@opengeni/db 3.8.2-canary.0 → 4.0.0-canary.0

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { type ChildLifecycleSystemUpdateKind, type ChildRequiresActionRespondedByKind, SessionGoalSnapshot } from "@opengeni/contracts";
-import type { AccessContext, AccessGrant, AccessPrincipalKind, ApiKey, AttemptToolResult, BillingBalance, CapabilityCatalogItem, CapabilityInstallation, CapabilityPack, CapabilitySource, ConnectionKind, ConnectionMetadata, ConnectionStatus, DocumentAuthorityKind, McpServerConnectionRef, FileAsset, FileUploadStatus, FirstPartyMcpToolName, HumanInputQuestion, HumanInputResponse, KnowledgeMemory, KnowledgeMemoryKind, KnowledgeMemoryStatus, KnowledgeSourceRef, GitHubInstallationAuthorityKind, GitHubRepositoryScope, HostEventExportBatch, HostUsageExportBatch, ManagedAccount, ManagedOrganizationMembershipProjection, WorkspaceMemberCandidate, McpPersonalConnectionDelegation, ModelContextContributionSummary, Permission, PersonalResourceAttachmentIntent, PackInstallation, PackInstallationStatus, ResourceRef, SandboxBackend, SandboxOs, ScheduledTask, ScheduledTaskAction, ScheduledTaskActionKind, KnowledgeSourceSyncAction, ScheduledTaskAgentConfig, ScheduledTaskOverlapPolicy, ScheduledTaskRun, ScheduledTaskRunAcceptedExecution as ScheduledTaskRunAcceptedExecutionType, ScheduledTaskRunMode, ScheduledTaskRunStatus, ScheduledTaskScheduleSpec, ScheduledTaskStatus, ScheduledTaskTriggerType, SlackInstallationBinding, Session, SessionAuthorizationListScope, SessionListResponse, SessionEvent, SessionEventPayloadMode, SessionEventReadDirection, SessionEventSemanticClass, SessionEventType, SessionGoal, SessionGoalChangeKind, SessionGoalCreatedBy, SessionGoalMutationPolicy, SessionGoalRevision, SessionGoalStatus, SessionHumanInputRequest, LineageNode, SessionMcpApprovalPolicy, SessionSkill, SessionMcpServerMetadata, SessionStatus, SessionToolPolicy, SessionTurn, SessionQueueSnapshot, SessionSystemUpdate, SessionSystemUpdateKind, SystemUpdateClassification, SessionTurnSource, SessionTurnStatus, TurnInitiator, TurnInitiatorContext, SocialConnection, SocialConnectionStatus, SocialPost, SocialProvider, ToolRef, ReasoningEffort, UsageEvent, Workspace, WorkspaceControlEvent, VariableSet, VariableSetSecret, VariableSetVariableMetadata, WorkspaceMember, WorkspaceMemoryPromptMode, WorkspaceRegisteredPack, Channel, Rig, RigProviderImage, RigProviderImages, RigVersion, RigVerificationHealth, RigChange, RigChangeKind, RigChangeStatus, RigCheck, NativeSnapshotDescriptor, TarWorkspaceArchiveDescriptor, WorkspaceArchiveDescriptor, ModalCheckpointProviderBinding, SandboxProviderContinuityRecovery, WorkClaimSubjectFilter, WorkDiscoveryProjection } from "@opengeni/contracts";
+import type { AccessContext, AccessGrant, AccessPrincipalKind, ApiKey, AttemptToolResult, BillingBalance, CapabilityCatalogItem, CapabilityInstallation, CapabilityPack, CapabilitySource, ConnectionKind, ConnectionMetadata, ConnectionStatus, DocumentAuthorityKind, McpServerConnectionRef, FileAsset, FileUploadStatus, FirstPartyMcpToolName, HumanInputQuestion, HumanInputResponse, KnowledgeMemory, KnowledgeMemoryKind, KnowledgeMemoryStatus, KnowledgeSourceRef, GitHubInstallationAuthorityKind, GitHubRepositoryScope, HostEventExportBatch, HostUsageExportBatch, ManagedAccount, ManagedOrganizationMembershipProjection, WorkspaceMemberCandidate, McpPersonalConnectionDelegation, ModelContextContributionSummary, Permission, PersonalResourceAttachmentIntent, PackInstallation, PackInstallationStatus, ResourceRef, SandboxBackend, SandboxOs, ScheduledTask, ScheduledTaskAction, ScheduledTaskActionKind, KnowledgeSourceSyncAction, ScheduledTaskAgentConfig, ScheduledTaskOverlapPolicy, ScheduledTaskRun, ScheduledTaskRunAcceptedExecution as ScheduledTaskRunAcceptedExecutionType, ScheduledTaskRunMode, ScheduledTaskRunStatus, ScheduledTaskScheduleSpec, ScheduledTaskStatus, ScheduledTaskTriggerType, SlackInstallationBinding, Session, SessionAuthorizationListScope, SessionListResponse, SessionEvent, SessionEventPayloadMode, SessionEventReadDirection, SessionEventSemanticClass, SessionEventType, SessionGoal, SessionGoalChangeKind, SessionGoalCreatedBy, SessionGoalMutationPolicy, SessionGoalRevision, SessionGoalStatus, SessionHumanInputRequest, LineageNode, SessionMcpApprovalPolicy, SessionBackgroundCommand, SessionSkill, SessionMcpServerMetadata, SessionStatus, SessionToolPolicy, SessionTurn, SessionQueueSnapshot, SessionSystemUpdate, SessionSystemUpdateKind, SystemUpdateClassification, SessionTurnSource, SessionTurnStatus, TurnInitiator, TurnInitiatorContext, SocialConnection, SocialConnectionStatus, SocialPost, SocialProvider, ToolRef, ReasoningEffort, UsageEvent, Workspace, WorkspaceControlEvent, VariableSet, VariableSetSecret, VariableSetVariableMetadata, WorkspaceMember, WorkspaceMemoryPromptMode, WorkspaceRegisteredPack, Channel, Rig, RigProviderImage, RigProviderImages, RigVersion, RigVerificationHealth, RigChange, RigChangeKind, RigChangeStatus, RigCheck, NativeSnapshotDescriptor, TarWorkspaceArchiveDescriptor, WorkspaceArchiveDescriptor, ModalCheckpointProviderBinding, SandboxProviderContinuityRecovery, WorkClaimSubjectFilter, WorkDiscoveryProjection } from "@opengeni/contracts";
 import { type WorkspaceArchiveObjectRef, RequestHumanInteractionToolInput, XaiProviderAccountAuthoritySnapshotV1, type TimelineAnnotation } from "@opengeni/contracts";
-import { type LatencyMode, SessionSystemUpdatePayload, TurnExecutionPolicyV1 } from "@opengeni/contracts";
+import { type LatencyMode, SessionSystemUpdatePayload, TurnExecutionPolicyV1, CodexCredentialPolicySnapshotV1 } from "@opengeni/contracts";
 import { type Settings } from "@opengeni/config";
 import { type CodexFetch } from "@opengeni/codex";
 export { isCodexBilledModel } from "@opengeni/codex";
@@ -11,6 +11,7 @@ export { frozenInitiatorForCommandActor, type FrozenTurnInitiator } from "./turn
 export { LOSSLESS_TEXT_PREFIX } from "./lossless-json.js";
 import { type NewSessionDraftSnapshot } from "./new-session-drafts.js";
 import { type SessionDiscoveryControl, type SessionCommandActor, type SessionTurnAttemptOutcome } from "./session-control.js";
+import { type ConnectedMachineBackgroundCommandClaim } from "./session-background-commands.js";
 import { type SessionRealtimeContinuityEntry } from "./session-realtime-context.js";
 import * as schema from "./schema.js";
 export { sql as dbSql } from "drizzle-orm";
@@ -3683,6 +3684,10 @@ export type WorkspaceCodexSubscriptionSource = {
     organizationAvailable: boolean;
 };
 export declare function getWorkspaceCodexSubscriptionSource(db: Database, workspaceId: string): Promise<WorkspaceCodexSubscriptionSource>;
+export declare class CodexSubscriptionSourceChangeBlockedError extends Error {
+    readonly code = "codex_subscription_source_change_blocked";
+    constructor();
+}
 export declare function setWorkspaceCodexSubscriptionModeInTransaction(scopedDb: Database, input: {
     accountId: string;
     workspaceId: string;
@@ -3935,7 +3940,7 @@ export declare function getCodexCredentialStatus(db: Database, workspaceId: stri
  * decide whether to inject the synthetic codex-subscription provider, so billing
  * and provider-injection cannot drift. Metadata-only read (never the secret).
  */
-export declare function workspaceCodexSubscriptionActive(db: Database, settings: Pick<Settings, "codexSubscriptionEnabled" | "codexCredentialLeasingEnabled">, workspaceId: string): Promise<boolean>;
+export declare function workspaceCodexSubscriptionActive(db: Database, settings: Pick<Settings, "codexSubscriptionEnabled">, workspaceId: string): Promise<boolean>;
 /**
  * CANONICAL "is this a Codex-billed turn?" predicate.
  *
@@ -3951,7 +3956,7 @@ export declare function workspaceCodexSubscriptionActive(db: Database, settings:
  */
 export declare function isCodexBilledTurn(input: {
     db: Database;
-    settings: Pick<Settings, "codexSubscriptionEnabled" | "codexCredentialLeasingEnabled">;
+    settings: Pick<Settings, "codexSubscriptionEnabled">;
     workspaceId: string;
     model: string | null | undefined;
     /**
@@ -4023,15 +4028,25 @@ export type CodexCredentialLeaseCandidateFilter<TPolicyScope, TUnavailableDiagno
     accounts: readonly CodexLeaseAccountStatus[];
     policyScope: TPolicyScope | null;
 }) => readonly CodexLeaseAccountStatus[] | CodexCredentialLeaseCandidateFilterResult<TUnavailableDiagnostic>;
+/**
+ * Codex session state read from the exact session row locked by credential
+ * acquisition. Selection and pointer movement must use this snapshot rather
+ * than an unlocked read taken before the allocator transaction.
+ */
+export type CodexCredentialLeaseSessionState = {
+    pinnedCredentialId: string | null;
+    pinSource: "manual" | "policy" | null;
+    lastCredentialId: string | null;
+};
 export type CodexCredentialLeaseSelectionContext<TPolicyScope = never, TUnavailableDiagnostic = never> = {
     accounts: CodexLeaseAccountStatus[];
     activeCredentialId: string | null;
     rotationEnabled: boolean;
-    /** Workspace cutover fence. False means the additive lease table stays inert. */
-    leaseRotationEnabled: boolean;
     rotationStrategy: string;
     /** A still-live idempotent lease for this SAME turn, if one exists. */
     existingCredentialId: string | null;
+    /** Credentials already consumed by a definitive refusal on this accepted turn. */
+    failedCredentialIds?: readonly string[];
     /** Downstream-owned accepted-turn policy; absent until a resolver is supplied. */
     policyScope: TPolicyScope | null;
     /** Diagnostics produced while choosing one policy scope for this NEW allocation. */
@@ -4049,6 +4064,14 @@ export type CodexCredentialLeaseResult<T, TUnavailableDiagnostic = never> = {
     activeCredentialId: string | null;
     rotationEnabled: boolean;
     rotationStrategy: string;
+    /** Session state from the row locked during this acquisition. */
+    sessionCodexState: CodexCredentialLeaseSessionState;
+    /** Number of effective-pool rows before any downstream policy filter. */
+    poolAccountCount: number;
+    /** Accepted allocator policy captured with the first durable lease. */
+    codexPolicySnapshot: CodexCredentialPolicySnapshotV1 | null;
+    /** True when this acquisition reused a snapshot already present on the turn. */
+    codexPolicySnapshotReused: boolean;
     credentialId: string | null;
     reused: boolean;
     holderId: string | null;
@@ -4057,7 +4080,19 @@ export type CodexCredentialLeaseResult<T, TUnavailableDiagnostic = never> = {
     unavailableDiagnostics: readonly TUnavailableDiagnostic[];
     /** Final selector decision after input policy and manual/policy pin handling. */
     advanceActivePointer: boolean;
+    /** Frozen alternate-account budget observed before the first provider request. */
+    failoverLimit: number;
 };
+export declare class CodexCredentialLeaseAttemptFencedError extends Error {
+    readonly code = "codex_credential_lease_attempt_fenced";
+    constructor();
+}
+export declare class CodexCredentialFailoverExhaustedError extends Error {
+    readonly failoverCount: number;
+    readonly maxFailovers: number;
+    readonly code = "codex_credential_failover_exhausted";
+    constructor(failoverCount: number, maxFailovers: number);
+}
 /**
  * Five minutes is deliberately much longer than the one-minute heartbeat and
  * much shorter than a five-hour allowance window. A killed worker therefore
@@ -4082,7 +4117,14 @@ export declare const CODEX_CREDENTIAL_LEASE_TTL_MS: number;
 export declare function acquireCodexCredentialLease<T, TPolicyScope = never, TUnavailableDiagnostic = never>(db: Database, input: {
     accountId: string;
     workspaceId: string;
+    sessionId: string;
     turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+    workflowId: string;
+    workflowRunId: string;
+    dispatchId: string;
+    expectedRedispatches: number;
     /** Unique Temporal/local activity execution id used as the zombie fence. */
     holderId: string;
     /** Pins must not move the workspace-global cursor. */
@@ -4100,9 +4142,9 @@ export declare function acquireCodexCredentialLease<T, TPolicyScope = never, TUn
      */
     filterNewAllocationCandidates?: CodexCredentialLeaseCandidateFilter<TPolicyScope, TUnavailableDiagnostic>;
     leaseTtlMs?: number;
-}, select: (context: CodexCredentialLeaseSelectionContext<TPolicyScope, TUnavailableDiagnostic>) => CodexCredentialLeaseSelection<T>): Promise<CodexCredentialLeaseResult<T, TUnavailableDiagnostic>>;
+}, select: (context: CodexCredentialLeaseSelectionContext<TPolicyScope, TUnavailableDiagnostic>, sessionCodexState: CodexCredentialLeaseSessionState) => CodexCredentialLeaseSelection<T>): Promise<CodexCredentialLeaseResult<T, TUnavailableDiagnostic>>;
 export type CodexCapacityWaitStatus = "waiting" | "resumed" | "superseded";
-export type CodexCapacityResetKind = "authoritative" | "bounded_refresh";
+export type CodexCapacityResetKind = "authoritative" | "bounded_refresh" | "mutation_only";
 export type CodexCapacityWait = {
     id: string;
     accountId: string;
@@ -4198,7 +4240,8 @@ export declare const CODEX_CAPACITY_REFRESH_MAX_MS: number;
 export declare function codexCapacityRefreshBackoffMs(attempt: number): number;
 /**
  * Atomically close one all-unavailable attempt and arm exactly one durable wait
- * for the same logical turn. Lock order is allocator rotation row -> workspace
+ * for the same logical turn. Lock order is workspace source advisory -> allocator
+ * rotation row -> workspace
  * control -> actual workspace -> session -> exact turn -> exact attempt ->
  * optional goal -> live lease (when a reactive failure owns one) -> waiter.
  * The waiting turn/session pointer, durable events, exact lease release, and
@@ -4265,6 +4308,8 @@ export declare function reconcileCodexCapacityWait<TPolicyScope = never, TUnavai
     waiterId: string;
     generation: number;
     now?: Date;
+    /** True only after the caller performed the due bounded metadata refresh. */
+    boundedRefreshAttempted?: boolean;
 }, decide: (context: CodexCapacitySelectionContext<TPolicyScope, TUnavailableDiagnostic>) => CodexCapacityAvailabilityDecision, policy?: {
     resolvePolicyScope?: CodexCredentialLeasePolicyScopeResolver<TPolicyScope>;
     filterNewAllocationCandidates?: CodexCredentialLeaseCandidateFilter<TPolicyScope, TUnavailableDiagnostic>;
@@ -4368,7 +4413,8 @@ export declare function reconcileXaiCapacityWait(db: Database, input: {
  * Extend a live holder and return the database-confirmed expiry. A
  * missing/expired/released row returns null. A successful result lets the worker
  * derive a conservative monotonic deadline from the request start and configured
- * TTL, without comparing the Postgres and worker wall clocks.
+ * TTL, without comparing the Postgres and worker wall clocks; the worker still
+ * rejects a response that returns after its prior confirmed deadline.
  */
 export declare function heartbeatCodexCredentialLeaseUntil(db: Database, accountId: string, workspaceId: string, turnId: string, holderId: string, generation: number, leaseTtlMs?: number): Promise<Date | null>;
 /** Extend a live holder. Compatibility wrapper for boolean-only callers. */
@@ -4384,20 +4430,46 @@ export type CodexCredentialLeaseQuarantine = {
     until: Date;
     cooldownKind: CodexCredentialCooldownKind;
 };
+export type CodexCredentialLeaseQuarantineResult = {
+    action: "recorded";
+    failoverCount: number;
+    maxFailovers: number;
+    exhausted: boolean;
+} | {
+    action: "credential_changed";
+    failoverCount: number;
+    maxFailovers: number;
+    currentCredentialVersion: number;
+} | {
+    action: "stale";
+    failoverCount: number;
+    maxFailovers: number;
+};
 /**
- * Quarantine the credential served by one exact live holder. The lease row is
- * locked and checked before the credential write, so a superseded/expired
- * activity cannot poison status or cooldown after a successor owns the turn.
+ * Quarantine the credential served by one exact live attempt and token family.
+ * The attempt, dispatch, lease, and credential version are checked before the
+ * write. The same transaction freezes the accepted turn's alternate budget and
+ * records the attempted credential, so waiter/database recovery cannot reset
+ * accounting or return to an already-consumed account under rotation policy.
  */
 export declare function quarantineCodexCredentialForLease(db: Database, input: {
     accountId: string;
     workspaceId: string;
+    sessionId: string;
     turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+    workflowId: string;
+    workflowRunId: string;
+    dispatchId: string;
+    expectedRedispatches: number;
     credentialId: string;
+    credentialVersion: number;
     holderId: string;
     generation: number;
+    maxFailovers: number;
     quarantine: CodexCredentialLeaseQuarantine;
-}): Promise<boolean>;
+}): Promise<CodexCredentialLeaseQuarantineResult>;
 /**
  * Metadata-only list of every connected Codex account in the workspace, for the
  * accounts UI + the worker's selection resolver. NEVER decrypts. `isActive` marks
@@ -4600,10 +4672,8 @@ export declare function recordCodexAccountUsage(db: Database, workspaceId: strin
 export declare function recordCodexAccountUsageWithWakeTargets(db: Database, workspaceId: string, credentialId: string, snapshot: CodexAccountUsageSnapshot): Promise<CodexCapacityMutationResult<boolean>>;
 export type CodexRotationSettings = {
     activeCredentialId: string | null;
-    /** Legacy selector bit; old binaries only understand this field. */
+    /** False keeps new allocations on the active account; true permits pool failover. */
     rotationEnabled: boolean;
-    /** New allocator cutover bit; ignored safely by old binaries. */
-    leaseRotationEnabled: boolean;
     rotationStrategy: string;
 };
 /**
@@ -4655,20 +4725,6 @@ export declare function setInitialActiveCodexCredential(db: Database, workspaceI
 export declare function setCodexCredentialExhausted(db: Database, workspaceId: string, credentialId: string, until: Date | null, cooldownKind: CodexCredentialCooldownKind | null): Promise<boolean>;
 /** Cooldown mutation plus its committed durable capacity-wake outbox. */
 export declare function setCodexCredentialExhaustedWithWakeTargets(db: Database, workspaceId: string, credentialId: string, until: Date | null, cooldownKind: CodexCredentialCooldownKind | null): Promise<CodexCapacityMutationResult<boolean>>;
-/**
- * P3 reactive-rotation boundedness (Finding 1b): the number of CONSECUTIVE rotated
- * 429-failover turns since the session last had a SUCCESSFUL turn. Counts
- * `turn.failed` events carrying the `rotated` marker that occurred AFTER the most
- * recent `turn.completed` event (the natural reset anchor — any successful turn
- * moves the anchor past every prior failover, so the streak resets to 0). The
- * reactive 429 catch consults this to bound its otherwise-0-delay re-dispatch:
- * once the streak exceeds ~(connected accounts + margin) the path degrades to a
- * fixed positive idle instead of another hot re-dispatch (invariant 4: NO THRASH),
- * covering the double-fault where a cooldown write did not persist AND the 429
- * carried no usage headers. Derived from persisted events so it is correct across
- * the Temporal re-dispatch (each failover is a NEW turn, but its event survives).
- */
-export declare function countConsecutiveReactiveRotations(db: Database, workspaceId: string, sessionId: string): Promise<number>;
 /** The supported rotation strategies (P3). */
 export declare const CODEX_ROTATION_STRATEGIES: readonly ["most_remaining", "round_robin", "drain_then_next", "sharded"];
 export type CodexRotationStrategy = (typeof CODEX_ROTATION_STRATEGIES)[number];
@@ -4864,6 +4920,8 @@ export declare function ensureConnectorActionPolicyDefault(db: Database, input:
     changed: boolean;
 }>;
 export declare function prepareConnectorActionApproval(db: Database, identity: ConnectorActionAttemptIdentity, invocation: ConnectorActionInvocation): Promise<PrepareConnectorActionApprovalResult>;
+/** Resolve the frozen connector policy without creating approval or audit state. */
+export declare function previewConnectorActionApproval(db: Database, identity: ConnectorActionAttemptIdentity, invocation: ConnectorActionInvocation): Promise<PrepareConnectorActionApprovalResult>;
 export declare function beginConnectorActionExecution(db: Database, identity: ConnectorActionAttemptIdentity, invocation: ConnectorActionInvocation): Promise<BeginConnectorActionExecutionResult>;
 export declare function completeConnectorActionExecution(db: Database, input: {
     accountId: string;
@@ -5164,7 +5222,7 @@ type SessionTreeStats = NonNullable<Session["treeStats"]>;
 export declare function projectEffectiveControlForRelatedAccess(control: Session["effectiveControl"], sessionId: string, access: "target" | "root"): Session["effectiveControl"];
 /**
  * Remove metadata derived from sessions other than the exact authorized
- * target, including parent identity and descendant counts.
+ * target, including parent identity, policy provenance, and descendant counts.
  */
 export declare function projectSessionForRelatedAccess(session: Session, access: "target" | "root"): Session;
 /**
@@ -5345,7 +5403,8 @@ export declare function listSessionDiscoverySummaries(db: Database, workspaceId:
     recentHours?: number;
     subject?: WorkClaimSubjectFilter;
     claimLimit?: number;
-    /** Skip advisory claim reads for an operator-disabled discovery rollout. */
+    /** Skip advisory claim reads on plain MCP browse or an operator-disabled rollout.
+     * Omitted retains the REST/UI legacy evidence default. */
     includeWorkDiscovery?: boolean;
     subjectId?: string;
     authorizationScope?: SessionAuthorizationListScope;
@@ -5477,6 +5536,18 @@ export declare function getWorkspaceControlEvent(db: Database, workspaceId: stri
  * a session, while the workspace predicate remains the tenancy boundary.
  */
 export declare function getSessionEventByClientEventId(db: Database, workspaceId: string, sessionId: string, clientEventId: string): Promise<SessionEvent | null>;
+/**
+ * Resolve the visible creation event for one exact tool operation. This is a
+ * rolling-upgrade compatibility lookup for producers that predate deterministic
+ * client event ids; the operation id remains bound to the same turn attempt.
+ */
+export declare function getSessionToolCallCreatedEventByOperationId(db: Database, input: {
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    attemptId: string;
+    operationId: string;
+}): Promise<SessionEvent | null>;
 export declare const APPROVAL_RUN_STATE_MAX_JSON_BYTES: number;
 export declare const APPROVAL_RUN_STATE_MAX_JSON_NODES = 65536;
 export declare const APPROVAL_RUN_STATE_MAX_JSON_PROPERTIES = 32768;
@@ -5608,6 +5679,34 @@ export declare function adoptConnectedMachineSessionBackgroundCommand(db: Databa
     settledAt: string | null;
     updatedAt: string;
 }>;
+/** Transfer one exact managed retained process from a live turn attempt to its
+ * session. Retaining the provider process and backgrounding it are deliberately
+ * separate: a provider yield only preserves physical ownership; this adoption
+ * occurs immediately before the running receipt becomes model-visible. */
+export declare function adoptManagedSessionBackgroundCommand(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    executionGeneration: number;
+    attemptId: string;
+    processId: string;
+    expected: SandboxRetainedProcessIdentity;
+    command: string;
+}): Promise<{
+    id: string;
+    workspaceId: string;
+    sessionId: string;
+    provider: "connected_machine" | "managed";
+    state: "exited" | "lost" | "running" | "stopping";
+    commandPreview: string;
+    cancelRequestedAt: string | null;
+    exitCode: number | null;
+    settlementReason: string | null;
+    startedAt: string;
+    settledAt: string | null;
+    updatedAt: string;
+}>;
 export type InstallOrReadTurnExecutionPolicyForAttemptResult = {
     accepted: true;
     installed: boolean;
@@ -7472,8 +7571,9 @@ export declare function deferRetainedProcessReconciliation(db: Database, input:
 export declare function countActiveRetainedProcessesByOwnerState(db: Database): Promise<ActiveRetainedProcessOwnerCount[]>;
 export declare function countExpiredDrainingSandboxLeases(db: Database): Promise<ExpiredDrainingSandboxLeaseCount[]>;
 /** Settle an exact retained process only after exit or definitive loss proof.
- * The process row, parent admission, non-TTL holder, and lease count transition
- * commit atomically. A duplicate terminal state + exit code is idempotent and
+ * The process row, parent admission, non-TTL holder, lease count, and any
+ * linked background-command terminal input commit atomically. A duplicate
+ * terminal state + exit code is idempotent and
  * preserves the first durable evidence reason; contradictory physical truth
  * fails closed. */
 export declare function settleRetainedProcess(db: Database, input: {
@@ -7490,6 +7590,7 @@ export declare function settleRetainedProcess(db: Database, input: {
 }): Promise<{
     settled: boolean;
     process: SandboxRetainedProcess;
+    backgroundCommandEvents: SessionEvent[];
 }>;
 /** Read the exact generation a verified capture must later fold. This is a
  * preflight only: persistWarmSnapshot/persistDrainSnapshot repeat the full
@@ -8714,6 +8815,9 @@ export type CreateSessionGoalInput = {
 };
 export declare function createSessionGoal(db: Database, input: CreateSessionGoalInput): Promise<SessionGoal>;
 export declare function getSessionGoal(db: Database, workspaceId: string, sessionId: string): Promise<SessionGoal | null>;
+/** Bounded MCP management facts. No config, goal metadata, or event payload is materialized.
+ * The caller must authorize session.read first, just as for getSession/queue reads. */
+export declare function getSessionMcpMonitoringSummary(db: Database, workspaceId: string, sessionId: string): Promise<import("@opengeni/contracts").SessionMcpMonitoringSource>;
 export type SessionGoalContinuationProjection = {
     state: "inactive" | "scheduled" | "running" | "blocked" | "invariant_broken";
     reason: "goal_inactive" | "wake_pending" | "continuation_pending" | "human_work_pending" | "goal_turn_running" | "human_turn_running" | "workstream_paused" | "approval_required" | "provider_backpressure" | "session_cancelled" | "system_work_pending" | "held_for_input" | "backoff_pending" | "missing_obligation";
@@ -8721,7 +8825,7 @@ export type SessionGoalContinuationProjection = {
     observedRevision: number;
     nextAttemptAt: string | null;
     lastError: string | null;
-    /** The agent's stated `goal_wait` reason while `held_for_input`; null otherwise. */
+    /** The agent's stated `wait_for_input` reason while held; null otherwise. */
     holdReason: string | null;
 };
 /**
@@ -8841,34 +8945,19 @@ export declare function updateSessionGoalWithEvent(db: Database, workspaceId: st
     outcome: "applied" | "proposed";
     proposalId: string | null;
 }>;
+/** Maximum relative duration accepted by the session-level out-of-turn wait. */
+export declare const SESSION_INPUT_WAIT_MIN_SECONDS = 30;
+export declare const SESSION_INPUT_WAIT_MAX_SECONDS: number;
+export declare const SESSION_INPUT_WAIT_REASON_MAX_BYTES: number;
 /**
- * Record execution progress without changing goal semantics or either goal
- * revision. The attempt-fenced operation receipt makes a recovered tool call
- * converge on the original event instead of manufacturing progress twice.
- */
-/**
- * Column set that retires an agent-declared `goal_wait` hold. Spread into every
- * goal head mutation (status transition, applied semantic revision, replace) so
- * newer truth never sits behind an older wait.
+ * Agent `wait_for_input`: persist one session-owned, self-only out-of-turn
+ * wait. The exact declaring turn and absolute deadline are causal authority;
+ * Temporal/NATS are replaceable wake hints. A replacement attempt replaying
+ * the same target-scoped operation key receives the committed result.
  */
-export declare const SESSION_GOAL_HOLD_MIN_SECONDS = 30;
-export declare const SESSION_GOAL_HOLD_MAX_SECONDS: number;
-/**
- * Agent `goal_wait`: record that the active goal's next continuation should
- * wait for child results, a message, a human prompt, or the deadline instead of
- * materializing immediately after the declaring turn ends.
- *
- * The hold is bound to the exact caller turn. The materializer honors it only
- * while that turn is still the latest finished turn and `now < until`; it
- * never consumes the wake/observed revision ledger. The receipt, goal
- * mutation, and `goal.held` timeline fact commit under the canonical goal
- * event-write prefix (control FOR SHARE -> workspace FOR KEY SHARE -> session
- * FOR NO KEY UPDATE), never a workspace FOR UPDATE. A replacement attempt
- * replaying the same target-scoped operation key receives the stored result.
- */
-export declare function holdSessionGoalContinuationWithEvent(db: Database, workspaceId: string, sessionId: string, input: {
+export declare function waitForSessionInputWithEvent(db: Database, workspaceId: string, sessionId: string, input: {
     reason: string;
-    untilSeconds: number;
+    timeoutSeconds: number;
     command: {
         accountId: string;
         actor: Extract<SessionCommandActor, {
@@ -8877,13 +8966,17 @@ export declare function holdSessionGoalContinuationWithEvent(db: Database, works
         operationKey: string;
     };
 }): Promise<{
-    goal: SessionGoal;
     events: SessionEvent[];
     operationId: string;
     replay: boolean;
-    holdTurnId: string;
-    untilAt: string;
+    waitTurnId: string;
+    deadlineAt: string;
 }>;
+/**
+ * Record execution progress without changing goal semantics or either goal
+ * revision. The attempt-fenced operation receipt makes a recovered tool call
+ * converge on the original event instead of manufacturing progress twice.
+ */
 export declare function recordSessionGoalProgressWithEvent(db: Database, workspaceId: string, sessionId: string, input: {
     progressNote: string;
     command: {
@@ -9044,11 +9137,6 @@ export type GoalIdleBackoffPolicy = {
 export type MaterializeGoalContinuationResult = {
     action: "none" | "queue";
     events: [];
-} | {
-    action: "held";
-    events: [];
-    holdTurnId: string;
-    holdUntil: Date;
 } | {
     action: "deferred";
     events: [];
@@ -9331,10 +9419,37 @@ export type SessionWorkPeek = {
 } | {
     kind: "cancellation-wait";
     attemptId: string;
+} | {
+    kind: "input-wait";
+    disposition: "held" | "timeout" | "superseded";
+    waitTurnId: string;
+    deadlineAt: string;
 } | {
     kind: "idle";
 };
 export declare function peekSessionWork(db: Database, workspaceId: string, sessionId: string): Promise<SessionWorkPeek>;
+export type SettleSessionInputWaitResult = {
+    action: "held";
+    events: [];
+    workflowWakeRevision: number;
+} | {
+    action: "timeout";
+    events: SessionEvent[];
+    workflowWakeRevision: number | null;
+} | {
+    action: "superseded";
+    events: SessionEvent[];
+} | {
+    action: "stale";
+    events: [];
+};
+export declare function settleSessionInputWait(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    waitTurnId: string;
+    disposition: "held" | "timeout" | "superseded";
+}): Promise<SettleSessionInputWaitResult>;
 export type FailSessionWorkBeforeAttemptClaimInput = {
     accountId: string;
     sessionId: string;
@@ -9409,6 +9524,13 @@ export type ApplySessionTurnSettlementInput = {
     turnStatus: SessionTurnStatus;
     sessionStatus: SessionStatus;
     activeTurnId: string | null;
+    /**
+     * Finish this terminal turn without arming the active goal's autonomous
+     * continuation. The goal remains active so explicit later work can proceed,
+     * but this exact settlement cannot synthesize another turn from unchanged
+     * input after a bounded terminal condition.
+     */
+    suppressGoalContinuation?: boolean;
     events: AppendEventInput[];
     /**
      * A mid-turn requires_action freeze. Human-input rows and interaction
@@ -9491,7 +9613,8 @@ export type SettleCodexCredentialFailoverResult = {
 } | {
     action: "limit_exceeded";
     failoverCount: number;
-    events: [];
+    maxFailovers: number;
+    events: SessionEvent[];
 };
 export type SettleCodexCredentialLeaseLossResult = {
     action: "recovering";
@@ -9529,11 +9652,13 @@ export declare function settleCodexCredentialLeaseLoss(db: Database, input: {
 /**
  * Atomically settle a definitive Codex credential failover. Conversation
  * history/RunState is persisted by the caller first; this transaction then
- * fences the exact activity lease, increments the bounded same-turn counter,
- * appends both durable events, marks the same turn recoverable, updates the
- * session, and releases the lease together. The exact holder remains provable
- * if its row just expired or was reaped; a successor, redispatch, or closed
- * inference gate makes the caller stale without a second settlement path.
+ * fences the exact activity lease, consumes the quarantine transaction's
+ * bounded same-turn receipt, appends durable recovery or terminal events,
+ * updates the turn/session, and releases the lease together. Exhaustion also
+ * suppresses autonomous goal continuation and enqueues a failed-child notice in
+ * this transaction. The exact holder remains provable if its row just expired
+ * or was reaped; a successor, redispatch, or closed inference gate makes the
+ * caller stale without a second settlement path.
  */
 export declare function settleCodexCredentialFailover(db: Database, input: {
     accountId: string;
@@ -9541,11 +9666,12 @@ export declare function settleCodexCredentialFailover(db: Database, input: {
     sessionId: string;
     turnId: string;
     attemptId: string;
-    holderId: string;
-    generation: number;
+    holderId?: string | null;
+    generation?: number | null;
     expectedRedispatches: number;
     maxFailovers: number;
     recoveryPayload: Record<string, unknown>;
+    failedPayload?: Record<string, unknown>;
 }): Promise<SettleCodexCredentialFailoverResult>;
 export type RequestSessionTurnRecoveryInput = {
     sessionId: string;
@@ -9829,6 +9955,29 @@ export declare function addSessionSystemUpdateWithSourceMutation<RequireIdleSess
     /** Runs under the locked session/source transaction before any update/event insert. */
     prepareSource?: (tx: Database, sessionId: string) => Promise<PrepareSessionSystemUpdateSourceResult | void>;
 }): Promise<AddSessionSystemUpdateResult<RequireIdleSession>>;
+export type SessionBackgroundCommandTerminalSettlement = {
+    command: SessionBackgroundCommand;
+    events: SessionEvent[];
+};
+export declare function settleConnectedMachineSessionBackgroundCommand(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    commandId: string;
+    controlWorkspaceId: string;
+    enrollmentId: string;
+    connectionInstanceId: string;
+    opId: string;
+    outcome: "exited" | "lost";
+    exitCode: number | null;
+    reason: string;
+}): Promise<SessionBackgroundCommandTerminalSettlement | null>;
+export declare function settleClaimedConnectedMachineBackgroundCommand(db: Database, input: {
+    claim: ConnectedMachineBackgroundCommandClaim;
+}): Promise<{
+    settled: boolean;
+    events: SessionEvent[];
+}>;
 /**
  * One durable machine input by id, under the ordinary workspace RLS scope.
  * The row outlives delivery, so a late bounded projection of an already
@@ -10028,10 +10177,13 @@ export { adoptPackComponentReferences, finalizePackComponentOwnership, listPackI
 export { deferPackInstallationOperation, finalizePackInstallationOperation, finalizePackUninstallOperation, PackManifestChangedError, PackOperationClaimLostError, PackOperationInProgressError, PackInstallationVersionConflictError, PackInstallationVersionRequiredError, PackOperationIdempotencyError, preparePackInstallationOperation, preparePackUninstallOperation, touchPackInstallationOperation, type PreparedPackInstallation, } from "./pack-installations.js";
 export { checkpointPluginPackageOperation, deferPluginPackageOperation, finalizePluginPackageInstall, getInstalledPluginPackage, getPluginPackageUninstallPreview, installPluginMcpReference, listInstalledPluginPackages, PluginInstallationVersionConflictError, PluginInstallationVersionRequiredError, PluginOperationIdempotencyError, preparePluginPackageInstall, uninstallPluginPackage, type InstalledPluginPackage, type InstalledPluginPackageSummary, type PluginBomComponent, type PreparedPluginPackage, } from "./plugin-packages.js";
 export * from "./workspace-artifacts.js";
+export * from "./mcp-oauth.js";
+export * from "./tool-gateway-approvals.js";
 export * from "./transcription-recordings.js";
 export * from "./editable-artifacts.js";
 export * from "./editable-artifact-materialization.js";
 export * from "./attempt-tool-catalogs.js";
+export * from "./model-context-snapshots.js";
 export * from "./codemode-operations.js";
 export * from "./browser-sessions.js";
 export * from "./computer-sessions.js";