@opengeni/db 0.9.3 → 0.10.7

package/dist/index.js

@@ -7,6 +7,7 @@ import {
   capabilityInstallations,
   codexCapacityWaiters,
   codexCredentialLeases,
+  codexResetRedemptionAttempts,
   codexRotationSettings,
   codexSubscriptionCredentials,
   composerDrafts,
@@ -65,7 +66,7 @@ import {
   workspaceVariableSetVariables,
   workspaceVariableSets,
   workspaces
-} from "./chunk-4LG5NBTC.js";
+} from "./chunk-P6PKXY5W.js";
 import {
   migrate,
   runMigrations
@@ -87,6 +88,9 @@ import {
   SESSION_EVENT_ENVELOPE_MAX_BYTES,
   SESSION_EVENT_TYPE_MAX_BYTES,
   resolveSessionEventTypeFilters,
+  capabilityCatalogItemIsTrustedForExposure,
+  metadataWithTurnExecutionPolicyV1 as metadataWithTurnExecutionPolicyV12,
+  readTurnExecutionPolicyV1,
   reasoningEffortForMetadata,
   resolveWorkspaceMemoryEnabled,
   RigChange as RigChangeContract,
@@ -98,7 +102,8 @@ import {
   HostUsageExportBatch as HostUsageExportBatchContract,
   OPENGENI_HOST_EXPORT_SCHEMA_REVISION,
   HumanInputQuestion as HumanInputQuestionContract,
-  SubmitHumanInputResponseRequest
+  SubmitHumanInputResponseRequest,
+  TurnExecutionPolicyV1
 } from "@opengeni/contracts";
 import { environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes3 } from "@opengeni/config";
 import { boundModelToolOutputItem as boundModelToolOutputItem2, isCodexBilledModel } from "@opengeni/codex";
@@ -327,8 +332,21 @@ function sanitizeEventString(value) {
   }
   return out;
 }
-function sanitizeEventPayload(payload) {
-  return sanitizeEventPayloadDeep(boundSessionEventPayload(payload));
+function sanitizeEventPayload(payload, options = {}) {
+  const bounded = boundSessionEventPayload(payload, {
+    fullEvidence: options.fullEvidence
+  });
+  return sanitizeEventPayloadDeep(
+    bounded === payload ? removeProducerTruncationMetadata(bounded) : bounded
+  );
+}
+function removeProducerTruncationMetadata(payload) {
+  if (!isPlainObject(payload)) return payload;
+  const descriptor = Object.getOwnPropertyDescriptor(payload, "truncation");
+  if (!descriptor?.enumerable) return payload;
+  const cleaned = { ...payload };
+  delete cleaned.truncation;
+  return cleaned;
 }
 function sanitizeEventPayloadDeep(payload) {
   if (typeof payload === "string") {
@@ -2478,8 +2496,10 @@ import { sql as sql5 } from "drizzle-orm";
 
 // src/session-queue-commands.ts
 import {
+  metadataWithTurnExecutionPolicyV1,
   mergeResourceRefs,
-  mergeToolRefs
+  mergeToolRefs,
+  turnExecutionPolicyAuditMetadata
 } from "@opengeni/contracts";
 import { and as and4, asc as asc2, eq as eq4, inArray as inArray2, sql as sql3 } from "drizzle-orm";
 var QueueCommandConflictError = class extends Error {
@@ -2684,7 +2704,7 @@ async function normalizeQueuePositions(db, workspaceId, sessionId, orderedIds) {
   }).where(and4(eq4(sessions.workspaceId, workspaceId), eq4(sessions.id, sessionId)));
 }
 function draftIsNonEmpty(draft) {
-  return draft.text.length > 0 || draft.resources.length > 0 || draft.tools.length > 0 || draft.sourceTurnId !== null;
+  return draft.text.length > 0 || draft.resources.length > 0 || draft.tools.length > 0 || draft.toolsProvided || draft.sourceTurnId !== null;
 }
 async function getComposerDraftInTransaction(db, input) {
   const query = db.select().from(composerDrafts).where(
@@ -2725,6 +2745,7 @@ async function saveComposerDraftInTransaction(db, input) {
     text: input.text,
     resources: input.resources,
     tools: input.tools,
+    toolsProvided: input.toolsProvided,
     model: input.model,
     reasoningEffort: input.reasoningEffort,
     // A queue edit is still the same accepted work item. Preserve its frozen
@@ -3024,6 +3045,7 @@ async function editQueuedTurnInTransaction(db, input) {
     text: turn.prompt,
     resources: turn.resources,
     tools: turn.tools,
+    toolsProvided: turn.toolsProvided,
     model: turn.model,
     reasoningEffort: turn.reasoningEffort,
     sourceTurnId: turn.id,
@@ -3290,6 +3312,7 @@ async function submitHumanPromptInTransaction(db, input) {
     turnInstructions: input.turnInstructions ?? null,
     resources: input.resources,
     tools: input.tools,
+    toolsProvided: input.toolsProvided === true,
     model: input.model ?? null,
     reasoningEffort: input.reasoningEffort ?? null,
     source: input.source,
@@ -3373,12 +3396,14 @@ async function submitHumanPromptInTransaction(db, input) {
       text: draft.text,
       resources: draft.resources,
       tools: draft.tools,
+      toolsProvided: draft.toolsProvided,
       model: draft.model,
       reasoningEffort: draft.reasoningEffort
     }) !== canonicalSessionCommandHash({
       text: input.text,
       resources: input.resources,
       tools: input.tools,
+      toolsProvided: input.toolsProvided === true,
       model: input.model ?? session.model,
       reasoningEffort: input.reasoningEffort ?? input.reasoningEffortFallback
     })) {
@@ -3392,6 +3417,33 @@ async function submitHumanPromptInTransaction(db, input) {
       );
     }
   }
+  let editedSourceTurn;
+  let editedSourceTurnInstructions;
+  if (draft?.sourceTurnId) {
+    const sourceLocks = await lockSessionEventWriteRows(db, {
+      workspaceId: input.workspaceId,
+      controlLock: "already_locked",
+      workspaceLock: "already_locked",
+      turnIds: [draft.sourceTurnId]
+    });
+    const sourceTurn = sourceLocks.turns[0];
+    const sourceTurnVersion = draft.sourceTurnVersion;
+    const sourceMetadata = sourceTurn?.metadata ?? {};
+    const sourceIsExactWithdrawnRevision = sourceTurn !== void 0 && sourceTurn.accountId === input.accountId && sourceTurn.workspaceId === input.workspaceId && sourceTurn.sessionId === input.sessionId && (sourceTurn.source === "user" || sourceTurn.source === "api") && sourceTurn.status === "withdrawn_for_edit" && sourceTurnVersion !== null && sourceTurn.version === sourceTurnVersion + 1 && sourceTurn.cancelledBy === input.subjectId && sourceTurn.cancelReason === "withdrawn_for_edit" && sourceTurn.activeAttemptId === null && sourceMetadata.delivery !== "steer";
+    if (!sourceIsExactWithdrawnRevision) {
+      throw new QueueCommandConflictError(
+        "EDIT_SOURCE_CHANGED",
+        "Edited prompt source changed or is no longer withdrawn for edit",
+        {
+          queueVersion: session.queueVersion,
+          draftRevision: draft.revision,
+          ...sourceTurn ? { turnVersion: sourceTurn.version } : {}
+        }
+      );
+    }
+    editedSourceTurn = sourceTurn;
+    editedSourceTurnInstructions = sourceTurn.turnInstructions ?? null;
+  }
   for (const update of input.mcpCredentialUpdates ?? []) {
     const [server] = await db.update(sessionMcpServers).set({
       headersEncrypted: update.headersEncrypted,
@@ -3409,18 +3461,7 @@ async function submitHumanPromptInTransaction(db, input) {
   const now = /* @__PURE__ */ new Date();
   let frozenInitiator;
   if (input.delivery === "send" && draft?.sourceTurnId) {
-    const [sourceTurn] = await db.select({
-      sessionId: sessionTurns.sessionId,
-      initiatorKind: sessionTurns.initiatorKind,
-      initiatorSubjectId: sessionTurns.initiatorSubjectId,
-      initiatorContext: sessionTurns.initiatorContext
-    }).from(sessionTurns).where(
-      and4(
-        eq4(sessionTurns.workspaceId, input.workspaceId),
-        eq4(sessionTurns.sessionId, input.sessionId),
-        eq4(sessionTurns.id, draft.sourceTurnId)
-      )
-    ).limit(1);
+    const sourceTurn = editedSourceTurn;
     if (!sourceTurn) {
       throw new SessionControlInvariantError("Edited prompt source turn is missing");
     }
@@ -3456,7 +3497,7 @@ async function submitHumanPromptInTransaction(db, input) {
       payload: sanitizeEventPayload({
         text: input.text,
         ...input.resources.length ? { resources: input.resources } : {},
-        ...input.tools.length ? { tools: input.tools } : {},
+        ...input.toolsProvided === true ? { tools: input.tools } : input.tools.length ? { tools: input.tools } : {},
         ...input.model ? { model: input.model } : {},
         ...input.reasoningEffort ? { reasoningEffort: input.reasoningEffort } : {},
         delivery: input.delivery,
@@ -3477,13 +3518,14 @@ async function submitHumanPromptInTransaction(db, input) {
     source: input.source,
     position: input.delivery === "steer" ? 0 : existingQueued.length + 1,
     prompt: input.text,
-    turnInstructions: input.turnInstructions ?? null,
+    turnInstructions: editedSourceTurnInstructions !== void 0 ? editedSourceTurnInstructions : input.turnInstructions ?? null,
     resources: input.resources,
     tools: input.tools,
+    toolsProvided: input.toolsProvided === true,
     model: input.model ?? session.model,
     reasoningEffort: input.reasoningEffort ?? input.reasoningEffortFallback,
     sandboxBackend: session.sandboxBackend,
-    metadata: {},
+    metadata: input.turnExecutionPolicy ? metadataWithTurnExecutionPolicyV1({}, input.turnExecutionPolicy) : {},
     lineage: { actor: input.actor.type },
     ...initiatorColumns(frozenInitiator)
   }).returning();
@@ -3527,6 +3569,7 @@ async function submitHumanPromptInTransaction(db, input) {
   if (input.delivery === "steer") {
     await db.update(sessionTurns).set({
       metadata: {
+        ...turn.metadata,
         delivery: "steer",
         replacedTurnId,
         replacedAttemptId,
@@ -3598,7 +3641,7 @@ async function submitHumanPromptInTransaction(db, input) {
   const queueVersion = session.queueVersion + 1;
   await db.update(sessions).set({
     resources: mergeResourceRefs(session.resources, input.resources),
-    tools: mergeToolRefs(session.tools, input.tools),
+    tools: sessionToolPolicyIsFixed(session.toolPolicy) ? session.tools : mergeToolRefs(session.tools, input.tools),
     activeTurnId: input.delivery === "steer" ? liveCurrentTurnId : session.activeTurnId,
     status: nextStatus,
     queueVersion,
@@ -3627,7 +3670,8 @@ async function submitHumanPromptInTransaction(db, input) {
     metadata: {
       operationId: reserved.receipt.id,
       replacedTurnId,
-      interruptionCount
+      interruptionCount,
+      ...input.turnExecutionPolicy ? turnExecutionPolicyAuditMetadata(input.turnExecutionPolicy, turnId) : {}
     }
   });
   const eventIds = eventRows.map((event) => event.id);
@@ -3643,7 +3687,10 @@ async function submitHumanPromptInTransaction(db, input) {
       wakeRevision,
       interruptionCount,
       replacedTurnId,
-      workspaceControlEventId: resumed.workspaceControlEventId
+      workspaceControlEventId: resumed.workspaceControlEventId,
+      ...input.turnExecutionPolicy ? {
+        executionPolicy: turnExecutionPolicyAuditMetadata(input.turnExecutionPolicy, turnId)
+      } : {}
     }
   });
   return {
@@ -3658,6 +3705,11 @@ async function submitHumanPromptInTransaction(db, input) {
     replay: false
   };
 }
+function sessionToolPolicyIsFixed(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const mode = value.mode;
+  return mode === "workspace_default" || mode === "explicit" || mode === "inherited";
+}
 async function sendAgentMessageInTransaction(db, input) {
   const workspaceControl = await lockWorkspaceInferenceControl(db, input.workspaceId, "share");
   await lockSessionEventWriteRows(db, {
@@ -4021,11 +4073,65 @@ import {
   CODEX_REFRESH_FALLBACK_MS,
   CODEX_REFRESH_WINDOW_MS,
   CodexReloginRequired,
+  fetchCodexRateLimitResetCredits,
   fetchCodexUsage,
   normalizeCodexUsage,
   refreshCodexToken
 } from "@opengeni/codex";
 var inflight = /* @__PURE__ */ new Map();
+var CODEX_TOKEN_REFRESH_TIMEOUT_MS = 6e3;
+var systemCodexTokenDeadlineClock = {
+  setTimeout: (callback, delayMs) => globalThis.setTimeout(callback, delayMs),
+  clearTimeout: (handle) => globalThis.clearTimeout(handle)
+};
+async function withCodexTokenDeadline(operation, options = {}) {
+  const timeoutMs = options.timeoutMs ?? CODEX_TOKEN_REFRESH_TIMEOUT_MS;
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    throw new Error("Codex token refresh timeout must be positive");
+  }
+  const clock = options.clock ?? systemCodexTokenDeadlineClock;
+  const signal = options.signal;
+  return await new Promise((resolve, reject) => {
+    let settled = false;
+    let timeout;
+    const cleanup = () => {
+      if (timeout !== void 0) {
+        clock.clearTimeout(timeout);
+        timeout = void 0;
+      }
+      signal?.removeEventListener("abort", onAbort);
+    };
+    const settle = (outcome) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      if (outcome.kind === "resolve") {
+        resolve(outcome.value);
+      } else {
+        reject(outcome.error);
+      }
+    };
+    const onAbort = () => {
+      settle({
+        kind: "reject",
+        error: signal?.reason ?? new Error("Codex token refresh cancelled")
+      });
+    };
+    if (signal?.aborted) {
+      onAbort();
+    } else {
+      signal?.addEventListener("abort", onAbort, { once: true });
+      timeout = clock.setTimeout(
+        () => settle({ kind: "reject", error: new Error("Codex token refresh timed out") }),
+        timeoutMs
+      );
+    }
+    void Promise.resolve(operation).then(
+      (value) => settle({ kind: "resolve", value }),
+      (error) => settle({ kind: "reject", error })
+    );
+  });
+}
 var defaultDeps = {
   loadCredential: loadCodexCredentialForRun,
   recordRefresh: recordCodexTokenRefresh,
@@ -4043,7 +4149,7 @@ function buildCodexTokenResolver(db, settings, workspaceId, credentialId, deps =
   });
   const performRefresh = async (refreshDb, cred) => {
     try {
-      const next = await deps.refresh(cred.tokens.refreshToken);
+      const next = await withCodexTokenDeadline(deps.refresh(cred.tokens.refreshToken));
       const tokens = {
         access_token: next.accessToken ?? cred.tokens.accessToken,
         refresh_token: next.refreshToken ?? cred.tokens.refreshToken,
@@ -4136,10 +4242,11 @@ function errorUsagePayload(reason) {
     weekly: null,
     limitReached: false,
     fetchedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    rateLimitResetCredits: null,
     ...reason ? { reason } : {}
   };
 }
-async function fetchCodexUsageForAccount(db, settings, workspaceId, credentialId) {
+async function fetchCodexUsageForAccount(db, settings, workspaceId, credentialId, fetchImpl = fetch) {
   const resolver = buildCodexTokenResolver(db, settings, workspaceId, credentialId);
   let token;
   try {
@@ -4149,34 +4256,74 @@ async function fetchCodexUsageForAccount(db, settings, workspaceId, credentialId
   }
   let normalized;
   try {
-    const usage = await fetchCodexUsage({
-      accessToken: token.accessToken,
-      chatgptAccountId: token.chatgptAccountId,
-      isFedramp: token.isFedramp,
-      clientVersion: CODEX_CLIENT_VERSION
-    });
+    const usage = await fetchCodexUsage(
+      {
+        accessToken: token.accessToken,
+        chatgptAccountId: token.chatgptAccountId,
+        isFedramp: token.isFedramp,
+        clientVersion: CODEX_CLIENT_VERSION
+      },
+      fetchImpl
+    );
     normalized = normalizeCodexUsage(usage.status, usage.payload);
   } catch {
     return errorUsagePayload();
   }
-  if (normalized.fiveHour || normalized.weekly) {
+  const parsedQuota = normalized.status !== "error" && (normalized.fiveHour != null || normalized.weekly != null);
+  if (parsedQuota || normalized.rateLimitResetCredits) {
+    const checkedAt = /* @__PURE__ */ new Date();
     await recordCodexAccountUsage(db, workspaceId, credentialId, {
-      primaryUsedPercent: normalized.fiveHour?.percent ?? null,
-      primaryResetAt: normalized.fiveHour?.resetAt ? new Date(normalized.fiveHour.resetAt) : null,
-      secondaryUsedPercent: normalized.weekly?.percent ?? null,
-      secondaryResetAt: normalized.weekly?.resetAt ? new Date(normalized.weekly.resetAt) : null,
-      checkedAt: /* @__PURE__ */ new Date()
+      ...parsedQuota ? {
+        primaryUsedPercent: normalized.fiveHour?.percent ?? null,
+        primaryResetAt: normalized.fiveHour?.resetAt ? new Date(normalized.fiveHour.resetAt) : null,
+        secondaryUsedPercent: normalized.weekly?.percent ?? null,
+        secondaryResetAt: normalized.weekly?.resetAt ? new Date(normalized.weekly.resetAt) : null,
+        checkedAt
+      } : {},
+      ...normalized.rateLimitResetCredits ? {
+        resetCreditAvailableCount: normalized.rateLimitResetCredits.availableCount,
+        resetCreditsCheckedAt: checkedAt
+      } : {}
     }).catch(() => void 0);
   }
   return normalized;
 }
+async function fetchCodexRateLimitResetCreditsForAccount(db, settings, workspaceId, credentialId, fetchImpl = fetch) {
+  const resolver = buildCodexTokenResolver(db, settings, workspaceId, credentialId);
+  let token;
+  try {
+    token = await resolver.getToken();
+  } catch (error) {
+    return {
+      ok: false,
+      status: 0,
+      reason: error instanceof CodexReloginRequired ? "needs_relogin" : "network_error"
+    };
+  }
+  return await fetchCodexRateLimitResetCredits(
+    {
+      accessToken: token.accessToken,
+      chatgptAccountId: token.chatgptAccountId,
+      isFedramp: token.isFedramp,
+      clientVersion: CODEX_CLIENT_VERSION
+    },
+    fetchImpl
+  );
+}
 
 // src/connection-token-resolver.ts
 import {
   environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes2
 } from "@opengeni/config";
+import {
+  OAUTH_MAX_RESPONSE_BYTES,
+  pinnedFetch,
+  readResponseJsonBounded,
+  undiciFetch,
+  validateHttpUrl
+} from "@opengeni/network";
+import { isPrivateAddress } from "@opengeni/network";
 import { Buffer as Buffer2 } from "buffer";
-import { lookup } from "dns/promises";
 import { isIP } from "net";
 var HostMcpCredentialScopeError = class extends Error {
   constructor(field) {
@@ -4195,6 +4342,10 @@ function buildHostConnectionTokenResolver(resolve, context) {
     if (input.workspaceId !== context.workspaceId) {
       throw new HostMcpCredentialScopeError("workspaceId");
     }
+    const destinationUrl = canonicalHttpUrl(input.destinationUrl);
+    if (!destinationUrl || !destinationHostMatchesProvider(destinationUrl, input.connectionRef.providerDomain)) {
+      throw new HostMcpCredentialBindingError("destinationUrl");
+    }
     const toolName = input.toolName ?? input.toolId;
     const request = {
       accountId: context.accountId,
@@ -4207,6 +4358,7 @@ function buildHostConnectionTokenResolver(resolve, context) {
       initiator: context.initiator,
       initiatorContext: { ...context.initiatorContext },
       surface: context.surface,
+      destinationUrl,
       serverId: input.serverId,
       connectionRef: {
         providerDomain: input.connectionRef.providerDomain,
@@ -4384,10 +4536,13 @@ function buildConnectionTokenResolver(db, settings, deps = defaultDeps2) {
     }
     return deps.loadCredential(db, settings, request);
   };
-  const snapshot = async (cred, ref) => {
+  const snapshot = async (cred, ref, destinationUrl) => {
     if (cred.status !== "active") {
       return authNeededForStatus(cred, ref);
     }
+    if (!connectionBindingMatches(cred, ref, destinationUrl)) {
+      return authNeeded(ref, "missing_connection", cred.id);
+    }
     const missingScopes = missingRequestedScopes(ref.scopes, cred.grantedScopes);
     if (missingScopes.length > 0) {
       return {
@@ -4443,7 +4598,6 @@ function buildConnectionTokenResolver(db, settings, deps = defaultDeps2) {
     if (persisted) {
       const current = await load({
         workspaceId: cred.workspaceId,
-        serverId: "",
         connectionRef: { ...ref, connectionId: cred.id }
       });
       if (current) {
@@ -4452,7 +4606,6 @@ function buildConnectionTokenResolver(db, settings, deps = defaultDeps2) {
     }
     const winner = await load({
       workspaceId: cred.workspaceId,
-      serverId: "",
       connectionRef: { ...ref, connectionId: cred.id }
     });
     if (winner?.status === "active") {
@@ -4491,6 +4644,9 @@ function buildConnectionTokenResolver(db, settings, deps = defaultDeps2) {
     if (cred.status !== "active") {
       return authNeededForStatus(cred, ref);
     }
+    if (!connectionBindingMatches(cred, ref, input.destinationUrl)) {
+      return authNeeded(ref, "missing_connection", cred.id);
+    }
     if (shouldRefresh(cred, input.forceRefresh === true, deps.now())) {
       try {
         cred = await refreshSingleFlight(cred, ref);
@@ -4510,9 +4666,54 @@ function buildConnectionTokenResolver(db, settings, deps = defaultDeps2) {
         return authNeeded(ref, "refresh_failed", cred.id);
       }
     }
-    return await snapshot(cred, ref);
+    return await snapshot(cred, ref, input.destinationUrl);
   };
 }
+function connectionBindingMatches(cred, ref, destinationUrl) {
+  if (cred.providerDomain.toLowerCase() !== ref.providerDomain.toLowerCase()) return false;
+  if (ref.kind && cred.kind !== ref.kind) return false;
+  const credential = cred.credential;
+  const metadata = cred.metadata;
+  const boundMcpUrl = stringValue(credential.mcp_url) ?? stringValue(metadata.mcpUrl);
+  const destination = canonicalHttpUrl(destinationUrl);
+  if (!destination) return false;
+  if (boundMcpUrl) {
+    const binding = canonicalHttpUrl(boundMcpUrl);
+    if (!binding || destination !== binding) return false;
+  } else if (!destinationHostMatchesProvider(destination, cred.providerDomain)) {
+    return false;
+  }
+  if (cred.kind !== "oauth2") return true;
+  const boundResource = stringValue(credential.resource) ?? stringValue(metadata.resource);
+  if (ref.resource) {
+    if (!boundResource) return false;
+    if (canonicalResource(ref.resource) !== canonicalResource(boundResource)) return false;
+  }
+  return true;
+}
+function destinationHostMatchesProvider(destinationUrl, providerDomain) {
+  const destinationHost = new URL(destinationUrl).hostname.toLowerCase();
+  const provider = providerDomain.trim().toLowerCase().replace(/^\.+|\.+$/g, "");
+  return Boolean(provider) && (destinationHost === provider || destinationHost.endsWith(`.${provider}`));
+}
+function canonicalHttpUrl(value) {
+  try {
+    const url = new URL(value);
+    if (url.protocol !== "http:" && url.protocol !== "https:") return null;
+    url.hash = "";
+    url.hostname = url.hostname.toLowerCase();
+    if (url.protocol === "https:" && url.port === "443" || url.protocol === "http:" && url.port === "80") {
+      url.port = "";
+    }
+    url.pathname = url.pathname.replace(/\/+$/, "") || "/";
+    return url.toString();
+  } catch {
+    return null;
+  }
+}
+function canonicalResource(value) {
+  return canonicalHttpUrl(value) ?? value.trim();
+}
 var ConnectionRefreshHttpError = class extends Error {
   httpStatus;
   constructor(httpStatus) {
@@ -4583,7 +4784,7 @@ function headersForCredential(cred) {
   }
   return stringRecord(cred.credential.headers);
 }
-async function refreshOAuthConnectionCredential(cred, ref, settings) {
+async function refreshOAuthConnectionCredential(cred, ref, settings, transportOptions = {}) {
   if (cred.kind !== "oauth2") {
     return {
       credential: cred.credential,
@@ -4596,8 +4797,14 @@ async function refreshOAuthConnectionCredential(cred, ref, settings) {
   if (!refreshToken || !tokenEndpoint) {
     throw new Error("connection has no refresh token endpoint");
   }
-  if (settings) {
-    await assertOAuthEndpointAllowed(tokenEndpoint, settings);
+  let validatedTokenEndpoint;
+  try {
+    validatedTokenEndpoint = validateHttpUrl(tokenEndpoint, {
+      label: "OAuth refresh token endpoint",
+      allowLoopbackHttp: settings.environment === "local" || settings.environment === "test"
+    });
+  } catch {
+    throw new Error("connection has an invalid refresh token endpoint");
   }
   const body = new URLSearchParams();
   body.set("grant_type", "refresh_token");
@@ -4623,20 +4830,35 @@ async function refreshOAuthConnectionCredential(cred, ref, settings) {
   if (ref.scopes?.length) {
     body.set("scope", ref.scopes.join(" "));
   }
-  const response = await fetch(tokenEndpoint, {
-    method: "POST",
-    headers,
-    body,
-    redirect: "manual",
-    signal: AbortSignal.timeout(CONNECTION_REFRESH_TIMEOUT_MS)
-  });
+  const response = await pinnedFetch(
+    validatedTokenEndpoint,
+    {
+      method: "POST",
+      headers,
+      body,
+      signal: AbortSignal.timeout(CONNECTION_REFRESH_TIMEOUT_MS)
+    },
+    settings,
+    {
+      fetchImpl: transportOptions.fetchImpl ?? undiciFetch,
+      ...transportOptions.dnsLookup ? { dnsLookup: transportOptions.dnsLookup } : {},
+      label: "OAuth token endpoint",
+      requireHttpsOutsideLocalTest: true
+    }
+  );
   if (response.status >= 300 && response.status < 400) {
+    await cancelResponseBody(response);
     throw new ConnectionRefreshHttpError(response.status);
   }
   if (!response.ok) {
+    await cancelResponseBody(response);
     throw new ConnectionRefreshHttpError(response.status);
   }
-  const payload = await response.json();
+  const payload = await readResponseJsonBounded(
+    response,
+    OAUTH_MAX_RESPONSE_BYTES,
+    "OAuth refresh token response"
+  );
   const accessToken = stringValue(payload.access_token);
   if (!accessToken) {
     throw new Error("connection refresh response did not include access_token");
@@ -4687,74 +4909,8 @@ function stringRecord(value) {
 function stringValue(value) {
   return typeof value === "string" && value.length > 0 ? value : void 0;
 }
-async function assertOAuthEndpointAllowed(rawUrl, settings) {
-  if (settings.integrationsAllowPrivateNetworkTargets || ["local", "test"].includes(settings.environment)) {
-    return;
-  }
-  const url = new URL(rawUrl);
-  if (url.protocol !== "https:") {
-    throw new Error("OAuth token endpoint must use https outside local/test");
-  }
-  const hostname = url.hostname.toLowerCase();
-  if (hostname === "localhost" || hostname.endsWith(".localhost")) {
-    throw new Error("OAuth token endpoint may not target localhost");
-  }
-  const literal = isIP(hostname);
-  const addresses = literal ? [hostname] : (await lookup(hostname, { all: true })).map((entry) => entry.address);
-  if (addresses.some(isPrivateAddress)) {
-    throw new Error("OAuth token endpoint may not target a private network address");
-  }
-}
-function isPrivateAddress(address) {
-  const normalized = normalizeAddress(address);
-  const mapped = ipv4FromMappedIpv6(normalized);
-  if (mapped) {
-    return isPrivateIpv4Address(mapped);
-  }
-  if (normalized.includes(":")) {
-    if (isIP(normalized) !== 6) {
-      return true;
-    }
-    return normalized === "::1" || normalized === "::" || normalized.startsWith("fc") || normalized.startsWith("fd") || normalized.startsWith("fe8") || normalized.startsWith("fe9") || normalized.startsWith("fea") || normalized.startsWith("feb");
-  }
-  return isPrivateIpv4Address(normalized);
-}
-function normalizeAddress(address) {
-  const trimmed = address.trim().toLowerCase();
-  if (trimmed.startsWith("[") && trimmed.endsWith("]")) {
-    return trimmed.slice(1, -1);
-  }
-  return trimmed;
-}
-function ipv4FromMappedIpv6(address) {
-  if (!address.startsWith("::ffff:")) {
-    return null;
-  }
-  const embedded = address.slice("::ffff:".length);
-  if (embedded.includes(".")) {
-    return embedded;
-  }
-  const parts = embedded.split(":");
-  if (parts.length !== 2 || parts.some((part) => !/^[0-9a-f]{1,4}$/.test(part))) {
-    return null;
-  }
-  const high = Number.parseInt(parts[0], 16);
-  const low = Number.parseInt(parts[1], 16);
-  if (!Number.isInteger(high) || !Number.isInteger(low) || high < 0 || high > 65535 || low < 0 || low > 65535) {
-    return null;
-  }
-  return `${high >> 8 & 255}.${high & 255}.${low >> 8 & 255}.${low & 255}`;
-}
-function isPrivateIpv4Address(address) {
-  if (isIP(address) !== 4) {
-    return true;
-  }
-  const parts = address.split(".").map((part) => Number(part));
-  if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
-    return true;
-  }
-  const [a, b] = parts;
-  return a === 0 || a === 10 || a === 127 || a === 169 && b === 254 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168;
+async function cancelResponseBody(response) {
+  await response.body?.cancel().catch(() => void 0);
 }
 
 // src/index.ts
@@ -6171,6 +6327,27 @@ async function requireFile(db, workspaceId, fileId) {
   }
   return file;
 }
+async function getRetainedFileArtifact(db, workspaceId, fileId) {
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const [row] = await scopedDb.select({
+      file: files,
+      uploadStatus: fileUploads.status,
+      uploadExpiresAt: fileUploads.expiresAt
+    }).from(files).leftJoin(
+      fileUploads,
+      and5(
+        eq5(fileUploads.workspaceId, files.workspaceId),
+        eq5(fileUploads.fileId, files.id)
+      )
+    ).where(and5(eq5(files.workspaceId, workspaceId), eq5(files.id, fileId))).orderBy(desc(fileUploads.createdAt)).limit(1);
+    if (!row) return null;
+    return {
+      file: mapFile(row.file),
+      uploadStatus: row.uploadStatus,
+      uploadExpiresAt: row.uploadExpiresAt
+    };
+  });
+}
 async function getFileUpload(db, workspaceId, uploadId) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
     const [row] = await scopedDb.select({
@@ -6728,7 +6905,14 @@ async function listCapabilityCatalogItems(db, workspaceId) {
         )
       )
     ).orderBy(asc3(capabilityCatalogItems.kind), asc3(capabilityCatalogItems.name));
-    return rows.map(mapCapabilityCatalogItem);
+    const installations = await scopedDb.select().from(capabilityInstallations).where(eq5(capabilityInstallations.workspaceId, workspaceId));
+    const installationByCapabilityId = new Map(
+      installations.map((installation) => [installation.capabilityId, installation])
+    );
+    return rows.flatMap((row) => {
+      const exposure = catalogExposureState(row, installationByCapabilityId.get(row.id) ?? null);
+      return exposure === "blocked" ? [] : [mapCapabilityCatalogItem(row, exposure)];
+    });
   });
 }
 async function getCapabilityCatalogItem(db, workspaceId, capabilityId) {
@@ -6742,7 +6926,17 @@ async function getCapabilityCatalogItem(db, workspaceId, capabilityId) {
         )
       )
     ).orderBy(asc3(sql4`(${capabilityCatalogItems.workspaceId} is null)`)).limit(1);
-    return row ? mapCapabilityCatalogItem(row) : null;
+    if (!row) {
+      return null;
+    }
+    const [installation] = await scopedDb.select().from(capabilityInstallations).where(
+      and5(
+        eq5(capabilityInstallations.workspaceId, workspaceId),
+        eq5(capabilityInstallations.capabilityId, capabilityId)
+      )
+    ).limit(1);
+    const exposure = catalogExposureState(row, installation ?? null);
+    return exposure === "blocked" ? null : mapCapabilityCatalogItem(row, exposure);
   });
 }
 async function enableCapabilityInstallation(db, input) {
@@ -6862,7 +7056,7 @@ async function listEnabledMcpCapabilityServers(db, workspaceId) {
     }
   }
   return [...preferredByInstallation.values()].flatMap(({ item, installation }) => {
-    if (!item.endpointUrl || !mcpConnectivityOk(installation.metadata)) {
+    if (catalogExposureState(item, installation) === "blocked" || !item.endpointUrl || !mcpConnectivityOk(installation.metadata)) {
       return [];
     }
     const headersEncrypted = encryptedHeadersConfig(installation.config.headersEncrypted);
@@ -9403,6 +9597,30 @@ async function upsertCodexSubscriptionCredential(db, input) {
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
     async (scopedDb) => {
+      await scopedDb.execute(
+        sql4`select pg_advisory_xact_lock(hashtextextended(${`codex-credential-upsert:${input.workspaceId}:${input.chatgptAccountId ?? "null"}`}, 0))`
+      );
+      const [existing] = input.chatgptAccountId ? await scopedDb.select({
+        id: codexSubscriptionCredentials.id,
+        connectedBySubjectId: codexSubscriptionCredentials.connectedBySubjectId
+      }).from(codexSubscriptionCredentials).where(
+        and5(
+          eq5(codexSubscriptionCredentials.workspaceId, input.workspaceId),
+          eq5(codexSubscriptionCredentials.chatgptAccountId, input.chatgptAccountId)
+        )
+      ).for("update").limit(1) : [];
+      if (existing && existing.connectedBySubjectId !== (input.connectedBySubjectId ?? null)) {
+        const [unresolved] = await scopedDb.select({ id: codexResetRedemptionAttempts.id }).from(codexResetRedemptionAttempts).where(
+          and5(
+            eq5(codexResetRedemptionAttempts.workspaceId, input.workspaceId),
+            eq5(codexResetRedemptionAttempts.credentialId, existing.id),
+            eq5(codexResetRedemptionAttempts.status, "provider_started")
+          )
+        ).limit(1);
+        if (unresolved) {
+          return { kind: "unresolved_redemption", id: existing.id, isNew: false };
+        }
+      }
       const now = /* @__PURE__ */ new Date();
       const [row] = await scopedDb.insert(codexSubscriptionCredentials).values({
         accountId: input.accountId,
@@ -9416,6 +9634,7 @@ async function upsertCodexSubscriptionCredential(db, input) {
         lastRefreshAt: input.lastRefreshAt,
         accountEmail: input.accountEmail ?? null,
         label: input.label ?? null,
+        connectedBySubjectId: input.connectedBySubjectId ?? null,
         status: "active",
         lastError: null
       }).onConflictDoUpdate({
@@ -9443,6 +9662,11 @@ async function upsertCodexSubscriptionCredential(db, input) {
           // it when still null) so a re-connect never clobbers a rename.
           accountEmail: input.accountEmail ?? null,
           label: sql4`coalesce(${codexSubscriptionCredentials.label}, ${input.label ?? null})`,
+          // Ownership follows the most recent connection exactly. A
+          // configured/delegated/API-key reconnect is intentionally
+          // nonhuman and clears the prior human owner, making the row
+          // view-only until a direct managed-cookie human reconnects it.
+          connectedBySubjectId: input.connectedBySubjectId ?? null,
           status: "active",
           lastError: null,
           version: sql4`${codexSubscriptionCredentials.version} + 1`,
@@ -9457,7 +9681,7 @@ async function upsertCodexSubscriptionCredential(db, input) {
         throw new Error("upsertCodexSubscriptionCredential returned no row");
       }
       const isNew = row.createdAt.getTime() === row.updatedAt.getTime();
-      return { id: row.id, isNew };
+      return { kind: "upserted", id: row.id, isNew };
     }
   );
 }
@@ -10766,6 +10990,12 @@ async function listCodexAccountStatuses(db, workspaceId) {
       planType: codexSubscriptionCredentials.planType,
       status: codexSubscriptionCredentials.status,
       allocatorEnabled: codexSubscriptionCredentials.allocatorEnabled,
+      allocatorVersion: codexSubscriptionCredentials.allocatorVersion,
+      allocatorUpdatedBySubjectId: codexSubscriptionCredentials.allocatorUpdatedBySubjectId,
+      allocatorUpdatedAt: codexSubscriptionCredentials.allocatorUpdatedAt,
+      resetCreditAvailableCount: codexSubscriptionCredentials.resetCreditAvailableCount,
+      resetCreditsCheckedAt: codexSubscriptionCredentials.resetCreditsCheckedAt,
+      connectedBySubjectId: codexSubscriptionCredentials.connectedBySubjectId,
       expiresAt: codexSubscriptionCredentials.expiresAt,
       lastRefreshAt: codexSubscriptionCredentials.lastRefreshAt,
       lastError: codexSubscriptionCredentials.lastError,
@@ -10787,6 +11017,8 @@ async function listCodexAccountStatuses(db, workspaceId) {
       ...row,
       expiresAt: codexMetadataDate(row.expiresAt),
       lastRefreshAt: codexMetadataDate(row.lastRefreshAt),
+      allocatorUpdatedAt: codexMetadataDate(row.allocatorUpdatedAt),
+      resetCreditsCheckedAt: codexMetadataDate(row.resetCreditsCheckedAt),
       primaryResetAt: codexMetadataDate(row.primaryResetAt),
       secondaryResetAt: codexMetadataDate(row.secondaryResetAt),
       usageCheckedAt: codexMetadataDate(row.usageCheckedAt),
@@ -10796,6 +11028,519 @@ async function listCodexAccountStatuses(db, workspaceId) {
     }));
   });
 }
+async function updateCodexAllocatorEligibility(db, input) {
+  return await withCodexCapacityMutation(
+    db,
+    { workspaceId: input.workspaceId, reason: "codex_allocator_eligibility_changed" },
+    async (tx) => {
+      const [row] = await tx.select({
+        allocatorEnabled: codexSubscriptionCredentials.allocatorEnabled,
+        allocatorVersion: codexSubscriptionCredentials.allocatorVersion,
+        allocatorUpdatedBySubjectId: codexSubscriptionCredentials.allocatorUpdatedBySubjectId,
+        allocatorUpdatedAt: codexSubscriptionCredentials.allocatorUpdatedAt
+      }).from(codexSubscriptionCredentials).where(
+        and5(
+          eq5(codexSubscriptionCredentials.accountId, input.accountId),
+          eq5(codexSubscriptionCredentials.workspaceId, input.workspaceId),
+          eq5(codexSubscriptionCredentials.id, input.credentialId)
+        )
+      ).for("update").limit(1);
+      if (!row) return { result: { kind: "not_found" }, changed: false };
+      const current = {
+        allocatorEnabled: row.allocatorEnabled,
+        allocatorVersion: row.allocatorVersion,
+        allocatorUpdatedBySubjectId: row.allocatorUpdatedBySubjectId,
+        allocatorUpdatedAt: codexMetadataDate(row.allocatorUpdatedAt)
+      };
+      if (row.allocatorEnabled === input.enabled) {
+        return { result: { kind: "unchanged", ...current }, changed: false };
+      }
+      if (row.allocatorVersion !== input.expectedVersion) {
+        return { result: { kind: "conflict", ...current }, changed: false };
+      }
+      const changedAt = /* @__PURE__ */ new Date();
+      const [updated] = await tx.update(codexSubscriptionCredentials).set({
+        allocatorEnabled: input.enabled,
+        allocatorVersion: sql4`${codexSubscriptionCredentials.allocatorVersion} + 1`,
+        allocatorUpdatedBySubjectId: input.subjectId,
+        allocatorUpdatedAt: changedAt
+        // Deliberately no credential version/updatedAt write.
+      }).where(
+        and5(
+          eq5(codexSubscriptionCredentials.accountId, input.accountId),
+          eq5(codexSubscriptionCredentials.workspaceId, input.workspaceId),
+          eq5(codexSubscriptionCredentials.id, input.credentialId),
+          eq5(codexSubscriptionCredentials.allocatorVersion, input.expectedVersion)
+        )
+      ).returning({
+        allocatorEnabled: codexSubscriptionCredentials.allocatorEnabled,
+        allocatorVersion: codexSubscriptionCredentials.allocatorVersion,
+        allocatorUpdatedBySubjectId: codexSubscriptionCredentials.allocatorUpdatedBySubjectId,
+        allocatorUpdatedAt: codexSubscriptionCredentials.allocatorUpdatedAt
+      });
+      if (!updated) {
+        throw new Error("Codex allocator row changed while locked");
+      }
+      await tx.insert(auditEvents).values({
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        subjectId: input.subjectId,
+        action: "codex.allocator.updated",
+        targetType: "codex_subscription_credential",
+        targetId: input.credentialId,
+        metadata: {
+          allocatorEnabled: updated.allocatorEnabled,
+          allocatorVersion: updated.allocatorVersion
+        }
+      });
+      return {
+        result: {
+          kind: "updated",
+          allocatorEnabled: updated.allocatorEnabled,
+          allocatorVersion: updated.allocatorVersion,
+          allocatorUpdatedBySubjectId: updated.allocatorUpdatedBySubjectId,
+          allocatorUpdatedAt: codexMetadataDate(updated.allocatorUpdatedAt)
+        },
+        changed: true
+      };
+    }
+  );
+}
+var CODEX_RESET_REDEMPTION_OUTCOMES = [
+  "reset",
+  "nothingToReset",
+  "noCredit",
+  "alreadyRedeemed"
+];
+function mapCodexResetRedemptionAttempt(row) {
+  return {
+    id: row.id,
+    accountId: row.accountId,
+    workspaceId: row.workspaceId,
+    credentialId: row.credentialId,
+    subjectId: row.subjectId,
+    browserSessionHash: row.browserSessionHash,
+    creditId: row.creditId,
+    upstreamIdempotencyKey: row.upstreamIdempotencyKey,
+    status: row.status,
+    outcome: row.outcome,
+    claimHolderId: row.claimHolderId,
+    claimExpiresAt: codexMetadataDate(row.claimExpiresAt),
+    confirmationExpiresAt: codexMetadataDate(row.confirmationExpiresAt),
+    providerStartedAt: codexMetadataDate(row.providerStartedAt),
+    completedAt: codexMetadataDate(row.completedAt),
+    lastFailureKind: row.lastFailureKind,
+    retryCount: row.retryCount,
+    createdAt: codexMetadataDate(row.createdAt),
+    updatedAt: codexMetadataDate(row.updatedAt)
+  };
+}
+async function getCodexResetRedemptionAttempt(db, workspaceId, attemptId) {
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const [row] = await scopedDb.select().from(codexResetRedemptionAttempts).where(
+      and5(
+        eq5(codexResetRedemptionAttempts.workspaceId, workspaceId),
+        eq5(codexResetRedemptionAttempts.id, attemptId)
+      )
+    ).limit(1);
+    return row ? mapCodexResetRedemptionAttempt(row) : null;
+  });
+}
+async function listCodexResetRedemptionRecoveries(db, input) {
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      const rows = await scopedDb.select({
+        attemptId: codexResetRedemptionAttempts.id,
+        credentialId: codexResetRedemptionAttempts.credentialId,
+        creditId: codexResetRedemptionAttempts.creditId,
+        status: codexResetRedemptionAttempts.status,
+        outcome: codexResetRedemptionAttempts.outcome,
+        providerStartedAt: codexResetRedemptionAttempts.providerStartedAt,
+        completedAt: codexResetRedemptionAttempts.completedAt,
+        createdAt: codexResetRedemptionAttempts.createdAt,
+        updatedAt: codexResetRedemptionAttempts.updatedAt
+      }).from(codexResetRedemptionAttempts).innerJoin(
+        codexSubscriptionCredentials,
+        and5(
+          eq5(
+            codexSubscriptionCredentials.id,
+            codexResetRedemptionAttempts.credentialId
+          ),
+          eq5(
+            codexSubscriptionCredentials.workspaceId,
+            codexResetRedemptionAttempts.workspaceId
+          )
+        )
+      ).where(
+        and5(
+          eq5(codexResetRedemptionAttempts.workspaceId, input.workspaceId),
+          eq5(codexResetRedemptionAttempts.subjectId, input.subjectId),
+          eq5(codexSubscriptionCredentials.connectedBySubjectId, input.subjectId),
+          inArray3(codexResetRedemptionAttempts.status, ["provider_started", "completed"])
+        )
+      ).orderBy(desc(codexResetRedemptionAttempts.createdAt));
+      return rows.map((row) => ({
+        attemptId: row.attemptId,
+        credentialId: row.credentialId,
+        creditId: row.creditId,
+        status: row.status,
+        outcome: row.outcome,
+        providerStartedAt: codexMetadataDate(row.providerStartedAt),
+        completedAt: codexMetadataDate(row.completedAt),
+        createdAt: codexMetadataDate(row.createdAt),
+        updatedAt: codexMetadataDate(row.updatedAt)
+      }));
+    }
+  );
+}
+async function adoptCodexResetRedemptionAttempt(db, input) {
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => await scopedDb.transaction(async (tx) => {
+      const [credential] = await tx.select({
+        connectedBySubjectId: codexSubscriptionCredentials.connectedBySubjectId
+      }).from(codexSubscriptionCredentials).where(
+        and5(
+          eq5(codexSubscriptionCredentials.id, input.credentialId),
+          eq5(codexSubscriptionCredentials.workspaceId, input.workspaceId)
+        )
+      ).for("share").limit(1);
+      if (!credential) return { kind: "not_found" };
+      if (credential.connectedBySubjectId !== input.subjectId) {
+        return { kind: "forbidden" };
+      }
+      const [attempt] = await tx.select().from(codexResetRedemptionAttempts).where(
+        and5(
+          eq5(codexResetRedemptionAttempts.workspaceId, input.workspaceId),
+          eq5(codexResetRedemptionAttempts.id, input.attemptId)
+        )
+      ).for("update").limit(1);
+      if (!attempt) return { kind: "not_found" };
+      if (attempt.accountId !== input.accountId || attempt.credentialId !== input.credentialId || attempt.creditId !== input.creditId || attempt.subjectId !== input.subjectId) {
+        return { kind: "conflict" };
+      }
+      if (attempt.browserSessionHash === input.browserSessionHash) {
+        return { kind: "current", attempt: mapCodexResetRedemptionAttempt(attempt) };
+      }
+      if (attempt.status !== "provider_started" && attempt.status !== "completed") {
+        return { kind: "conflict" };
+      }
+      const claim = await tx.execute(sql4`
+          select claim_expires_at > now() as claim_live
+          from codex_reset_redemption_attempts
+          where workspace_id = ${input.workspaceId} and id = ${input.attemptId}
+        `);
+      if (claim[0]?.claim_live) return { kind: "in_progress" };
+      const [adopted] = await tx.update(codexResetRedemptionAttempts).set({
+        browserSessionHash: input.browserSessionHash,
+        claimHolderId: null,
+        claimExpiresAt: null,
+        updatedAt: sql4`now()`
+      }).where(eq5(codexResetRedemptionAttempts.id, input.attemptId)).returning();
+      if (!adopted) throw new Error("Codex redemption adoption returned no row");
+      return { kind: "adopted", attempt: mapCodexResetRedemptionAttempt(adopted) };
+    })
+  );
+}
+async function claimCodexResetRedemption(db, input) {
+  const claimTtlMs = input.claimTtlMs ?? 6e4;
+  if (!Number.isFinite(claimTtlMs) || claimTtlMs <= 0) {
+    throw new Error("Codex redemption claim TTL must be positive");
+  }
+  if (!Number.isFinite(input.confirmationExpiresAt.getTime()) || input.confirmationExpiresAt.getTime() <= Date.now()) {
+    return { kind: "forbidden" };
+  }
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => await scopedDb.transaction(async (tx) => {
+      await tx.execute(
+        sql4`select pg_advisory_xact_lock(hashtextextended(${`codex-reset-attempt:${input.id}`}, 0))`
+      );
+      await tx.execute(
+        sql4`select pg_advisory_xact_lock(hashtextextended(${`codex-reset-credit:${input.workspaceId}:${input.credentialId}:${input.creditId}`}, 0))`
+      );
+      const [credential] = await tx.select({
+        connectedBySubjectId: codexSubscriptionCredentials.connectedBySubjectId,
+        status: codexSubscriptionCredentials.status
+      }).from(codexSubscriptionCredentials).where(
+        and5(
+          eq5(codexSubscriptionCredentials.accountId, input.accountId),
+          eq5(codexSubscriptionCredentials.workspaceId, input.workspaceId),
+          eq5(codexSubscriptionCredentials.id, input.credentialId)
+        )
+      ).for("share").limit(1);
+      if (!credential) return { kind: "not_found" };
+      const [existing] = await tx.select().from(codexResetRedemptionAttempts).where(
+        and5(
+          eq5(codexResetRedemptionAttempts.workspaceId, input.workspaceId),
+          eq5(codexResetRedemptionAttempts.id, input.id)
+        )
+      ).for("update").limit(1);
+      const now = /* @__PURE__ */ new Date();
+      if (existing) {
+        if (existing.accountId !== input.accountId || existing.credentialId !== input.credentialId || existing.subjectId !== input.subjectId || existing.browserSessionHash !== input.browserSessionHash || existing.creditId !== input.creditId) {
+          return { kind: "conflict" };
+        }
+        if (credential.connectedBySubjectId !== input.subjectId) {
+          return { kind: "forbidden" };
+        }
+        const mapped = mapCodexResetRedemptionAttempt(existing);
+        if (mapped.status === "completed") return { kind: "completed", attempt: mapped };
+        if (credential.status !== "active") {
+          return { kind: "forbidden" };
+        }
+        const claimState = await tx.execute(sql4`
+            select claim_expires_at > now() as claim_live
+            from codex_reset_redemption_attempts
+            where workspace_id = ${input.workspaceId} and id = ${input.id}
+          `);
+        if (claimState[0]?.claim_live) {
+          return { kind: "in_progress", attempt: mapped };
+        }
+        const [reclaimed] = await tx.update(codexResetRedemptionAttempts).set({
+          claimHolderId: input.claimHolderId,
+          claimExpiresAt: sql4`now() + (${claimTtlMs} * interval '1 millisecond')`,
+          confirmationExpiresAt: input.confirmationExpiresAt,
+          lastFailureKind: null,
+          retryCount: sql4`${codexResetRedemptionAttempts.retryCount} + 1`,
+          updatedAt: now
+        }).where(eq5(codexResetRedemptionAttempts.id, input.id)).returning();
+        if (!reclaimed) throw new Error("Codex redemption reclaim returned no row");
+        return {
+          kind: "claimed",
+          attempt: mapCodexResetRedemptionAttempt(reclaimed)
+        };
+      }
+      if (credential.status !== "active" || credential.connectedBySubjectId !== input.subjectId) {
+        return { kind: "forbidden" };
+      }
+      const [creditAttempt] = await tx.execute(sql4`
+          select id, status, claim_expires_at > now() as claim_live
+          from codex_reset_redemption_attempts
+          where workspace_id = ${input.workspaceId}
+            and credential_id = ${input.credentialId}
+            and credit_id = ${input.creditId}
+            and (status <> 'completed' or outcome in ('reset', 'alreadyRedeemed'))
+          limit 1
+          for update
+        `);
+      if (creditAttempt) {
+        if (creditAttempt.status !== "processing" || creditAttempt.claim_live) {
+          return { kind: "conflict" };
+        }
+        const removed = await tx.delete(codexResetRedemptionAttempts).where(
+          and5(
+            eq5(codexResetRedemptionAttempts.workspaceId, input.workspaceId),
+            eq5(codexResetRedemptionAttempts.id, creditAttempt.id),
+            eq5(codexResetRedemptionAttempts.status, "processing"),
+            sql4`(${codexResetRedemptionAttempts.claimExpiresAt} is null or ${codexResetRedemptionAttempts.claimExpiresAt} <= now())`
+          )
+        ).returning({ id: codexResetRedemptionAttempts.id });
+        if (removed.length !== 1) return { kind: "conflict" };
+      }
+      const [created] = await tx.insert(codexResetRedemptionAttempts).values({
+        id: input.id,
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        credentialId: input.credentialId,
+        subjectId: input.subjectId,
+        browserSessionHash: input.browserSessionHash,
+        creditId: input.creditId,
+        status: "processing",
+        claimHolderId: input.claimHolderId,
+        claimExpiresAt: sql4`now() + (${claimTtlMs} * interval '1 millisecond')`,
+        confirmationExpiresAt: input.confirmationExpiresAt
+      }).returning();
+      if (!created) throw new Error("Codex redemption claim returned no row");
+      return {
+        kind: "claimed",
+        attempt: mapCodexResetRedemptionAttempt(created)
+      };
+    })
+  );
+}
+async function fenceCodexResetRedemptionSend(db, input) {
+  const sendLeaseMs = input.sendLeaseMs ?? 3e4;
+  if (!Number.isFinite(sendLeaseMs) || sendLeaseMs <= 1e4) {
+    throw new Error("Codex redemption send lease must exceed the bounded provider call");
+  }
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => await scopedDb.transaction(async (tx) => {
+      const [credential] = await tx.select({
+        connectedBySubjectId: codexSubscriptionCredentials.connectedBySubjectId,
+        status: codexSubscriptionCredentials.status
+      }).from(codexSubscriptionCredentials).where(
+        and5(
+          eq5(codexSubscriptionCredentials.accountId, input.accountId),
+          eq5(codexSubscriptionCredentials.workspaceId, input.workspaceId),
+          eq5(codexSubscriptionCredentials.id, input.credentialId)
+        )
+      ).for("share").limit(1);
+      const [attempt] = await tx.select().from(codexResetRedemptionAttempts).where(
+        and5(
+          eq5(codexResetRedemptionAttempts.accountId, input.accountId),
+          eq5(codexResetRedemptionAttempts.workspaceId, input.workspaceId),
+          eq5(codexResetRedemptionAttempts.id, input.attemptId)
+        )
+      ).for("update").limit(1);
+      if (!attempt) return { kind: "not_ready", reason: "not_found" };
+      if (attempt.credentialId !== input.credentialId || attempt.subjectId !== input.subjectId || attempt.browserSessionHash !== input.browserSessionHash || attempt.claimHolderId !== input.claimHolderId) {
+        return { kind: "not_ready", reason: "identity_mismatch" };
+      }
+      if (attempt.status === "completed") {
+        return { kind: "not_ready", reason: "already_completed" };
+      }
+      const [liveness] = await tx.execute(sql4`
+          select claim_expires_at > now() as claim_live,
+                 confirmation_expires_at > now() as confirmation_live
+          from codex_reset_redemption_attempts
+          where workspace_id = ${input.workspaceId} and id = ${input.attemptId}
+        `);
+      let reason;
+      if (!liveness?.claim_live) reason = "claim_expired";
+      else if (!liveness.confirmation_live) reason = "confirmation_expired";
+      else if (!credential || credential.status !== "active" || credential.connectedBySubjectId !== input.subjectId) {
+        reason = "credential_unavailable";
+      } else {
+        const [ready] = await tx.update(codexResetRedemptionAttempts).set({
+          status: "provider_started",
+          providerStartedAt: sql4`coalesce(${codexResetRedemptionAttempts.providerStartedAt}, now())`,
+          claimExpiresAt: sql4`now() + (${sendLeaseMs} * interval '1 millisecond')`,
+          lastFailureKind: null,
+          updatedAt: sql4`now()`
+        }).where(eq5(codexResetRedemptionAttempts.id, input.attemptId)).returning();
+        if (!ready) throw new Error("Codex redemption send fence returned no row");
+        return { kind: "ready", attempt: mapCodexResetRedemptionAttempt(ready) };
+      }
+      if (attempt.status === "processing") {
+        await tx.delete(codexResetRedemptionAttempts).where(eq5(codexResetRedemptionAttempts.id, input.attemptId));
+      } else {
+        await tx.update(codexResetRedemptionAttempts).set({
+          claimHolderId: null,
+          claimExpiresAt: null,
+          lastFailureKind: `send_fence_${reason}`,
+          updatedAt: sql4`now()`
+        }).where(eq5(codexResetRedemptionAttempts.id, input.attemptId));
+      }
+      return { kind: "not_ready", reason };
+    })
+  );
+}
+async function abandonCodexResetRedemptionBeforeProvider(db, input) {
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      const deleted = await scopedDb.delete(codexResetRedemptionAttempts).where(
+        and5(
+          eq5(codexResetRedemptionAttempts.workspaceId, input.workspaceId),
+          eq5(codexResetRedemptionAttempts.id, input.attemptId),
+          eq5(codexResetRedemptionAttempts.status, "processing"),
+          eq5(codexResetRedemptionAttempts.claimHolderId, input.claimHolderId)
+        )
+      ).returning({ id: codexResetRedemptionAttempts.id });
+      return deleted.length === 1;
+    }
+  );
+}
+async function releaseCodexResetRedemptionClaim(db, input) {
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => {
+      const rows = await scopedDb.update(codexResetRedemptionAttempts).set({
+        claimHolderId: null,
+        claimExpiresAt: null,
+        lastFailureKind: input.failureKind.slice(0, 100),
+        updatedAt: /* @__PURE__ */ new Date()
+      }).where(
+        and5(
+          eq5(codexResetRedemptionAttempts.workspaceId, input.workspaceId),
+          eq5(codexResetRedemptionAttempts.id, input.attemptId),
+          eq5(codexResetRedemptionAttempts.claimHolderId, input.claimHolderId),
+          sql4`${codexResetRedemptionAttempts.status} <> 'completed'`
+        )
+      ).returning({ id: codexResetRedemptionAttempts.id });
+      return rows.length === 1;
+    }
+  );
+}
+async function completeCodexResetRedemption(db, input) {
+  if (!CODEX_RESET_REDEMPTION_OUTCOMES.includes(input.outcome)) {
+    throw new Error("Unknown Codex redemption outcome");
+  }
+  return await withCodexCapacityMutation(
+    db,
+    { workspaceId: input.workspaceId, reason: "codex_reset_credit_redeemed" },
+    async (tx) => {
+      await tx.execute(
+        sql4`select pg_advisory_xact_lock(hashtextextended(${`codex-reset-attempt:${input.attemptId}`}, 0))`
+      );
+      const [current] = await tx.select().from(codexResetRedemptionAttempts).where(
+        and5(
+          eq5(codexResetRedemptionAttempts.accountId, input.accountId),
+          eq5(codexResetRedemptionAttempts.workspaceId, input.workspaceId),
+          eq5(codexResetRedemptionAttempts.id, input.attemptId)
+        )
+      ).for("update").limit(1);
+      if (!current) return { result: null, changed: false };
+      if (current.status === "completed") {
+        return { result: mapCodexResetRedemptionAttempt(current), changed: false };
+      }
+      if (current.status !== "provider_started" || current.claimHolderId !== input.claimHolderId) {
+        return { result: null, changed: false };
+      }
+      const completedAt = /* @__PURE__ */ new Date();
+      const [completed] = await tx.update(codexResetRedemptionAttempts).set({
+        status: "completed",
+        outcome: input.outcome,
+        completedAt,
+        claimHolderId: null,
+        claimExpiresAt: null,
+        lastFailureKind: null,
+        updatedAt: completedAt
+      }).where(
+        and5(
+          eq5(codexResetRedemptionAttempts.accountId, input.accountId),
+          eq5(codexResetRedemptionAttempts.workspaceId, input.workspaceId),
+          eq5(codexResetRedemptionAttempts.id, input.attemptId)
+        )
+      ).returning();
+      if (!completed) throw new Error("Codex redemption completion returned no row");
+      const restoresCapacity = input.outcome === "reset" || input.outcome === "alreadyRedeemed";
+      if (restoresCapacity) {
+        await tx.update(codexSubscriptionCredentials).set({ exhaustedUntil: null }).where(
+          and5(
+            eq5(codexSubscriptionCredentials.accountId, input.accountId),
+            eq5(codexSubscriptionCredentials.workspaceId, input.workspaceId),
+            eq5(codexSubscriptionCredentials.id, current.credentialId)
+          )
+        );
+      }
+      await tx.insert(auditEvents).values({
+        accountId: input.accountId,
+        workspaceId: input.workspaceId,
+        subjectId: current.subjectId,
+        action: "codex.reset_credit.redemption.completed",
+        targetType: "codex_reset_redemption_attempt",
+        targetId: input.attemptId,
+        metadata: { outcome: input.outcome }
+      });
+      return {
+        result: mapCodexResetRedemptionAttempt(completed),
+        // A successful/already-applied upstream reset can make durable waiters
+        // eligible immediately even when the local cooldown was already null.
+        changed: restoresCapacity
+      };
+    }
+  );
+}
 async function recordCodexAccountUsage(db, workspaceId, credentialId, snapshot) {
   return (await recordCodexAccountUsageWithWakeTargets(db, workspaceId, credentialId, snapshot)).result;
 }
@@ -10805,11 +11550,17 @@ async function recordCodexAccountUsageWithWakeTargets(db, workspaceId, credentia
     { workspaceId, reason: "codex_usage_refreshed" },
     async (tx) => {
       const updated = await tx.update(codexSubscriptionCredentials).set({
-        primaryUsedPercent: snapshot.primaryUsedPercent,
-        primaryResetAt: snapshot.primaryResetAt,
-        secondaryUsedPercent: snapshot.secondaryUsedPercent,
-        secondaryResetAt: snapshot.secondaryResetAt,
-        usageCheckedAt: snapshot.checkedAt
+        ...snapshot.checkedAt !== void 0 ? {
+          primaryUsedPercent: snapshot.primaryUsedPercent ?? null,
+          primaryResetAt: snapshot.primaryResetAt ?? null,
+          secondaryUsedPercent: snapshot.secondaryUsedPercent ?? null,
+          secondaryResetAt: snapshot.secondaryResetAt ?? null,
+          usageCheckedAt: snapshot.checkedAt
+        } : {},
+        ...snapshot.resetCreditAvailableCount !== void 0 ? {
+          resetCreditAvailableCount: snapshot.resetCreditAvailableCount,
+          resetCreditsCheckedAt: snapshot.resetCreditsCheckedAt ?? null
+        } : {}
         // NB: no `version` bump and no `updatedAt` touch — usage is non-credential
         // metadata and must NOT race the (id, version) refresh CAS in
         // recordCodexTokenRefresh / setCodexCredentialStatus.
@@ -11091,6 +11842,34 @@ async function disconnectCodexAccount(db, workspaceId, credentialId) {
       where workspace_id = ${workspaceId}
       for update
     `);
+    const [credential] = await scopedDb.select({ id: codexSubscriptionCredentials.id }).from(codexSubscriptionCredentials).where(
+      and5(
+        eq5(codexSubscriptionCredentials.id, credentialId),
+        eq5(codexSubscriptionCredentials.workspaceId, workspaceId)
+      )
+    ).for("update").limit(1);
+    const [settingsBefore] = await scopedDb.select({ activeCredentialId: codexRotationSettings.activeCredentialId }).from(codexRotationSettings).where(eq5(codexRotationSettings.workspaceId, workspaceId)).limit(1);
+    if (!credential) {
+      return {
+        removed: false,
+        newActiveCredentialId: settingsBefore?.activeCredentialId ?? null,
+        blockedByUnresolvedRedemption: false
+      };
+    }
+    const [unresolved] = await scopedDb.select({ id: codexResetRedemptionAttempts.id }).from(codexResetRedemptionAttempts).where(
+      and5(
+        eq5(codexResetRedemptionAttempts.workspaceId, workspaceId),
+        eq5(codexResetRedemptionAttempts.credentialId, credentialId),
+        eq5(codexResetRedemptionAttempts.status, "provider_started")
+      )
+    ).limit(1);
+    if (unresolved) {
+      return {
+        removed: false,
+        newActiveCredentialId: settingsBefore?.activeCredentialId ?? null,
+        blockedByUnresolvedRedemption: true
+      };
+    }
     const removedRows = await scopedDb.delete(codexSubscriptionCredentials).where(
       and5(
         eq5(codexSubscriptionCredentials.id, credentialId),
@@ -11103,7 +11882,8 @@ async function disconnectCodexAccount(db, workspaceId, credentialId) {
     if (removedRows.length === 0) {
       return {
         removed: false,
-        newActiveCredentialId: settingsRow?.activeCredentialId ?? null
+        newActiveCredentialId: settingsRow?.activeCredentialId ?? null,
+        blockedByUnresolvedRedemption: false
       };
     }
     let newActive = settingsRow?.activeCredentialId ?? null;
@@ -11114,13 +11894,31 @@ async function disconnectCodexAccount(db, workspaceId, credentialId) {
         await scopedDb.update(codexRotationSettings).set({ activeCredentialId: newActive, updatedAt: /* @__PURE__ */ new Date() }).where(eq5(codexRotationSettings.workspaceId, workspaceId));
       }
     }
-    return { removed: true, newActiveCredentialId: newActive };
+    return {
+      removed: true,
+      newActiveCredentialId: newActive,
+      blockedByUnresolvedRedemption: false
+    };
   });
 }
 async function disconnectAllCodexAccounts(db, workspaceId) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const credentials = await scopedDb.select({ id: codexSubscriptionCredentials.id }).from(codexSubscriptionCredentials).where(eq5(codexSubscriptionCredentials.workspaceId, workspaceId)).orderBy(asc3(codexSubscriptionCredentials.id)).for("update");
+    if (credentials.length === 0) return { removed: 0, blockedCredentialIds: [] };
+    const blocked = await scopedDb.selectDistinct({ credentialId: codexResetRedemptionAttempts.credentialId }).from(codexResetRedemptionAttempts).where(
+      and5(
+        eq5(codexResetRedemptionAttempts.workspaceId, workspaceId),
+        eq5(codexResetRedemptionAttempts.status, "provider_started")
+      )
+    );
+    if (blocked.length > 0) {
+      return {
+        removed: 0,
+        blockedCredentialIds: blocked.map((row) => row.credentialId).sort()
+      };
+    }
     const rows = await scopedDb.delete(codexSubscriptionCredentials).where(eq5(codexSubscriptionCredentials.workspaceId, workspaceId)).returning({ id: codexSubscriptionCredentials.id });
-    return rows.length;
+    return { removed: rows.length, blockedCredentialIds: [] };
   });
 }
 async function recordAuditEvent(db, input) {
@@ -11181,6 +11979,7 @@ function mapSessionMcpServerMetadata(row) {
     url: row.url,
     headerNames: Object.keys(row.headersEncrypted ?? {}).sort(),
     credentialVersion: Number(row.credentialVersion),
+    requireApproval: row.requireApproval ?? false,
     connectionRef: row.connectionRef ?? null
   };
 }
@@ -11290,8 +12089,60 @@ async function updateSessionMcpServerCredentialsInTransaction(tx, input) {
   }
   return { servers, missingIds };
 }
-async function listSessionMcpServersForRun(db, workspaceId, sessionId, encryptionKey) {
+async function updateSessionMcpApprovalPolicy(db, input) {
+  return await withWorkspaceRls(
+    db,
+    input.workspaceId,
+    async (scopedDb) => await scopedDb.transaction(
+      async (tx) => await updateSessionMcpApprovalPolicyInTransaction(tx, input)
+    )
+  );
+}
+async function updateSessionMcpApprovalPolicyInTransaction(tx, input) {
+  const [existing] = await tx.select().from(sessionMcpServers).where(
+    and5(
+      eq5(sessionMcpServers.workspaceId, input.workspaceId),
+      eq5(sessionMcpServers.sessionId, input.sessionId),
+      eq5(sessionMcpServers.serverId, input.serverId)
+    )
+  ).for("update").limit(1);
+  if (!existing) {
+    return { server: null, changed: false };
+  }
+  const current = existing.requireApproval ?? false;
+  if (JSON.stringify(current) === JSON.stringify(input.requireApproval)) {
+    return { server: mapSessionMcpServerMetadata(existing), changed: false };
+  }
+  const [updated] = await tx.update(sessionMcpServers).set({
+    requireApproval: input.requireApproval,
+    updatedAt: /* @__PURE__ */ new Date()
+  }).where(
+    and5(
+      eq5(sessionMcpServers.workspaceId, input.workspaceId),
+      eq5(sessionMcpServers.sessionId, input.sessionId),
+      eq5(sessionMcpServers.serverId, input.serverId)
+    )
+  ).returning();
+  if (!updated) {
+    throw new Error(`Session MCP server disappeared during policy update: ${input.serverId}`);
+  }
+  return { server: mapSessionMcpServerMetadata(updated), changed: true };
+}
+async function listSessionMcpServersForRun(db, workspaceId, sessionId, attemptId, encryptionKey) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const [attempt] = await scopedDb.select({
+      sessionId: sessionTurnAttempts.sessionId,
+      mcpApprovalPolicies: sessionTurnAttempts.mcpApprovalPolicies
+    }).from(sessionTurnAttempts).where(
+      and5(
+        eq5(sessionTurnAttempts.workspaceId, workspaceId),
+        eq5(sessionTurnAttempts.id, attemptId),
+        inArray3(sessionTurnAttempts.state, ["claimed", "running"])
+      )
+    ).limit(1);
+    if (!attempt || attempt.sessionId !== sessionId) {
+      throw new Error(`session MCP policy snapshot is unavailable for attempt ${attemptId}`);
+    }
     const rows = await scopedDb.select().from(sessionMcpServers).where(
       and5(
         eq5(sessionMcpServers.workspaceId, workspaceId),
@@ -11299,6 +12150,11 @@ async function listSessionMcpServersForRun(db, workspaceId, sessionId, encryptio
       )
     ).orderBy(asc3(sessionMcpServers.createdAt), asc3(sessionMcpServers.serverId));
     return rows.map((row) => {
+      if (!Object.hasOwn(attempt.mcpApprovalPolicies, row.serverId)) {
+        throw new Error(
+          `session MCP policy snapshot is missing server ${row.serverId} for attempt ${attemptId}`
+        );
+      }
       let headers;
       try {
         if (!encryptionKey && Object.keys(row.headersEncrypted ?? {}).length > 0) {
@@ -11318,7 +12174,7 @@ async function listSessionMcpServersForRun(db, workspaceId, sessionId, encryptio
         ...row.allowedTools ? { allowedTools: row.allowedTools } : {},
         ...row.timeoutMs ? { timeoutMs: row.timeoutMs } : {},
         ...row.cacheToolsList ? { cacheToolsList: row.cacheToolsList } : {},
-        ...row.requireApproval != null ? { requireApproval: row.requireApproval } : {},
+        requireApproval: attempt.mcpApprovalPolicies[row.serverId],
         headers
       };
     });
@@ -11369,6 +12225,7 @@ async function createSession(db, input) {
         initialTurnInstructions: input.initialTurnInstructions ?? null,
         resources: input.resources,
         tools: input.tools ?? [],
+        toolPolicy: input.toolPolicy ?? null,
         metadata: input.metadata,
         ...creatorColumns(frozenCreator),
         model: input.model,
@@ -11416,6 +12273,7 @@ async function createSessionWithIdempotencyKey(db, input) {
         initialTurnInstructions: input.initialTurnInstructions ?? null,
         resources: input.resources,
         tools: input.tools ?? [],
+        toolPolicy: input.toolPolicy ?? null,
         metadata: input.metadata,
         ...creatorColumns(frozenCreator),
         model: input.model,
@@ -12695,6 +13553,17 @@ async function listSessionEventPage(db, workspaceId, sessionId, options = {}) {
         eq5(sessionEvents.sessionId, sessionId),
         gt(sessionEvents.sequence, after)
       ];
+      if (options.authoritativeLatest) {
+        filters.push(
+          and5(
+            or(
+              isNull(sessionEvents.turnAssociation),
+              eq5(sessionEvents.turnAssociation, "current")
+            ),
+            isNull(sessionEvents.duplicateOfEventId)
+          )
+        );
+      }
       if (typeFilters.includeTypes.length > 0) {
         filters.push(inArray3(sessionEvents.type, typeFilters.includeTypes));
       }
@@ -12712,7 +13581,7 @@ async function listSessionEventPage(db, workspaceId, sessionId, options = {}) {
         filters.push(lt(sessionEvents.sequence, before));
       }
       const rows = await scopedDb.select(sessionEventProjectionSelect(payloadMode)).from(sessionEvents).where(and5(...filters)).orderBy(
-        direction === "before" ? desc(sessionEvents.sequence) : asc3(sessionEvents.sequence)
+        options.authoritativeLatest ? desc(sessionEvents.sequence) : direction === "before" ? desc(sessionEvents.sequence) : asc3(sessionEvents.sequence)
       ).limit(queryLimit);
       if (rows.length === 0) break;
       for (const row of rows) {
@@ -12906,21 +13775,67 @@ async function listSessionEvents(db, workspaceId, sessionId, afterOrOptions = 0,
     return (direction === "before" ? rows.reverse() : rows).map(mapProjectedEvent);
   });
 }
-async function reserveToolspaceCallForTurn(db, workspaceId, sessionId, turnId, limit) {
+async function admitToolspaceTurnAttempt(db, workspaceId, claims) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
-    const [row] = await scopedDb.update(sessionTurns).set({
-      toolspaceCallCount: sql4`${sessionTurns.toolspaceCallCount} + 1`
-    }).where(
-      and5(
-        eq5(sessionTurns.workspaceId, workspaceId),
-        eq5(sessionTurns.sessionId, sessionId),
-        eq5(sessionTurns.id, turnId),
-        sql4`${sessionTurns.toolspaceCallCount} < ${limit}`
-      )
-    ).returning({ count: sessionTurns.toolspaceCallCount });
-    return row ? { reserved: true, count: Number(row.count) } : { reserved: false };
+    return await scopedDb.transaction(async (tx) => {
+      const fence = await lockTurnAttemptWriteFenceTx(tx, {
+        workspaceId,
+        sessionId: claims.sessionId,
+        turnId: claims.turnId,
+        attemptId: claims.attemptId,
+        executionGeneration: claims.executionGeneration
+      });
+      return fence.allowed && fence.turn.status === "running";
+    });
   });
 }
+async function reserveToolspaceCallForAttempt(db, input) {
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => await scopedDb.transaction(async (tx) => {
+      const fence = await lockTurnAttemptWriteFenceTx(tx, {
+        workspaceId: input.workspaceId,
+        sessionId: input.sessionId,
+        turnId: input.turnId,
+        executionGeneration: input.executionGeneration,
+        attemptId: input.attemptId
+      });
+      if (!fence.allowed) {
+        return { reserved: false, reason: fence.reason };
+      }
+      if (fence.turn.status !== "running") {
+        return { reserved: false, reason: "turn_terminal" };
+      }
+      if (Number(fence.turn.toolspaceCallCount) >= input.limit) {
+        return { reserved: false, reason: "budget_exhausted" };
+      }
+      const [row] = await tx.update(sessionTurns).set({
+        toolspaceCallCount: sql4`${sessionTurns.toolspaceCallCount} + 1`
+      }).where(
+        and5(
+          eq5(sessionTurns.workspaceId, input.workspaceId),
+          eq5(sessionTurns.sessionId, input.sessionId),
+          eq5(sessionTurns.id, input.turnId),
+          eq5(sessionTurns.executionGeneration, input.executionGeneration),
+          eq5(sessionTurns.activeAttemptId, input.attemptId),
+          sql4`${sessionTurns.toolspaceCallCount} < ${input.limit}`
+        )
+      ).returning({ count: sessionTurns.toolspaceCallCount });
+      if (!row) {
+        throw new Error("Toolspace call reservation lost its locked turn");
+      }
+      return {
+        reserved: true,
+        count: Number(row.count),
+        turn: mapSessionTurnForExecution({
+          ...fence.turn,
+          toolspaceCallCount: Number(row.count)
+        })
+      };
+    })
+  );
+}
 function normalizeEventSequence(value, fallback) {
   if (value === void 0 || !Number.isFinite(value)) {
     return fallback;
@@ -13441,6 +14356,56 @@ async function lockTurnAttemptWriteFenceTx(tx, input) {
   }
   return { allowed: true, workspace, session, turn, attempt };
 }
+async function installOrReadTurnExecutionPolicyForAttempt(db, input) {
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => await scopedDb.transaction(async (tx) => {
+      const fence = await lockTurnAttemptWriteFenceTx(tx, {
+        workspaceId: input.workspaceId,
+        sessionId: input.sessionId,
+        turnId: input.turnId,
+        executionGeneration: input.executionGeneration,
+        attemptId: input.attemptId
+      });
+      if (!fence.allowed) {
+        return { accepted: false, reason: fence.reason };
+      }
+      const existing = readTurnExecutionPolicyV1(fence.turn.metadata);
+      if (existing.kind === "valid") {
+        return {
+          accepted: true,
+          installed: false,
+          policy: existing.policy,
+          turn: mapSessionTurn(fence.turn)
+        };
+      }
+      const policy = TurnExecutionPolicyV1.parse(input.policyForAbsent);
+      const [updated] = await tx.update(sessionTurns).set({
+        metadata: metadataWithTurnExecutionPolicyV12(fence.turn.metadata, policy),
+        updatedAt: /* @__PURE__ */ new Date()
+      }).where(
+        and5(
+          eq5(sessionTurns.workspaceId, input.workspaceId),
+          eq5(sessionTurns.sessionId, input.sessionId),
+          eq5(sessionTurns.id, input.turnId),
+          eq5(sessionTurns.status, "running"),
+          eq5(sessionTurns.executionGeneration, input.executionGeneration),
+          eq5(sessionTurns.activeAttemptId, input.attemptId)
+        )
+      ).returning();
+      if (!updated) {
+        throw new Error("Turn execution policy owner changed while its row was locked");
+      }
+      return {
+        accepted: true,
+        installed: true,
+        policy,
+        turn: mapSessionTurn(updated)
+      };
+    })
+  );
+}
 async function appendSessionHistoryItems(db, input) {
   if (input.items.length === 0) {
     return true;
@@ -13519,6 +14484,33 @@ async function registerPendingSessionToolCall(db, input) {
     })
   );
 }
+async function clearPendingSessionToolspaceCall(db, input) {
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => await scopedDb.transaction(async (tx) => {
+      const fence = await lockTurnAttemptWriteFenceTx(tx, {
+        workspaceId: input.workspaceId,
+        sessionId: input.sessionId,
+        turnId: input.turnId,
+        executionGeneration: input.executionGeneration,
+        attemptId: input.attemptId
+      });
+      if (!fence.allowed) return { accepted: false, cleared: false };
+      const deleted = await tx.delete(sessionPendingToolCalls).where(
+        and5(
+          eq5(sessionPendingToolCalls.workspaceId, input.workspaceId),
+          eq5(sessionPendingToolCalls.sessionId, input.sessionId),
+          eq5(sessionPendingToolCalls.turnId, input.turnId),
+          eq5(sessionPendingToolCalls.attemptId, input.attemptId),
+          eq5(sessionPendingToolCalls.callId, input.callId),
+          eq5(sessionPendingToolCalls.callType, "toolspace_call")
+        )
+      ).returning({ id: sessionPendingToolCalls.id });
+      return { accepted: true, cleared: deleted.length === 1 };
+    })
+  );
+}
 async function recordPendingSessionToolCallResult(db, input) {
   return await withRlsContext(
     db,
@@ -14385,13 +15377,17 @@ async function acquireLease(db, input) {
         on conflict (workspace_id, sandbox_group_id) do nothing
       `);
       const rows = await tx.execute(sql4`
-        select * from sandbox_leases
+        select *, (liveness = 'draining' and expires_at <= now()) as draining_expired
+        from sandbox_leases
         where workspace_id = ${workspaceId} and sandbox_group_id = ${sandboxGroupId}
         for update
       `);
       const row = rows[0];
       if (!row) throw new Error(`Lease row vanished post-insert: ${sandboxGroupId}`);
       let liveness = row.liveness;
+      if (liveness === "draining" && row.draining_expired) {
+        return { role: "fenced", lease: mapLeaseRow(row) };
+      }
       const imageConflict = image !== null && row.image !== null && row.image !== image;
       const rigConflict = rigVersionId !== null && row.rig_version_id !== null && row.rig_version_id !== rigVersionId;
       if (liveness !== "cold" && (imageConflict || rigConflict)) {
@@ -14570,6 +15566,7 @@ async function failWarmingToCold(db, input) {
         update sandbox_leases set
           liveness = 'cold', instance_id = null,
           data_plane_url = null, terminal_data_plane_url = null, updated_at = now(),
+          lease_epoch = lease_epoch + 1,
           resume_state = case
             when (resume_state #>> '{sessionState,workspaceArchive}') is not null
               then jsonb_build_object(
@@ -14719,7 +15716,8 @@ async function reapStaleLeaseHolders(db, input) {
         update sandbox_leases set
           liveness = 'cold', instance_id = null,
           resume_backend_id = null, resume_state = null,
-          data_plane_url = null, terminal_data_plane_url = null, updated_at = now()
+          data_plane_url = null, terminal_data_plane_url = null,
+          lease_epoch = lease_epoch + 1, updated_at = now()
         where workspace_id = ${input.workspaceId}
           and liveness = 'warming' and expires_at < now() and instance_id is null
         returning id
@@ -14732,6 +15730,7 @@ async function reapStaleLeaseHolders(db, input) {
           viewer_holders = 0,
           data_plane_url = null,
           terminal_data_plane_url = null,
+          lease_epoch = lease_epoch + 1,
           expires_at = now() - interval '1 millisecond',
           updated_at = now()
         where workspace_id = ${input.workspaceId}
@@ -14882,6 +15881,7 @@ async function reArmDrainingLease(db, input) {
           updated_at = now()
         where workspace_id = ${input.workspaceId} and sandbox_group_id = ${input.sandboxGroupId}
           and liveness = 'draining'
+          and expires_at > now()
         returning id
       `);
       return { rearmed: rows.length > 0 };
@@ -16998,6 +17998,7 @@ async function initializeSessionStartAtomically(db, input) {
           turnInstructions: session.initialTurnInstructions ?? null,
           resources: session.resources,
           tools: session.tools,
+          toolsProvided: session.toolPolicy?.mode === "explicit",
           model: session.model,
           reasoningEffort: reasoningEffortForMetadata(
             session.metadata,
@@ -17005,7 +18006,7 @@ async function initializeSessionStartAtomically(db, input) {
           ),
           sandboxBackend: session.sandboxBackend,
           sandboxOs: session.sandboxOs,
-          metadata: {},
+          metadata: input.turnExecutionPolicy ? metadataWithTurnExecutionPolicyV12({}, input.turnExecutionPolicy) : {},
           lineage: {},
           ...initiatorColumns(creator)
         }).returning();
@@ -17114,6 +18115,7 @@ async function enqueueSessionTurn(db, input) {
         turnInstructions: input.turnInstructions ?? null,
         resources: input.resources,
         tools: input.tools,
+        toolsProvided: input.toolsProvided ?? false,
         model: input.model,
         reasoningEffort: input.reasoningEffort,
         sandboxBackend: input.sandboxBackend,
@@ -17325,18 +18327,33 @@ async function claimSessionWorkForAttempt(db, workspaceId, input) {
       if (unquiescedInterruption) {
         return { action: "unclaimed", reason: "control-pending" };
       }
-      const registerAttempt = async (turn) => await registerSessionTurnAttemptClaim(tx, {
-        id: input.attemptId,
-        accountId: session.accountId,
-        workspaceId,
-        sessionId,
-        turnId: turn.id,
-        executionGeneration: turn.executionGeneration,
-        temporalWorkflowId: workflowId,
-        temporalWorkflowRunId: input.workflowRunId,
-        temporalActivityId: input.dispatchId,
-        verifiedControlRevision: Number(workspaceControl.revision)
-      });
+      const registerAttempt = async (turn) => {
+        const policyRows = await tx.select({
+          serverId: sessionMcpServers.serverId,
+          requireApproval: sessionMcpServers.requireApproval
+        }).from(sessionMcpServers).where(
+          and5(
+            eq5(sessionMcpServers.workspaceId, workspaceId),
+            eq5(sessionMcpServers.sessionId, sessionId)
+          )
+        ).orderBy(asc3(sessionMcpServers.serverId));
+        const mcpApprovalPolicies = Object.fromEntries(
+          policyRows.map((row2) => [row2.serverId, row2.requireApproval ?? false])
+        );
+        return await registerSessionTurnAttemptClaim(tx, {
+          id: input.attemptId,
+          accountId: session.accountId,
+          workspaceId,
+          sessionId,
+          turnId: turn.id,
+          executionGeneration: turn.executionGeneration,
+          temporalWorkflowId: workflowId,
+          temporalWorkflowRunId: input.workflowRunId,
+          temporalActivityId: input.dispatchId,
+          verifiedControlRevision: Number(workspaceControl.revision),
+          mcpApprovalPolicies
+        });
+      };
       if (session.activeTurnId !== null) {
         const [activeTurnPreview] = await tx.select().from(sessionTurns).where(
           and5(
@@ -19083,7 +20100,8 @@ async function applySessionTurnSettlement(db, workspaceId, input) {
           sequence: ++sequence,
           type: event.type,
           payload: sanitizeEventPayload(
-            event.type === "session.status.changed" && payload.status === input.sessionStatus && effectiveSessionStatus !== input.sessionStatus ? { ...payload, status: effectiveSessionStatus } : payload
+            event.type === "session.status.changed" && payload.status === input.sessionStatus && effectiveSessionStatus !== input.sessionStatus ? { ...payload, status: effectiveSessionStatus } : payload,
+            { fullEvidence: event.retainedOutputEvidence }
           ),
           clientEventId: event.clientEventId ?? null,
           turnId: input.turnId,
@@ -19876,6 +20894,41 @@ async function getSessionTurn(db, workspaceId, turnId) {
     return row ? mapSessionTurn(row) : null;
   });
 }
+async function getActiveSessionTurnForExecution(db, workspaceId, sessionId) {
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const [row] = await scopedDb.select({ turn: sessionTurns }).from(sessions).innerJoin(
+      sessionTurns,
+      and5(
+        eq5(sessionTurns.workspaceId, sessions.workspaceId),
+        eq5(sessionTurns.id, sessions.activeTurnId)
+      )
+    ).innerJoin(
+      sessionTurnAttempts,
+      and5(
+        eq5(sessionTurnAttempts.workspaceId, sessionTurns.workspaceId),
+        eq5(sessionTurnAttempts.id, sessionTurns.activeAttemptId)
+      )
+    ).where(
+      and5(
+        eq5(sessions.workspaceId, workspaceId),
+        eq5(sessions.id, sessionId),
+        eq5(sessionTurns.sessionId, sessionId),
+        eq5(sessionTurnAttempts.sessionId, sessionId),
+        eq5(sessionTurnAttempts.turnId, sessionTurns.id),
+        inArray3(sessionTurnAttempts.state, ["claimed", "running"]),
+        inArray3(sessionTurns.status, ["running", "recovering", "waiting_capacity"]),
+        sql4`not exists (
+            select 1
+            from ${sessionAttemptInterruptions} interruption
+            where interruption.workspace_id = ${workspaceId}
+              and interruption.attempt_id = ${sessionTurnAttempts.id}
+              and interruption.state in ('pending', 'delivered', 'acknowledged')
+          )`
+      )
+    ).limit(1);
+    return row ? mapSessionTurnForExecution(row.turn) : null;
+  });
+}
 async function getSessionTurnForAttempt(db, workspaceId, sessionId, attemptId) {
   return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
     const [row] = await scopedDb.select({ turn: sessionTurns }).from(sessionTurnAttempts).innerJoin(
@@ -20146,11 +21199,37 @@ async function claimPendingSessionWorkflowWakes(db, limit = 100) {
   }));
 }
 async function markSessionWorkflowWakeDelivered(db, input) {
-  await withRlsContext(
+  return await withRlsContext(
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
-    async (scopedDb) => {
-      const [row] = await scopedDb.update(sessionWorkflowWakeOutbox).set({
+    async (scopedDb) => await scopedDb.transaction(async (tx) => {
+      const locks = await lockSessionEventWriteRows(tx, {
+        workspaceId: input.workspaceId,
+        controlLock: "share",
+        sessionIds: [input.sessionId]
+      });
+      const session = locks.sessions[0];
+      if (!session) throw new Error(`Session not found: ${input.sessionId}`);
+      const effectiveControl = await evaluateSessionControl(
+        tx,
+        input.workspaceId,
+        input.sessionId,
+        { workspaceControl: locks.control ?? void 0 }
+      );
+      if (effectiveControl.state === "active") {
+        const [pendingAgentSteer] = await tx.select({ id: sessionSystemUpdates.id }).from(sessionSystemUpdates).where(
+          and5(
+            eq5(sessionSystemUpdates.workspaceId, input.workspaceId),
+            eq5(sessionSystemUpdates.sessionId, input.sessionId),
+            eq5(sessionSystemUpdates.kind, "agent_steer_instruction"),
+            eq5(sessionSystemUpdates.state, "pending")
+          )
+        ).limit(1);
+        if (pendingAgentSteer) {
+          return { action: "pending_admission", blocker: "pending_agent_steer" };
+        }
+      }
+      const [row] = await tx.update(sessionWorkflowWakeOutbox).set({
         deliveredRevision: sql4`greatest(${sessionWorkflowWakeOutbox.deliveredRevision}, ${input.wakeRevision})`,
         attempts: sql4`case when ${sessionWorkflowWakeOutbox.wakeRevision} = ${input.wakeRevision} then 0 else ${sessionWorkflowWakeOutbox.attempts} end`,
         lastError: sql4`case when ${sessionWorkflowWakeOutbox.wakeRevision} = ${input.wakeRevision} then null else ${sessionWorkflowWakeOutbox.lastError} end`,
@@ -20167,7 +21246,8 @@ async function markSessionWorkflowWakeDelivered(db, input) {
           `Workflow wake revision ${input.wakeRevision} is not current for session ${input.sessionId}`
         );
       }
-    }
+      return { action: "acknowledged" };
+    })
   );
 }
 async function markSessionWorkflowWakeFailed(db, input, error) {
@@ -20528,7 +21608,9 @@ async function appendSessionEvents(db, workspaceId, sessionId, inputs) {
         sessionId,
         sequence: ++sequence,
         type: input.type,
-        payload: sanitizeEventPayload(input.payload ?? {}),
+        payload: sanitizeEventPayload(input.payload ?? {}, {
+          fullEvidence: input.retainedOutputEvidence
+        }),
         clientEventId: input.clientEventId ?? null,
         turnId: input.turnId ?? null,
         turnGeneration: input.turnGeneration ?? null,
@@ -20780,7 +21862,9 @@ async function appendSessionEventsForTurnAttempt(db, workspaceId, sessionId, tur
           sessionId,
           sequence: ++sequence,
           type: input.type,
-          payload: sanitizeEventPayload(input.payload ?? {}),
+          payload: sanitizeEventPayload(input.payload ?? {}, {
+            fullEvidence: input.retainedOutputEvidence
+          }),
           clientEventId: input.clientEventId ?? null,
           turnId,
           turnGeneration: executionGeneration,
@@ -20838,7 +21922,9 @@ async function appendSessionEventToSandboxGroup(db, workspaceId, sandboxGroupId,
         sessionId: row.id,
         sequence: row.lastSequence + 1,
         type: input.type,
-        payload: sanitizeEventPayload(input.payload ?? {}),
+        payload: sanitizeEventPayload(input.payload ?? {}, {
+          fullEvidence: input.retainedOutputEvidence
+        }),
         clientEventId: input.clientEventId ?? null,
         turnId: input.turnId ?? null,
         turnGeneration: input.turnGeneration ?? null,
@@ -20893,7 +21979,9 @@ async function appendSessionEventsAndUpdateSession(db, workspaceId, sessionId, i
         sessionId,
         sequence: ++sequence,
         type: input.type,
-        payload: sanitizeEventPayload(input.payload ?? {}),
+        payload: sanitizeEventPayload(input.payload ?? {}, {
+          fullEvidence: input.retainedOutputEvidence
+        }),
         clientEventId: input.clientEventId ?? null,
         turnId: input.turnId ?? null,
         turnGeneration: input.turnGeneration ?? null,
@@ -20946,6 +22034,12 @@ async function appendSessionEventsWithLockedSessionUpdate(db, workspaceId, sessi
           sessionId,
           updates
         }),
+        updateSessionMcpApprovalPolicy: async (serverId, requireApproval) => await updateSessionMcpApprovalPolicyInTransaction(tx, {
+          workspaceId,
+          sessionId,
+          serverId,
+          requireApproval
+        }),
         listPendingSessionTurns: async () => {
           const rows = await tx.select().from(sessionTurns).where(
             and5(
@@ -20975,7 +22069,9 @@ async function appendSessionEventsWithLockedSessionUpdate(db, workspaceId, sessi
         sessionId,
         sequence: ++sequence,
         type: input.type,
-        payload: sanitizeEventPayload(input.payload ?? {}),
+        payload: sanitizeEventPayload(input.payload ?? {}, {
+          fullEvidence: input.retainedOutputEvidence
+        }),
         clientEventId: input.clientEventId ?? null,
         turnId: input.turnId ?? null,
         turnGeneration: input.turnGeneration ?? null,
@@ -21034,6 +22130,10 @@ function mapSession(row, effectiveControl, mcpServers = [], pin = mapSessionPin(
     instructions: row.instructions ?? null,
     resources: row.resources,
     tools: row.tools,
+    toolPolicy: row.toolPolicy ?? {
+      mode: "legacy",
+      inheritedFromSessionId: null
+    },
     metadata: row.metadata,
     createdBy: initiatorFromStorage(
       row.createdByKind,
@@ -21127,6 +22227,7 @@ function mapSessionTurn(row) {
     prompt: row.prompt,
     resources: row.resources,
     tools: row.tools,
+    toolsProvided: row.toolsProvided,
     model: row.model,
     reasoningEffort: row.reasoningEffort,
     sandboxBackend: row.sandboxBackend,
@@ -21277,15 +22378,50 @@ function mapImportBatch(row) {
     updatedAt: row.updatedAt.toISOString()
   };
 }
-function mapCapabilityCatalogItem(row) {
+function catalogExposureState(item, installation) {
+  if (capabilityCatalogItemIsTrustedForExposure({
+    source: item.source,
+    stale: item.stale,
+    authKind: item.authKind,
+    metadata: item.metadata
+  })) {
+    return "trusted";
+  }
+  if (item.source !== registryCapabilitySource || item.stale || Object.prototype.hasOwnProperty.call(item.metadata, "mcpProbe") || !item.authKind || item.authKind === "unknown" || installation?.status !== "active" || !mcpConnectivityOk(installation.metadata)) {
+    return "blocked";
+  }
+  const hasCredentialBinding = !!encryptedHeadersConfig(installation.config.headersEncrypted) || !!connectionRefConfig(installation.config.connectionRef);
+  if (item.authModel && !hasCredentialBinding) {
+    return "blocked";
+  }
+  return "legacy_active";
+}
+function mapCapabilityCatalogItem(row, exposure = capabilityCatalogItemIsTrustedForExposure({
+  source: row.source,
+  stale: row.stale,
+  authKind: row.authKind,
+  metadata: row.metadata
+}) ? "trusted" : "unverified") {
+  const catalogTrust = exposure === "legacy_active" ? {
+    state: "legacy_active",
+    reason: "active_installation_compatibility"
+  } : exposure === "trusted" ? {
+    state: "trusted",
+    reason: row.source === registryCapabilitySource ? "verified_probe" : "trusted_source"
+  } : {
+    state: "unverified",
+    reason: "missing_verification"
+  };
   const runtime = row.kind === "mcp" && row.endpointUrl ? {
     available: true,
     mcpServerId: mcpServerIdForCapability(row.id, row.metadata),
     transport: row.transport ?? "streamable-http",
-    notes: row.authModel ? "Requires credential headers supplied in the enable request." : null
+    notes: row.authModel ? "Requires credential headers supplied in the enable request." : null,
+    catalogTrust
   } : {
     available: false,
-    notes: row.kind === "mcp" ? "Remote streamable HTTP endpoint is required for runtime use." : null
+    notes: row.kind === "mcp" ? "Remote streamable HTTP endpoint is required for runtime use." : null,
+    catalogTrust
   };
   return {
     id: row.id,
@@ -21628,6 +22764,7 @@ export {
   CODEX_CAPACITY_REFRESH_MAX_MS,
   CODEX_CAPACITY_REFRESH_MIN_MS,
   CODEX_CREDENTIAL_LEASE_TTL_MS,
+  CODEX_RESET_REDEMPTION_OUTCOMES,
   CODEX_ROTATION_STRATEGIES,
   ConnectionRefreshHttpError,
   HostExportPayloadError,
@@ -21678,6 +22815,7 @@ export {
   WORKSPACE_MEMORY_BLOCK_EMPTY,
   WORKSPACE_MEMORY_BLOCK_HEADER_POPULATED,
   WORKSPACE_MEMORY_BLOCK_TOKEN_BUDGET,
+  abandonCodexResetRedemptionBeforeProvider,
   abandonRecordingForTurnAttempt,
   acceptSessionApprovalDecision,
   acceptSessionHumanInputResponse,
@@ -21688,6 +22826,8 @@ export {
   activateRigVersion,
   addSessionSystemUpdate,
   addSessionSystemUpdateWithSourceMutation,
+  admitToolspaceTurnAttempt,
+  adoptCodexResetRedemptionAttempt,
   allAccountPermissions,
   allWorkspacePermissions,
   appendSessionEventToSandboxGroup,
@@ -21713,6 +22853,7 @@ export {
   buildConnectionTokenResolver,
   buildHostConnectionTokenResolver,
   canonicalSessionCommandHash,
+  claimCodexResetRedemption,
   claimExpiredFileUploadCleanup,
   claimFileUploadCleanup,
   claimHostExportBatch,
@@ -21721,6 +22862,7 @@ export {
   claimSessionWorkForAttempt,
   clearDurablePendingSessionToolCalls,
   clearEnrollmentWentOffline,
+  clearPendingSessionToolspaceCall,
   clearSessionContext,
   clearSessionGoal,
   clearedContextMarkerItem,
@@ -21728,6 +22870,7 @@ export {
   closeSessionTurnAttemptInTransaction,
   codexCapacityRefreshBackoffMs,
   commitWarmingToWarm,
+  completeCodexResetRedemption,
   completeExpiredFileUploadCleanup,
   completeFileUpload,
   completeFileUploadCleanup,
@@ -21822,12 +22965,15 @@ export {
   expireSessionHumanInputRequest,
   failHostExportBatch,
   failWarmingToCold,
+  fenceCodexResetRedemptionSend,
+  fetchCodexRateLimitResetCreditsForAccount,
   fetchCodexUsageForAccount,
   finalizeEnrollmentByToken,
   findActiveApiKeyByHash,
   forceDrainOverLimitViewerOnlyBoxes,
   frozenInitiatorForCommandActor,
   getActiveSessionHistoryItems,
+  getActiveSessionTurnForExecution,
   getAnySessionInGroup,
   getBillingBalance,
   getBillingCustomer,
@@ -21835,6 +22981,7 @@ export {
   getCapabilityInstallation,
   getCodexCapacityWaitForSession,
   getCodexCredentialStatus,
+  getCodexResetRedemptionAttempt,
   getCodexRotationSettings,
   getComposerDraftInTransaction,
   getConnectionMetadata,
@@ -21856,6 +23003,7 @@ export {
   getPendingDeviceEnrollmentRequestByUserCode,
   getPendingDeviceEnrollmentRequestByUserCodeGlobal,
   getRecording,
+  getRetainedFileArtifact,
   getRig,
   getRigByName,
   getRigChange,
@@ -21908,6 +23056,7 @@ export {
   insertPtySession,
   insertRecording,
   insertWorkspaceCapture,
+  installOrReadTurnExecutionPolicyForAttempt,
   interruptedToolCallResult,
   isCodexBilledModel2 as isCodexBilledModel,
   isCodexBilledTurn,
@@ -21923,6 +23072,7 @@ export {
   listCapabilityCatalogItems,
   listCapabilityInstallations,
   listCodexAccountStatuses,
+  listCodexResetRedemptionRecoveries,
   listConnectionsMetadata,
   listCreditBalancesByAccount,
   listDistinctRigVersionIdsInGroup,
@@ -22044,6 +23194,7 @@ export {
   registerSessionWorkflowWakeInTransaction,
   registerWorkspacePack,
   releaseCodexCredentialLease,
+  releaseCodexResetRedemptionClaim,
   releaseLeaseHolder,
   removeWorkspaceMember,
   renameCodexAccount,
@@ -22057,7 +23208,7 @@ export {
   requireSocialConnection,
   requireWorkspace,
   reserveSessionCommandReceipt,
-  reserveToolspaceCallForTurn,
+  reserveToolspaceCallForAttempt,
   resolveWorkspaceMemoryBlock,
   resumeHostExportConsumer,
   retireHostExportConsumer,
@@ -22120,6 +23271,7 @@ export {
   supersedeSessionCurrentDirectionInTransaction,
   touchEnrollmentLastSeen,
   touchLeaseHolder,
+  updateCodexAllocatorEligibility,
   updateCodexRotationSettings,
   updateConnection,
   updateImportBatchCounts,
@@ -22133,6 +23285,7 @@ export {
   updateScheduledTaskRun,
   updateSessionCommandReceiptResult,
   updateSessionGoal,
+  updateSessionMcpApprovalPolicy,
   updateSessionMcpServerCredentials,
   updateSessionTitle,
   updateVariableSet,
@@ -22152,6 +23305,7 @@ export {
   withAccountRls,
   withCodexCapacityMutation,
   withCodexCredentialRefreshLock,
+  withCodexTokenDeadline,
   withRlsContext,
   withWorkspaceRls,
   withWorkspaceSubjectRls,