@opengeni/db 3.6.0 → 3.7.3-canary.0

package/dist/{chunk-UJ2EW3QI.js → chunk-O56DM5GZ.js}

@@ -52,6 +52,7 @@ __export(schema_exports, {
   companyBrainContextSelectionReceipts: () => companyBrainContextSelectionReceipts,
   companyBrainTurnContextSnapshots: () => companyBrainTurnContextSnapshots,
   companyProfileActivationEvents: () => companyProfileActivationEvents,
+  companyProfileAgentAutomaticActivationReceipts: () => companyProfileAgentAutomaticActivationReceipts,
   companyProfileAgentConfirmationReceipts: () => companyProfileAgentConfirmationReceipts,
   companyProfileAgentProposalReceipts: () => companyProfileAgentProposalReceipts,
   companyProfileHeads: () => companyProfileHeads,
@@ -166,6 +167,9 @@ __export(schema_exports, {
   nestedAgentDepthConfiguration: () => nestedAgentDepthConfiguration,
   networkRoutes: () => networkRoutes,
   newSessionDrafts: () => newSessionDrafts,
+  organizationCodexRotationSettings: () => organizationCodexRotationSettings,
+  organizationCompanyProfileAgentPolicies: () => organizationCompanyProfileAgentPolicies,
+  organizationCompanyProfileAgentPolicyEvents: () => organizationCompanyProfileAgentPolicyEvents,
   organizationInvitationBindingEvents: () => organizationInvitationBindingEvents,
   organizationMembershipInvitations: () => organizationMembershipInvitations,
   organizationMembershipLifecycleEvents: () => organizationMembershipLifecycleEvents,
@@ -230,6 +234,7 @@ __export(schema_exports, {
   sessionAttemptToolCatalogs: () => sessionAttemptToolCatalogs,
   sessionBackgroundCommands: () => sessionBackgroundCommands,
   sessionCommandReceipts: () => sessionCommandReceipts,
+  sessionEventCursors: () => sessionEventCursors,
   sessionEvents: () => sessionEvents,
   sessionGoalRevisions: () => sessionGoalRevisions,
   sessionGoals: () => sessionGoals,
@@ -309,6 +314,7 @@ __export(schema_exports, {
   workspaceArtifactVersions: () => workspaceArtifactVersions,
   workspaceArtifacts: () => workspaceArtifacts,
   workspaceCaptures: () => workspaceCaptures,
+  workspaceCodexSubscriptionPreferences: () => workspaceCodexSubscriptionPreferences,
   workspaceControlEvents: () => workspaceControlEvents,
   workspaceInferenceControls: () => workspaceInferenceControls,
   workspaceInstructionPolicyActivationEvents: () => workspaceInstructionPolicyActivationEvents,
@@ -342,7 +348,7 @@ import { WORKSPACE_XAI_PROVIDER_ACCOUNT_AUTHORITY_SNAPSHOT_V1 } from "@opengeni/
 import { sql as sql16 } from "drizzle-orm";
 import {
   bigint as bigint14,
-  boolean as boolean10,
+  boolean as boolean11,
   check as check11,
   customType as customType5,
   foreignKey,
@@ -2198,6 +2204,7 @@ var workspaceInstructionPolicySnapshots = pgTable4(
 import { sql as sql5 } from "drizzle-orm";
 import {
   bigint as bigint5,
+  boolean as boolean3,
   check as check3,
   index as index5,
   integer as integer6,
@@ -2298,6 +2305,55 @@ var companyProfileActivationEvents = pgTable5(
     type: check3("company_profile_events_type_chk", sql5`${table.type} in ('activate', 'rollback')`)
   })
 );
+var organizationCompanyProfileAgentPolicies = pgTable5(
+  "organization_company_profile_agent_policies",
+  {
+    accountId: uuid5("account_id").primaryKey(),
+    mode: text5("mode").$type().notNull().default("suggest"),
+    version: bigint5("version", { mode: "number" }).notNull().default(0),
+    updatedByMembershipId: uuid5("updated_by_membership_id"),
+    updatedAt: timestamp5("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    mode: check3(
+      "organization_company_profile_agent_policies_mode_check",
+      sql5`${table.mode} in ('off', 'suggest', 'automatic')`
+    ),
+    version: check3(
+      "organization_company_profile_agent_policies_version_check",
+      sql5`${table.version} >= 0`
+    )
+  })
+);
+var organizationCompanyProfileAgentPolicyEvents = pgTable5(
+  "organization_company_profile_agent_policy_events",
+  {
+    id: uuid5("id").primaryKey(),
+    accountId: uuid5("account_id").notNull(),
+    actorMembershipId: uuid5("actor_membership_id").notNull(),
+    requestedMode: text5("requested_mode").$type().notNull(),
+    expectedVersion: bigint5("expected_version", { mode: "number" }).notNull(),
+    resultMode: text5("result_mode").$type().notNull(),
+    resultVersion: bigint5("result_version", { mode: "number" }).notNull(),
+    resultUpdatedAt: timestamp5("result_updated_at", { withTimezone: true }).notNull(),
+    changed: boolean3("changed").notNull()
+  },
+  (table) => ({
+    accountTimeline: index5("organization_company_profile_agent_policy_events_account_idx").on(
+      table.accountId,
+      table.resultVersion
+    ),
+    modes: check3(
+      "organization_company_profile_agent_policy_events_mode_check",
+      sql5`${table.requestedMode} in ('off', 'suggest', 'automatic')
+        and ${table.resultMode} in ('off', 'suggest', 'automatic')`
+    ),
+    versions: check3(
+      "organization_company_profile_agent_policy_events_version_check",
+      sql5`${table.expectedVersion} >= 0 and ${table.resultVersion} > 0`
+    )
+  })
+);
 var companyProfileSnapshots = pgTable5(
   "company_profile_snapshots",
   {
@@ -2350,6 +2406,8 @@ var companyProfileAgentProposalReceipts = pgTable5(
     revisionId: uuid5("revision_id").notNull(),
     expectedCurrentRevisionId: uuid5("expected_current_revision_id"),
     expectedActivationVersion: bigint5("expected_activation_version", { mode: "number" }).notNull(),
+    policyMode: text5("policy_mode").$type().notNull(),
+    policyVersion: bigint5("policy_version", { mode: "number" }).notNull(),
     reason: text5("reason").notNull(),
     humanInput: jsonb5("human_input").$type().notNull(),
     createdAt: timestamp5("created_at", { withTimezone: true }).notNull().defaultNow()
@@ -2379,7 +2437,9 @@ var companyProfileAgentProposalReceipts = pgTable5(
     ),
     generation: check3(
       "company_profile_agent_proposals_generation_check",
-      sql5`${table.executionGeneration} > 0 and ${table.expectedActivationVersion} >= 0`
+      sql5`${table.executionGeneration} > 0
+        and ${table.expectedActivationVersion} >= 0
+        and ${table.policyVersion} >= 0`
     ),
     subject: check3(
       "company_profile_agent_proposals_subject_check",
@@ -2390,6 +2450,10 @@ var companyProfileAgentProposalReceipts = pgTable5(
       sql5`char_length(btrim(${table.reason})) between 1 and 4096
         and octet_length(convert_to(btrim(${table.reason}), 'UTF8')) <= 16384`
     ),
+    policyMode: check3(
+      "company_profile_agent_proposals_policy_mode_check",
+      sql5`${table.policyMode} in ('suggest', 'automatic')`
+    ),
     humanInputShape: check3(
       "company_profile_agent_proposals_human_input_check",
       sql5`jsonb_typeof(${table.humanInput}) = 'object'
@@ -2446,6 +2510,58 @@ var companyProfileAgentConfirmationReceipts = pgTable5(
     )
   })
 );
+var companyProfileAgentAutomaticActivationReceipts = pgTable5(
+  "company_profile_agent_automatic_activation_receipts",
+  {
+    id: uuid5("id").primaryKey().defaultRandom(),
+    operationId: uuid5("operation_id").notNull(),
+    inputHash: text5("input_hash").notNull(),
+    accountId: uuid5("account_id").notNull(),
+    workspaceId: uuid5("workspace_id").notNull(),
+    sessionId: uuid5("session_id").notNull(),
+    turnId: uuid5("turn_id").notNull(),
+    activationAttemptId: uuid5("activation_attempt_id").notNull(),
+    executionGeneration: integer6("execution_generation").notNull(),
+    proposalReceiptId: uuid5("proposal_receipt_id").notNull(),
+    proposalRevisionId: uuid5("proposal_revision_id").notNull(),
+    initiatingHumanSubjectId: text5("initiating_human_subject_id").notNull(),
+    initiatingMembershipId: uuid5("initiating_membership_id").notNull(),
+    policyVersion: bigint5("policy_version", { mode: "number" }).notNull(),
+    activationEventId: uuid5("activation_event_id").notNull(),
+    createdAt: timestamp5("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    accountOperation: uniqueIndex5(
+      "company_profile_agent_automatic_activations_account_operation_uq"
+    ).on(table.accountId, table.operationId),
+    proposal: uniqueIndex5("company_profile_agent_automatic_activations_proposal_uq").on(
+      table.accountId,
+      table.proposalReceiptId
+    ),
+    activationEvent: uniqueIndex5("company_profile_agent_automatic_activations_event_uq").on(
+      table.accountId,
+      table.activationEventId
+    ),
+    turn: index5("company_profile_agent_automatic_activations_turn_idx").on(
+      table.workspaceId,
+      table.sessionId,
+      table.turnId,
+      table.executionGeneration
+    ),
+    hash: check3(
+      "company_profile_agent_automatic_activations_input_hash_check",
+      sql5`${table.inputHash} ~ '^[0-9a-f]{64}$'`
+    ),
+    generation: check3(
+      "company_profile_agent_automatic_activations_generation_check",
+      sql5`${table.executionGeneration} > 0 and ${table.policyVersion} >= 0`
+    ),
+    subject: check3(
+      "company_profile_agent_automatic_activations_subject_check",
+      sql5`octet_length(btrim(${table.initiatingHumanSubjectId})) between 1 and 1024`
+    )
+  })
+);
 
 // src/workspace-learning-policy-schema.ts
 import { sql as sql6 } from "drizzle-orm";
@@ -2713,7 +2829,7 @@ var slackSharedTaskOrigins = pgTable7(
 import { sql as sql8 } from "drizzle-orm";
 import {
   bigint as bigint8,
-  boolean as boolean3,
+  boolean as boolean4,
   check as check6,
   index as index8,
   integer as integer8,
@@ -2845,7 +2961,7 @@ var preferenceRegistrySnapshots = pgTable8(
     initiatingHumanSubjectId: text8("initiating_human_subject_id").notNull(),
     descriptors: jsonb8("descriptors").$type().notNull(),
     descriptorHash: text8("descriptor_hash").notNull(),
-    truncated: boolean3("truncated").notNull().default(false),
+    truncated: boolean4("truncated").notNull().default(false),
     createdAt: timestamp8("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => ({
@@ -3023,7 +3139,7 @@ var knowledgeMemoryLifecycleEvents = pgTable9(
 import { sql as sql10 } from "drizzle-orm";
 import {
   bigint as bigint9,
-  boolean as boolean4,
+  boolean as boolean5,
   index as index10,
   integer as integer10,
   jsonb as jsonb10,
@@ -3161,7 +3277,7 @@ var knowledgeSourceAclVersions = pgTable10(
     generation: bigint9("generation", { mode: "number" }).notNull(),
     aclVersion: text10("acl_version"),
     aclHash: text10("acl_hash").notNull(),
-    agentAccess: boolean4("agent_access").notNull().default(true),
+    agentAccess: boolean5("agent_access").notNull().default(true),
     operationId: text10("operation_id").notNull(),
     inputHash: text10("input_hash").notNull(),
     ...actorColumns(),
@@ -3935,7 +4051,7 @@ var sessionWorkClaimWriteCapabilities = pgTable12(
 
 // src/company-brain-context-selection-schema.ts
 import {
-  boolean as boolean5,
+  boolean as boolean6,
   index as index13,
   integer as integer13,
   jsonb as jsonb11,
@@ -3958,9 +4074,9 @@ var companyBrainContextSelectionReceipts = pgTable13(
     createdByExecutionGeneration: integer13("created_by_execution_generation").notNull(),
     acceptedAt: timestamp13("accepted_at", { withTimezone: true }).notNull(),
     sessionRole: text13("session_role").notNull(),
-    memoryEnabled: boolean5("memory_enabled").notNull(),
+    memoryEnabled: boolean6("memory_enabled").notNull(),
     memoryPromptMode: text13("memory_prompt_mode").notNull(),
-    companyProfileIncluded: boolean5("company_profile_included").notNull(),
+    companyProfileIncluded: boolean6("company_profile_included").notNull(),
     instructionPolicyEntryHash: text13("instruction_policy_entry_hash").notNull(),
     preferenceDescriptorHash: text13("preference_descriptor_hash"),
     companyProfileSnapshotHash: text13("company_profile_snapshot_hash").notNull(),
@@ -3994,13 +4110,13 @@ var companyBrainTurnContextSnapshots = pgTable13(
     rootSessionId: uuid13("root_session_id").notNull(),
     turnId: uuid13("turn_id").notNull(),
     acceptedAt: timestamp13("accepted_at", { withTimezone: true }).notNull(),
-    memoryEnabled: boolean5("memory_enabled").notNull(),
+    memoryEnabled: boolean6("memory_enabled").notNull(),
     memoryPromptMode: text13("memory_prompt_mode").notNull(),
     legacyWorkspaceInstructions: text13("legacy_workspace_instructions"),
     legacyWorkspaceInstructionsOriginalUtf8Bytes: integer13(
       "legacy_workspace_instructions_original_utf8_bytes"
     ),
-    legacyWorkspaceInstructionsTruncated: boolean5(
+    legacyWorkspaceInstructionsTruncated: boolean6(
       "legacy_workspace_instructions_truncated"
     ).notNull(),
     snapshotSource: text13("snapshot_source").notNull(),
@@ -4022,7 +4138,7 @@ var companyBrainTurnContextSnapshots = pgTable13(
 // src/governed-learning-evaluator-schema.ts
 import {
   bigint as bigint10,
-  boolean as boolean6,
+  boolean as boolean7,
   index as index14,
   integer as integer14,
   pgTable as pgTable14,
@@ -4066,7 +4182,7 @@ var governedLearningDecisionReceipts = pgTable14(
     conflictCount: integer14("conflict_count").notNull(),
     outcome: text14("outcome").notNull(),
     reasonCodes: text14("reason_codes").array().$type().notNull(),
-    automaticEligible: boolean6("automatic_eligible").notNull(),
+    automaticEligible: boolean7("automatic_eligible").notNull(),
     confidenceFloorBps: integer14("confidence_floor_bps").notNull(),
     createdAt: timestamp14("created_at", { withTimezone: true }).notNull().defaultNow()
   },
@@ -4210,7 +4326,7 @@ var governedLearningActivationUndoReceipts = pgTable15(
 // src/knowledge-source-sync-schema.ts
 import {
   bigint as bigint12,
-  boolean as boolean7,
+  boolean as boolean8,
   index as index16,
   integer as integer15,
   jsonb as jsonb12,
@@ -4250,9 +4366,9 @@ var knowledgeSourceSyncStates = pgTable16(
     pendingWakeCount: integer15("pending_wake_count").notNull().default(0),
     leaseId: uuid16("lease_id"),
     leaseUntil: timestamp16("lease_until", { withTimezone: true }),
-    bufferedWake: boolean7("buffered_wake").notNull().default(false),
+    bufferedWake: boolean8("buffered_wake").notNull().default(false),
     bufferedScheduledTaskRunId: uuid16("buffered_scheduled_task_run_id"),
-    reconnectRequired: boolean7("reconnect_required").notNull().default(false),
+    reconnectRequired: boolean8("reconnect_required").notNull().default(false),
     lastSuccessAt: timestamp16("last_success_at", { withTimezone: true }),
     lastCompletedAt: timestamp16("last_completed_at", { withTimezone: true }),
     lastSummary: jsonb12("last_summary").$type(),
@@ -4343,7 +4459,7 @@ var knowledgeSourceSyncWakes = pgTable16(
     producerKey: text16("producer_key").notNull(),
     sourceConfigGeneration: bigint12("source_config_generation", { mode: "number" }).notNull(),
     sourceLifecycleGeneration: bigint12("source_lifecycle_generation", { mode: "number" }).notNull(),
-    coalesced: boolean7("coalesced").notNull().default(false),
+    coalesced: boolean8("coalesced").notNull().default(false),
     claimedAt: timestamp16("claimed_at", { withTimezone: true }),
     completedAt: timestamp16("completed_at", { withTimezone: true }),
     createdAt: timestamp16("created_at", { withTimezone: true }).notNull().defaultNow()
@@ -4458,8 +4574,8 @@ var googleDriveObjectAclPrincipals = pgTable16(
     emailHash: text16("email_hash"),
     domainHash: text16("domain_hash"),
     role: text16("role").notNull(),
-    inherited: boolean7("inherited").notNull().default(false),
-    allowFileDiscovery: boolean7("allow_file_discovery"),
+    inherited: boolean8("inherited").notNull().default(false),
+    allowFileDiscovery: boolean8("allow_file_discovery"),
     expirationTime: timestamp16("expiration_time", { withTimezone: true }),
     createdAt: timestamp16("created_at", { withTimezone: true }).notNull().defaultNow()
   },
@@ -4478,7 +4594,7 @@ var googleDriveObjectAclPrincipals = pgTable16(
 // src/transcription-recordings-schema.ts
 import { sql as sql14 } from "drizzle-orm";
 import {
-  boolean as boolean8,
+  boolean as boolean9,
   check as check9,
   index as index17,
   integer as integer16,
@@ -4527,7 +4643,7 @@ var transcriptionRecordings = pgTable17(
     transcriptTextCodecVersion: losslessCodecVersion("transcript_text_codec_version"),
     languages: jsonb13("languages").$type().notNull().default([]),
     errorCode: text17("error_code"),
-    retryable: boolean8("retryable").notNull().default(false),
+    retryable: boolean9("retryable").notNull().default(false),
     providerId: text17("provider_id"),
     processingGeneration: integer16("processing_generation").notNull().default(0),
     processingOwner: uuid17("processing_owner"),
@@ -4676,7 +4792,7 @@ var transcriptionRecordingSegments = pgTable17(
     languages: jsonb13("languages").$type().notNull().default([]),
     providerId: text17("provider_id"),
     errorCode: text17("error_code"),
-    retryable: boolean8("retryable").notNull().default(false),
+    retryable: boolean9("retryable").notNull().default(false),
     createdAt: timestamp17("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp17("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
@@ -4716,7 +4832,7 @@ var transcriptionRecordingSegments = pgTable17(
 import { sql as sql15 } from "drizzle-orm";
 import {
   bigint as bigint13,
-  boolean as boolean9,
+  boolean as boolean10,
   check as check10,
   index as index18,
   integer as integer17,
@@ -4831,8 +4947,8 @@ var browserRevisions = pgTable18(
     expectedHeadGeneration: bigint13("expected_head_generation", {
       mode: "number"
     }).notNull(),
-    advanceDefaultRequested: boolean9("advance_default_requested").notNull(),
-    defaultAdvanced: boolean9("default_advanced").notNull(),
+    advanceDefaultRequested: boolean10("advance_default_requested").notNull(),
+    defaultAdvanced: boolean10("default_advanced").notNull(),
     resultHeadGeneration: bigint13("result_head_generation", {
       mode: "number"
     }).notNull(),
@@ -5247,7 +5363,7 @@ var browserSessions = pgTable18(
       enum: ["chromium", "chrome", "firefox", "webkit", "lightpanda", "external"]
     }).notNull(),
     engineVersion: text18("engine_version"),
-    headless: boolean9("headless").notNull(),
+    headless: boolean10("headless").notNull(),
     identityId: uuid18("identity_id"),
     baseRevisionId: uuid18("base_revision_id"),
     linkedComputerSessionId: uuid18("linked_computer_session_id"),
@@ -6161,7 +6277,7 @@ var interactionOperations = pgTable18(
     controllerGeneration: text18("controller_generation"),
     errorCode: text18("error_code"),
     errorMessage: text18("error_message"),
-    errorRetryable: boolean9("error_retryable"),
+    errorRetryable: boolean10("error_retryable"),
     errorDetails: jsonb14("error_details").$type(),
     actorSubjectId: text18("actor_subject_id").notNull(),
     createdAt: timestamp18("created_at", { withTimezone: true }).notNull().defaultNow(),
@@ -6460,7 +6576,7 @@ var workspaceArtifactEvents = pgTable19(
 var nestedAgentDepthConfiguration = pgTable19(
   "nested_agent_depth_configuration",
   {
-    singleton: boolean10("singleton").primaryKey().notNull().default(true),
+    singleton: boolean11("singleton").primaryKey().notNull().default(true),
     maxNestedAgentDepth: integer18("max_nested_agent_depth").notNull(),
     policySource: text19("policy_source").$type().notNull(),
     updatedAt: timestamp19("updated_at", { withTimezone: true }).notNull().defaultNow()
@@ -6677,7 +6793,7 @@ var organizationPrivateSessionSettings = pgTable19(
   "organization_private_session_settings",
   {
     accountId: uuid19("account_id").primaryKey().references(() => managedAccounts.id, { onDelete: "cascade" }),
-    enabled: boolean10("enabled").notNull().default(false),
+    enabled: boolean11("enabled").notNull().default(false),
     version: bigint14("version", { mode: "number" }).notNull().default(1),
     updatedByMembershipId: uuid19("updated_by_membership_id"),
     updatedAt: timestamp19("updated_at", { withTimezone: true }).notNull().defaultNow()
@@ -6700,12 +6816,12 @@ var organizationPrivateSessionSettingEvents = pgTable19(
     id: uuid19("id").primaryKey(),
     accountId: uuid19("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
     actorMembershipId: uuid19("actor_membership_id").notNull(),
-    requestedEnabled: boolean10("requested_enabled").notNull(),
+    requestedEnabled: boolean11("requested_enabled").notNull(),
     expectedVersion: bigint14("expected_version", { mode: "number" }).notNull(),
-    resultEnabled: boolean10("result_enabled").notNull(),
+    resultEnabled: boolean11("result_enabled").notNull(),
     resultVersion: bigint14("result_version", { mode: "number" }).notNull(),
     resultUpdatedAt: timestamp19("result_updated_at", { withTimezone: true }).notNull(),
-    changed: boolean10("changed").notNull(),
+    changed: boolean11("changed").notNull(),
     createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => ({
@@ -7159,6 +7275,7 @@ var apiKeys = pgTable19(
     }),
     name: text19("name").notNull(),
     description: text19("description"),
+    credentialKind: text19("credential_kind").$type().notNull(),
     prefix: text19("prefix").notNull(),
     keyHash: text19("key_hash").notNull(),
     permissions: jsonb15("permissions").$type().notNull().default([]),
@@ -7176,6 +7293,20 @@ var apiKeys = pgTable19(
     descriptionValid: check11(
       "api_keys_description_check",
       sql16`${table.description} is null or length(${table.description}) between 1 and 500`
+    ),
+    credentialKindValid: check11(
+      "api_keys_credential_kind_check",
+      sql16`(
+        ${table.workspaceId} is not null
+        and ${table.credentialKind} = 'workspace'
+      ) or (
+        ${table.workspaceId} is null
+        and ${table.credentialKind} = 'organization'
+      ) or (
+        ${table.workspaceId} is null
+        and ${table.credentialKind} = 'legacy_account'
+        and ${table.revokedAt} is not null
+      )`
     )
   })
 );
@@ -7279,7 +7410,18 @@ var codexSubscriptionCredentials = pgTable19(
   {
     id: uuid19("id").primaryKey().defaultRandom(),
     accountId: uuid19("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
-    workspaceId: uuid19("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    workspaceId: uuid19("workspace_id").references(() => workspaces.id, { onDelete: "cascade" }),
+    organizationId: uuid19("organization_id").references(() => managedAccounts.id, {
+      onDelete: "cascade"
+    }),
+    authorityScope: text19("authority_scope").notNull().default("workspace"),
+    ownerOrganizationMembershipId: uuid19("owner_organization_membership_id"),
+    organizationUserResourceAuthorityId: uuid19("organization_user_resource_authority_id"),
+    organizationUserResourceKind: text19("organization_user_resource_kind"),
+    organizationUserResourceAuthorityGeneration: bigint14(
+      "organization_user_resource_authority_generation",
+      { mode: "number" }
+    ),
     // Format: v1:<base64 iv>:<base64 ciphertext||gcm-tag>. JSON {access_token, refresh_token, id_token}. Never returned by any API.
     credentialEncrypted: text19("credential_encrypted").notNull(),
     chatgptAccountId: text19("chatgpt_account_id"),
@@ -7287,7 +7429,7 @@ var codexSubscriptionCredentials = pgTable19(
     scopes: text19("scopes"),
     // space-delimited, as granted
     planType: text19("plan_type"),
-    isFedramp: boolean10("is_fedramp").notNull().default(false),
+    isFedramp: boolean11("is_fedramp").notNull().default(false),
     expiresAt: timestamp19("expires_at", { withTimezone: true }),
     // derived from access-token JWT exp
     lastRefreshAt: timestamp19("last_refresh_at", { withTimezone: true }),
@@ -7308,17 +7450,21 @@ var codexSubscriptionCredentials = pgTable19(
     secondaryResetAt: timestamp19("secondary_reset_at", { withTimezone: true }),
     usageCheckedAt: timestamp19("usage_checked_at", { withTimezone: true }),
     // snapshot freshness → cache TTL clock
-    // P3 rotation cooldown (plaintext metadata; NEVER a token). Set when this account hit its
-    // usage cap on a rotation turn; the rotation engine treats `exhausted_until > now()` as
-    // capped/skip so it isn't immediately re-picked. Self-clears via the now() comparison.
+    // P3 rotation cooldown (plaintext metadata; NEVER a token). The kind keeps
+    // quota refusals distinct from generic provider backpressure. The independent
+    // revision fences a live usage response against a concurrently newer refusal;
+    // neither field participates in token-refresh OCC.
     exhaustedUntil: timestamp19("exhausted_until", { withTimezone: true }),
+    exhaustedKind: text19("exhausted_kind"),
+    // quota | rate_limit | null (legacy/cleared)
+    exhaustedRevision: bigint14("exhausted_revision", { mode: "number" }).notNull().default(0),
     // Workspace-local, server-held fairness cursor. Provider usage headers are
     // capacity hints, never the sole allocator: live lease count is ranked first
     // and this cursor deterministically breaks equal-load/equal-capacity ties.
     // This flag controls NEW automatic allocations only. Credential health,
     // refresh, encrypted material, and an already-leased in-flight turn are
     // intentionally independent. account eligibility policy owns toggle OCC/audit and product UI.
-    allocatorEnabled: boolean10("allocator_enabled").notNull().default(true),
+    allocatorEnabled: boolean11("allocator_enabled").notNull().default(true),
     // Independent OCC/audit sequence for the allocator toggle. Token refresh
     // continues to own `version`; quota/cache writes own neither counter.
     allocatorVersion: integer18("allocator_version").notNull().default(1),
@@ -7356,7 +7502,58 @@ var codexSubscriptionCredentials = pgTable19(
     ),
     workspaceAccountIdentity: uniqueIndex19(
       "codex_subscription_credentials_workspace_account_id_idx"
-    ).on(table.workspaceId, table.accountId, table.id)
+    ).on(table.workspaceId, table.accountId, table.id),
+    accountIdentity: uniqueIndex19("codex_subscription_credentials_account_id_idx").on(
+      table.accountId,
+      table.id
+    ),
+    organizationAccount: uniqueIndex19("codex_subscription_credentials_organization_account_idx").on(table.organizationId, table.chatgptAccountId).where(
+      sql16`${table.authorityScope} = 'organization' and ${table.chatgptAccountId} is not null`
+    ),
+    organizationLookup: index19("codex_subscription_credentials_organization_lookup_idx").on(table.organizationId, table.createdAt, table.id).where(sql16`${table.authorityScope} = 'organization'`)
+  })
+);
+var workspaceCodexSubscriptionPreferences = pgTable19(
+  "workspace_codex_subscription_preferences",
+  {
+    workspaceId: uuid19("workspace_id").primaryKey().references(() => workspaces.id, { onDelete: "cascade" }),
+    accountId: uuid19("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
+    mode: text19("mode").notNull().default("automatic"),
+    updatedBySubjectId: text19("updated_by_subject_id"),
+    createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp19("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    workspaceAccount: foreignKey({
+      name: "workspace_codex_subscription_preferences_workspace_account_fk",
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId]
+    }).onDelete("cascade"),
+    modeValid: check11(
+      "workspace_codex_subscription_preferences_mode_chk",
+      sql16`${table.mode} in ('automatic', 'workspace', 'organization', 'disabled')`
+    )
+  })
+);
+var organizationCodexRotationSettings = pgTable19(
+  "organization_codex_rotation_settings",
+  {
+    id: uuid19("id").primaryKey().defaultRandom(),
+    accountId: uuid19("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
+    activeCredentialId: uuid19("active_credential_id"),
+    rotationEnabled: boolean11("rotation_enabled").notNull().default(false),
+    leaseRotationEnabled: boolean11("lease_rotation_enabled").notNull().default(false),
+    rotationStrategy: text19("rotation_strategy").notNull().default("sharded"),
+    createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp19("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    account: uniqueIndex19("organization_codex_rotation_settings_account_idx").on(table.accountId),
+    activeCredential: foreignKey({
+      name: "organization_codex_rotation_settings_active_fk",
+      columns: [table.activeCredentialId],
+      foreignColumns: [codexSubscriptionCredentials.id]
+    }).onDelete("set null")
   })
 );
 var codexAppsSettings = pgTable19(
@@ -7619,9 +7816,9 @@ var personalGitHubRepositorySelections = pgTable19(
     canonicalHttpsUri: text19("canonical_https_uri").notNull(),
     defaultBranch: text19("default_branch").notNull(),
     visibility: text19("visibility").notNull(),
-    private: boolean10("private").notNull(),
-    archived: boolean10("archived").notNull(),
-    disabled: boolean10("disabled").notNull(),
+    private: boolean11("private").notNull(),
+    archived: boolean11("archived").notNull(),
+    disabled: boolean11("disabled").notNull(),
     permissions: jsonb15("permissions").$type().notNull(),
     selectedAccess: text19("selected_access").notNull(),
     selectionGeneration: bigint14("selection_generation", {
@@ -7915,7 +8112,7 @@ var slackRoutePrompts = pgTable19(
     providerEventId: text19("provider_event_id").notNull(),
     triggerKind: text19("trigger_kind").$type().notNull(),
     requestText: text19("request_text").notNull(),
-    hasFiles: boolean10("has_files").notNull().default(false),
+    hasFiles: boolean11("has_files").notNull().default(false),
     slackThreadTs: text19("slack_thread_ts"),
     messageOperationId: uuid19("message_operation_id").notNull(),
     status: text19("status").$type().notNull().default("pending"),
@@ -8312,7 +8509,7 @@ var slackInteractionInbox = pgTable19(
     slackThreadTs: text19("slack_thread_ts"),
     triggerKind: text19("trigger_kind").$type().notNull(),
     text: text19("text").notNull(),
-    hasFiles: boolean10("has_files").notNull().default(false),
+    hasFiles: boolean11("has_files").notNull().default(false),
     status: text19("status").$type().notNull().default("pending"),
     claimHolderId: uuid19("claim_holder_id"),
     claimExpiresAt: timestamp19("claim_expires_at", { withTimezone: true }),
@@ -8441,7 +8638,7 @@ var slackInteractions = pgTable19(
     ackSlackMessageTs: text19("ack_slack_message_ts"),
     // Frozen once: whether this interaction's acknowledgement renders the
     // one-time onboarding hint. NULL means the decision has not been resolved.
-    firstTaskHint: boolean10("first_task_hint"),
+    firstTaskHint: boolean11("first_task_hint"),
     // The routed workspace's display name, frozen when the interaction binds.
     // A live lookup at post time would be wrong: a workspace rename between the
     // original post and a reconciliation makes `reconcilePostMessage`'s
@@ -8679,7 +8876,7 @@ var memorySlackPublicationConfigurations = pgTable19(
     accountId: uuid19("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
     workspaceId: uuid19("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
     revision: integer18("revision").notNull(),
-    enabled: boolean10("enabled").notNull(),
+    enabled: boolean11("enabled").notNull(),
     connectionId: uuid19("connection_id"),
     slackTeamId: text19("slack_team_id"),
     slackChannelId: text19("slack_channel_id"),
@@ -9033,11 +9230,11 @@ var codexRotationSettings = pgTable19(
     // Legacy selector bit. Keep false as the DB default forever: an old worker
     // only understands this column, so a schema-first rollout or binary
     // rollback must never make it enter the non-atomic rotation path.
-    rotationEnabled: boolean10("rotation_enabled").notNull().default(false),
+    rotationEnabled: boolean11("rotation_enabled").notNull().default(false),
     // Revision-aware allocator cutover. Only migration-compatible API/worker
     // code reads this bit; old binaries safely ignore it and keep the legacy
     // pin/rotation policy.
-    leaseRotationEnabled: boolean10("lease_rotation_enabled").notNull().default(false),
+    leaseRotationEnabled: boolean11("lease_rotation_enabled").notNull().default(false),
     rotationStrategy: text19("rotation_strategy").notNull().default("sharded"),
     // sharded-rotation policy: legacy residue; behavior is always sharded
     createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow(),
@@ -9108,7 +9305,7 @@ var xaiSubscriptionCredentials = pgTable19(
     lastRefreshAt: timestamp19("last_refresh_at", { withTimezone: true }),
     lastError: text19("last_error"),
     version: integer18("version").notNull().default(1),
-    allocatorEnabled: boolean10("allocator_enabled").notNull().default(true),
+    allocatorEnabled: boolean11("allocator_enabled").notNull().default(true),
     allocatorVersion: integer18("allocator_version").notNull().default(1),
     allocatorUpdatedAt: timestamp19("allocator_updated_at", {
       withTimezone: true
@@ -9195,7 +9392,7 @@ var xaiRotationSettings = pgTable19(
     authorityScope: text19("authority_scope").notNull().default("workspace"),
     ownerOrganizationMembershipId: uuid19("owner_organization_membership_id"),
     activeCredentialId: uuid19("active_credential_id"),
-    rotationEnabled: boolean10("rotation_enabled").notNull().default(true),
+    rotationEnabled: boolean11("rotation_enabled").notNull().default(true),
     fairnessCursor: bigint14("fairness_cursor", { mode: "number" }).notNull().default(0),
     version: integer18("version").notNull().default(1),
     createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow(),
@@ -9261,7 +9458,7 @@ var channels = pgTable19(
     workspaceId: uuid19("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
     name: text19("name").notNull(),
     description: text19("description"),
-    pinned: boolean10("pinned").notNull().default(false),
+    pinned: boolean11("pinned").notNull().default(false),
     // Explicit user order within the pinned and unpinned project groups.
     sortOrder: integer18("sort_order").notNull().default(0),
     // Attribution string: 'user:<subject>' | 'session:<id>' | 'system'.
@@ -9448,7 +9645,7 @@ var sessions = pgTable19(
     // it true; the worker honors it BEFORE the next turn's model call by forcing
     // a compaction, then clears it. A durable flag (not a transient signal) so
     // the trigger survives a worker restart and converges before the next turn.
-    compactRequested: boolean10("compact_requested").notNull().default(false),
+    compactRequested: boolean11("compact_requested").notNull().default(false),
     queueVersion: integer18("queue_version").notNull().default(0),
     queueHeadPosition: bigint14("queue_head_position", { mode: "number" }).notNull().default(0),
     queueTailPosition: bigint14("queue_tail_position", { mode: "number" }).notNull().default(0),
@@ -10120,16 +10317,16 @@ var sessionPins = pgTable19(
     // deleting it. That preserves a monotonic version and prevents an ABA race:
     // a stale client that saw pin version 1 cannot silently overwrite a later
     // unpin+re-pin that would otherwise recreate version 1.
-    pinned: boolean10("pinned").notNull().default(true),
+    pinned: boolean11("pinned").notNull().default(true),
     pinnedAt: timestamp19("pinned_at", { withTimezone: true }).defaultNow(),
     version: integer18("version").notNull().default(1),
     // A session is unread for this subject whenever its durable event sequence
     // has advanced beyond this explicit acknowledgment fence. Merely opening a
     // route never changes the fence.
     acknowledgedSequence: integer18("acknowledged_sequence").notNull().default(0),
-    activelyWorking: boolean10("actively_working").notNull().default(false),
+    activelyWorking: boolean11("actively_working").notNull().default(false),
     attentionVersion: integer18("attention_version").notNull().default(0),
-    archived: boolean10("archived").notNull().default(false),
+    archived: boolean11("archived").notNull().default(false),
     archivedAt: timestamp19("archived_at", { withTimezone: true }),
     archiveVersion: integer18("archive_version").notNull().default(0)
   },
@@ -10246,7 +10443,7 @@ var sessionMcpServers = pgTable19(
     url: text19("url").notNull(),
     allowedTools: jsonb15("allowed_tools").$type(),
     timeoutMs: integer18("timeout_ms"),
-    cacheToolsList: boolean10("cache_tools_list").notNull().default(false),
+    cacheToolsList: boolean11("cache_tools_list").notNull().default(false),
     // Human-approval policy: `true` = every tool requires approval, a string[] of
     // UNPREFIXED tool names = only those require it, null/absent = auto-run.
     requireApproval: jsonb15("require_approval").$type(),
@@ -10757,7 +10954,7 @@ var generatedVideoArtifacts = pgTable19(
     fpsMilli: integer18("fps_milli").notNull(),
     videoCodec: text19("video_codec").notNull(),
     audioCodec: text19("audio_codec"),
-    hasAudio: boolean10("has_audio").notNull(),
+    hasAudio: boolean11("has_audio").notNull(),
     sandboxFilename: text19("sandbox_filename").notNull(),
     deletedAt: timestamp19("deleted_at", { withTimezone: true }),
     readyAt: timestamp19("ready_at", { withTimezone: true }).notNull().defaultNow(),
@@ -10983,7 +11180,7 @@ var documents = pgTable19(
     // document from agent retrieval surfaces (docs MCP) while humans keep REST.
     visibility: text19("visibility").notNull().default("workspace"),
     createdBy: text19("created_by"),
-    agentAccess: boolean10("agent_access").notNull().default(true),
+    agentAccess: boolean11("agent_access").notNull().default(true),
     // Auto-curation output (knowledge drops).
     summary: text19("summary"),
     topics: jsonb15("topics").$type().notNull().default([]),
@@ -11160,7 +11357,7 @@ var knowledgeMemories = pgTable19(
     // (embedder unavailable) persist keyword-searchable rows without a vector.
     embedding: vector("embedding"),
     embeddingModel: text19("embedding_model"),
-    pinned: boolean10("pinned").notNull().default(false),
+    pinned: boolean11("pinned").notNull().default(false),
     usageCount: integer18("usage_count").notNull().default(0),
     lastUsedAt: timestamp19("last_used_at", { withTimezone: true }),
     // Self-referential supersession chain. FKs live in migration 0045 (ON DELETE SET
@@ -11261,7 +11458,7 @@ var sessionTurns = pgTable19(
     tools: jsonb15("tools").$type().notNull().default([]),
     // false = inherit the durable session policy; true = this turn explicitly
     // replaces it with `tools` after the core subset fence.
-    toolsProvided: boolean10("tools_provided").notNull().default(false),
+    toolsProvided: boolean11("tools_provided").notNull().default(false),
     model: text19("model").notNull(),
     reasoningEffort: text19("reasoning_effort").notNull(),
     // Peer of model + reasoning_effort for Fast/priority inheritance.
@@ -11362,7 +11559,7 @@ var turnPersonalResourceAttachmentReceipts = pgTable19(
     sessionAuthorityEpoch: integer18("session_authority_epoch").notNull(),
     grantMode: text19("grant_mode").notNull(),
     sharedOutputWarningVersion: integer18("shared_output_warning_version").notNull(),
-    sharedOutputAcknowledged: boolean10("shared_output_acknowledged").notNull(),
+    sharedOutputAcknowledged: boolean11("shared_output_acknowledged").notNull(),
     requestDigest: bytea2("request_digest").notNull(),
     resourceCount: integer18("resource_count").notNull(),
     createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow()
@@ -12257,7 +12454,7 @@ var workspaceControlEvents = pgTable19(
     scope: text19("scope").notNull(),
     rootSessionId: uuid19("root_session_id"),
     action: text19("action").notNull(),
-    automatic: boolean10("automatic").notNull().default(false),
+    automatic: boolean11("automatic").notNull().default(false),
     reason: text19("reason"),
     reasonOriginalBytes: integer18("reason_original_bytes"),
     actor: text19("actor").notNull(),
@@ -12359,7 +12556,7 @@ var composerDrafts = pgTable19(
     annotations: jsonb15("annotations").$type().notNull().default([]),
     resources: jsonb15("resources").$type().notNull().default([]),
     tools: jsonb15("tools").$type().notNull().default([]),
-    toolsProvided: boolean10("tools_provided").notNull().default(false),
+    toolsProvided: boolean11("tools_provided").notNull().default(false),
     model: text19("model").notNull(),
     reasoningEffort: text19("reasoning_effort").notNull(),
     latencyMode: text19("latency_mode").notNull().default("standard"),
@@ -12929,6 +13126,36 @@ var xaiCapacityWaiters = pgTable19(
     )
   })
 );
+var sessionEventCursors = pgTable19(
+  "session_event_cursors",
+  {
+    sessionId: uuid19("session_id").primaryKey().references(() => sessions.id, { onDelete: "cascade" }),
+    accountId: uuid19("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid19("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    lastSequence: integer18("last_sequence").notNull().default(0),
+    revision: bigint14("revision", { mode: "number" }).notNull().default(0),
+    createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp19("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    workspaceAccount: foreignKey({
+      name: "session_event_cursors_workspace_account_fk",
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId]
+    }).onDelete("cascade"),
+    workspaceSession: foreignKey({
+      name: "session_event_cursors_workspace_session_fk",
+      columns: [table.workspaceId, table.sessionId],
+      foreignColumns: [sessions.workspaceId, sessions.id]
+    }).onDelete("cascade"),
+    workspaceIdentity: uniqueIndex19("session_event_cursors_workspace_session_idx").on(
+      table.workspaceId,
+      table.sessionId
+    ),
+    sequenceValid: check11("session_event_cursors_sequence_check", sql16`${table.lastSequence} >= 0`),
+    revisionValid: check11("session_event_cursors_revision_check", sql16`${table.revision} >= 0`)
+  })
+);
 var sessionEvents = pgTable19(
   "session_events",
   {
@@ -13074,7 +13301,7 @@ var sessionHumanInputRequests = pgTable19(
     toolCallId: text19("tool_call_id").notNull(),
     status: text19("status").notNull().default("pending"),
     questions: jsonb15("questions").$type().notNull(),
-    allowSkip: boolean10("allow_skip").notNull().default(false),
+    allowSkip: boolean11("allow_skip").notNull().default(false),
     response: jsonb15("response").$type(),
     respondedBy: text19("responded_by"),
     respondedAt: timestamp19("responded_at", { withTimezone: true }),
@@ -13158,7 +13385,7 @@ var sessionHistoryItems = pgTable19(
     // false — never deletes, so the full transcript stays as an audit trail) and
     // inserts ONE synthetic active summary row at the boundary. Defaults true so
     // every existing and normally-appended row is live.
-    active: boolean10("active").notNull().default(true),
+    active: boolean11("active").notNull().default(true),
     // An exact provider 400 can prove that the request's active opaque artifact
     // set is no longer usable. Keep each canonical item immutable, but record the
     // attempt-fenced rejection on the exact candidate row IDs so later model
@@ -13432,12 +13659,12 @@ var sandboxLeases = pgTable19(
     // archiveCaptureProviderRequestId resumes the same physical capture. This is
     // deliberately explicit rather than inferred from backend/id equality so a
     // rolling old worker can never be mistaken for an idempotent caller.
-    archiveCaptureProviderReplaySafe: boolean10("archive_capture_provider_replay_safe").notNull().default(false),
+    archiveCaptureProviderReplaySafe: boolean11("archive_capture_provider_replay_safe").notNull().default(false),
     // Provider-neutral takeover proof. True means the registered adapter has
     // proven either same-request idempotency or an independently repeatable,
     // read-only capture. It is distinct from providerReplaySafe so portable tar
     // can recover immediately without pretending it resumes one provider RPC.
-    archiveCaptureTakeoverSafe: boolean10("archive_capture_takeover_safe").notNull().default(false),
+    archiveCaptureTakeoverSafe: boolean11("archive_capture_takeover_safe").notNull().default(false),
     archiveCaptureAttempt: integer18("archive_capture_attempt"),
     archiveCaptureGeneration: integer18("archive_capture_generation"),
     archiveCaptureStartedAt: timestamp19("archive_capture_started_at", {
@@ -13483,6 +13710,28 @@ var sandboxLeases = pgTable19(
     // these remain bare UUIDs here rather than generating a stricter wrong FK.
     currentCheckpointArtifactId: uuid19("current_checkpoint_artifact_id"),
     previousCheckpointArtifactId: uuid19("previous_checkpoint_artifact_id"),
+    // Durable single-flight for immutable machine setup (currently exact rig
+    // setup only). Per-turn credentials, repositories, files, and cloud login
+    // deliberately remain outside this lease-scoped receipt.
+    sharedPreparationLeaseEpoch: integer18("shared_preparation_lease_epoch"),
+    sharedPreparationInstanceId: text19("shared_preparation_instance_id"),
+    sharedPreparationSpecHash: text19("shared_preparation_spec_hash"),
+    sharedPreparationStatus: text19("shared_preparation_status", {
+      enum: ["running", "completed", "failed"]
+    }),
+    sharedPreparationClaimId: uuid19("shared_preparation_claim_id"),
+    sharedPreparationOwnerAttemptId: uuid19("shared_preparation_owner_attempt_id"),
+    sharedPreparationAttempt: integer18("shared_preparation_attempt"),
+    sharedPreparationRevision: integer18("shared_preparation_revision").notNull().default(0),
+    sharedPreparationStartedAt: timestamp19("shared_preparation_started_at", {
+      withTimezone: true
+    }),
+    sharedPreparationDeadlineAt: timestamp19("shared_preparation_deadline_at", {
+      withTimezone: true
+    }),
+    sharedPreparationSettledAt: timestamp19("shared_preparation_settled_at", {
+      withTimezone: true
+    }),
     expiresAt: timestamp19("expires_at", { withTimezone: true }).notNull(),
     createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp19("updated_at", { withTimezone: true }).notNull().defaultNow()
@@ -14451,10 +14700,10 @@ var enrollments = pgTable19(
     // The agent's ed25519 public key (the machine identity).
     pubkey: text19("pubkey").notNull(),
     exposure: text19("exposure", { enum: enrollmentExposureValues }).notNull().default("whole-machine"),
-    hasDisplay: boolean10("has_display").notNull().default(false),
+    hasDisplay: boolean11("has_display").notNull().default(false),
     // Refreshed from every connect Hello (Capabilities.op_stream); false for
     // agents predating the op-stream engine.
-    opStream: boolean10("op_stream").notNull().default(false),
+    opStream: boolean11("op_stream").notNull().default(false),
     // When the machine has a display it CANNOT capture (macOS Screen Recording / TCC
     // not granted), the agent reports has_display=false AND a human, actionable reason
     // here (e.g. "grant Screen Recording in System Settings"). NULL means capture is
@@ -14463,7 +14712,7 @@ var enrollments = pgTable19(
     // so the Machines dashboard / VM picker can surface the specific hint. Refreshed
     // from every connect Hello alongside has_display.
     desktopUnavailableReason: text19("desktop_unavailable_reason"),
-    allowScreenControl: boolean10("allow_screen_control").notNull().default(false),
+    allowScreenControl: boolean11("allow_screen_control").notNull().default(false),
     // Optional per-connection command policy. NULL is the unrestricted default.
     // Values remain within JavaScript's exact-integer wire range; local runner and
     // ancestor host policy may only tighten them at execution.
@@ -14532,8 +14781,8 @@ var enrollments = pgTable19(
     agentUpdateTargetVersion: text19("agent_update_target_version"),
     agentUpdateExpectedBinarySha256: text19("agent_update_expected_binary_sha256"),
     agentUpdateErrorCode: text19("agent_update_error_code"),
-    agentUpdateRetryable: boolean10("agent_update_retryable").notNull().default(false),
-    agentUpdateRolledBack: boolean10("agent_update_rolled_back").notNull().default(false),
+    agentUpdateRetryable: boolean11("agent_update_retryable").notNull().default(false),
+    agentUpdateRolledBack: boolean11("agent_update_rolled_back").notNull().default(false),
     agentUpdateConnectionInstanceId: text19("agent_update_connection_instance_id"),
     agentUpdateConnectionGeneration: integer18("agent_update_connection_generation"),
     agentUpdateRequestedAt: timestamp19("agent_update_requested_at", {
@@ -14736,17 +14985,17 @@ var deviceEnrollmentRequests = pgTable19(
     // The agent CAN offer a display (a real screen / Xvfb is available) — gates
     // whether screen-control consent is even meaningful. has_display on the
     // resulting enrollment is derived from this.
-    canOfferDisplay: boolean10("can_offer_display").notNull().default(false),
+    canOfferDisplay: boolean11("can_offer_display").notNull().default(false),
     // The agent REQUESTS screen control (computer-use). The user's allow_screen_control
     // at approve is the AUTHORITATIVE consent; this is only the agent's request.
-    requestsScreenControl: boolean10("requests_screen_control").notNull().default(false),
+    requestsScreenControl: boolean11("requests_screen_control").notNull().default(false),
     status: text19("status", { enum: deviceEnrollmentStatusValues }).notNull().default("pending"),
     // ── LOUD CONSENT capture (who/when/what), stamped at approve ──────────────
     approvedBySubjectId: text19("approved_by_subject_id"),
     approvedBySubjectLabel: text19("approved_by_subject_label"),
     // The user's screen-control consent decision (whole-machine is mandatory at
     // approve; screen-control is opt-in per this flag).
-    allowScreenControl: boolean10("allow_screen_control").notNull().default(false),
+    allowScreenControl: boolean11("allow_screen_control").notNull().default(false),
     approvedAt: timestamp19("approved_at", { withTimezone: true }),
     // The enrollment + sandbox the approve produced (acceptance #2: an enrollment
     // row AND a sandbox row appear). Null until approved.
@@ -15541,8 +15790,8 @@ var hostExportConfig = pgTable19(
   "host_export_config",
   {
     id: integer18("id").primaryKey().default(1),
-    sessionEventsEnabled: boolean10("session_events_enabled").notNull().default(false),
-    usageEventsEnabled: boolean10("usage_events_enabled").notNull().default(false),
+    sessionEventsEnabled: boolean11("session_events_enabled").notNull().default(false),
+    usageEventsEnabled: boolean11("usage_events_enabled").notNull().default(false),
     updatedAt: timestamp19("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => ({
@@ -15634,7 +15883,7 @@ var hostExportConsumers = pgTable19(
     consumerId: text19("consumer_id").notNull(),
     exportKind: text19("export_kind").notNull(),
     checkpoint: bigint14("checkpoint", { mode: "bigint" }).notNull().default(0n),
-    enabled: boolean10("enabled").notNull().default(true),
+    enabled: boolean11("enabled").notNull().default(true),
     leaseToken: uuid19("lease_token"),
     leaseHolderId: text19("lease_holder_id"),
     leaseExpiresAt: timestamp19("lease_expires_at", { withTimezone: true }),
@@ -16257,7 +16506,7 @@ var capabilityCatalogItems = pgTable19(
     importBatchId: uuid19("import_batch_id").references(() => importBatches.id, {
       onDelete: "set null"
     }),
-    stale: boolean10("stale").notNull().default(false),
+    stale: boolean11("stale").notNull().default(false),
     staleAt: timestamp19("stale_at", { withTimezone: true }),
     metadata: jsonb15("metadata").$type().notNull().default({}),
     createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow(),
@@ -16381,7 +16630,7 @@ var capabilityFacets = pgTable19(
     facetKey: text19("facet_key").notNull(),
     kind: text19("kind").notNull(),
     activationMode: text19("activation_mode").notNull(),
-    required: boolean10("required").notNull().default(true),
+    required: boolean11("required").notNull().default(true),
     createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => ({
@@ -16537,7 +16786,7 @@ var capabilityComponentOwners = pgTable19(
     }),
     ownerKind: text19("owner_kind").notNull(),
     ownerId: text19("owner_id").notNull(),
-    removable: boolean10("removable").notNull().default(true),
+    removable: boolean11("removable").notNull().default(true),
     createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => ({
@@ -16588,7 +16837,7 @@ var integrationTools = pgTable19(
     inputSchema: jsonb15("input_schema").$type().notNull().default({}),
     outputSchema: jsonb15("output_schema").$type(),
     effect: text19("effect").notNull().default("read"),
-    active: boolean10("active").notNull().default(true),
+    active: boolean11("active").notNull().default(true),
     createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp19("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
@@ -16671,7 +16920,7 @@ var integrationFacetBindingOwners = pgTable19(
     bindingId: uuid19("binding_id").notNull().references(() => integrationFacetBindings.id, { onDelete: "cascade" }),
     ownerKind: text19("owner_kind").notNull(),
     ownerId: text19("owner_id").notNull(),
-    removable: boolean10("removable").notNull().default(true),
+    removable: boolean11("removable").notNull().default(true),
     createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => ({
@@ -16879,7 +17128,7 @@ var rigVersions = pgTable19(
     // session state, or process state.
     providerImages: jsonb15("provider_images").$type().notNull().default({}),
     createdBy: text19("created_by"),
-    active: boolean10("active").notNull().default(false),
+    active: boolean11("active").notNull().default(false),
     createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => ({
@@ -16978,9 +17227,12 @@ export {
   companyProfileRevisions,
   companyProfileHeads,
   companyProfileActivationEvents,
+  organizationCompanyProfileAgentPolicies,
+  organizationCompanyProfileAgentPolicyEvents,
   companyProfileSnapshots,
   companyProfileAgentProposalReceipts,
   companyProfileAgentConfirmationReceipts,
+  companyProfileAgentAutomaticActivationReceipts,
   workspaceLearningPolicyRevisions,
   workspaceLearningPolicyHeads,
   workspaceLearningPolicyActivationEvents,
@@ -17088,6 +17340,8 @@ export {
   workspaceVariableSets,
   workspaceVariableSetVariables,
   codexSubscriptionCredentials,
+  workspaceCodexSubscriptionPreferences,
+  organizationCodexRotationSettings,
   codexAppsSettings,
   codexResetRedemptionAttempts,
   connections,
@@ -17175,6 +17429,7 @@ export {
   codexCapacityWaiters,
   xaiSessionAccountPins,
   xaiCapacityWaiters,
+  sessionEventCursors,
   sessionEvents,
   automaticSessionTitleFanoutOutboxV1,
   agentRunStates,
@@ -17270,4 +17525,4 @@ export {
   rigChanges,
   schema_exports
 };
-//# sourceMappingURL=chunk-UJ2EW3QI.js.map
+//# sourceMappingURL=chunk-O56DM5GZ.js.map