@opengeni/db 5.0.1 → 6.0.0

package/dist/index.d.ts

@@ -1,3 +1,29 @@
+export { acceptSessionFileAttachments, readSessionFileAttachments, type SessionAttachmentReadAccess, } from "./session-file-attachments.js";
+import { SandboxRecoveryResponse, type SandboxRecoveryProjection, type SandboxRecoveryRequest, ModalRouterProviderCommand } from "@opengeni/contracts";
+import { type ConfigurationEffort } from "@opengeni/codex";
+export { getSessionAttemptMcpApprovalPolicies } from "./session-mcp-approval.js";
+export { SessionRetryConflictError, getSessionRetryReceiptInTransaction } from "./session-retry.js";
+import { retainedProviderCommandPersistence as retainedProviderCommandState } from "./retained-provider-commands.js";
+export declare const retryFailedSessionInTransaction: (db: SessionActivityDatabase, input: Parameters<(db: SessionActivityDatabase, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    subjectId: string;
+    request: import("@opengeni/contracts").SessionRetryRequest;
+    executionPolicy: TurnExecutionPolicyV1;
+}, sessionEffectiveSandboxRecoveryBlocked: (db: Database, session: typeof schema.sessions.$inferSelect) => Promise<boolean>) => Promise<import("@opengeni/contracts").SessionRetryResponse & {
+    eventIds: string[];
+}>>[1]) => Promise<{
+    outcome: "accepted" | "replayed";
+    turnId: string;
+    failureEventId: string;
+} & {
+    eventIds: string[];
+}>;
+import { type SessionAdmissionFence, StoredSessionAdmissionBlock } from "./session-admission-block.js";
+export type { SessionAdmissionFence, StoredSessionAdmissionBlock } from "./session-admission-block.js";
+import { SessionMessageSearchRequest, type SessionMessageSearchResponse } from "@opengeni/contracts";
+export { SessionMessageSearchCursorError } from "./session-message-search.js";
 export * from "./artifact-catalog.js";
 export { grantWorkspaceAccess, listWorkspaceMembers } from "./workspace-membership-access.js";
 import { codexSelectionDiagnostics } from "./codex-selection-diagnostics.js";
@@ -5,20 +31,19 @@ export { codexSelectionDiagnostics } from "./codex-selection-diagnostics.js";
 import { type ModelConnectionAccess, type ModelConnectionTarget } from "./model-connection-access.js";
 export { assertModelConnectionAllowsTurn, modelAllowedByConnections, type ConnectionModelRestrictions, } from "./workspace-model-connection-access.js";
 export * from "./model-connection-access.js";
+import { type ReportArtifactActor } from "./session-goal-reports.js";
+export { recordNativeDocumentInspection } from "./session-goal-reports.js";
+import { type SessionGoalReportRequirement, type SessionGoalReportDelivery } from "@opengeni/contracts";
 import { type BundledSkillId } from "@opengeni/contracts";
 import { type SkillSourceReleaseReceipt } from "./skill-source-release.js";
 import type { SkillActor, SkillWriteReceipt } from "@opengeni/contracts";
-import { type HostMcpCreateSelection } from "./host-selection-identity.js";
 export * from "./connect-attempts.js";
 export * from "./external-identities.js";
 export * from "./external-identity-links.js";
 export * from "./connection-setup-authority.js";
 export * from "./external-link-work.js";
-export * from "./host-mcp-bindings.js";
-export * from "./host-mcp-resolvers.js";
-export * from "./host-mcp-task-authority.js";
 import { type ChildLifecycleSystemUpdateKind, type ChildRequiresActionRespondedByKind, SessionGoalSnapshot } from "@opengeni/contracts";
-import type { AccessContext, AccessGrant, AccessPrincipalKind, ApiKey, AttemptToolResult, BillingBalance, CapabilityCatalogItem, CapabilityInstallation, CapabilityPack, CapabilitySource, ConnectionKind, ConnectionMetadata, ConnectionStatus, DocumentAuthorityKind, McpServerConnectionRef, FileAsset, FileUploadStatus, FirstPartyMcpToolName, HumanInputQuestion, HumanInputResponse, KnowledgeMemory, KnowledgeMemoryKind, KnowledgeMemoryStatus, KnowledgeSourceRef, GitHubInstallationAuthorityKind, GitHubRepositoryScope, HostEventExportBatch, HostUsageExportBatch, ManagedAccount, ManagedOrganizationMembershipProjection, WorkspaceMemberCandidate, McpPersonalConnectionDelegation, ModelContextContributionSummary, Permission, PersonalResourceAttachmentIntent, PackInstallation, PackInstallationStatus, ResourceRef, SandboxBackend, SandboxOs, ScheduledTask, ScheduledTaskAction, ScheduledTaskActionKind, ScheduledTaskAgentConfig, ScheduledTaskOverlapPolicy, ScheduledTaskRun, ScheduledTaskRunAcceptedExecution as ScheduledTaskRunAcceptedExecutionType, ScheduledTaskRunMode, ScheduledTaskRunStatus, ScheduledTaskScheduleSpec, ScheduledTaskStatus, ScheduledTaskTriggerType, SlackInstallationBinding, Session, SessionAgentAccess, SessionAgentAccessViewer, SessionAuthorizationListScope, SessionScopeSubjectId, SessionMemoryScope, SessionListResponse, SessionEvent, SessionEventPayloadMode, SessionEventReadDirection, SessionEventSemanticClass, SessionEventType, SessionGoal, SessionGoalChangeKind, SessionGoalCreatedBy, SessionGoalMutationPolicy, SessionGoalRevision, SessionGoalStatus, SessionHumanInputRequest, LineageNode, SessionMcpApprovalPolicy, SessionBackgroundCommand, SessionSkill, SessionMcpServerMetadata, SessionStatus, SessionToolPolicy, SessionTurn, SessionQueueSnapshot, SessionSystemUpdate, SessionSystemUpdateKind, SystemUpdateClassification, SessionTurnSource, SessionTurnStatus, TurnInitiator, TurnInitiatorContext, SocialConnection, SocialConnectionStatus, SocialPost, SocialProvider, ToolRef, ReasoningEffort, UsageEvent, Workspace, WorkspaceMember, WorkspaceControlEvent, VariableSet, VariableSetSecret, VariableSetVariableMetadata, WorkspaceMemoryPromptMode, WorkspaceRegisteredPack, Channel, Rig, RigProviderImage, RigProviderImages, RigVersion, RigVerificationHealth, RigChange, RigChangeKind, RigChangeStatus, RigCheck, NativeSnapshotDescriptor, TarWorkspaceArchiveDescriptor, WorkspaceArchiveDescriptor, ModalCheckpointProviderBinding, SandboxProviderContinuityRecovery, WorkClaimSubjectFilter, WorkDiscoveryProjection } from "@opengeni/contracts";
+import type { AccessContext, AccessGrant, AccessPrincipalKind, ApiKey, AttemptToolResult, BillingBalance, CapabilityCatalogItem, CapabilityInstallation, CapabilitySource, ConnectionKind, ConnectionMetadata, ConnectionStatus, DocumentAuthorityKind, McpServerConnectionRef, FileAsset, FileUploadStatus, FirstPartyMcpToolName, HumanInputQuestion, HumanInputResponse, KnowledgeMemory, KnowledgeMemoryKind, KnowledgeMemoryStatus, KnowledgeSourceRef, GitHubInstallationAuthorityKind, GitHubRepositoryScope, HostEventExportBatch, HostUsageExportBatch, ManagedAccount, ManagedOrganizationMembershipProjection, WorkspaceMemberCandidate, McpPersonalConnectionDelegation, McpConnectionAccountBinding, ModelContextContributionSummary, Permission, PersonalResourceAttachmentIntent, ResourceRef, SandboxBackend, SandboxOs, ScheduledTask, ScheduledTaskAction, ScheduledTaskActionKind, ScheduledTaskAgentConfig, ScheduledTaskOverlapPolicy, ScheduledTaskRun, ScheduledTaskRunAcceptedExecution as ScheduledTaskRunAcceptedExecutionType, ScheduledTaskRunMode, ScheduledTaskRunStatus, ScheduledTaskScheduleSpec, ScheduledTaskStatus, ScheduledTaskTriggerType, SlackInstallationBinding, Session, SessionAgentAccess, SessionAgentAccessViewer, SessionAuthorizationListScope, SessionScopeSubjectId, SessionMemoryScope, SessionListResponse, SessionEvent, SessionEventPayloadMode, SessionEventReadDirection, SessionEventSemanticClass, SessionEventType, SessionGoal, SessionGoalChangeKind, SessionGoalCreatedBy, SessionGoalMutationPolicy, SessionGoalRevision, SessionGoalStatus, SessionHumanInputRequest, LineageNode, SessionMcpApprovalPolicy, SessionMcpApprovalPolicyTarget, SessionBackgroundCommand, SessionSkill, SessionMcpServerMetadata, SessionStatus, SessionToolPolicy, SessionTurn, SessionQueueSnapshot, SessionSystemUpdate, SessionSystemUpdateKind, SystemUpdateClassification, SessionTurnSource, SessionTurnStatus, TurnInitiator, TurnInitiatorContext, SocialConnection, SocialConnectionStatus, SocialPost, SocialProvider, ToolRef, ReasoningEffort, UsageEvent, Workspace, WorkspaceMember, WorkspaceControlEvent, VariableSet, VariableSetSecret, VariableSetVariableMetadata, WorkspaceMemoryPromptMode, Channel, Rig, RigProviderImage, RigProviderImages, RigVersion, RigVerificationHealth, RigChange, RigChangeKind, RigChangeStatus, RigCheck, NativeSnapshotDescriptor, TarWorkspaceArchiveDescriptor, WorkspaceArchiveDescriptor, ModalCheckpointProviderBinding, SandboxProviderContinuityRecovery, WorkClaimSubjectFilter, WorkDiscoveryProjection } from "@opengeni/contracts";
 import { type WorkspaceArchiveObjectRef, RequestHumanInteractionToolInput, XaiProviderAccountAuthoritySnapshotV1, type TimelineAnnotation } from "@opengeni/contracts";
 import { type LatencyMode, SessionSystemUpdatePayload, TurnExecutionPolicyV1, CodexCredentialPolicySnapshotV1 } from "@opengeni/contracts";
 import { type Settings } from "@opengeni/config";
@@ -97,7 +122,8 @@ export * from "./model-catalog.js";
 import { type Database, type SessionActivityDatabase } from "./database.js";
 export { createDb, registerDbBinding, retrySessionActivityRls, rlsContextForWorkspace, rlsStrategyFor, setRlsContext, setSubjectRlsContext, withAccountRls, withDatabaseStatementTimeout, withRlsContext, withSessionActivityRlsContext, withSessionActivitySavepoint, withWorkspaceRls, withWorkspaceSessionActivityRls, withWorkspaceSubjectRls, withWorkspaceSubjectSessionActivityRls, withWorkspaceUsageLock, withSandboxProviderReadLock, SandboxProviderReadLockUnavailableError, type CreateDbOptions, type Database, type DbClient, type SessionActivityDatabase, type RlsContext, type SessionRlsActorContext, type RlsStrategy, type SandboxProviderReadLockIdentity, type ManagedUserProfile, type UserLookup, type UserProfileLookup, } from "./database.js";
 export { withSessionRlsActorContext } from "./database.js";
-export { normalizedHostCredentialHeaders } from "./connection-token-resolver.js";
+export { withDatabaseTimingObserver, type DatabaseTimingObservation } from "./database-timing.js";
+export { normalizedCredentialHeaders } from "./connection-token-resolver.js";
 import { buildCodexTokenResolver as buildCodexTokenResolverCore, fetchCodexRateLimitResetCreditsForAccount as fetchCodexRateLimitResetCreditsForAccountCore, fetchCodexUsageForAccount as fetchCodexUsageForAccountCore, type CodexAccountUsageSnapshot, type CodexAuthDeps, type CodexCredentialCooldownKind, type CodexCredentialForRun } from "./codex-token-resolver.js";
 import { buildConnectionTokenResolver as buildConnectionTokenResolverCore, type ConnectionBrokerDeps, type ConnectionCredentialForBroker, type ConnectionTokenResolverOptions } from "./connection-token-resolver.js";
 /** Raised when a durable session tool-policy write lost its version fence. */
@@ -779,6 +805,7 @@ export declare function recordModelCallFact(db: Database, input: {
     totalTokens?: number | null;
     occurredAt?: Date;
 }): Promise<ModelCallFact>;
+export { getOrganizationUsageSummary, getOrganizationUsageWorkspacePage, organizationUsageWindow, } from "./organization-usage.js";
 export declare function listUsageEvents(db: Database, input: {
     accountId: string;
     workspaceId?: string;
@@ -894,7 +921,6 @@ export type CreateScheduledTaskInput = {
     createdBy?: TurnInitiator;
     createdByContext?: TurnInitiatorContext;
     createdByActor?: AgentSessionCreationActor | null;
-    personalConnectionDelegations?: McpPersonalConnectionDelegation[];
     xaiProviderAccountAuthoritySnapshot?: XaiProviderAccountAuthoritySnapshotV1;
     /** Frozen creator boundary; omit (or pass null fields) for human/API creates. */
     creatorPolicy?: ScheduledTaskCreatorPolicy | null;
@@ -904,7 +930,6 @@ export type CreateScheduledTaskInput = {
     metadata: Record<string, unknown>;
     /** Trusted database-only admission seam. Throwing rolls the task creation back. */
     beforeCreateCommit?: (tx: Database) => Promise<void>;
-    captureHostAuthority?: (tx: Database, task: ScheduledTask) => Promise<void>;
     captureLinkAuthority?: (tx: Database, task: ScheduledTask) => Promise<void>;
 };
 export type UpdateScheduledTaskInput = Partial<{
@@ -915,39 +940,20 @@ export type UpdateScheduledTaskInput = Partial<{
     overlapPolicy: ScheduledTaskOverlapPolicy;
     action: ScheduledTaskAction;
     agentConfig: ScheduledTaskAgentConfig;
-    personalConnectionDelegations: McpPersonalConnectionDelegation[];
     reusableSessionId: string | null;
     targetSessionId: string | null;
     variableSetId: string | null;
     rigId: string | null;
     metadata: Record<string, unknown>;
     refreshPersonalResourceAuthority: boolean;
-    cloneConnectionAuthorityFromRevision: number;
     clonePersonalResourceAuthorityFromRevision: number;
     authorityUpdatedBy: TurnInitiator;
     authorityUpdatedByContext: TurnInitiatorContext;
     authorityUpdatedByActor: AgentSessionCreationActor | null;
     /** Trusted database-only admission seam. Throwing rolls the task update back. */
     beforeUpdateCommit: (tx: Database) => Promise<void>;
-    captureHostAuthority: (tx: Database, task: ScheduledTask) => Promise<void>;
     captureLinkAuthority: (tx: Database, task: ScheduledTask) => Promise<void>;
 }>;
-export type CreatePackInstallationInput = {
-    accountId: string;
-    workspaceId: string;
-    packId: string;
-    status?: PackInstallationStatus;
-    manifestSnapshot?: CapabilityPack | null;
-    manifestDigest?: string | null;
-    selectedRigId?: string | null;
-    installedBySubjectId?: string | null;
-    metadata?: Record<string, unknown>;
-};
-export type RegisterWorkspacePackInput = {
-    accountId: string;
-    workspaceId: string;
-    pack: CapabilityPack;
-};
 export type CreateKnowledgeMemoryInput = {
     accountId: string;
     workspaceId: string;
@@ -1413,6 +1419,8 @@ export type EnableCapabilityInstallationInput = {
     workspaceId: string;
     capabilityId: string;
     kind: "mcp";
+    /** Automatic setup must preserve every existing installation, including disabled ones. */
+    onlyIfUninstalled?: boolean;
     config?: Record<string, unknown>;
     metadata?: Record<string, unknown>;
 };
@@ -1427,7 +1435,7 @@ export type InstallPortableSkillInput = {
     skillRequestIdentity?: Record<string, unknown>;
     capabilityId: string;
     pluginKey: string;
-    source: "library" | "github" | "skills_sh" | "pack";
+    source: "library" | "github" | "skills_sh";
     sourceUrl: string;
     repositoryUrl: string;
     version?: string;
@@ -1462,7 +1470,7 @@ export type InstalledPortableSkill = {
     pluginInstallationId: string;
     facetInstallationId: string;
     installationVersion: number;
-    source: "library" | "github" | "skills_sh" | "pack";
+    source: "library" | "github" | "skills_sh";
     version: string;
     sourceUrl: string;
     sourceCommit: string;
@@ -1471,7 +1479,7 @@ export type InstalledPortableSkill = {
 };
 export type PortableSkillRuntime = {
     capabilityId: string;
-    source: "library" | "github" | "skills_sh" | "pack";
+    source: "library" | "github" | "skills_sh";
     version: string;
     name: string;
     description: string;
@@ -1494,7 +1502,7 @@ export type InstalledSkillSummary = {
     category: string;
     tags: string[];
     provenance: string;
-    source: "library" | "github" | "skills_sh" | "pack";
+    source: "library" | "github" | "skills_sh";
     version: string;
     sourceUrl: string;
     repositoryUrl: string;
@@ -1509,7 +1517,7 @@ export type InstalledSkillSummary = {
     owners: PortableSkillOwner[];
 };
 export type PortableSkillOwner = {
-    kind: "direct" | "plugin" | "pack" | "migration";
+    kind: "direct" | "plugin" | "migration";
     id: string;
     removable: boolean;
 };
@@ -1549,6 +1557,7 @@ export type EnabledMcpCapabilityServer = {
     timeoutMs?: number;
     cacheToolsList?: boolean;
     requireApproval?: SessionMcpApprovalPolicy;
+    approvalFloor?: SessionMcpApprovalPolicy;
     /**
      * Credential request headers stored encrypted at enable time
      * (AES-256-GCM under the workspace-variableSets key). Decrypted only at
@@ -1578,7 +1587,7 @@ export type UpdateSessionMcpServerCredentialsResult = {
     missingIds: string[];
 };
 export type UpdateSessionMcpApprovalPolicyResult = {
-    server: SessionMcpServerMetadata | null;
+    server: SessionMcpApprovalPolicyTarget | null;
     changed: boolean;
 };
 export type SessionMcpServerForRun = SessionMcpServerMetadata & {
@@ -1610,6 +1619,7 @@ export type EnqueueSessionTurnInput = {
     initiator: TurnInitiator;
     initiatorContext?: TurnInitiatorContext;
     personalConnectionDelegations?: McpPersonalConnectionDelegation[];
+    mcpAccountBindings?: McpConnectionAccountBinding[] | null;
     xaiProviderAccountAuthoritySnapshot?: XaiProviderAccountAuthoritySnapshotV1;
     /** Steer inserts before all waiting prompts; Send appends after them. */
     placement?: "head" | "tail";
@@ -1617,6 +1627,7 @@ export type EnqueueSessionTurnInput = {
 /** Worker-only turn projection with causal authority omitted from public APIs. */
 export type SessionTurnForExecution = SessionTurn & {
     personalConnectionDelegations: McpPersonalConnectionDelegation[];
+    mcpAccountBindings: McpConnectionAccountBinding[] | null;
     /** Worker-only causal authority; never inferred from the current worker. */
     initiatingHumanSubjectId: string | null;
     scheduledTaskRunId: string | null;
@@ -1919,17 +1930,6 @@ export declare function completeExpiredFileUploadCleanup(db: Database, input: {
     uploadId: string;
     fileId: string;
 }): Promise<boolean>;
-export declare function enablePackInstallation(db: Database, input: CreatePackInstallationInput): Promise<PackInstallation>;
-export declare function listPackInstallations(db: Database, workspaceId: string): Promise<PackInstallation[]>;
-export declare function getPackInstallation(db: Database, workspaceId: string, packId: string): Promise<PackInstallation | null>;
-export declare function updatePackInstallationStatus(db: Database, workspaceId: string, packId: string, status: PackInstallationStatus): Promise<PackInstallation>;
-export declare function registerWorkspacePack(db: Database, input: RegisterWorkspacePackInput): Promise<{
-    pack: WorkspaceRegisteredPack;
-    created: boolean;
-}>;
-export declare function listWorkspacePacks(db: Database, workspaceId: string): Promise<WorkspaceRegisteredPack[]>;
-export declare function getWorkspacePack(db: Database, workspaceId: string, packId: string): Promise<WorkspaceRegisteredPack | null>;
-export declare function deleteWorkspacePack(db: Database, workspaceId: string, packId: string): Promise<boolean>;
 export declare function createImportBatch(db: Database, input: CreateImportBatchInput): Promise<ImportBatch>;
 export declare function findCompletedImportBatch(db: Database, input: {
     source: string;
@@ -2020,6 +2020,23 @@ export declare function decryptedCapabilityHeaders(server: EnabledMcpCapabilityS
  */
 export declare function getStoredCapabilityHeaderCiphertext(db: Database, workspaceId: string, capabilityId: string): Promise<Record<string, string> | null>;
 export declare function mcpServerIdForCapability(capabilityId: string, metadata?: Record<string, unknown>): string;
+export declare class ConnectionCreateIdempotencyError extends Error {
+    constructor();
+}
+export declare function getConnectionCreationResult(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    operationId: string;
+}): Promise<ConnectionMetadataWithVerification | null>;
+export declare function createConnectionIdempotently(db: Database, input: CreateConnectionInput & {
+    operation?: {
+        id: string;
+        requestDigest: string;
+    };
+    /** Runs inside the first creation transaction, never on operation replay. */
+    onCreated?: (tx: Database, connection: Awaited<ReturnType<typeof createConnection>>) => Promise<void>;
+}): Promise<ConnectionMetadataWithVerification>;
 export declare function createConnection(db: Database, input: CreateConnectionInput): Promise<ConnectionMetadataWithVerification>;
 /** Compatibility wrapper for the existing Vercel AI Gateway create/replay contract. */
 export declare function upsertWorkspaceVercelAiGatewayConnection(db: Database, input: UpsertWorkspaceVercelAiGatewayConnectionInput): Promise<ConnectionMetadataWithVerification | null>;
@@ -2840,6 +2857,14 @@ export declare function listSocialPosts(db: Database, options: {
     limit?: number;
 }): Promise<SocialPost[]>;
 export declare function createScheduledTask(db: Database, input: CreateScheduledTaskInput): Promise<ScheduledTask>;
+/** Trusted mutation seam: verify an exact agent attempt before deriving its human. */
+export declare function scheduledTaskMutationOwnerMatches(db: Database, input: {
+    workspaceId: string;
+    taskId: string;
+    createdBy?: TurnInitiator;
+    createdByContext?: TurnInitiatorContext;
+    createdByActor?: AgentSessionCreationActor | null;
+}): Promise<boolean>;
 export declare function updateScheduledTask(db: Database, workspaceId: string, taskId: string, input: UpdateScheduledTaskInput): Promise<ScheduledTask>;
 export declare function getScheduledTask(db: Database, workspaceId: string, taskId: string): Promise<ScheduledTask | null>;
 /** Internal delete-recovery lookup; public list/get surfaces hide tombstones. */
@@ -2850,20 +2875,14 @@ export declare function getScheduledTaskIncludingDeleted(db: Database, workspace
 export declare function getScheduledTaskIncludingDeletedForUpdate(db: Database, workspaceId: string, taskId: string): Promise<(ScheduledTask & {
     deletedAt: string | null;
 }) | null>;
-export declare function getScheduledTaskPersonalConnectionDelegations(db: Database, workspaceId: string, taskId: string): Promise<McpPersonalConnectionDelegation[]>;
 /**
- * Lock and project the exact mutable incident-task authority inside a caller's
- * dispatch/claim transaction. Returning the frozen personal delegation tuple
- * from the same row prevents a later task edit from mixing with the task
- * snapshot used for preflight.
+ * Lock the incident task definition inside the dispatch transaction. Account
+ * authority belongs to the accepted occurrence, never the mutable task head.
  */
 export declare function requireScheduledTaskIncidentAuthorityInTransaction(tx: Database, input: {
     workspaceId: string;
     taskId: string;
-}): Promise<{
-    task: ScheduledTask;
-    personalConnectionDelegations: McpPersonalConnectionDelegation[];
-}>;
+}): Promise<ScheduledTask>;
 export declare function getScheduledTaskXaiProviderAccountAuthoritySnapshot(db: Database, workspaceId: string, taskId: string): Promise<XaiProviderAccountAuthoritySnapshotV1>;
 /**
  * The frozen creator boundary of a scheduled task. Read at fire time (and by
@@ -3781,7 +3800,7 @@ export declare function setWorkspaceCodexSubscriptionModeInTransaction(scopedDb:
     workspaceId: string;
     subjectId: string | null;
     mode: WorkspaceCodexSubscriptionMode;
-    /** Effective source captured under the source lock before caller-owned credential writes. */
+    /** Compatibility hint only; database capture derives authority before credential writes. */
     effectiveSourceBeforeMutation?: EffectiveCodexSubscriptionSource;
 }): Promise<WorkspaceCodexSubscriptionSource>;
 export declare function setWorkspaceCodexSubscriptionMode(db: Database, input: {
@@ -3947,7 +3966,16 @@ export declare function clearCodexAppsCredential(db: Database, input: {
  * workspace; an unknown/disconnected id returns null → the caller treats it as
  * "needs relogin / re-pick".
  */
-export declare function loadCodexCredentialForRun(db: Database, settings: Settings, workspaceId: string, credentialId: string): Promise<CodexCredentialForRun | null>;
+export type CodexAcceptedLeaseAuthority = {
+    turnId: string;
+    holderId: string;
+    generation: number;
+};
+type CodexAcceptedCredentialAuthority = CodexAcceptedLeaseAuthority | {
+    turnId: string;
+    purpose: "capacity_refresh";
+};
+export declare function loadCodexCredentialForRun(db: Database, settings: Settings, workspaceId: string, credentialId: string, authority?: CodexAcceptedCredentialAuthority): Promise<CodexCredentialForRun | null>;
 /**
  * Persist rotated tokens after a successful refresh. Caller pre-encrypts.
  *
@@ -3966,6 +3994,7 @@ export declare function recordCodexTokenRefresh(db: Database, input: {
     credentialEncrypted: string;
     expiresAt: Date | null;
     lastRefreshAt: Date;
+    authority?: CodexAcceptedCredentialAuthority | undefined;
 }): Promise<boolean>;
 /**
  * Cross-process single-flight boundary for one workspace credential refresh.
@@ -3989,7 +4018,7 @@ export declare function withCodexCredentialRefreshLock<T>(db: Database, workspac
 export declare function setCodexCredentialStatus(db: Database, workspaceId: string, status: "active" | "needs_relogin" | "error", lastError: string | null, target: {
     id: string;
     version: number;
-}): Promise<boolean>;
+}, authority?: CodexAcceptedCredentialAuthority): Promise<boolean>;
 /**
  * Metadata-only runtime quarantine for a credential selected by id. The version
  * is read and written in one RLS-scoped transaction, so a reconnect that rotates
@@ -4028,7 +4057,7 @@ export declare function getCodexCredentialStatus(db: Database, workspaceId: stri
  * decide whether to inject the synthetic codex-subscription provider, so billing
  * and provider-injection cannot drift. Metadata-only read (never the secret).
  */
-export declare function workspaceCodexSubscriptionActive(db: Database, settings: Pick<Settings, "codexSubscriptionEnabled">, workspaceId: string): Promise<boolean>;
+export declare function workspaceCodexSubscriptionActive(db: Database, settings: Pick<Settings, "codexSubscriptionEnabled">, workspaceId: string, acceptedTurnId?: string): Promise<boolean>;
 /**
  * CANONICAL "is this a Codex-billed turn?" predicate.
  *
@@ -4094,6 +4123,9 @@ export type CodexAccountStatus = {
  */
 export type CodexLeaseAccountStatus = Omit<CodexAccountStatus, "allocatorVersion" | "allocatorUpdatedBySubjectId" | "allocatorUpdatedAt" | "resetCreditAvailableCount" | "resetCreditsCheckedAt" | "connectedBySubjectId" | "source"> & {
     activeLeaseCount: number;
+    /** Absent only in pre-0383 compatibility schemas. */
+    exhaustedRevision?: number;
+    credentialVersion?: number;
     selectionCount: number;
     lastSelectedAt: Date | null;
 };
@@ -4136,6 +4168,8 @@ export type CodexCredentialLeaseSelectionContext<TPolicyScope = never, TUnavaila
     existingCredentialId: string | null;
     /** Credentials already consumed by a definitive refusal on this accepted turn. */
     failedCredentialIds?: readonly string[];
+    failoverExhausted?: boolean;
+    modelId?: string;
     /** Downstream-owned accepted-turn policy; absent until a resolver is supplied. */
     policyScope: TPolicyScope | null;
     /** Diagnostics produced while choosing one policy scope for this NEW allocation. */
@@ -4293,6 +4327,11 @@ export type ArmCodexCapacityWaitResult = {
     action: "waiting";
     waiter: CodexCapacityWait;
     events: SessionEvent[];
+} | {
+    action: "stopped";
+    sessionStatus: "failed" | "queued";
+    waiter: CodexCapacityWait;
+    events: SessionEvent[];
 } | {
     action: "stale";
     waiter: CodexCapacityWait | null;
@@ -4361,14 +4400,18 @@ export declare function armCodexCapacityWait(db: Database, input: {
 }): Promise<ArmCodexCapacityWaitResult>;
 export declare function getCodexCapacityWaitForSession(db: Database, workspaceId: string, sessionId: string): Promise<CodexCapacityWait | null>;
 type CodexCapacityMutationInput = {
+    acceptedTurnId?: string | undefined;
+    /** Local management writes do not follow the live source preference. */
+    mutationSource?: "workspace" | "organization" | "effective";
     workspaceId: string;
     reason: string;
     policyHash?: string | null;
 };
 /**
  * Same-transaction capacity-mutation/outbox seam for eligibility and
- * membership/default changes. The allocator rotation row is always the
- * first lock. Mutations report whether capacity truth changed; only then are
+ * membership/default changes. Local management writes target the workspace
+ * pool; runtime writers opt into the effective/accepted pool. The source lock
+ * precedes that pool's rotation row. Mutations report whether capacity truth changed; only then are
  * matching waiter wake revisions advanced and returned for best-effort signal.
  */
 export declare function withCodexCapacityMutation<T>(db: Database, input: CodexCapacityMutationInput, mutate: (tx: Database) => Promise<{
@@ -4573,7 +4616,22 @@ export declare function getWorkspaceConnectionModelRestrictions(db: Database, wo
  * accounts UI + the worker's selection resolver. NEVER decrypts. `isActive` marks
  * the workspace active pointer. Ordered by created_at ASC (stable list order).
  */
-export declare function listCodexAccountStatuses(db: Database, workspaceId: string): Promise<CodexAccountStatus[]>;
+export declare function listCodexAccountStatuses(db: Database, workspaceId: string, acceptedTurnId?: string): Promise<CodexAccountStatus[]>;
+/** Session-authorized metadata projection. The caller authorizes the session;
+ * its locked active pointer, never a client-supplied turn/source, selects the
+ * accepted pool. Running turns retain their display account while choices for
+ * new work follow current settings. No credential material or Apps grants. */
+export declare function getSessionCodexAccounts(db: Database, workspaceId: string, sessionId: string): Promise<{
+    accounts: CodexAccountStatus[];
+    rotation: CodexRotationSettings | null;
+    currentSelection: {
+        waiting: boolean;
+        credentialId: string | null;
+    } | null;
+    currentAccount: CodexAccountStatus | null;
+    pinnedAccountId: string | null;
+    lastAccountId: string | null;
+} | null>;
 export type CodexAllocatorUpdateResult = {
     kind: "updated" | "unchanged";
     allocatorEnabled: boolean;
@@ -4767,7 +4825,15 @@ export declare function completeCodexResetRedemption(db: Database, input: {
  */
 export declare function recordCodexAccountUsage(db: Database, workspaceId: string, credentialId: string, snapshot: CodexAccountUsageSnapshot): Promise<boolean>;
 /** Usage-cache mutation plus its committed durable capacity-wake outbox. */
-export declare function recordCodexAccountUsageWithWakeTargets(db: Database, workspaceId: string, credentialId: string, snapshot: CodexAccountUsageSnapshot): Promise<CodexCapacityMutationResult<boolean>>;
+export declare function recordCodexAccountUsageWithWakeTargets(db: Database, workspaceId: string, credentialId: string, snapshot: CodexAccountUsageSnapshot, authority?: CodexAcceptedCredentialAuthority): Promise<CodexCapacityMutationResult<boolean>>;
+export type CodexFinalizationUsageAuthority = CodexAcceptedLeaseAuthority & {
+    sessionId: string;
+    attemptId: string;
+    executionGeneration: number;
+    credentialVersion: number;
+};
+/** Write-only cleanup authority: never usable by a token/decrypt accessor. */
+export declare function recordCodexAccountUsageForFinalization(db: Database, workspaceId: string, credentialId: string, snapshot: CodexAccountUsageSnapshot, authority: CodexFinalizationUsageAuthority): Promise<CodexCapacityMutationResult<boolean>>;
 export type CodexRotationSettings = {
     activeCredentialId: string | null;
     /** False keeps new allocations on the active account; true permits pool failover. */
@@ -4801,7 +4867,7 @@ export declare function upsertWorkspaceModelPolicy(db: Database, input: {
     allowedModels: string[] | null;
 }): Promise<WorkspaceModelPolicy>;
 /** The per-workspace rotation/active-pointer row (null when none exists yet). */
-export declare function getCodexRotationSettings(db: Database, workspaceId: string): Promise<CodexRotationSettings | null>;
+export declare function getCodexRotationSettings(db: Database, workspaceId: string, acceptedTurnId?: string): Promise<CodexRotationSettings | null>;
 /** Idempotently ensure the per-workspace rotation-settings row exists. */
 export declare function ensureCodexRotationSettings(db: Database, accountId: string, workspaceId: string): Promise<void>;
 /**
@@ -5100,6 +5166,7 @@ export type SessionCreateInput = {
     skills?: SessionSkill[];
     tools?: ToolRef[];
     toolPolicy?: SessionToolPolicy;
+    mcpApprovalPolicies?: Record<string, SessionMcpApprovalPolicy>;
     metadata: Record<string, unknown>;
     createdBy?: TurnInitiator;
     createdByContext?: TurnInitiatorContext;
@@ -5127,8 +5194,6 @@ export type SessionCreateInput = {
     createIdempotencyKey?: string | null;
     /** Exact explicit installed-Skill selection used for keyed-create replay. */
     selectedInstalledSkillIds?: string[];
-    /** Backend-only replay identity; does not admit host credential authority. */
-    selectedHostMcpDelegations?: HostMcpCreateSelection[];
     sandboxGroupId?: string | null;
     sandboxOs?: SandboxOs;
     /** Exact accepted generated-session compaction policy; internal lifecycle callers only. */
@@ -5140,6 +5205,7 @@ export type SessionCreateInput = {
     };
     mcpServers?: CreateSessionMcpServerInput[];
     personalConnectionDelegations?: McpPersonalConnectionDelegation[];
+    mcpAccountBindings?: McpConnectionAccountBinding[] | null;
     initialPersonalResourceAttachmentIntent?: PersonalResourceAttachmentIntent | null;
     initialXaiProviderAccountAuthoritySnapshot?: XaiProviderAccountAuthoritySnapshotV1;
     maxNestedAgentDepthOverride?: number | null;
@@ -5214,7 +5280,6 @@ export declare function getInitializedSessionCreateReplay(db: Database, input: {
     visibility?: "user_private" | "workspace_shared";
     variableSetIds: string[];
     selectedInstalledSkillIds: string[];
-    selectedHostMcpDelegations?: HostMcpCreateSelection[];
     initialPersonalResourceAttachmentIntent?: PersonalResourceAttachmentIntent | null;
     deferInitialTurn?: boolean;
 }): Promise<InitializedSessionCreateReplay | null>;
@@ -5259,6 +5324,7 @@ export type SessionAccessProjection = {
     memoryScope: SessionMemoryScope;
 };
 export type SessionAuthorityProjection = SessionAccessProjection & {
+    authorityEpoch: number;
     visibility: "user_private" | "workspace_shared";
     ownerSubjectId: string | null;
 };
@@ -5277,6 +5343,8 @@ export declare function resolveSessionMemoryAgentScope(db: Database, workspaceId
     executionGeneration?: unknown;
 }): Promise<MemoryAgentScope | null>;
 export declare function memoryAgentScopeForSessionAccess(access: Pick<SessionAccessProjection, "rootSessionId" | "scopeSubjectId" | "memoryScope">): MemoryAgentScope;
+export declare function getSessionTurnMcpAccountBindings(db: Database, workspaceId: string, sessionId: string, turnId: string): Promise<McpConnectionAccountBinding[] | null>;
+export declare function getSessionParentMcpAccountBindings(db: Database, workspaceId: string, childSessionId: string): Promise<McpConnectionAccountBinding[] | null>;
 export declare function getSessionTurnXaiProviderAccountAuthoritySnapshot(db: Database, workspaceId: string, sessionId: string, turnId: string): Promise<XaiProviderAccountAuthoritySnapshotV1>;
 export declare function getSessionTurnPersonalConnectionDelegations(db: Database, workspaceId: string, sessionId: string, turnId: string): Promise<McpPersonalConnectionDelegation[]>;
 export declare function getSessionParentPersonalConnectionDelegations(db: Database, workspaceId: string, childSessionId: string): Promise<McpPersonalConnectionDelegation[]>;
@@ -5322,22 +5390,22 @@ export type SessionListSnapshotCursor = {
     offset: number;
     parentSessionFilter: string;
     search: string | null;
-    archiveMode: "active" | "archived";
+    archiveMode: "active" | "archived" | "all";
     /** Additive filter identity; absent on legacy snapshot cursors. */
     filter?: string;
 };
 export type SessionListKeysetCursor = {
     kind: "keyset";
     /** Absent on v2 cursors, which always used session updatedAt. */
-    sortBy?: "updatedAt" | "archivedAt";
+    sortBy?: "updatedAt" | "archivedAt" | "createdAt" | "name";
     /** Decimal committed workspace activity revision frozen on page one. */
     snapshotRevision: string;
-    /** Exact PostgreSQL timestamp text, including microseconds. */
+    /** Exact PostgreSQL timestamp (including microseconds), or normalized name for name order. */
     sortAt: string;
     id: string;
     parentSessionFilter: string;
     search: string | null;
-    archiveMode: "active" | "archived";
+    archiveMode: "active" | "archived" | "all";
     /** Canonical identity for channel, creator, and time-bound filters. */
     filter?: string;
 };
@@ -5371,6 +5439,8 @@ export type ListSessionsForSubjectOptions = ListSessionsOptions & SessionListFil
     pinsOnly?: boolean | undefined;
     /** List personally archived chats instead of active chats. */
     archivedOnly?: boolean | undefined;
+    sortBy?: "updatedAt" | "createdAt" | "name" | undefined;
+    archiveStatus?: "active" | "archived" | "all" | undefined;
     /** Return a continuation cursor. Disable for legacy one-page array reads. */
     materializeSnapshot?: boolean | undefined;
     authorizationScope?: SessionAuthorizationListScope | undefined;
@@ -5480,6 +5550,12 @@ export declare function encodeSessionListCursor(cursor: SessionListCursor): stri
 export declare function decodeSessionListCursor(value: string): SessionListCursor | null;
 /** Bounded global TTL cleanup, isolated from serializable member list reads. */
 export declare function reapExpiredSessionListSnapshots(db: Database, limit?: number): Promise<number>;
+/** Bounded full-history message search. The caller must authorize a live grant
+ * and its complete host/agent list scope before entering this RLS projection.
+ */
+export declare function searchSessionMessagesForSubject(db: Database, workspaceId: string, request: SessionMessageSearchRequest, authority: Pick<ListSessionsForSubjectOptions, "subjectId" | "authorizationScope" | "personalWorkspaceOwnerException">, options?: {
+    signal?: AbortSignal | undefined;
+}): Promise<SessionMessageSearchResponse>;
 /**
  * Server-authoritative member-specific page. Pinned rows are returned separately
  * and omitted from ordinary pages, so list pagination cannot duplicate a
@@ -5975,6 +6051,26 @@ export declare function installOrReadTurnExecutionPolicyForAttempt(db: Database,
     attemptId: string;
     policyForAbsent: TurnExecutionPolicyV1;
 }): Promise<InstallOrReadTurnExecutionPolicyForAttemptResult>;
+/** Persist the current catalog once per logical turn; retries reuse its exact snapshot. */
+export declare function ensureSessionSkillCatalog(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    expectedExecutionGeneration: number;
+    expectedAttemptId: string;
+    catalog: string;
+}): Promise<string>;
+/** Install an effort update before accepted input, or at the maintenance tail, under the attempt fence. */
+export declare function ensureSessionReasoningConfiguration(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string;
+    expectedExecutionGeneration: number;
+    expectedAttemptId: string;
+    effort: ConfigurationEffort;
+}): Promise<ConfigurationEffort>;
 /**
  * Append conversation items (verbatim SDK AgentInputItems) to the session's
  * history. Idempotent on (workspace, session, position): concurrent or
@@ -6186,6 +6282,7 @@ export declare function applyContextCompaction(db: Database, input: {
     expectedAttemptId: string;
     replacementItems: Array<Record<string, unknown>>;
     summaryItem: Record<string, unknown>;
+    trailingItems?: Array<Record<string, unknown>>;
     clearRequestedCompaction?: boolean;
     eventPayload?: Record<string, unknown>;
 }): Promise<ApplyContextCompactionResult>;
@@ -6233,6 +6330,18 @@ export declare function recordSkippedContextCompaction(db: Database, input: {
     requirePendingRequest?: boolean;
     /** When false, leave `compactRequested` untouched. Defaults to true. */
     clearRequestedCompaction?: boolean;
+    /**
+     * Closed, content-free identifiers of a definitive provider rejection
+     * (`summarization_failed` only): HTTP status, error type/code, rejected
+     * parameter path, provider request id. Never a provider message.
+     */
+    providerRejection?: {
+        httpStatus: number;
+        type: string | null;
+        code: string | null;
+        param: string | null;
+        requestId: string | null;
+    };
 }): Promise<{
     recorded: true;
     events: SessionEvent[];
@@ -6553,6 +6662,8 @@ export type SandboxRecoveryState = {
     };
 };
 export interface LeaseSnapshot {
+    /** Consent is not archive completeness; begin/commit revalidate the receipt. */
+    historicalRecoveryAuthorized?: boolean;
     /** Exact idle-only enrollment. Commands remain active until provider stop. */
     unobservableCommandDrainIds?: string[] | null;
     id: string;
@@ -6800,6 +6911,29 @@ export type BeginSandboxRematerializationResult = {
     code: "archive_unavailable" | "archive_unverified" | "archive_generation_mismatch" | "checkpoint_artifact_invalid" | "attempt_conflict" | "stale_epoch";
     lease: LeaseSnapshot | null;
 };
+export declare class SandboxRecoveryConflictError extends Error {
+    readonly code = "SANDBOX_RECOVERY_CONFLICT";
+}
+/** Retry already owns workspace/session/turn locks. Fence the EFFECTIVE route,
+ * not a degraded managed home behind an explicitly selected Connected Machine. */
+export declare function sessionEffectiveSandboxRecoveryBlocked(tx: Database, session: typeof schema.sessions.$inferSelect): Promise<boolean>;
+type PublicRecoveryScope = {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    subjectId: string;
+};
+/** Authorized caller only; provider-free and mutation-free (transaction scope only). */
+export declare function readPublicSandboxRecovery(db: Database, input: PublicRecoveryScope): Promise<SandboxRecoveryProjection>;
+/** Core authenticates the canonical managed human before calling this seam.
+ * Exclusive tenancy precedes the complete membership proof and is shared by
+ * every attach/child writer. No provider operation or inference is dispatched. */
+export declare function consentPublicSandboxRecovery(db: Database, input: PublicRecoveryScope & {
+    request: SandboxRecoveryRequest;
+}): Promise<SandboxRecoveryResponse>;
+/** These warnings are outside compactable history and survive ordinary context
+ * reconstruction. Receipts describe consent, never unverified restore success. */
+export declare function getSandboxRecoveryDiscontinuity(db: Database, workspaceId: string, sessionId: string): Promise<string | null>;
 /** Operator-only authorization for an exact historical checkpoint. Direct
  * database access is the authority boundary; subjectId records attribution.
  * This never resumes a turn or changes the archive/workspace generations. */
@@ -7238,6 +7372,8 @@ export declare function markWarmLeaseInstanceLost(db: Database, input: {
     sandboxGroupId: string;
     expectedEpoch: number;
     expectedInstanceId: string;
+    /** Optional for legacy callers; new provider observers should bind backend too. */
+    expectedBackend?: string;
     /** Bounded classifier output only; never raw provider error text. */
     diagnostic?: string;
 }): Promise<MarkWarmLeaseInstanceLostResult>;
@@ -7863,6 +7999,150 @@ export declare function settleRetainedProcess(db: Database, input: {
     process: SandboxRetainedProcess;
     backgroundCommandEvents: SessionEvent[];
 }>;
+/** Only call for an authenticated, typed provider response proving this exact
+ * retained launch was never started. Ambiguous dispatch is NOT rejection proof.
+ * The command equality and empty launch checks repeat under the settlement lock. */
+export declare function rejectRetainedSupervisedLaunch(db: Database, scope: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    processId: string;
+}, command: ModalRouterProviderCommand): Promise<void>;
+/** Compose the leaf cursor/proof persistence with canonical settlement. The
+ * leaf subpath cannot import this root without reversing the DB boundary. */
+export declare function retainedProviderCommandPersistence(...[db, scope, publish]: Parameters<typeof retainedProviderCommandState>): {
+    recordSupervisionReceipt: (receipt: import("./retained-provider-commands.js").SupervisionReceipt) => Promise<void>;
+    loadSupervisionReceipt: () => Promise<{
+        protocol: "native-subreaper-v1";
+        invocationId: string;
+        receiptId: string;
+        leaderExitCode: number;
+    } | null>;
+    requestCancellation: (reason: "provider_deadline" | "explicit_stop") => Promise<void>;
+    cancellationRequested: () => Promise<boolean>;
+    load: () => Promise<{
+        kind: "modal-control-v1";
+        sandboxId: string;
+        taskId: string;
+        execId: string;
+        pty?: boolean | undefined;
+        streams: {
+            stdout: {
+                batchIndex: number;
+                utf8Remainder: string;
+                exitCode: number | null;
+            };
+            stderr: {
+                batchIndex: number;
+                utf8Remainder: string;
+                exitCode: number | null;
+            };
+        };
+    } | {
+        kind: "modal-router-v1";
+        sandboxId: string;
+        taskId: string;
+        execId: string;
+        pty?: boolean | undefined;
+        supervision?: {
+            protocol: "native-subreaper-v1";
+            invocationId: string;
+            nonce: string;
+            controlPath: string;
+        } | undefined;
+        streams: {
+            stdout: {
+                byteOffset: number;
+                utf8Remainder: string;
+                eof: boolean;
+                exitCode: number | null;
+            };
+            stderr: {
+                byteOffset: number;
+                utf8Remainder: string;
+                eof: boolean;
+                exitCode: number | null;
+            };
+        };
+    } | null>;
+    acknowledge: (command: import("@opengeni/contracts").SandboxProviderCommand) => Promise<{
+        kind: "modal-control-v1";
+        sandboxId: string;
+        taskId: string;
+        execId: string;
+        pty?: boolean | undefined;
+        streams: {
+            stdout: {
+                batchIndex: number;
+                utf8Remainder: string;
+                exitCode: number | null;
+            };
+            stderr: {
+                batchIndex: number;
+                utf8Remainder: string;
+                exitCode: number | null;
+            };
+        };
+    } | {
+        kind: "modal-router-v1";
+        sandboxId: string;
+        taskId: string;
+        execId: string;
+        pty?: boolean | undefined;
+        supervision?: {
+            protocol: "native-subreaper-v1";
+            invocationId: string;
+            nonce: string;
+            controlPath: string;
+        } | undefined;
+        streams: {
+            stdout: {
+                byteOffset: number;
+                utf8Remainder: string;
+                eof: boolean;
+                exitCode: number | null;
+            };
+            stderr: {
+                byteOffset: number;
+                utf8Remainder: string;
+                eof: boolean;
+                exitCode: number | null;
+            };
+        };
+    }>;
+    reserveInput: (byteLength?: number) => Promise<number>;
+    captureRouterPage: (page: import("./retained-provider-commands.js").RetainedRouterOutputPage) => Promise<{
+        command: {
+            kind: "modal-router-v1";
+            sandboxId: string;
+            taskId: string;
+            execId: string;
+            pty?: boolean | undefined;
+            supervision?: {
+                protocol: "native-subreaper-v1";
+                invocationId: string;
+                nonce: string;
+                controlPath: string;
+            } | undefined;
+            streams: {
+                stdout: {
+                    byteOffset: number;
+                    utf8Remainder: string;
+                    eof: boolean;
+                    exitCode: number | null;
+                };
+                stderr: {
+                    byteOffset: number;
+                    utf8Remainder: string;
+                    eof: boolean;
+                    exitCode: number | null;
+                };
+            };
+        };
+        captured: boolean;
+    }>;
+    rejectSupervisedLaunch: (command: ModalRouterProviderCommand) => Promise<void>;
+};
 /** Read the exact generation a verified capture must later fold. This is a
  * preflight only: persistWarmSnapshot/persistDrainSnapshot repeat the full
  * epoch, provider, liveness, and generation CAS under the archive-fold lock. */
@@ -9083,6 +9363,7 @@ export type CreateSessionGoalInput = {
     text: string;
     successCriteria?: string | null;
     rootConstraints?: string[];
+    reportRequirements?: SessionGoalReportRequirement[];
     maxAutoContinuations?: number | null;
     mutationPolicy?: SessionGoalMutationPolicy;
     expectedObjectiveRevision?: number;
@@ -9117,7 +9398,9 @@ export type SessionGoalContinuationProjection = {
 export declare function getSessionGoalWithContinuation(db: Database, workspaceId: string, sessionId: string): Promise<(SessionGoal & {
     continuation: SessionGoalContinuationProjection;
 }) | null>;
-export declare function clearSessionGoal(db: Database, workspaceId: string, sessionId: string): Promise<{
+export declare function clearSessionGoal(db: Database, workspaceId: string, sessionId: string, options?: {
+    actor: "api" | "agent";
+}): Promise<{
     cleared: boolean;
     goal: SessionGoal | null;
     event: SessionEvent | null;
@@ -9155,6 +9438,9 @@ export declare function upsertScheduledSessionGoalForRun(db: Database, input: {
  */
 export declare function upsertSessionGoalWithEvent(db: Database, input: CreateSessionGoalInput & {
     actor: "agent" | "api";
+    commandActor?: Extract<SessionCommandActor, {
+        type: "agent_attempt";
+    }>;
 }): Promise<{
     goal: SessionGoal;
     replaced: boolean;
@@ -9259,6 +9545,7 @@ export declare function waitForSessionInputWithEvent(db: Database, workspaceId:
  */
 export declare function recordSessionGoalProgressWithEvent(db: Database, workspaceId: string, sessionId: string, input: {
     progressNote: string;
+    reportRequirements?: SessionGoalReportRequirement[];
     command: {
         accountId: string;
         actor: Extract<SessionCommandActor, {
@@ -9345,6 +9632,11 @@ export declare function setSessionGoalStatus(db: Database, workspaceId: string,
     evidence?: string;
     rationale?: string;
     pausedReason?: string;
+    reportDeliveries?: SessionGoalReportDelivery[];
+    reportArtifactActor?: ReportArtifactActor;
+    commandActor?: Extract<SessionCommandActor, {
+        type: "agent_attempt";
+    }>;
 }): Promise<{
     goal: SessionGoal;
     changed: boolean;
@@ -9368,6 +9660,11 @@ export declare function setSessionGoalStatusWithEvent(db: Database, workspaceId:
     evidence?: string;
     rationale?: string;
     pausedReason?: string;
+    reportDeliveries?: SessionGoalReportDelivery[];
+    reportArtifactActor?: ReportArtifactActor;
+    commandActor?: Extract<SessionCommandActor, {
+        type: "agent_attempt";
+    }>;
     event: SetSessionGoalStatusEvent;
 }): Promise<{
     goal: SessionGoal;
@@ -9479,6 +9776,7 @@ export type InitializeSessionStartInput = {
         text: string;
         successCriteria?: string | null;
         rootConstraints?: string[];
+        reportRequirements?: SessionGoalReportRequirement[];
         maxAutoContinuations?: number | null;
         mutationPolicy?: SessionGoalMutationPolicy;
         createdBy?: SessionGoalCreatedBy;
@@ -9538,6 +9836,9 @@ export type FrozenXaiExecutionAuthority = {
     subjectId: string | null;
 };
 export type ClaimSessionWorkForAttemptInput = {
+    /** Internal worker-build declaration, never request-derived or universally
+     * stamped by createDb. Only builds that always reconstruct the warning opt in. */
+    filesystemDiscontinuityProtocol?: 1;
     sessionId: string;
     workflowId: string;
     workflowRunId: string;
@@ -9680,13 +9981,25 @@ export declare function reconcileSessionAttemptQuiescence(db: Database, input: {
  */
 export declare function settleSessionAttemptInterruptions(db: Database, workspaceId: string, sessionId: string, attemptId: string): Promise<SessionAttemptInterruptionSettlement>;
 export type SessionWorkPeek = {
+    kind: "unavailable";
+} | {
+    kind: "attempt-owned";
+    turnId: string;
+    attemptId: string;
+    executionGeneration: number;
+    activityRef: SessionAttemptActivityRef;
+} | {
     kind: "runnable";
+    admissionFence?: SessionAdmissionFence;
+} | {
+    kind: "admission-blocked";
 } | {
     kind: "sandbox-lifecycle-wait";
     ref: SandboxLifecycleWait;
 } | {
     kind: "approval-pending";
     triggerEventId: string;
+    admissionFence?: SessionAdmissionFence;
 } | {
     kind: "approval-wait";
     humanInputRequestId?: string;
@@ -9695,6 +10008,7 @@ export type SessionWorkPeek = {
 } | {
     kind: "capacity-wait";
     ref: {
+        provider?: "codex" | "xai";
         waiterId: string;
         generation: number;
         nextCheckAt: string;
@@ -9714,7 +10028,7 @@ export type SessionWorkPeek = {
 } | {
     kind: "idle";
 };
-export declare function peekSessionWork(db: Database, workspaceId: string, sessionId: string): Promise<SessionWorkPeek>;
+export declare function peekSessionWork(db: Database, workspaceId: string, sessionId: string, includeAdmissionFence?: boolean, observerAccountId?: string): Promise<SessionWorkPeek>;
 export type SettleSessionInputWaitResult = {
     action: "held";
     events: [];
@@ -9737,6 +10051,19 @@ export declare function settleSessionInputWait(db: Database, input: {
     waitTurnId: string;
     disposition: "held" | "timeout" | "superseded";
 }): Promise<SettleSessionInputWaitResult>;
+/** Park only the exact pre-dispatch snapshot; late failures cannot block new work. */
+export declare function blockSessionWorkBeforeAttemptClaim(db: Database, workspaceId: string, input: {
+    accountId: string;
+    sessionId: string;
+    workflowId: string;
+    attemptId: string;
+    fence: SessionAdmissionFence;
+    reason: StoredSessionAdmissionBlock["reason"];
+    sqlState: string | null;
+}): Promise<{
+    action: "blocked" | "stale" | "terminal";
+    events: SessionEvent[];
+}>;
 export type FailSessionWorkBeforeAttemptClaimInput = {
     accountId: string;
     sessionId: string;
@@ -10126,6 +10453,7 @@ export type SessionSystemUpdateOutboxDelivery = {
     payload: ChildLifecycleOutboxPayload;
     lineage: Record<string, unknown>;
     personalConnectionDelegations: McpPersonalConnectionDelegation[];
+    mcpAccountBindings: McpConnectionAccountBinding[] | null;
     xaiProviderAccountAuthoritySnapshot: XaiProviderAccountAuthoritySnapshotV1;
 };
 /** Narrow an outbox row back to its correlated typed kind/payload input variant. */
@@ -10224,7 +10552,7 @@ export type SessionWorkflowWakeDeliveryResult = {
     action: "acknowledged";
 } | {
     action: "pending_admission";
-    blocker: "pending_agent_steer" | "pending_prompt_turn" | "pending_quiescence" | "pending_machine_input" | "pending_input_wait";
+    blocker: "pending_agent_steer" | "pending_prompt_turn" | "pending_quiescence" | "pending_machine_input" | "pending_input_wait" | "session_unavailable";
 };
 export declare function markSessionWorkflowWakeDelivered(db: Database, input: Omit<SessionWorkflowWake, "interruptionRequested">): Promise<SessionWorkflowWakeDeliveryResult>;
 /** Record delivery failure; the claim already scheduled the bounded retry. */
@@ -10251,6 +10579,7 @@ export type AddSessionSystemUpdateInput = {
     summary: string;
     lineage?: Record<string, unknown>;
     personalConnectionDelegations?: McpPersonalConnectionDelegation[];
+    mcpAccountBindings?: McpConnectionAccountBinding[] | null;
     xaiProviderAccountAuthoritySnapshot?: XaiProviderAccountAuthoritySnapshotV1;
     scheduledTaskRunId?: string | null;
 } & SessionSystemUpdateInputVariant;
@@ -10499,16 +10828,26 @@ export declare function appendSessionEventsWithLockedSessionUpdate(db: Database,
     lockParentSession?: boolean;
 }): Promise<SessionEvent[]>;
 export declare function sessionSubject(workspaceId: string, sessionId: string): string;
-export declare function buildCodexTokenResolver(db: Database, settings: Settings, workspaceId: string, credentialId: string, deps?: CodexAuthDeps): ReturnType<typeof buildCodexTokenResolverCore>;
-export declare function fetchCodexUsageForAccount(db: Database, settings: Settings, workspaceId: string, credentialId: string, fetchImpl?: CodexFetch): ReturnType<typeof fetchCodexUsageForAccountCore>;
+/**
+ * Unions a workspace's configured approval policy with a global catalog row's
+ * mandated floor, so `enableCapability`'s ordinary config override can only
+ * ADD approval requirements beyond a curated minimum, never remove one -
+ * closing the gap where a bare `??` let a workspace-supplied `false` or a
+ * narrower array silently erase a reviewed row's mandate (e.g. Gmail's
+ * approval-gated send tools). `true` on either side is maximal. Applies only
+ * to global rows (`workspaceId === null`): a workspace's own custom MCP
+ * registration owns its policy outright, with no OpenGeni-reviewed floor to
+ * protect.
+ */
+export declare function requireApprovalWithFloor(rawConfigValue: unknown, rawMetadataValue: unknown, isGlobalRow: boolean): SessionMcpApprovalPolicy | undefined;
+export declare function buildCodexTokenResolver(db: Database, settings: Settings, workspaceId: string, credentialId: string, deps?: CodexAuthDeps, authority?: CodexAcceptedLeaseAuthority): ReturnType<typeof buildCodexTokenResolverCore>;
+export declare function fetchCodexUsageForAccount(db: Database, settings: Settings, workspaceId: string, credentialId: string, fetchImpl?: CodexFetch, acceptedTurnId?: string): ReturnType<typeof fetchCodexUsageForAccountCore>;
 export declare function fetchCodexRateLimitResetCreditsForAccount(db: Database, settings: Settings, workspaceId: string, credentialId: string, fetchImpl?: CodexFetch): ReturnType<typeof fetchCodexRateLimitResetCreditsForAccountCore>;
 export declare function buildConnectionTokenResolver(db: Database, settings: Settings, deps?: ConnectionBrokerDeps, options?: ConnectionTokenResolverOptions): ReturnType<typeof buildConnectionTokenResolverCore>;
 export { withCodexTokenDeadline, type CodexAccountUsageSnapshot, type CodexAuthDeps, type CodexCredentialCooldownKind, type CodexCredentialForRun, type CodexCredentialTokens, type CodexRateLimitResetCreditsAccountResult, type CodexTokenDeadlineClock, type CodexTokenDeadlineOptions, } from "./codex-token-resolver.js";
-export { buildHostConnectionTokenResolver, buildHostGatewayConnectionTokenResolver, ConnectionRefreshHttpError, HostMcpCredentialBindingError, HostMcpCredentialScopeError, isPrivateAddress, normalizeBearerScheme, refreshOAuthConnectionCredential, type ConnectionBrokerDeps, type ConnectionCredentialForBroker, type ConnectionCredentialLookupInput, type ConnectionStatusGuard, type ConnectionTokenRefreshInput, type ConnectionTokenResolverOptions, type HostMcpCredentialResolverContext, type PermanentConnectionRefreshFailure, type RefreshTransportOptions, type ResolveConnectionCredentialInput, type ResolveConnectionCredentialResult, } from "./connection-token-resolver.js";
+export { ConnectionRefreshHttpError, isPrivateAddress, normalizeBearerScheme, refreshOAuthConnectionCredential, type ConnectionBrokerDeps, type ConnectionCredentialForBroker, type ConnectionCredentialLookupInput, type ConnectionStatusGuard, type ConnectionTokenRefreshInput, type ConnectionTokenResolverOptions, type PermanentConnectionRefreshFailure, type RefreshTransportOptions, type ResolveConnectionCredentialInput, type ResolveConnectionCredentialResult, } from "./connection-token-resolver.js";
 export { CapabilityComponentVersionConflictError, cleanupOrphanedCapabilityComponents, effectiveCapabilityOwnerSql, type CapabilityComponentOwnerIdentity, } from "./capability-components.js";
-export { adoptPackComponentReferences, finalizePackComponentOwnership, listPackInstallationComponents, PackComponentResolutionError, previewPackComponentRelease, recordPackInlineSkillComponent, releasePackComponents, resolvePackComponentReferences, resolvePackInlineSkillReferences, type PackInlineSkillRequirement, type StoredPackInstallationComponent, } from "./pack-components.js";
-export { deferPackInstallationOperation, finalizePackInstallationOperation, finalizePackUninstallOperation, PackManifestChangedError, PackOperationClaimLostError, PackOperationInProgressError, PackInstallationVersionConflictError, PackInstallationVersionRequiredError, PackOperationIdempotencyError, preparePackInstallationOperation, preparePackUninstallOperation, touchPackInstallationOperation, type PreparedPackInstallation, } from "./pack-installations.js";
-export { checkpointPluginPackageOperation, deferPluginPackageOperation, finalizePluginPackageInstall, getInstalledPluginPackage, getPluginPackageUninstallPreview, installPluginMcpReference, listInstalledPluginPackages, PluginInstallationVersionConflictError, PluginInstallationVersionRequiredError, PluginOperationIdempotencyError, preparePluginPackageInstall, uninstallPluginPackage, type InstalledPluginPackage, type InstalledPluginPackageSummary, type PluginBomComponent, type PreparedPluginPackage, } from "./plugin-packages.js";
+export { checkpointPluginPackageOperation, deferPluginPackageOperation, finalizePluginPackageInstall, getInstalledPluginPackage, getPluginPackageUninstallPreview, PluginUninstallPreviewChangedError, installPluginMcpReference, listInstalledPluginPackages, PluginInstallationVersionConflictError, PluginInstallationVersionRequiredError, PluginOperationIdempotencyError, preparePluginPackageInstall, uninstallPluginPackage, type InstalledPluginPackage, type InstalledPluginPackageSummary, type PluginBomComponent, type PreparedPluginPackage, } from "./plugin-packages.js";
 export * from "./workspace-artifacts.js";
 export * from "./mcp-oauth.js";
 export * from "./tool-gateway-approvals.js";
@@ -10542,4 +10881,34 @@ export declare function listDueWorkspacePauseTimers(db: Database, limit?: number
 export * from "./feedback.js";
 export * from "./knowledge-entries.js";
 export * from "./knowledge-indexing.js";
+import type { ConnectorToolPermission } from "@opengeni/contracts";
 export * from "./knowledge-document-preparation.js";
+export declare function listConnectorToolPermissionPolicies(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+}): Promise<{
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    serverId: string;
+    toolName: string;
+    actionName: string;
+    policy: schema.ConnectorActionPolicyDecision;
+    version: number;
+    createdBySubjectId: string;
+    updatedBySubjectId: string;
+    createdAt: Date;
+    updatedAt: Date;
+}[]>;
+/** All tools in a group change together, and never exceed the attempt snapshot bound. */
+export declare function updateConnectorToolPermissionPolicies(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    connectionId: string;
+    serverId: string;
+    toolNames: string[];
+    policy: ConnectorToolPermission;
+}): Promise<void>;