@opengeni/db 1.3.0 → 1.4.2

package/dist/codemode-approvals.d.ts

@@ -33,7 +33,13 @@ export declare function adoptCodemodeApproval(db: Database, input: CodemodeConti
     catalogDigest: string;
     effectDigest: string | null;
 }, onTerminal?: (tx: Database, operation: CodemodeOperation) => Promise<void>): Promise<CodemodeOperation | null>;
-/** Read a handle with the current exact attempt and same original caller; old bearer authority is insufficient. */
+/**
+ * Read a handle with the current exact attempt and same original caller; old
+ * bearer authority is insufficient. This is a status read polled while a
+ * caller waits, so it is one plain snapshot select: it proves the exact live
+ * attempt in the same statement but takes no session/turn/attempt row locks
+ * and is not refused by a pending Pause/Steer, which owns the write fence only.
+ */
 export declare function readTurnCodemodeOperation(db: Database, input: CodemodeContinuationScope & {
     operationId: string;
     callerSubjectId: string;

package/dist/connect-attempts.js

@@ -7,9 +7,9 @@ import {
   getConnectAttempt,
   getConnectBeginReplay,
   listPendingConnectAttempts
-} from "./chunk-HYBQABBJ.js";
-import "./chunk-LRSIODCQ.js";
-import "./chunk-DSNEIW5E.js";
+} from "./chunk-HUKBIZGH.js";
+import "./chunk-IT3EYY2C.js";
+import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/connection-metadata.d.ts

@@ -0,0 +1,416 @@
+import { type ConnectionMetadata } from "@opengeni/contracts";
+import { type SQL } from "drizzle-orm";
+import { type Database } from "./database.js";
+/** Server-owned verification facts; public schemas expose them read-only and nullable. */
+export type ConnectionMetadataWithVerification = ConnectionMetadata & {
+    verifiedInstallAt: string | null;
+    verifiedInstallVersion: number | null;
+};
+export declare const connectionMetadataColumns: {
+    id: import("drizzle-orm/pg-core").PgColumn<{
+        name: "id";
+        tableName: "connections";
+        dataType: "string";
+        columnType: "PgUUID";
+        data: string;
+        driverParam: string;
+        notNull: true;
+        hasDefault: true;
+        isPrimaryKey: true;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+    }, {}, {}>;
+    authorityId: import("drizzle-orm/pg-core").PgColumn<{
+        name: "authority_id";
+        tableName: "connections";
+        dataType: "string";
+        columnType: "PgUUID";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+    }, {}, {}>;
+    authorityGeneration: import("drizzle-orm/pg-core").PgColumn<{
+        name: "authority_generation";
+        tableName: "connections";
+        dataType: "number";
+        columnType: "PgBigInt53";
+        data: number;
+        driverParam: string | number;
+        notNull: true;
+        hasDefault: true;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+    }, {}, {}>;
+    accountId: import("drizzle-orm/pg-core").PgColumn<{
+        name: "account_id";
+        tableName: "connections";
+        dataType: "string";
+        columnType: "PgUUID";
+        data: string;
+        driverParam: string;
+        notNull: true;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+    }, {}, {}>;
+    workspaceId: import("drizzle-orm/pg-core").PgColumn<{
+        name: "workspace_id";
+        tableName: "connections";
+        dataType: "string";
+        columnType: "PgUUID";
+        data: string;
+        driverParam: string;
+        notNull: true;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+    }, {}, {}>;
+    subjectId: import("drizzle-orm/pg-core").PgColumn<{
+        name: "subject_id";
+        tableName: "connections";
+        dataType: "string";
+        columnType: "PgText";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+    }, {}, {}>;
+    providerDomain: import("drizzle-orm/pg-core").PgColumn<{
+        name: "provider_domain";
+        tableName: "connections";
+        dataType: "string";
+        columnType: "PgText";
+        data: string;
+        driverParam: string;
+        notNull: true;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+    }, {}, {}>;
+    kind: import("drizzle-orm/pg-core").PgColumn<{
+        name: "kind";
+        tableName: "connections";
+        dataType: "string";
+        columnType: "PgText";
+        data: string;
+        driverParam: string;
+        notNull: true;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+    }, {}, {}>;
+    status: import("drizzle-orm/pg-core").PgColumn<{
+        name: "status";
+        tableName: "connections";
+        dataType: "string";
+        columnType: "PgText";
+        data: string;
+        driverParam: string;
+        notNull: true;
+        hasDefault: true;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+    }, {}, {}>;
+    grantedScopes: import("drizzle-orm/pg-core").PgColumn<{
+        name: "granted_scopes";
+        tableName: "connections";
+        dataType: "json";
+        columnType: "PgJsonb";
+        data: string[];
+        driverParam: unknown;
+        notNull: true;
+        hasDefault: true;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+    }, {}, {
+        $type: string[];
+    }>;
+    expiresAt: import("drizzle-orm/pg-core").PgColumn<{
+        name: "expires_at";
+        tableName: "connections";
+        dataType: "date";
+        columnType: "PgTimestamp";
+        data: Date;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+    }, {}, {}>;
+    lastRefreshAt: import("drizzle-orm/pg-core").PgColumn<{
+        name: "last_refresh_at";
+        tableName: "connections";
+        dataType: "date";
+        columnType: "PgTimestamp";
+        data: Date;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+    }, {}, {}>;
+    lastUsedAt: import("drizzle-orm/pg-core").PgColumn<{
+        name: "last_used_at";
+        tableName: "connections";
+        dataType: "date";
+        columnType: "PgTimestamp";
+        data: Date;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+    }, {}, {}>;
+    lastError: import("drizzle-orm/pg-core").PgColumn<{
+        name: "last_error";
+        tableName: "connections";
+        dataType: "string";
+        columnType: "PgText";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+    }, {}, {}>;
+    version: import("drizzle-orm/pg-core").PgColumn<{
+        name: "version";
+        tableName: "connections";
+        dataType: "number";
+        columnType: "PgInteger";
+        data: number;
+        driverParam: string | number;
+        notNull: true;
+        hasDefault: true;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+    }, {}, {}>;
+    verifiedInstallAt: import("drizzle-orm/pg-core").PgColumn<{
+        name: "verified_install_at";
+        tableName: "connections";
+        dataType: "date";
+        columnType: "PgTimestamp";
+        data: Date;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+    }, {}, {}>;
+    verifiedInstallVersion: import("drizzle-orm/pg-core").PgColumn<{
+        name: "verified_install_version";
+        tableName: "connections";
+        dataType: "number";
+        columnType: "PgInteger";
+        data: number;
+        driverParam: string | number;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+    }, {}, {}>;
+    metadata: import("drizzle-orm/pg-core").PgColumn<{
+        name: "metadata";
+        tableName: "connections";
+        dataType: "json";
+        columnType: "PgJsonb";
+        data: Record<string, unknown>;
+        driverParam: unknown;
+        notNull: true;
+        hasDefault: true;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+    }, {}, {
+        $type: Record<string, unknown>;
+    }>;
+    createdBySubjectId: import("drizzle-orm/pg-core").PgColumn<{
+        name: "created_by_subject_id";
+        tableName: "connections";
+        dataType: "string";
+        columnType: "PgText";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+    }, {}, {}>;
+    updatedBySubjectId: import("drizzle-orm/pg-core").PgColumn<{
+        name: "updated_by_subject_id";
+        tableName: "connections";
+        dataType: "string";
+        columnType: "PgText";
+        data: string;
+        driverParam: string;
+        notNull: false;
+        hasDefault: false;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: [string, ...string[]];
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+    }, {}, {}>;
+    createdAt: import("drizzle-orm/pg-core").PgColumn<{
+        name: "created_at";
+        tableName: "connections";
+        dataType: "date";
+        columnType: "PgTimestamp";
+        data: Date;
+        driverParam: string;
+        notNull: true;
+        hasDefault: true;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+    }, {}, {}>;
+    updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+        name: "updated_at";
+        tableName: "connections";
+        dataType: "date";
+        columnType: "PgTimestamp";
+        data: Date;
+        driverParam: string;
+        notNull: true;
+        hasDefault: true;
+        isPrimaryKey: false;
+        isAutoincrement: false;
+        hasRuntimeDefault: false;
+        enumValues: undefined;
+        baseColumn: never;
+        identity: undefined;
+        generated: undefined;
+    }, {}, {}>;
+};
+export declare function connectionSubjectVisibility(subjectId?: string | null): SQL;
+export declare function withConnectionSubjectRls<T>(db: Database, workspaceId: string, subjectId: string | null | undefined, fn: (db: Database) => Promise<T>): Promise<T>;
+export declare function listConnectionsMetadata(db: Database, workspaceId: string, subjectId?: string | null): Promise<ConnectionMetadataWithVerification[]>;
+export declare function getConnectionMetadata(db: Database, workspaceId: string, connectionId: string, subjectId?: string | null): Promise<ConnectionMetadataWithVerification | null>;
+export declare function mapConnectionMetadata(row: {
+    id: string;
+    authorityId?: string | null;
+    authorityGeneration: number;
+    accountId: string;
+    workspaceId: string;
+    subjectId: string | null;
+    providerDomain: string;
+    kind: string;
+    status: string;
+    grantedScopes: string[];
+    expiresAt: Date | null;
+    lastRefreshAt: Date | null;
+    lastUsedAt: Date | null;
+    lastError: string | null;
+    version: number;
+    verifiedInstallAt: Date | null;
+    verifiedInstallVersion: number | null;
+    metadata: Record<string, unknown>;
+    createdBySubjectId: string | null;
+    updatedBySubjectId: string | null;
+    createdAt: Date;
+    updatedAt: Date;
+}): ConnectionMetadataWithVerification;

package/dist/credit-balances.d.ts

@@ -5,14 +5,35 @@ type CreditBalanceSnapshot = BillingBalance & {
     creditPolicyRevision?: number;
 };
 export declare function getBillingBalance(db: Database, accountId: string, policyRevision?: number): Promise<CreditBalanceSnapshot>;
-/** Missing model means a non-model resource, which can only use general credits. */
-export declare function spendableCreditMicros(balance: BillingBalance, modelId?: string): number;
-export declare function getSpendableCreditBalance(db: Database, accountId: string, modelId?: string, policyRevision?: number): Promise<CreditBalanceSnapshot>;
-export declare function planCreditDebit(balance: BillingBalance, requestedMicros: number, modelId?: string): {
+/**
+ * What a charge pays for. A canonical model ID uses grants scoped to that
+ * model; {@link VOICE_CREDIT_USAGE} (dictation and live voice) uses grants
+ * that cover voice, which are the verified-signup trial credits. Omitted means
+ * a non-model resource, which can only use general credits.
+ */
+export type CreditUsage = string | {
+    readonly kind: "voice";
+} | undefined;
+/** Deployment-funded dictation and live voice. */
+export declare const VOICE_CREDIT_USAGE: {
+    readonly kind: "voice";
+};
+export declare function spendableCreditMicros(balance: BillingBalance, usage?: CreditUsage): number;
+export declare function getSpendableCreditBalance(db: Database, accountId: string, usage?: CreditUsage, policyRevision?: number): Promise<CreditBalanceSnapshot>;
+export declare function planCreditDebit(balance: BillingBalance, requestedMicros: number, usage?: CreditUsage): {
     debitedMicros: number;
     allocations: {
         grantEntryId: string;
         amountMicros: number;
     }[];
 };
+/**
+ * Allocations for an already-consumed charge of the full amount: covering
+ * grants pay what they can and general credit takes the rest, possibly going
+ * negative.
+ */
+export declare function planPostUseCreditAllocations(balance: BillingBalance, amountMicros: number, usage: CreditUsage): {
+    grantEntryId: string;
+    amountMicros: number;
+}[];
 export {};

package/dist/database.d.ts

@@ -192,7 +192,13 @@ export declare function withWorkspaceRls<T>(db: Database, workspaceId: string, f
 export declare function withSessionActivityRlsContext<T>(db: Database, context: RlsContext & {
     workspaceId: string;
 }, fn: (db: SessionActivityDatabase) => Promise<T>, transactionConfig?: PgTransactionConfig, fenceMode?: "shared" | "none", organizationMembershipFence?: boolean): Promise<T>;
-export declare function withWorkspaceSessionActivityRls<T>(db: Database, workspaceId: string, fn: (db: SessionActivityDatabase) => Promise<T>, transactionConfig?: PgTransactionConfig): Promise<T>;
+/**
+ * `organizationMembershipFence` is required when the callback takes the
+ * organization-membership lifecycle lock (for example external-actor
+ * reauthorization): that lock precedes the session-tenancy fence and the
+ * canonical control/workspace/session prefix, never follows it.
+ */
+export declare function withWorkspaceSessionActivityRls<T>(db: Database, workspaceId: string, fn: (db: SessionActivityDatabase) => Promise<T>, transactionConfig?: PgTransactionConfig, organizationMembershipFence?: boolean): Promise<T>;
 /**
  * Run one of several ordered workspace activity scopes inside a caller-owned
  * transaction. Each scope is fully finalized before restoring the caller's

package/dist/editable-artifact-durable-export.js

@@ -1,8 +1,8 @@
 import {
   rawRows,
   withRlsContext
-} from "./chunk-LRSIODCQ.js";
-import "./chunk-DSNEIW5E.js";
+} from "./chunk-IT3EYY2C.js";
+import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 

package/dist/editable-artifacts.js

@@ -10,9 +10,9 @@ import {
   listEditableArtifactIdsForSession,
   touchEditableArtifactSessionLink,
   transactionallyAuthorizeEditableArtifactActor
-} from "./chunk-3XHC5KC5.js";
-import "./chunk-LRSIODCQ.js";
-import "./chunk-DSNEIW5E.js";
+} from "./chunk-OKCBARX6.js";
+import "./chunk-IT3EYY2C.js";
+import "./chunk-JL6TBB76.js";
 import "./chunk-P7YDM2RI.js";
 import "./chunk-PZ5AY32C.js";
 export {

package/dist/index.d.ts

@@ -1,9 +1,14 @@
 export * from "./organization-slack-bots.js";
+export * from "./voice-transcription-settlement.js";
+import { type ConnectionMetadataWithVerification } from "./connection-metadata.js";
+export { getConnectionMetadata, listConnectionsMetadata, type ConnectionMetadataWithVerification, } from "./connection-metadata.js";
 export { readCreditPromotionPolicy } from "./credit-promotion-policy.js";
-export { getBillingBalance, getSpendableCreditBalance, spendableCreditMicros, } from "./credit-balances.js";
+import { type CreditUsage } from "./credit-balances.js";
+export { getBillingBalance, getSpendableCreditBalance, spendableCreditMicros, VOICE_CREDIT_USAGE, type CreditUsage, } from "./credit-balances.js";
 import { type TurnAttemptFenceRejectReason } from "./session-attempt-fence.js";
 export type { TurnAttemptFenceRejectReason } from "./session-attempt-fence.js";
 export { resolveConnectorActionPolicy, connectorActionPolicyDecision, projectConnectorToolPermission, connectorActionPoliciesForAccountRoutes, connectorToolPolicyRevision, ConnectorToolPermissionConflictError, } from "./connector-action-policy.js";
+export { lockLiveNativeOriginalOriginTx, type ModalNativeLiveOriginScope, type ModalNativeLiveOriginProjection, type ModalNativeLiveOriginResult, } from "./modal-native-live-origin.js";
 export { SubscriptionAccountChangedError } from "./subscription-account-conflict.js";
 import type { GoalAdmissionPausedReason } from "@opengeni/contracts";
 export declare const getScheduledTaskClaudeProviderAccountAuthoritySnapshot: (db: Database, workspaceId: string, taskId: string) => Promise<{
@@ -260,6 +265,7 @@ export * from "./session-queue-commands.js";
 export * from "./session-realtime.js";
 export * from "./session-realtime-context.js";
 export * from "./session-realtime-ledger.js";
+export * from "./session-realtime-billing.js";
 export * from "./new-session-drafts.js";
 export * from "./workspace-instruction-policies.js";
 export * from "./company-profile.js";
@@ -1095,6 +1101,11 @@ export declare function applyCreditDebitAfterUse(db: Database, input: {
     idempotencyKey: string;
     metadata?: Record<string, unknown>;
     occurredAt?: Date;
+    /**
+     * What the charge paid for. When set, grants covering it pay first (oldest
+     * first) and general credit takes the rest. Omitted: general credit only.
+     */
+    usage?: CreditUsage;
 }): Promise<{
     balance: BillingBalance;
     debitedMicros: number;
@@ -1518,11 +1529,6 @@ export declare class PersonalGitHubRepositorySelectionUnavailableError extends E
     readonly code = "PERSONAL_GITHUB_REPOSITORY_SELECTION_UNAVAILABLE";
     constructor();
 }
-/** Server-owned verification facts; public schemas expose them read-only and nullable. */
-export type ConnectionMetadataWithVerification = ConnectionMetadata & {
-    verifiedInstallAt: string | null;
-    verifiedInstallVersion: number | null;
-};
 export type SlackBotPostOperation = {
     id: string;
     accountId: string;
@@ -2363,8 +2369,6 @@ export declare function revokeWorkspaceOpenRouterConnections(db: Database, input
  * reconnect remains fenced to the exact Connection version captured in state.
  */
 export declare function persistProviderOAuthConnection(db: Database, input: PersistProviderOAuthConnectionInput): Promise<ConnectionMetadataWithVerification | null>;
-export declare function listConnectionsMetadata(db: Database, workspaceId: string, subjectId?: string | null): Promise<ConnectionMetadataWithVerification[]>;
-export declare function getConnectionMetadata(db: Database, workspaceId: string, connectionId: string, subjectId?: string | null): Promise<ConnectionMetadataWithVerification | null>;
 export declare function getPersonalGitHubRepositorySelectionState(db: Database, input: {
     accountId: string;
     originWorkspaceId: string;
@@ -8409,6 +8413,9 @@ export declare function confirmDrainCold(db: Database, input: {
     idleCommandContainmentMs?: number | undefined;
 }): Promise<{
     wentCold: boolean;
+    /** The missing provider was an unpublished warming replacement: its loss
+     *  recorded no lost workspace (see `unpublishedWarmingLoss`). */
+    unpublishedProviderLost?: boolean;
     backgroundCommandEvents?: SessionEvent[];
 }>;
 export declare class SandboxWorkspaceMutationFencedError extends Error {
@@ -8452,6 +8459,41 @@ export type SandboxWorkspaceMutationAdmission = {
     workspaceGeneration: number;
 };
 export type SandboxWorkspaceMutationProviderOutcome = "resolved" | "rejected";
+/** Evidence from a committed exact admission settlement. It establishes the
+ * physical provider outcome only; mutable output authority remains rejected. */
+export type SandboxWorkspaceMutationPhysicalSettlement = Readonly<{
+    accountId: string;
+    workspaceId: string;
+    admission: Readonly<SandboxWorkspaceMutationAdmission>;
+    operation: string;
+    outcome: "resolved";
+}>;
+/** Durable terminal truth of the retained process whose concurrent settlement
+ * fenced a physically settled mutation's output. */
+export type SandboxRetainedProcessTerminalState = Readonly<{
+    state: "exited" | "lost";
+    exitCode: number | null;
+}>;
+/** The exact provider outcome committed before its output failed an acceptance
+ * fence. A generic admission fence or failed transaction carries no receipt.
+ * This error never authorizes accepting output or replaying provider work. */
+export declare class SandboxWorkspaceMutationOutputRejectedError extends SandboxWorkspaceMutationFencedError {
+    readonly name = "SandboxWorkspaceMutationOutputRejectedError";
+    readonly physicalSettlement: SandboxWorkspaceMutationPhysicalSettlement;
+    /** Non-null only when the fence was the retained process itself having
+     * already reached a durable terminal state (for example the reaper settled
+     * the exit between admission and settlement). The output stays rejected;
+     * callers may report this stored terminal truth instead of failing. */
+    readonly retainedProcessTerminal: SandboxRetainedProcessTerminalState | null;
+    constructor(code: SandboxWorkspaceMutationFencedError["code"], message: string, physicalSettlement: SandboxWorkspaceMutationPhysicalSettlement, retainedProcessTerminal?: SandboxRetainedProcessTerminalState | null);
+    matchesPhysicalSettlement(input: {
+        accountId: string;
+        workspaceId: string;
+        admission: SandboxWorkspaceMutationAdmission;
+        operation: string;
+        outcome: SandboxWorkspaceMutationProviderOutcome;
+    }): boolean;
+}
 export type SandboxRetainedProcessState = "active" | "exited" | "lost";
 export type SandboxRetainedProcess = {
     id: string;
@@ -11963,6 +12005,7 @@ export * from "./codemode-approvals.js";
 export * from "./tool-action-reviews.js";
 export * from "./browser-sessions.js";
 export * from "./browser-deadline-checkpoints.js";
+export * from "./sandbox-interaction-idle.js";
 export * from "./computer-sessions.js";
 export * from "./browser-identities.js";
 export * from "./browser-state-artifacts.js";