claim_failure" },
+          turnId: turn?.id ?? null,
+          turnGeneration: turn?.executionGeneration ?? null,
+          turnAttemptId: null,
+          turnAssociation: turn ? "current" : null,
+          occurredAt: now
+        }
+      ];
+      const inserted = await tx.insert(sessionEvents).values(withLosslessContentWriteVersion(values, "payload", "payloadCodecVersion")).returning();
+      if (turn) {
+        const failedEvent = inserted.find((event) => event.type === "turn.failed");
+        if (!failedEvent) {
+          throw new SessionControlInvariantError(
+            `Pre-claim failure for turn ${turn.id} has no terminal event`
+          );
+        }
+        await projectSessionRealtimeDelegationTerminalInTransaction(tx, {
+          accountId: session.accountId,
+          workspaceId,
+          sessionId: input.sessionId,
+          turnId: turn.id,
+          turnStatus: "failed",
+          terminalEvent: {
+            id: failedEvent.id,
+            type: "turn.failed",
+            payload: sessionEventPayloadRecord(
+              failedEvent.payload,
+              failedEvent.payloadCodecVersion
+            )
+          },
+          now
+        });
+        await tx.update(sessionTurns).set({
+          status: "failed",
+          activeAttemptId: null,
+          version: turn.version + 1,
+          finishedAt: now,
+          updatedAt: now
+        }).where(
+          and42(
+            eq43(sessionTurns.workspaceId, workspaceId),
+            eq43(sessionTurns.sessionId, input.sessionId),
+            eq43(sessionTurns.id, turn.id)
+          )
+        );
+        await enqueueFailedChildOutboxForTurnTx(
+          tx,
+          workspaceId,
+          session,
+          turn
+        );
+      } else {
+        await enqueueFailedChildOutboxWithoutTurnTx(
+          tx,
+          workspaceId,
+          session,
+          sequence
+        );
+      }
+      await tx.update(sessions).set({
+        status: "failed",
+        activeTurnId: null,
+        compactRequested: false,
+        lastSequence: sequence,
+        queueVersion: session.queueVersion + 1,
+        updatedAt: now
+      }).where(
+        and42(
+          eq43(sessions.workspaceId, workspaceId),
+          eq43(sessions.id, input.sessionId)
+        )
+      );
+      return {
+        action: "failed",
+        turnId: turn?.id ?? null,
+        events: [...closedToolEvents, ...inserted.map(mapEvent2)]
+      };
+    })
+  );
+}
 async function lockChildLifecycleOutboxWriteRowsTx(tx, workspaceId, input) {
   const prefix = await lockSessionEventWriteRows(tx, {
     workspaceId,
@@ -65004,9 +65767,8 @@ function queuedSteerReplacementAttemptId(metadata) {
   }
   return null;
 }
-async function enqueueFailedChildOutboxForTurnTx(tx, workspaceId, session, turn) {
+async function enqueueFailedChildOutboxTx(tx, workspaceId, session, input) {
   if (!session.parentSessionId) return;
-  const dedupeKey = `child-completion:${turn.sessionId}:turn:${turn.id}`;
   const personalConnectionDelegations = session.parentTurnId ? await personalConnectionDelegationsForTurnInTransaction(
     tx,
     workspaceId,
@@ -65038,26 +65800,26 @@ async function enqueueFailedChildOutboxForTurnTx(tx, workspaceId, session, turn)
     withLosslessContentWriteVersion(
       withLosslessContentWriteVersion(
         {
-          accountId: turn.accountId,
+          accountId: session.accountId,
           workspaceId,
-          sourceSessionId: turn.sessionId,
+          sourceSessionId: session.id,
           targetSessionId: session.parentSessionId,
-          dedupeKey,
+          dedupeKey: input.dedupeKey,
           kind: "child_terminal_result",
           classification: "failure",
-          sourceId: turn.sessionId,
+          sourceId: session.id,
           summary: "Child session failed; inspect the durable child timeline.",
           payload: {
             type: "child_terminal_result",
-            childSessionId: turn.sessionId,
+            childSessionId: session.id,
             status: "failed",
-            turnId: turn.id
+            ...input.turnId ? { turnId: input.turnId } : {}
           },
           lineage: {
-            childSessionId: turn.sessionId,
+            childSessionId: session.id,
             parentSessionId: session.parentSessionId,
             ...session.parentTurnId ? { parentTurnId: session.parentTurnId } : {},
-            turnId: turn.id,
+            ...input.turnId ? { turnId: input.turnId } : {},
             ...xaiAuthoritySubjectId ? { xaiAuthoritySubjectId } : {}
           },
           personalConnectionDelegations,
@@ -65076,6 +65838,23 @@ async function enqueueFailedChildOutboxForTurnTx(tx, workspaceId, session, turn)
     ]
   });
 }
+async function enqueueFailedChildOutboxForTurnTx(tx, workspaceId, session, turn) {
+  if (turn.accountId !== session.accountId || turn.sessionId !== session.id) {
+    throw new SessionControlInvariantError(
+      `Failed child turn ${turn.id} lost session ${session.id} ownership`
+    );
+  }
+  await enqueueFailedChildOutboxTx(tx, workspaceId, session, {
+    turnId: turn.id,
+    dedupeKey: `child-completion:${turn.sessionId}:turn:${turn.id}`
+  });
+}
+async function enqueueFailedChildOutboxWithoutTurnTx(tx, workspaceId, session, terminalSequence) {
+  await enqueueFailedChildOutboxTx(tx, workspaceId, session, {
+    turnId: null,
+    dedupeKey: `child-completion:${session.id}:pre-claim:${terminalSequence}`
+  });
+}
 function parseChildTerminalResultPayload(input) {
   const payload = SessionSystemUpdatePayload.parse(input);
   if (payload.type !== "child_terminal_result") {
@@ -65177,10 +65956,19 @@ async function enqueueSessionWorkflowWakeInTransaction(tx, input) {
       controlRevision: input.controlRequested ? sql39`${sessionWorkflowWakeOutbox.wakeRevision} + 1` : sql39`${sessionWorkflowWakeOutbox.controlRevision}`,
       reason: input.reason,
       attempts: 0,
-      // Coalescing a delayed retry must never postpone an already-due wake
-      // owned by another producer. A later revision makes the batch richer;
-      // it does not revoke the earlier delivery obligation.
-      nextAttemptAt: sql39`least(${sessionWorkflowWakeOutbox.nextAttemptAt}, ${nextAttemptAt.toISOString()}::timestamptz)`,
+      // Coalescing a delayed retry must never postpone an undelivered wake
+      // owned by another producer. Once every prior revision is delivered,
+      // however, this is a new obligation and must honor its own deadline;
+      // retaining the old (usually past) deadline would defeat backoff.
+      nextAttemptAt: sql39`case
+          when ${sessionWorkflowWakeOutbox.wakeRevision}
+            > ${sessionWorkflowWakeOutbox.deliveredRevision}
+          then least(
+            ${sessionWorkflowWakeOutbox.nextAttemptAt},
+            ${nextAttemptAt.toISOString()}::timestamptz
+          )
+          else ${nextAttemptAt.toISOString()}::timestamptz
+        end`,
       lastError: null,
       updatedAt: now
     }
@@ -65980,7 +66768,7 @@ async function acceptSessionApprovalDecision(db, input) {
   );
 }
 function deterministicSystemUuid(seed) {
-  const bytes = createHash28("sha256").update(seed, "utf8").digest().subarray(0, 16);
+  const bytes = createHash29("sha256").update(seed, "utf8").digest().subarray(0, 16);
   bytes[6] = (bytes[6] ?? 0) & 15 | 80;
   bytes[8] = (bytes[8] ?? 0) & 63 | 128;
   const hex = bytes.toString("hex");
@@ -66706,7 +67494,6 @@ function mapSessionTurn(row) {
 function mapSessionTurnForExecution(row) {
   return {
     ...mapSessionTurn(row),
-    turnInstructions: row.turnInstructions ?? null,
     initiatingHumanSubjectId: row.initiatingHumanSubjectId ?? null,
     personalConnectionDelegations: parsedPersonalConnectionDelegations(
       row.personalConnectionDelegations,
@@ -67735,6 +68522,7 @@ export {
   autoResumeSessionBranchInTransaction,
   backfillModelCallFactsFromSessionEvents,
   beginConnectorActionExecution,
+  beginGoogleDriveObjectAclRefresh,
   beginImageGenerationOperation,
   beginKnowledgeSyncRun,
   beginRigChangeVerificationAttempt,
@@ -67991,6 +68779,7 @@ export {
   ensureCanonicalHumanIdentity,
   ensureCanonicalHumanIdentityForAuthUser,
   ensureCodexRotationSettings,
+  ensureConnectorActionPolicyDefault,
   ensureIntegrationFacetDefinition,
   ensureKnowledgeSourceBlobFile,
   ensureKnowledgeSourceSyncState,
@@ -68019,6 +68808,7 @@ export {
   failMemorySlackPublication,
   failSandboxRematerialization,
   failSessionRealtimeConnectionInTransaction,
+  failSessionWorkBeforeAttemptClaim,
   failTranscriptionRecordingAssembly,
   failTranscriptionRecordingSegment,
   failWarmingToCold,
@@ -68082,6 +68872,7 @@ export {
   getFile,
   getFileUpload,
   getFiles,
+  getFilesForSubject,
   getGeneratedImageArtifact,
   getGeneratedVideoArtifact,
   getHostExportConsumerStatus,
@@ -68243,6 +69034,7 @@ export {
   isMemoryScopeApplicable,
   isMemoryTextTooLong,
   isPrivateAddress,
+  isRetryableDatabaseTransportFailure,
   isRetryablePersistenceSqlState,
   isSessionCompactionRequested,
   isSessionEventPersistenceError,
@@ -68497,6 +69289,7 @@ export {
   recordConnectionTokenRefresh,
   recordConnectionUsed,
   recordGeneratedImageArtifactError,
+  recordGoogleDriveObjectAclEvidence,
   recordKnowledgeLifecycleEvent,
   recordKnowledgeSourceSyncAclEvidence,
   recordKnowledgeSourceSyncItemOutcomes,
@@ -68568,6 +69361,7 @@ export {
   requestSessionTurnRecovery,
   requestSlackUserLinkWorkspaceAccess,
   requireFile,
+  requireFileForSubject,
   requireScheduledTask,
   requireScheduledTaskTargetInTransaction,
   requireSession,