@opengeni/db 3.7.4 → 4.0.0-canary.0

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { type ChildLifecycleSystemUpdateKind, type ChildRequiresActionRespondedByKind, SessionGoalSnapshot } from "@opengeni/contracts";
-import type { AccessContext, AccessGrant, AccessPrincipalKind, ApiKey, AttemptToolResult, BillingBalance, CapabilityCatalogItem, CapabilityInstallation, CapabilityPack, CapabilitySource, ConnectionKind, ConnectionMetadata, ConnectionStatus, DocumentAuthorityKind, McpServerConnectionRef, FileAsset, FileUploadStatus, FirstPartyMcpToolName, HumanInputQuestion, HumanInputResponse, KnowledgeMemory, KnowledgeMemoryKind, KnowledgeMemoryStatus, KnowledgeSourceRef, GitHubInstallationAuthorityKind, GitHubRepositoryScope, HostEventExportBatch, HostUsageExportBatch, ManagedAccount, ManagedOrganizationMembershipProjection, WorkspaceMemberCandidate, McpPersonalConnectionDelegation, ModelContextContributionSummary, Permission, PersonalResourceAttachmentIntent, PackInstallation, PackInstallationStatus, ResourceRef, SandboxBackend, SandboxOs, ScheduledTask, ScheduledTaskAction, ScheduledTaskActionKind, KnowledgeSourceSyncAction, ScheduledTaskAgentConfig, ScheduledTaskOverlapPolicy, ScheduledTaskRun, ScheduledTaskRunAcceptedExecution as ScheduledTaskRunAcceptedExecutionType, ScheduledTaskRunMode, ScheduledTaskRunStatus, ScheduledTaskScheduleSpec, ScheduledTaskStatus, ScheduledTaskTriggerType, SlackInstallationBinding, Session, SessionAuthorizationListScope, SessionListResponse, SessionEvent, SessionEventPayloadMode, SessionEventReadDirection, SessionEventSemanticClass, SessionEventType, SessionGoal, SessionGoalChangeKind, SessionGoalCreatedBy, SessionGoalMutationPolicy, SessionGoalRevision, SessionGoalStatus, SessionHumanInputRequest, LineageNode, SessionMcpApprovalPolicy, SessionSkill, SessionMcpServerMetadata, SessionStatus, SessionToolPolicy, SessionTurn, SessionQueueSnapshot, SessionSystemUpdate, SessionSystemUpdateKind, SystemUpdateClassification, SessionTurnSource, SessionTurnStatus, TurnInitiator, TurnInitiatorContext, SocialConnection, SocialConnectionStatus, SocialPost, SocialProvider, ToolRef, ReasoningEffort, UsageEvent, Workspace, WorkspaceControlEvent, VariableSet, VariableSetSecret, VariableSetVariableMetadata, WorkspaceMember, WorkspaceMemoryPromptMode, WorkspaceRegisteredPack, Channel, Rig, RigProviderImage, RigProviderImages, RigVersion, RigVerificationHealth, RigChange, RigChangeKind, RigChangeStatus, RigCheck, NativeSnapshotDescriptor, TarWorkspaceArchiveDescriptor, WorkspaceArchiveDescriptor, ModalCheckpointProviderBinding, SandboxProviderContinuityRecovery, WorkClaimSubjectFilter, WorkDiscoveryProjection } from "@opengeni/contracts";
+import type { AccessContext, AccessGrant, AccessPrincipalKind, ApiKey, AttemptToolResult, BillingBalance, CapabilityCatalogItem, CapabilityInstallation, CapabilityPack, CapabilitySource, ConnectionKind, ConnectionMetadata, ConnectionStatus, DocumentAuthorityKind, McpServerConnectionRef, FileAsset, FileUploadStatus, FirstPartyMcpToolName, HumanInputQuestion, HumanInputResponse, KnowledgeMemory, KnowledgeMemoryKind, KnowledgeMemoryStatus, KnowledgeSourceRef, GitHubInstallationAuthorityKind, GitHubRepositoryScope, HostEventExportBatch, HostUsageExportBatch, ManagedAccount, ManagedOrganizationMembershipProjection, WorkspaceMemberCandidate, McpPersonalConnectionDelegation, ModelContextContributionSummary, Permission, PersonalResourceAttachmentIntent, PackInstallation, PackInstallationStatus, ResourceRef, SandboxBackend, SandboxOs, ScheduledTask, ScheduledTaskAction, ScheduledTaskActionKind, KnowledgeSourceSyncAction, ScheduledTaskAgentConfig, ScheduledTaskOverlapPolicy, ScheduledTaskRun, ScheduledTaskRunAcceptedExecution as ScheduledTaskRunAcceptedExecutionType, ScheduledTaskRunMode, ScheduledTaskRunStatus, ScheduledTaskScheduleSpec, ScheduledTaskStatus, ScheduledTaskTriggerType, SlackInstallationBinding, Session, SessionAuthorizationListScope, SessionListResponse, SessionEvent, SessionEventPayloadMode, SessionEventReadDirection, SessionEventSemanticClass, SessionEventType, SessionGoal, SessionGoalChangeKind, SessionGoalCreatedBy, SessionGoalMutationPolicy, SessionGoalRevision, SessionGoalStatus, SessionHumanInputRequest, LineageNode, SessionMcpApprovalPolicy, SessionBackgroundCommand, SessionSkill, SessionMcpServerMetadata, SessionStatus, SessionToolPolicy, SessionTurn, SessionQueueSnapshot, SessionSystemUpdate, SessionSystemUpdateKind, SystemUpdateClassification, SessionTurnSource, SessionTurnStatus, TurnInitiator, TurnInitiatorContext, SocialConnection, SocialConnectionStatus, SocialPost, SocialProvider, ToolRef, ReasoningEffort, UsageEvent, Workspace, WorkspaceControlEvent, VariableSet, VariableSetSecret, VariableSetVariableMetadata, WorkspaceMember, WorkspaceMemoryPromptMode, WorkspaceRegisteredPack, Channel, Rig, RigProviderImage, RigProviderImages, RigVersion, RigVerificationHealth, RigChange, RigChangeKind, RigChangeStatus, RigCheck, NativeSnapshotDescriptor, TarWorkspaceArchiveDescriptor, WorkspaceArchiveDescriptor, ModalCheckpointProviderBinding, SandboxProviderContinuityRecovery, WorkClaimSubjectFilter, WorkDiscoveryProjection } from "@opengeni/contracts";
 import { type WorkspaceArchiveObjectRef, RequestHumanInteractionToolInput, XaiProviderAccountAuthoritySnapshotV1, type TimelineAnnotation } from "@opengeni/contracts";
-import { type LatencyMode, SessionSystemUpdatePayload, TurnExecutionPolicyV1 } from "@opengeni/contracts";
+import { type LatencyMode, SessionSystemUpdatePayload, TurnExecutionPolicyV1, CodexCredentialPolicySnapshotV1 } from "@opengeni/contracts";
 import { type Settings } from "@opengeni/config";
 import { type CodexFetch } from "@opengeni/codex";
 export { isCodexBilledModel } from "@opengeni/codex";
@@ -11,6 +11,7 @@ export { frozenInitiatorForCommandActor, type FrozenTurnInitiator } from "./turn
 export { LOSSLESS_TEXT_PREFIX } from "./lossless-json.js";
 import { type NewSessionDraftSnapshot } from "./new-session-drafts.js";
 import { type SessionDiscoveryControl, type SessionCommandActor, type SessionTurnAttemptOutcome } from "./session-control.js";
+import { type ConnectedMachineBackgroundCommandClaim } from "./session-background-commands.js";
 import { type SessionRealtimeContinuityEntry } from "./session-realtime-context.js";
 import * as schema from "./schema.js";
 export { sql as dbSql } from "drizzle-orm";
@@ -68,6 +69,7 @@ export { memoryTextForStorage } from "./memory-domain.js";
 export { migrate, runMigrations } from "./migrate.js";
 export { provisionRoles, type ProvisionResult, type ProvisionRolesOptions, } from "./provision-roles.js";
 export * from "./memory-domain.js";
+export * from "./model-catalog.js";
 import { type Database, type SessionActivityDatabase } from "./database.js";
 export { createDb, registerDbBinding, retrySessionActivityRls, rlsContextForWorkspace, rlsStrategyFor, setRlsContext, setSubjectRlsContext, withAccountRls, withDatabaseStatementTimeout, withRlsContext, withSessionActivityRlsContext, withSessionActivitySavepoint, withWorkspaceRls, withWorkspaceSessionActivityRls, withWorkspaceSubjectRls, withWorkspaceSubjectSessionActivityRls, withWorkspaceUsageLock, withSandboxProviderReadLock, SandboxProviderReadLockUnavailableError, type CreateDbOptions, type Database, type DbClient, type SessionActivityDatabase, type RlsContext, type SessionRlsActorContext, type RlsStrategy, type SandboxProviderReadLockIdentity, type ManagedUserProfile, type UserLookup, type UserProfileLookup, } from "./database.js";
 export { withSessionRlsActorContext } from "./database.js";
@@ -536,6 +538,7 @@ export declare function deleteWorkspaceIfQuiescent(db: Database, input: {
     accountId: string;
     workspaceId: string;
     observer?: WorkspaceDeleteObserver;
+    organizationAdministratorSubjectId?: string;
 }): Promise<DeleteWorkspaceIfQuiescentResult>;
 /** Claim a bounded cross-workspace batch after abandoned claims expire. */
 export declare function claimTemporalScheduleCleanups(db: Database, input: {
@@ -718,6 +721,7 @@ export type ModelCallFact = {
     totalTokens: number | null;
     pricedCostMicros: number;
     estimatedProviderCostMicros: number | null;
+    equivalentCreditCostMicros: number | null;
     pricingSource: "configured_list_price" | "gateway_reported" | null;
     contextContributions: readonly ModelContextContributionSummary[] | null;
     occurredAt: Date;
@@ -740,6 +744,7 @@ export declare function recordModelCallFact(db: Database, input: {
     billingPath: ModelCallBillingPath;
     pricedCostMicros: number;
     estimatedProviderCostMicros?: number | null;
+    equivalentCreditCostMicros?: number | null;
     pricingSource?: "configured_list_price" | "gateway_reported" | null;
     contextContributions?: readonly ModelContextContributionSummary[] | null;
     inputTokens?: number | null;
@@ -849,6 +854,8 @@ export type CreateScheduledTaskInput = {
     variableSetId?: string | null;
     rigId?: string | null;
     metadata: Record<string, unknown>;
+    /** Trusted database-only admission seam. Throwing rolls the task creation back. */
+    beforeCreateCommit?: (tx: Database) => Promise<void>;
 };
 export type UpdateScheduledTaskInput = Partial<{
     name: string;
@@ -870,6 +877,8 @@ export type UpdateScheduledTaskInput = Partial<{
     authorityUpdatedBy: TurnInitiator;
     authorityUpdatedByContext: TurnInitiatorContext;
     authorityUpdatedByActor: AgentSessionCreationActor | null;
+    /** Trusted database-only admission seam. Throwing rolls the task update back. */
+    beforeUpdateCommit: (tx: Database) => Promise<void>;
 }>;
 export type CreatePackInstallationInput = {
     accountId: string;
@@ -992,6 +1001,43 @@ export type CreateConnectionInput = {
     createdBySubjectId?: string | null;
     updatedBySubjectId?: string | null;
 };
+type UpsertWorkspaceProviderApiKeyConnectionInput = {
+    accountId: string;
+    workspaceId: string;
+    operationId: string;
+    requestDigest: string;
+    credentialEncrypted: string;
+    grantedScopes?: string[];
+    expiresAt?: Date | null;
+    metadata?: Record<string, unknown>;
+    updatedBySubjectId: string;
+};
+type RotateWorkspaceProviderApiKeyConnectionInput = {
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    expectedVersion: number;
+    operationId: string;
+    requestDigest: string;
+    credentialEncrypted: string;
+    grantedScopes?: string[];
+    expiresAt?: Date | null;
+    metadata?: Record<string, unknown>;
+    updatedBySubjectId: string;
+};
+type RevokeWorkspaceProviderApiKeyConnectionsInput = {
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    expectedVersion: number;
+    updatedBySubjectId: string;
+};
+export type UpsertWorkspaceVercelAiGatewayConnectionInput = UpsertWorkspaceProviderApiKeyConnectionInput;
+export type RotateWorkspaceVercelAiGatewayConnectionInput = RotateWorkspaceProviderApiKeyConnectionInput;
+export type RevokeWorkspaceVercelAiGatewayConnectionsInput = RevokeWorkspaceProviderApiKeyConnectionsInput;
+export type UpsertWorkspaceOpenRouterConnectionInput = UpsertWorkspaceProviderApiKeyConnectionInput;
+export type RotateWorkspaceOpenRouterConnectionInput = RotateWorkspaceProviderApiKeyConnectionInput;
+export type RevokeWorkspaceOpenRouterConnectionsInput = RevokeWorkspaceProviderApiKeyConnectionsInput;
 export type UpdateConnectionInput = {
     workspaceId: string;
     connectionId: string;
@@ -1335,6 +1381,7 @@ export type InstallPortableSkillInput = {
     sourcePath: string;
     name: string;
     description: string;
+    activationMode?: "workspace_managed" | "session_selected";
     category?: string;
     tags?: string[];
     provenance?: "platform" | "deployment" | "registry" | "workspace";
@@ -1373,6 +1420,7 @@ export type PortableSkillRuntime = {
     version: string;
     name: string;
     description: string;
+    activationMode: "workspace_managed" | "session_selected";
     sourceUrl: string;
     sourceCommit: string;
     sourcePath: string;
@@ -1848,8 +1896,14 @@ export declare function getCapabilityCatalogItem(db: Database, workspaceId: stri
  * immutable history.
  */
 export declare function installPortableSkill(db: Database, input: InstallPortableSkillInput): Promise<InstalledPortableSkill>;
-/** Return exact text artifacts for active authoritative Skill installations. */
-export declare function listInstalledPortableSkills(db: Database, workspaceId: string): Promise<PortableSkillRuntime[]>;
+/**
+ * Return exact text artifacts for active authoritative Skill installations.
+ * Session-selected Skills are excluded from ambient runtime resolution unless
+ * the caller is explicitly materializing one during session admission.
+ */
+export declare function listInstalledPortableSkills(db: Database, workspaceId: string, options?: {
+    includeSessionSelected?: boolean;
+}): Promise<PortableSkillRuntime[]>;
 /** Return secret-free lifecycle summaries from the authoritative Skill ledger. */
 export declare function listInstalledSkills(db: Database, workspaceId: string): Promise<InstalledSkillSummary[]>;
 export declare function getPortableSkillUninstallPreview(db: Database, workspaceId: string, capabilityId: string): Promise<PortableSkillUninstallPreview>;
@@ -1886,6 +1940,15 @@ export declare function decryptedCapabilityHeaders(server: EnabledMcpCapabilityS
 export declare function getStoredCapabilityHeaderCiphertext(db: Database, workspaceId: string, capabilityId: string): Promise<Record<string, string> | null>;
 export declare function mcpServerIdForCapability(capabilityId: string, metadata?: Record<string, unknown>): string;
 export declare function createConnection(db: Database, input: CreateConnectionInput): Promise<ConnectionMetadataWithVerification>;
+/** Compatibility wrapper for the existing Vercel AI Gateway create/replay contract. */
+export declare function upsertWorkspaceVercelAiGatewayConnection(db: Database, input: UpsertWorkspaceVercelAiGatewayConnectionInput): Promise<ConnectionMetadataWithVerification | null>;
+export declare function upsertWorkspaceOpenRouterConnection(db: Database, input: UpsertWorkspaceOpenRouterConnectionInput): Promise<ConnectionMetadataWithVerification | null>;
+/** Compatibility wrapper for the existing Vercel AI Gateway rotation contract. */
+export declare function rotateWorkspaceVercelAiGatewayConnection(db: Database, input: RotateWorkspaceVercelAiGatewayConnectionInput): Promise<ConnectionMetadataWithVerification | null>;
+export declare function rotateWorkspaceOpenRouterConnection(db: Database, input: RotateWorkspaceOpenRouterConnectionInput): Promise<ConnectionMetadataWithVerification | null>;
+/** Compatibility wrapper for the existing Vercel AI Gateway revoke contract. */
+export declare function revokeWorkspaceVercelAiGatewayConnections(db: Database, input: RevokeWorkspaceVercelAiGatewayConnectionsInput): Promise<ConnectionMetadataWithVerification | null>;
+export declare function revokeWorkspaceOpenRouterConnections(db: Database, input: RevokeWorkspaceOpenRouterConnectionsInput): Promise<ConnectionMetadataWithVerification | null>;
 /**
  * Serialize one provider-principal/owner connection generation. Distinct OAuth
  * starts for the same principal converge on one row, while an explicit
@@ -2517,14 +2580,21 @@ export declare function loadConnectionCredentialForBroker(db: Database, settings
     allowSubjectOwned?: boolean;
     expectedAuthorityGeneration?: number;
 }): Promise<ConnectionCredentialForBroker | null>;
-export declare function workspaceVercelAiGatewayConnectionActive(db: Database, workspaceId: string): Promise<boolean>;
 /** Metadata-only capability revision input; never selects/decrypts the API key. */
 export declare function getWorkspaceVercelAiGatewayConnectionMetadata(db: Database, workspaceId: string): Promise<{
     connectionId: string;
     version: number;
 } | null>;
+export declare function getWorkspaceOpenRouterConnectionMetadata(db: Database, workspaceId: string): Promise<{
+    connectionId: string;
+    version: number;
+} | null>;
+export declare function workspaceVercelAiGatewayConnectionActive(db: Database, workspaceId: string): Promise<boolean>;
+export declare function workspaceOpenRouterConnectionActive(db: Database, workspaceId: string): Promise<boolean>;
 /** Resolve only the reviewed workspace-shared AI Gateway credential shape. */
 export declare function loadWorkspaceVercelAiGatewayApiKey(db: Database, settings: Settings, workspaceId: string): Promise<string | null>;
+/** Resolve only the reviewed workspace-shared OpenRouter credential shape. */
+export declare function loadWorkspaceOpenRouterApiKey(db: Database, settings: Settings, workspaceId: string): Promise<string | null>;
 /**
  * Worker-only immutable credential lease for an asynchronous video operation.
  * The operation copies the already-encrypted credential envelope before its
@@ -2753,6 +2823,11 @@ export declare function createScheduledTaskRun(db: Database, input: {
     scheduledAt?: Date | null;
     firedAt?: Date;
     acceptedExecutionSnapshot?: ScheduledTaskRunAcceptedExecutionType | null;
+    /**
+     * Trusted database-only admission seam for a fresh agent occurrence.
+     * Throwing rolls back the run insert; exact producer replay skips it.
+     */
+    beforeFreshAgentRunCommit?: (tx: Database) => Promise<void>;
 }): Promise<ScheduledTaskRun>;
 export declare function getScheduledTaskRunAcceptedExecution(db: Database, input: {
     workspaceId: string;
@@ -3609,11 +3684,17 @@ export type WorkspaceCodexSubscriptionSource = {
     organizationAvailable: boolean;
 };
 export declare function getWorkspaceCodexSubscriptionSource(db: Database, workspaceId: string): Promise<WorkspaceCodexSubscriptionSource>;
+export declare class CodexSubscriptionSourceChangeBlockedError extends Error {
+    readonly code = "codex_subscription_source_change_blocked";
+    constructor();
+}
 export declare function setWorkspaceCodexSubscriptionModeInTransaction(scopedDb: Database, input: {
     accountId: string;
     workspaceId: string;
     subjectId: string | null;
     mode: WorkspaceCodexSubscriptionMode;
+    /** Effective source captured under the source lock before caller-owned credential writes. */
+    effectiveSourceBeforeMutation?: EffectiveCodexSubscriptionSource;
 }): Promise<WorkspaceCodexSubscriptionSource>;
 export declare function setWorkspaceCodexSubscriptionMode(db: Database, input: {
     accountId: string;
@@ -3859,7 +3940,7 @@ export declare function getCodexCredentialStatus(db: Database, workspaceId: stri
  * decide whether to inject the synthetic codex-subscription provider, so billing
  * and provider-injection cannot drift. Metadata-only read (never the secret).
  */
-export declare function workspaceCodexSubscriptionActive(db: Database, settings: Pick<Settings, "codexSubscriptionEnabled" | "codexCredentialLeasingEnabled">, workspaceId: string): Promise<boolean>;
+export declare function workspaceCodexSubscriptionActive(db: Database, settings: Pick<Settings, "codexSubscriptionEnabled">, workspaceId: string): Promise<boolean>;
 /**
  * CANONICAL "is this a Codex-billed turn?" predicate.
  *
@@ -3875,7 +3956,7 @@ export declare function workspaceCodexSubscriptionActive(db: Database, settings:
  */
 export declare function isCodexBilledTurn(input: {
     db: Database;
-    settings: Pick<Settings, "codexSubscriptionEnabled" | "codexCredentialLeasingEnabled">;
+    settings: Pick<Settings, "codexSubscriptionEnabled">;
     workspaceId: string;
     model: string | null | undefined;
     /**
@@ -3947,15 +4028,25 @@ export type CodexCredentialLeaseCandidateFilter<TPolicyScope, TUnavailableDiagno
     accounts: readonly CodexLeaseAccountStatus[];
     policyScope: TPolicyScope | null;
 }) => readonly CodexLeaseAccountStatus[] | CodexCredentialLeaseCandidateFilterResult<TUnavailableDiagnostic>;
+/**
+ * Codex session state read from the exact session row locked by credential
+ * acquisition. Selection and pointer movement must use this snapshot rather
+ * than an unlocked read taken before the allocator transaction.
+ */
+export type CodexCredentialLeaseSessionState = {
+    pinnedCredentialId: string | null;
+    pinSource: "manual" | "policy" | null;
+    lastCredentialId: string | null;
+};
 export type CodexCredentialLeaseSelectionContext<TPolicyScope = never, TUnavailableDiagnostic = never> = {
     accounts: CodexLeaseAccountStatus[];
     activeCredentialId: string | null;
     rotationEnabled: boolean;
-    /** Workspace cutover fence. False means the additive lease table stays inert. */
-    leaseRotationEnabled: boolean;
     rotationStrategy: string;
     /** A still-live idempotent lease for this SAME turn, if one exists. */
     existingCredentialId: string | null;
+    /** Credentials already consumed by a definitive refusal on this accepted turn. */
+    failedCredentialIds?: readonly string[];
     /** Downstream-owned accepted-turn policy; absent until a resolver is supplied. */
     policyScope: TPolicyScope | null;
     /** Diagnostics produced while choosing one policy scope for this NEW allocation. */
@@ -3973,6 +4064,14 @@ export type CodexCredentialLeaseResult<T, TUnavailableDiagnostic = never> = {
     activeCredentialId: string | null;
     rotationEnabled: boolean;
     rotationStrategy: string;
+    /** Session state from the row locked during this acquisition. */
+    sessionCodexState: CodexCredentialLeaseSessionState;
+    /** Number of effective-pool rows before any downstream policy filter. */
+    poolAccountCount: number;
+    /** Accepted allocator policy captured with the first durable lease. */
+    codexPolicySnapshot: CodexCredentialPolicySnapshotV1 | null;
+    /** True when this acquisition reused a snapshot already present on the turn. */
+    codexPolicySnapshotReused: boolean;
     credentialId: string | null;
     reused: boolean;
     holderId: string | null;
@@ -3981,7 +4080,19 @@ export type CodexCredentialLeaseResult<T, TUnavailableDiagnostic = never> = {
     unavailableDiagnostics: readonly TUnavailableDiagnostic[];
     /** Final selector decision after input policy and manual/policy pin handling. */
     advanceActivePointer: boolean;
+    /** Frozen alternate-account budget observed before the first provider request. */
+    failoverLimit: number;
 };
+export declare class CodexCredentialLeaseAttemptFencedError extends Error {
+    readonly code = "codex_credential_lease_attempt_fenced";
+    constructor();
+}
+export declare class CodexCredentialFailoverExhaustedError extends Error {
+    readonly failoverCount: number;
+    readonly maxFailovers: number;
+    readonly code = "codex_credential_failover_exhausted";
+    constructor(failoverCount: number, maxFailovers: number);
+}
 /**
  * Five minutes is deliberately much longer than the one-minute heartbeat and
  * much shorter than a five-hour allowance window. A killed worker therefore
@@ -4006,7 +4117,14 @@ export declare const CODEX_CREDENTIAL_LEASE_TTL_MS: number;
 export declare function acquireCodexCredentialLease<T, TPolicyScope = never, TUnavailableDiagnostic = never>(db: Database, input: {
     accountId: string;
     workspaceId: string;
+    sessionId: string;
     turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+    workflowId: string;
+    workflowRunId: string;
+    dispatchId: string;
+    expectedRedispatches: number;
     /** Unique Temporal/local activity execution id used as the zombie fence. */
     holderId: string;
     /** Pins must not move the workspace-global cursor. */
@@ -4024,9 +4142,9 @@ export declare function acquireCodexCredentialLease<T, TPolicyScope = never, TUn
      */
     filterNewAllocationCandidates?: CodexCredentialLeaseCandidateFilter<TPolicyScope, TUnavailableDiagnostic>;
     leaseTtlMs?: number;
-}, select: (context: CodexCredentialLeaseSelectionContext<TPolicyScope, TUnavailableDiagnostic>) => CodexCredentialLeaseSelection<T>): Promise<CodexCredentialLeaseResult<T, TUnavailableDiagnostic>>;
+}, select: (context: CodexCredentialLeaseSelectionContext<TPolicyScope, TUnavailableDiagnostic>, sessionCodexState: CodexCredentialLeaseSessionState) => CodexCredentialLeaseSelection<T>): Promise<CodexCredentialLeaseResult<T, TUnavailableDiagnostic>>;
 export type CodexCapacityWaitStatus = "waiting" | "resumed" | "superseded";
-export type CodexCapacityResetKind = "authoritative" | "bounded_refresh";
+export type CodexCapacityResetKind = "authoritative" | "bounded_refresh" | "mutation_only";
 export type CodexCapacityWait = {
     id: string;
     accountId: string;
@@ -4122,7 +4240,8 @@ export declare const CODEX_CAPACITY_REFRESH_MAX_MS: number;
 export declare function codexCapacityRefreshBackoffMs(attempt: number): number;
 /**
  * Atomically close one all-unavailable attempt and arm exactly one durable wait
- * for the same logical turn. Lock order is allocator rotation row -> workspace
+ * for the same logical turn. Lock order is workspace source advisory -> allocator
+ * rotation row -> workspace
  * control -> actual workspace -> session -> exact turn -> exact attempt ->
  * optional goal -> live lease (when a reactive failure owns one) -> waiter.
  * The waiting turn/session pointer, durable events, exact lease release, and
@@ -4189,6 +4308,8 @@ export declare function reconcileCodexCapacityWait<TPolicyScope = never, TUnavai
     waiterId: string;
     generation: number;
     now?: Date;
+    /** True only after the caller performed the due bounded metadata refresh. */
+    boundedRefreshAttempted?: boolean;
 }, decide: (context: CodexCapacitySelectionContext<TPolicyScope, TUnavailableDiagnostic>) => CodexCapacityAvailabilityDecision, policy?: {
     resolvePolicyScope?: CodexCredentialLeasePolicyScopeResolver<TPolicyScope>;
     filterNewAllocationCandidates?: CodexCredentialLeaseCandidateFilter<TPolicyScope, TUnavailableDiagnostic>;
@@ -4292,7 +4413,8 @@ export declare function reconcileXaiCapacityWait(db: Database, input: {
  * Extend a live holder and return the database-confirmed expiry. A
  * missing/expired/released row returns null. A successful result lets the worker
  * derive a conservative monotonic deadline from the request start and configured
- * TTL, without comparing the Postgres and worker wall clocks.
+ * TTL, without comparing the Postgres and worker wall clocks; the worker still
+ * rejects a response that returns after its prior confirmed deadline.
  */
 export declare function heartbeatCodexCredentialLeaseUntil(db: Database, accountId: string, workspaceId: string, turnId: string, holderId: string, generation: number, leaseTtlMs?: number): Promise<Date | null>;
 /** Extend a live holder. Compatibility wrapper for boolean-only callers. */
@@ -4308,20 +4430,46 @@ export type CodexCredentialLeaseQuarantine = {
     until: Date;
     cooldownKind: CodexCredentialCooldownKind;
 };
+export type CodexCredentialLeaseQuarantineResult = {
+    action: "recorded";
+    failoverCount: number;
+    maxFailovers: number;
+    exhausted: boolean;
+} | {
+    action: "credential_changed";
+    failoverCount: number;
+    maxFailovers: number;
+    currentCredentialVersion: number;
+} | {
+    action: "stale";
+    failoverCount: number;
+    maxFailovers: number;
+};
 /**
- * Quarantine the credential served by one exact live holder. The lease row is
- * locked and checked before the credential write, so a superseded/expired
- * activity cannot poison status or cooldown after a successor owns the turn.
+ * Quarantine the credential served by one exact live attempt and token family.
+ * The attempt, dispatch, lease, and credential version are checked before the
+ * write. The same transaction freezes the accepted turn's alternate budget and
+ * records the attempted credential, so waiter/database recovery cannot reset
+ * accounting or return to an already-consumed account under rotation policy.
  */
 export declare function quarantineCodexCredentialForLease(db: Database, input: {
     accountId: string;
     workspaceId: string;
+    sessionId: string;
     turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+    workflowId: string;
+    workflowRunId: string;
+    dispatchId: string;
+    expectedRedispatches: number;
     credentialId: string;
+    credentialVersion: number;
     holderId: string;
     generation: number;
+    maxFailovers: number;
     quarantine: CodexCredentialLeaseQuarantine;
-}): Promise<boolean>;
+}): Promise<CodexCredentialLeaseQuarantineResult>;
 /**
  * Metadata-only list of every connected Codex account in the workspace, for the
  * accounts UI + the worker's selection resolver. NEVER decrypts. `isActive` marks
@@ -4524,10 +4672,8 @@ export declare function recordCodexAccountUsage(db: Database, workspaceId: strin
 export declare function recordCodexAccountUsageWithWakeTargets(db: Database, workspaceId: string, credentialId: string, snapshot: CodexAccountUsageSnapshot): Promise<CodexCapacityMutationResult<boolean>>;
 export type CodexRotationSettings = {
     activeCredentialId: string | null;
-    /** Legacy selector bit; old binaries only understand this field. */
+    /** False keeps new allocations on the active account; true permits pool failover. */
     rotationEnabled: boolean;
-    /** New allocator cutover bit; ignored safely by old binaries. */
-    leaseRotationEnabled: boolean;
     rotationStrategy: string;
 };
 /**
@@ -4579,20 +4725,6 @@ export declare function setInitialActiveCodexCredential(db: Database, workspaceI
 export declare function setCodexCredentialExhausted(db: Database, workspaceId: string, credentialId: string, until: Date | null, cooldownKind: CodexCredentialCooldownKind | null): Promise<boolean>;
 /** Cooldown mutation plus its committed durable capacity-wake outbox. */
 export declare function setCodexCredentialExhaustedWithWakeTargets(db: Database, workspaceId: string, credentialId: string, until: Date | null, cooldownKind: CodexCredentialCooldownKind | null): Promise<CodexCapacityMutationResult<boolean>>;
-/**
- * P3 reactive-rotation boundedness (Finding 1b): the number of CONSECUTIVE rotated
- * 429-failover turns since the session last had a SUCCESSFUL turn. Counts
- * `turn.failed` events carrying the `rotated` marker that occurred AFTER the most
- * recent `turn.completed` event (the natural reset anchor — any successful turn
- * moves the anchor past every prior failover, so the streak resets to 0). The
- * reactive 429 catch consults this to bound its otherwise-0-delay re-dispatch:
- * once the streak exceeds ~(connected accounts + margin) the path degrades to a
- * fixed positive idle instead of another hot re-dispatch (invariant 4: NO THRASH),
- * covering the double-fault where a cooldown write did not persist AND the 429
- * carried no usage headers. Derived from persisted events so it is correct across
- * the Temporal re-dispatch (each failover is a NEW turn, but its event survives).
- */
-export declare function countConsecutiveReactiveRotations(db: Database, workspaceId: string, sessionId: string): Promise<number>;
 /** The supported rotation strategies (P3). */
 export declare const CODEX_ROTATION_STRATEGIES: readonly ["most_remaining", "round_robin", "drain_then_next", "sharded"];
 export type CodexRotationStrategy = (typeof CODEX_ROTATION_STRATEGIES)[number];
@@ -4788,6 +4920,8 @@ export declare function ensureConnectorActionPolicyDefault(db: Database, input:
     changed: boolean;
 }>;
 export declare function prepareConnectorActionApproval(db: Database, identity: ConnectorActionAttemptIdentity, invocation: ConnectorActionInvocation): Promise<PrepareConnectorActionApprovalResult>;
+/** Resolve the frozen connector policy without creating approval or audit state. */
+export declare function previewConnectorActionApproval(db: Database, identity: ConnectorActionAttemptIdentity, invocation: ConnectorActionInvocation): Promise<PrepareConnectorActionApprovalResult>;
 export declare function beginConnectorActionExecution(db: Database, identity: ConnectorActionAttemptIdentity, invocation: ConnectorActionInvocation): Promise<BeginConnectorActionExecutionResult>;
 export declare function completeConnectorActionExecution(db: Database, input: {
     accountId: string;
@@ -4839,6 +4973,8 @@ export type SessionCreateInput = {
     policyRole?: string | null;
     parentSessionId?: string | null;
     createIdempotencyKey?: string | null;
+    /** Exact explicit installed-Skill selection used for keyed-create replay. */
+    selectedInstalledSkillIds?: string[];
     sandboxGroupId?: string | null;
     sandboxOs?: SandboxOs;
     /** Exact accepted generated-session compaction policy; internal lifecycle callers only. */
@@ -4858,7 +4994,9 @@ export type SessionCreateInput = {
     /** Trusted, transaction-local linkage run after the exact session row and
      * MCP metadata exist but before either can commit. It must perform database
      * work only; throwing rolls the complete create/replay transaction back. */
-    beforeCreateCommit?: (tx: Database, sessionId: string) => Promise<void>;
+    beforeCreateCommit?: (tx: Database, sessionId: string, context?: {
+        created: boolean;
+    }) => Promise<void>;
 };
 export declare function createSession(db: Database, input: SessionCreateInput): Promise<DbSession>;
 /**
@@ -4883,6 +5021,43 @@ export declare function createSessionWithIdempotencyKey(db: Database, input: Ses
     createIdempotencyKey: string;
 }): Promise<SessionCreateSuccessResult>;
 export declare function getSessionByCreateIdempotencyKey(db: Database, workspaceId: string, createIdempotencyKey: string): Promise<Session | null>;
+/**
+ * Recover a keyed create before mutable create dependencies (notably the
+ * current model catalog) are consulted. A fully initialized queued turn gets a
+ * fresh durable wake revision from persisted state only; an uninitialized shell
+ * returns its persisted model so the caller can reopen it strictly as retained
+ * while the canonical keyed transaction repairs initialization. The same
+ * request-identity checks as transactional create replay run before any session
+ * or committed denial is returned.
+ */
+export type InitializedSessionCreateReplay = {
+    outcome: "session";
+    session: Session & {
+        initialTurnId: string | null;
+    };
+    temporalWorkflowId: string;
+    workflowWakeRevision: number | null;
+    changed: boolean;
+} | {
+    outcome: "pending";
+    session: Session;
+} | {
+    outcome: "denied";
+    denial: SessionSpawnDenial;
+};
+export declare function getInitializedSessionCreateReplay(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    activeManagedHumanSubjectId?: string;
+    createIdempotencyKey: string;
+    requestedSessionId?: string;
+    visibility?: "user_private" | "workspace_shared";
+    variableSetIds: string[];
+    selectedInstalledSkillIds: string[];
+    initialPersonalResourceAttachmentIntent?: PersonalResourceAttachmentIntent | null;
+    deferInitialTurn?: boolean;
+}): Promise<InitializedSessionCreateReplay | null>;
 export declare function getSession(db: Database, workspaceId: string, sessionId: string): Promise<Session | null>;
 export type DeleteSessionTreeIfQuiescentResult = {
     status: "deleted";
@@ -5047,7 +5222,7 @@ type SessionTreeStats = NonNullable<Session["treeStats"]>;
 export declare function projectEffectiveControlForRelatedAccess(control: Session["effectiveControl"], sessionId: string, access: "target" | "root"): Session["effectiveControl"];
 /**
  * Remove metadata derived from sessions other than the exact authorized
- * target, including parent identity and descendant counts.
+ * target, including parent identity, policy provenance, and descendant counts.
  */
 export declare function projectSessionForRelatedAccess(session: Session, access: "target" | "root"): Session;
 /**
@@ -5228,7 +5403,8 @@ export declare function listSessionDiscoverySummaries(db: Database, workspaceId:
     recentHours?: number;
     subject?: WorkClaimSubjectFilter;
     claimLimit?: number;
-    /** Skip advisory claim reads for an operator-disabled discovery rollout. */
+    /** Skip advisory claim reads on plain MCP browse or an operator-disabled rollout.
+     * Omitted retains the REST/UI legacy evidence default. */
     includeWorkDiscovery?: boolean;
     subjectId?: string;
     authorizationScope?: SessionAuthorizationListScope;
@@ -5324,6 +5500,8 @@ export type SessionEventPage = {
     events: SessionEvent[];
     hasMore: boolean;
     bytes: number;
+    /** True only when every full-mode event is the exact retained database row. */
+    fullPayloadsExact: boolean;
     direction: SessionEventReadDirection;
     coveredSequence: {
         first: number;
@@ -5336,10 +5514,12 @@ export type SessionEventPage = {
 export declare const SESSION_EVENT_DB_PAGE_MAX_BYTES: number;
 /**
  * Read one direction-aware session-event page. Full mode selects the canonical
- * row exactly; summary/none modes derive bounded monitoring projections in SQL
- * without rewriting the retained source. `bytes` is the exact UTF-8 size of
- * `JSON.stringify(events)`; `hasMore` is true whenever count or byte selection
- * stopped before the durable range ended.
+ * row exactly when it fits the page; an oversized historical row that predates
+ * the durable write guard is projected at the bounded database-read boundary
+ * when it would otherwise strand its cursor forever. Summary/none modes derive
+ * bounded monitoring projections in SQL without rewriting the retained source.
+ * `bytes` is the exact UTF-8 size of `JSON.stringify(events)`; `hasMore` is true
+ * whenever count or byte selection stopped before the durable range ended.
  */
 export declare function listSessionEventPage(db: Database, workspaceId: string, sessionId: string, options?: ListSessionEventPageOptions): Promise<SessionEventPage>;
 export declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string): Promise<SessionEvent[]>;
@@ -5356,6 +5536,18 @@ export declare function getWorkspaceControlEvent(db: Database, workspaceId: stri
  * a session, while the workspace predicate remains the tenancy boundary.
  */
 export declare function getSessionEventByClientEventId(db: Database, workspaceId: string, sessionId: string, clientEventId: string): Promise<SessionEvent | null>;
+/**
+ * Resolve the visible creation event for one exact tool operation. This is a
+ * rolling-upgrade compatibility lookup for producers that predate deterministic
+ * client event ids; the operation id remains bound to the same turn attempt.
+ */
+export declare function getSessionToolCallCreatedEventByOperationId(db: Database, input: {
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    operationId: string;
+}): Promise<SessionEvent | null>;
 export declare const APPROVAL_RUN_STATE_MAX_JSON_BYTES: number;
 export declare const APPROVAL_RUN_STATE_MAX_JSON_NODES = 65536;
 export declare const APPROVAL_RUN_STATE_MAX_JSON_PROPERTIES = 32768;
@@ -5487,6 +5679,34 @@ export declare function adoptConnectedMachineSessionBackgroundCommand(db: Databa
     settledAt: string | null;
     updatedAt: string;
 }>;
+/** Transfer one exact managed retained process from a live turn attempt to its
+ * session. Retaining the provider process and backgrounding it are deliberately
+ * separate: a provider yield only preserves physical ownership; this adoption
+ * occurs immediately before the running receipt becomes model-visible. */
+export declare function adoptManagedSessionBackgroundCommand(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    executionGeneration: number;
+    attemptId: string;
+    processId: string;
+    expected: SandboxRetainedProcessIdentity;
+    command: string;
+}): Promise<{
+    id: string;
+    workspaceId: string;
+    sessionId: string;
+    provider: "connected_machine" | "managed";
+    state: "exited" | "lost" | "running" | "stopping";
+    commandPreview: string;
+    cancelRequestedAt: string | null;
+    exitCode: number | null;
+    settlementReason: string | null;
+    startedAt: string;
+    settledAt: string | null;
+    updatedAt: string;
+}>;
 export type InstallOrReadTurnExecutionPolicyForAttemptResult = {
     accepted: true;
     installed: boolean;
@@ -6208,6 +6428,9 @@ export type AcquireLeaseResult = {
     role: "fenced";
     reason: "superseded" | "capture_in_progress" | "rotation_in_progress" | "provider_recovery_in_progress";
     lease: LeaseSnapshot;
+    /** Remaining durable capture budget from PostgreSQL's clock. Present only
+     * for an exact active capture; callers cap it at the lifecycle ceiling. */
+    captureRemainingMs?: number;
 };
 export type SandboxSharedPreparationSnapshot = {
     status: "running" | "completed" | "failed";
@@ -6965,6 +7188,16 @@ export declare function listSandboxViewerForceDrainWorkspaceIds(db: Database): P
 export declare function countQueuedTurns(db: Database): Promise<number>;
 export type SessionRecoveryBacklogState = "quiescence_missing" | "projection_stale";
 export declare function countSessionRecoveryBacklog(db: Database): Promise<Record<SessionRecoveryBacklogState, number>>;
+export type ContextCompactionPendingSummary = {
+    pendingCount: number;
+    oldestStartedAt: Date | null;
+};
+/**
+ * Content-free cross-workspace projection of exact active attempts whose latest
+ * automatic compaction landmark is still `started`. The trigger-maintained
+ * private ledger survives turn-worker loss without exposing tenant identities.
+ */
+export declare function getContextCompactionPendingSummary(db: Database): Promise<ContextCompactionPendingSummary>;
 export declare function countSandboxLeasesByLiveness(db: Database): Promise<Record<SandboxLeaseLiveness, number>>;
 export type CreditBalanceByAccount = {
     accountId: string;
@@ -6997,8 +7230,14 @@ export declare function confirmDrainCold(db: Database, input: {
 }>;
 export declare class SandboxWorkspaceMutationFencedError extends Error {
     readonly code: "attempt_fenced" | "holder_fenced" | "lease_fenced" | "rotation_in_progress" | "route_fenced" | "process_fenced" | "capture_in_progress" | "admission_fenced" | "operation_invalid" | "generation_exhausted" | "authority_unattributed" | "authority_revoked";
+    /** Remaining exact archive-capture budget projected by PostgreSQL. This is
+     * observational wait input only; it never licenses capture takeover. */
+    readonly captureRemainingMs: number | null;
     readonly name: string;
-    constructor(code: "attempt_fenced" | "holder_fenced" | "lease_fenced" | "rotation_in_progress" | "route_fenced" | "process_fenced" | "capture_in_progress" | "admission_fenced" | "operation_invalid" | "generation_exhausted" | "authority_unattributed" | "authority_revoked", message: string);
+    constructor(code: "attempt_fenced" | "holder_fenced" | "lease_fenced" | "rotation_in_progress" | "route_fenced" | "process_fenced" | "capture_in_progress" | "admission_fenced" | "operation_invalid" | "generation_exhausted" | "authority_unattributed" | "authority_revoked", message: string, 
+    /** Remaining exact archive-capture budget projected by PostgreSQL. This is
+     * observational wait input only; it never licenses capture takeover. */
+    captureRemainingMs?: number | null);
 }
 /** An operation named a durable retained process that has already reached a
  * terminal state. This remains a fence—the provider must not be called again
@@ -7332,8 +7571,9 @@ export declare function deferRetainedProcessReconciliation(db: Database, input:
 export declare function countActiveRetainedProcessesByOwnerState(db: Database): Promise<ActiveRetainedProcessOwnerCount[]>;
 export declare function countExpiredDrainingSandboxLeases(db: Database): Promise<ExpiredDrainingSandboxLeaseCount[]>;
 /** Settle an exact retained process only after exit or definitive loss proof.
- * The process row, parent admission, non-TTL holder, and lease count transition
- * commit atomically. A duplicate terminal state + exit code is idempotent and
+ * The process row, parent admission, non-TTL holder, lease count, and any
+ * linked background-command terminal input commit atomically. A duplicate
+ * terminal state + exit code is idempotent and
  * preserves the first durable evidence reason; contradictory physical truth
  * fails closed. */
 export declare function settleRetainedProcess(db: Database, input: {
@@ -7350,6 +7590,7 @@ export declare function settleRetainedProcess(db: Database, input: {
 }): Promise<{
     settled: boolean;
     process: SandboxRetainedProcess;
+    backgroundCommandEvents: SessionEvent[];
 }>;
 /** Read the exact generation a verified capture must later fold. This is a
  * preflight only: persistWarmSnapshot/persistDrainSnapshot repeat the full
@@ -7586,6 +7827,7 @@ export type SandboxRotationBacklog = {
     turnBlocked: number;
     directBlocked: number;
     processBlocked: number;
+    interactionBlocked: number;
 };
 export declare function readSandboxRotationBacklog(db: Database): Promise<SandboxRotationBacklog>;
 export type LegacyModalCheckpointSlot = {
@@ -8573,6 +8815,9 @@ export type CreateSessionGoalInput = {
 };
 export declare function createSessionGoal(db: Database, input: CreateSessionGoalInput): Promise<SessionGoal>;
 export declare function getSessionGoal(db: Database, workspaceId: string, sessionId: string): Promise<SessionGoal | null>;
+/** Bounded MCP management facts. No config, goal metadata, or event payload is materialized.
+ * The caller must authorize session.read first, just as for getSession/queue reads. */
+export declare function getSessionMcpMonitoringSummary(db: Database, workspaceId: string, sessionId: string): Promise<import("@opengeni/contracts").SessionMcpMonitoringSource>;
 export type SessionGoalContinuationProjection = {
     state: "inactive" | "scheduled" | "running" | "blocked" | "invariant_broken";
     reason: "goal_inactive" | "wake_pending" | "continuation_pending" | "human_work_pending" | "goal_turn_running" | "human_turn_running" | "workstream_paused" | "approval_required" | "provider_backpressure" | "session_cancelled" | "system_work_pending" | "held_for_input" | "backoff_pending" | "missing_obligation";
@@ -8580,7 +8825,7 @@ export type SessionGoalContinuationProjection = {
     observedRevision: number;
     nextAttemptAt: string | null;
     lastError: string | null;
-    /** The agent's stated `goal_wait` reason while `held_for_input`; null otherwise. */
+    /** The agent's stated `wait_for_input` reason while held; null otherwise. */
     holdReason: string | null;
 };
 /**
@@ -8700,34 +8945,19 @@ export declare function updateSessionGoalWithEvent(db: Database, workspaceId: st
     outcome: "applied" | "proposed";
     proposalId: string | null;
 }>;
+/** Maximum relative duration accepted by the session-level out-of-turn wait. */
+export declare const SESSION_INPUT_WAIT_MIN_SECONDS = 30;
+export declare const SESSION_INPUT_WAIT_MAX_SECONDS: number;
+export declare const SESSION_INPUT_WAIT_REASON_MAX_BYTES: number;
 /**
- * Record execution progress without changing goal semantics or either goal
- * revision. The attempt-fenced operation receipt makes a recovered tool call
- * converge on the original event instead of manufacturing progress twice.
- */
-/**
- * Column set that retires an agent-declared `goal_wait` hold. Spread into every
- * goal head mutation (status transition, applied semantic revision, replace) so
- * newer truth never sits behind an older wait.
+ * Agent `wait_for_input`: persist one session-owned, self-only out-of-turn
+ * wait. The exact declaring turn and absolute deadline are causal authority;
+ * Temporal/NATS are replaceable wake hints. A replacement attempt replaying
+ * the same target-scoped operation key receives the committed result.
  */
-export declare const SESSION_GOAL_HOLD_MIN_SECONDS = 30;
-export declare const SESSION_GOAL_HOLD_MAX_SECONDS: number;
-/**
- * Agent `goal_wait`: record that the active goal's next continuation should
- * wait for child results, a message, a human prompt, or the deadline instead of
- * materializing immediately after the declaring turn ends.
- *
- * The hold is bound to the exact caller turn. The materializer honors it only
- * while that turn is still the latest finished turn and `now < until`; it
- * never consumes the wake/observed revision ledger. The receipt, goal
- * mutation, and `goal.held` timeline fact commit under the canonical goal
- * event-write prefix (control FOR SHARE -> workspace FOR KEY SHARE -> session
- * FOR NO KEY UPDATE), never a workspace FOR UPDATE. A replacement attempt
- * replaying the same target-scoped operation key receives the stored result.
- */
-export declare function holdSessionGoalContinuationWithEvent(db: Database, workspaceId: string, sessionId: string, input: {
+export declare function waitForSessionInputWithEvent(db: Database, workspaceId: string, sessionId: string, input: {
     reason: string;
-    untilSeconds: number;
+    timeoutSeconds: number;
     command: {
         accountId: string;
         actor: Extract<SessionCommandActor, {
@@ -8736,13 +8966,17 @@ export declare function holdSessionGoalContinuationWithEvent(db: Database, works
         operationKey: string;
     };
 }): Promise<{
-    goal: SessionGoal;
     events: SessionEvent[];
     operationId: string;
     replay: boolean;
-    holdTurnId: string;
-    untilAt: string;
+    waitTurnId: string;
+    deadlineAt: string;
 }>;
+/**
+ * Record execution progress without changing goal semantics or either goal
+ * revision. The attempt-fenced operation receipt makes a recovered tool call
+ * converge on the original event instead of manufacturing progress twice.
+ */
 export declare function recordSessionGoalProgressWithEvent(db: Database, workspaceId: string, sessionId: string, input: {
     progressNote: string;
     command: {
@@ -8903,11 +9137,6 @@ export type GoalIdleBackoffPolicy = {
 export type MaterializeGoalContinuationResult = {
     action: "none" | "queue";
     events: [];
-} | {
-    action: "held";
-    events: [];
-    holdTurnId: string;
-    holdUntil: Date;
 } | {
     action: "deferred";
     events: [];
@@ -8944,6 +9173,7 @@ export declare function materializeGoalContinuation(db: Database, input: {
         model: string;
         reasoningEffort: ReasoningEffort;
         latencyMode: LatencyMode;
+        turnExecutionPolicy?: TurnExecutionPolicyV1;
         tools: ToolRef[];
         sandboxBackend: SandboxBackend;
     };
@@ -9189,10 +9419,37 @@ export type SessionWorkPeek = {
 } | {
     kind: "cancellation-wait";
     attemptId: string;
+} | {
+    kind: "input-wait";
+    disposition: "held" | "timeout" | "superseded";
+    waitTurnId: string;
+    deadlineAt: string;
 } | {
     kind: "idle";
 };
 export declare function peekSessionWork(db: Database, workspaceId: string, sessionId: string): Promise<SessionWorkPeek>;
+export type SettleSessionInputWaitResult = {
+    action: "held";
+    events: [];
+    workflowWakeRevision: number;
+} | {
+    action: "timeout";
+    events: SessionEvent[];
+    workflowWakeRevision: number | null;
+} | {
+    action: "superseded";
+    events: SessionEvent[];
+} | {
+    action: "stale";
+    events: [];
+};
+export declare function settleSessionInputWait(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    waitTurnId: string;
+    disposition: "held" | "timeout" | "superseded";
+}): Promise<SettleSessionInputWaitResult>;
 export type FailSessionWorkBeforeAttemptClaimInput = {
     accountId: string;
     sessionId: string;
@@ -9267,6 +9524,13 @@ export type ApplySessionTurnSettlementInput = {
     turnStatus: SessionTurnStatus;
     sessionStatus: SessionStatus;
     activeTurnId: string | null;
+    /**
+     * Finish this terminal turn without arming the active goal's autonomous
+     * continuation. The goal remains active so explicit later work can proceed,
+     * but this exact settlement cannot synthesize another turn from unchanged
+     * input after a bounded terminal condition.
+     */
+    suppressGoalContinuation?: boolean;
     events: AppendEventInput[];
     /**
      * A mid-turn requires_action freeze. Human-input rows and interaction
@@ -9349,7 +9613,8 @@ export type SettleCodexCredentialFailoverResult = {
 } | {
     action: "limit_exceeded";
     failoverCount: number;
-    events: [];
+    maxFailovers: number;
+    events: SessionEvent[];
 };
 export type SettleCodexCredentialLeaseLossResult = {
     action: "recovering";
@@ -9387,11 +9652,13 @@ export declare function settleCodexCredentialLeaseLoss(db: Database, input: {
 /**
  * Atomically settle a definitive Codex credential failover. Conversation
  * history/RunState is persisted by the caller first; this transaction then
- * fences the exact activity lease, increments the bounded same-turn counter,
- * appends both durable events, marks the same turn recoverable, updates the
- * session, and releases the lease together. The exact holder remains provable
- * if its row just expired or was reaped; a successor, redispatch, or closed
- * inference gate makes the caller stale without a second settlement path.
+ * fences the exact activity lease, consumes the quarantine transaction's
+ * bounded same-turn receipt, appends durable recovery or terminal events,
+ * updates the turn/session, and releases the lease together. Exhaustion also
+ * suppresses autonomous goal continuation and enqueues a failed-child notice in
+ * this transaction. The exact holder remains provable if its row just expired
+ * or was reaped; a successor, redispatch, or closed inference gate makes the
+ * caller stale without a second settlement path.
  */
 export declare function settleCodexCredentialFailover(db: Database, input: {
     accountId: string;
@@ -9399,11 +9666,12 @@ export declare function settleCodexCredentialFailover(db: Database, input: {
     sessionId: string;
     turnId: string;
     attemptId: string;
-    holderId: string;
-    generation: number;
+    holderId?: string | null;
+    generation?: number | null;
     expectedRedispatches: number;
     maxFailovers: number;
     recoveryPayload: Record<string, unknown>;
+    failedPayload?: Record<string, unknown>;
 }): Promise<SettleCodexCredentialFailoverResult>;
 export type RequestSessionTurnRecoveryInput = {
     sessionId: string;
@@ -9654,10 +9922,13 @@ export type AddSessionSystemUpdateInput = {
     xaiProviderAccountAuthoritySnapshot?: XaiProviderAccountAuthoritySnapshotV1;
     scheduledTaskRunId?: string | null;
 } & SessionSystemUpdateInputVariant;
-export type AddSessionSystemUpdateResult = {
+export type AddSessionSystemUpdateResult<RequireIdleSession extends boolean = boolean> = {
     added: false;
     reason: "session_cancelled";
-} | {
+} | (RequireIdleSession extends true ? {
+    added: false;
+    reason: "session_not_idle";
+} : never) | {
     added: boolean;
     reason: "added" | "duplicate";
     update: SessionSystemUpdate;
@@ -9670,16 +9941,43 @@ export type AddSessionSystemUpdateResult = {
 export type PrepareSessionSystemUpdateSourceResult = {
     /** Private, bounded, content-free source authority appended before insert. */
     lineage?: Record<string, unknown>;
+    /** Source-owned events appended before the pending-update event. */
+    events?: SessionEvent[];
 };
-export declare function addSessionSystemUpdate(db: Database, input: AddSessionSystemUpdateInput): Promise<AddSessionSystemUpdateResult>;
+export declare function addSessionSystemUpdate(db: Database, input: AddSessionSystemUpdateInput): Promise<AddSessionSystemUpdateResult<false>>;
 /**
  * Persist one internal update without fabricating a user prompt or queue row.
  * Dedupe and any producer/outbox mutation commit in the same transaction.
  */
-export declare function addSessionSystemUpdateWithSourceMutation(db: Database, input: AddSessionSystemUpdateInput, mutateSource: (tx: Database, wakeEventId: string | null, updateId: string | null) => Promise<void>, options?: {
+export declare function addSessionSystemUpdateWithSourceMutation<RequireIdleSession extends boolean = false>(db: Database, input: AddSessionSystemUpdateInput, mutateSource: (tx: Database, wakeEventId: string | null, updateId: string | null, rejectionReason: "session_cancelled" | "session_not_idle" | null) => Promise<void>, options?: {
+    /** Admit only when the already-locked session is at its idle boundary. */
+    requireIdleSession?: RequireIdleSession;
     /** Runs under the locked session/source transaction before any update/event insert. */
     prepareSource?: (tx: Database, sessionId: string) => Promise<PrepareSessionSystemUpdateSourceResult | void>;
-}): Promise<AddSessionSystemUpdateResult>;
+}): Promise<AddSessionSystemUpdateResult<RequireIdleSession>>;
+export type SessionBackgroundCommandTerminalSettlement = {
+    command: SessionBackgroundCommand;
+    events: SessionEvent[];
+};
+export declare function settleConnectedMachineSessionBackgroundCommand(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    commandId: string;
+    controlWorkspaceId: string;
+    enrollmentId: string;
+    connectionInstanceId: string;
+    opId: string;
+    outcome: "exited" | "lost";
+    exitCode: number | null;
+    reason: string;
+}): Promise<SessionBackgroundCommandTerminalSettlement | null>;
+export declare function settleClaimedConnectedMachineBackgroundCommand(db: Database, input: {
+    claim: ConnectedMachineBackgroundCommandClaim;
+}): Promise<{
+    settled: boolean;
+    events: SessionEvent[];
+}>;
 /**
  * One durable machine input by id, under the ordinary workspace RLS scope.
  * The row outlives delivery, so a late bounded projection of an already
@@ -9879,10 +10177,13 @@ export { adoptPackComponentReferences, finalizePackComponentOwnership, listPackI
 export { deferPackInstallationOperation, finalizePackInstallationOperation, finalizePackUninstallOperation, PackManifestChangedError, PackOperationClaimLostError, PackOperationInProgressError, PackInstallationVersionConflictError, PackInstallationVersionRequiredError, PackOperationIdempotencyError, preparePackInstallationOperation, preparePackUninstallOperation, touchPackInstallationOperation, type PreparedPackInstallation, } from "./pack-installations.js";
 export { checkpointPluginPackageOperation, deferPluginPackageOperation, finalizePluginPackageInstall, getInstalledPluginPackage, getPluginPackageUninstallPreview, installPluginMcpReference, listInstalledPluginPackages, PluginInstallationVersionConflictError, PluginInstallationVersionRequiredError, PluginOperationIdempotencyError, preparePluginPackageInstall, uninstallPluginPackage, type InstalledPluginPackage, type InstalledPluginPackageSummary, type PluginBomComponent, type PreparedPluginPackage, } from "./plugin-packages.js";
 export * from "./workspace-artifacts.js";
+export * from "./mcp-oauth.js";
+export * from "./tool-gateway-approvals.js";
 export * from "./transcription-recordings.js";
 export * from "./editable-artifacts.js";
 export * from "./editable-artifact-materialization.js";
 export * from "./attempt-tool-catalogs.js";
+export * from "./model-context-snapshots.js";
 export * from "./codemode-operations.js";
 export * from "./browser-sessions.js";
 export * from "./computer-sessions.js";
@@ -9899,3 +10200,4 @@ export * from "./organization-recovery.js";
 export * from "./session-tenancy.js";
 export * from "./governed-learning-activation.js";
 export * from "./automations.js";
+export * from "./organization-model-providers.js";