@opengeni/db 0.7.3 → 0.10.7

package/dist/provision-roles.d.ts

@@ -1,10 +1,11 @@
-import { ResourceRef, ToolRef, ReasoningEffort, KnowledgeMemoryKind, SessionEvent, SessionStatus, SystemUpdateClassification, SessionSystemUpdateKind, SessionSystemUpdatePayload, SessionSystemUpdate, SessionEventType, SessionTurnStatus, Permission, SessionTurn, ConnectionKind, ConnectionStatus, KnowledgeMemory, CapabilityKind, CapabilitySource, KnowledgeMemoryStatus, KnowledgeSourceRef, ScheduledTaskStatus, ScheduledTaskScheduleSpec, ScheduledTaskRunMode, ScheduledTaskOverlapPolicy, ScheduledTaskAgentConfig, SessionGoalCreatedBy, SocialProvider, SocialConnectionStatus, McpServerConnectionRef as McpServerConnectionRef$1, SessionTurnSource, SandboxBackend, SandboxOs, FileAsset, FileUploadStatus, SessionGoal, CapabilityPack, RigCheck, Session, LineageNode, SessionMcpServerMetadata, RigVersion, BillingBalance, RigChange, AccessContext, ApiKey, ConnectionMetadata, Rig, RigChangeKind, ScheduledTask, ScheduledTaskTriggerType, ScheduledTaskRun, SocialConnection, SocialPost, VariableSet, Workspace, CapabilityInstallation, PackInstallation, CapabilityCatalogItem, ManagedAccount, SessionQueueSnapshot, WorkspaceControlEvent, AccessGrant, WorkspaceRegisteredPack, SessionListResponse, UsageEvent, WorkspaceMember, SessionGoalStatus, VariableSetVariableMetadata, PackInstallationStatus, RigChangeStatus, ScheduledTaskRunStatus } from '@opengeni/contracts';
+import { TurnInitiatorContext, SessionMcpApprovalPolicy, TurnInitiator, ResourceRef, ToolRef, ReasoningEffort, TurnExecutionPolicyV1, KnowledgeMemoryKind, McpCredentialsRequest, McpCredentialAuthNeededReason, McpConnectionResourceScope, ConnectionCredentialsPort, SessionEvent, SessionStatus, SessionHumanInputRequest, SystemUpdateClassification, SessionSystemUpdateKind, SessionSystemUpdatePayload, SessionSystemUpdate, SessionEventType, SessionTurnStatus, HumanInputQuestion, Permission, SessionTurn, ConnectionKind, ConnectionStatus, KnowledgeMemory, CapabilityKind, CapabilitySource, KnowledgeMemoryStatus, KnowledgeSourceRef, ScheduledTaskStatus, ScheduledTaskScheduleSpec, ScheduledTaskRunMode, ScheduledTaskOverlapPolicy, ScheduledTaskAgentConfig, SessionGoalCreatedBy, McpServerConnectionRef as McpServerConnectionRef$1, SocialProvider, SocialConnectionStatus, SessionTurnSource, SandboxBackend, SandboxOs, FileAsset, FileUploadStatus, GitHubRepositoryScope, SessionGoal, SessionEventReadDirection, SessionEventSemanticClass, SessionEventPayloadMode, SessionAuthorizationListScope, CapabilityPack, RigChangeKind, RigChangeStatus, RigCheck, SessionGoalStatus, Session, LineageNode, SessionMcpServerMetadata, RigVersion, BillingBalance, RigChange, AccessContext, HostEventExportBatch, HostUsageExportBatch, ApiKey, ConnectionMetadata, Rig, ScheduledTask, ScheduledTaskTriggerType, ScheduledTaskRun, SessionToolPolicy, SocialConnection, SocialPost, VariableSet, Workspace, CapabilityInstallation, PackInstallation, CapabilityCatalogItem, HumanInputResponse, ManagedAccount, SessionQueueSnapshot, WorkspaceControlEvent, AccessGrant, WorkspaceRegisteredPack, SessionListResponse, UsageEvent, WorkspaceMember, VariableSetVariableMetadata, PackInstallationStatus, ScheduledTaskRunStatus } from '@opengeni/contracts';
 import { environmentsEncryptionKeyBytes, Settings, McpServerConnectionRef } from '@opengeni/config';
-import { refreshCodexToken, CodexTokenSnapshot, CodexUsagePayload } from '@opengeni/codex';
+import { refreshCodexToken, CodexRateLimitResetCreditsDetails, ResetCreditFetchFailureReason, CodexTokenSnapshot, CodexFetch, CodexUsagePayload } from '@opengeni/codex';
+import { SQL } from 'drizzle-orm';
 import { PgDatabase, PgTransactionConfig } from 'drizzle-orm/pg-core';
-import { s as sessionCommandReceipts, a as sessionTurnAttempts, c as composerDrafts, b as sessionTurns, d as schema, e as enrollmentOsValues, f as enrollmentExposureValues, g as deviceEnrollmentStatusValues, h as enrollmentStatusValues, i as sandboxKindValues, j as sessionRecordingCodecValues, k as sessionRecordingModeValues, l as sessionRecordingStateValues } from './schema-BN5mB9xZ.js';
-import 'drizzle-orm';
+import { s as sessionCommandReceipts, w as workspaces, a as sessions, b as sessionTurns, c as sessionTurnAttempts, d as composerDrafts, e as schema, f as enrollmentOsValues, g as enrollmentExposureValues, h as deviceEnrollmentStatusValues, i as enrollmentStatusValues, j as sandboxKindValues, k as sessionRecordingCodecValues, l as sessionRecordingModeValues, m as sessionRecordingStateValues } from './schema-CqkzrBRS.js';
 import './migrate.js';
+import { FetchLike, DnsLookup } from '@opengeni/network';
 
 declare const SESSION_ANCESTRY_LIMIT = 10000;
 type WorkspaceControlLockMode = "share" | "update";
@@ -12,6 +13,11 @@ type EffectiveControlState = "active" | "paused";
 type SessionCommandActor = {
     type: "human" | "operator";
     subjectId: string;
+} | {
+    type: "service";
+    subjectId: string;
+    subjectLabel?: string;
+    context?: TurnInitiatorContext;
 } | {
     type: "agent_attempt";
     attemptId: string;
@@ -52,8 +58,28 @@ type EffectiveSessionControl = {
     settlement: {
         state: "stopping";
         attemptCount: number;
+        interruptionPendingCount: number;
+        quiescencePendingCount: number;
     } | null;
 };
+declare const SESSION_DISCOVERY_CONTROL_TITLE_MAX_CHARS = 200;
+declare const SESSION_DISCOVERY_CONTROL_TARGET_LIMIT = 100;
+/**
+ * Purpose-built control projection for session discovery. Full blocker evidence,
+ * actors/reasons, resume options, etags, and settlement state remain available
+ * from the ordinary session detail APIs; this shape is intentionally only what
+ * `sessions_list` renders.
+ */
+type SessionDiscoveryControl = {
+    state: EffectiveControlState;
+    primaryBlocker: {
+        kind: "session" | "workspace";
+        sessionId?: string;
+        displayName: string;
+        displayNameOriginalChars: number;
+    } | null;
+    additionalBlockerCount: number;
+};
 declare function serializeEffectiveSessionControl(control: EffectiveSessionControl): {
     primaryBlocker: (Omit<EffectiveControlBlocker, "changedAt"> & {
         changedAt: string | null;
@@ -82,6 +108,8 @@ declare function serializeEffectiveSessionControl(control: EffectiveSessionContr
     settlement: {
         state: "stopping";
         attemptCount: number;
+        interruptionPendingCount: number;
+        quiescencePendingCount: number;
     } | null;
 };
 type WorkspaceControlRow = {
@@ -121,6 +149,47 @@ declare function assertAgentCommandAuthorityInTransaction(db: Database, input: {
 }): Promise<void>;
 declare function canonicalSessionCommandHash(value: unknown): string;
 declare function lockWorkspaceInferenceControl(db: Database, workspaceId: string, mode: WorkspaceControlLockMode): Promise<WorkspaceControlRow>;
+type SessionEventWriteLockInput = {
+    workspaceId: string;
+    /**
+     * Control-aware writes take this lock first. Callers that already hold the
+     * workspace control row (for example a Pause mutation under FOR UPDATE) say
+     * `already_locked`; ordinary audit/title appends explicitly use `none`.
+     */
+    controlLock: WorkspaceControlLockMode | "already_locked" | "none";
+    /** Used only when a staged caller already established the workspace prefix. */
+    workspaceLock?: "key_share" | "already_locked";
+    sessionIds?: string[];
+    turnIds?: string[];
+    attemptIds?: string[];
+};
+type SessionEventWriteLocks = {
+    control: WorkspaceControlRow | null;
+    workspace: typeof workspaces.$inferSelect | null;
+    sessions: Array<typeof sessions.$inferSelect>;
+    turns: Array<typeof sessionTurns.$inferSelect>;
+    attempts: Array<typeof sessionTurnAttempts.$inferSelect>;
+};
+/**
+ * Establish the one canonical lock prefix for every `session_events` writer:
+ *
+ *   workspace_inference_controls (when control-aware)
+ *     -> actual workspaces row FOR KEY SHARE
+ *     -> session rows FOR UPDATE, UUID ordered
+ *     -> exact turn rows FOR UPDATE, UUID ordered
+ *     -> exact attempt rows FOR UPDATE, UUID ordered
+ *
+ * `FOR KEY SHARE` is deliberate. Event inserts need the workspace key to remain
+ * stable for their FK, but they do not mutate the workspace. The old generic
+ * `FOR UPDATE` lock serialized unrelated sessions and inverted the activity
+ * path's session -> implicit workspace-FK edge.
+ *
+ * Complex lifecycle transactions may acquire allocator/control locks before
+ * this helper and may discover exact turn IDs only after locking the session.
+ * They use the explicit `already_locked` stages, while retaining the same
+ * monotonic table order. New event writers should prefer one complete call.
+ */
+declare function lockSessionEventWriteRows(db: Database, input: SessionEventWriteLockInput): Promise<SessionEventWriteLocks>;
 declare function registerSessionTurnAttemptClaim(db: Database, input: {
     id: string;
     accountId: string;
@@ -132,6 +201,7 @@ declare function registerSessionTurnAttemptClaim(db: Database, input: {
     temporalWorkflowRunId: string;
     temporalActivityId: string;
     verifiedControlRevision: number;
+    mcpApprovalPolicies: Record<string, SessionMcpApprovalPolicy>;
 }): Promise<typeof sessionTurnAttempts.$inferSelect>;
 /**
  * Close the exact first-class owner while the caller still holds the owning
@@ -153,9 +223,23 @@ declare function closeSessionTurnAttemptInTransaction(db: Database, input: {
 }>;
 declare function evaluateSessionControls(db: Database, workspaceId: string, sessionIds: string[], options?: {
     lock?: WorkspaceControlLockMode;
+    /** Reuse a control row already locked before workspace/session/turn rows. */
+    workspaceControl?: WorkspaceControlRow | undefined;
 }): Promise<Map<string, EffectiveSessionControl>>;
+/**
+ * Return one compact aggregate row per target for `sessions_list`.
+ *
+ * Unlike `evaluateSessionControls`, the database boundary never returns a row
+ * per blocker/ancestor, nor does application code construct blocker or resume
+ * option arrays. The recursive walk carries no growing visited-path array: a
+ * missing ancestor stops below the limit, while a cycle cannot reach a root and
+ * therefore runs into the hard `SESSION_ANCESTRY_LIMIT`. The externally
+ * supplied target set is capped by `SESSION_DISCOVERY_CONTROL_TARGET_LIMIT`.
+ */
+declare function evaluateSessionDiscoveryControls(db: Database, workspaceId: string, sessionIds: string[]): Promise<Map<string, SessionDiscoveryControl>>;
 declare function evaluateSessionControl(db: Database, workspaceId: string, sessionId: string, options?: {
     lock?: WorkspaceControlLockMode;
+    workspaceControl?: WorkspaceControlRow | undefined;
 }): Promise<EffectiveSessionControl>;
 declare function reserveSessionCommandReceipt(db: Database, input: {
     accountId: string;
@@ -224,7 +308,7 @@ declare function autoResumeSessionBranchInTransaction(db: Database, input: {
     workspaceId: string;
     sessionId: string;
     actor: string;
-    reason: "human_send" | "human_steer" | "agent_steer";
+    reason: "human_send" | "human_steer" | "service_send" | "service_steer" | "agent_steer";
     observedControlEtag?: string | null;
 }): Promise<{
     revision: number;
@@ -251,7 +335,13 @@ declare function mutateWorkspaceControlInTransaction(db: Database, input: {
     expectedRevision?: number | null;
 }): Promise<WorkspaceControlMutationResult>;
 
-type QueueCommandConflictCode = "QUEUE_VERSION_CHANGED" | "QUEUE_PROMPT_STARTED" | "QUEUE_ANCHOR_CHANGED" | "PROMPT_CHANGED" | "DRAFT_CHANGED" | "DRAFT_NOT_EMPTY";
+type FrozenTurnInitiator = {
+    initiator: TurnInitiator;
+    context: TurnInitiatorContext;
+};
+declare function frozenInitiatorForCommandActor(db: Database, workspaceId: string, actor: SessionCommandActor, subjectLabel?: string): Promise<FrozenTurnInitiator>;
+
+type QueueCommandConflictCode = "QUEUE_VERSION_CHANGED" | "QUEUE_PROMPT_STARTED" | "QUEUE_ANCHOR_CHANGED" | "PROMPT_CHANGED" | "DRAFT_CHANGED" | "DRAFT_NOT_EMPTY" | "EDIT_SOURCE_CHANGED";
 declare class QueueCommandConflictError extends Error {
     readonly code: QueueCommandConflictCode;
     readonly current: {
@@ -341,6 +431,7 @@ declare function saveComposerDraftInTransaction(db: Database, input: {
     text: string;
     resources: ResourceRef[];
     tools: ToolRef[];
+    toolsProvided: boolean;
     model: string;
     reasoningEffort: ReasoningEffort;
 }): Promise<ComposerDraftRow>;
@@ -391,17 +482,22 @@ declare function submitHumanPromptInTransaction(db: Database, input: {
     workspaceId: string;
     sessionId: string;
     subjectId: string;
+    subjectLabel?: string;
     actor: SessionCommandActor;
     operationKey: string;
     delivery: "send" | "steer";
     controlEtag?: string | null;
     expectedDraftRevision?: number | null;
     text: string;
+    turnInstructions?: string | null;
     resources: ResourceRef[];
     tools: ToolRef[];
+    toolsProvided?: boolean;
     model?: string | null;
     reasoningEffort?: ReasoningEffort | null;
     reasoningEffortFallback: ReasoningEffort;
+    /** Trusted API/core admission snapshot. Omitted only by legacy low-level callers. */
+    turnExecutionPolicy?: TurnExecutionPolicyV1;
     source: "user" | "api";
     mcpCredentialUpdates?: Array<{
         id: string;
@@ -449,23 +545,6 @@ declare function encryptEnvironmentValue(key: Uint8Array, plaintext: string): st
  */
 declare function decryptEnvironmentValue(key: Uint8Array, stored: string): string;
 
-/**
- * Last line of defense against a session event crashing a whole turn.
- *
- * Postgres `text`/`jsonb` cannot store a NUL byte (U+0000) nor lone UTF-16
- * surrogates. Raw exec output routinely carries both -- chrome/crashpad logs,
- * `cat` of a binary, random bytes -- and the worker persists that output verbatim
- * inside `agent.toolCall.output` / `sandbox.command.output` event payloads. When
- * such a payload reaches `INSERT INTO session_events`, the driver rejects it
- * ("Failed query: insert into session_events") and the turn dies.
- *
- * `sanitizeEventPayload` deep-walks any payload value (objects, arrays, nested)
- * and, for every string, strips NUL and rewrites invalid/lone UTF-16 surrogates
- * to the Unicode replacement char (U+FFFD), so the result is always valid UTF-8
- * that jsonb can store. It is cheap and total: only strings are touched, and only
- * the two disallowed classes of code unit -- no meaningful text is lost, no
- * truncation (truncation is handled elsewhere).
- */
 /**
  * Strip NUL and repair invalid/lone UTF-16 surrogates in a single string.
  * Returns the input unchanged (same reference) when it is already clean, so the
@@ -478,7 +557,14 @@ declare function sanitizeEventString(value: string): string;
  * combinations are traversed; non-string leaves pass through untouched. Object
  * keys are sanitized too -- they are jsonb-constrained the same as values.
  */
-declare function sanitizeEventPayload<T>(payload: T): T;
+type SanitizeEventPayloadOptions = {
+    /**
+     * Separately trusted, server-created retained-output evidence. Never populate
+     * this from a producer-controlled payload field.
+     */
+    fullEvidence?: unknown;
+};
+declare function sanitizeEventPayload<T>(payload: T, options?: SanitizeEventPayloadOptions): T;
 /**
  * Make model-facing conversation data safe for Postgres without redacting it.
  *
@@ -490,6 +576,76 @@ declare function sanitizeEventPayload<T>(payload: T): T;
  */
 declare function sanitizeModelPayload<T>(payload: T): T;
 
+type DatabaseFailureCode = "db_deadlock" | "db_serialization_failure" | "db_failure";
+type PersistenceRetryOutcome = "not_retryable" | "exhausted";
+type SafeDatabaseErrorFacts = {
+    severity?: string;
+    schema?: string;
+    table?: string;
+    column?: string;
+    dataType?: string;
+    constraint?: string;
+    routine?: string;
+};
+type PersistenceFailureDetails = {
+    code: DatabaseFailureCode;
+    sqlState: string | null;
+    stage: string;
+    eventTypes: string[];
+    correlationId: string;
+    attempts: number;
+    retryOutcome: PersistenceRetryOutcome;
+    database: SafeDatabaseErrorFacts;
+};
+/** Find the driver SQLSTATE even when Drizzle wrapped it under nested causes. */
+declare function nestedPostgresSqlState(error: unknown): string | null;
+declare function databaseFailureCode(sqlState: string | null): DatabaseFailureCode;
+declare function isRetryablePersistenceSqlState(sqlState: string | null): boolean;
+/**
+ * Distinguish database/ORM failures from expected domain exceptions when a
+ * driver omitted SQLSTATE. This checks shape only and never retains query text,
+ * bound parameters, or a raw driver cause.
+ */
+declare function isDatabasePersistenceFailure(error: unknown): boolean;
+/** Extract only PostgreSQL diagnostic identifiers; never query text/parameters. */
+declare function safeDatabaseErrorFacts(error: unknown): SafeDatabaseErrorFacts;
+/** Public-safe cause that preserves database classification without driver data. */
+declare class SanitizedDatabasePersistenceCause extends Error {
+    readonly sqlState: string | null;
+    readonly database: SafeDatabaseErrorFacts;
+    readonly name = "SanitizedDatabasePersistenceCause";
+    constructor(sqlState: string | null, database: SafeDatabaseErrorFacts);
+}
+/**
+ * Public-safe replacement for a raw Drizzle/postgres-js failure. Its `cause`
+ * is a newly constructed sanitized projection; the original driver cause can
+ * contain full SQL and bound parameters and is never retained.
+ */
+declare class SessionEventPersistenceError extends Error {
+    readonly details: PersistenceFailureDetails;
+    readonly name = "SessionEventPersistenceError";
+    readonly cause: SanitizedDatabasePersistenceCause;
+    constructor(details: PersistenceFailureDetails);
+    get code(): DatabaseFailureCode;
+}
+declare function isSessionEventPersistenceError(error: unknown): error is SessionEventPersistenceError;
+type IdempotentPersistenceTransactionOptions = {
+    stage: string;
+    eventTypes?: string[];
+    maxAttempts?: number;
+    correlationId?: string;
+    onRetry?: (input: {
+        attempt: number;
+        sqlState: "40P01" | "40001";
+    }) => void | Promise<void>;
+};
+/**
+ * Retry only the supplied idempotent database transaction/savepoint. Provider
+ * inference, tools, NATS, and all other external effects must remain outside
+ * this function. A single correlation ID follows every persistence attempt.
+ */
+declare function runIdempotentPersistenceTransaction<T>(options: IdempotentPersistenceTransactionOptions, transaction: (attempt: number) => Promise<T>): Promise<T>;
+
 /** Reject writes whose sanitized text exceeds this many characters. */
 declare const MEMORY_TEXT_MAX_CHARS = 4000;
 /** Per-workspace cap on agent-visible memory records (active ∪ approved). */
@@ -536,6 +692,7 @@ declare function renderWorkspaceMemoryBlock(records: readonly MemoryBlockRecord[
 
 type ProvisionResult = {
     appRole: string | null;
+    hostExportRole: string | null;
     temporalRole: string | null;
     temporalDatabases: string[];
     schema: string;
@@ -559,6 +716,16 @@ type ProvisionRolesOptions = {
     rlsStrategy?: RlsStrategy;
     appRole?: string;
     appPassword?: string;
+    /**
+     * Optional cross-workspace projection role. It receives schema USAGE and
+     * EXECUTE only on the host-export API; it receives no table privileges.
+     * Provision it after the first migration run so the schema exists. The
+     * provisioner also registers same-owner default privileges for future
+     * host-export functions; shipped migrations preserve existing exporter ACLs
+     * when a migration-only upgrade adds a function.
+     */
+    hostExportRole?: string;
+    hostExportPassword?: string;
     temporalRole?: string;
     temporalPassword?: string;
     temporalDatabases?: string[];
@@ -580,6 +747,22 @@ type ProvisionRolesOptions = {
  */
 declare function provisionRoles(adminConnection: string, options?: ProvisionRolesOptions): Promise<ProvisionResult>;
 
+type CodexTokenDeadlineClock = {
+    setTimeout: (callback: () => void, delayMs: number) => ReturnType<typeof globalThis.setTimeout>;
+    clearTimeout: (handle: ReturnType<typeof globalThis.setTimeout>) => void;
+};
+type CodexTokenDeadlineOptions = {
+    timeoutMs?: number | undefined;
+    signal?: AbortSignal | undefined;
+    clock?: CodexTokenDeadlineClock | undefined;
+};
+/**
+ * Bound a refresh promise without abandoning its rejection handler when the
+ * deadline or cancellation wins. The provider promise is observed exactly
+ * once, while the observer itself always fulfills, so a late provider failure
+ * cannot become an unhandled rejection or replace the authoritative outcome.
+ */
+declare function withCodexTokenDeadline<T>(operation: Promise<T>, options?: CodexTokenDeadlineOptions): Promise<T>;
 type CodexAuthDeps = {
     loadCredential: typeof loadCodexCredentialForRun;
     recordRefresh: typeof recordCodexTokenRefresh;
@@ -607,7 +790,23 @@ declare function buildCodexTokenResolver(db: Database, settings: Settings, works
  * A refresh that stamps needs_relogin returns { status:"error", reason } and never
  * hits the provider; a transient refresh error returns a plain error payload.
  */
-declare function fetchCodexUsageForAccount(db: Database, settings: Settings, workspaceId: string, credentialId: string): Promise<CodexUsagePayload>;
+declare function fetchCodexUsageForAccount(db: Database, settings: Settings, workspaceId: string, credentialId: string, fetchImpl?: CodexFetch): Promise<CodexUsagePayload>;
+type CodexRateLimitResetCreditsAccountResult = {
+    ok: true;
+    status: number;
+    details: CodexRateLimitResetCreditsDetails;
+} | {
+    ok: false;
+    status: number;
+    reason: ResetCreditFetchFailureReason | "needs_relogin";
+};
+/**
+ * Fresh detailed reset-credit inventory for one exact workspace credential.
+ * The token is refreshed through the same resolver as usage and never escapes
+ * this server-side function. Detailed rows are returned to the route only and
+ * are never persisted as redemption authority.
+ */
+declare function fetchCodexRateLimitResetCreditsForAccount(db: Database, settings: Settings, workspaceId: string, credentialId: string, fetchImpl?: CodexFetch): Promise<CodexRateLimitResetCreditsAccountResult>;
 
 type ResolveConnectionCredentialResult = {
     status: "ok";
@@ -616,21 +815,52 @@ type ResolveConnectionCredentialResult = {
     expiresAt?: Date | null;
 } | {
     status: "auth_needed";
-    reason: "missing_connection" | "expired" | "insufficient_scope" | "refresh_failed";
+    reason: McpCredentialAuthNeededReason;
     providerDomain: string;
+    provider?: string;
     connectionId?: string;
     scopes?: string[];
     resource?: string;
+    selectedResources?: McpConnectionResourceScope[];
     authorizationUrl?: string;
 };
 type ResolveConnectionCredentialInput = {
     workspaceId: string;
     subjectId?: string;
     serverId: string;
+    toolName?: string;
+    /** @deprecated Use toolName. Retained for the API's pre-existing broker call shape. */
     toolId?: string;
     connectionRef: McpServerConnectionRef;
+    /** Exact MCP destination whose request would receive the resolved headers. */
+    destinationUrl: string;
     forceRefresh?: boolean;
 };
+type HostMcpCredentialResolverContext = {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    rootSessionId: string;
+    turnId: string;
+    attemptId: string | null;
+    executionGeneration: number;
+    initiator: TurnInitiator;
+    initiatorContext: TurnInitiatorContext;
+    surface: McpCredentialsRequest["surface"];
+};
+declare class HostMcpCredentialScopeError extends Error {
+    constructor(field: "accountId" | "workspaceId" | "sessionId");
+}
+declare class HostMcpCredentialBindingError extends Error {
+    constructor(field: "provider" | "providerDomain" | "connectionId" | "scopes" | "resource" | "selectedResources" | "destinationUrl");
+}
+/**
+ * Adapts the public embedding credential port to the runtime's connection
+ * resolver contract. Scope echoes are checked before credential headers can
+ * reach a request; the returned object is a fresh copy so a host cannot mutate
+ * headers after resolution.
+ */
+declare function buildHostConnectionTokenResolver(resolve: NonNullable<ConnectionCredentialsPort["mcpCredentials"]>, context: HostMcpCredentialResolverContext): (input: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult>;
 type ConnectionBrokerDeps = {
     loadCredential: typeof loadConnectionCredentialForBroker;
     recordRefresh: typeof recordConnectionTokenRefresh;
@@ -641,6 +871,10 @@ type ConnectionBrokerDeps = {
     keyBytes: typeof environmentsEncryptionKeyBytes;
     now: () => Date;
 };
+type RefreshTransportOptions = {
+    fetchImpl?: FetchLike;
+    dnsLookup?: DnsLookup;
+};
 declare function buildConnectionTokenResolver(db: Database, settings: Settings, deps?: ConnectionBrokerDeps): (input: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult>;
 declare class ConnectionRefreshHttpError extends Error {
     readonly httpStatus: number;
@@ -653,12 +887,11 @@ declare class ConnectionRefreshHttpError extends Error {
  * the canonical `Bearer`. A non-bearer scheme is passed through unchanged.
  */
 declare function normalizeBearerScheme(tokenType: string | null | undefined): string;
-declare function refreshOAuthConnectionCredential(cred: ConnectionCredentialForBroker, ref: McpServerConnectionRef, settings?: Settings): Promise<{
+declare function refreshOAuthConnectionCredential(cred: ConnectionCredentialForBroker, ref: McpServerConnectionRef, settings: Settings, transportOptions?: RefreshTransportOptions): Promise<{
     credential: Record<string, unknown>;
     expiresAt: Date | null;
     grantedScopes?: string[];
 }>;
-declare function isPrivateAddress(address: string): boolean;
 
 type Database = PgDatabase<any, typeof schema>;
 type DbClient = {
@@ -710,7 +943,7 @@ type CreateDbOptions = {
      * it as a per-session startup parameter (the supported, query-param-free way;
      * URL `?search_path=` is IGNORED by postgres-js). Keep `public` LAST so the
      * `vector` type and `gen_random_uuid()` (which live in `public` on the
-     * pgvector image) still resolve — the SPIKE-1 live footgun.
+     * pgvector image) still resolve — the schema-isolation contract live footgun.
      */
     searchPath?: string;
     /** RLS posture; defaults to `"force"` (today's standalone). */
@@ -733,6 +966,115 @@ declare function registerDbBinding(db: Database, binding: {
     rlsStrategy?: RlsStrategy;
     userLookup?: UserLookup;
 }): void;
+type HostExportKind = "session_event" | "usage_event";
+/**
+ * A leased row did not satisfy this consumer build's export contract. Only
+ * bounded schema diagnostics are retained here; the source payload is never
+ * copied into the error. The lease can therefore be failed visibly, or an
+ * operator can re-claim it with a known token and explicitly dead-letter the
+ * reported head cursor.
+ */
+declare class HostExportPayloadError extends Error {
+    readonly kind: HostExportKind;
+    readonly consumerId: string;
+    readonly leaseToken: string;
+    readonly cursor: string;
+    readonly schemaIssues: string[];
+    readonly name = "HostExportPayloadError";
+    constructor(kind: HostExportKind, consumerId: string, leaseToken: string, cursor: string, schemaIssues: string[]);
+}
+type HostExportConsumerStatus = {
+    exportKind: HostExportKind;
+    consumerId: string;
+    checkpoint: string;
+    enabled: boolean;
+    consecutiveFailures: number;
+    nextAttemptAt: string;
+    lastError: string | null;
+    lastErrorAt: string | null;
+    blockedAt: string | null;
+    leaseExpiresAt: string | null;
+    maxCursor: string;
+    pendingCount: string;
+    unassignedCount: string;
+    prunedThrough: string;
+};
+/**
+ * Enable a named consumer. This call deliberately requires a database handle
+ * authenticated as the separately provisioned host-export role; the ordinary
+ * tenant-scoped app role cannot execute this cross-workspace API.
+ */
+declare function registerHostExportConsumer(db: Database, input: {
+    kind: HostExportKind;
+    consumerId: string;
+}): Promise<void>;
+declare function disableHostExportConsumer(db: Database, input: {
+    kind: HostExportKind;
+    consumerId: string;
+}): Promise<void>;
+/**
+ * Permanently remove a quiesced consumer and release its retention floor.
+ * Unlike disable, re-registering this name later starts at the retained floor.
+ */
+declare function retireHostExportConsumer(db: Database, input: {
+    kind: HostExportKind;
+    consumerId: string;
+}): Promise<void>;
+declare function claimHostExportBatch(db: Database, input: {
+    kind: "session_event";
+    consumerId: string;
+    leaseToken: string;
+    leaseHolderId: string;
+    leaseSeconds?: number;
+    limit?: number;
+    maxBytes?: number;
+}): Promise<HostEventExportBatch | null>;
+declare function claimHostExportBatch(db: Database, input: {
+    kind: "usage_event";
+    consumerId: string;
+    leaseToken: string;
+    leaseHolderId: string;
+    leaseSeconds?: number;
+    limit?: number;
+    maxBytes?: number;
+}): Promise<HostUsageExportBatch | null>;
+declare function acknowledgeHostExportBatch(db: Database, input: {
+    kind: HostExportKind;
+    consumerId: string;
+    leaseToken: string;
+}): Promise<string>;
+declare function failHostExportBatch(db: Database, input: {
+    kind: HostExportKind;
+    consumerId: string;
+    leaseToken: string;
+    error: string;
+    maxFailures?: number;
+}): Promise<number>;
+declare function deadLetterHostExportHead(db: Database, input: {
+    kind: HostExportKind;
+    consumerId: string;
+    leaseToken: string;
+    cursor: string;
+    reason: string;
+}): Promise<string>;
+declare function resumeHostExportConsumer(db: Database, input: {
+    kind: HostExportKind;
+    consumerId: string;
+}): Promise<void>;
+declare function rewindHostExportConsumer(db: Database, input: {
+    kind: HostExportKind;
+    consumerId: string;
+    checkpoint: string;
+}): Promise<void>;
+declare function pruneHostExportOutbox(db: Database, input: {
+    kind: HostExportKind;
+    graceSeconds?: number;
+    limit?: number;
+}): Promise<number>;
+declare function getHostExportConsumerStatus(db: Database, input: {
+    kind: HostExportKind;
+    consumerId: string;
+}): Promise<HostExportConsumerStatus | null>;
 declare function setRlsContext(db: Database, context: RlsContext): Promise<void>;
 declare function withRlsContext<T>(db: Database, context: RlsContext, fn: (db: Database) => Promise<T>, transactionConfig?: PgTransactionConfig): Promise<T>;
 declare function rlsContextForWorkspace(db: Database, workspaceId: string): Promise<RlsContext>;
@@ -835,18 +1177,40 @@ type GitHubInstallation = {
     installationId: number;
     accountLogin: string | null;
     accountType: string | null;
+    repositoryScope: GitHubRepositoryScope;
+    linkedBySubjectId: string | null;
     createdAt: string;
     updatedAt: string;
 };
+type GitHubInstallationAccess = GitHubInstallation & {
+    repositoryIds: number[];
+};
 declare function upsertGitHubInstallation(db: Database, input: {
     accountId: string;
     workspaceId: string;
     installationId: number;
     accountLogin?: string | null;
     accountType?: string | null;
+    linkedBySubjectId?: string | null;
 }): Promise<GitHubInstallation>;
+declare function bindGitHubInstallationRepositories(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    installationId: number;
+    accountLogin?: string | null;
+    accountType?: string | null;
+    linkedBySubjectId: string;
+    repositoryIds: number[];
+}): Promise<GitHubInstallationAccess>;
 declare function listGitHubInstallationsForWorkspace(db: Database, workspaceId: string): Promise<GitHubInstallation[]>;
 declare function listGitHubInstallationIdsForWorkspace(db: Database, workspaceId: string): Promise<number[]>;
+declare function listGitHubInstallationAccessForWorkspace(db: Database, workspaceId: string): Promise<GitHubInstallationAccess[]>;
+declare function areGitHubRepositoriesAllowedForWorkspace(db: Database, workspaceId: string, installationId: number, repositoryIds: number[]): Promise<boolean>;
+declare function deleteGitHubInstallationBinding(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    installationId: number;
+}): Promise<boolean>;
 declare function recordUsageEvent(db: Database, input: {
     accountId: string;
     workspaceId: string;
@@ -856,6 +1220,12 @@ declare function recordUsageEvent(db: Database, input: {
     unit: string;
     sourceResourceType?: string | null;
     sourceResourceId?: string | null;
+    sessionId?: string | null;
+    turnId?: string | null;
+    turnAttemptId?: string | null;
+    initiator?: TurnInitiator | null;
+    initiatorContext?: TurnInitiatorContext;
+    origin?: SessionTurnSource | null;
     idempotencyKey: string;
     occurredAt?: Date;
 }): Promise<UsageEvent>;
@@ -921,6 +1291,11 @@ declare function countScheduledTasksForWorkspace(db: Database, workspaceId: stri
 type AppendEventInput = {
     type: SessionEventType;
     payload?: unknown;
+    /**
+     * Server-created retained-output evidence for canonical audit truncation.
+     * Producer payload fields are never trusted as evidence.
+     */
+    retainedOutputEvidence?: unknown;
     clientEventId?: string;
     turnId?: string | null;
     turnGeneration?: number | null;
@@ -1214,7 +1589,8 @@ type CreateSessionMcpServerInput = {
     allowedTools?: string[] | null;
     timeoutMs?: number | null;
     cacheToolsList?: boolean | null;
-    requireApproval?: boolean | string[] | null;
+    requireApproval?: SessionMcpApprovalPolicy | null;
+    connectionRef?: McpServerConnectionRef$1 | null;
     headersEncrypted?: Record<string, string>;
 };
 type UpdateSessionMcpServerCredentialsInput = {
@@ -1225,11 +1601,15 @@ type UpdateSessionMcpServerCredentialsResult = {
     servers: SessionMcpServerMetadata[];
     missingIds: string[];
 };
+type UpdateSessionMcpApprovalPolicyResult = {
+    server: SessionMcpServerMetadata | null;
+    changed: boolean;
+};
 type SessionMcpServerForRun = SessionMcpServerMetadata & {
     allowedTools?: string[];
     timeoutMs?: number;
     cacheToolsList?: boolean;
-    requireApproval?: boolean | string[];
+    requireApproval: SessionMcpApprovalPolicy;
     headers: Record<string, string>;
 };
 type EnqueueSessionTurnInput = {
@@ -1240,17 +1620,28 @@ type EnqueueSessionTurnInput = {
     temporalWorkflowId: string;
     source: SessionTurnSource;
     prompt: string;
+    turnInstructions?: string | null;
     resources: ResourceRef[];
     tools: ToolRef[];
+    toolsProvided?: boolean;
     model: string;
     reasoningEffort: ReasoningEffort;
     sandboxBackend: SandboxBackend;
     sandboxOs?: SandboxOs | null;
     metadata: Record<string, unknown>;
     lineage?: Record<string, unknown>;
+    initiator: TurnInitiator;
+    initiatorContext?: TurnInitiatorContext;
     /** Steer inserts before all waiting prompts; Send appends after them. */
     placement?: "head" | "tail";
 };
+/**
+ * Worker-only turn projection. Host instructions are durable execution input,
+ * never part of the public SessionTurn/queue/HTTP contract.
+ */
+type SessionTurnForExecution = SessionTurn & {
+    turnInstructions: string | null;
+};
 declare function createFileUpload(db: Database, input: {
     accountId: string;
     workspaceId: string;
@@ -1270,6 +1661,17 @@ declare function createFileUpload(db: Database, input: {
 }>;
 declare function getFile(db: Database, workspaceId: string, fileId: string): Promise<FileAsset | null>;
 declare function requireFile(db: Database, workspaceId: string, fileId: string): Promise<FileAsset>;
+type RetainedFileArtifact = {
+    file: FileAsset;
+    uploadStatus: FileUploadStatus | null;
+    uploadExpiresAt: Date | null;
+};
+/**
+ * RLS-scoped file lookup with just enough upload lifecycle truth to distinguish
+ * pending, failed, and expired artifact references. The bytes and provider
+ * location remain in the existing FileAsset/object-storage seam.
+ */
+declare function getRetainedFileArtifact(db: Database, workspaceId: string, fileId: string): Promise<RetainedFileArtifact | null>;
 declare function getFileUpload(db: Database, workspaceId: string, uploadId: string): Promise<{
     id: string;
     status: FileUploadStatus;
@@ -1595,6 +1997,28 @@ declare function createRigVersionForChangePromotion(db: Database, workspaceId: s
     change: RigChange;
 }>;
 declare function listRigVersions(db: Database, workspaceId: string, rigId: string): Promise<RigVersion[]>;
+type RigVersionMonitoringSummary = {
+    id: string;
+    rigId: string;
+    version: number;
+    active: boolean;
+    image: string | null;
+    imageOriginalChars: number | null;
+    setupScriptBytes: number;
+    checkCount: number;
+    credentialHookCount: number;
+    defaultVariableSetCount: number;
+    changelog: string | null;
+    changelogOriginalChars: number | null;
+    createdBy: string | null;
+    createdAt: string;
+};
+/** Compact-by-query historical rig versions for the model-facing MCP surface. */
+declare function listRigVersionMonitoringSummaries(db: Database, workspaceId: string, rigId: string, limit?: number): Promise<{
+    versions: RigVersionMonitoringSummary[];
+    hasMore: boolean;
+    total: number;
+}>;
 declare function getRigVersion(db: Database, workspaceId: string, rigId: string, versionId: string): Promise<RigVersion | null>;
 declare function getRigVersionById(db: Database, workspaceId: string, versionId: string): Promise<RigVersion | null>;
 declare function getRigName(db: Database, workspaceId: string, rigId: string): Promise<string | null>;
@@ -1609,6 +2033,31 @@ declare function createRigChange(db: Database, input: {
     proposedBy?: string | null;
 }): Promise<RigChange>;
 declare function listRigChanges(db: Database, workspaceId: string, rigId: string, limit?: number): Promise<RigChange[]>;
+type RigChangeMonitoringSummary = {
+    id: string;
+    rigId: string;
+    baseVersionId: string | null;
+    kind: RigChangeKind;
+    status: RigChangeStatus;
+    proposedBy: string | null;
+    resultVersionId: string | null;
+    commandPreview: string | null;
+    commandOriginalChars: number | null;
+    payloadBytes: number;
+    verificationBytes: number;
+    verificationLogBytes: number;
+    verificationStartedAt: string | null;
+    verificationFinishedAt: string | null;
+    verificationPassed: boolean | null;
+    createdAt: string;
+    updatedAt: string;
+};
+/** Compact-by-query recent rig changes for the model-facing MCP surface. */
+declare function listRigChangeMonitoringSummaries(db: Database, workspaceId: string, rigId: string, limit?: number): Promise<{
+    changes: RigChangeMonitoringSummary[];
+    hasMore: boolean;
+    total: number;
+}>;
 declare function getRigChange(db: Database, workspaceId: string, changeId: string): Promise<RigChange | null>;
 declare function updateRigChangeStatus(db: Database, workspaceId: string, changeId: string, input: {
     status: RigChangeStatus;
@@ -1709,6 +2158,15 @@ type CodexCredentialForRun = {
  * accessor — auto-activates a brand-new first account and ensures the
  * rotation-settings row exists.
  */
+type UpsertCodexSubscriptionCredentialResult = {
+    kind: "upserted";
+    id: string;
+    isNew: boolean;
+} | {
+    kind: "unresolved_redemption";
+    id: string;
+    isNew: false;
+};
 declare function upsertCodexSubscriptionCredential(db: Database, input: {
     accountId: string;
     workspaceId: string;
@@ -1721,10 +2179,9 @@ declare function upsertCodexSubscriptionCredential(db: Database, input: {
     lastRefreshAt: Date | null;
     accountEmail?: string | null;
     label?: string | null;
-}): Promise<{
-    id: string;
-    isNew: boolean;
-}>;
+    /** Direct managed-cookie human who most recently connected this row. */
+    connectedBySubjectId?: string | null;
+}): Promise<UpsertCodexSubscriptionCredentialResult>;
 /**
  * The ONLY decrypt-read accessor. Fails closed. Never call from an API route that
  * returns the result.
@@ -1853,6 +2310,12 @@ type CodexAccountStatus = {
     status: string;
     /** New automatic allocations only; health/refresh and existing turns remain independent. */
     allocatorEnabled: boolean;
+    allocatorVersion: number;
+    allocatorUpdatedBySubjectId: string | null;
+    allocatorUpdatedAt: Date | null;
+    resetCreditAvailableCount: number | null;
+    resetCreditsCheckedAt: Date | null;
+    connectedBySubjectId: string | null;
     isActive: boolean;
     expiresAt: Date | null;
     lastRefreshAt: Date | null;
@@ -1872,7 +2335,7 @@ type CodexAccountStatus = {
  * the selection cursor gives deterministic fairness after those holders drain.
  * None of these fields contains credential material.
  */
-type CodexLeaseAccountStatus = CodexAccountStatus & {
+type CodexLeaseAccountStatus = Omit<CodexAccountStatus, "allocatorVersion" | "allocatorUpdatedBySubjectId" | "allocatorUpdatedAt" | "resetCreditAvailableCount" | "resetCreditsCheckedAt" | "connectedBySubjectId"> & {
     activeLeaseCount: number;
     selectionCount: number;
     lastSelectedAt: Date | null;
@@ -1880,8 +2343,8 @@ type CodexLeaseAccountStatus = CodexAccountStatus & {
 /**
  * Opaque accepted-turn policy scope resolved while the durable turn is locked.
  *
- * OPE-21 deliberately does not know the shape of named pools. A downstream
- * allocator policy (OPE-32) owns its private scope type and supplies a pure
+ * This API deliberately does not know the shape of named pools. A downstream
+ * allocator policy owns its private scope type and supplies a pure
  * metadata resolver. The resolved value is handed to the selector in the same
  * workspace rotation-row transaction as lease acquisition, so future pool
  * membership filtering cannot race the accepted turn's frozen policy.
@@ -1966,7 +2429,7 @@ declare function acquireCodexCredentialLease<T, TPolicyScope = never, TUnavailab
     /**
      * Optional downstream parser for private accepted-turn policy metadata.
      * It is pure, runs under the turn/rotation transaction, and must not query
-     * pool membership itself. OPE-21 stores or interprets no pool identifiers.
+     * pool membership itself. This module stores or interprets no pool identifiers.
      */
     resolvePolicyScope?: CodexCredentialLeasePolicyScopeResolver<TPolicyScope>;
     /**
@@ -2070,11 +2533,13 @@ declare const CODEX_CAPACITY_REFRESH_MAX_MS: number;
 declare function codexCapacityRefreshBackoffMs(attempt: number): number;
 /**
  * Atomically settle one all-unavailable turn and arm exactly one durable wait.
- * Lock order is allocator rotation row -> session -> goal -> blocked turn ->
- * live lease (when a reactive failure owns one) -> waiter. The failed turn,
- * idle/capacity-paused session, durable events, lease release, and waiter
- * generation commit together; a crash cannot leave only half of the boundary
- * visible.
+ * Lock order is allocator rotation row -> workspace control -> actual workspace
+ * -> session -> exact turn -> exact attempt -> goal -> live lease (when a
+ * reactive failure owns one) -> waiter. The control share lock and effective
+ * control recheck prevent a capacity boundary from closing an attempt after a
+ * committed Pause. The failed turn, idle/capacity-paused session, durable
+ * events, lease release, and waiter generation commit together; a crash cannot
+ * leave only half of the boundary visible.
  */
 declare function armCodexCapacityWait(db: Database, input: {
     accountId: string;
@@ -2100,8 +2565,8 @@ declare function armCodexCapacityWait(db: Database, input: {
 }): Promise<ArmCodexCapacityWaitResult>;
 declare function getCodexCapacityWaitForSession(db: Database, workspaceId: string, sessionId: string): Promise<CodexCapacityWait | null>;
 /**
- * Same-transaction capacity-mutation/outbox seam for OPE-24 eligibility and
- * OPE-32 membership/default changes. The allocator rotation row is always the
+ * Same-transaction capacity-mutation/outbox seam for account eligibility and
+ * policy-scope membership/default changes. The allocator rotation row is always the
  * first lock. Mutations report whether capacity truth changed; only then are
  * matching waiter wake revisions advanced and returned for best-effort signal.
  */
@@ -2172,13 +2637,198 @@ declare function quarantineCodexCredentialForLease(db: Database, input: {
  * the workspace active pointer. Ordered by created_at ASC (stable list order).
  */
 declare function listCodexAccountStatuses(db: Database, workspaceId: string): Promise<CodexAccountStatus[]>;
+type CodexAllocatorUpdateResult = {
+    kind: "updated" | "unchanged";
+    allocatorEnabled: boolean;
+    allocatorVersion: number;
+    allocatorUpdatedBySubjectId: string | null;
+    allocatorUpdatedAt: Date | null;
+} | {
+    kind: "conflict";
+    allocatorEnabled: boolean;
+    allocatorVersion: number;
+    allocatorUpdatedBySubjectId: string | null;
+    allocatorUpdatedAt: Date | null;
+} | {
+    kind: "not_found";
+};
+/**
+ * Toggle only NEW allocator eligibility under credential-row OCC.
+ *
+ * Same-state writes are idempotent even when `expectedVersion` is stale. A real
+ * state transition requires the exact current version, increments only the
+ * allocator version, and writes one audit row in the same transaction. It never
+ * touches credential `version`, health, encrypted material, cooldown, or quota.
+ */
+declare function updateCodexAllocatorEligibility(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    credentialId: string;
+    subjectId: string;
+    enabled: boolean;
+    expectedVersion: number;
+}): Promise<CodexCapacityMutationResult<CodexAllocatorUpdateResult>>;
+declare const CODEX_RESET_REDEMPTION_OUTCOMES: readonly ["reset", "nothingToReset", "noCredit", "alreadyRedeemed"];
+type CodexResetRedemptionOutcome = (typeof CODEX_RESET_REDEMPTION_OUTCOMES)[number];
+type CodexResetRedemptionStatus = "processing" | "provider_started" | "completed";
+type CodexResetRedemptionAttempt = {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    credentialId: string;
+    subjectId: string;
+    browserSessionHash: string;
+    creditId: string;
+    upstreamIdempotencyKey: string;
+    status: CodexResetRedemptionStatus;
+    outcome: CodexResetRedemptionOutcome | null;
+    claimHolderId: string | null;
+    claimExpiresAt: Date | null;
+    confirmationExpiresAt: Date;
+    providerStartedAt: Date | null;
+    completedAt: Date | null;
+    lastFailureKind: string | null;
+    retryCount: number;
+    createdAt: Date;
+    updatedAt: Date;
+};
+/** Metadata-only attempt read used to resume a browser-session-bound ambiguity. */
+declare function getCodexResetRedemptionAttempt(db: Database, workspaceId: string, attemptId: string): Promise<CodexResetRedemptionAttempt | null>;
+type CodexResetRedemptionRecovery = {
+    attemptId: string;
+    credentialId: string;
+    creditId: string;
+    status: "provider_started" | "completed";
+    outcome: CodexResetRedemptionOutcome | null;
+    providerStartedAt: Date | null;
+    completedAt: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+};
+/**
+ * Cookie-owner discovery source for durable ambiguous/completed attempts.
+ * Browser storage is never required to recover these non-secret identifiers.
+ */
+declare function listCodexResetRedemptionRecoveries(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+}): Promise<CodexResetRedemptionRecovery[]>;
+type AdoptCodexResetRedemptionResult = {
+    kind: "current" | "adopted";
+    attempt: CodexResetRedemptionAttempt;
+} | {
+    kind: "in_progress";
+} | {
+    kind: "not_found";
+} | {
+    kind: "forbidden";
+} | {
+    kind: "conflict";
+};
+/** Adopt a released durable ambiguity/completion into the owner's current browser session. */
+declare function adoptCodexResetRedemptionAttempt(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    attemptId: string;
+    credentialId: string;
+    creditId: string;
+    subjectId: string;
+    browserSessionHash: string;
+}): Promise<AdoptCodexResetRedemptionResult>;
+type ClaimCodexResetRedemptionResult = {
+    kind: "claimed";
+    attempt: CodexResetRedemptionAttempt;
+} | {
+    kind: "in_progress";
+    attempt: CodexResetRedemptionAttempt;
+} | {
+    kind: "completed";
+    attempt: CodexResetRedemptionAttempt;
+} | {
+    kind: "not_found";
+} | {
+    kind: "forbidden";
+} | {
+    kind: "conflict";
+};
+/**
+ * Claim or reclaim one logical redemption across API replicas/crashes.
+ *
+ * A transaction advisory lock closes the initial INSERT race. A live claim
+ * yields `in_progress`; an expired/released claim is reclaimed without changing
+ * the status or upstream key. Existing attempt identity is immutable.
+ */
+declare function claimCodexResetRedemption(db: Database, input: {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    credentialId: string;
+    subjectId: string;
+    browserSessionHash: string;
+    creditId: string;
+    confirmationExpiresAt: Date;
+    claimHolderId: string;
+    claimTtlMs?: number;
+}): Promise<ClaimCodexResetRedemptionResult>;
+type CodexResetRedemptionSendNotReadyReason = "not_found" | "identity_mismatch" | "claim_expired" | "confirmation_expired" | "credential_unavailable" | "already_completed";
+type FenceCodexResetRedemptionSendResult = {
+    kind: "ready";
+    attempt: CodexResetRedemptionAttempt;
+} | {
+    kind: "not_ready";
+    reason: CodexResetRedemptionSendNotReadyReason;
+};
+/**
+ * Final DB-time irreversible-send fence, called only after preflight and token
+ * resolution and immediately before every provider POST (including ambiguity
+ * retries). The credential SHARE lock serializes against disconnect and
+ * ownership-changing reconnect. The claim is extended beyond the bounded
+ * consume operation in the same transaction that persists provider_started.
+ */
+declare function fenceCodexResetRedemptionSend(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    attemptId: string;
+    claimHolderId: string;
+    credentialId: string;
+    subjectId: string;
+    browserSessionHash: string;
+    sendLeaseMs?: number;
+}): Promise<FenceCodexResetRedemptionSendResult>;
+/** Delete only definite pre-provider work still owned by this request. */
+declare function abandonCodexResetRedemptionBeforeProvider(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    attemptId: string;
+    claimHolderId: string;
+}): Promise<boolean>;
+/** Release a failed claim while preserving processing/provider_started truth. */
+declare function releaseCodexResetRedemptionClaim(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    attemptId: string;
+    claimHolderId: string;
+    failureKind: string;
+}): Promise<boolean>;
+/** Persist the exact provider outcome, cooldown repair, and audit atomically. */
+declare function completeCodexResetRedemption(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    attemptId: string;
+    claimHolderId: string;
+    outcome: CodexResetRedemptionOutcome;
+}): Promise<CodexCapacityMutationResult<CodexResetRedemptionAttempt | null>>;
 /** The P2 usage-cache snapshot written by the refreshing usage wrapper. */
 type CodexAccountUsageSnapshot = {
-    primaryUsedPercent: number | null;
-    primaryResetAt: Date | null;
-    secondaryUsedPercent: number | null;
-    secondaryResetAt: Date | null;
-    checkedAt: Date;
+    primaryUsedPercent?: number | null;
+    primaryResetAt?: Date | null;
+    secondaryUsedPercent?: number | null;
+    secondaryResetAt?: Date | null;
+    /** Present only when the quota body parsed successfully. */
+    checkedAt?: Date;
+    resetCreditAvailableCount?: number | null;
+    resetCreditsCheckedAt?: Date | null;
 };
 /**
  * Cache-write for P2 quota bars: persist the five plaintext usage columns on a
@@ -2324,9 +2974,13 @@ declare function recordSessionActiveCodexCredential(db: Database, workspaceId: s
 declare function disconnectCodexAccount(db: Database, workspaceId: string, credentialId: string): Promise<{
     removed: boolean;
     newActiveCredentialId: string | null;
+    blockedByUnresolvedRedemption: boolean;
+}>;
+/** Legacy "disconnect all"; atomically rejects when any provider work is unresolved. */
+declare function disconnectAllCodexAccounts(db: Database, workspaceId: string): Promise<{
+    removed: number;
+    blockedCredentialIds: string[];
 }>;
-/** Legacy "disconnect all" (old workspace-wide behavior). Returns rows removed. */
-declare function disconnectAllCodexAccounts(db: Database, workspaceId: string): Promise<number>;
 declare function recordAuditEvent(db: Database, input: {
     accountId: string;
     workspaceId?: string | null;
@@ -2343,19 +2997,55 @@ declare function createSessionMcpServers(db: Database, input: {
     servers: CreateSessionMcpServerInput[];
 }): Promise<SessionMcpServerMetadata[]>;
 declare function listSessionMcpServerMetadata(db: Database, workspaceId: string, sessionId: string): Promise<SessionMcpServerMetadata[]>;
+/**
+ * Returns the complete stored server configuration needed to snapshot an
+ * immediate parent's MCP context onto a child session. Credential values stay
+ * encrypted throughout this path: the core can copy the ciphertext into the
+ * child's rows, but it never receives plaintext headers.
+ *
+ * This is intentionally distinct from `listSessionMcpServersForRun`, whose
+ * worker-only responsibility is decrypting credentials at the execution
+ * boundary.
+ */
+declare function listSessionMcpServersForChildInheritance(db: Database, workspaceId: string, sessionId: string): Promise<CreateSessionMcpServerInput[]>;
 declare function updateSessionMcpServerCredentials(db: Database, input: {
     workspaceId: string;
     sessionId: string;
     updates: UpdateSessionMcpServerCredentialsInput[];
 }): Promise<UpdateSessionMcpServerCredentialsResult>;
-declare function listSessionMcpServersForRun(db: Database, workspaceId: string, sessionId: string, encryptionKey: Uint8Array): Promise<SessionMcpServerForRun[]>;
+declare function updateSessionMcpApprovalPolicy(db: Database, input: {
+    workspaceId: string;
+    sessionId: string;
+    serverId: string;
+    requireApproval: SessionMcpApprovalPolicy;
+}): Promise<UpdateSessionMcpApprovalPolicyResult>;
+declare function listSessionMcpServersForRun(db: Database, workspaceId: string, sessionId: string, attemptId: string, encryptionKey: Uint8Array | null): Promise<SessionMcpServerForRun[]>;
+type AgentSessionCreationActor = Extract<SessionCommandActor, {
+    type: "agent_attempt";
+}>;
+/** A caller-preallocated session UUID is already owned by another session. */
+declare class SessionIdConflictError extends Error {
+    readonly sessionId: string;
+    constructor(sessionId: string);
+}
 declare function createSession(db: Database, input: {
+    requestedSessionId?: string;
     accountId: string;
     workspaceId: string;
     initialMessage: string;
+    initialTurnInstructions?: string | null;
     resources: ResourceRef[];
     tools?: ToolRef[];
+    toolPolicy?: SessionToolPolicy | null;
     metadata: Record<string, unknown>;
+    /**
+     * Frozen creator authority. Legacy/test-only callers may omit this and get
+     * an explicit unattributed service sentinel; production producers must pass
+     * an authenticated subject or named service.
+     */
+    createdBy?: TurnInitiator;
+    createdByContext?: TurnInitiatorContext;
+    createdByActor?: AgentSessionCreationActor | null;
     model: string;
     sandboxBackend: SandboxBackend;
     variableSetId?: string | null;
@@ -2380,12 +3070,18 @@ declare function createSession(db: Database, input: {
  * the row already existed and must be returned as-is).
  */
 declare function createSessionWithIdempotencyKey(db: Database, input: {
+    requestedSessionId?: string;
     accountId: string;
     workspaceId: string;
     initialMessage: string;
+    initialTurnInstructions?: string | null;
     resources: ResourceRef[];
     tools?: ToolRef[];
+    toolPolicy?: SessionToolPolicy | null;
     metadata: Record<string, unknown>;
+    createdBy?: TurnInitiator;
+    createdByContext?: TurnInitiatorContext;
+    createdByActor?: AgentSessionCreationActor | null;
     model: string;
     sandboxBackend: SandboxBackend;
     variableSetId?: string | null;
@@ -2441,6 +3137,7 @@ type ListSessionsForSubjectOptions = ListSessionsOptions & {
     subjectId: string;
     cursor?: SessionListCursor | undefined;
     search?: string | undefined;
+    authorizationScope?: SessionAuthorizationListScope | undefined;
 };
 declare class SessionPinVersionConflictError extends Error {
     readonly current: Pick<Session, "pinned" | "pinnedAt" | "pinVersion">;
@@ -2455,6 +3152,32 @@ declare class SessionListAccessError extends Error {
 declare class SessionPinAccessError extends Error {
     constructor(message?: string);
 }
+type SessionTreeStats = NonNullable<Session["treeStats"]>;
+/**
+ * Remove control metadata derived from sessions other than the exact target.
+ * Effective state and the opaque OCC etag remain usable without exposing
+ * ancestor ids/titles/actors/reasons or descendant settlement facts.
+ */
+declare function projectEffectiveControlForRelatedAccess(control: Session["effectiveControl"], sessionId: string, access: "target" | "root"): Session["effectiveControl"];
+/**
+ * Remove metadata derived from sessions other than the exact authorized
+ * target, including parent identity and descendant counts.
+ */
+declare function projectSessionForRelatedAccess(session: Session, access: "target" | "root"): Session;
+/**
+ * Return bounded descendant aggregates for the bounded set of rows being
+ * painted in the session rail. Each selected root receives an independent
+ * fixed node/depth budget. `truncated=true` makes every count an explicit lower
+ * bound when a deep, wide, overlapping, or cyclic graph reaches that budget.
+ */
+declare function sessionTreeStatsForSessions(db: Database, workspaceId: string, rootIds: string[]): Promise<Map<string, SessionTreeStats>>;
+/**
+ * Convert the embedding host's complete list scope into a workspace-bound SQL
+ * predicate. Root scopes include every descendant through the durable parent
+ * graph; exact ids never imply access to related sessions. `UNION` (rather than
+ * `UNION ALL`) makes legacy cycles terminate without a caller-sized path array.
+ */
+declare function sessionAuthorizationScopeFilter(scope: SessionAuthorizationListScope): SQL;
 /** Opaque, URL-safe cursor encoding for a server-owned activity snapshot. */
 declare function encodeSessionListCursor(cursor: SessionListCursor): string;
 /** Decode and validate a cursor before it reaches any SQL predicate. */
@@ -2471,7 +3194,7 @@ declare function reapExpiredSessionListSnapshots(db: Database, limit?: number):
  */
 declare function listSessionsForSubject(db: Database, workspaceId: string, options: ListSessionsForSubjectOptions): Promise<SessionListResponse>;
 /** Read a session with the caller subject's personal pin projection. */
-declare function getSessionForSubject(db: Database, workspaceId: string, sessionId: string, subjectId: string): Promise<Session | null>;
+declare function getSessionForSubject(db: Database, workspaceId: string, sessionId: string, subjectId: string, relatedSessionAccess?: "target" | "root"): Promise<Session | null>;
 /**
  * Idempotently set a member's pin without mutating the session's lifecycle or
  * activity timestamps. A transaction advisory lock serializes same-subject,
@@ -2486,11 +3209,83 @@ declare function setSessionPin(db: Database, input: {
 }): Promise<Session | null>;
 declare function listSessions(db: Database, workspaceId: string, limit?: number): Promise<Session[]>;
 declare function listSessions(db: Database, workspaceId: string, options?: ListSessionsOptions): Promise<Session[]>;
+type SessionDiscoveryOrderBy = "createdAt" | "updatedAt";
+type SessionDiscoveryCursor = {
+    orderBy: SessionDiscoveryOrderBy;
+    /** Decimal database activity revision; zero is the legacy/created-order bucket. */
+    sortRevision: string;
+    /** Exact PostgreSQL timestamp text (including microseconds), not a JS Date. */
+    sortAt: string;
+    id: string;
+    /** Created-order timestamp ceiling; retained as diagnostic context for updated order. */
+    snapshotAt: string;
+    /** First-page revision fence: later activity belongs to the next incremental scan. */
+    snapshotRevision: string;
+    /** Incremental revision scope is cursor-bound and cannot change on continuation. */
+    updatedAfter: string | null;
+};
+declare const SESSION_DISCOVERY_GOAL_MAX_CHARS = 600;
+declare const SESSION_DISCOVERY_MESSAGE_MAX_CHARS = 600;
+type SessionDiscoverySummary = {
+    id: string;
+    title: string | null;
+    titleOriginalChars: number | null;
+    parentSessionId: string | null;
+    status: SessionStatus;
+    effectiveControl: SessionDiscoveryControl;
+    goal: {
+        status: SessionGoalStatus;
+        text: string;
+        textOriginalChars: number;
+    } | null;
+    queuedPromptCount: number;
+    treeStats: NonNullable<Session["treeStats"]>;
+    latestMessage: {
+        type: SessionEventType;
+        preview: string | null;
+        previewOriginalChars: number | null;
+    } | null;
+    createdAt: string;
+    updatedAt: string;
+    /** Internal exact revision key; omitted from the MCP row projection. */
+    sortRevision: string;
+    /** Internal exact keyset timestamp; omitted from the MCP row projection. */
+    sortAt: string;
+};
+/**
+ * Compact-by-construction discovery projection for the first-party
+ * `sessions_list` MCP tool. It never selects instructions, resources, tools,
+ * MCP metadata, repositories, settings, or full event/history bodies.
+ */
+declare function listSessionDiscoverySummaries(db: Database, workspaceId: string, options: {
+    limit: number;
+    cursor?: SessionDiscoveryCursor;
+    includeLastMessage?: boolean;
+    orderBy?: SessionDiscoveryOrderBy;
+    updatedAfter?: string;
+    authorizationScope?: SessionAuthorizationListScope;
+}): Promise<{
+    sessions: SessionDiscoverySummary[];
+    hasMore: boolean;
+    nextCursor: SessionDiscoveryCursor | null;
+    total: number;
+    orderBy: SessionDiscoveryOrderBy;
+    snapshotAt: string;
+    snapshotRevision: string;
+    updatedThrough: string | null;
+    updatedAfter: string | null;
+}>;
 type SessionLineage = {
     ancestors: Session[];
     children: LineageNode[];
     truncated: boolean;
 };
+/**
+ * Resolve a session tree to its root without materializing the full lineage.
+ * Every recursive hop stays workspace-scoped and invalid/cyclic/deep chains
+ * fail closed instead of returning an ambiguous credential authority.
+ */
+declare function getSessionRootId(db: Database, workspaceId: string, sessionId: string): Promise<string | null>;
 /**
  * Read the full lineage slice around a session. Every recursive step carries
  * workspace_id as a hard predicate; a foreign parent/child id is invisible even
@@ -2511,16 +3306,80 @@ type ListSessionEventsOptions = {
     after?: number;
     before?: number;
     limit?: number;
+    direction?: SessionEventReadDirection;
+    includeTypes?: readonly SessionEventType[];
+    excludeTypes?: readonly SessionEventType[];
+    includeClasses?: readonly SessionEventSemanticClass[];
+    excludeClasses?: readonly SessionEventSemanticClass[];
+    defaultExcludeTypes?: readonly SessionEventType[];
+    payloadMode?: SessionEventPayloadMode;
+    /**
+     * Internal exclusive-latest selector. Eligible legacy rows with a null
+     * association remain visible, while late-rejected and duplicate callbacks do
+     * not compete with current truth. Durable session sequence is authoritative
+     * across distinct turns; turn generation is metadata only here. Callers must
+     * pair this with a single semantic class and limit 1.
+     */
+    authoritativeLatest?: boolean;
+};
+type ListSessionEventPageOptions = ListSessionEventsOptions & {
+    /** Exact UTF-8 JSON-array envelope budget for rows materialized by the app. */
+    maxBytes?: number;
+    /** Internal SQL fetch size. Batches never escape the surrounding RLS transaction. */
+    batchSize?: number;
 };
+type SessionEventPage = {
+    events: SessionEvent[];
+    hasMore: boolean;
+    bytes: number;
+    direction: SessionEventReadDirection;
+    coveredSequence: {
+        first: number;
+        last: number;
+    } | null;
+    nextAfter: number | null;
+    nextBefore: number | null;
+    truncatedBy: "count" | "bytes" | null;
+};
+declare const SESSION_EVENT_DB_PAGE_MAX_BYTES: number;
+/**
+ * Read one direction-aware session-event page without transferring legacy raw
+ * payloads or malformed free-form envelope strings out of PostgreSQL.
+ *
+ * Migration 0067 deliberately leaves historical rows untouched. This query
+ * invokes its immutable payload projector in SQL and mirrors the rolling
+ * envelope guard in SQL, then accumulates small batches under one RLS
+ * transaction. `bytes` is the exact UTF-8 size of `JSON.stringify(events)`;
+ * `hasMore` is true whenever count or byte selection stopped before the durable
+ * range ended. A nonempty durable range can therefore never become an empty,
+ * non-advancing HTTP page.
+ */
+declare function listSessionEventPage(db: Database, workspaceId: string, sessionId: string, options?: ListSessionEventPageOptions): Promise<SessionEventPage>;
 declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string): Promise<SessionEvent[]>;
 declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string, after: number, limit?: number): Promise<SessionEvent[]>;
 declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string, options: ListSessionEventsOptions): Promise<SessionEvent[]>;
 type ToolspaceCallReservation = {
     reserved: true;
     count: number;
+    turn: SessionTurnForExecution;
 } | {
     reserved: false;
+    reason: TurnAttemptFenceRejectReason | "budget_exhausted";
 };
+type ToolspaceTurnAttemptClaims = {
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+};
+/**
+ * Admit one exact Toolspace bearer before any session credential is decrypted or
+ * any upstream schema is enumerated. This intentionally reuses the canonical
+ * activity write fence so Pause/Steer, attempt replacement, generation changes,
+ * and terminal settlement revoke a copied token at the same linearization point
+ * as other attempt-owned writes.
+ */
+declare function admitToolspaceTurnAttempt(db: Database, workspaceId: string, claims: ToolspaceTurnAttemptClaims): Promise<boolean>;
 /**
  * Atomically reserve one toolspace call against a turn's per-turn budget.
  *
@@ -2528,10 +3387,20 @@ type ToolspaceCallReservation = {
  * below `limit` and returns the post-increment value. Concurrent reservations
  * for the same turn serialize on the row lock, so exactly `limit` of N
  * simultaneous callers observe `reserved: true` — closing the read-then-append
- * TOCTOU the event-count approach had. `reserved: false` means the turn is at or
- * over budget (or the turn row no longer exists).
+ * TOCTOU the event-count approach had. The returned attempt id is captured by
+ * that same UPDATE, so callers cannot accidentally execute under a successor
+ * attempt. `reserved: false` means the turn is not executable, at/over budget,
+ * or no longer exists.
  */
-declare function reserveToolspaceCallForTurn(db: Database, workspaceId: string, sessionId: string, turnId: string, limit: number): Promise<ToolspaceCallReservation>;
+declare function reserveToolspaceCallForAttempt(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    executionGeneration: number;
+    attemptId: string;
+    limit: number;
+}): Promise<ToolspaceCallReservation>;
 declare function getSessionEvent(db: Database, workspaceId: string, eventId: string): Promise<SessionEvent | null>;
 declare function listWorkspaceControlEvents(db: Database, workspaceId: string, after?: number, limit?: number): Promise<WorkspaceControlEvent[]>;
 declare function getWorkspaceControlEvent(db: Database, workspaceId: string, eventId: string): Promise<WorkspaceControlEvent | null>;
@@ -2548,7 +3417,82 @@ declare function getLatestRunState(db: Database, workspaceId: string, sessionId:
     pendingApprovals: unknown[];
     frozenCodexCredentialId: string | null;
 } | null>;
+declare class HumanInputResponseValidationError extends Error {
+    readonly code: "INVALID_RESPONSE" | "SKIP_NOT_ALLOWED";
+    readonly name = "HumanInputResponseValidationError";
+    constructor(code: "INVALID_RESPONSE" | "SKIP_NOT_ALLOWED", message: string);
+}
+declare function getSessionHumanInputRequest(db: Database, workspaceId: string, sessionId: string, requestId: string): Promise<SessionHumanInputRequest | null>;
+declare function listSessionHumanInputRequests(db: Database, workspaceId: string, sessionId: string, options?: {
+    status?: SessionHumanInputRequest["status"];
+    limit?: number;
+}): Promise<SessionHumanInputRequest[]>;
+declare function validateHumanInputResponse(request: Pick<SessionHumanInputRequest, "questions" | "allowSkip">, rawResponse: unknown): HumanInputResponse;
+type AcceptSessionHumanInputResponseResult = {
+    action: "accepted";
+    request: SessionHumanInputRequest;
+    event: SessionEvent;
+    events: SessionEvent[];
+    workflowWakeRevision: number;
+} | {
+    action: "conflict";
+    request: SessionHumanInputRequest;
+    events: SessionEvent[];
+    workflowWakeRevision: number | null;
+} | {
+    action: "not_found";
+};
+/**
+ * First-writer-wins settlement for one pending structured input boundary.
+ * Session + logical turn + current freeze generation are locked with the row;
+ * the creation attempt is provenance and is intentionally not the resume owner.
+ */
+declare function acceptSessionHumanInputResponse(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    requestId: string;
+    response: unknown;
+    respondedBy: string;
+    clientEventId?: string | null;
+    expireOnly?: boolean;
+}): Promise<AcceptSessionHumanInputResponseResult>;
+declare function expireSessionHumanInputRequest(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    requestId: string;
+}): Promise<AcceptSessionHumanInputResponseResult>;
+declare function getHumanInputResumeForEvent(db: Database, workspaceId: string, sessionId: string, event: Pick<SessionEvent, "type" | "payload">): Promise<{
+    requestId: string;
+    toolCallId: string;
+    response: HumanInputResponse;
+} | null>;
 type TurnAttemptFenceRejectReason = "workspace_paused" | "session_paused" | "pending_control" | "active_turn_changed" | "generation_changed" | "attempt_changed" | "turn_terminal" | "not_found";
+type InstallOrReadTurnExecutionPolicyForAttemptResult = {
+    accepted: true;
+    installed: boolean;
+    policy: TurnExecutionPolicyV1;
+    turn: SessionTurn;
+} | {
+    accepted: false;
+    reason: TurnAttemptFenceRejectReason;
+};
+/**
+ * Freeze a legacy turn's execution identity at its first admitted attempt, or
+ * return the policy already accepted for this logical turn. The exact active
+ * attempt owns this mutation; malformed present metadata fails closed and a
+ * replay never replaces an existing valid policy.
+ */
+declare function installOrReadTurnExecutionPolicyForAttempt(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    executionGeneration: number;
+    attemptId: string;
+    policyForAbsent: TurnExecutionPolicyV1;
+}): Promise<InstallOrReadTurnExecutionPolicyForAttemptResult>;
 /**
  * Append conversation items (verbatim SDK AgentInputItems) to the session's
  * history. Idempotent on (workspace, session, position): concurrent or
@@ -2563,6 +3507,7 @@ declare function appendSessionHistoryItems(db: Database, input: {
     expectedExecutionGeneration: number;
     expectedAttemptId: string;
     producerCodexCredentialId?: string | null;
+    modelToolOutputTruncationTokens?: number;
     items: Array<{
         position: number;
         item: Record<string, unknown>;
@@ -2590,20 +3535,31 @@ declare function registerPendingSessionToolCall(db: Database, input: PendingSess
     accepted: boolean;
     registered: boolean;
 }>;
+/**
+ * Clear one completed Toolspace receipt after its attempt-fenced output event is
+ * durable. If control already replaced the attempt, its settlement transaction
+ * owns the receipt and will retain an explicit outcome-unknown or the durable
+ * output event instead.
+ */
+declare function clearPendingSessionToolspaceCall(db: Database, input: Omit<PendingSessionToolCallInput, "callType" | "callItem">): Promise<{
+    accepted: boolean;
+    cleared: boolean;
+}>;
 /** Record the raw SDK result without dropping the call receipt. */
 declare function recordPendingSessionToolCallResult(db: Database, input: Omit<PendingSessionToolCallInput, "callType" | "callItem"> & {
     resultItem: Record<string, unknown>;
 }): Promise<{
     accepted: boolean;
     recorded: boolean;
-    allResultsRecorded: boolean;
 }>;
 /**
  * Remove completed receipts only after the full SDK call/result batch is
  * durable. Until then every raw result remains available to an attempt-ending
  * transaction, including reverse-completing parallel calls.
  */
-declare function clearDurablePendingSessionToolCalls(db: Database, input: Omit<PendingSessionToolCallInput, "callId" | "callType" | "callItem">): Promise<{
+declare function clearDurablePendingSessionToolCalls(db: Database, input: Omit<PendingSessionToolCallInput, "callId" | "callType" | "callItem"> & {
+    callIds: string[];
+}): Promise<{
     accepted: boolean;
     cleared: number;
 }>;
@@ -2705,7 +3661,7 @@ declare function recordSkippedContextCompaction(db: Database, input: {
     turnId: string;
     expectedExecutionGeneration: number;
     expectedAttemptId: string;
-    reason: "no_history" | "replacement_not_smaller";
+    reason: "no_history" | "replacement_not_smaller" | "replacement_unchanged" | "summarization_failed";
 }): Promise<{
     recorded: true;
     events: SessionEvent[];
@@ -3183,6 +4139,9 @@ declare function persistDrainSnapshot(db: Database, input: {
 declare function persistWarmSnapshot(db: Database, input: {
     accountId: string;
     workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
     sandboxGroupId: string;
     expectedEpoch: number;
     /** base64 of the provider snapshot-ref / tar archive from persistWorkspace(). */
@@ -3242,15 +4201,17 @@ type WorkspaceCaptureCommitResult = {
  * — can embed the same number). Writes ONLY when a warm lease with the expected
  * epoch still exists for the sandbox group (the same supersession guard
  * persistWarmSnapshot uses, expressed as an EXISTS on sandbox_leases). Returns
- * the assigned revision, or null when the fence rejected the write (superseded /
- * released lease). Captures for one session are serialized (one turn at a time),
- * so the explicit revision never races the unique (session_id, revision) index.
+ * the assigned revision, or null when the fence rejected the write (interrupted
+ * attempt, cancelled/superseded turn, or released/superseded lease). Captures for
+ * one session are serialized (one turn at a time), so the explicit revision never
+ * races the unique (session_id, revision) index.
  */
 declare function insertWorkspaceCapture(db: Database, input: {
     accountId: string;
     workspaceId: string;
     sessionId: string;
-    turnId: string | null;
+    turnId: string;
+    attemptId: string;
     sandboxGroupId: string;
     expectedEpoch: number;
     revision: number;
@@ -3274,7 +4235,8 @@ declare function insertFailedWorkspaceCapture(db: Database, input: {
     accountId: string;
     workspaceId: string;
     sessionId: string;
-    turnId: string | null;
+    turnId: string;
+    attemptId: string;
     sandboxGroupId: string;
     expectedEpoch: number;
     revision: number;
@@ -3836,6 +4798,8 @@ type InitializeSessionStartInput = {
     sessionId: string;
     clientEventId?: string;
     reasoningEffortFallback: ReasoningEffort;
+    /** Trusted create-session policy. Omitted only by legacy low-level callers. */
+    turnExecutionPolicy?: TurnExecutionPolicyV1;
     createdEventPayload: Record<string, unknown>;
     goal?: {
         text: string;
@@ -3877,7 +4841,7 @@ type ClaimSessionWorkForAttemptInput = {
 };
 type ClaimSessionWorkForAttemptResult = {
     action: "claimed";
-    turn: SessionTurn;
+    turn: SessionTurnForExecution;
 } | {
     action: "unclaimed";
     reason: "gate-closed" | "no-work" | "stale-approval" | "control-pending";
@@ -3896,6 +4860,33 @@ type SessionAttemptInterruptionSettlement = {
     turnId: string | null;
     outcome: SessionTurnAttemptOutcome | null;
 };
+/**
+ * Acknowledge that the exact cancelled attempt reached its final quiescence
+ * boundary: after this transaction it has no inference, user-visible output,
+ * or workspace-persistence authority. Fenced/idempotent cleanup and telemetry
+ * may still finish. This may race the workflow's logical settlement transaction
+ * in either order; both use the canonical control -> workspace -> session ->
+ * exact turn -> exact attempt lock order and require the durable interruption.
+ * Temporal activity cancellation/terminalization is transport state only. The
+ * workflow admits a replacement from this durable receipt, never from the
+ * activity promise.
+ */
+declare function markSessionAttemptQuiesced(db: Database, input: {
+    accountId?: string;
+    workspaceId: string;
+    sessionId: string;
+    attemptId: string;
+    temporalWorkflowId: string;
+    /** When supplied, both values bind an activity-owned recovery proof to the
+     * exact persisted Temporal dispatch. Legacy v1 replay callers omit them. */
+    temporalWorkflowRunId?: string;
+    temporalActivityId?: string;
+    /** The dying activity also reaches this boundary for non-control ownership
+     * fences. It may no-op when no Pause/Steer interruption exists; replacement
+     * admission remains strict because only a durable interruption needs this
+     * receipt. */
+    allowUninterrupted?: boolean;
+}): Promise<SessionEvent[]>;
 /**
  * Settle every durable interruption cause for one exact first-class attempt.
  * Steer wins the logical-turn fate when causes coexist; effective control after
@@ -3910,6 +4901,8 @@ type SessionWorkPeek = {
     triggerEventId: string;
 } | {
     kind: "approval-wait";
+    humanInputRequestId?: string;
+    expiresAt?: string;
 } | {
     kind: "capacity-wait";
     ref: {
@@ -3921,6 +4914,9 @@ type SessionWorkPeek = {
 } | {
     kind: "interruption-pending";
     attemptId: string;
+} | {
+    kind: "cancellation-wait";
+    attemptId: string;
 } | {
     kind: "idle";
 };
@@ -3972,7 +4968,38 @@ type ApplySessionTurnSettlementInput = {
     sessionStatus: SessionStatus;
     activeTurnId: string | null;
     events: AppendEventInput[];
+    /**
+     * A mid-turn SDK freeze installed atomically with requires_action. Human
+     * input requests are public protocol rows; ordinary approvals remain only in
+     * pendingApprovals. No request can become visible without the exact frozen
+     * RunState needed to resume it, and no frozen request can miss its status
+     * transition/events because all writes share this transaction.
+     */
+    runState?: {
+        serializedRunState: string;
+        pendingApprovals: unknown[];
+        frozenCodexCredentialId?: string | null;
+        humanInputRequests?: Array<{
+            id: string;
+            toolCallId: string;
+            questions: HumanInputQuestion[];
+            allowSkip: boolean;
+            expiresAt?: Date | null;
+        }>;
+    };
     recording?: SessionTurnRecordingSettlement;
+    /**
+     * Atomically consume an operator /compact request and record why it could
+     * not install a replacement. This lives on the terminal turn settlement so
+     * a worker crash can never clear the request without also publishing the
+     * attempt-owned failure truth.
+     */
+    compactionRequestFailure?: {
+        reason: "summarization_failed";
+        producerId?: string | null;
+        producerSeq?: number | null;
+        occurredAt?: Date;
+    };
 };
 type ApplySessionTurnSettlementResult = {
     action: "settled";
@@ -4109,7 +5136,13 @@ type RecoverSessionDispatchResult = {
  */
 declare function recoverSessionDispatch(db: Database, workspaceId: string, input: RecoverSessionDispatchInput): Promise<RecoverSessionDispatchResult>;
 declare function getSessionTurn(db: Database, workspaceId: string, turnId: string): Promise<SessionTurn | null>;
-declare function getSessionTurnForAttempt(db: Database, workspaceId: string, sessionId: string, attemptId: string): Promise<SessionTurn | null>;
+/**
+ * Resolve the exact currently executable turn/attempt from authoritative
+ * pointers in one query. This avoids treating a stale session preview as proof
+ * that no attempt exists during an atomic claim transition.
+ */
+declare function getActiveSessionTurnForExecution(db: Database, workspaceId: string, sessionId: string): Promise<SessionTurnForExecution | null>;
+declare function getSessionTurnForAttempt(db: Database, workspaceId: string, sessionId: string, attemptId: string): Promise<SessionTurnForExecution | null>;
 /**
  * Return the newest turn that reached agent execution for a session. A claimed
  * turn's `started_at` is set before worker admission, so it is not sufficient
@@ -4201,11 +5234,26 @@ declare function enqueueSessionWorkflowWakeIfRunnable(db: Database, input: {
 /** Claim only explicit, undelivered wake revisions; never infer work by scan. */
 declare function claimPendingSessionWorkflowWakes(db: Database, limit?: number): Promise<SessionWorkflowWake[]>;
 /**
- * Acknowledge an immediate post-commit signal. An older sender may advance only
- * its own revision; it cannot clear a claim or failure state belonging to a
- * newer revision.
+ * Acknowledge an immediate post-commit signal only after it cannot strand an
+ * accepted Agent Steer. Temporal accepting a signal is transport evidence, not
+ * proof that a closing workflow observed Postgres or admitted its pending
+ * direction. While active control still has an actionable Agent Steer, retain
+ * the revision so the bounded outbox dispatcher retries signalWithStart. The
+ * attempt-fenced claim consumes the update once; a real Pause is the typed
+ * blocker and may acknowledge this revision because Resume commits a new one.
+ *
+ * An older sender may advance only its own revision; it cannot clear a claim or
+ * failure state belonging to a newer revision. The control -> workspace ->
+ * session lock prefix serializes this decision with Steer, Pause/Resume, and
+ * claim without weakening physical-quiescence admission.
  */
-declare function markSessionWorkflowWakeDelivered(db: Database, input: Omit<SessionWorkflowWake, "interruptionRequested">): Promise<void>;
+type SessionWorkflowWakeDeliveryResult = {
+    action: "acknowledged";
+} | {
+    action: "pending_admission";
+    blocker: "pending_agent_steer";
+};
+declare function markSessionWorkflowWakeDelivered(db: Database, input: Omit<SessionWorkflowWake, "interruptionRequested">): Promise<SessionWorkflowWakeDeliveryResult>;
 /** Record delivery failure; the claim already scheduled the bounded retry. */
 declare function markSessionWorkflowWakeFailed(db: Database, input: SessionWorkflowWake, error: string): Promise<boolean>;
 declare function getOrCreateSessionSystemUpdateOutbox(db: Database, input: Omit<SessionSystemUpdateOutboxDelivery, "id" | "status">): Promise<SessionSystemUpdateOutboxDelivery>;
@@ -4295,6 +5343,7 @@ declare function appendSessionEventsAndUpdateSession(db: Database, workspaceId:
 }): Promise<SessionEvent[]>;
 type LockedSessionUpdateContext = {
     updateSessionMcpServerCredentials: (updates: UpdateSessionMcpServerCredentialsInput[]) => Promise<UpdateSessionMcpServerCredentialsResult>;
+    updateSessionMcpApprovalPolicy: (serverId: string, requireApproval: SessionMcpApprovalPolicy) => Promise<UpdateSessionMcpApprovalPolicyResult>;
     listPendingSessionTurns: () => Promise<SessionTurn[]>;
 };
 type LockedSessionUpdateResult = {
@@ -4311,4 +5360,4 @@ type LockedSessionUpdateResult = {
 declare function appendSessionEventsWithLockedSessionUpdate(db: Database, workspaceId: string, sessionId: string, build: (session: Session, context: LockedSessionUpdateContext) => LockedSessionUpdateResult | Promise<LockedSessionUpdateResult>): Promise<SessionEvent[]>;
 declare function sessionSubject(workspaceId: string, sessionId: string): string;
 
-export { type CorrectWorkspaceMemoryResult as $, AGENT_VISIBLE_MEMORY_STATUSES as A, type BootstrapWorkspaceInput as B, CODEX_CAPACITY_REFRESH_MAX_MS as C, type CodexCapacitySelectionContext as D, type CodexCapacityWait as E, type CodexCapacityWaitStatus as F, type CodexCapacityWakeTarget as G, type CodexCredentialForRun as H, type CodexCredentialLeaseCandidateFilter as I, type CodexCredentialLeaseCandidateFilterResult as J, type CodexCredentialLeasePolicyScopeResolver as K, type CodexCredentialLeaseQuarantine as L, type CodexCredentialLeaseResult as M, type CodexCredentialLeaseSelection as N, type CodexCredentialLeaseSelectionContext as O, type CodexCredentialStatus as P, type ProvisionResult, type ProvisionRolesOptions, type CodexCredentialTokens as Q, type CodexLeaseAccountStatus as R, type CodexPinSource as S, type CodexRotationSettings as T, type CodexRotationStrategy as U, type ComposerDraftRow as V, type ConnectionBrokerDeps as W, type ConnectionCredentialForBroker as X, ConnectionRefreshHttpError as Y, type ConsumeOAuthStateNonceInput as Z, type CorrectWorkspaceMemoryInput as _, type AcceptSessionApprovalDecisionResult as a, type MarkWarmLeaseInstanceLostResult as a$, type CreateCapabilityCatalogItemInput as a0, type CreateConnectionInput as a1, type CreateDbOptions as a2, type CreateImportBatchInput as a3, type CreateKnowledgeMemoryInput as a4, type CreatePackInstallationInput as a5, type CreateScheduledTaskInput as a6, type CreateSessionGoalInput as a7, type CreateSessionMcpServerInput as a8, type CreateSocialConnectionInput as a9, type IntegrationOAuthClientForUse as aA, type LeaseHolderKind as aB, type LeaseSnapshot as aC, type ListKnowledgeMemoryOptions as aD, type ListSessionEventsOptions as aE, type ListSessionsForSubjectOptions as aF, type ListSessionsOptions as aG, type LiveModalSandboxLeaseAttribution as aH, MACHINE_METRICS_SERIES_INTERVAL_MS as aI, MAX_INTERNAL_UPDATE_BATCH_BYTES as aJ, MAX_INTERNAL_UPDATE_BATCH_MEMBERS as aK, MAX_INTERNAL_UPDATE_BYTES as aL, MEMORY_ACTIVE_RECORD_CAP as aM, MEMORY_BLOCK_KIND_ORDER as aN, MEMORY_BLOCK_RECORD_LIMIT as aO, MEMORY_CORRECT_TOOL_DESCRIPTION as aP, MEMORY_KIND_SECTION_TITLES as aQ, MEMORY_NEAR_DUP_COSINE_THRESHOLD as aR, MEMORY_NEAR_DUP_NEIGHBORS as aS, MEMORY_SAVE_TOOL_DESCRIPTION as aT, MEMORY_SEARCH_DEFAULT_LIMIT as aU, MEMORY_SEARCH_MAX_LIMIT as aV, MEMORY_SEARCH_TOOL_DESCRIPTION as aW, MEMORY_TEXT_MAX_CHARS as aX, MEMORY_VISIBLE_RECORD_CAP as aY, type MachineMetricsRow as aZ, type MachineMetricsSample as a_, type CreateSocialPostInput as aa, type CreditBalanceByAccount as ab, type Database as ac, type DbClient as ad, type DeviceEnrollmentRequestRecord as ae, type DeviceEnrollmentStatus as af, type EditQueueCommandResult as ag, type EffectiveControlBlocker as ah, type EffectiveControlResumeOption as ai, type EffectiveControlState as aj, type EffectiveSessionControl as ak, type EnableCapabilityInstallationInput as al, type EnabledMcpCapabilityServer as am, type EnqueueSessionTurnInput as an, type EnrollmentExposure as ao, type EnrollmentOs as ap, type EnrollmentRecord as aq, type EnrollmentStatus as ar, type ExpiredFileUploadCleanupClaim as as, type FileUploadCleanupClaimResult as at, type ForceDrainResult as au, type GitHubInstallation as av, type GoalContinuationDecision as aw, type ImportBatch as ax, type InitializeSessionStartInput as ay, type InitializeSessionStartResult as az, type AccrueWarmSecondsResult as b, type SetSessionCodexPinOptions as b$, type MemoryBlockRecord as b0, type MemoryEmbedder as b1, type MemorySanitizeResult as b2, type MeterableWarmLease as b3, type PendingSessionToolCallInput as b4, type QueueCommandConflictCode as b5, QueueCommandConflictError as b6, type QueueCommandResult as b7, type QueuedTurnRow as b8, type ReapDrainable as b9, type SaveWorkspaceMemoryResult as bA, type SessionAttemptInterruptionSettlement as bB, type SessionCodexState as bC, type SessionCommandActor as bD, SessionCommandIdempotencyError as bE, type SessionCommandReceiptRow as bF, SessionContextBusyError as bG, SessionControlConflictError as bH, SessionControlInvariantError as bI, type SessionControlMutationResult as bJ, type SessionLineage as bK, SessionListAccessError as bL, type SessionListCursor as bM, SessionListCursorError as bN, type SessionMcpServerForRun as bO, SessionPinAccessError as bP, SessionPinVersionConflictError as bQ, type SessionRecordingCodec as bR, type SessionRecordingMode as bS, type SessionRecordingRow as bT, type SessionRecordingState as bU, type SessionSystemUpdateOutboxDelivery as bV, type SessionTurnAttemptOutcome as bW, type SessionTurnRecordingSettlement as bX, type SessionWorkPeek as bY, type SessionWorkTrigger as bZ, type SessionWorkflowWake as b_, type ReconcileCodexCapacityWaitResult as ba, type RecoverSessionDispatchInput as bb, type RecoverSessionDispatchResult as bc, type RegisterWorkspacePackInput as bd, type RegistryCapabilityCatalogItemInput as be, type RegistryCatalogSurfaceKey as bf, type ReplaceIntegrationOAuthClientInput as bg, type RequestSessionTurnRecoveryInput as bh, type RequestSessionTurnRecoveryResult as bi, type ResolveConnectionCredentialInput as bj, type ResolveConnectionCredentialResult as bk, RigActiveVersionChangedError as bl, RigChangeAlreadyVerifyingError as bm, RigChangeTransitionError as bn, type RigVersionContentInput as bo, type RlsContext as bp, type RlsStrategy as bq, SESSION_ANCESTRY_LIMIT as br, SandboxImageConflictError as bs, type SandboxKind as bt, type SandboxLeaseLiveness as bu, SandboxLeaseSupersededError as bv, type SandboxPtySessionRow as bw, type SandboxRecord as bx, SandboxRigConflictError as by, type SaveWorkspaceMemoryInput as bz, type AcquireLeaseInput as c, claimFileUploadCleanup as c$, type SettleCodexCredentialFailoverResult as c0, type SettleCodexCredentialLeaseLossResult as c1, type SteerQueueCommandResult as c2, type StoreIntegrationOAuthClientInput as c3, type StoredIntegrationOAuthClient as c4, type StreamAcknowledgment as c5, type SubmitHumanPromptResult as c6, type ToolspaceCallReservation as c7, type TurnAttemptFenceRejectReason as c8, type UpdateConnectionInput as c9, acquireLease as cA, activateRigVersion as cB, addSessionSystemUpdate as cC, addSessionSystemUpdateWithSourceMutation as cD, allAccountPermissions as cE, allWorkspacePermissions as cF, appendSessionEventToSandboxGroup as cG, appendSessionEvents as cH, appendSessionEventsAndUpdateSession as cI, appendSessionEventsForTurnAttempt as cJ, appendSessionEventsWithLockedSessionUpdate as cK, appendSessionHistoryItems as cL, applyContextCompaction as cM, applyCreditDebitUpToBalance as cN, applyCreditLedgerEntry as cO, applySessionTurnSettlement as cP, approveDeviceEnrollmentRequest as cQ, armCodexCapacityWait as cR, assertAgentCommandAuthorityInTransaction as cS, autoResumeSessionBranchInTransaction as cT, beginRigChangeVerificationAttempt as cU, bootstrapWorkspace as cV, buildChildCompletionDigest as cW, buildCodexTokenResolver as cX, buildConnectionTokenResolver as cY, canonicalSessionCommandHash as cZ, claimExpiredFileUploadCleanup as c_, type UpdateImportBatchCountsInput as ca, type UpdateKnowledgeMemoryInput as cb, type UpdateScheduledTaskInput as cc, type UpdateSessionMcpServerCredentialsInput as cd, type UpdateSessionMcpServerCredentialsResult as ce, type UserLookup as cf, type VariableSetForRun as cg, WORKSPACE_MEMORY_BLOCK_EMPTY as ch, WORKSPACE_MEMORY_BLOCK_HEADER_POPULATED as ci, WORKSPACE_MEMORY_BLOCK_TOKEN_BUDGET as cj, type WorkspaceCaptureCommitResult as ck, type WorkspaceCaptureGcPlan as cl, type WorkspaceCaptureGcRow as cm, type WorkspaceCaptureRow as cn, type WorkspaceControlLockMode as co, type WorkspaceControlMutationResult as cp, type WorkspaceEnvironmentForRun as cq, type WorkspaceMemoryOrigin as cr, type WorkspaceMemorySearchInput as cs, type WorkspaceMemorySearchMode as ct, type WorkspaceMemorySearchResult as cu, type WorkspaceModelPolicy as cv, abandonRecordingForTurnAttempt as cw, acceptSessionApprovalDecision as cx, accrueWarmSeconds as cy, acquireCodexCredentialLease as cz, type AcquireLeaseResult as d, decryptEnvironmentValue as d$, claimPendingSessionSystemUpdateOutbox as d0, claimPendingSessionWorkflowWakes as d1, claimSessionWorkForAttempt as d2, clearDurablePendingSessionToolCalls as d3, clearEnrollmentWentOffline as d4, clearSessionContext as d5, clearSessionGoal as d6, clearedContextMarkerItem as d7, closePtySession as d8, closeSessionTurnAttemptInTransaction as d9, countWorkspaceEnvironments as dA, countWorkspacesForAccount as dB, createApiKey as dC, createConnection as dD, createDb as dE, createDeviceEnrollmentRequest as dF, createEnrollment as dG, createFileUpload as dH, createImportBatch as dI, createKnowledgeMemory as dJ, createRig as dK, createRigChange as dL, createRigVersion as dM, createRigVersionForChangePromotion as dN, createSandbox as dO, createScheduledTask as dP, createScheduledTaskRun as dQ, createSession as dR, createSessionGoal as dS, createSessionMcpServers as dT, createSessionWithIdempotencyKey as dU, createSocialConnection as dV, createSocialPost as dW, createVariableSet as dX, createWorkspace as dY, createWorkspaceEnvironment as dZ, decodeSessionListCursor as d_, codexCapacityRefreshBackoffMs as da, commitWarmingToWarm as db, completeExpiredFileUploadCleanup as dc, completeFileUpload as dd, completeFileUploadCleanup as de, computeWorkspaceCaptureGcPlan as df, confirmDrainCold as dg, consumeDeviceEnrollmentRequest as dh, consumeIntegrationOAuthStateNonce as di, correctWorkspaceMemory as dj, countActiveApiKeysForWorkspace as dk, countActiveSessionHistoryItems as dl, countActiveSessionsForWorkspace as dm, countActiveSessionsUsingEnvironment as dn, countActiveSessionsUsingVariableSet as dp, countConsecutiveReactiveRotations as dq, countQueuedTurns as dr, countRigs as ds, countSandboxLeasesByLiveness as dt, countScheduledTasksForWorkspace as du, countScheduledTasksUsingEnvironment as dv, countScheduledTasksUsingVariableSet as dw, countSessionHistoryItems as dx, countSessionsUsingRig as dy, countVariableSets as dz, type ActiveSandboxPointer as e, getRecording as e$, decryptedCapabilityHeaders as e0, deleteRecording as e1, deleteRig as e2, deleteRigIfNoActiveSessions as e3, deleteScheduledTask as e4, deleteSessionQueueItemInTransaction as e5, deleteVariableSet as e6, deleteVariableSetVariable as e7, deleteWorkspace as e8, deleteWorkspaceCaptureRows as e9, forceDrainOverLimitViewerOnlyBoxes as eA, getActiveSessionHistoryItems as eB, getAnySessionInGroup as eC, getBillingBalance as eD, getBillingCustomer as eE, getCapabilityCatalogItem as eF, getCapabilityInstallation as eG, getCodexCapacityWaitForSession as eH, getCodexCredentialStatus as eI, getCodexRotationSettings as eJ, getComposerDraftInTransaction as eK, getConnectionMetadata as eL, getDeviceEnrollmentRequestByDeviceCode as eM, getEnrollment as eN, getFile as eO, getFileUpload as eP, getKnowledgeMemory as eQ, getLatestRunState as eR, getLatestStartedSessionTurn as eS, getManagedAccount as eT, getManagedUserByEmail as eU, getMaterializedSandboxFileResources as eV, getOpenPtySession as eW, getOrCreateSessionSystemUpdateOutbox as eX, getPackInstallation as eY, getPendingDeviceEnrollmentRequestByUserCode as eZ, getPendingDeviceEnrollmentRequestByUserCodeGlobal as e_, deleteWorkspaceEnvironment as ea, deleteWorkspaceEnvironmentVariable as eb, deleteWorkspacePack as ec, denyDeviceEnrollmentRequest as ed, disableCapabilityInstallation as ee, disconnectAllCodexAccounts as ef, disconnectCodexAccount as eg, editQueuedTurnInTransaction as eh, enableCapabilityInstallation as ei, enablePackInstallation as ej, encodeSessionListCursor as ek, encryptEnvironmentValue as el, enqueueSessionTurn as em, enqueueSessionWorkflowWake as en, enqueueSessionWorkflowWakeIfRunnable as eo, enqueueSessionWorkflowWakeInTransaction as ep, ensureCodexRotationSettings as eq, ensureManagedAccessForUser as er, estimateMemoryTokens as es, evaluateGoalContinuation as et, evaluateSessionControl as eu, evaluateSessionControls as ev, failWarmingToCold as ew, fetchCodexUsageForAccount as ex, finalizeEnrollmentByToken as ey, findActiveApiKeyByHash as ez, type AddSessionSystemUpdateInput as f, listDistinctRigVersionIdsInGroup as f$, getRig as f0, getRigByName as f1, getRigChange as f2, getRigName as f3, getRigVersion as f4, getRigVersionById as f5, getSandbox as f6, getSandboxSessionEnvelope as f7, getScheduledTask as f8, getSession as f9, getWorkspacePack as fA, grantWorkspaceAccess as fB, hasCreditLedgerEntry as fC, hashMemoryText as fD, heartbeatCodexCredentialLease as fE, heartbeatCodexCredentialLeaseUntil as fF, heartbeatLeaseHolder as fG, ingestMachineMetricsSample as fH, initializeSessionStartAtomically as fI, insertFailedWorkspaceCapture as fJ, insertMachineMetricsSeries as fK, insertPtySession as fL, insertRecording as fM, insertWorkspaceCapture as fN, interruptedToolCallResult as fO, isCodexBilledTurn as fP, isMemoryTextTooLong as fQ, isPrivateAddress as fR, isSessionCompactionRequested as fS, isStripeWebhookProcessed as fT, latestWorkspaceCapture as fU, listApiKeys as fV, listCapabilityCatalogItems as fW, listCapabilityInstallations as fX, listCodexAccountStatuses as fY, listConnectionsMetadata as fZ, listCreditBalancesByAccount as f_, getSessionByCreateIdempotencyKey as fa, getSessionCodexState as fb, getSessionEvent as fc, getSessionEventByClientEventId as fd, getSessionForSubject as fe, getSessionGoal as ff, getSessionHistoryItems as fg, getSessionLineage as fh, getSessionQueueSnapshot as fi, getSessionSystemUpdateOutboxByDedupeKey as fj, getSessionTurn as fk, getSessionTurnForAttempt as fl, getSocialConnection as fm, getStoredCapabilityHeaderCiphertext as fn, getStreamAcknowledgment as fo, getVariableSet as fp, getVariableSetByName as fq, getVariableSetValuesForRun as fr, getWorkspace as fs, getWorkspaceControlEvent as ft, getWorkspaceDefaultRigId as fu, getWorkspaceEnvironment as fv, getWorkspaceEnvironmentByName as fw, getWorkspaceEnvironmentValuesForRun as fx, getWorkspaceGrant as fy, getWorkspaceModelPolicy as fz, type AddSessionSystemUpdateResult as g, persistDrainSnapshot as g$, listDistinctVariableSetIdsInGroup as g0, listEnabledMcpCapabilityServers as g1, listEnrollments as g2, listGitHubInstallationIdsForWorkspace as g3, listGitHubInstallationsForWorkspace as g4, listKnowledgeMemories as g5, listLiveModalSandboxLeaseAttributions as g6, listMeterableWarmLeases as g7, listOpenPtySessions as g8, listOutstandingSessionSystemUpdates as g9, listWorkspacePacks as gA, listWorkspacesForSubject as gB, loadCodexCredentialForRun as gC, loadConnectionCredentialForBroker as gD, loadIntegrationOAuthClient as gE, loadVariableSetForRun as gF, loadWorkspaceEnvironmentForRun as gG, lockWorkspaceInferenceControl as gH, markFileUploadFailed as gI, markSandboxFileResourcesMaterialized as gJ, markScheduledTaskRunFailedIfQueued as gK, markSessionSystemUpdateOutboxDeliveredInTransaction as gL, markSessionSystemUpdateOutboxFailed as gM, markSessionWorkflowWakeDelivered as gN, markSessionWorkflowWakeFailed as gO, markStaleRegistryCatalogItems as gP, markStripeWebhookProcessed as gQ, markWarmLeaseInstanceLost as gR, mcpServerIdForCapability as gS, moveQueuedTurnInTransaction as gT, mutateSessionControlInTransaction as gU, mutateWorkspaceControlInTransaction as gV, nextSessionHistoryPosition as gW, normalizeBearerScheme as gX, normalizeMemoryText as gY, orphanedResultRowIndicesForRepair as gZ, peekSessionWork as g_, listPackInstallations as ga, listPendingCodexCapacityWakeTargets as gb, listPendingSessionTurns as gc, listRecordings as gd, listRegistryCatalogSurfaceKeys as ge, listRigChanges as gf, listRigVersions as gg, listRigs as gh, listSandboxes as gi, listScheduledTaskRuns as gj, listScheduledTasks as gk, listSessionEvents as gl, listSessionIdsInGroup as gm, listSessionMcpServerMetadata as gn, listSessionMcpServersForRun as go, listSessionSystemUpdatesForTurn as gp, listSessionTurns as gq, listSessions as gr, listSessionsForSubject as gs, listSocialConnections as gt, listSocialPosts as gu, listUsageEvents as gv, listVariableSets as gw, listWorkspaceControlEvents as gx, listWorkspaceEnvironments as gy, listWorkspaceMembers as gz, AgentCommandAuthorityError as h, saveComposerDraftInTransaction as h$, persistWarmSnapshot as h0, planWorkspaceCaptureGc as h1, quarantineCodexCredentialForLease as h2, reArmDrainingLease as h3, readActiveSandbox as h4, readLease as h5, readMachineMetricsLatest as h6, readMachineMetricsLatestForWorkspace as h7, readMachineMetricsSeries as h8, reapExpiredSessionListSnapshots as h9, registerWorkspacePack as hA, releaseCodexCredentialLease as hB, releaseLeaseHolder as hC, removeWorkspaceMember as hD, renameCodexAccount as hE, renderWorkspaceMemoryBlock as hF, replaceIntegrationOAuthClient as hG, requestSessionCompaction as hH, requestSessionTurnRecovery as hI, requireFile as hJ, requireScheduledTask as hK, requireSession as hL, requireSocialConnection as hM, requireWorkspace as hN, reserveSessionCommandReceipt as hO, reserveToolspaceCallForTurn as hP, resolveWorkspaceMemoryBlock as hQ, revokeApiKey as hR, revokeConnection as hS, revokeEnrollment as hT, revokeViewer as hU, rlsContextForWorkspace as hV, rlsStrategyFor as hW, sanitizeEventPayload as hX, sanitizeEventString as hY, sanitizeMemoryText as hZ, sanitizeModelPayload as h_, reapStaleLeaseHolders as ha, reapStaleLeaseHoldersGlobal as hb, reconcileCodexCapacityWait as hc, recordAuditEvent as hd, recordCodexAccountConnectors as he, recordCodexAccountUsage as hf, recordCodexAccountUsageWithWakeTargets as hg, recordCodexTokenRefresh as hh, recordConnectionTokenRefresh as hi, recordConnectionUsed as hj, recordLeaseDataPlaneUrl as hk, recordLeaseTerminalDataPlaneUrl as hl, recordPendingSessionToolCallResult as hm, recordSessionActiveCodexCredential as hn, recordSkippedContextCompaction as ho, recordStreamAcknowledgment as hp, recordStripeWebhookEvent as hq, recordUsageEvent as hr, recordWarmingSandboxCreated as hs, recoverSessionDispatch as ht, refreshOAuthConnectionCredential as hu, registerDbBinding as hv, registerInternalUpdateWakeInTransaction as hw, registerPendingSessionToolCall as hx, registerSessionTurnAttemptClaim as hy, registerSessionWorkflowWakeInTransaction as hz, type AgentInternalUpdateCommandResult as i, upsertBillingCustomer as i$, saveRunState as i0, saveWorkspaceMemory as i1, searchWorkspaceMemories as i2, sendAgentMessageInTransaction as i3, serializeEffectiveSessionControl as i4, sessionSubject as i5, sessionsWithActiveOpOnEnrollment as i6, setActiveCodexCredential as i7, setActiveSandbox as i8, setCodexCredentialExhausted as i9, steerAgentSessionInTransaction as iA, steerQueuedTurnInTransaction as iB, storeIntegrationOAuthClient as iC, submitHumanPromptInTransaction as iD, sumUsageQuantity as iE, supersedeSessionCurrentDirectionInTransaction as iF, touchEnrollmentLastSeen as iG, touchLeaseHolder as iH, updateCodexRotationSettings as iI, updateConnection as iJ, updateImportBatchCounts as iK, updateKnowledgeMemory as iL, updatePackInstallationStatus as iM, updatePtySessionActivity as iN, updateRecording as iO, updateRig as iP, updateRigChangeStatus as iQ, updateScheduledTask as iR, updateScheduledTaskRun as iS, updateSessionCommandReceiptResult as iT, updateSessionGoal as iU, updateSessionMcpServerCredentials as iV, updateSessionTitle as iW, updateVariableSet as iX, updateWorkspace as iY, updateWorkspaceEnvironment as iZ, updateWorkspaceSettings as i_, setCodexCredentialExhaustedWithWakeTargets as ia, setCodexCredentialStatus as ib, setCodexCredentialStatusById as ic, setConnectionStatus as id, setEnrollmentDisplayState as ie, setEnrollmentOpStreamState as ig, setEnrollmentWentOffline as ih, setInitialActiveCodexCredential as ii, setRlsContext as ij, setSessionCodexPin as ik, setSessionGoalLastContinuationTurn as il, setSessionGoalStatus as im, setSessionLastInputTokensForTurnAttempt as io, setSessionPin as ip, setTemporalWorkflowId as iq, setVariableSetVariable as ir, setWorkspaceDefaultRig as is, setWorkspaceEnvironmentVariable as it, settleCodexCredentialFailover as iu, settleCodexCredentialLeaseLoss as iv, settleScheduledTaskRunInTransaction as iw, settleSessionAttemptInterruptions as ix, settleSessionIdleWithParentOutbox as iy, shortMemoryId as iz, type AppendEventInput as j, upsertCapabilityCatalogItem as j0, upsertCodexSubscriptionCredential as j1, upsertGitHubInstallation as j2, upsertMachineMetricsLatest as j3, upsertRegistryCapabilityCatalogItem as j4, upsertSandboxSessionEnvelope as j5, upsertSessionGoal as j6, upsertWorkspaceModelPolicy as j7, withAccountRls as j8, withCodexCapacityMutation as j9, withCodexCredentialRefreshLock as ja, withRlsContext as jb, withWorkspaceRls as jc, withWorkspaceSubjectRls as jd, withWorkspaceUsageLock as je, workspaceCaptureAtRevision as jf, workspaceCodexSubscriptionActive as jg, type ApplyContextCompactionResult as k, type ApplySessionTurnSettlementInput as l, type ApplySessionTurnSettlementResult as m, type ArmCodexCapacityWaitResult as n, CODEX_CAPACITY_REFRESH_MIN_MS as o, CODEX_CREDENTIAL_LEASE_TTL_MS as p, provisionRoles, CODEX_ROTATION_STRATEGIES as q, type ClaimSessionWorkForAttemptInput as r, type ClaimSessionWorkForAttemptResult as s, type ClearSessionContextResult as t, type CodexAccountStatus as u, type CodexAccountUsageSnapshot as v, type CodexAuthDeps as w, type CodexCapacityAvailabilityDecision as x, type CodexCapacityMutationResult as y, type CodexCapacityResetKind as z };
+export { type CodexResetRedemptionRecovery as $, AGENT_VISIBLE_MEMORY_STATUSES as A, type BootstrapWorkspaceInput as B, CODEX_CAPACITY_REFRESH_MAX_MS as C, type CodexAllocatorUpdateResult as D, type CodexAuthDeps as E, type CodexCapacityAvailabilityDecision as F, type CodexCapacityMutationResult as G, type CodexCapacityResetKind as H, type CodexCapacitySelectionContext as I, type CodexCapacityWait as J, type CodexCapacityWaitStatus as K, type CodexCapacityWakeTarget as L, type CodexCredentialForRun as M, type CodexCredentialLeaseCandidateFilter as N, type CodexCredentialLeaseCandidateFilterResult as O, type CodexCredentialLeasePolicyScopeResolver as P, type ProvisionResult, type ProvisionRolesOptions, type CodexCredentialLeaseQuarantine as Q, type CodexCredentialLeaseResult as R, type CodexCredentialLeaseSelection as S, type CodexCredentialLeaseSelectionContext as T, type CodexCredentialStatus as U, type CodexCredentialTokens as V, type CodexLeaseAccountStatus as W, type CodexPinSource as X, type CodexRateLimitResetCreditsAccountResult as Y, type CodexResetRedemptionAttempt as Z, type CodexResetRedemptionOutcome as _, type AcceptSessionApprovalDecisionResult as a, type LeaseHolderKind as a$, type CodexResetRedemptionSendNotReadyReason as a0, type CodexResetRedemptionStatus as a1, type CodexRotationSettings as a2, type CodexRotationStrategy as a3, type CodexTokenDeadlineClock as a4, type CodexTokenDeadlineOptions as a5, type ComposerDraftRow as a6, type ConnectionBrokerDeps as a7, type ConnectionCredentialForBroker as a8, ConnectionRefreshHttpError as a9, type EnabledMcpCapabilityServer as aA, type EnqueueSessionTurnInput as aB, type EnrollmentExposure as aC, type EnrollmentOs as aD, type EnrollmentRecord as aE, type EnrollmentStatus as aF, type ExpiredFileUploadCleanupClaim as aG, type FenceCodexResetRedemptionSendResult as aH, type FileUploadCleanupClaimResult as aI, type ForceDrainResult as aJ, type FrozenTurnInitiator as aK, type GitHubInstallation as aL, type GitHubInstallationAccess as aM, type GoalContinuationDecision as aN, type HostExportConsumerStatus as aO, type HostExportKind as aP, HostExportPayloadError as aQ, HostMcpCredentialBindingError as aR, type HostMcpCredentialResolverContext as aS, HostMcpCredentialScopeError as aT, HumanInputResponseValidationError as aU, type IdempotentPersistenceTransactionOptions as aV, type ImportBatch as aW, type InitializeSessionStartInput as aX, type InitializeSessionStartResult as aY, type InstallOrReadTurnExecutionPolicyForAttemptResult as aZ, type IntegrationOAuthClientForUse as a_, type ConsumeOAuthStateNonceInput as aa, type CorrectWorkspaceMemoryInput as ab, type CorrectWorkspaceMemoryResult as ac, type CreateCapabilityCatalogItemInput as ad, type CreateConnectionInput as ae, type CreateDbOptions as af, type CreateImportBatchInput as ag, type CreateKnowledgeMemoryInput as ah, type CreatePackInstallationInput as ai, type CreateScheduledTaskInput as aj, type CreateSessionGoalInput as ak, type CreateSessionMcpServerInput as al, type CreateSocialConnectionInput as am, type CreateSocialPostInput as an, type CreditBalanceByAccount as ao, type Database as ap, type DatabaseFailureCode as aq, type DbClient as ar, type DeviceEnrollmentRequestRecord as as, type DeviceEnrollmentStatus as at, type EditQueueCommandResult as au, type EffectiveControlBlocker as av, type EffectiveControlResumeOption as aw, type EffectiveControlState as ax, type EffectiveSessionControl as ay, type EnableCapabilityInstallationInput as az, type AcceptSessionHumanInputResponseResult as b, SESSION_DISCOVERY_GOAL_MAX_CHARS as b$, type LeaseSnapshot as b0, type ListKnowledgeMemoryOptions as b1, type ListSessionEventPageOptions as b2, type ListSessionEventsOptions as b3, type ListSessionsForSubjectOptions as b4, type ListSessionsOptions as b5, type LiveModalSandboxLeaseAttribution as b6, MACHINE_METRICS_SERIES_INTERVAL_MS as b7, MAX_INTERNAL_UPDATE_BATCH_BYTES as b8, MAX_INTERNAL_UPDATE_BATCH_MEMBERS as b9, type QueueCommandResult as bA, type QueuedTurnRow as bB, type ReapDrainable as bC, type ReconcileCodexCapacityWaitResult as bD, type RecoverSessionDispatchInput as bE, type RecoverSessionDispatchResult as bF, type RefreshTransportOptions as bG, type RegisterWorkspacePackInput as bH, type RegistryCapabilityCatalogItemInput as bI, type RegistryCatalogSurfaceKey as bJ, type ReplaceIntegrationOAuthClientInput as bK, type RequestSessionTurnRecoveryInput as bL, type RequestSessionTurnRecoveryResult as bM, type ResolveConnectionCredentialInput as bN, type ResolveConnectionCredentialResult as bO, type RetainedFileArtifact as bP, RigActiveVersionChangedError as bQ, RigChangeAlreadyVerifyingError as bR, type RigChangeMonitoringSummary as bS, RigChangeTransitionError as bT, type RigVersionContentInput as bU, type RigVersionMonitoringSummary as bV, type RlsContext as bW, type RlsStrategy as bX, SESSION_ANCESTRY_LIMIT as bY, SESSION_DISCOVERY_CONTROL_TARGET_LIMIT as bZ, SESSION_DISCOVERY_CONTROL_TITLE_MAX_CHARS as b_, MAX_INTERNAL_UPDATE_BYTES as ba, MEMORY_ACTIVE_RECORD_CAP as bb, MEMORY_BLOCK_KIND_ORDER as bc, MEMORY_BLOCK_RECORD_LIMIT as bd, MEMORY_CORRECT_TOOL_DESCRIPTION as be, MEMORY_KIND_SECTION_TITLES as bf, MEMORY_NEAR_DUP_COSINE_THRESHOLD as bg, MEMORY_NEAR_DUP_NEIGHBORS as bh, MEMORY_SAVE_TOOL_DESCRIPTION as bi, MEMORY_SEARCH_DEFAULT_LIMIT as bj, MEMORY_SEARCH_MAX_LIMIT as bk, MEMORY_SEARCH_TOOL_DESCRIPTION as bl, MEMORY_TEXT_MAX_CHARS as bm, MEMORY_VISIBLE_RECORD_CAP as bn, type MachineMetricsRow as bo, type MachineMetricsSample as bp, type MarkWarmLeaseInstanceLostResult as bq, type MemoryBlockRecord as br, type MemoryEmbedder as bs, type MemorySanitizeResult as bt, type MeterableWarmLease as bu, type PendingSessionToolCallInput as bv, type PersistenceFailureDetails as bw, type PersistenceRetryOutcome as bx, type QueueCommandConflictCode as by, QueueCommandConflictError as bz, type AccrueWarmSecondsResult as c, type UpdateKnowledgeMemoryInput as c$, SESSION_DISCOVERY_MESSAGE_MAX_CHARS as c0, SESSION_EVENT_DB_PAGE_MAX_BYTES as c1, type SafeDatabaseErrorFacts as c2, SandboxImageConflictError as c3, type SandboxKind as c4, type SandboxLeaseLiveness as c5, SandboxLeaseSupersededError as c6, type SandboxPtySessionRow as c7, type SandboxRecord as c8, SandboxRigConflictError as c9, SessionPinAccessError as cA, SessionPinVersionConflictError as cB, type SessionRecordingCodec as cC, type SessionRecordingMode as cD, type SessionRecordingRow as cE, type SessionRecordingState as cF, type SessionSystemUpdateOutboxDelivery as cG, type SessionTurnAttemptOutcome as cH, type SessionTurnForExecution as cI, type SessionTurnRecordingSettlement as cJ, type SessionWorkPeek as cK, type SessionWorkTrigger as cL, type SessionWorkflowWake as cM, type SessionWorkflowWakeDeliveryResult as cN, type SetSessionCodexPinOptions as cO, type SettleCodexCredentialFailoverResult as cP, type SettleCodexCredentialLeaseLossResult as cQ, type SteerQueueCommandResult as cR, type StoreIntegrationOAuthClientInput as cS, type StoredIntegrationOAuthClient as cT, type StreamAcknowledgment as cU, type SubmitHumanPromptResult as cV, type ToolspaceCallReservation as cW, type ToolspaceTurnAttemptClaims as cX, type TurnAttemptFenceRejectReason as cY, type UpdateConnectionInput as cZ, type UpdateImportBatchCountsInput as c_, SanitizedDatabasePersistenceCause as ca, type SaveWorkspaceMemoryInput as cb, type SaveWorkspaceMemoryResult as cc, type SessionAttemptInterruptionSettlement as cd, type SessionCodexState as ce, type SessionCommandActor as cf, SessionCommandIdempotencyError as cg, type SessionCommandReceiptRow as ch, SessionContextBusyError as ci, SessionControlConflictError as cj, SessionControlInvariantError as ck, type SessionControlMutationResult as cl, type SessionDiscoveryControl as cm, type SessionDiscoveryCursor as cn, type SessionDiscoveryOrderBy as co, type SessionDiscoverySummary as cp, type SessionEventPage as cq, SessionEventPersistenceError as cr, type SessionEventWriteLockInput as cs, type SessionEventWriteLocks as ct, SessionIdConflictError as cu, type SessionLineage as cv, SessionListAccessError as cw, type SessionListCursor as cx, SessionListCursorError as cy, type SessionMcpServerForRun as cz, type AcquireLeaseInput as d, claimExpiredFileUploadCleanup as d$, type UpdateScheduledTaskInput as d0, type UpdateSessionMcpApprovalPolicyResult as d1, type UpdateSessionMcpServerCredentialsInput as d2, type UpdateSessionMcpServerCredentialsResult as d3, type UpsertCodexSubscriptionCredentialResult as d4, type UserLookup as d5, type VariableSetForRun as d6, WORKSPACE_MEMORY_BLOCK_EMPTY as d7, WORKSPACE_MEMORY_BLOCK_HEADER_POPULATED as d8, WORKSPACE_MEMORY_BLOCK_TOKEN_BUDGET as d9, adoptCodexResetRedemptionAttempt as dA, allAccountPermissions as dB, allWorkspacePermissions as dC, appendSessionEventToSandboxGroup as dD, appendSessionEvents as dE, appendSessionEventsAndUpdateSession as dF, appendSessionEventsForTurnAttempt as dG, appendSessionEventsWithLockedSessionUpdate as dH, appendSessionHistoryItems as dI, applyContextCompaction as dJ, applyCreditDebitUpToBalance as dK, applyCreditLedgerEntry as dL, applySessionTurnSettlement as dM, approveDeviceEnrollmentRequest as dN, areGitHubRepositoriesAllowedForWorkspace as dO, armCodexCapacityWait as dP, assertAgentCommandAuthorityInTransaction as dQ, autoResumeSessionBranchInTransaction as dR, beginRigChangeVerificationAttempt as dS, bindGitHubInstallationRepositories as dT, bootstrapWorkspace as dU, buildChildCompletionDigest as dV, buildCodexTokenResolver as dW, buildConnectionTokenResolver as dX, buildHostConnectionTokenResolver as dY, canonicalSessionCommandHash as dZ, claimCodexResetRedemption as d_, type WorkspaceCaptureCommitResult as da, type WorkspaceCaptureGcPlan as db, type WorkspaceCaptureGcRow as dc, type WorkspaceCaptureRow as dd, type WorkspaceControlLockMode as de, type WorkspaceControlMutationResult as df, type WorkspaceControlRow as dg, type WorkspaceEnvironmentForRun as dh, type WorkspaceMemoryOrigin as di, type WorkspaceMemorySearchInput as dj, type WorkspaceMemorySearchMode as dk, type WorkspaceMemorySearchResult as dl, type WorkspaceModelPolicy as dm, abandonCodexResetRedemptionBeforeProvider as dn, abandonRecordingForTurnAttempt as dp, acceptSessionApprovalDecision as dq, acceptSessionHumanInputResponse as dr, accrueWarmSeconds as ds, acknowledgeHostExportBatch as dt, acquireCodexCredentialLease as du, acquireLease as dv, activateRigVersion as dw, addSessionSystemUpdate as dx, addSessionSystemUpdateWithSourceMutation as dy, admitToolspaceTurnAttempt as dz, type AcquireLeaseResult as e, createWorkspace as e$, claimFileUploadCleanup as e0, claimHostExportBatch as e1, claimPendingSessionSystemUpdateOutbox as e2, claimPendingSessionWorkflowWakes as e3, claimSessionWorkForAttempt as e4, clearDurablePendingSessionToolCalls as e5, clearEnrollmentWentOffline as e6, clearPendingSessionToolspaceCall as e7, clearSessionContext as e8, clearSessionGoal as e9, countSessionHistoryItems as eA, countSessionsUsingRig as eB, countVariableSets as eC, countWorkspaceEnvironments as eD, countWorkspacesForAccount as eE, createApiKey as eF, createConnection as eG, createDb as eH, createDeviceEnrollmentRequest as eI, createEnrollment as eJ, createFileUpload as eK, createImportBatch as eL, createKnowledgeMemory as eM, createRig as eN, createRigChange as eO, createRigVersion as eP, createRigVersionForChangePromotion as eQ, createSandbox as eR, createScheduledTask as eS, createScheduledTaskRun as eT, createSession as eU, createSessionGoal as eV, createSessionMcpServers as eW, createSessionWithIdempotencyKey as eX, createSocialConnection as eY, createSocialPost as eZ, createVariableSet as e_, clearedContextMarkerItem as ea, closePtySession as eb, closeSessionTurnAttemptInTransaction as ec, codexCapacityRefreshBackoffMs as ed, commitWarmingToWarm as ee, completeCodexResetRedemption as ef, completeExpiredFileUploadCleanup as eg, completeFileUpload as eh, completeFileUploadCleanup as ei, computeWorkspaceCaptureGcPlan as ej, confirmDrainCold as ek, consumeDeviceEnrollmentRequest as el, consumeIntegrationOAuthStateNonce as em, correctWorkspaceMemory as en, countActiveApiKeysForWorkspace as eo, countActiveSessionHistoryItems as ep, countActiveSessionsForWorkspace as eq, countActiveSessionsUsingEnvironment as er, countActiveSessionsUsingVariableSet as es, countConsecutiveReactiveRotations as et, countQueuedTurns as eu, countRigs as ev, countSandboxLeasesByLiveness as ew, countScheduledTasksForWorkspace as ex, countScheduledTasksUsingEnvironment as ey, countScheduledTasksUsingVariableSet as ez, type ActiveSandboxPointer as f, getDeviceEnrollmentRequestByDeviceCode as f$, createWorkspaceEnvironment as f0, databaseFailureCode as f1, deadLetterHostExportHead as f2, decodeSessionListCursor as f3, decryptEnvironmentValue as f4, decryptedCapabilityHeaders as f5, deleteGitHubInstallationBinding as f6, deleteRecording as f7, deleteRig as f8, deleteRigIfNoActiveSessions as f9, evaluateGoalContinuation as fA, evaluateSessionControl as fB, evaluateSessionControls as fC, evaluateSessionDiscoveryControls as fD, expireSessionHumanInputRequest as fE, failHostExportBatch as fF, failWarmingToCold as fG, fenceCodexResetRedemptionSend as fH, fetchCodexRateLimitResetCreditsForAccount as fI, fetchCodexUsageForAccount as fJ, finalizeEnrollmentByToken as fK, findActiveApiKeyByHash as fL, forceDrainOverLimitViewerOnlyBoxes as fM, frozenInitiatorForCommandActor as fN, getActiveSessionHistoryItems as fO, getActiveSessionTurnForExecution as fP, getAnySessionInGroup as fQ, getBillingBalance as fR, getBillingCustomer as fS, getCapabilityCatalogItem as fT, getCapabilityInstallation as fU, getCodexCapacityWaitForSession as fV, getCodexCredentialStatus as fW, getCodexResetRedemptionAttempt as fX, getCodexRotationSettings as fY, getComposerDraftInTransaction as fZ, getConnectionMetadata as f_, deleteScheduledTask as fa, deleteSessionQueueItemInTransaction as fb, deleteVariableSet as fc, deleteVariableSetVariable as fd, deleteWorkspace as fe, deleteWorkspaceCaptureRows as ff, deleteWorkspaceEnvironment as fg, deleteWorkspaceEnvironmentVariable as fh, deleteWorkspacePack as fi, denyDeviceEnrollmentRequest as fj, disableCapabilityInstallation as fk, disableHostExportConsumer as fl, disconnectAllCodexAccounts as fm, disconnectCodexAccount as fn, editQueuedTurnInTransaction as fo, enableCapabilityInstallation as fp, enablePackInstallation as fq, encodeSessionListCursor as fr, encryptEnvironmentValue as fs, enqueueSessionTurn as ft, enqueueSessionWorkflowWake as fu, enqueueSessionWorkflowWakeIfRunnable as fv, enqueueSessionWorkflowWakeInTransaction as fw, ensureCodexRotationSettings as fx, ensureManagedAccessForUser as fy, estimateMemoryTokens as fz, type AddSessionSystemUpdateInput as g, ingestMachineMetricsSample as g$, getEnrollment as g0, getFile as g1, getFileUpload as g2, getHostExportConsumerStatus as g3, getHumanInputResumeForEvent as g4, getKnowledgeMemory as g5, getLatestRunState as g6, getLatestStartedSessionTurn as g7, getManagedAccount as g8, getManagedUserByEmail as g9, getSessionLineage as gA, getSessionQueueSnapshot as gB, getSessionRootId as gC, getSessionSystemUpdateOutboxByDedupeKey as gD, getSessionTurn as gE, getSessionTurnForAttempt as gF, getSocialConnection as gG, getStoredCapabilityHeaderCiphertext as gH, getStreamAcknowledgment as gI, getVariableSet as gJ, getVariableSetByName as gK, getVariableSetValuesForRun as gL, getWorkspace as gM, getWorkspaceControlEvent as gN, getWorkspaceDefaultRigId as gO, getWorkspaceEnvironment as gP, getWorkspaceEnvironmentByName as gQ, getWorkspaceEnvironmentValuesForRun as gR, getWorkspaceGrant as gS, getWorkspaceModelPolicy as gT, getWorkspacePack as gU, grantWorkspaceAccess as gV, hasCreditLedgerEntry as gW, hashMemoryText as gX, heartbeatCodexCredentialLease as gY, heartbeatCodexCredentialLeaseUntil as gZ, heartbeatLeaseHolder as g_, getMaterializedSandboxFileResources as ga, getOpenPtySession as gb, getOrCreateSessionSystemUpdateOutbox as gc, getPackInstallation as gd, getPendingDeviceEnrollmentRequestByUserCode as ge, getPendingDeviceEnrollmentRequestByUserCodeGlobal as gf, getRecording as gg, getRetainedFileArtifact as gh, getRig as gi, getRigByName as gj, getRigChange as gk, getRigName as gl, getRigVersion as gm, getRigVersionById as gn, getSandbox as go, getSandboxSessionEnvelope as gp, getScheduledTask as gq, getSession as gr, getSessionByCreateIdempotencyKey as gs, getSessionCodexState as gt, getSessionEvent as gu, getSessionEventByClientEventId as gv, getSessionForSubject as gw, getSessionGoal as gx, getSessionHistoryItems as gy, getSessionHumanInputRequest as gz, type AddSessionSystemUpdateResult as h, listVariableSets as h$, initializeSessionStartAtomically as h0, insertFailedWorkspaceCapture as h1, insertMachineMetricsSeries as h2, insertPtySession as h3, insertRecording as h4, insertWorkspaceCapture as h5, installOrReadTurnExecutionPolicyForAttempt as h6, interruptedToolCallResult as h7, isCodexBilledTurn as h8, isDatabasePersistenceFailure as h9, listPendingCodexCapacityWakeTargets as hA, listPendingSessionTurns as hB, listRecordings as hC, listRegistryCatalogSurfaceKeys as hD, listRigChangeMonitoringSummaries as hE, listRigChanges as hF, listRigVersionMonitoringSummaries as hG, listRigVersions as hH, listRigs as hI, listSandboxes as hJ, listScheduledTaskRuns as hK, listScheduledTasks as hL, listSessionDiscoverySummaries as hM, listSessionEventPage as hN, listSessionEvents as hO, listSessionHumanInputRequests as hP, listSessionIdsInGroup as hQ, listSessionMcpServerMetadata as hR, listSessionMcpServersForChildInheritance as hS, listSessionMcpServersForRun as hT, listSessionSystemUpdatesForTurn as hU, listSessionTurns as hV, listSessions as hW, listSessionsForSubject as hX, listSocialConnections as hY, listSocialPosts as hZ, listUsageEvents as h_, isMemoryTextTooLong as ha, isRetryablePersistenceSqlState as hb, isSessionCompactionRequested as hc, isSessionEventPersistenceError as hd, isStripeWebhookProcessed as he, latestWorkspaceCapture as hf, listApiKeys as hg, listCapabilityCatalogItems as hh, listCapabilityInstallations as hi, listCodexAccountStatuses as hj, listCodexResetRedemptionRecoveries as hk, listConnectionsMetadata as hl, listCreditBalancesByAccount as hm, listDistinctRigVersionIdsInGroup as hn, listDistinctVariableSetIdsInGroup as ho, listEnabledMcpCapabilityServers as hp, listEnrollments as hq, listGitHubInstallationAccessForWorkspace as hr, listGitHubInstallationIdsForWorkspace as hs, listGitHubInstallationsForWorkspace as ht, listKnowledgeMemories as hu, listLiveModalSandboxLeaseAttributions as hv, listMeterableWarmLeases as hw, listOpenPtySessions as hx, listOutstandingSessionSystemUpdates as hy, listPackInstallations as hz, type AdoptCodexResetRedemptionResult as i, recordSkippedContextCompaction as i$, listWorkspaceControlEvents as i0, listWorkspaceEnvironments as i1, listWorkspaceMembers as i2, listWorkspacePacks as i3, listWorkspacesForSubject as i4, loadCodexCredentialForRun as i5, loadConnectionCredentialForBroker as i6, loadIntegrationOAuthClient as i7, loadVariableSetForRun as i8, loadWorkspaceEnvironmentForRun as i9, persistWarmSnapshot as iA, planWorkspaceCaptureGc as iB, projectEffectiveControlForRelatedAccess as iC, projectSessionForRelatedAccess as iD, pruneHostExportOutbox as iE, quarantineCodexCredentialForLease as iF, reArmDrainingLease as iG, readActiveSandbox as iH, readLease as iI, readMachineMetricsLatest as iJ, readMachineMetricsLatestForWorkspace as iK, readMachineMetricsSeries as iL, reapExpiredSessionListSnapshots as iM, reapStaleLeaseHolders as iN, reapStaleLeaseHoldersGlobal as iO, reconcileCodexCapacityWait as iP, recordAuditEvent as iQ, recordCodexAccountConnectors as iR, recordCodexAccountUsage as iS, recordCodexAccountUsageWithWakeTargets as iT, recordCodexTokenRefresh as iU, recordConnectionTokenRefresh as iV, recordConnectionUsed as iW, recordLeaseDataPlaneUrl as iX, recordLeaseTerminalDataPlaneUrl as iY, recordPendingSessionToolCallResult as iZ, recordSessionActiveCodexCredential as i_, lockSessionEventWriteRows as ia, lockWorkspaceInferenceControl as ib, markFileUploadFailed as ic, markSandboxFileResourcesMaterialized as id, markScheduledTaskRunFailedIfQueued as ie, markSessionAttemptQuiesced as ig, markSessionSystemUpdateOutboxDeliveredInTransaction as ih, markSessionSystemUpdateOutboxFailed as ii, markSessionWorkflowWakeDelivered as ij, markSessionWorkflowWakeFailed as ik, markStaleRegistryCatalogItems as il, markStripeWebhookProcessed as im, markWarmLeaseInstanceLost as io, mcpServerIdForCapability as ip, moveQueuedTurnInTransaction as iq, mutateSessionControlInTransaction as ir, mutateWorkspaceControlInTransaction as is, nestedPostgresSqlState as it, nextSessionHistoryPosition as iu, normalizeBearerScheme as iv, normalizeMemoryText as iw, orphanedResultRowIndicesForRepair as ix, peekSessionWork as iy, persistDrainSnapshot as iz, AgentCommandAuthorityError as j, setEnrollmentOpStreamState as j$, recordStreamAcknowledgment as j0, recordStripeWebhookEvent as j1, recordUsageEvent as j2, recordWarmingSandboxCreated as j3, recoverSessionDispatch as j4, refreshOAuthConnectionCredential as j5, registerDbBinding as j6, registerHostExportConsumer as j7, registerInternalUpdateWakeInTransaction as j8, registerPendingSessionToolCall as j9, rewindHostExportConsumer as jA, rlsContextForWorkspace as jB, rlsStrategyFor as jC, runIdempotentPersistenceTransaction as jD, safeDatabaseErrorFacts as jE, sanitizeEventPayload as jF, sanitizeEventString as jG, sanitizeMemoryText as jH, sanitizeModelPayload as jI, saveComposerDraftInTransaction as jJ, saveRunState as jK, saveWorkspaceMemory as jL, searchWorkspaceMemories as jM, sendAgentMessageInTransaction as jN, serializeEffectiveSessionControl as jO, sessionAuthorizationScopeFilter as jP, sessionSubject as jQ, sessionTreeStatsForSessions as jR, sessionsWithActiveOpOnEnrollment as jS, setActiveCodexCredential as jT, setActiveSandbox as jU, setCodexCredentialExhausted as jV, setCodexCredentialExhaustedWithWakeTargets as jW, setCodexCredentialStatus as jX, setCodexCredentialStatusById as jY, setConnectionStatus as jZ, setEnrollmentDisplayState as j_, registerSessionTurnAttemptClaim as ja, registerSessionWorkflowWakeInTransaction as jb, registerWorkspacePack as jc, releaseCodexCredentialLease as jd, releaseCodexResetRedemptionClaim as je, releaseLeaseHolder as jf, removeWorkspaceMember as jg, renameCodexAccount as jh, renderWorkspaceMemoryBlock as ji, replaceIntegrationOAuthClient as jj, requestSessionCompaction as jk, requestSessionTurnRecovery as jl, requireFile as jm, requireScheduledTask as jn, requireSession as jo, requireSocialConnection as jp, requireWorkspace as jq, reserveSessionCommandReceipt as jr, reserveToolspaceCallForAttempt as js, resolveWorkspaceMemoryBlock as jt, resumeHostExportConsumer as ju, retireHostExportConsumer as jv, revokeApiKey as jw, revokeConnection as jx, revokeEnrollment as jy, revokeViewer as jz, type AgentInternalUpdateCommandResult as k, withWorkspaceSubjectRls as k$, setEnrollmentWentOffline as k0, setInitialActiveCodexCredential as k1, setRlsContext as k2, setSessionCodexPin as k3, setSessionGoalLastContinuationTurn as k4, setSessionGoalStatus as k5, setSessionLastInputTokensForTurnAttempt as k6, setSessionPin as k7, setTemporalWorkflowId as k8, setVariableSetVariable as k9, updateScheduledTask as kA, updateScheduledTaskRun as kB, updateSessionCommandReceiptResult as kC, updateSessionGoal as kD, updateSessionMcpApprovalPolicy as kE, updateSessionMcpServerCredentials as kF, updateSessionTitle as kG, updateVariableSet as kH, updateWorkspace as kI, updateWorkspaceEnvironment as kJ, updateWorkspaceSettings as kK, upsertBillingCustomer as kL, upsertCapabilityCatalogItem as kM, upsertCodexSubscriptionCredential as kN, upsertGitHubInstallation as kO, upsertMachineMetricsLatest as kP, upsertRegistryCapabilityCatalogItem as kQ, upsertSandboxSessionEnvelope as kR, upsertSessionGoal as kS, upsertWorkspaceModelPolicy as kT, validateHumanInputResponse as kU, withAccountRls as kV, withCodexCapacityMutation as kW, withCodexCredentialRefreshLock as kX, withCodexTokenDeadline as kY, withRlsContext as kZ, withWorkspaceRls as k_, setWorkspaceDefaultRig as ka, setWorkspaceEnvironmentVariable as kb, settleCodexCredentialFailover as kc, settleCodexCredentialLeaseLoss as kd, settleScheduledTaskRunInTransaction as ke, settleSessionAttemptInterruptions as kf, settleSessionIdleWithParentOutbox as kg, shortMemoryId as kh, steerAgentSessionInTransaction as ki, steerQueuedTurnInTransaction as kj, storeIntegrationOAuthClient as kk, submitHumanPromptInTransaction as kl, sumUsageQuantity as km, supersedeSessionCurrentDirectionInTransaction as kn, touchEnrollmentLastSeen as ko, touchLeaseHolder as kp, updateCodexAllocatorEligibility as kq, updateCodexRotationSettings as kr, updateConnection as ks, updateImportBatchCounts as kt, updateKnowledgeMemory as ku, updatePackInstallationStatus as kv, updatePtySessionActivity as kw, updateRecording as kx, updateRig as ky, updateRigChangeStatus as kz, type AppendEventInput as l, withWorkspaceUsageLock as l0, workspaceCaptureAtRevision as l1, workspaceCodexSubscriptionActive as l2, type ApplyContextCompactionResult as m, type ApplySessionTurnSettlementInput as n, type ApplySessionTurnSettlementResult as o, type ArmCodexCapacityWaitResult as p, provisionRoles, CODEX_CAPACITY_REFRESH_MIN_MS as q, CODEX_CREDENTIAL_LEASE_TTL_MS as r, CODEX_RESET_REDEMPTION_OUTCOMES as s, CODEX_ROTATION_STRATEGIES as t, type ClaimCodexResetRedemptionResult as u, type ClaimSessionWorkForAttemptInput as v, type ClaimSessionWorkForAttemptResult as w, type ClearSessionContextResult as x, type CodexAccountStatus as y, type CodexAccountUsageSnapshot as z };