@opengeni/db 0.9.3 → 0.12.0

package/dist/provision-roles.d.ts

@@ -1,13 +1,15 @@
-import { TurnInitiatorContext, TurnInitiator, ResourceRef, ToolRef, ReasoningEffort, KnowledgeMemoryKind, McpCredentialsRequest, McpCredentialAuthNeededReason, McpConnectionResourceScope, ConnectionCredentialsPort, SessionEvent, SessionStatus, SessionHumanInputRequest, SystemUpdateClassification, SessionSystemUpdateKind, SessionSystemUpdatePayload, SessionSystemUpdate, SessionEventType, SessionTurnStatus, HumanInputQuestion, Permission, SessionTurn, ConnectionKind, ConnectionStatus, KnowledgeMemory, CapabilityKind, CapabilitySource, KnowledgeMemoryStatus, KnowledgeSourceRef, ScheduledTaskStatus, ScheduledTaskScheduleSpec, ScheduledTaskRunMode, ScheduledTaskOverlapPolicy, ScheduledTaskAgentConfig, SessionGoalCreatedBy, McpServerConnectionRef as McpServerConnectionRef$1, SocialProvider, SocialConnectionStatus, SessionTurnSource, SandboxBackend, SandboxOs, FileAsset, FileUploadStatus, GitHubRepositoryScope, SessionGoal, SessionEventReadDirection, SessionEventSemanticClass, SessionEventPayloadMode, SessionAuthorizationListScope, CapabilityPack, RigChangeKind, RigChangeStatus, RigCheck, SessionGoalStatus, Session, LineageNode, SessionMcpServerMetadata, RigVersion, BillingBalance, RigChange, AccessContext, HostEventExportBatch, HostUsageExportBatch, ApiKey, ConnectionMetadata, Rig, ScheduledTask, ScheduledTaskTriggerType, ScheduledTaskRun, SocialConnection, SocialPost, VariableSet, Workspace, CapabilityInstallation, PackInstallation, CapabilityCatalogItem, HumanInputResponse, ManagedAccount, SessionQueueSnapshot, WorkspaceControlEvent, AccessGrant, WorkspaceRegisteredPack, SessionListResponse, UsageEvent, WorkspaceMember, VariableSetVariableMetadata, PackInstallationStatus, ScheduledTaskRunStatus } from '@opengeni/contracts';
+import { TurnInitiatorContext, SessionMcpApprovalPolicy, TurnInitiator, ResourceRef, ToolRef, ReasoningEffort, TurnExecutionPolicyV1, NewSessionDraftOptions, KnowledgeMemoryKind, McpCredentialsRequest, McpCredentialAuthNeededReason, McpConnectionResourceScope, ConnectionCredentialsPort, SessionEvent, SessionStatus, SessionHumanInputRequest, SystemUpdateClassification, SessionSystemUpdateKind, SessionSystemUpdatePayload, SessionSystemUpdate, SessionEventType, SessionTurnStatus, HumanInputQuestion, Permission, SessionTurn, ConnectionKind, ConnectionStatus, KnowledgeMemory, CapabilityKind, CapabilitySource, KnowledgeMemoryStatus, KnowledgeSourceRef, ScheduledTaskStatus, ScheduledTaskScheduleSpec, ScheduledTaskRunMode, ScheduledTaskOverlapPolicy, ScheduledTaskAgentConfig, SessionGoalCreatedBy, McpServerConnectionRef as McpServerConnectionRef$1, SocialProvider, SocialConnectionStatus, Session, SessionTurnSource, SandboxBackend, SandboxOs, FileAsset, FileUploadStatus, GitHubRepositoryScope, SessionGoal, SessionEventReadDirection, SessionEventSemanticClass, SessionEventPayloadMode, SessionAuthorizationListScope, CapabilityPack, RigChangeKind, RigChangeStatus, RigCheck, SessionToolPolicy, SessionGoalStatus, LineageNode, SessionMcpServerMetadata, RigVersion, BillingBalance, RigChange, AccessContext, HostEventExportBatch, HostUsageExportBatch, ApiKey, ConnectionMetadata, Rig, ScheduledTask, ScheduledTaskTriggerType, ScheduledTaskRun, SocialConnection, SocialPost, VariableSet, Workspace, CapabilityInstallation, PackInstallation, CapabilityCatalogItem, HumanInputResponse, ManagedAccount, SessionQueueSnapshot, WorkspaceControlEvent, AccessGrant, WorkspaceRegisteredPack, SessionListResponse, UsageEvent, WorkspaceMember, VariableSetVariableMetadata, PackInstallationStatus, ScheduledTaskRunStatus } from '@opengeni/contracts';
 import { environmentsEncryptionKeyBytes, Settings, McpServerConnectionRef } from '@opengeni/config';
-import { refreshCodexToken, CodexTokenSnapshot, CodexUsagePayload } from '@opengeni/codex';
+import { refreshCodexToken, CodexRateLimitResetCreditsDetails, ResetCreditFetchFailureReason, CodexTokenSnapshot, CodexFetch, CodexUsagePayload } from '@opengeni/codex';
 import { SQL } from 'drizzle-orm';
 import { PgDatabase, PgTransactionConfig } from 'drizzle-orm/pg-core';
-import { s as sessionCommandReceipts, w as workspaces, a as sessions, b as sessionTurns, c as sessionTurnAttempts, d as composerDrafts, e as schema, f as enrollmentOsValues, g as enrollmentExposureValues, h as deviceEnrollmentStatusValues, i as enrollmentStatusValues, j as sandboxKindValues, k as sessionRecordingCodecValues, l as sessionRecordingModeValues, m as sessionRecordingStateValues } from './schema-CdPGTHlD.js';
+import postgres from 'postgres';
+import { s as sessionCommandReceipts, w as workspaces, a as sessions, b as sessionTurns, c as sessionTurnAttempts, d as composerDrafts, n as newSessionDrafts, e as schema, f as enrollmentOsValues, g as enrollmentExposureValues, h as deviceEnrollmentStatusValues, i as enrollmentStatusValues, j as sandboxKindValues, k as sessionRecordingCodecValues, l as sessionRecordingModeValues, m as sessionRecordingStateValues } from './schema-CnpD6BcX.js';
 import './migrate.js';
+import { FetchLike, DnsLookup } from '@opengeni/network';
 
 declare const SESSION_ANCESTRY_LIMIT = 10000;
-type WorkspaceControlLockMode = "share" | "update";
+type WorkspaceControlLockMode = "none" | "share" | "update";
 type EffectiveControlState = "active" | "paused";
 type SessionCommandActor = {
     type: "human" | "operator";
@@ -144,7 +146,7 @@ declare function assertAgentCommandAuthorityInTransaction(db: Database, input: {
         type: "agent_attempt";
     }>;
     targetSessionId: string;
-    action: "pause" | "resume" | "steer" | "message";
+    action: "pause" | "resume" | "steer" | "message" | "goal";
 }): Promise<void>;
 declare function canonicalSessionCommandHash(value: unknown): string;
 declare function lockWorkspaceInferenceControl(db: Database, workspaceId: string, mode: WorkspaceControlLockMode): Promise<WorkspaceControlRow>;
@@ -200,6 +202,7 @@ declare function registerSessionTurnAttemptClaim(db: Database, input: {
     temporalWorkflowRunId: string;
     temporalActivityId: string;
     verifiedControlRevision: number;
+    mcpApprovalPolicies: Record<string, SessionMcpApprovalPolicy>;
 }): Promise<typeof sessionTurnAttempts.$inferSelect>;
 /**
  * Close the exact first-class owner while the caller still holds the owning
@@ -248,6 +251,7 @@ declare function reserveSessionCommandReceipt(db: Database, input: {
     targetTurnId: string | null;
     operationKey: string;
     canonicalRequestHash: string;
+    identityScope?: "actor" | "goal_operation";
 }): Promise<{
     receipt: SessionCommandReceiptRow;
     replay: boolean;
@@ -339,7 +343,7 @@ type FrozenTurnInitiator = {
 };
 declare function frozenInitiatorForCommandActor(db: Database, workspaceId: string, actor: SessionCommandActor, subjectLabel?: string): Promise<FrozenTurnInitiator>;
 
-type QueueCommandConflictCode = "QUEUE_VERSION_CHANGED" | "QUEUE_PROMPT_STARTED" | "QUEUE_ANCHOR_CHANGED" | "PROMPT_CHANGED" | "DRAFT_CHANGED" | "DRAFT_NOT_EMPTY";
+type QueueCommandConflictCode = "QUEUE_VERSION_CHANGED" | "QUEUE_PROMPT_STARTED" | "QUEUE_ANCHOR_CHANGED" | "PROMPT_CHANGED" | "DRAFT_CHANGED" | "DRAFT_NOT_EMPTY" | "EDIT_SOURCE_CHANGED";
 declare class QueueCommandConflictError extends Error {
     readonly code: QueueCommandConflictCode;
     readonly current: {
@@ -429,6 +433,7 @@ declare function saveComposerDraftInTransaction(db: Database, input: {
     text: string;
     resources: ResourceRef[];
     tools: ToolRef[];
+    toolsProvided: boolean;
     model: string;
     reasoningEffort: ReasoningEffort;
 }): Promise<ComposerDraftRow>;
@@ -489,9 +494,12 @@ declare function submitHumanPromptInTransaction(db: Database, input: {
     turnInstructions?: string | null;
     resources: ResourceRef[];
     tools: ToolRef[];
+    toolsProvided?: boolean;
     model?: string | null;
     reasoningEffort?: ReasoningEffort | null;
     reasoningEffortFallback: ReasoningEffort;
+    /** Trusted API/core admission snapshot. Omitted only by legacy low-level callers. */
+    turnExecutionPolicy?: TurnExecutionPolicyV1;
     source: "user" | "api";
     mcpCredentialUpdates?: Array<{
         id: string;
@@ -519,6 +527,42 @@ declare function steerAgentSessionInTransaction(db: Database, input: {
     instruction: string;
 }): Promise<AgentInternalUpdateCommandResult>;
 
+type NewSessionDraftRow = typeof newSessionDrafts.$inferSelect;
+declare class NewSessionDraftConflictError extends Error {
+    readonly currentRevision: number;
+    readonly name = "NewSessionDraftConflictError";
+    constructor(currentRevision: number);
+}
+declare class NewSessionDraftAccessError extends Error {
+    readonly name = "NewSessionDraftAccessError";
+    constructor();
+}
+declare function getNewSessionDraftInTransaction(db: Database, input: {
+    workspaceId: string;
+    subjectId: string;
+    lock?: boolean;
+}): Promise<NewSessionDraftRow | null>;
+declare function saveNewSessionDraftInTransaction(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    expectedRevision: number;
+    text: string;
+    resources: ResourceRef[];
+    tools: ToolRef[];
+    model: string;
+    reasoningEffort: ReasoningEffort;
+    options: NewSessionDraftOptions;
+    /** API-key and delegated service subjects have no workspace-membership row. */
+    requireWorkspaceMembership?: boolean;
+}): Promise<NewSessionDraftRow>;
+/** Delete only the submitted revision; a newer sibling-tab revision survives. */
+declare function consumeNewSessionDraftInTransaction(db: Database, input: {
+    workspaceId: string;
+    subjectId: string;
+    expectedRevision: number;
+}): Promise<boolean>;
+
 /** Provider-valid result for a started call whose durable outcome is unknown. */
 declare function interruptedToolCallResult(input: {
     callType: string;
@@ -551,7 +595,14 @@ declare function sanitizeEventString(value: string): string;
  * combinations are traversed; non-string leaves pass through untouched. Object
  * keys are sanitized too -- they are jsonb-constrained the same as values.
  */
-declare function sanitizeEventPayload<T>(payload: T): T;
+type SanitizeEventPayloadOptions = {
+    /**
+     * Separately trusted, server-created retained-output evidence. Never populate
+     * this from a producer-controlled payload field.
+     */
+    fullEvidence?: unknown;
+};
+declare function sanitizeEventPayload<T>(payload: T, options?: SanitizeEventPayloadOptions): T;
 /**
  * Make model-facing conversation data safe for Postgres without redacting it.
  *
@@ -734,6 +785,22 @@ type ProvisionRolesOptions = {
  */
 declare function provisionRoles(adminConnection: string, options?: ProvisionRolesOptions): Promise<ProvisionResult>;
 
+type CodexTokenDeadlineClock = {
+    setTimeout: (callback: () => void, delayMs: number) => ReturnType<typeof globalThis.setTimeout>;
+    clearTimeout: (handle: ReturnType<typeof globalThis.setTimeout>) => void;
+};
+type CodexTokenDeadlineOptions = {
+    timeoutMs?: number | undefined;
+    signal?: AbortSignal | undefined;
+    clock?: CodexTokenDeadlineClock | undefined;
+};
+/**
+ * Bound a refresh promise without abandoning its rejection handler when the
+ * deadline or cancellation wins. The provider promise is observed exactly
+ * once, while the observer itself always fulfills, so a late provider failure
+ * cannot become an unhandled rejection or replace the authoritative outcome.
+ */
+declare function withCodexTokenDeadline<T>(operation: Promise<T>, options?: CodexTokenDeadlineOptions): Promise<T>;
 type CodexAuthDeps = {
     loadCredential: typeof loadCodexCredentialForRun;
     recordRefresh: typeof recordCodexTokenRefresh;
@@ -761,7 +828,23 @@ declare function buildCodexTokenResolver(db: Database, settings: Settings, works
  * A refresh that stamps needs_relogin returns { status:"error", reason } and never
  * hits the provider; a transient refresh error returns a plain error payload.
  */
-declare function fetchCodexUsageForAccount(db: Database, settings: Settings, workspaceId: string, credentialId: string): Promise<CodexUsagePayload>;
+declare function fetchCodexUsageForAccount(db: Database, settings: Settings, workspaceId: string, credentialId: string, fetchImpl?: CodexFetch): Promise<CodexUsagePayload>;
+type CodexRateLimitResetCreditsAccountResult = {
+    ok: true;
+    status: number;
+    details: CodexRateLimitResetCreditsDetails;
+} | {
+    ok: false;
+    status: number;
+    reason: ResetCreditFetchFailureReason | "needs_relogin";
+};
+/**
+ * Fresh detailed reset-credit inventory for one exact workspace credential.
+ * The token is refreshed through the same resolver as usage and never escapes
+ * this server-side function. Detailed rows are returned to the route only and
+ * are never persisted as redemption authority.
+ */
+declare function fetchCodexRateLimitResetCreditsForAccount(db: Database, settings: Settings, workspaceId: string, credentialId: string, fetchImpl?: CodexFetch): Promise<CodexRateLimitResetCreditsAccountResult>;
 
 type ResolveConnectionCredentialResult = {
     status: "ok";
@@ -787,6 +870,8 @@ type ResolveConnectionCredentialInput = {
     /** @deprecated Use toolName. Retained for the API's pre-existing broker call shape. */
     toolId?: string;
     connectionRef: McpServerConnectionRef;
+    /** Exact MCP destination whose request would receive the resolved headers. */
+    destinationUrl: string;
     forceRefresh?: boolean;
 };
 type HostMcpCredentialResolverContext = {
@@ -805,7 +890,7 @@ declare class HostMcpCredentialScopeError extends Error {
     constructor(field: "accountId" | "workspaceId" | "sessionId");
 }
 declare class HostMcpCredentialBindingError extends Error {
-    constructor(field: "provider" | "providerDomain" | "connectionId" | "scopes" | "resource" | "selectedResources");
+    constructor(field: "provider" | "providerDomain" | "connectionId" | "scopes" | "resource" | "selectedResources" | "destinationUrl");
 }
 /**
  * Adapts the public embedding credential port to the runtime's connection
@@ -824,6 +909,10 @@ type ConnectionBrokerDeps = {
     keyBytes: typeof environmentsEncryptionKeyBytes;
     now: () => Date;
 };
+type RefreshTransportOptions = {
+    fetchImpl?: FetchLike;
+    dnsLookup?: DnsLookup;
+};
 declare function buildConnectionTokenResolver(db: Database, settings: Settings, deps?: ConnectionBrokerDeps): (input: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult>;
 declare class ConnectionRefreshHttpError extends Error {
     readonly httpStatus: number;
@@ -836,12 +925,11 @@ declare class ConnectionRefreshHttpError extends Error {
  * the canonical `Bearer`. A non-bearer scheme is passed through unchanged.
  */
 declare function normalizeBearerScheme(tokenType: string | null | undefined): string;
-declare function refreshOAuthConnectionCredential(cred: ConnectionCredentialForBroker, ref: McpServerConnectionRef, settings?: Settings): Promise<{
+declare function refreshOAuthConnectionCredential(cred: ConnectionCredentialForBroker, ref: McpServerConnectionRef, settings: Settings, transportOptions?: RefreshTransportOptions): Promise<{
     credential: Record<string, unknown>;
     expiresAt: Date | null;
     grantedScopes?: string[];
 }>;
-declare function isPrivateAddress(address: string): boolean;
 
 type Database = PgDatabase<any, typeof schema>;
 type DbClient = {
@@ -852,6 +940,54 @@ type RlsContext = {
     accountId: string;
     workspaceId?: string | null;
 };
+type NestedAgentDepthPolicySource = "session" | "workspace" | "deployment" | "default";
+type SessionDepthPolicy = {
+    rootSessionId: string;
+    nestedAgentDepth: number;
+    maxNestedAgentDepthOverride: number | null;
+    effectiveMaxNestedAgentDepth: number;
+    nestedAgentDepthPolicySource: NestedAgentDepthPolicySource;
+    nestedAgentDepthPolicySessionId: string | null;
+};
+type SessionSpawnDenialCode = "nested_agent_depth_exceeded" | "nested_agent_depth_override_forbidden";
+type SessionSpawnDenial = {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    parentSessionId: string | null;
+    rootSessionId: string | null;
+    currentDepth: number;
+    attemptedDepth: number;
+    effectiveMaxNestedAgentDepth: number;
+    requestedMaxNestedAgentDepthOverride: number | null;
+    policySource: NestedAgentDepthPolicySource;
+    policySessionId: string | null;
+    subjectId: string | null;
+    code: SessionSpawnDenialCode;
+    idempotencyKey: string | null;
+    createdAt: string;
+};
+type NestedAgentDepthDeploymentPolicy = {
+    maxNestedAgentDepth: number;
+    policySource: "deployment" | "default";
+};
+type DbSession = Session & SessionDepthPolicy;
+type SessionCreateSuccessResult = {
+    denied: false;
+    session: DbSession;
+    created: boolean;
+};
+type SessionCreateDeniedResult = {
+    denied: true;
+    created: false;
+    denial: SessionSpawnDenial;
+};
+type SessionCreateResult = SessionCreateSuccessResult | SessionCreateDeniedResult;
+/** Thrown only after a denied create transaction has committed its evidence. */
+declare class SessionSpawnDeniedDbError extends Error {
+    readonly denial: SessionSpawnDenial;
+    constructor(denial: SessionSpawnDenial);
+}
 /**
  * RLS posture for the connection OpenGeni's query layer runs over (Step I, §7.7).
  *
@@ -902,6 +1038,13 @@ type CreateDbOptions = {
     userLookup?: UserLookup;
     /** postgres-js pool size; defaults to today's `10`. */
     max?: number;
+    /**
+     * Connection-local default transaction isolation sent in the postgres-js
+     * startup parameters. This is intentionally not a role/database default:
+     * tests and embedded callers can exercise a different ambient isolation
+     * without mutating a shared PostgreSQL role or affecting other connections.
+     */
+    isolationLevel?: postgres.ConnectionParameters["default_transaction_isolation"];
 };
 /** The strategy bound to a handle (or the `"force"` default). */
 declare function rlsStrategyFor(db: Database): RlsStrategy;
@@ -1035,6 +1178,8 @@ declare function withWorkspaceRls<T>(db: Database, workspaceId: string, fn: (db:
  * even if a future query accidentally omits its explicit subject predicate.
  */
 declare function withWorkspaceSubjectRls<T>(db: Database, workspaceId: string, subjectId: string, fn: (db: Database) => Promise<T>, transactionConfig?: PgTransactionConfig): Promise<T>;
+/** Apply and verify actor-private RLS on an already transaction-pinned handle. */
+declare function setSubjectRlsContext(db: Database, subjectId: string): Promise<void>;
 declare function withWorkspaceUsageLock<T>(db: Database, workspaceId: string, fn: (db: Database) => Promise<T>): Promise<T>;
 declare function withAccountRls<T>(db: Database, accountId: string, fn: (db: Database) => Promise<T>): Promise<T>;
 declare const allWorkspacePermissions: Permission[];
@@ -1241,6 +1386,11 @@ declare function countScheduledTasksForWorkspace(db: Database, workspaceId: stri
 type AppendEventInput = {
     type: SessionEventType;
     payload?: unknown;
+    /**
+     * Server-created retained-output evidence for canonical audit truncation.
+     * Producer payload fields are never trusted as evidence.
+     */
+    retainedOutputEvidence?: unknown;
     clientEventId?: string;
     turnId?: string | null;
     turnGeneration?: number | null;
@@ -1534,7 +1684,7 @@ type CreateSessionMcpServerInput = {
     allowedTools?: string[] | null;
     timeoutMs?: number | null;
     cacheToolsList?: boolean | null;
-    requireApproval?: boolean | string[] | null;
+    requireApproval?: SessionMcpApprovalPolicy | null;
     connectionRef?: McpServerConnectionRef$1 | null;
     headersEncrypted?: Record<string, string>;
 };
@@ -1546,11 +1696,15 @@ type UpdateSessionMcpServerCredentialsResult = {
     servers: SessionMcpServerMetadata[];
     missingIds: string[];
 };
+type UpdateSessionMcpApprovalPolicyResult = {
+    server: SessionMcpServerMetadata | null;
+    changed: boolean;
+};
 type SessionMcpServerForRun = SessionMcpServerMetadata & {
     allowedTools?: string[];
     timeoutMs?: number;
     cacheToolsList?: boolean;
-    requireApproval?: boolean | string[];
+    requireApproval: SessionMcpApprovalPolicy;
     headers: Record<string, string>;
 };
 type EnqueueSessionTurnInput = {
@@ -1564,6 +1718,7 @@ type EnqueueSessionTurnInput = {
     turnInstructions?: string | null;
     resources: ResourceRef[];
     tools: ToolRef[];
+    toolsProvided?: boolean;
     model: string;
     reasoningEffort: ReasoningEffort;
     sandboxBackend: SandboxBackend;
@@ -1601,6 +1756,17 @@ declare function createFileUpload(db: Database, input: {
 }>;
 declare function getFile(db: Database, workspaceId: string, fileId: string): Promise<FileAsset | null>;
 declare function requireFile(db: Database, workspaceId: string, fileId: string): Promise<FileAsset>;
+type RetainedFileArtifact = {
+    file: FileAsset;
+    uploadStatus: FileUploadStatus | null;
+    uploadExpiresAt: Date | null;
+};
+/**
+ * RLS-scoped file lookup with just enough upload lifecycle truth to distinguish
+ * pending, failed, and expired artifact references. The bytes and provider
+ * location remain in the existing FileAsset/object-storage seam.
+ */
+declare function getRetainedFileArtifact(db: Database, workspaceId: string, fileId: string): Promise<RetainedFileArtifact | null>;
 declare function getFileUpload(db: Database, workspaceId: string, uploadId: string): Promise<{
     id: string;
     status: FileUploadStatus;
@@ -2087,6 +2253,15 @@ type CodexCredentialForRun = {
  * accessor — auto-activates a brand-new first account and ensures the
  * rotation-settings row exists.
  */
+type UpsertCodexSubscriptionCredentialResult = {
+    kind: "upserted";
+    id: string;
+    isNew: boolean;
+} | {
+    kind: "unresolved_redemption";
+    id: string;
+    isNew: false;
+};
 declare function upsertCodexSubscriptionCredential(db: Database, input: {
     accountId: string;
     workspaceId: string;
@@ -2099,10 +2274,9 @@ declare function upsertCodexSubscriptionCredential(db: Database, input: {
     lastRefreshAt: Date | null;
     accountEmail?: string | null;
     label?: string | null;
-}): Promise<{
-    id: string;
-    isNew: boolean;
-}>;
+    /** Direct managed-cookie human who most recently connected this row. */
+    connectedBySubjectId?: string | null;
+}): Promise<UpsertCodexSubscriptionCredentialResult>;
 /**
  * The ONLY decrypt-read accessor. Fails closed. Never call from an API route that
  * returns the result.
@@ -2231,6 +2405,12 @@ type CodexAccountStatus = {
     status: string;
     /** New automatic allocations only; health/refresh and existing turns remain independent. */
     allocatorEnabled: boolean;
+    allocatorVersion: number;
+    allocatorUpdatedBySubjectId: string | null;
+    allocatorUpdatedAt: Date | null;
+    resetCreditAvailableCount: number | null;
+    resetCreditsCheckedAt: Date | null;
+    connectedBySubjectId: string | null;
     isActive: boolean;
     expiresAt: Date | null;
     lastRefreshAt: Date | null;
@@ -2250,7 +2430,7 @@ type CodexAccountStatus = {
  * the selection cursor gives deterministic fairness after those holders drain.
  * None of these fields contains credential material.
  */
-type CodexLeaseAccountStatus = CodexAccountStatus & {
+type CodexLeaseAccountStatus = Omit<CodexAccountStatus, "allocatorVersion" | "allocatorUpdatedBySubjectId" | "allocatorUpdatedAt" | "resetCreditAvailableCount" | "resetCreditsCheckedAt" | "connectedBySubjectId"> & {
     activeLeaseCount: number;
     selectionCount: number;
     lastSelectedAt: Date | null;
@@ -2552,13 +2732,198 @@ declare function quarantineCodexCredentialForLease(db: Database, input: {
  * the workspace active pointer. Ordered by created_at ASC (stable list order).
  */
 declare function listCodexAccountStatuses(db: Database, workspaceId: string): Promise<CodexAccountStatus[]>;
+type CodexAllocatorUpdateResult = {
+    kind: "updated" | "unchanged";
+    allocatorEnabled: boolean;
+    allocatorVersion: number;
+    allocatorUpdatedBySubjectId: string | null;
+    allocatorUpdatedAt: Date | null;
+} | {
+    kind: "conflict";
+    allocatorEnabled: boolean;
+    allocatorVersion: number;
+    allocatorUpdatedBySubjectId: string | null;
+    allocatorUpdatedAt: Date | null;
+} | {
+    kind: "not_found";
+};
+/**
+ * Toggle only NEW allocator eligibility under credential-row OCC.
+ *
+ * Same-state writes are idempotent even when `expectedVersion` is stale. A real
+ * state transition requires the exact current version, increments only the
+ * allocator version, and writes one audit row in the same transaction. It never
+ * touches credential `version`, health, encrypted material, cooldown, or quota.
+ */
+declare function updateCodexAllocatorEligibility(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    credentialId: string;
+    subjectId: string;
+    enabled: boolean;
+    expectedVersion: number;
+}): Promise<CodexCapacityMutationResult<CodexAllocatorUpdateResult>>;
+declare const CODEX_RESET_REDEMPTION_OUTCOMES: readonly ["reset", "nothingToReset", "noCredit", "alreadyRedeemed"];
+type CodexResetRedemptionOutcome = (typeof CODEX_RESET_REDEMPTION_OUTCOMES)[number];
+type CodexResetRedemptionStatus = "processing" | "provider_started" | "completed";
+type CodexResetRedemptionAttempt = {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    credentialId: string;
+    subjectId: string;
+    browserSessionHash: string;
+    creditId: string;
+    upstreamIdempotencyKey: string;
+    status: CodexResetRedemptionStatus;
+    outcome: CodexResetRedemptionOutcome | null;
+    claimHolderId: string | null;
+    claimExpiresAt: Date | null;
+    confirmationExpiresAt: Date;
+    providerStartedAt: Date | null;
+    completedAt: Date | null;
+    lastFailureKind: string | null;
+    retryCount: number;
+    createdAt: Date;
+    updatedAt: Date;
+};
+/** Metadata-only attempt read used to resume a browser-session-bound ambiguity. */
+declare function getCodexResetRedemptionAttempt(db: Database, workspaceId: string, attemptId: string): Promise<CodexResetRedemptionAttempt | null>;
+type CodexResetRedemptionRecovery = {
+    attemptId: string;
+    credentialId: string;
+    creditId: string;
+    status: "provider_started" | "completed";
+    outcome: CodexResetRedemptionOutcome | null;
+    providerStartedAt: Date | null;
+    completedAt: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+};
+/**
+ * Cookie-owner discovery source for durable ambiguous/completed attempts.
+ * Browser storage is never required to recover these non-secret identifiers.
+ */
+declare function listCodexResetRedemptionRecoveries(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+}): Promise<CodexResetRedemptionRecovery[]>;
+type AdoptCodexResetRedemptionResult = {
+    kind: "current" | "adopted";
+    attempt: CodexResetRedemptionAttempt;
+} | {
+    kind: "in_progress";
+} | {
+    kind: "not_found";
+} | {
+    kind: "forbidden";
+} | {
+    kind: "conflict";
+};
+/** Adopt a released durable ambiguity/completion into the owner's current browser session. */
+declare function adoptCodexResetRedemptionAttempt(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    attemptId: string;
+    credentialId: string;
+    creditId: string;
+    subjectId: string;
+    browserSessionHash: string;
+}): Promise<AdoptCodexResetRedemptionResult>;
+type ClaimCodexResetRedemptionResult = {
+    kind: "claimed";
+    attempt: CodexResetRedemptionAttempt;
+} | {
+    kind: "in_progress";
+    attempt: CodexResetRedemptionAttempt;
+} | {
+    kind: "completed";
+    attempt: CodexResetRedemptionAttempt;
+} | {
+    kind: "not_found";
+} | {
+    kind: "forbidden";
+} | {
+    kind: "conflict";
+};
+/**
+ * Claim or reclaim one logical redemption across API replicas/crashes.
+ *
+ * A transaction advisory lock closes the initial INSERT race. A live claim
+ * yields `in_progress`; an expired/released claim is reclaimed without changing
+ * the status or upstream key. Existing attempt identity is immutable.
+ */
+declare function claimCodexResetRedemption(db: Database, input: {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    credentialId: string;
+    subjectId: string;
+    browserSessionHash: string;
+    creditId: string;
+    confirmationExpiresAt: Date;
+    claimHolderId: string;
+    claimTtlMs?: number;
+}): Promise<ClaimCodexResetRedemptionResult>;
+type CodexResetRedemptionSendNotReadyReason = "not_found" | "identity_mismatch" | "claim_expired" | "confirmation_expired" | "credential_unavailable" | "already_completed";
+type FenceCodexResetRedemptionSendResult = {
+    kind: "ready";
+    attempt: CodexResetRedemptionAttempt;
+} | {
+    kind: "not_ready";
+    reason: CodexResetRedemptionSendNotReadyReason;
+};
+/**
+ * Final DB-time irreversible-send fence, called only after preflight and token
+ * resolution and immediately before every provider POST (including ambiguity
+ * retries). The credential SHARE lock serializes against disconnect and
+ * ownership-changing reconnect. The claim is extended beyond the bounded
+ * consume operation in the same transaction that persists provider_started.
+ */
+declare function fenceCodexResetRedemptionSend(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    attemptId: string;
+    claimHolderId: string;
+    credentialId: string;
+    subjectId: string;
+    browserSessionHash: string;
+    sendLeaseMs?: number;
+}): Promise<FenceCodexResetRedemptionSendResult>;
+/** Delete only definite pre-provider work still owned by this request. */
+declare function abandonCodexResetRedemptionBeforeProvider(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    attemptId: string;
+    claimHolderId: string;
+}): Promise<boolean>;
+/** Release a failed claim while preserving processing/provider_started truth. */
+declare function releaseCodexResetRedemptionClaim(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    attemptId: string;
+    claimHolderId: string;
+    failureKind: string;
+}): Promise<boolean>;
+/** Persist the exact provider outcome, cooldown repair, and audit atomically. */
+declare function completeCodexResetRedemption(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    attemptId: string;
+    claimHolderId: string;
+    outcome: CodexResetRedemptionOutcome;
+}): Promise<CodexCapacityMutationResult<CodexResetRedemptionAttempt | null>>;
 /** The P2 usage-cache snapshot written by the refreshing usage wrapper. */
 type CodexAccountUsageSnapshot = {
-    primaryUsedPercent: number | null;
-    primaryResetAt: Date | null;
-    secondaryUsedPercent: number | null;
-    secondaryResetAt: Date | null;
-    checkedAt: Date;
+    primaryUsedPercent?: number | null;
+    primaryResetAt?: Date | null;
+    secondaryUsedPercent?: number | null;
+    secondaryResetAt?: Date | null;
+    /** Present only when the quota body parsed successfully. */
+    checkedAt?: Date;
+    resetCreditAvailableCount?: number | null;
+    resetCreditsCheckedAt?: Date | null;
 };
 /**
  * Cache-write for P2 quota bars: persist the five plaintext usage columns on a
@@ -2704,9 +3069,13 @@ declare function recordSessionActiveCodexCredential(db: Database, workspaceId: s
 declare function disconnectCodexAccount(db: Database, workspaceId: string, credentialId: string): Promise<{
     removed: boolean;
     newActiveCredentialId: string | null;
+    blockedByUnresolvedRedemption: boolean;
+}>;
+/** Legacy "disconnect all"; atomically rejects when any provider work is unresolved. */
+declare function disconnectAllCodexAccounts(db: Database, workspaceId: string): Promise<{
+    removed: number;
+    blockedCredentialIds: string[];
 }>;
-/** Legacy "disconnect all" (old workspace-wide behavior). Returns rows removed. */
-declare function disconnectAllCodexAccounts(db: Database, workspaceId: string): Promise<number>;
 declare function recordAuditEvent(db: Database, input: {
     accountId: string;
     workspaceId?: string | null;
@@ -2739,7 +3108,15 @@ declare function updateSessionMcpServerCredentials(db: Database, input: {
     sessionId: string;
     updates: UpdateSessionMcpServerCredentialsInput[];
 }): Promise<UpdateSessionMcpServerCredentialsResult>;
-declare function listSessionMcpServersForRun(db: Database, workspaceId: string, sessionId: string, encryptionKey: Uint8Array | null): Promise<SessionMcpServerForRun[]>;
+declare function updateSessionMcpApprovalPolicy(db: Database, input: {
+    workspaceId: string;
+    sessionId: string;
+    serverId: string;
+    requireApproval: SessionMcpApprovalPolicy;
+}): Promise<UpdateSessionMcpApprovalPolicyResult>;
+declare function listSessionMcpServersForRun(db: Database, workspaceId: string, sessionId: string, attemptId: string, encryptionKey: Uint8Array | null): Promise<SessionMcpServerForRun[]>;
+/** Read the persisted deployment fallback; process configuration is not policy authority. */
+declare function getNestedAgentDepthDeploymentPolicy(db: Database): Promise<NestedAgentDepthDeploymentPolicy>;
 type AgentSessionCreationActor = Extract<SessionCommandActor, {
     type: "agent_attempt";
 }>;
@@ -2748,7 +3125,7 @@ declare class SessionIdConflictError extends Error {
     readonly sessionId: string;
     constructor(sessionId: string);
 }
-declare function createSession(db: Database, input: {
+type SessionCreateInput = {
     requestedSessionId?: string;
     accountId: string;
     workspaceId: string;
@@ -2756,12 +3133,8 @@ declare function createSession(db: Database, input: {
     initialTurnInstructions?: string | null;
     resources: ResourceRef[];
     tools?: ToolRef[];
+    toolPolicy?: SessionToolPolicy | null;
     metadata: Record<string, unknown>;
-    /**
-     * Frozen creator authority. Legacy/test-only callers may omit this and get
-     * an explicit unattributed service sentinel; production producers must pass
-     * an authenticated subject or named service.
-     */
     createdBy?: TurnInitiator;
     createdByContext?: TurnInitiatorContext;
     createdByActor?: AgentSessionCreationActor | null;
@@ -2777,47 +3150,40 @@ declare function createSession(db: Database, input: {
     sandboxGroupId?: string | null;
     sandboxOs?: SandboxOs;
     mcpServers?: CreateSessionMcpServerInput[];
-}): Promise<Session>;
+    maxNestedAgentDepthOverride?: number | null;
+    allowNestedAgentDepthIncrease?: boolean;
+    subjectId?: string | null;
+};
+declare function createSession(db: Database, input: SessionCreateInput): Promise<DbSession>;
 /**
  * Inserts a session under a workspace-scoped CREATE idempotency key, collapsing
- * a concurrent race on the same key to a single row. On the unique-violation
- * the conflicting insert does nothing (`onConflictDoNothing` on the partial
- * unique index) and the now-existing winning row is fetched and returned, so
- * two near-simultaneous creates with the same key yield ONE session and both
- * callers see the same id. `created` distinguishes the winner (true: this call
- * inserted and must run the rest of the start flow) from the loser/dup (false:
- * the row already existed and must be returned as-is).
- */
-declare function createSessionWithIdempotencyKey(db: Database, input: {
-    requestedSessionId?: string;
-    accountId: string;
-    workspaceId: string;
-    initialMessage: string;
-    initialTurnInstructions?: string | null;
-    resources: ResourceRef[];
-    tools?: ToolRef[];
-    metadata: Record<string, unknown>;
-    createdBy?: TurnInitiator;
-    createdByContext?: TurnInitiatorContext;
-    createdByActor?: AgentSessionCreationActor | null;
-    model: string;
-    sandboxBackend: SandboxBackend;
-    variableSetId?: string | null;
-    rigId?: string | null;
-    rigVersionId?: string | null;
-    firstPartyMcpPermissions?: Permission[] | null;
-    instructions?: string | null;
-    parentSessionId?: string | null;
+ * a concurrent race on the same key to a single row. A losing source insert
+ * is either handled by `onConflictDoNothing` on the partial unique index or
+ * suppressed by the database BEFORE guard, and the durable winner is fetched
+ * and returned. Two near-simultaneous creates with the same key therefore
+ * yield ONE session and both callers see the same id. `created` distinguishes
+ * the winner (true: this call inserted and must run the rest of the start flow)
+ * from the loser/dup (false: the row already existed and must be returned as-is).
+ */
+declare function createSessionWithIdempotencyKeyResult(db: Database, input: SessionCreateInput & {
     createIdempotencyKey: string;
-    sandboxGroupId?: string | null;
-    sandboxOs?: SandboxOs;
-    mcpServers?: CreateSessionMcpServerInput[];
-}): Promise<{
-    session: Session;
-    created: boolean;
-}>;
+}): Promise<SessionCreateResult>;
+/**
+ * Backward-compatible keyed create API. Denials are committed by the
+ * admission transaction and then surfaced as SessionSpawnDeniedDbError;
+ * callers that need a structured result use createSessionWithIdempotencyKeyResult.
+ */
+declare function createSessionWithIdempotencyKey(db: Database, input: SessionCreateInput & {
+    createIdempotencyKey: string;
+}): Promise<SessionCreateSuccessResult>;
 declare function getSessionByCreateIdempotencyKey(db: Database, workspaceId: string, createIdempotencyKey: string): Promise<Session | null>;
 declare function getSession(db: Database, workspaceId: string, sessionId: string): Promise<Session | null>;
+declare function getSessionSpawnDenial(db: Database, workspaceId: string, denialId: string): Promise<SessionSpawnDenial | null>;
+declare function getSessionSpawnDenialByIdempotencyKey(db: Database, workspaceId: string, createIdempotencyKey: string): Promise<SessionSpawnDenial | null>;
+declare function listSessionSpawnDenials(db: Database, workspaceId: string, options?: {
+    limit?: number;
+    parentSessionId?: string | null;
+}): Promise<SessionSpawnDenial[]>;
 /**
  * Resolve ANY session that belongs to a shared-sandbox group (addendum 05 §D.3,
  * stress (e)). Used by the create-session `sandbox:{groupId}` join path to (1)
@@ -2855,6 +3221,10 @@ type ListSessionsForSubjectOptions = ListSessionsOptions & {
     subjectId: string;
     cursor?: SessionListCursor | undefined;
     search?: string | undefined;
+    /** Return only the complete personal pin projection; never scan/snapshot ordinary rows. */
+    pinsOnly?: boolean | undefined;
+    /** Materialize a continuation snapshot. Disable for legacy one-page array reads. */
+    materializeSnapshot?: boolean | undefined;
     authorizationScope?: SessionAuthorizationListScope | undefined;
 };
 declare class SessionPinVersionConflictError extends Error {
@@ -2864,9 +3234,15 @@ declare class SessionPinVersionConflictError extends Error {
 declare class SessionListCursorError extends Error {
     constructor(message?: string);
 }
+declare class SessionListCursorExpiredError extends Error {
+    constructor(message?: string);
+}
 declare class SessionListAccessError extends Error {
     constructor(message?: string);
 }
+declare class SessionListSnapshotLimitError extends Error {
+    constructor(message?: string);
+}
 declare class SessionPinAccessError extends Error {
     constructor(message?: string);
 }
@@ -2896,6 +3272,8 @@ declare function sessionTreeStatsForSessions(db: Database, workspaceId: string,
  * `UNION ALL`) makes legacy cycles terminate without a caller-sized path array.
  */
 declare function sessionAuthorizationScopeFilter(scope: SessionAuthorizationListScope): SQL;
+declare const SESSION_LIST_SNAPSHOT_MAX_IDS = 5000;
+declare const SESSION_LIST_SNAPSHOT_MAX_ACTIVE_PER_SUBJECT = 32;
 /** Opaque, URL-safe cursor encoding for a server-owned activity snapshot. */
 declare function encodeSessionListCursor(cursor: SessionListCursor): string;
 /** Decode and validate a cursor before it reaches any SQL predicate. */
@@ -2915,8 +3293,9 @@ declare function listSessionsForSubject(db: Database, workspaceId: string, optio
 declare function getSessionForSubject(db: Database, workspaceId: string, sessionId: string, subjectId: string, relatedSessionAccess?: "target" | "root"): Promise<Session | null>;
 /**
  * Idempotently set a member's pin without mutating the session's lifecycle or
- * activity timestamps. A transaction advisory lock serializes same-subject,
- * same-session actions across API replicas; expectedVersion rejects stale tabs.
+ * activity timestamps. A subject-scoped transaction advisory lock serializes
+ * personal pin mutations across API replicas and fences list projections;
+ * expectedVersion rejects stale tabs.
  */
 declare function setSessionPin(db: Database, input: {
     workspaceId: string;
@@ -3031,6 +3410,14 @@ type ListSessionEventsOptions = {
     excludeClasses?: readonly SessionEventSemanticClass[];
     defaultExcludeTypes?: readonly SessionEventType[];
     payloadMode?: SessionEventPayloadMode;
+    /**
+     * Internal exclusive-latest selector. Eligible legacy rows with a null
+     * association remain visible, while late-rejected and duplicate callbacks do
+     * not compete with current truth. Durable session sequence is authoritative
+     * across distinct turns; turn generation is metadata only here. Callers must
+     * pair this with a single semantic class and limit 1.
+     */
+    authoritativeLatest?: boolean;
 };
 type ListSessionEventPageOptions = ListSessionEventsOptions & {
     /** Exact UTF-8 JSON-array envelope budget for rows materialized by the app. */
@@ -3071,9 +3458,25 @@ declare function listSessionEvents(db: Database, workspaceId: string, sessionId:
 type ToolspaceCallReservation = {
     reserved: true;
     count: number;
+    turn: SessionTurnForExecution;
 } | {
     reserved: false;
+    reason: TurnAttemptFenceRejectReason | "budget_exhausted";
+};
+type ToolspaceTurnAttemptClaims = {
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
 };
+/**
+ * Admit one exact Toolspace bearer before any session credential is decrypted or
+ * any upstream schema is enumerated. This intentionally reuses the canonical
+ * activity write fence so Pause/Steer, attempt replacement, generation changes,
+ * and terminal settlement revoke a copied token at the same linearization point
+ * as other attempt-owned writes.
+ */
+declare function admitToolspaceTurnAttempt(db: Database, workspaceId: string, claims: ToolspaceTurnAttemptClaims): Promise<boolean>;
 /**
  * Atomically reserve one toolspace call against a turn's per-turn budget.
  *
@@ -3081,10 +3484,20 @@ type ToolspaceCallReservation = {
  * below `limit` and returns the post-increment value. Concurrent reservations
  * for the same turn serialize on the row lock, so exactly `limit` of N
  * simultaneous callers observe `reserved: true` — closing the read-then-append
- * TOCTOU the event-count approach had. `reserved: false` means the turn is at or
- * over budget (or the turn row no longer exists).
+ * TOCTOU the event-count approach had. The returned attempt id is captured by
+ * that same UPDATE, so callers cannot accidentally execute under a successor
+ * attempt. `reserved: false` means the turn is not executable, at/over budget,
+ * or no longer exists.
  */
-declare function reserveToolspaceCallForTurn(db: Database, workspaceId: string, sessionId: string, turnId: string, limit: number): Promise<ToolspaceCallReservation>;
+declare function reserveToolspaceCallForAttempt(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    executionGeneration: number;
+    attemptId: string;
+    limit: number;
+}): Promise<ToolspaceCallReservation>;
 declare function getSessionEvent(db: Database, workspaceId: string, eventId: string): Promise<SessionEvent | null>;
 declare function listWorkspaceControlEvents(db: Database, workspaceId: string, after?: number, limit?: number): Promise<WorkspaceControlEvent[]>;
 declare function getWorkspaceControlEvent(db: Database, workspaceId: string, eventId: string): Promise<WorkspaceControlEvent | null>;
@@ -3153,6 +3566,30 @@ declare function getHumanInputResumeForEvent(db: Database, workspaceId: string,
     response: HumanInputResponse;
 } | null>;
 type TurnAttemptFenceRejectReason = "workspace_paused" | "session_paused" | "pending_control" | "active_turn_changed" | "generation_changed" | "attempt_changed" | "turn_terminal" | "not_found";
+type InstallOrReadTurnExecutionPolicyForAttemptResult = {
+    accepted: true;
+    installed: boolean;
+    policy: TurnExecutionPolicyV1;
+    turn: SessionTurn;
+} | {
+    accepted: false;
+    reason: TurnAttemptFenceRejectReason;
+};
+/**
+ * Freeze a legacy turn's execution identity at its first admitted attempt, or
+ * return the policy already accepted for this logical turn. The exact active
+ * attempt owns this mutation; malformed present metadata fails closed and a
+ * replay never replaces an existing valid policy.
+ */
+declare function installOrReadTurnExecutionPolicyForAttempt(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    executionGeneration: number;
+    attemptId: string;
+    policyForAbsent: TurnExecutionPolicyV1;
+}): Promise<InstallOrReadTurnExecutionPolicyForAttemptResult>;
 /**
  * Append conversation items (verbatim SDK AgentInputItems) to the session's
  * history. Idempotent on (workspace, session, position): concurrent or
@@ -3183,6 +3620,7 @@ type PendingSessionToolCallInput = {
     callId: string;
     callType: string;
     callItem: Record<string, unknown>;
+    modelToolOutputTruncationTokens?: number;
 };
 /**
  * Durably capture the raw SDK call item at the exact attempt boundary. This is
@@ -3195,6 +3633,16 @@ declare function registerPendingSessionToolCall(db: Database, input: PendingSess
     accepted: boolean;
     registered: boolean;
 }>;
+/**
+ * Clear one completed Toolspace receipt after its attempt-fenced output event is
+ * durable. If control already replaced the attempt, its settlement transaction
+ * owns the receipt and will retain an explicit outcome-unknown or the durable
+ * output event instead.
+ */
+declare function clearPendingSessionToolspaceCall(db: Database, input: Omit<PendingSessionToolCallInput, "callType" | "callItem">): Promise<{
+    accepted: boolean;
+    cleared: boolean;
+}>;
 /** Record the raw SDK result without dropping the call receipt. */
 declare function recordPendingSessionToolCallResult(db: Database, input: Omit<PendingSessionToolCallInput, "callType" | "callItem"> & {
     resultItem: Record<string, unknown>;
@@ -3483,8 +3931,17 @@ type SandboxPtySessionRow = {
     accountId: string;
     workspaceId: string;
     sessionId: string;
+    leaseId: string | null;
+    sandboxGroupId: string | null;
+    retainedProcessId: string | null;
+    openAdmissionId: string | null;
     execSessionId: number | null;
     leaseEpoch: number;
+    providerBackend: string | null;
+    providerInstanceId: string | null;
+    routeKind: "home" | "active" | null;
+    routeTargetId: string | null;
+    routeEpoch: number | null;
     cols: number;
     rows: number;
     shell: string;
@@ -3495,41 +3952,108 @@ type SandboxPtySessionRow = {
     createdAt: string;
     closedAt: string | null;
 };
+type SandboxPtyProcessIdentity = {
+    leaseId: string;
+    sandboxGroupId: string;
+    retainedProcessId: string;
+    openAdmissionId: string;
+    execSessionId: number;
+    leaseEpoch: number;
+    providerBackend: string;
+    providerInstanceId: string;
+    routeKind: "home" | "active";
+    routeTargetId: string | null;
+    routeEpoch: number;
+};
+type SandboxOpenPtySessionRow = Omit<SandboxPtySessionRow, keyof SandboxPtyProcessIdentity | "status"> & SandboxPtyProcessIdentity & {
+    status: "open";
+};
 declare function insertPtySession(db: Database, input: {
     id: string;
     accountId: string;
     workspaceId: string;
     sessionId: string;
-    execSessionId?: number | null;
-    leaseEpoch: number;
+    identity: SandboxPtyProcessIdentity;
     cols: number;
     rows: number;
     shell: string;
     cwd: string;
     openedBy: string;
-}): Promise<SandboxPtySessionRow>;
+}): Promise<SandboxOpenPtySessionRow>;
 /** Read an OPEN PTY row by ptyId. Returns null when absent or already closed. */
-declare function getOpenPtySession(db: Database, workspaceId: string, ptyId: string): Promise<SandboxPtySessionRow | null>;
-/** Stamp the SDK exec-session id (known only after the open exec yields a still-
- *  running process) + refresh the input-activity TTL. */
+declare function getOpenPtySession(db: Database, input: {
+    workspaceId: string;
+    sessionId: string;
+    ptyId: string;
+}): Promise<SandboxOpenPtySessionRow | null>;
+/** Refresh activity/geometry only when the full retained-process identity still
+ * matches. A numeric provider locator or PTY UUID alone is never authority. */
 declare function updatePtySessionActivity(db: Database, input: {
     accountId: string;
     workspaceId: string;
+    sessionId: string;
     ptyId: string;
-    execSessionId?: number | null;
+    identity: SandboxPtyProcessIdentity;
     cols?: number;
     rows?: number;
-}): Promise<SandboxPtySessionRow | null>;
+}): Promise<SandboxOpenPtySessionRow | null>;
 /** Mark a PTY closed (idempotent — a double close on a closed row is a no-op). */
 declare function closePtySession(db: Database, input: {
     accountId: string;
     workspaceId: string;
+    sessionId: string;
     ptyId: string;
+    identity: SandboxPtyProcessIdentity;
 }): Promise<SandboxPtySessionRow | null>;
 /** List a session's OPEN PTYs (reattach + reap). */
-declare function listOpenPtySessions(db: Database, workspaceId: string, sessionId: string): Promise<SandboxPtySessionRow[]>;
+declare function listOpenPtySessions(db: Database, workspaceId: string, sessionId: string): Promise<SandboxOpenPtySessionRow[]>;
 type SandboxLeaseLiveness = "cold" | "warming" | "warm" | "draining";
-type LeaseHolderKind = "turn" | "viewer";
+type LeaseHolderKind = "turn" | "viewer" | "direct" | "process";
+type SandboxProviderExistence = "not_created" | "creating" | "exists" | "missing" | "unknown";
+type SandboxArchiveAvailability = "none" | "available" | "unverified" | "invalid";
+type SandboxRestoreStatus = "not_required" | "pending" | "restoring" | "verifying" | "ready" | "degraded" | "unrecoverable";
+type SandboxWorkspaceReadiness = "unknown" | "not_ready" | "ready" | "degraded" | "unrecoverable";
+type SandboxArchiveRevision = {
+    version: 1;
+    revision: string;
+    archiveSha256: string;
+    archiveBytes: number;
+    capturedAt: string;
+    workspace: {
+        algorithm: "sha256";
+        sha256: string;
+        entryCount: number;
+        fileCount: number;
+        totalFileBytes: number;
+    };
+};
+type SandboxRecoveryState = {
+    provider: {
+        status: SandboxProviderExistence;
+        instanceId: string | null;
+        observedAt: string | null;
+        diagnostic?: string;
+    };
+    archive: {
+        status: SandboxArchiveAvailability;
+        current: SandboxArchiveRevision | null;
+        previous: SandboxArchiveRevision | null;
+    };
+    restore: {
+        status: SandboxRestoreStatus;
+        rematerializationId: string | null;
+        selectedRevision: string | null;
+        startedAt: string | null;
+        completedAt: string | null;
+        failureCode?: string;
+        retryable?: boolean;
+    };
+    workspace: {
+        status: SandboxWorkspaceReadiness;
+        verifiedRevision: string | null;
+        verifiedAt: string | null;
+    };
+};
 interface LeaseSnapshot {
     id: string;
     sandboxGroupId: string;
@@ -3545,8 +4069,20 @@ interface LeaseSnapshot {
     dataPlaneUrl: string | null;
     terminalDataPlaneUrl: string | null;
     leaseEpoch: number;
+    /** Monotonic filesystem mutation intent for the exact live workspace. */
+    workspaceGeneration: number;
+    /** Generation captured by the current verified archive, or null when no
+     * generation-complete archive exists. */
+    archiveGeneration: number | null;
+    /** True only when the current verified archive represents the exact current
+     * workspace generation. This is numeric/boolean truth, never archive content. */
+    archiveComplete: boolean;
     resumeBackendId: string | null;
     resumeState: Record<string, unknown> | null;
+    /** Provider/archive/restore/workspace truth, deliberately separate from the
+     * lease liveness and epoch fields above. Legacy envelopes project to
+     * conservative unknown/unverified values. */
+    recovery: SandboxRecoveryState;
     expiresAt: Date;
 }
 interface LiveModalSandboxLeaseAttribution {
@@ -3580,6 +4116,10 @@ type AcquireLeaseResult = {
 } | {
     role: "rearmed";
     lease: LeaseSnapshot;
+} | {
+    role: "blocked";
+    code: "restore_degraded" | "restore_unrecoverable";
+    lease: LeaseSnapshot;
 } | {
     role: "fenced";
     lease: LeaseSnapshot;
@@ -3589,6 +4129,14 @@ declare class SandboxLeaseSupersededError extends Error {
     readonly leaseEpoch: number;
     constructor(sandboxGroupId: string, leaseEpoch: number);
 }
+declare class SandboxLeaseRecoveryBlockedError extends Error {
+    readonly sandboxGroupId: string;
+    readonly leaseEpoch: number;
+    readonly code: "restore_degraded" | "restore_unrecoverable";
+    readonly recovery: SandboxRecoveryState;
+    readonly name = "SandboxLeaseRecoveryBlockedError";
+    constructor(sandboxGroupId: string, leaseEpoch: number, code: "restore_degraded" | "restore_unrecoverable", recovery: SandboxRecoveryState);
+}
 declare class SandboxImageConflictError extends Error {
     readonly sandboxGroupId: string;
     readonly currentImage: string;
@@ -3602,6 +4150,60 @@ declare class SandboxRigConflictError extends Error {
     constructor(sandboxGroupId: string, currentRigVersionId: string, requestedRigVersionId: string);
 }
 declare function acquireLease(db: Database, input: AcquireLeaseInput): Promise<AcquireLeaseResult>;
+type BeginSandboxRematerializationResult = {
+    status: "started";
+    lease: LeaseSnapshot;
+} | {
+    status: "blocked";
+    code: "archive_unavailable" | "archive_unverified" | "archive_generation_mismatch" | "attempt_conflict" | "stale_epoch";
+    lease: LeaseSnapshot | null;
+};
+/** Records the single cold->warming winner's exact restore attempt. The lease
+ * election remains the sole spawner guard; this adds durable selected-revision
+ * and progress truth under the same epoch. */
+declare function beginSandboxRematerialization(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    expectedEpoch: number;
+    rematerializationId: string;
+    /** Optional durable per-session fallback envelope. When the lease has no
+     *  archive yet, its archive fields are imported under this same row lock so
+     *  restoration can never consume bytes that were not durably selected by
+     *  the lease attempt. Provider/session state is never imported here. */
+    archiveSource?: Record<string, unknown> | null;
+}): Promise<BeginSandboxRematerializationResult>;
+declare function markSandboxRestoreVerifying(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    expectedEpoch: number;
+    rematerializationId: string;
+}): Promise<{
+    wrote: boolean;
+}>;
+declare function failSandboxRematerialization(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    expectedEpoch: number;
+    rematerializationId: string;
+    failureCode: string;
+    retryable: boolean;
+}): Promise<{
+    failed: boolean;
+    lease: LeaseSnapshot | null;
+}>;
+declare function markSandboxProviderReady(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    expectedEpoch: number;
+    expectedInstanceId: string;
+}): Promise<{
+    wrote: boolean;
+    lease: LeaseSnapshot | null;
+}>;
 declare function commitWarmingToWarm(db: Database, input: {
     accountId: string;
     workspaceId: string;
@@ -3611,16 +4213,28 @@ declare function commitWarmingToWarm(db: Database, input: {
     dataPlaneUrl?: string | null;
     resumeBackendId?: string | null;
     resumeState?: Record<string, unknown> | null;
+    /** Required when the warming lease carries a selected durable archive.
+     *  The warm transition is rejected unless this exact attempt is in the
+     *  verifying state for this exact revision. */
+    rematerialization?: {
+        id: string;
+        verifiedRevision: string;
+    };
     leaseTtlMs: number;
 }): Promise<{
     committed: boolean;
     lease: LeaseSnapshot | null;
+    reason?: "stale_epoch" | "rematerialization_required" | "rematerialization_mismatch" | "archive_revision_mismatch" | "archive_generation_mismatch";
 }>;
 declare function recordWarmingSandboxCreated(db: Database, input: {
     accountId: string;
     workspaceId: string;
     sandboxGroupId: string;
     expectedEpoch: number;
+    /** Exact restore attempt elected before provider create. Null for a fresh
+     *  archive-less create. Provider attribution is accepted only while the
+     *  warming row still carries this same attempt as well as this epoch. */
+    rematerializationId?: string | null;
     instanceId: string;
     resumeBackendId?: string | null;
     resumeState?: Record<string, unknown> | null;
@@ -3660,6 +4274,8 @@ declare function markWarmLeaseInstanceLost(db: Database, input: {
     sandboxGroupId: string;
     expectedEpoch: number;
     expectedInstanceId: string;
+    /** Bounded classifier output only; never raw provider error text. */
+    diagnostic?: string;
 }): Promise<MarkWarmLeaseInstanceLostResult>;
 declare function failWarmingToCold(db: Database, input: {
     accountId: string;
@@ -3719,6 +4335,7 @@ declare function reapStaleLeaseHolders(db: Database, input: {
     idleGraceMs: number;
 }): Promise<{
     reapedViewers: number;
+    reapedDirect: number;
     reapedTurns: number;
     warmingReset: number;
     drained: ReapDrainable[];
@@ -3759,22 +4376,284 @@ declare function confirmDrainCold(db: Database, input: {
     workspaceId: string;
     sandboxGroupId: string;
     expectedEpoch: number;
+    /** Definitive provider NotFound before this drain could capture /workspace.
+     *  With no durable archive this must become typed unrecoverable, never a
+     *  clean cold lease that can expose an empty replacement. */
+    providerMissingBeforeCapture?: boolean;
 }): Promise<{
     wentCold: boolean;
 }>;
+declare class SandboxWorkspaceMutationFencedError extends Error {
+    readonly code: "attempt_fenced" | "holder_fenced" | "lease_fenced" | "route_fenced" | "process_fenced" | "admission_fenced" | "operation_invalid" | "generation_exhausted";
+    readonly name = "SandboxWorkspaceMutationFencedError";
+    constructor(code: "attempt_fenced" | "holder_fenced" | "lease_fenced" | "route_fenced" | "process_fenced" | "admission_fenced" | "operation_invalid" | "generation_exhausted", message: string);
+}
+type SandboxWorkspaceMutationAdmission = {
+    id: string;
+    leaseId: string;
+    sandboxGroupId: string;
+    sessionId: string;
+    actorKind: "turn" | "direct" | "process";
+    actorId: string;
+    holderKind: "turn" | "direct" | "process";
+    holderId: string;
+    leaseEpoch: number;
+    providerBackend: string;
+    providerInstanceId: string;
+    routeKind: "home" | "active";
+    routeTargetId: string | null;
+    routeEpoch: number;
+    workspaceGeneration: number;
+};
+type SandboxWorkspaceMutationProviderOutcome = "resolved" | "rejected";
+type SandboxRetainedProcessState = "active" | "exited" | "lost";
+type SandboxRetainedProcess = {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    leaseId: string;
+    sandboxGroupId: string;
+    parentAdmissionId: string;
+    holderId: string;
+    ownerActorKind: "turn" | "direct";
+    ownerActorId: string;
+    ownerTurnId: string | null;
+    ownerAttemptId: string | null;
+    ownerExecutionGeneration: number | null;
+    leaseEpoch: number;
+    providerBackend: string;
+    providerInstanceId: string;
+    routeKind: "home" | "active";
+    routeTargetId: string | null;
+    routeEpoch: number;
+    providerSessionId: number;
+    state: SandboxRetainedProcessState;
+    exitCode: number | null;
+    settlementReason: string | null;
+    startedAt: string;
+    settledAt: string | null;
+};
+/**
+ * Advance the live workspace's mutation generation before an acknowledged
+ * filesystem-writing operation reaches the provider. The normal activity write
+ * fence is acquired first (workspace control -> workspace -> session -> turn ->
+ * attempt), then the exact lease row is updated under its epoch + provider-id
+ * predicates. Any failed fence rejects the operation before external effects.
+ */
+declare function advanceWorkspaceGeneration(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    executionGeneration: number;
+    attemptId: string;
+    holderId: string;
+    sandboxGroupId: string;
+    expectedEpoch: number;
+    expectedInstanceId: string;
+    operation: string;
+    /** Active-routed mutations bind to the exact session pointer. Omitted means
+     * an intentional home-provider write outside the routing surface. */
+    routeKind?: "home" | "active";
+    routeTargetId?: string | null;
+    routeEpoch?: number;
+}): Promise<SandboxWorkspaceMutationAdmission>;
+/** Admit an API/direct mutation under an exact request holder and active route.
+ * Direct actors intentionally have no turn identity and can never inherit the
+ * attempt-quiescence archive fallback. */
+declare function advanceWorkspaceGenerationForDirectRequest(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    requestId: string;
+    holderId: string;
+    sandboxGroupId: string;
+    expectedEpoch: number;
+    expectedInstanceId: string;
+    routeTargetId: string | null;
+    routeEpoch: number;
+    operation: string;
+}): Promise<SandboxWorkspaceMutationAdmission>;
+/** Admit one model/user-visible stdin write for an exact retained process. The
+ * process's original provider and route are authoritative even if the session's
+ * active pointer has since moved. */
+declare function advanceWorkspaceGenerationForRetainedProcess(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    processId: string;
+    operation: string;
+}): Promise<SandboxWorkspaceMutationAdmission>;
+/** Physically settle one exact provider mutation admission after its promise
+ * resolves or rejects. Rejections need no output acceptance, but still clear
+ * the in-flight capture blocker. Resolved output is accepted only after the
+ * canonical attempt fence plus the exact live lease-holder/provider identity
+ * are revalidated. A failed acceptance fence is reported only AFTER the
+ * settlement transaction commits, so stale output can be rejected without
+ * resurrecting the physical blocker. */
+declare function verifyWorkspaceMutationSettlement(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    executionGeneration: number;
+    attemptId: string;
+    holderId: string;
+    sandboxGroupId: string;
+    expectedEpoch: number;
+    expectedInstanceId: string;
+    admission: SandboxWorkspaceMutationAdmission;
+    operation: string;
+    outcome: SandboxWorkspaceMutationProviderOutcome;
+    routeKind?: "home" | "active";
+    routeTargetId?: string | null;
+    routeEpoch?: number;
+}): Promise<void>;
+declare function verifyDirectWorkspaceMutationSettlement(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    requestId: string;
+    holderId: string;
+    sandboxGroupId: string;
+    expectedEpoch: number;
+    expectedInstanceId: string;
+    routeTargetId: string | null;
+    routeEpoch: number;
+    admission: SandboxWorkspaceMutationAdmission;
+    operation: string;
+    outcome: SandboxWorkspaceMutationProviderOutcome;
+}): Promise<void>;
+declare function verifyRetainedProcessMutationSettlement(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    processId: string;
+    admission: SandboxWorkspaceMutationAdmission;
+    operation: string;
+    outcome: SandboxWorkspaceMutationProviderOutcome;
+}): Promise<void>;
+/** Promote one yielded provider exec into durable process authority. The parent
+ * admission stays unsettled (`retained`) and a process holder is inserted in the
+ * same transaction, so ordinary request/turn cleanup cannot open archive capture. */
+declare function retainWorkspaceMutationProcess(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    processId: string;
+    providerSessionId: number;
+    admissionId: string;
+    admittedWorkspaceGeneration: number;
+    operation: string;
+    owner: {
+        kind: "turn";
+        turnId: string;
+        executionGeneration: number;
+        attemptId: string;
+        holderId: string;
+        sandboxGroupId: string;
+        expectedEpoch: number;
+        expectedInstanceId: string;
+        routeKind?: "home" | "active";
+        routeTargetId?: string | null;
+        routeEpoch?: number;
+    } | {
+        kind: "direct";
+        requestId: string;
+        holderId: string;
+        sandboxGroupId: string;
+        expectedEpoch: number;
+        expectedInstanceId: string;
+        routeTargetId: string | null;
+        routeEpoch: number;
+    };
+}): Promise<SandboxRetainedProcess>;
+/** Read one retained process by durable UUID. Callers must use the copied route
+ * identity; a numeric provider session id alone is never sufficient authority. */
+declare function getRetainedProcess(db: Database, input: {
+    workspaceId: string;
+    sessionId: string;
+    processId: string;
+}): Promise<SandboxRetainedProcess | null>;
+/** Settle an exact retained process only after exit or definitive loss proof.
+ * The process row, parent admission, non-TTL holder, and lease count transition
+ * commit atomically. Duplicate identical proof is idempotent; conflicting proof
+ * fails closed. */
+declare function settleRetainedProcess(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    processId: string;
+    outcome: "exited" | "lost";
+    exitCode?: number | null;
+    reason: string;
+    idleGraceMs: number;
+}): Promise<{
+    settled: boolean;
+    process: SandboxRetainedProcess;
+}>;
+/** Read the exact generation a verified capture must later fold. This is a
+ * preflight only: persistWarmSnapshot/persistDrainSnapshot repeat the full
+ * epoch, provider, liveness, and generation CAS under the archive-fold lock. */
+declare function readWorkspaceArchiveCapturePreflight(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    expectedEpoch: number;
+    expectedInstanceId: string;
+    liveness: "warm" | "draining";
+}): Promise<{
+    workspaceGeneration: number;
+    archiveGeneration: number | null;
+    archiveComplete: boolean;
+} | null>;
 declare function persistDrainSnapshot(db: Database, input: {
     accountId: string;
     workspaceId: string;
     sandboxGroupId: string;
     expectedEpoch: number;
+    expectedInstanceId: string;
+    expectedWorkspaceGeneration: number;
     /** base64 of the provider snapshot-ref / tar archive from persistWorkspace().
-     *  Pass null to CAS-check without writing (for backends with no persistWorkspace). */
+     *  Pass null only to CAS-check without writing; this does not certify that
+     *  provider termination is lossless. */
     workspaceArchive: string | null;
+    /** Exact verified archive/tree descriptor produced by the runtime capture.
+     *  Omission is accepted only for legacy callers and remains unverified. */
+    workspaceArchiveMeta?: SandboxArchiveRevision;
 }): Promise<{
     wrote: boolean;
-    priorArchive: string | null;
-    priorArchivePrev: string | null;
+    priorArchiveForGc: string | null;
+    archiveRevision: string | null;
 }>;
+/**
+ * The ONE archive-fold write, shared by the drain seam (persistDrainSnapshot)
+ * and the mid-session seam (persistWarmSnapshot) — the two differ only in
+ * their CAS guard (draining@refcount0 vs warm) and their read-side semantics.
+ *
+ * Merges the NEW archive (+ its workspaceArchiveAt timestamp, the throttle
+ * baseline for mid-session snapshots) into resume_state.sessionState.
+ * jsonb_set's create_missing does NOT create intermediate objects, so a direct
+ * set of '{sessionState,workspaceArchive}' is a silent no-op when
+ * `sessionState` is absent (a null resume_state, or a legacy flat envelope).
+ * Instead: rebuild `sessionState` as (existing sessionState OR '{}') merged
+ * (||) with the fold — this CREATES sessionState if absent AND preserves its
+ * existing siblings (providerState/manifest/exposedPorts). The archive is
+ * bound as a jsonb string scalar (to_jsonb(text)). Re-asserting the caller's
+ * CAS guard keeps the write atomic with its FOR UPDATE lock. Archive-slot
+ * rotation is computed by rotateWorkspaceArchives before this writer is called,
+ * so the warm and drain seams use exactly the same retention policy.
+ */
+declare function rotateWorkspaceArchives(input: {
+    resumeState: Record<string, unknown> | null;
+    priorCurrentArchive: string | null;
+    priorPreviousArchive: string | null;
+}): {
+    previousArchive: string | null;
+    previousArchiveMeta: SandboxArchiveRevision | null;
+    priorArchiveForGc: string | null;
+};
 /**
  * MID-SESSION /workspace snapshot fold (sandbox-file-persistence). The WARM
  * sibling of persistDrainSnapshot: a turn that HOLDS the live box folds a fresh
@@ -3794,8 +4673,13 @@ declare function persistWarmSnapshot(db: Database, input: {
     attemptId: string;
     sandboxGroupId: string;
     expectedEpoch: number;
+    expectedInstanceId: string;
+    expectedWorkspaceGeneration: number;
     /** base64 of the provider snapshot-ref / tar archive from persistWorkspace(). */
     workspaceArchive: string;
+    /** Exact verified archive/tree descriptor produced by the runtime capture.
+     *  Omission is accepted only for legacy callers and remains unverified. */
+    workspaceArchiveMeta?: SandboxArchiveRevision;
     /** Snapshots newer than this many ms are kept (throttle); 0 = always write. */
     minIntervalMs: number;
     /** Wall-clock (ms) this capture STARTED. Ordering is by capture-initiation,
@@ -3809,6 +4693,7 @@ declare function persistWarmSnapshot(db: Database, input: {
     throttled: boolean;
     superseded: boolean;
     priorArchiveForGc: string | null;
+    archiveRevision: string | null;
 }>;
 declare function getMaterializedSandboxFileResources(db: Database, input: {
     accountId: string;
@@ -4352,6 +5237,23 @@ type CreateSessionGoalInput = {
 };
 declare function createSessionGoal(db: Database, input: CreateSessionGoalInput): Promise<SessionGoal>;
 declare function getSessionGoal(db: Database, workspaceId: string, sessionId: string): Promise<SessionGoal | null>;
+type SessionGoalContinuationProjection = {
+    state: "inactive" | "scheduled" | "running" | "blocked" | "invariant_broken";
+    reason: "goal_inactive" | "wake_pending" | "continuation_pending" | "human_work_pending" | "goal_turn_running" | "human_turn_running" | "workstream_paused" | "approval_required" | "provider_backpressure" | "session_cancelled" | "system_work_pending" | "missing_obligation";
+    wakeRevision: number;
+    observedRevision: number;
+    nextAttemptAt: string | null;
+    lastError: string | null;
+};
+/**
+ * Read the goal and its autonomy state from one repeatable Postgres snapshot.
+ * The projection never infers liveness from the public session status alone:
+ * goal revisions, typed internal updates/turns, capacity waiters, admission
+ * control, and the workflow-wake delivery ledger each remain distinct truth.
+ */
+declare function getSessionGoalWithContinuation(db: Database, workspaceId: string, sessionId: string): Promise<(SessionGoal & {
+    continuation: SessionGoalContinuationProjection;
+}) | null>;
 declare function clearSessionGoal(db: Database, workspaceId: string, sessionId: string): Promise<{
     cleared: boolean;
     goal: SessionGoal | null;
@@ -4367,6 +5269,19 @@ declare function upsertSessionGoal(db: Database, input: CreateSessionGoalInput):
     goal: SessionGoal;
     replaced: boolean;
 }>;
+/**
+ * Agent/API goal_set: session sequence ownership, the create-or-replace
+ * mutation, and goal.set timeline fact commit together. The session-first lock
+ * order matches active-turn event writes; goal_set must never hold a goal row
+ * while waiting for the session sequence owner.
+ */
+declare function upsertSessionGoalWithEvent(db: Database, input: CreateSessionGoalInput & {
+    actor: "agent" | "api";
+}): Promise<{
+    goal: SessionGoal;
+    replaced: boolean;
+    events: SessionEvent[];
+}>;
 /**
  * goal_update semantics: revise text/criteria without changing status. The
  * version bump counts as progress for the no-progress detector.
@@ -4375,6 +5290,30 @@ declare function updateSessionGoal(db: Database, workspaceId: string, sessionId:
     text?: string;
     successCriteria?: string | null;
 }): Promise<SessionGoal>;
+/**
+ * Agent goal_update: session sequence ownership, goal mutation, and its audit
+ * event commit together. Locking the session before the goal also matches an
+ * active turn's event-write order and avoids the workspace->session inversion
+ * that previously self-locked root goal mutations.
+ */
+declare function updateSessionGoalWithEvent(db: Database, workspaceId: string, sessionId: string, input: {
+    text?: string;
+    successCriteria?: string | null;
+    progressNote?: string;
+    actor: "agent" | "api";
+    command?: {
+        accountId: string;
+        actor: Extract<SessionCommandActor, {
+            type: "agent_attempt";
+        }>;
+        operationKey: string;
+    };
+}): Promise<{
+    goal: SessionGoal;
+    events: SessionEvent[];
+    operationId: string | null;
+    replay: boolean;
+}>;
 /**
  * Sets a session's display title. The clobber guard lives entirely in this
  * single atomic UPDATE: a user-set title is permanent, so agent/auto writes
@@ -4412,6 +5351,31 @@ declare function setSessionGoalStatus(db: Database, workspaceId: string, session
     changed: boolean;
     workflowWakeRevision: number | null;
 }>;
+type SetSessionGoalStatusEvent = {
+    type: "goal.completed";
+    evidence: string;
+} | {
+    type: "goal.paused";
+    actor: "agent" | "api";
+    reason: string;
+    rationale?: string;
+} | {
+    type: "goal.resumed";
+    actor: "api";
+};
+/** Status mutation and its timeline fact share the same session-first commit. */
+declare function setSessionGoalStatusWithEvent(db: Database, workspaceId: string, sessionId: string, input: {
+    status: SessionGoalStatus;
+    evidence?: string;
+    rationale?: string;
+    pausedReason?: string;
+    event: SetSessionGoalStatusEvent;
+}): Promise<{
+    goal: SessionGoal;
+    changed: boolean;
+    workflowWakeRevision: number | null;
+    events: SessionEvent[];
+}>;
 declare function setSessionGoalLastContinuationTurn(db: Database, workspaceId: string, sessionId: string, turnId: string): Promise<void>;
 type GoalContinuationDecision = {
     decision: "none";
@@ -4442,18 +5406,63 @@ declare function evaluateGoalContinuation(db: Database, input: {
     noProgressLimit: number;
     budgetBlocked?: string | null;
 }): Promise<GoalContinuationDecision>;
+type MaterializeGoalContinuationResult = {
+    action: "none" | "queue";
+    events: [];
+} | {
+    action: "paused";
+    events: SessionEvent[];
+} | {
+    action: "continue";
+    events: SessionEvent[];
+    update: SessionSystemUpdate;
+    goalWakeRevision: number;
+    workflowWakeRevision: number;
+};
+/**
+ * Consume one durable goal-wake revision into one continuation obligation.
+ *
+ * This is deliberately one outer PostgreSQL transaction. The existing locked
+ * evaluator runs as a nested savepoint, so its no-progress/counter mutation is
+ * rolled back if prompt construction, update/event insertion, metering, or the
+ * workflow-wake outbox write fails. Retrying after a lost COMMIT response sees
+ * the same stable goal revision and the already-pending update; it never spends
+ * another continuation count or creates another usage row.
+ */
+declare function materializeGoalContinuation(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    workflowId: string;
+    defaultMaxAutoContinuations?: number | null;
+    noProgressLimit: number;
+    budgetBlocked?: string | null;
+    policy: {
+        model: string;
+        reasoningEffort: ReasoningEffort;
+        tools: ToolRef[];
+        sandboxBackend: SandboxBackend;
+    };
+    prompt: (goal: SessionGoal, autoContinuation: number, cap: number | null) => string;
+}): Promise<MaterializeGoalContinuationResult>;
 type InitializeSessionStartInput = {
     accountId: string;
     workspaceId: string;
     sessionId: string;
     clientEventId?: string;
     reasoningEffortFallback: ReasoningEffort;
+    /** Trusted create-session policy. Omitted only by legacy low-level callers. */
+    turnExecutionPolicy?: TurnExecutionPolicyV1;
     createdEventPayload: Record<string, unknown>;
     goal?: {
         text: string;
         successCriteria?: string | null;
         maxAutoContinuations?: number | null;
     } | null;
+    consumeNewSessionDraft?: {
+        subjectId: string;
+        expectedRevision: number;
+    } | null;
 };
 type InitializeSessionStartResult = {
     events: SessionEvent[];
@@ -4784,6 +5793,12 @@ type RecoverSessionDispatchResult = {
  */
 declare function recoverSessionDispatch(db: Database, workspaceId: string, input: RecoverSessionDispatchInput): Promise<RecoverSessionDispatchResult>;
 declare function getSessionTurn(db: Database, workspaceId: string, turnId: string): Promise<SessionTurn | null>;
+/**
+ * Resolve the exact currently executable turn/attempt from authoritative
+ * pointers in one query. This avoids treating a stale session preview as proof
+ * that no attempt exists during an atomic claim transition.
+ */
+declare function getActiveSessionTurnForExecution(db: Database, workspaceId: string, sessionId: string): Promise<SessionTurnForExecution | null>;
 declare function getSessionTurnForAttempt(db: Database, workspaceId: string, sessionId: string, attemptId: string): Promise<SessionTurnForExecution | null>;
 /**
  * Return the newest turn that reached agent execution for a session. A claimed
@@ -4876,11 +5891,26 @@ declare function enqueueSessionWorkflowWakeIfRunnable(db: Database, input: {
 /** Claim only explicit, undelivered wake revisions; never infer work by scan. */
 declare function claimPendingSessionWorkflowWakes(db: Database, limit?: number): Promise<SessionWorkflowWake[]>;
 /**
- * Acknowledge an immediate post-commit signal. An older sender may advance only
- * its own revision; it cannot clear a claim or failure state belonging to a
- * newer revision.
+ * Acknowledge an immediate post-commit signal only after it cannot strand an
+ * accepted Agent Steer. Temporal accepting a signal is transport evidence, not
+ * proof that a closing workflow observed Postgres or admitted its pending
+ * direction. While active control still has an actionable Agent Steer, retain
+ * the revision so the bounded outbox dispatcher retries signalWithStart. The
+ * attempt-fenced claim consumes the update once; a real Pause is the typed
+ * blocker and may acknowledge this revision because Resume commits a new one.
+ *
+ * An older sender may advance only its own revision; it cannot clear a claim or
+ * failure state belonging to a newer revision. The control -> workspace ->
+ * session lock prefix serializes this decision with Steer, Pause/Resume, and
+ * claim without weakening physical-quiescence admission.
  */
-declare function markSessionWorkflowWakeDelivered(db: Database, input: Omit<SessionWorkflowWake, "interruptionRequested">): Promise<void>;
+type SessionWorkflowWakeDeliveryResult = {
+    action: "acknowledged";
+} | {
+    action: "pending_admission";
+    blocker: "pending_agent_steer";
+};
+declare function markSessionWorkflowWakeDelivered(db: Database, input: Omit<SessionWorkflowWake, "interruptionRequested">): Promise<SessionWorkflowWakeDeliveryResult>;
 /** Record delivery failure; the claim already scheduled the bounded retry. */
 declare function markSessionWorkflowWakeFailed(db: Database, input: SessionWorkflowWake, error: string): Promise<boolean>;
 declare function getOrCreateSessionSystemUpdateOutbox(db: Database, input: Omit<SessionSystemUpdateOutboxDelivery, "id" | "status">): Promise<SessionSystemUpdateOutboxDelivery>;
@@ -4970,6 +6000,7 @@ declare function appendSessionEventsAndUpdateSession(db: Database, workspaceId:
 }): Promise<SessionEvent[]>;
 type LockedSessionUpdateContext = {
     updateSessionMcpServerCredentials: (updates: UpdateSessionMcpServerCredentialsInput[]) => Promise<UpdateSessionMcpServerCredentialsResult>;
+    updateSessionMcpApprovalPolicy: (serverId: string, requireApproval: SessionMcpApprovalPolicy) => Promise<UpdateSessionMcpApprovalPolicyResult>;
     listPendingSessionTurns: () => Promise<SessionTurn[]>;
 };
 type LockedSessionUpdateResult = {
@@ -4986,4 +6017,4 @@ type LockedSessionUpdateResult = {
 declare function appendSessionEventsWithLockedSessionUpdate(db: Database, workspaceId: string, sessionId: string, build: (session: Session, context: LockedSessionUpdateContext) => LockedSessionUpdateResult | Promise<LockedSessionUpdateResult>): Promise<SessionEvent[]>;
 declare function sessionSubject(workspaceId: string, sessionId: string): string;
 
-export { type CorrectWorkspaceMemoryInput as $, AGENT_VISIBLE_MEMORY_STATUSES as A, type BootstrapWorkspaceInput as B, CODEX_CAPACITY_REFRESH_MAX_MS as C, type CodexCapacityResetKind as D, type CodexCapacitySelectionContext as E, type CodexCapacityWait as F, type CodexCapacityWaitStatus as G, type CodexCapacityWakeTarget as H, type CodexCredentialForRun as I, type CodexCredentialLeaseCandidateFilter as J, type CodexCredentialLeaseCandidateFilterResult as K, type CodexCredentialLeasePolicyScopeResolver as L, type CodexCredentialLeaseQuarantine as M, type CodexCredentialLeaseResult as N, type CodexCredentialLeaseSelection as O, type CodexCredentialLeaseSelectionContext as P, type ProvisionResult, type ProvisionRolesOptions, type CodexCredentialStatus as Q, type CodexCredentialTokens as R, type CodexLeaseAccountStatus as S, type CodexPinSource as T, type CodexRotationSettings as U, type CodexRotationStrategy as V, type ComposerDraftRow as W, type ConnectionBrokerDeps as X, type ConnectionCredentialForBroker as Y, ConnectionRefreshHttpError as Z, type ConsumeOAuthStateNonceInput as _, type AcceptSessionApprovalDecisionResult as a, MEMORY_BLOCK_RECORD_LIMIT as a$, type CorrectWorkspaceMemoryResult as a0, type CreateCapabilityCatalogItemInput as a1, type CreateConnectionInput as a2, type CreateDbOptions as a3, type CreateImportBatchInput as a4, type CreateKnowledgeMemoryInput as a5, type CreatePackInstallationInput as a6, type CreateScheduledTaskInput as a7, type CreateSessionGoalInput as a8, type CreateSessionMcpServerInput as a9, type GoalContinuationDecision as aA, type HostExportConsumerStatus as aB, type HostExportKind as aC, HostExportPayloadError as aD, HostMcpCredentialBindingError as aE, type HostMcpCredentialResolverContext as aF, HostMcpCredentialScopeError as aG, HumanInputResponseValidationError as aH, type IdempotentPersistenceTransactionOptions as aI, type ImportBatch as aJ, type InitializeSessionStartInput as aK, type InitializeSessionStartResult as aL, type IntegrationOAuthClientForUse as aM, type LeaseHolderKind as aN, type LeaseSnapshot as aO, type ListKnowledgeMemoryOptions as aP, type ListSessionEventPageOptions as aQ, type ListSessionEventsOptions as aR, type ListSessionsForSubjectOptions as aS, type ListSessionsOptions as aT, type LiveModalSandboxLeaseAttribution as aU, MACHINE_METRICS_SERIES_INTERVAL_MS as aV, MAX_INTERNAL_UPDATE_BATCH_BYTES as aW, MAX_INTERNAL_UPDATE_BATCH_MEMBERS as aX, MAX_INTERNAL_UPDATE_BYTES as aY, MEMORY_ACTIVE_RECORD_CAP as aZ, MEMORY_BLOCK_KIND_ORDER as a_, type CreateSocialConnectionInput as aa, type CreateSocialPostInput as ab, type CreditBalanceByAccount as ac, type Database as ad, type DatabaseFailureCode as ae, type DbClient as af, type DeviceEnrollmentRequestRecord as ag, type DeviceEnrollmentStatus as ah, type EditQueueCommandResult as ai, type EffectiveControlBlocker as aj, type EffectiveControlResumeOption as ak, type EffectiveControlState as al, type EffectiveSessionControl as am, type EnableCapabilityInstallationInput as an, type EnabledMcpCapabilityServer as ao, type EnqueueSessionTurnInput as ap, type EnrollmentExposure as aq, type EnrollmentOs as ar, type EnrollmentRecord as as, type EnrollmentStatus as at, type ExpiredFileUploadCleanupClaim as au, type FileUploadCleanupClaimResult as av, type ForceDrainResult as aw, type FrozenTurnInitiator as ax, type GitHubInstallation as ay, type GitHubInstallationAccess as az, type AcceptSessionHumanInputResponseResult as b, type SessionCommandActor as b$, MEMORY_CORRECT_TOOL_DESCRIPTION as b0, MEMORY_KIND_SECTION_TITLES as b1, MEMORY_NEAR_DUP_COSINE_THRESHOLD as b2, MEMORY_NEAR_DUP_NEIGHBORS as b3, MEMORY_SAVE_TOOL_DESCRIPTION as b4, MEMORY_SEARCH_DEFAULT_LIMIT as b5, MEMORY_SEARCH_MAX_LIMIT as b6, MEMORY_SEARCH_TOOL_DESCRIPTION as b7, MEMORY_TEXT_MAX_CHARS as b8, MEMORY_VISIBLE_RECORD_CAP as b9, RigActiveVersionChangedError as bA, RigChangeAlreadyVerifyingError as bB, type RigChangeMonitoringSummary as bC, RigChangeTransitionError as bD, type RigVersionContentInput as bE, type RigVersionMonitoringSummary as bF, type RlsContext as bG, type RlsStrategy as bH, SESSION_ANCESTRY_LIMIT as bI, SESSION_DISCOVERY_CONTROL_TARGET_LIMIT as bJ, SESSION_DISCOVERY_CONTROL_TITLE_MAX_CHARS as bK, SESSION_DISCOVERY_GOAL_MAX_CHARS as bL, SESSION_DISCOVERY_MESSAGE_MAX_CHARS as bM, SESSION_EVENT_DB_PAGE_MAX_BYTES as bN, type SafeDatabaseErrorFacts as bO, SandboxImageConflictError as bP, type SandboxKind as bQ, type SandboxLeaseLiveness as bR, SandboxLeaseSupersededError as bS, type SandboxPtySessionRow as bT, type SandboxRecord as bU, SandboxRigConflictError as bV, SanitizedDatabasePersistenceCause as bW, type SaveWorkspaceMemoryInput as bX, type SaveWorkspaceMemoryResult as bY, type SessionAttemptInterruptionSettlement as bZ, type SessionCodexState as b_, type MachineMetricsRow as ba, type MachineMetricsSample as bb, type MarkWarmLeaseInstanceLostResult as bc, type MemoryBlockRecord as bd, type MemoryEmbedder as be, type MemorySanitizeResult as bf, type MeterableWarmLease as bg, type PendingSessionToolCallInput as bh, type PersistenceFailureDetails as bi, type PersistenceRetryOutcome as bj, type QueueCommandConflictCode as bk, QueueCommandConflictError as bl, type QueueCommandResult as bm, type QueuedTurnRow as bn, type ReapDrainable as bo, type ReconcileCodexCapacityWaitResult as bp, type RecoverSessionDispatchInput as bq, type RecoverSessionDispatchResult as br, type RegisterWorkspacePackInput as bs, type RegistryCapabilityCatalogItemInput as bt, type RegistryCatalogSurfaceKey as bu, type ReplaceIntegrationOAuthClientInput as bv, type RequestSessionTurnRecoveryInput as bw, type RequestSessionTurnRecoveryResult as bx, type ResolveConnectionCredentialInput as by, type ResolveConnectionCredentialResult as bz, type AccrueWarmSecondsResult as c, type WorkspaceMemorySearchInput as c$, SessionCommandIdempotencyError as c0, type SessionCommandReceiptRow as c1, SessionContextBusyError as c2, SessionControlConflictError as c3, SessionControlInvariantError as c4, type SessionControlMutationResult as c5, type SessionDiscoveryControl as c6, type SessionDiscoveryCursor as c7, type SessionDiscoveryOrderBy as c8, type SessionDiscoverySummary as c9, type SteerQueueCommandResult as cA, type StoreIntegrationOAuthClientInput as cB, type StoredIntegrationOAuthClient as cC, type StreamAcknowledgment as cD, type SubmitHumanPromptResult as cE, type ToolspaceCallReservation as cF, type TurnAttemptFenceRejectReason as cG, type UpdateConnectionInput as cH, type UpdateImportBatchCountsInput as cI, type UpdateKnowledgeMemoryInput as cJ, type UpdateScheduledTaskInput as cK, type UpdateSessionMcpServerCredentialsInput as cL, type UpdateSessionMcpServerCredentialsResult as cM, type UserLookup as cN, type VariableSetForRun as cO, WORKSPACE_MEMORY_BLOCK_EMPTY as cP, WORKSPACE_MEMORY_BLOCK_HEADER_POPULATED as cQ, WORKSPACE_MEMORY_BLOCK_TOKEN_BUDGET as cR, type WorkspaceCaptureCommitResult as cS, type WorkspaceCaptureGcPlan as cT, type WorkspaceCaptureGcRow as cU, type WorkspaceCaptureRow as cV, type WorkspaceControlLockMode as cW, type WorkspaceControlMutationResult as cX, type WorkspaceControlRow as cY, type WorkspaceEnvironmentForRun as cZ, type WorkspaceMemoryOrigin as c_, type SessionEventPage as ca, SessionEventPersistenceError as cb, type SessionEventWriteLockInput as cc, type SessionEventWriteLocks as cd, SessionIdConflictError as ce, type SessionLineage as cf, SessionListAccessError as cg, type SessionListCursor as ch, SessionListCursorError as ci, type SessionMcpServerForRun as cj, SessionPinAccessError as ck, SessionPinVersionConflictError as cl, type SessionRecordingCodec as cm, type SessionRecordingMode as cn, type SessionRecordingRow as co, type SessionRecordingState as cp, type SessionSystemUpdateOutboxDelivery as cq, type SessionTurnAttemptOutcome as cr, type SessionTurnForExecution as cs, type SessionTurnRecordingSettlement as ct, type SessionWorkPeek as cu, type SessionWorkTrigger as cv, type SessionWorkflowWake as cw, type SetSessionCodexPinOptions as cx, type SettleCodexCredentialFailoverResult as cy, type SettleCodexCredentialLeaseLossResult as cz, type AcquireLeaseInput as d, countActiveSessionHistoryItems as d$, type WorkspaceMemorySearchMode as d0, type WorkspaceMemorySearchResult as d1, type WorkspaceModelPolicy as d2, abandonRecordingForTurnAttempt as d3, acceptSessionApprovalDecision as d4, acceptSessionHumanInputResponse as d5, accrueWarmSeconds as d6, acknowledgeHostExportBatch as d7, acquireCodexCredentialLease as d8, acquireLease as d9, buildConnectionTokenResolver as dA, buildHostConnectionTokenResolver as dB, canonicalSessionCommandHash as dC, claimExpiredFileUploadCleanup as dD, claimFileUploadCleanup as dE, claimHostExportBatch as dF, claimPendingSessionSystemUpdateOutbox as dG, claimPendingSessionWorkflowWakes as dH, claimSessionWorkForAttempt as dI, clearDurablePendingSessionToolCalls as dJ, clearEnrollmentWentOffline as dK, clearSessionContext as dL, clearSessionGoal as dM, clearedContextMarkerItem as dN, closePtySession as dO, closeSessionTurnAttemptInTransaction as dP, codexCapacityRefreshBackoffMs as dQ, commitWarmingToWarm as dR, completeExpiredFileUploadCleanup as dS, completeFileUpload as dT, completeFileUploadCleanup as dU, computeWorkspaceCaptureGcPlan as dV, confirmDrainCold as dW, consumeDeviceEnrollmentRequest as dX, consumeIntegrationOAuthStateNonce as dY, correctWorkspaceMemory as dZ, countActiveApiKeysForWorkspace as d_, activateRigVersion as da, addSessionSystemUpdate as db, addSessionSystemUpdateWithSourceMutation as dc, allAccountPermissions as dd, allWorkspacePermissions as de, appendSessionEventToSandboxGroup as df, appendSessionEvents as dg, appendSessionEventsAndUpdateSession as dh, appendSessionEventsForTurnAttempt as di, appendSessionEventsWithLockedSessionUpdate as dj, appendSessionHistoryItems as dk, applyContextCompaction as dl, applyCreditDebitUpToBalance as dm, applyCreditLedgerEntry as dn, applySessionTurnSettlement as dp, approveDeviceEnrollmentRequest as dq, areGitHubRepositoriesAllowedForWorkspace as dr, armCodexCapacityWait as ds, assertAgentCommandAuthorityInTransaction as dt, autoResumeSessionBranchInTransaction as du, beginRigChangeVerificationAttempt as dv, bindGitHubInstallationRepositories as dw, bootstrapWorkspace as dx, buildChildCompletionDigest as dy, buildCodexTokenResolver as dz, type AcquireLeaseResult as e, enableCapabilityInstallation as e$, countActiveSessionsForWorkspace as e0, countActiveSessionsUsingEnvironment as e1, countActiveSessionsUsingVariableSet as e2, countConsecutiveReactiveRotations as e3, countQueuedTurns as e4, countRigs as e5, countSandboxLeasesByLiveness as e6, countScheduledTasksForWorkspace as e7, countScheduledTasksUsingEnvironment as e8, countScheduledTasksUsingVariableSet as e9, createVariableSet as eA, createWorkspace as eB, createWorkspaceEnvironment as eC, databaseFailureCode as eD, deadLetterHostExportHead as eE, decodeSessionListCursor as eF, decryptEnvironmentValue as eG, decryptedCapabilityHeaders as eH, deleteGitHubInstallationBinding as eI, deleteRecording as eJ, deleteRig as eK, deleteRigIfNoActiveSessions as eL, deleteScheduledTask as eM, deleteSessionQueueItemInTransaction as eN, deleteVariableSet as eO, deleteVariableSetVariable as eP, deleteWorkspace as eQ, deleteWorkspaceCaptureRows as eR, deleteWorkspaceEnvironment as eS, deleteWorkspaceEnvironmentVariable as eT, deleteWorkspacePack as eU, denyDeviceEnrollmentRequest as eV, disableCapabilityInstallation as eW, disableHostExportConsumer as eX, disconnectAllCodexAccounts as eY, disconnectCodexAccount as eZ, editQueuedTurnInTransaction as e_, countSessionHistoryItems as ea, countSessionsUsingRig as eb, countVariableSets as ec, countWorkspaceEnvironments as ed, countWorkspacesForAccount as ee, createApiKey as ef, createConnection as eg, createDb as eh, createDeviceEnrollmentRequest as ei, createEnrollment as ej, createFileUpload as ek, createImportBatch as el, createKnowledgeMemory as em, createRig as en, createRigChange as eo, createRigVersion as ep, createRigVersionForChangePromotion as eq, createSandbox as er, createScheduledTask as es, createScheduledTaskRun as et, createSession as eu, createSessionGoal as ev, createSessionMcpServers as ew, createSessionWithIdempotencyKey as ex, createSocialConnection as ey, createSocialPost as ez, type ActiveSandboxPointer as f, getSessionEvent as f$, enablePackInstallation as f0, encodeSessionListCursor as f1, encryptEnvironmentValue as f2, enqueueSessionTurn as f3, enqueueSessionWorkflowWake as f4, enqueueSessionWorkflowWakeIfRunnable as f5, enqueueSessionWorkflowWakeInTransaction as f6, ensureCodexRotationSettings as f7, ensureManagedAccessForUser as f8, estimateMemoryTokens as f9, getFileUpload as fA, getHostExportConsumerStatus as fB, getHumanInputResumeForEvent as fC, getKnowledgeMemory as fD, getLatestRunState as fE, getLatestStartedSessionTurn as fF, getManagedAccount as fG, getManagedUserByEmail as fH, getMaterializedSandboxFileResources as fI, getOpenPtySession as fJ, getOrCreateSessionSystemUpdateOutbox as fK, getPackInstallation as fL, getPendingDeviceEnrollmentRequestByUserCode as fM, getPendingDeviceEnrollmentRequestByUserCodeGlobal as fN, getRecording as fO, getRig as fP, getRigByName as fQ, getRigChange as fR, getRigName as fS, getRigVersion as fT, getRigVersionById as fU, getSandbox as fV, getSandboxSessionEnvelope as fW, getScheduledTask as fX, getSession as fY, getSessionByCreateIdempotencyKey as fZ, getSessionCodexState as f_, evaluateGoalContinuation as fa, evaluateSessionControl as fb, evaluateSessionControls as fc, evaluateSessionDiscoveryControls as fd, expireSessionHumanInputRequest as fe, failHostExportBatch as ff, failWarmingToCold as fg, fetchCodexUsageForAccount as fh, finalizeEnrollmentByToken as fi, findActiveApiKeyByHash as fj, forceDrainOverLimitViewerOnlyBoxes as fk, frozenInitiatorForCommandActor as fl, getActiveSessionHistoryItems as fm, getAnySessionInGroup as fn, getBillingBalance as fo, getBillingCustomer as fp, getCapabilityCatalogItem as fq, getCapabilityInstallation as fr, getCodexCapacityWaitForSession as fs, getCodexCredentialStatus as ft, getCodexRotationSettings as fu, getComposerDraftInTransaction as fv, getConnectionMetadata as fw, getDeviceEnrollmentRequestByDeviceCode as fx, getEnrollment as fy, getFile as fz, type AddSessionSystemUpdateInput as g, listLiveModalSandboxLeaseAttributions as g$, getSessionEventByClientEventId as g0, getSessionForSubject as g1, getSessionGoal as g2, getSessionHistoryItems as g3, getSessionHumanInputRequest as g4, getSessionLineage as g5, getSessionQueueSnapshot as g6, getSessionRootId as g7, getSessionSystemUpdateOutboxByDedupeKey as g8, getSessionTurn as g9, insertPtySession as gA, insertRecording as gB, insertWorkspaceCapture as gC, interruptedToolCallResult as gD, isCodexBilledTurn as gE, isDatabasePersistenceFailure as gF, isMemoryTextTooLong as gG, isPrivateAddress as gH, isRetryablePersistenceSqlState as gI, isSessionCompactionRequested as gJ, isSessionEventPersistenceError as gK, isStripeWebhookProcessed as gL, latestWorkspaceCapture as gM, listApiKeys as gN, listCapabilityCatalogItems as gO, listCapabilityInstallations as gP, listCodexAccountStatuses as gQ, listConnectionsMetadata as gR, listCreditBalancesByAccount as gS, listDistinctRigVersionIdsInGroup as gT, listDistinctVariableSetIdsInGroup as gU, listEnabledMcpCapabilityServers as gV, listEnrollments as gW, listGitHubInstallationAccessForWorkspace as gX, listGitHubInstallationIdsForWorkspace as gY, listGitHubInstallationsForWorkspace as gZ, listKnowledgeMemories as g_, getSessionTurnForAttempt as ga, getSocialConnection as gb, getStoredCapabilityHeaderCiphertext as gc, getStreamAcknowledgment as gd, getVariableSet as ge, getVariableSetByName as gf, getVariableSetValuesForRun as gg, getWorkspace as gh, getWorkspaceControlEvent as gi, getWorkspaceDefaultRigId as gj, getWorkspaceEnvironment as gk, getWorkspaceEnvironmentByName as gl, getWorkspaceEnvironmentValuesForRun as gm, getWorkspaceGrant as gn, getWorkspaceModelPolicy as go, getWorkspacePack as gp, grantWorkspaceAccess as gq, hasCreditLedgerEntry as gr, hashMemoryText as gs, heartbeatCodexCredentialLease as gt, heartbeatCodexCredentialLeaseUntil as gu, heartbeatLeaseHolder as gv, ingestMachineMetricsSample as gw, initializeSessionStartAtomically as gx, insertFailedWorkspaceCapture as gy, insertMachineMetricsSeries as gz, type AddSessionSystemUpdateResult as h, orphanedResultRowIndicesForRepair as h$, listMeterableWarmLeases as h0, listOpenPtySessions as h1, listOutstandingSessionSystemUpdates as h2, listPackInstallations as h3, listPendingCodexCapacityWakeTargets as h4, listPendingSessionTurns as h5, listRecordings as h6, listRegistryCatalogSurfaceKeys as h7, listRigChangeMonitoringSummaries as h8, listRigChanges as h9, listWorkspacesForSubject as hA, loadCodexCredentialForRun as hB, loadConnectionCredentialForBroker as hC, loadIntegrationOAuthClient as hD, loadVariableSetForRun as hE, loadWorkspaceEnvironmentForRun as hF, lockSessionEventWriteRows as hG, lockWorkspaceInferenceControl as hH, markFileUploadFailed as hI, markSandboxFileResourcesMaterialized as hJ, markScheduledTaskRunFailedIfQueued as hK, markSessionAttemptQuiesced as hL, markSessionSystemUpdateOutboxDeliveredInTransaction as hM, markSessionSystemUpdateOutboxFailed as hN, markSessionWorkflowWakeDelivered as hO, markSessionWorkflowWakeFailed as hP, markStaleRegistryCatalogItems as hQ, markStripeWebhookProcessed as hR, markWarmLeaseInstanceLost as hS, mcpServerIdForCapability as hT, moveQueuedTurnInTransaction as hU, mutateSessionControlInTransaction as hV, mutateWorkspaceControlInTransaction as hW, nestedPostgresSqlState as hX, nextSessionHistoryPosition as hY, normalizeBearerScheme as hZ, normalizeMemoryText as h_, listRigVersionMonitoringSummaries as ha, listRigVersions as hb, listRigs as hc, listSandboxes as hd, listScheduledTaskRuns as he, listScheduledTasks as hf, listSessionDiscoverySummaries as hg, listSessionEventPage as hh, listSessionEvents as hi, listSessionHumanInputRequests as hj, listSessionIdsInGroup as hk, listSessionMcpServerMetadata as hl, listSessionMcpServersForChildInheritance as hm, listSessionMcpServersForRun as hn, listSessionSystemUpdatesForTurn as ho, listSessionTurns as hp, listSessions as hq, listSessionsForSubject as hr, listSocialConnections as hs, listSocialPosts as ht, listUsageEvents as hu, listVariableSets as hv, listWorkspaceControlEvents as hw, listWorkspaceEnvironments as hx, listWorkspaceMembers as hy, listWorkspacePacks as hz, AgentCommandAuthorityError as i, revokeApiKey as i$, peekSessionWork as i0, persistDrainSnapshot as i1, persistWarmSnapshot as i2, planWorkspaceCaptureGc as i3, projectEffectiveControlForRelatedAccess as i4, projectSessionForRelatedAccess as i5, pruneHostExportOutbox as i6, quarantineCodexCredentialForLease as i7, reArmDrainingLease as i8, readActiveSandbox as i9, recoverSessionDispatch as iA, refreshOAuthConnectionCredential as iB, registerDbBinding as iC, registerHostExportConsumer as iD, registerInternalUpdateWakeInTransaction as iE, registerPendingSessionToolCall as iF, registerSessionTurnAttemptClaim as iG, registerSessionWorkflowWakeInTransaction as iH, registerWorkspacePack as iI, releaseCodexCredentialLease as iJ, releaseLeaseHolder as iK, removeWorkspaceMember as iL, renameCodexAccount as iM, renderWorkspaceMemoryBlock as iN, replaceIntegrationOAuthClient as iO, requestSessionCompaction as iP, requestSessionTurnRecovery as iQ, requireFile as iR, requireScheduledTask as iS, requireSession as iT, requireSocialConnection as iU, requireWorkspace as iV, reserveSessionCommandReceipt as iW, reserveToolspaceCallForTurn as iX, resolveWorkspaceMemoryBlock as iY, resumeHostExportConsumer as iZ, retireHostExportConsumer as i_, readLease as ia, readMachineMetricsLatest as ib, readMachineMetricsLatestForWorkspace as ic, readMachineMetricsSeries as id, reapExpiredSessionListSnapshots as ie, reapStaleLeaseHolders as ig, reapStaleLeaseHoldersGlobal as ih, reconcileCodexCapacityWait as ii, recordAuditEvent as ij, recordCodexAccountConnectors as ik, recordCodexAccountUsage as il, recordCodexAccountUsageWithWakeTargets as im, recordCodexTokenRefresh as io, recordConnectionTokenRefresh as ip, recordConnectionUsed as iq, recordLeaseDataPlaneUrl as ir, recordLeaseTerminalDataPlaneUrl as is, recordPendingSessionToolCallResult as it, recordSessionActiveCodexCredential as iu, recordSkippedContextCompaction as iv, recordStreamAcknowledgment as iw, recordStripeWebhookEvent as ix, recordUsageEvent as iy, recordWarmingSandboxCreated as iz, type AgentInternalUpdateCommandResult as j, updateRecording as j$, revokeConnection as j0, revokeEnrollment as j1, revokeViewer as j2, rewindHostExportConsumer as j3, rlsContextForWorkspace as j4, rlsStrategyFor as j5, runIdempotentPersistenceTransaction as j6, safeDatabaseErrorFacts as j7, sanitizeEventPayload as j8, sanitizeEventString as j9, setSessionGoalStatus as jA, setSessionLastInputTokensForTurnAttempt as jB, setSessionPin as jC, setTemporalWorkflowId as jD, setVariableSetVariable as jE, setWorkspaceDefaultRig as jF, setWorkspaceEnvironmentVariable as jG, settleCodexCredentialFailover as jH, settleCodexCredentialLeaseLoss as jI, settleScheduledTaskRunInTransaction as jJ, settleSessionAttemptInterruptions as jK, settleSessionIdleWithParentOutbox as jL, shortMemoryId as jM, steerAgentSessionInTransaction as jN, steerQueuedTurnInTransaction as jO, storeIntegrationOAuthClient as jP, submitHumanPromptInTransaction as jQ, sumUsageQuantity as jR, supersedeSessionCurrentDirectionInTransaction as jS, touchEnrollmentLastSeen as jT, touchLeaseHolder as jU, updateCodexRotationSettings as jV, updateConnection as jW, updateImportBatchCounts as jX, updateKnowledgeMemory as jY, updatePackInstallationStatus as jZ, updatePtySessionActivity as j_, sanitizeMemoryText as ja, sanitizeModelPayload as jb, saveComposerDraftInTransaction as jc, saveRunState as jd, saveWorkspaceMemory as je, searchWorkspaceMemories as jf, sendAgentMessageInTransaction as jg, serializeEffectiveSessionControl as jh, sessionAuthorizationScopeFilter as ji, sessionSubject as jj, sessionTreeStatsForSessions as jk, sessionsWithActiveOpOnEnrollment as jl, setActiveCodexCredential as jm, setActiveSandbox as jn, setCodexCredentialExhausted as jo, setCodexCredentialExhaustedWithWakeTargets as jp, setCodexCredentialStatus as jq, setCodexCredentialStatusById as jr, setConnectionStatus as js, setEnrollmentDisplayState as jt, setEnrollmentOpStreamState as ju, setEnrollmentWentOffline as jv, setInitialActiveCodexCredential as jw, setRlsContext as jx, setSessionCodexPin as jy, setSessionGoalLastContinuationTurn as jz, type AppendEventInput as k, updateRig as k0, updateRigChangeStatus as k1, updateScheduledTask as k2, updateScheduledTaskRun as k3, updateSessionCommandReceiptResult as k4, updateSessionGoal as k5, updateSessionMcpServerCredentials as k6, updateSessionTitle as k7, updateVariableSet as k8, updateWorkspace as k9, updateWorkspaceEnvironment as ka, updateWorkspaceSettings as kb, upsertBillingCustomer as kc, upsertCapabilityCatalogItem as kd, upsertCodexSubscriptionCredential as ke, upsertGitHubInstallation as kf, upsertMachineMetricsLatest as kg, upsertRegistryCapabilityCatalogItem as kh, upsertSandboxSessionEnvelope as ki, upsertSessionGoal as kj, upsertWorkspaceModelPolicy as kk, validateHumanInputResponse as kl, withAccountRls as km, withCodexCapacityMutation as kn, withCodexCredentialRefreshLock as ko, withRlsContext as kp, withWorkspaceRls as kq, withWorkspaceSubjectRls as kr, withWorkspaceUsageLock as ks, workspaceCaptureAtRevision as kt, workspaceCodexSubscriptionActive as ku, type ApplyContextCompactionResult as l, type ApplySessionTurnSettlementInput as m, type ApplySessionTurnSettlementResult as n, type ArmCodexCapacityWaitResult as o, CODEX_CAPACITY_REFRESH_MIN_MS as p, provisionRoles, CODEX_CREDENTIAL_LEASE_TTL_MS as q, CODEX_ROTATION_STRATEGIES as r, type ClaimSessionWorkForAttemptInput as s, type ClaimSessionWorkForAttemptResult as t, type ClearSessionContextResult as u, type CodexAccountStatus as v, type CodexAccountUsageSnapshot as w, type CodexAuthDeps as x, type CodexCapacityAvailabilityDecision as y, type CodexCapacityMutationResult as z };
+export { type CodexResetRedemptionOutcome as $, AGENT_VISIBLE_MEMORY_STATUSES as A, type BeginSandboxRematerializationResult as B, CODEX_CAPACITY_REFRESH_MAX_MS as C, type CodexAccountUsageSnapshot as D, type CodexAllocatorUpdateResult as E, type CodexAuthDeps as F, type CodexCapacityAvailabilityDecision as G, type CodexCapacityMutationResult as H, type CodexCapacityResetKind as I, type CodexCapacitySelectionContext as J, type CodexCapacityWait as K, type CodexCapacityWaitStatus as L, type CodexCapacityWakeTarget as M, type CodexCredentialForRun as N, type CodexCredentialLeaseCandidateFilter as O, type CodexCredentialLeaseCandidateFilterResult as P, type ProvisionResult, type ProvisionRolesOptions, type CodexCredentialLeasePolicyScopeResolver as Q, type CodexCredentialLeaseQuarantine as R, type CodexCredentialLeaseResult as S, type CodexCredentialLeaseSelection as T, type CodexCredentialLeaseSelectionContext as U, type CodexCredentialStatus as V, type CodexCredentialTokens as W, type CodexLeaseAccountStatus as X, type CodexPinSource as Y, type CodexRateLimitResetCreditsAccountResult as Z, type CodexResetRedemptionAttempt as _, type AcceptSessionApprovalDecisionResult as a, type InstallOrReadTurnExecutionPolicyForAttemptResult as a$, type CodexResetRedemptionRecovery as a0, type CodexResetRedemptionSendNotReadyReason as a1, type CodexResetRedemptionStatus as a2, type CodexRotationSettings as a3, type CodexRotationStrategy as a4, type CodexTokenDeadlineClock as a5, type CodexTokenDeadlineOptions as a6, type ComposerDraftRow as a7, type ConnectionBrokerDeps as a8, type ConnectionCredentialForBroker as a9, type EffectiveSessionControl as aA, type EnableCapabilityInstallationInput as aB, type EnabledMcpCapabilityServer as aC, type EnqueueSessionTurnInput as aD, type EnrollmentExposure as aE, type EnrollmentOs as aF, type EnrollmentRecord as aG, type EnrollmentStatus as aH, type ExpiredFileUploadCleanupClaim as aI, type FenceCodexResetRedemptionSendResult as aJ, type FileUploadCleanupClaimResult as aK, type ForceDrainResult as aL, type FrozenTurnInitiator as aM, type GitHubInstallation as aN, type GitHubInstallationAccess as aO, type GoalContinuationDecision as aP, type HostExportConsumerStatus as aQ, type HostExportKind as aR, HostExportPayloadError as aS, HostMcpCredentialBindingError as aT, type HostMcpCredentialResolverContext as aU, HostMcpCredentialScopeError as aV, HumanInputResponseValidationError as aW, type IdempotentPersistenceTransactionOptions as aX, type ImportBatch as aY, type InitializeSessionStartInput as aZ, type InitializeSessionStartResult as a_, ConnectionRefreshHttpError as aa, type ConsumeOAuthStateNonceInput as ab, type CorrectWorkspaceMemoryInput as ac, type CorrectWorkspaceMemoryResult as ad, type CreateCapabilityCatalogItemInput as ae, type CreateConnectionInput as af, type CreateDbOptions as ag, type CreateImportBatchInput as ah, type CreateKnowledgeMemoryInput as ai, type CreatePackInstallationInput as aj, type CreateScheduledTaskInput as ak, type CreateSessionGoalInput as al, type CreateSessionMcpServerInput as am, type CreateSocialConnectionInput as an, type CreateSocialPostInput as ao, type CreditBalanceByAccount as ap, type Database as aq, type DatabaseFailureCode as ar, type DbClient as as, type DbSession as at, type DeviceEnrollmentRequestRecord as au, type DeviceEnrollmentStatus as av, type EditQueueCommandResult as aw, type EffectiveControlBlocker as ax, type EffectiveControlResumeOption as ay, type EffectiveControlState as az, type AcceptSessionHumanInputResponseResult as b, RigChangeTransitionError as b$, type IntegrationOAuthClientForUse as b0, type LeaseHolderKind as b1, type LeaseSnapshot as b2, type ListKnowledgeMemoryOptions as b3, type ListSessionEventPageOptions as b4, type ListSessionEventsOptions as b5, type ListSessionsForSubjectOptions as b6, type ListSessionsOptions as b7, type LiveModalSandboxLeaseAttribution as b8, MACHINE_METRICS_SERIES_INTERVAL_MS as b9, NewSessionDraftAccessError as bA, NewSessionDraftConflictError as bB, type NewSessionDraftRow as bC, type PendingSessionToolCallInput as bD, type PersistenceFailureDetails as bE, type PersistenceRetryOutcome as bF, type QueueCommandConflictCode as bG, QueueCommandConflictError as bH, type QueueCommandResult as bI, type QueuedTurnRow as bJ, type ReapDrainable as bK, type ReconcileCodexCapacityWaitResult as bL, type RecoverSessionDispatchInput as bM, type RecoverSessionDispatchResult as bN, type RefreshTransportOptions as bO, type RegisterWorkspacePackInput as bP, type RegistryCapabilityCatalogItemInput as bQ, type RegistryCatalogSurfaceKey as bR, type ReplaceIntegrationOAuthClientInput as bS, type RequestSessionTurnRecoveryInput as bT, type RequestSessionTurnRecoveryResult as bU, type ResolveConnectionCredentialInput as bV, type ResolveConnectionCredentialResult as bW, type RetainedFileArtifact as bX, RigActiveVersionChangedError as bY, RigChangeAlreadyVerifyingError as bZ, type RigChangeMonitoringSummary as b_, MAX_INTERNAL_UPDATE_BATCH_BYTES as ba, MAX_INTERNAL_UPDATE_BATCH_MEMBERS as bb, MAX_INTERNAL_UPDATE_BYTES as bc, MEMORY_ACTIVE_RECORD_CAP as bd, MEMORY_BLOCK_KIND_ORDER as be, MEMORY_BLOCK_RECORD_LIMIT as bf, MEMORY_CORRECT_TOOL_DESCRIPTION as bg, MEMORY_KIND_SECTION_TITLES as bh, MEMORY_NEAR_DUP_COSINE_THRESHOLD as bi, MEMORY_NEAR_DUP_NEIGHBORS as bj, MEMORY_SAVE_TOOL_DESCRIPTION as bk, MEMORY_SEARCH_DEFAULT_LIMIT as bl, MEMORY_SEARCH_MAX_LIMIT as bm, MEMORY_SEARCH_TOOL_DESCRIPTION as bn, MEMORY_TEXT_MAX_CHARS as bo, MEMORY_VISIBLE_RECORD_CAP as bp, type MachineMetricsRow as bq, type MachineMetricsSample as br, type MarkWarmLeaseInstanceLostResult as bs, type MaterializeGoalContinuationResult as bt, type MemoryBlockRecord as bu, type MemoryEmbedder as bv, type MemorySanitizeResult as bw, type MeterableWarmLease as bx, type NestedAgentDepthDeploymentPolicy as by, type NestedAgentDepthPolicySource as bz, type AccrueWarmSecondsResult as c, type SessionListCursor as c$, type RigVersionContentInput as c0, type RigVersionMonitoringSummary as c1, type RlsContext as c2, type RlsStrategy as c3, SESSION_ANCESTRY_LIMIT as c4, SESSION_DISCOVERY_CONTROL_TARGET_LIMIT as c5, SESSION_DISCOVERY_CONTROL_TITLE_MAX_CHARS as c6, SESSION_DISCOVERY_GOAL_MAX_CHARS as c7, SESSION_DISCOVERY_MESSAGE_MAX_CHARS as c8, SESSION_EVENT_DB_PAGE_MAX_BYTES as c9, type SaveWorkspaceMemoryResult as cA, type SessionAttemptInterruptionSettlement as cB, type SessionCodexState as cC, type SessionCommandActor as cD, SessionCommandIdempotencyError as cE, type SessionCommandReceiptRow as cF, SessionContextBusyError as cG, SessionControlConflictError as cH, SessionControlInvariantError as cI, type SessionControlMutationResult as cJ, type SessionCreateDeniedResult as cK, type SessionCreateInput as cL, type SessionCreateResult as cM, type SessionCreateSuccessResult as cN, type SessionDepthPolicy as cO, type SessionDiscoveryControl as cP, type SessionDiscoveryCursor as cQ, type SessionDiscoveryOrderBy as cR, type SessionDiscoverySummary as cS, type SessionEventPage as cT, SessionEventPersistenceError as cU, type SessionEventWriteLockInput as cV, type SessionEventWriteLocks as cW, type SessionGoalContinuationProjection as cX, SessionIdConflictError as cY, type SessionLineage as cZ, SessionListAccessError as c_, SESSION_LIST_SNAPSHOT_MAX_ACTIVE_PER_SUBJECT as ca, SESSION_LIST_SNAPSHOT_MAX_IDS as cb, type SafeDatabaseErrorFacts as cc, type SandboxArchiveAvailability as cd, type SandboxArchiveRevision as ce, SandboxImageConflictError as cf, type SandboxKind as cg, type SandboxLeaseLiveness as ch, SandboxLeaseRecoveryBlockedError as ci, SandboxLeaseSupersededError as cj, type SandboxOpenPtySessionRow as ck, type SandboxProviderExistence as cl, type SandboxPtyProcessIdentity as cm, type SandboxPtySessionRow as cn, type SandboxRecord as co, type SandboxRecoveryState as cp, type SandboxRestoreStatus as cq, type SandboxRetainedProcess as cr, type SandboxRetainedProcessState as cs, SandboxRigConflictError as ct, type SandboxWorkspaceMutationAdmission as cu, SandboxWorkspaceMutationFencedError as cv, type SandboxWorkspaceMutationProviderOutcome as cw, type SandboxWorkspaceReadiness as cx, SanitizedDatabasePersistenceCause as cy, type SaveWorkspaceMemoryInput as cz, type AcquireLeaseInput as d, acceptSessionHumanInputResponse as d$, SessionListCursorError as d0, SessionListCursorExpiredError as d1, SessionListSnapshotLimitError as d2, type SessionMcpServerForRun as d3, SessionPinAccessError as d4, SessionPinVersionConflictError as d5, type SessionRecordingCodec as d6, type SessionRecordingMode as d7, type SessionRecordingRow as d8, type SessionRecordingState as d9, type UpdateKnowledgeMemoryInput as dA, type UpdateScheduledTaskInput as dB, type UpdateSessionMcpApprovalPolicyResult as dC, type UpdateSessionMcpServerCredentialsInput as dD, type UpdateSessionMcpServerCredentialsResult as dE, type UpsertCodexSubscriptionCredentialResult as dF, type UserLookup as dG, type VariableSetForRun as dH, WORKSPACE_MEMORY_BLOCK_EMPTY as dI, WORKSPACE_MEMORY_BLOCK_HEADER_POPULATED as dJ, WORKSPACE_MEMORY_BLOCK_TOKEN_BUDGET as dK, type WorkspaceCaptureCommitResult as dL, type WorkspaceCaptureGcPlan as dM, type WorkspaceCaptureGcRow as dN, type WorkspaceCaptureRow as dO, type WorkspaceControlLockMode as dP, type WorkspaceControlMutationResult as dQ, type WorkspaceControlRow as dR, type WorkspaceEnvironmentForRun as dS, type WorkspaceMemoryOrigin as dT, type WorkspaceMemorySearchInput as dU, type WorkspaceMemorySearchMode as dV, type WorkspaceMemorySearchResult as dW, type WorkspaceModelPolicy as dX, abandonCodexResetRedemptionBeforeProvider as dY, abandonRecordingForTurnAttempt as dZ, acceptSessionApprovalDecision as d_, type SessionSpawnDenial as da, type SessionSpawnDenialCode as db, SessionSpawnDeniedDbError as dc, type SessionSystemUpdateOutboxDelivery as dd, type SessionTurnAttemptOutcome as de, type SessionTurnForExecution as df, type SessionTurnRecordingSettlement as dg, type SessionWorkPeek as dh, type SessionWorkTrigger as di, type SessionWorkflowWake as dj, type SessionWorkflowWakeDeliveryResult as dk, type SetSessionCodexPinOptions as dl, type SetSessionGoalStatusEvent as dm, type SettleCodexCredentialFailoverResult as dn, type SettleCodexCredentialLeaseLossResult as dp, type SteerQueueCommandResult as dq, type StoreIntegrationOAuthClientInput as dr, type StoredIntegrationOAuthClient as ds, type StreamAcknowledgment as dt, type SubmitHumanPromptResult as du, type ToolspaceCallReservation as dv, type ToolspaceTurnAttemptClaims as dw, type TurnAttemptFenceRejectReason as dx, type UpdateConnectionInput as dy, type UpdateImportBatchCountsInput as dz, type AcquireLeaseResult as e, consumeNewSessionDraftInTransaction as e$, accrueWarmSeconds as e0, acknowledgeHostExportBatch as e1, acquireCodexCredentialLease as e2, acquireLease as e3, activateRigVersion as e4, addSessionSystemUpdate as e5, addSessionSystemUpdateWithSourceMutation as e6, admitToolspaceTurnAttempt as e7, adoptCodexResetRedemptionAttempt as e8, advanceWorkspaceGeneration as e9, buildHostConnectionTokenResolver as eA, canonicalSessionCommandHash as eB, claimCodexResetRedemption as eC, claimExpiredFileUploadCleanup as eD, claimFileUploadCleanup as eE, claimHostExportBatch as eF, claimPendingSessionSystemUpdateOutbox as eG, claimPendingSessionWorkflowWakes as eH, claimSessionWorkForAttempt as eI, clearDurablePendingSessionToolCalls as eJ, clearEnrollmentWentOffline as eK, clearPendingSessionToolspaceCall as eL, clearSessionContext as eM, clearSessionGoal as eN, clearedContextMarkerItem as eO, closePtySession as eP, closeSessionTurnAttemptInTransaction as eQ, codexCapacityRefreshBackoffMs as eR, commitWarmingToWarm as eS, completeCodexResetRedemption as eT, completeExpiredFileUploadCleanup as eU, completeFileUpload as eV, completeFileUploadCleanup as eW, computeWorkspaceCaptureGcPlan as eX, confirmDrainCold as eY, consumeDeviceEnrollmentRequest as eZ, consumeIntegrationOAuthStateNonce as e_, advanceWorkspaceGenerationForDirectRequest as ea, advanceWorkspaceGenerationForRetainedProcess as eb, allAccountPermissions as ec, allWorkspacePermissions as ed, appendSessionEventToSandboxGroup as ee, appendSessionEvents as ef, appendSessionEventsAndUpdateSession as eg, appendSessionEventsForTurnAttempt as eh, appendSessionEventsWithLockedSessionUpdate as ei, appendSessionHistoryItems as ej, applyContextCompaction as ek, applyCreditDebitUpToBalance as el, applyCreditLedgerEntry as em, applySessionTurnSettlement as en, approveDeviceEnrollmentRequest as eo, areGitHubRepositoriesAllowedForWorkspace as ep, armCodexCapacityWait as eq, assertAgentCommandAuthorityInTransaction as er, autoResumeSessionBranchInTransaction as es, beginRigChangeVerificationAttempt as et, beginSandboxRematerialization as eu, bindGitHubInstallationRepositories as ev, bootstrapWorkspace as ew, buildChildCompletionDigest as ex, buildCodexTokenResolver as ey, buildConnectionTokenResolver as ez, type ActiveSandboxPointer as f, disableHostExportConsumer as f$, correctWorkspaceMemory as f0, countActiveApiKeysForWorkspace as f1, countActiveSessionHistoryItems as f2, countActiveSessionsForWorkspace as f3, countActiveSessionsUsingEnvironment as f4, countActiveSessionsUsingVariableSet as f5, countConsecutiveReactiveRotations as f6, countQueuedTurns as f7, countRigs as f8, countSandboxLeasesByLiveness as f9, createSessionWithIdempotencyKey as fA, createSessionWithIdempotencyKeyResult as fB, createSocialConnection as fC, createSocialPost as fD, createVariableSet as fE, createWorkspace as fF, createWorkspaceEnvironment as fG, databaseFailureCode as fH, deadLetterHostExportHead as fI, decodeSessionListCursor as fJ, decryptEnvironmentValue as fK, decryptedCapabilityHeaders as fL, deleteGitHubInstallationBinding as fM, deleteRecording as fN, deleteRig as fO, deleteRigIfNoActiveSessions as fP, deleteScheduledTask as fQ, deleteSessionQueueItemInTransaction as fR, deleteVariableSet as fS, deleteVariableSetVariable as fT, deleteWorkspace as fU, deleteWorkspaceCaptureRows as fV, deleteWorkspaceEnvironment as fW, deleteWorkspaceEnvironmentVariable as fX, deleteWorkspacePack as fY, denyDeviceEnrollmentRequest as fZ, disableCapabilityInstallation as f_, countScheduledTasksForWorkspace as fa, countScheduledTasksUsingEnvironment as fb, countScheduledTasksUsingVariableSet as fc, countSessionHistoryItems as fd, countSessionsUsingRig as fe, countVariableSets as ff, countWorkspaceEnvironments as fg, countWorkspacesForAccount as fh, createApiKey as fi, createConnection as fj, createDb as fk, createDeviceEnrollmentRequest as fl, createEnrollment as fm, createFileUpload as fn, createImportBatch as fo, createKnowledgeMemory as fp, createRig as fq, createRigChange as fr, createRigVersion as fs, createRigVersionForChangePromotion as ft, createSandbox as fu, createScheduledTask as fv, createScheduledTaskRun as fw, createSession as fx, createSessionGoal as fy, createSessionMcpServers as fz, type AddSessionSystemUpdateInput as g, getRetainedProcess as g$, disconnectAllCodexAccounts as g0, disconnectCodexAccount as g1, editQueuedTurnInTransaction as g2, enableCapabilityInstallation as g3, enablePackInstallation as g4, encodeSessionListCursor as g5, encryptEnvironmentValue as g6, enqueueSessionTurn as g7, enqueueSessionWorkflowWake as g8, enqueueSessionWorkflowWakeIfRunnable as g9, getCodexCapacityWaitForSession as gA, getCodexCredentialStatus as gB, getCodexResetRedemptionAttempt as gC, getCodexRotationSettings as gD, getComposerDraftInTransaction as gE, getConnectionMetadata as gF, getDeviceEnrollmentRequestByDeviceCode as gG, getEnrollment as gH, getFile as gI, getFileUpload as gJ, getHostExportConsumerStatus as gK, getHumanInputResumeForEvent as gL, getKnowledgeMemory as gM, getLatestRunState as gN, getLatestStartedSessionTurn as gO, getManagedAccount as gP, getManagedUserByEmail as gQ, getMaterializedSandboxFileResources as gR, getNestedAgentDepthDeploymentPolicy as gS, getNewSessionDraftInTransaction as gT, getOpenPtySession as gU, getOrCreateSessionSystemUpdateOutbox as gV, getPackInstallation as gW, getPendingDeviceEnrollmentRequestByUserCode as gX, getPendingDeviceEnrollmentRequestByUserCodeGlobal as gY, getRecording as gZ, getRetainedFileArtifact as g_, enqueueSessionWorkflowWakeInTransaction as ga, ensureCodexRotationSettings as gb, ensureManagedAccessForUser as gc, estimateMemoryTokens as gd, evaluateGoalContinuation as ge, evaluateSessionControl as gf, evaluateSessionControls as gg, evaluateSessionDiscoveryControls as gh, expireSessionHumanInputRequest as gi, failHostExportBatch as gj, failSandboxRematerialization as gk, failWarmingToCold as gl, fenceCodexResetRedemptionSend as gm, fetchCodexRateLimitResetCreditsForAccount as gn, fetchCodexUsageForAccount as go, finalizeEnrollmentByToken as gp, findActiveApiKeyByHash as gq, forceDrainOverLimitViewerOnlyBoxes as gr, frozenInitiatorForCommandActor as gs, getActiveSessionHistoryItems as gt, getActiveSessionTurnForExecution as gu, getAnySessionInGroup as gv, getBillingBalance as gw, getBillingCustomer as gx, getCapabilityCatalogItem as gy, getCapabilityInstallation as gz, type AddSessionSystemUpdateResult as h, isStripeWebhookProcessed as h$, getRig as h0, getRigByName as h1, getRigChange as h2, getRigName as h3, getRigVersion as h4, getRigVersionById as h5, getSandbox as h6, getSandboxSessionEnvelope as h7, getScheduledTask as h8, getSession as h9, getWorkspaceEnvironment as hA, getWorkspaceEnvironmentByName as hB, getWorkspaceEnvironmentValuesForRun as hC, getWorkspaceGrant as hD, getWorkspaceModelPolicy as hE, getWorkspacePack as hF, grantWorkspaceAccess as hG, hasCreditLedgerEntry as hH, hashMemoryText as hI, heartbeatCodexCredentialLease as hJ, heartbeatCodexCredentialLeaseUntil as hK, heartbeatLeaseHolder as hL, ingestMachineMetricsSample as hM, initializeSessionStartAtomically as hN, insertFailedWorkspaceCapture as hO, insertMachineMetricsSeries as hP, insertPtySession as hQ, insertRecording as hR, insertWorkspaceCapture as hS, installOrReadTurnExecutionPolicyForAttempt as hT, interruptedToolCallResult as hU, isCodexBilledTurn as hV, isDatabasePersistenceFailure as hW, isMemoryTextTooLong as hX, isRetryablePersistenceSqlState as hY, isSessionCompactionRequested as hZ, isSessionEventPersistenceError as h_, getSessionByCreateIdempotencyKey as ha, getSessionCodexState as hb, getSessionEvent as hc, getSessionEventByClientEventId as hd, getSessionForSubject as he, getSessionGoal as hf, getSessionGoalWithContinuation as hg, getSessionHistoryItems as hh, getSessionHumanInputRequest as hi, getSessionLineage as hj, getSessionQueueSnapshot as hk, getSessionRootId as hl, getSessionSpawnDenial as hm, getSessionSpawnDenialByIdempotencyKey as hn, getSessionSystemUpdateOutboxByDedupeKey as ho, getSessionTurn as hp, getSessionTurnForAttempt as hq, getSocialConnection as hr, getStoredCapabilityHeaderCiphertext as hs, getStreamAcknowledgment as ht, getVariableSet as hu, getVariableSetByName as hv, getVariableSetValuesForRun as hw, getWorkspace as hx, getWorkspaceControlEvent as hy, getWorkspaceDefaultRigId as hz, type AdoptCodexResetRedemptionResult as i, lockWorkspaceInferenceControl as i$, latestWorkspaceCapture as i0, listApiKeys as i1, listCapabilityCatalogItems as i2, listCapabilityInstallations as i3, listCodexAccountStatuses as i4, listCodexResetRedemptionRecoveries as i5, listConnectionsMetadata as i6, listCreditBalancesByAccount as i7, listDistinctRigVersionIdsInGroup as i8, listDistinctVariableSetIdsInGroup as i9, listSessionEventPage as iA, listSessionEvents as iB, listSessionHumanInputRequests as iC, listSessionIdsInGroup as iD, listSessionMcpServerMetadata as iE, listSessionMcpServersForChildInheritance as iF, listSessionMcpServersForRun as iG, listSessionSpawnDenials as iH, listSessionSystemUpdatesForTurn as iI, listSessionTurns as iJ, listSessions as iK, listSessionsForSubject as iL, listSocialConnections as iM, listSocialPosts as iN, listUsageEvents as iO, listVariableSets as iP, listWorkspaceControlEvents as iQ, listWorkspaceEnvironments as iR, listWorkspaceMembers as iS, listWorkspacePacks as iT, listWorkspacesForSubject as iU, loadCodexCredentialForRun as iV, loadConnectionCredentialForBroker as iW, loadIntegrationOAuthClient as iX, loadVariableSetForRun as iY, loadWorkspaceEnvironmentForRun as iZ, lockSessionEventWriteRows as i_, listEnabledMcpCapabilityServers as ia, listEnrollments as ib, listGitHubInstallationAccessForWorkspace as ic, listGitHubInstallationIdsForWorkspace as id, listGitHubInstallationsForWorkspace as ie, listKnowledgeMemories as ig, listLiveModalSandboxLeaseAttributions as ih, listMeterableWarmLeases as ii, listOpenPtySessions as ij, listOutstandingSessionSystemUpdates as ik, listPackInstallations as il, listPendingCodexCapacityWakeTargets as im, listPendingSessionTurns as io, listRecordings as ip, listRegistryCatalogSurfaceKeys as iq, listRigChangeMonitoringSummaries as ir, listRigChanges as is, listRigVersionMonitoringSummaries as it, listRigVersions as iu, listRigs as iv, listSandboxes as iw, listScheduledTaskRuns as ix, listScheduledTasks as iy, listSessionDiscoverySummaries as iz, AgentCommandAuthorityError as j, registerPendingSessionToolCall as j$, markFileUploadFailed as j0, markSandboxFileResourcesMaterialized as j1, markSandboxProviderReady as j2, markSandboxRestoreVerifying as j3, markScheduledTaskRunFailedIfQueued as j4, markSessionAttemptQuiesced as j5, markSessionSystemUpdateOutboxDeliveredInTransaction as j6, markSessionSystemUpdateOutboxFailed as j7, markSessionWorkflowWakeDelivered as j8, markSessionWorkflowWakeFailed as j9, readMachineMetricsSeries as jA, readWorkspaceArchiveCapturePreflight as jB, reapExpiredSessionListSnapshots as jC, reapStaleLeaseHolders as jD, reapStaleLeaseHoldersGlobal as jE, reconcileCodexCapacityWait as jF, recordAuditEvent as jG, recordCodexAccountConnectors as jH, recordCodexAccountUsage as jI, recordCodexAccountUsageWithWakeTargets as jJ, recordCodexTokenRefresh as jK, recordConnectionTokenRefresh as jL, recordConnectionUsed as jM, recordLeaseDataPlaneUrl as jN, recordLeaseTerminalDataPlaneUrl as jO, recordPendingSessionToolCallResult as jP, recordSessionActiveCodexCredential as jQ, recordSkippedContextCompaction as jR, recordStreamAcknowledgment as jS, recordStripeWebhookEvent as jT, recordUsageEvent as jU, recordWarmingSandboxCreated as jV, recoverSessionDispatch as jW, refreshOAuthConnectionCredential as jX, registerDbBinding as jY, registerHostExportConsumer as jZ, registerInternalUpdateWakeInTransaction as j_, markStaleRegistryCatalogItems as ja, markStripeWebhookProcessed as jb, markWarmLeaseInstanceLost as jc, materializeGoalContinuation as jd, mcpServerIdForCapability as je, moveQueuedTurnInTransaction as jf, mutateSessionControlInTransaction as jg, mutateWorkspaceControlInTransaction as jh, nestedPostgresSqlState as ji, nextSessionHistoryPosition as jj, normalizeBearerScheme as jk, normalizeMemoryText as jl, orphanedResultRowIndicesForRepair as jm, peekSessionWork as jn, persistDrainSnapshot as jo, persistWarmSnapshot as jp, planWorkspaceCaptureGc as jq, projectEffectiveControlForRelatedAccess as jr, projectSessionForRelatedAccess as js, pruneHostExportOutbox as jt, quarantineCodexCredentialForLease as ju, reArmDrainingLease as jv, readActiveSandbox as jw, readLease as jx, readMachineMetricsLatest as jy, readMachineMetricsLatestForWorkspace as jz, type AgentInternalUpdateCommandResult as k, setSessionGoalStatusWithEvent as k$, registerSessionTurnAttemptClaim as k0, registerSessionWorkflowWakeInTransaction as k1, registerWorkspacePack as k2, releaseCodexCredentialLease as k3, releaseCodexResetRedemptionClaim as k4, releaseLeaseHolder as k5, removeWorkspaceMember as k6, renameCodexAccount as k7, renderWorkspaceMemoryBlock as k8, replaceIntegrationOAuthClient as k9, sanitizeModelPayload as kA, saveComposerDraftInTransaction as kB, saveNewSessionDraftInTransaction as kC, saveRunState as kD, saveWorkspaceMemory as kE, searchWorkspaceMemories as kF, sendAgentMessageInTransaction as kG, serializeEffectiveSessionControl as kH, sessionAuthorizationScopeFilter as kI, sessionSubject as kJ, sessionTreeStatsForSessions as kK, sessionsWithActiveOpOnEnrollment as kL, setActiveCodexCredential as kM, setActiveSandbox as kN, setCodexCredentialExhausted as kO, setCodexCredentialExhaustedWithWakeTargets as kP, setCodexCredentialStatus as kQ, setCodexCredentialStatusById as kR, setConnectionStatus as kS, setEnrollmentDisplayState as kT, setEnrollmentOpStreamState as kU, setEnrollmentWentOffline as kV, setInitialActiveCodexCredential as kW, setRlsContext as kX, setSessionCodexPin as kY, setSessionGoalLastContinuationTurn as kZ, setSessionGoalStatus as k_, requestSessionCompaction as ka, requestSessionTurnRecovery as kb, requireFile as kc, requireScheduledTask as kd, requireSession as ke, requireSocialConnection as kf, requireWorkspace as kg, reserveSessionCommandReceipt as kh, reserveToolspaceCallForAttempt as ki, resolveWorkspaceMemoryBlock as kj, resumeHostExportConsumer as kk, retainWorkspaceMutationProcess as kl, retireHostExportConsumer as km, revokeApiKey as kn, revokeConnection as ko, revokeEnrollment as kp, revokeViewer as kq, rewindHostExportConsumer as kr, rlsContextForWorkspace as ks, rlsStrategyFor as kt, rotateWorkspaceArchives as ku, runIdempotentPersistenceTransaction as kv, safeDatabaseErrorFacts as kw, sanitizeEventPayload as kx, sanitizeEventString as ky, sanitizeMemoryText as kz, type AppendEventInput as l, withWorkspaceRls as l$, setSessionLastInputTokensForTurnAttempt as l0, setSessionPin as l1, setSubjectRlsContext as l2, setTemporalWorkflowId as l3, setVariableSetVariable as l4, setWorkspaceDefaultRig as l5, setWorkspaceEnvironmentVariable as l6, settleCodexCredentialFailover as l7, settleCodexCredentialLeaseLoss as l8, settleRetainedProcess as l9, updateSessionGoalWithEvent as lA, updateSessionMcpApprovalPolicy as lB, updateSessionMcpServerCredentials as lC, updateSessionTitle as lD, updateVariableSet as lE, updateWorkspace as lF, updateWorkspaceEnvironment as lG, updateWorkspaceSettings as lH, upsertBillingCustomer as lI, upsertCapabilityCatalogItem as lJ, upsertCodexSubscriptionCredential as lK, upsertGitHubInstallation as lL, upsertMachineMetricsLatest as lM, upsertRegistryCapabilityCatalogItem as lN, upsertSandboxSessionEnvelope as lO, upsertSessionGoal as lP, upsertSessionGoalWithEvent as lQ, upsertWorkspaceModelPolicy as lR, validateHumanInputResponse as lS, verifyDirectWorkspaceMutationSettlement as lT, verifyRetainedProcessMutationSettlement as lU, verifyWorkspaceMutationSettlement as lV, withAccountRls as lW, withCodexCapacityMutation as lX, withCodexCredentialRefreshLock as lY, withCodexTokenDeadline as lZ, withRlsContext as l_, settleScheduledTaskRunInTransaction as la, settleSessionAttemptInterruptions as lb, settleSessionIdleWithParentOutbox as lc, shortMemoryId as ld, steerAgentSessionInTransaction as le, steerQueuedTurnInTransaction as lf, storeIntegrationOAuthClient as lg, submitHumanPromptInTransaction as lh, sumUsageQuantity as li, supersedeSessionCurrentDirectionInTransaction as lj, touchEnrollmentLastSeen as lk, touchLeaseHolder as ll, updateCodexAllocatorEligibility as lm, updateCodexRotationSettings as ln, updateConnection as lo, updateImportBatchCounts as lp, updateKnowledgeMemory as lq, updatePackInstallationStatus as lr, updatePtySessionActivity as ls, updateRecording as lt, updateRig as lu, updateRigChangeStatus as lv, updateScheduledTask as lw, updateScheduledTaskRun as lx, updateSessionCommandReceiptResult as ly, updateSessionGoal as lz, type ApplyContextCompactionResult as m, withWorkspaceSubjectRls as m0, withWorkspaceUsageLock as m1, workspaceCaptureAtRevision as m2, workspaceCodexSubscriptionActive as m3, type ApplySessionTurnSettlementInput as n, type ApplySessionTurnSettlementResult as o, type ArmCodexCapacityWaitResult as p, provisionRoles, type BootstrapWorkspaceInput as q, CODEX_CAPACITY_REFRESH_MIN_MS as r, CODEX_CREDENTIAL_LEASE_TTL_MS as s, CODEX_RESET_REDEMPTION_OUTCOMES as t, CODEX_ROTATION_STRATEGIES as u, type ClaimCodexResetRedemptionResult as v, type ClaimSessionWorkForAttemptInput as w, type ClaimSessionWorkForAttemptResult as x, type ClearSessionContextResult as y, type CodexAccountStatus as z };