@opengeni/db 6.0.1 → 6.0.3

package/dist/index.js

@@ -1,9 +1,9 @@
 import {
   retainedProviderCommandPersistence
-} from "./chunk-RXH5CFG3.js";
+} from "./chunk-VE2XK2KD.js";
 import {
   readSessionMessageSliceInScope
-} from "./chunk-FULLE5CF.js";
+} from "./chunk-WT7HG43Y.js";
 import {
   FORCE_RLS_TABLES,
   NON_RLS_RUNTIME_TABLES,
@@ -28,7 +28,7 @@ import {
   isRetryableRuntimeDatabaseStartupError,
   provisionRoles,
   runtimeDatabaseReadyCheck
-} from "./chunk-H7BC444C.js";
+} from "./chunk-SRAMNVHT.js";
 import {
   CanonicalHumanIdentityAuthorityError,
   CanonicalHumanIdentityConflictError,
@@ -42,7 +42,7 @@ import {
   getCanonicalHumanIdentityProjection,
   synchronizeCanonicalHumanLoginBindings,
   validateCanonicalHumanSession
-} from "./chunk-PGIFHEBA.js";
+} from "./chunk-RVEOGRMF.js";
 import {
   EDITABLE_ARTIFACT_INTENT_MAX_BYTES,
   EDITABLE_ARTIFACT_KERNEL_TAIL_MAX_BYTES,
@@ -54,7 +54,7 @@ import {
   listEditableArtifactIdsForSession,
   touchEditableArtifactSessionLink,
   transactionallyAuthorizeEditableArtifactActor
-} from "./chunk-6ORJPCYW.js";
+} from "./chunk-5UOWNKPP.js";
 import {
   SessionTenancyAccessError,
   SessionTenancyConflictError,
@@ -71,8 +71,8 @@ import {
   replayAppliedSessionFork,
   sessionTenancyProductActivated,
   transitionSessionVisibility
-} from "./chunk-JILAWE26.js";
-import "./chunk-LSLNMENV.js";
+} from "./chunk-M5Z6II2P.js";
+import "./chunk-KZXWUXWV.js";
 import {
   ConnectAttemptConflictError,
   ConnectAttemptNotFoundError,
@@ -82,11 +82,11 @@ import {
   getConnectAttempt,
   getConnectBeginReplay,
   listPendingConnectAttempts
-} from "./chunk-XK6HXON2.js";
+} from "./chunk-UXFBXCHM.js";
 import {
   withOrganizationIntegrationAcquisition,
   withOrganizationIntegrationPolicyFence
-} from "./chunk-LO6BVXXH.js";
+} from "./chunk-LD52IFS3.js";
 import {
   AgentCommandAuthorityError,
   CHILD_LIFECYCLE_DEDUPE_PREFIX,
@@ -220,7 +220,7 @@ import {
   updateSessionCommandReceiptResult,
   workspaceControlLockBudget,
   workspaceControlRequestLockTimeoutMs
-} from "./chunk-CSVHCF3R.js";
+} from "./chunk-IB3SW3JW.js";
 import {
   ACTIVE_VIDEO_GENERATION_STATUSES,
   VideoGenerationCapacityError,
@@ -252,7 +252,7 @@ import {
   settleVideoGenerationFailure,
   settleVideoGenerationReady,
   updateWorkspaceVideoGenerationPolicy
-} from "./chunk-I7HQL6FK.js";
+} from "./chunk-ZM5BA3TD.js";
 import {
   external_exports
 } from "./chunk-4UJCXBR2.js";
@@ -278,12 +278,13 @@ import {
   reapManagedAuthIsolatedSessions,
   releaseManagedAuthActorMutationLease,
   validateManagedAuthActorMutationLease
-} from "./chunk-4RDUZ5UV.js";
+} from "./chunk-4ZQFT5II.js";
 import {
   SandboxProviderReadLockUnavailableError,
   SessionEventPersistenceError,
   createDb,
   currentSessionAttachmentReadAccess,
+  currentSessionRlsActorIdentityKey,
   databaseFailureCode,
   dbBindingFor,
   isDatabasePersistenceFailure,
@@ -316,7 +317,7 @@ import {
   withWorkspaceSubjectRls,
   withWorkspaceSubjectSessionActivityRls,
   withWorkspaceUsageLock
-} from "./chunk-4CCFFLDZ.js";
+} from "./chunk-BG46J5HF.js";
 import {
   agentRunStates,
   apiKeys,
@@ -552,11 +553,11 @@ import {
   xaiRotationSettings,
   xaiSessionAccountPins,
   xaiSubscriptionCredentials
-} from "./chunk-GSB4ISHE.js";
+} from "./chunk-IIPWNNVR.js";
 import {
   migrate,
   runMigrations
-} from "./chunk-MAMBI2HR.js";
+} from "./chunk-JPYN5XKV.js";
 import {
   LOSSLESS_CONTENT_CODEC_VERSION,
   LOSSLESS_JSON_STRING_PREFIX,
@@ -8407,6 +8408,7 @@ import {
 import {
   environmentsEncryptionKeyBytes as environmentsEncryptionKeyBytes2,
   SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS as SANDBOX_LIFECYCLE_TRANSITION_MAX_WAIT_MS2,
+  SANDBOX_DEADLINE_COMMAND_STOP_GRACE_MS,
   WORKSPACE_OPENROUTER_CONNECTION_DOMAIN as WORKSPACE_OPENROUTER_CONNECTION_DOMAIN2,
   WORKSPACE_OPENROUTER_CONNECTION_ROLE,
   VERCEL_AI_GATEWAY_CONNECTION_DOMAIN as VERCEL_AI_GATEWAY_CONNECTION_DOMAIN2,
@@ -24422,10 +24424,23 @@ async function completeSelfServiceOrganizationSetup(db, input) {
   return await db.transaction(async (tx) => {
     const txDb = tx;
     await setSubjectRlsContext(txDb, input.actorSubjectId);
+    await rawRows(
+      txDb,
+      sql47`select pg_catalog.set_config(
+      'opengeni.verified_signup_trial_enabled',
+      ${input.trialCreditsEnabled === true ? "on" : "off"}, true
+    )`
+    );
     const [row] = await rawRows(
       txDb,
       sql47`select complete_self_service_organization_setup(
-        ${JSON.stringify(input)}::jsonb
+        ${JSON.stringify({
+        authUserId: input.authUserId,
+        actorSubjectId: input.actorSubjectId,
+        organizationName: input.organizationName,
+        operationId: input.operationId,
+        requestFingerprint: input.requestFingerprint
+      })}::jsonb
       ) as result`
     );
     return CompleteSelfServiceOrganizationSetupResponse.parse(row?.result);
@@ -29496,36 +29511,36 @@ async function countScheduledTaskFires(db, input) {
 async function aggregateSessionDepth(db, workspaceId) {
   const context = await rlsContextForWorkspace(db, workspaceId);
   return await withRlsContext(db, context, async (scopedDb) => {
-    const buckets = await scopedDb.select({
+    const buckets = (await scopedDb.select({
       depth: sessions.nestedAgentDepth,
       sessions: sql59`count(*)::int`
-    }).from(sessions).where(eq41(sessions.workspaceId, workspaceId)).groupBy(sessions.nestedAgentDepth).orderBy(sessions.nestedAgentDepth);
-    const [stats] = await scopedDb.select({
-      sessionsTouched: sql59`count(*)::int`,
-      rootSessions: sql59`count(*) filter (where ${sessions.nestedAgentDepth} = 0)::int`,
-      deepestDepth: sql59`coalesce(max(${sessions.nestedAgentDepth}), 0)`,
-      avgDepth: sql59`coalesce(avg(${sessions.nestedAgentDepth}), 0)`
-    }).from(sessions).where(eq41(sessions.workspaceId, workspaceId));
-    const [deepest] = await scopedDb.select({
+    }).from(sessions).where(eq41(sessions.workspaceId, workspaceId)).groupBy(sessions.nestedAgentDepth).orderBy(sessions.nestedAgentDepth)).map((row) => ({ depth: row.depth, sessions: Number(row.sessions) }));
+    const sessionsTouched = buckets.reduce((sum, bucket) => sum + bucket.sessions, 0);
+    const rootSessions = buckets.find((bucket) => bucket.depth === 0)?.sessions ?? 0;
+    const deepestDepth = buckets.reduce((max, bucket) => Math.max(max, bucket.depth), 0);
+    const avgDepth = sessionsTouched > 0 ? buckets.reduce((sum, bucket) => sum + bucket.depth * bucket.sessions, 0) / sessionsTouched : 0;
+    const [deepest] = sessionsTouched > 0 ? await scopedDb.select({
       id: sessions.id,
       title: sessions.title,
       depth: sessions.nestedAgentDepth
-    }).from(sessions).where(eq41(sessions.workspaceId, workspaceId)).orderBy(desc13(sessions.nestedAgentDepth), desc13(sessions.updatedAt)).limit(1);
+    }).from(sessions).where(
+      and40(
+        eq41(sessions.workspaceId, workspaceId),
+        eq41(sessions.nestedAgentDepth, deepestDepth)
+      )
+    ).orderBy(desc13(sessions.updatedAt)).limit(1) : [];
     const [goals] = await scopedDb.select({
       active: sql59`count(*) filter (where ${sessionGoals.status} = 'active')::int`,
       completed: sql59`count(*) filter (where ${sessionGoals.status} = 'completed')::int`
     }).from(sessionGoals).where(eq41(sessionGoals.workspaceId, workspaceId));
     return {
-      buckets: buckets.map((row) => ({
-        depth: row.depth,
-        sessions: Number(row.sessions)
-      })),
-      sessionsTouched: Number(stats?.sessionsTouched ?? 0),
-      rootSessions: Number(stats?.rootSessions ?? 0),
-      deepestDepth: Number(stats?.deepestDepth ?? 0),
+      buckets,
+      sessionsTouched,
+      rootSessions,
+      deepestDepth,
       deepestSessionId: deepest?.id ?? null,
       deepestSessionTitle: deepest?.title?.trim() || "",
-      avgDepth: Number(stats?.avgDepth ?? 0),
+      avgDepth,
       goalsActive: Number(goals?.active ?? 0),
       goalsCompleted: Number(goals?.completed ?? 0)
     };
@@ -36849,6 +36864,9 @@ function associationFromRow(row) {
     lastUsedAt: iso13(row.lastUsedAt)
   };
 }
+function readStoredBrowserCapabilities(value) {
+  return BrowserSessionCapabilities.parse({ permissions: false, ...value });
+}
 function browserSessionFromRows(row, associations) {
   return BrowserSession.parse({
     id: row.id,
@@ -36866,7 +36884,7 @@ function browserSessionFromRows(row, associations) {
     baseRevisionId: row.baseRevisionId,
     networkRouteId: row.networkRouteId,
     linkedComputerSessionId: row.linkedComputerSessionId,
-    capabilities: row.capabilities,
+    capabilities: readStoredBrowserCapabilities(row.capabilities),
     associations: associations.map(associationFromRow),
     createdBySubjectId: row.createdBySubjectId,
     createdAt: iso13(row.createdAt),
@@ -37681,6 +37699,50 @@ async function prepareBrowserSessionSuspend(db, input) {
     }
   });
 }
+async function failPreparedBrowserSessionSuspend(db, input) {
+  const error = InteractionError.parse(input.error);
+  return await withRlsContext(
+    db,
+    input,
+    async (scopedDb) => await scopedDb.transaction(async (txRaw) => {
+      const tx = txRaw;
+      await lockOperation3(tx, input.workspaceId, input.operationId);
+      const operation = await loadOperation2(tx, input.workspaceId, input.operationId);
+      assertOperationResource(operation, input.browserSessionId, "suspend");
+      if (operation.state !== "prepared" || operation.dispatchedAt) return null;
+      await lockBrowserSession(tx, input.workspaceId, input.browserSessionId);
+      const now = /* @__PURE__ */ new Date();
+      const [sessionRow] = await tx.update(browserSessions).set({ lifecycle: "active", failureCode: null, updatedAt: now }).where(
+        and50(
+          eq51(browserSessions.workspaceId, input.workspaceId),
+          eq51(browserSessions.id, input.browserSessionId),
+          eq51(browserSessions.lifecycle, "suspending")
+        )
+      ).returning();
+      if (!sessionRow) {
+        throw new BrowserSessionStateError("Prepared BrowserSession suspension changed state");
+      }
+      const [operationRow] = await tx.update(interactionOperations).set({
+        state: "failed",
+        errorCode: error.code,
+        errorMessage: error.message,
+        errorRetryable: error.retryable,
+        errorDetails: error.details ?? null,
+        settledAt: now,
+        updatedAt: now
+      }).where(eq51(interactionOperations.operationId, input.operationId)).returning();
+      if (!operationRow) throw new Error("BrowserSession failure receipt was lost");
+      const associations = await loadAssociations(tx, input.workspaceId, [
+        input.browserSessionId
+      ]);
+      await advanceWorkspaceInteractionRevision(tx, input.accountId, input.workspaceId);
+      return BrowserSessionMutationResponse.parse({
+        session: browserSessionFromRows(sessionRow, associations),
+        operation: operationReceipt(operationRow, false)
+      });
+    })
+  );
+}
 async function prepareBrowserSessionResume(db, input) {
   return await prepareBrowserSessionLifecycleTransition(db, input, {
     kind: "resume",
@@ -42164,6 +42226,7 @@ import {
   KnowledgeEntryRestoreRequest,
   KnowledgeEntrySaveRequest,
   KnowledgeEntrySummary,
+  KnowledgeIndexStatus,
   KnowledgeEntryWriteReceipt
 } from "@opengeni/contracts";
 import { sql as sql84 } from "drizzle-orm";
@@ -42351,6 +42414,27 @@ function decodeProjection(value, full) {
     }
   });
 }
+async function withIndexStatus(db, context, entries, view) {
+  if (view === "archived" || view === "rejected") return entries;
+  const items = entries.filter(
+    (entry) => ("entry" in entry.revision ? entry.revision.entry.kind : entry.revision.kind) === "source"
+  ).map((entry) => ({ entryId: entry.id, revisionId: entry.revision.id }));
+  if (!items.length) return entries;
+  const statuses = await inKnowledgeContext(db, context, async (tx) => {
+    const [row] = await rawRows(
+      tx,
+      sql84`SELECT knowledge_visible_index_status(${context.accountId}::uuid,
+        ${context.workspaceId}::uuid,${JSON.stringify(context.actor)}::jsonb,
+        ${JSON.stringify(items)}::jsonb,${view}) AS result`
+    );
+    return external_exports.array(external_exports.object({ entryId: external_exports.uuid(), revisionId: external_exports.uuid(), status: KnowledgeIndexStatus })).parse(row?.result);
+  });
+  const byRevision = new Map(statuses.map((item) => [item.revisionId, item.status]));
+  return entries.map((entry) => {
+    const indexStatus = byRevision.get(entry.revision.id);
+    return indexStatus ? { ...entry, indexStatus } : entry;
+  });
+}
 async function read(db, context, request) {
   return inKnowledgeContext(db, context, async (tx) => {
     const [row] = await rawRows(
@@ -42369,7 +42453,9 @@ async function getKnowledgeEntry(db, context, entryId, options = {}) {
     view: external_exports.enum(["published", "needs_review", "archived", "rejected"]).optional()
   }).strict().parse({ entryId, ...options });
   const rows = await read(db, context, { ...request, operation: "get", limit: 1 });
-  return rows[0] ? decodeProjection(rows[0], true) : null;
+  if (!rows[0]) return null;
+  const record4 = decodeProjection(rows[0], true);
+  return (await withIndexStatus(db, context, [record4], request.view ?? "published"))[0];
 }
 var Cursor2 = external_exports.object({
   v: external_exports.literal(2),
@@ -42402,7 +42488,12 @@ async function listKnowledgeEntries(db, context, input = {}, embedding) {
       embeddingModel: embedding.model
     } : {}
   });
-  const entries = rows.slice(0, request.limit).map((row) => decodeProjection(row, false));
+  const entries = await withIndexStatus(
+    db,
+    context,
+    rows.slice(0, request.limit).map((row) => decodeProjection(row, false)),
+    request.view
+  );
   return {
     entries,
     nextCursor: rows.length > request.limit && entries.length ? Buffer.from(
@@ -42719,6 +42810,37 @@ var Claim = external_exports.object({
   generation: external_exports.number().int().positive(),
   nextIndex: external_exports.number().int().nonnegative()
 });
+async function knowledgeIndexBillingActivationTime(db) {
+  const [row] = await rawRows(
+    db,
+    sql85`SELECT clock_timestamp() AS "activatedAt"`
+  );
+  return external_exports.coerce.date().parse(row?.activatedAt);
+}
+async function freezeKnowledgeIndexBillingMode(db, raw2, requested, activatedAt, rateMicrosPerMillionBytes) {
+  const claim = Claim.parse(raw2);
+  return withRlsContext(db, { accountId: claim.accountId }, async (tx) => {
+    const [row] = await rawRows(
+      tx,
+      sql85`SELECT knowledge_index_billing_policy(${claim.accountId}::uuid,
+        ${claim.revisionId}::uuid,${claim.leaseId}::uuid,${requested},
+        ${activatedAt.toISOString()}::timestamptz,
+        ${rateMicrosPerMillionBytes}::bigint) AS policy`
+    );
+    return external_exports.object({
+      mode: external_exports.enum(["usage_only", "shadow", "credits", "awaiting_review", "obsolete"]),
+      rateMicrosPerMillionBytes: external_exports.number().int().nonnegative()
+    }).parse(row?.policy);
+  });
+}
+async function withKnowledgeQueryAccountLock(db, accountId, workspaceId, fn) {
+  return withWorkspaceUsageLock(db, workspaceId, async (tx) => {
+    await tx.execute(
+      sql85`SELECT pg_advisory_xact_lock(hashtext(${`knowledge-query-account:${accountId}`}))`
+    );
+    return fn(tx);
+  });
+}
 async function claimKnowledgeIndexJobs(db, input) {
   const request = external_exports.object({
     model: Claim.shape.model,
@@ -42785,6 +42907,28 @@ async function completeKnowledgeIndexJob(db, claim, expectedNextIndex) {
 async function deferKnowledgeIndexJob(db, claim) {
   return work(db, claim, { operation: "fail" });
 }
+async function waitKnowledgeIndexForFunding(db, raw2) {
+  const claim = Claim.parse(raw2);
+  return withRlsContext(db, { accountId: claim.accountId }, async (tx) => {
+    const [row] = await rawRows(
+      tx,
+      sql85`SELECT knowledge_index_wait_for_funding(${claim.accountId}::uuid,
+        ${claim.revisionId}::uuid,${claim.leaseId}::uuid) AS result`
+    );
+    return external_exports.object({ status: external_exports.enum(["pending", "obsolete"]) }).parse(row?.result);
+  });
+}
+async function guardPaidKnowledgeIndexPublication(db, raw2) {
+  const claim = Claim.parse(raw2);
+  return withRlsContext(db, { accountId: claim.accountId }, async (tx) => {
+    const [row] = await rawRows(
+      tx,
+      sql85`SELECT knowledge_index_paid_publication_guard(${claim.accountId}::uuid,
+        ${claim.revisionId}::uuid,${claim.leaseId}::uuid) AS status`
+    );
+    return external_exports.enum(["published", "awaiting_review", "obsolete"]).parse(row?.status);
+  });
+}
 async function continueKnowledgeIndexJob(db, claim) {
   return work(db, claim, { operation: "continue" });
 }
@@ -45702,6 +45846,47 @@ async function applyCreditDebitUpToBalance(db, input) {
     }
   );
 }
+async function applyCreditDebitAfterUse(db, input) {
+  if (!Number.isSafeInteger(input.amountMicros) || input.amountMicros <= 0) {
+    throw new Error("post-use credit debit requires a positive, safe integer micro amount");
+  }
+  return await withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId ?? null },
+    async (scopedDb) => {
+      const inserted = await scopedDb.insert(creditLedgerEntries).values({
+        accountId: input.accountId,
+        workspaceId: input.workspaceId ?? null,
+        type: input.type,
+        amountMicros: -input.amountMicros,
+        sourceType: input.sourceType,
+        sourceId: input.sourceId,
+        idempotencyKey: input.idempotencyKey,
+        metadata: input.metadata ?? {},
+        occurredAt: input.occurredAt ?? /* @__PURE__ */ new Date()
+      }).onConflictDoNothing({ target: creditLedgerEntries.idempotencyKey }).returning({ id: creditLedgerEntries.id });
+      if (inserted.length === 0) {
+        const [prior] = await scopedDb.select({
+          accountId: creditLedgerEntries.accountId,
+          workspaceId: creditLedgerEntries.workspaceId,
+          type: creditLedgerEntries.type,
+          amountMicros: creditLedgerEntries.amountMicros,
+          sourceType: creditLedgerEntries.sourceType,
+          sourceId: creditLedgerEntries.sourceId
+        }).from(creditLedgerEntries).where(eq59(creditLedgerEntries.idempotencyKey, input.idempotencyKey));
+        if (!prior || prior.accountId !== input.accountId || prior.workspaceId !== (input.workspaceId ?? null) || prior.type !== input.type || prior.amountMicros !== -input.amountMicros || prior.sourceType !== input.sourceType || prior.sourceId !== input.sourceId) {
+          throw new Error(
+            "post-use credit debit idempotency key conflicts with a different charge"
+          );
+        }
+      }
+      return {
+        balance: await getBillingBalance(scopedDb, input.accountId),
+        debitedMicros: inserted.length ? input.amountMicros : 0
+      };
+    }
+  );
+}
 async function hasCreditLedgerEntry(db, accountId, idempotencyKey) {
   return await withAccountRls(db, accountId, async (scopedDb) => {
     const [row] = await scopedDb.select({ id: creditLedgerEntries.id }).from(creditLedgerEntries).where(
@@ -46420,6 +46605,24 @@ async function getRetainedScreenshotArtifact(db, workspaceId, sessionId, artifac
     return row ? mapRetainedScreenshotArtifact(row.artifact, row.file) : null;
   });
 }
+async function getRetainedScreenshotArtifactForToolCall(db, workspaceId, sessionId, toolCallId) {
+  return await withWorkspaceRls(db, workspaceId, async (scopedDb) => {
+    const rows = await scopedDb.select({ artifact: retainedScreenshotArtifacts, file: files }).from(retainedScreenshotArtifacts).innerJoin(
+      files,
+      and58(
+        eq59(files.workspaceId, retainedScreenshotArtifacts.workspaceId),
+        eq59(files.id, retainedScreenshotArtifacts.artifactId)
+      )
+    ).where(
+      and58(
+        eq59(retainedScreenshotArtifacts.workspaceId, workspaceId),
+        eq59(retainedScreenshotArtifacts.sessionId, sessionId),
+        eq59(retainedScreenshotArtifacts.toolCallId, toolCallId)
+      )
+    ).limit(2);
+    return rows.length === 1 ? mapRetainedScreenshotArtifact(rows[0].artifact, rows[0].file) : null;
+  });
+}
 async function claimRetainedScreenshotMaintenance(db, input) {
   const rows = await rawRows(
     db,
@@ -67818,74 +68021,129 @@ function assertPendingToolOutputPolicyMatches(stored, supplied, callId) {
     );
   }
 }
+function pendingToolCallItemsEqual(left, right) {
+  if (left === right) return true;
+  if (left === null || right === null || typeof left !== "object" || typeof right !== "object")
+    return false;
+  if (Array.isArray(left) || Array.isArray(right)) {
+    return Array.isArray(left) && Array.isArray(right) && left.length === right.length && left.every((value, index) => pendingToolCallItemsEqual(value, right[index]));
+  }
+  const keys = Object.keys(left);
+  return keys.length === Object.keys(right).length && keys.every(
+    (key2) => Object.hasOwn(right, key2) && pendingToolCallItemsEqual(
+      left[key2],
+      right[key2]
+    )
+  );
+}
 async function registerPendingSessionToolCall(db, input) {
-  return await withRlsContext(
-    db,
-    { accountId: input.accountId, workspaceId: input.workspaceId },
-    async (scopedDb) => await scopedDb.transaction(async (tx) => {
-      const fence = await lockTurnAttemptWriteFenceTx(tx, {
-        workspaceId: input.workspaceId,
-        sessionId: input.sessionId,
-        turnId: input.turnId,
-        executionGeneration: input.executionGeneration,
-        attemptId: input.attemptId
-      });
-      if (!fence.allowed) return { accepted: false, registered: false };
-      const inserted = await tx.insert(sessionPendingToolCalls).values(
-        withLosslessContentWriteVersion(
-          {
-            accountId: input.accountId,
+  const correlationId = crypto.randomUUID();
+  const registerOnce = async (attempt) => {
+    try {
+      return await withRlsContext(
+        db,
+        { accountId: input.accountId, workspaceId: input.workspaceId },
+        async (scopedDb) => await scopedDb.transaction(async (tx) => {
+          const fence = await lockTurnAttemptWriteFenceTx(tx, {
             workspaceId: input.workspaceId,
             sessionId: input.sessionId,
             turnId: input.turnId,
             executionGeneration: input.executionGeneration,
-            attemptId: input.attemptId,
-            callId: input.callId,
-            callType: input.callType,
-            callItem: input.callItem,
-            modelToolOutputTruncationTokens: input.modelToolOutputTruncationTokens ?? null
-          },
-          "callItem",
-          "callItemCodecVersion"
-        )
-      ).onConflictDoNothing({
-        target: [
-          sessionPendingToolCalls.workspaceId,
-          sessionPendingToolCalls.turnId,
-          sessionPendingToolCalls.callId
-        ]
-      }).returning({ id: sessionPendingToolCalls.id });
-      if (inserted.length === 0) {
-        const [pending] = await tx.select({
-          id: sessionPendingToolCalls.id,
-          modelToolOutputTruncationTokens: sessionPendingToolCalls.modelToolOutputTruncationTokens
-        }).from(sessionPendingToolCalls).where(
-          and58(
-            eq59(sessionPendingToolCalls.workspaceId, input.workspaceId),
-            eq59(sessionPendingToolCalls.sessionId, input.sessionId),
-            eq59(sessionPendingToolCalls.turnId, input.turnId),
-            eq59(sessionPendingToolCalls.callId, input.callId)
-          )
-        ).for("update").limit(1);
-        if (!pending) {
-          throw new Error(
-            `Pending SDK tool call disappeared during registration: ${input.callId}`
-          );
-        }
-        assertPendingToolOutputPolicyMatches(
-          pending.modelToolOutputTruncationTokens,
-          input.modelToolOutputTruncationTokens,
-          input.callId
-        );
-        if (pending.modelToolOutputTruncationTokens === null && input.modelToolOutputTruncationTokens !== void 0) {
-          await tx.update(sessionPendingToolCalls).set({
-            modelToolOutputTruncationTokens: input.modelToolOutputTruncationTokens
-          }).where(eq59(sessionPendingToolCalls.id, pending.id));
-        }
+            attemptId: input.attemptId
+          });
+          if (!fence.allowed) return { accepted: false, registered: false };
+          const inserted = await tx.insert(sessionPendingToolCalls).values(
+            withLosslessContentWriteVersion(
+              {
+                accountId: input.accountId,
+                workspaceId: input.workspaceId,
+                sessionId: input.sessionId,
+                turnId: input.turnId,
+                executionGeneration: input.executionGeneration,
+                attemptId: input.attemptId,
+                callId: input.callId,
+                callType: input.callType,
+                callItem: input.callItem,
+                modelToolOutputTruncationTokens: input.modelToolOutputTruncationTokens ?? null
+              },
+              "callItem",
+              "callItemCodecVersion"
+            )
+          ).onConflictDoNothing({
+            target: [
+              sessionPendingToolCalls.workspaceId,
+              sessionPendingToolCalls.turnId,
+              sessionPendingToolCalls.callId
+            ]
+          }).returning({ id: sessionPendingToolCalls.id });
+          if (inserted.length === 0) {
+            const [pending] = await tx.select({
+              id: sessionPendingToolCalls.id,
+              accountId: sessionPendingToolCalls.accountId,
+              callType: sessionPendingToolCalls.callType,
+              callItem: sessionPendingToolCalls.callItem,
+              callItemCodecVersion: sessionPendingToolCalls.callItemCodecVersion,
+              modelToolOutputTruncationTokens: sessionPendingToolCalls.modelToolOutputTruncationTokens
+            }).from(sessionPendingToolCalls).where(
+              and58(
+                eq59(sessionPendingToolCalls.workspaceId, input.workspaceId),
+                eq59(sessionPendingToolCalls.sessionId, input.sessionId),
+                eq59(sessionPendingToolCalls.turnId, input.turnId),
+                eq59(sessionPendingToolCalls.callId, input.callId)
+              )
+            ).for("update").limit(1);
+            if (!pending || pending.accountId !== input.accountId || pending.callType !== input.callType || !pendingToolCallItemsEqual(
+              fromPostgresLosslessJson(pending.callItem, pending.callItemCodecVersion),
+              input.callItem
+            )) {
+              throw new Error("Pending tool receipt conflicts with the registered call");
+            }
+            assertPendingToolOutputPolicyMatches(
+              pending.modelToolOutputTruncationTokens,
+              input.modelToolOutputTruncationTokens,
+              input.callId
+            );
+            if (pending.modelToolOutputTruncationTokens === null && input.modelToolOutputTruncationTokens !== void 0) {
+              await tx.update(sessionPendingToolCalls).set({
+                modelToolOutputTruncationTokens: input.modelToolOutputTruncationTokens
+              }).where(eq59(sessionPendingToolCalls.id, pending.id));
+            }
+          }
+          return { accepted: true, registered: inserted.length === 1 };
+        })
+      );
+    } catch (error) {
+      if (!isRetryableDatabaseTransportFailure(error)) throw error;
+      return { transportFailure: error, attempt };
+    }
+  };
+  const result = await runIdempotentPersistenceTransaction(
+    {
+      stage: "pending_tool_registration",
+      correlationId,
+      maxAttempts: 3,
+      onRetry: async ({ attempt }) => {
+        await new Promise((resolve) => setTimeout(resolve, 25 * attempt));
       }
-      return { accepted: true, registered: inserted.length === 1 };
-    })
+    },
+    registerOnce
   );
+  if ("transportFailure" in result) {
+    throw new SessionEventPersistenceError(
+      {
+        code: "db_failure",
+        sqlState: null,
+        stage: "pending_tool_registration",
+        eventTypes: [],
+        correlationId,
+        attempts: result.attempt,
+        retryOutcome: "not_retryable",
+        database: safeDatabaseErrorFacts(result.transportFailure)
+      },
+      result.transportFailure
+    );
+  }
+  return result;
 }
 async function recordPendingSessionToolCallResult(db, input) {
   return await withRlsContext(
@@ -69482,6 +69740,54 @@ var SandboxViewerAdmissionBlockedError = class extends Error {
   }
   name = "SandboxViewerAdmissionBlockedError";
 };
+var SandboxPaidComputeAdmissionError = class extends Error {
+  constructor(workspaceId, sandboxGroupId) {
+    super("Insufficient OpenGeni credits to admit paid sandbox compute");
+    this.workspaceId = workspaceId;
+    this.sandboxGroupId = sandboxGroupId;
+  }
+  name = "SandboxPaidComputeAdmissionError";
+};
+function warmBillingSnapshot(row) {
+  const value = row.resume_state?.opengeniWarmBilling;
+  if (!value || typeof value !== "object") return null;
+  const snapshot = value;
+  return (snapshot.mode === "usage_only" || snapshot.mode === "shadow" || snapshot.mode === "credits") && Number.isFinite(snapshot.rateMicrosPerSecond) && snapshot.rateMicrosPerSecond >= 0 && (snapshot.stopChargeAt === void 0 || typeof snapshot.stopChargeAt === "string" && Number.isFinite(Date.parse(snapshot.stopChargeAt))) && snapshot.accountId === row.account_id && snapshot.workspaceId === row.workspace_id ? snapshot : null;
+}
+async function markWarmBillingStopCutoff(db, input) {
+  return withRlsContext(
+    db,
+    { accountId: input.accountId, workspaceId: input.workspaceId },
+    async (scopedDb) => scopedDb.transaction(async (txRaw) => {
+      const tx = txRaw;
+      const [row] = await tx.execute(sql87`
+        select * from sandbox_leases where workspace_id = ${input.workspaceId}
+          and sandbox_group_id = ${input.sandboxGroupId} for update
+      `);
+      if (!row || Number(row.lease_epoch) !== input.expectedEpoch || row.liveness !== "draining" || Number(row.refcount) !== 0 && !row.unobservable_command_drain_ids?.length)
+        return null;
+      const snapshot = warmBillingSnapshot(row);
+      if (row.resume_state?.opengeniWarmBilling && !snapshot)
+        throw new Error("sandbox warm billing snapshot is invalid");
+      if (snapshot?.stopChargeAt) return new Date(snapshot.stopChargeAt);
+      const [stamped] = await tx.execute(sql87`
+        update sandbox_leases set
+          resume_state = jsonb_set(coalesce(resume_state, '{}'::jsonb),
+            '{opengeniWarmBilling}',
+            coalesce(resume_state->'opengeniWarmBilling',
+              jsonb_build_object('mode', 'usage_only', 'rateMicrosPerSecond', 0,
+                'accountId', account_id, 'workspaceId', workspace_id)) ||
+              jsonb_build_object('stopChargeAt', clock_timestamp()), true),
+          updated_at = now()
+        where id = ${row.id}
+        returning resume_state #>> '{opengeniWarmBilling,stopChargeAt}' as cutoff
+      `);
+      if (!stamped || !Number.isFinite(Date.parse(stamped.cutoff)))
+        throw new Error("sandbox warm billing stop cutoff was not saved");
+      return new Date(stamped.cutoff);
+    })
+  );
+}
 var SandboxLeaseRecoveryBlockedError = class extends Error {
   constructor(sandboxGroupId, leaseEpoch, code, recovery) {
     super(
@@ -69892,6 +70198,10 @@ async function acquireLeaseOnce(db, input) {
   const os = input.os ?? "linux";
   const subjectId = input.subjectId ?? null;
   const warmingLeaseTtlMs = input.warmingLeaseTtlMs ?? input.leaseTtlMs;
+  const warmPolicy = input.warmBilling ?? { mode: "usage_only", rateMicrosPerSecond: 0 };
+  if (!Number.isFinite(warmPolicy.rateMicrosPerSecond) || warmPolicy.rateMicrosPerSecond < 0) {
+    throw new Error("sandbox warm rate must be finite and non-negative");
+  }
   return await withRlsContext(
     db,
     { accountId, workspaceId },
@@ -69927,6 +70237,24 @@ async function acquireLeaseOnce(db, input) {
       const row = rows[0];
       if (!row) throw new Error(`Lease row vanished post-insert: ${sandboxGroupId}`);
       const liveness = row.liveness;
+      const existingSnapshot = warmBillingSnapshot(row);
+      if (row.resume_state?.opengeniWarmBilling && !existingSnapshot) {
+        throw new Error("sandbox warm billing snapshot is invalid");
+      }
+      const activeMode = input.warmBilling?.mode ?? existingSnapshot?.mode ?? "usage_only";
+      const activeRate = liveness !== "cold" && existingSnapshot?.mode === "credits" ? existingSnapshot.rateMicrosPerSecond : input.warmBilling?.rateMicrosPerSecond ?? existingSnapshot?.rateMicrosPerSecond ?? 0;
+      if (activeMode === "credits" && activeRate > 0 && (liveness === "cold" || existingSnapshot?.mode === "credits" && existingSnapshot.rateMicrosPerSecond > 0)) {
+        const alreadyHeld = await tx.execute(sql87`
+            select exists (select 1 from sandbox_lease_holders
+              where lease_id = ${row.id} and kind = ${kind} and holder_id = ${holderId}) as held
+          `);
+        if (!alreadyHeld[0]?.held) {
+          const balance = await getBillingBalance(tx, accountId);
+          if (balance.balanceMicros <= 0) {
+            throw new SandboxPaidComputeAdmissionError(workspaceId, sandboxGroupId);
+          }
+        }
+      }
       if ((kind === "viewer" || kind === "interaction") && Number(row.turn_holders) === 0) {
         const workspaceRows = await tx.execute(sql87`
             select sandbox_viewer_force_drain_reason
@@ -69934,7 +70262,7 @@ async function acquireLeaseOnce(db, input) {
             where id = ${workspaceId}
           `);
         const reason = workspaceRows[0]?.sandbox_viewer_force_drain_reason ?? null;
-        if (reason !== null) {
+        if (reason === "warm_cap") {
           throw new SandboxViewerAdmissionBlockedError(workspaceId, sandboxGroupId, reason);
         }
       }
@@ -69999,6 +70327,14 @@ async function acquireLeaseOnce(db, input) {
         };
       }
       if (liveness === "draining") {
+        if (warmBillingSnapshot(row)?.stopChargeAt) {
+          await tx.execute(sql87`
+              update sandbox_leases
+              set resume_state = resume_state #- '{opengeniWarmBilling,stopChargeAt}',
+                  updated_at = now()
+              where id = ${row.id}
+            `);
+        }
         await upsertLeaseHolder(tx, row.id, accountId, workspaceId, kind, holderId, subjectId, {
           subjectId: input.viewerSubjectId ?? null,
           authorityEpoch: input.viewerAuthorityEpoch ?? null
@@ -70018,6 +70354,13 @@ async function acquireLeaseOnce(db, input) {
         const casRows = await tx.execute(sql87`
           update sandbox_leases set
             liveness = 'warming',
+            ${input.warmBilling ? sql87`resume_state = coalesce(resume_state, '{}'::jsonb) ||
+              jsonb_build_object('opengeniWarmBilling', ${JSON.stringify({
+          mode: warmPolicy.mode,
+          rateMicrosPerSecond: warmPolicy.rateMicrosPerSecond,
+          accountId,
+          workspaceId
+        })}::jsonb),` : sql87``}
             ${image !== null ? sql87`image = ${image},` : sql87``}
             ${rigVersionId !== null ? sql87`rig_version_id = ${rigVersionId},` : sql87``}
             updated_at = now()
@@ -70986,7 +71329,11 @@ async function commitWarmingToWarm(db, input) {
           reason: "archive_generation_mismatch"
         };
       }
-      const completedAt = (/* @__PURE__ */ new Date()).toISOString();
+      const [warmClock] = await tx.execute(sql87`
+          select clock_timestamp() as completed_at
+        `);
+      if (!warmClock) throw new Error("sandbox warm-transition clock unavailable");
+      const completedAt = new Date(warmClock.completed_at).toISOString();
       const recovery = rematerialization ? {
         provider: {
           status: "exists",
@@ -71030,7 +71377,15 @@ async function commitWarmingToWarm(db, input) {
         input.resumeState ?? null,
         row.resume_state
       );
-      const resumeStateJson = JSON.stringify(resumeStateWithRecovery(withArchives, recovery));
+      const resumeStateJson = JSON.stringify(
+        resumeStateWithRecovery(
+          {
+            ...withArchives ?? {},
+            ...row.resume_state?.opengeniWarmBilling ? { opengeniWarmBilling: row.resume_state.opengeniWarmBilling } : {}
+          },
+          recovery
+        )
+      );
       const updated = await tx.execute(sql87`
           update sandbox_leases set
             liveness          = 'warm',
@@ -71118,7 +71473,15 @@ async function recordWarmingSandboxCreated(db, input) {
         input.resumeState ?? null,
         row.resume_state
       );
-      const resumeStateJson = JSON.stringify(resumeStateWithRecovery(withArchives, recovery));
+      const resumeStateJson = JSON.stringify(
+        resumeStateWithRecovery(
+          {
+            ...withArchives ?? {},
+            ...row.resume_state?.opengeniWarmBilling ? { opengeniWarmBilling: row.resume_state.opengeniWarmBilling } : {}
+          },
+          recovery
+        )
+      );
       const warmingTtlMs = input.warmingLeaseTtlMs ?? input.leaseTtlMs;
       const providerCreatedAt = input.providerCreatedAt ?? null;
       const providerDeadlineAt = input.providerDeadlineAt ?? null;
@@ -72638,7 +73001,7 @@ async function heartbeatLeaseHolderStatus(db, input) {
     async (scopedDb) => await scopedDb.transaction(async (txRaw) => {
       const tx = txRaw;
       const leases = await tx.execute(sql87`
-          select id, lease_epoch, liveness, rotation_requested_at from sandbox_leases
+          select id, account_id, workspace_id, resume_state, lease_epoch, liveness, rotation_requested_at from sandbox_leases
           where workspace_id = ${input.workspaceId}
             and sandbox_group_id = ${input.sandboxGroupId}
           for update
@@ -72663,6 +73026,19 @@ async function heartbeatLeaseHolderStatus(db, input) {
           fence: "holder_gone"
         };
       }
+      const snapshot = warmBillingSnapshot(lease);
+      if (lease.resume_state?.opengeniWarmBilling && !snapshot) {
+        throw new Error("sandbox warm billing snapshot is invalid");
+      }
+      if (Number(lease.lease_epoch) !== input.expectedEpoch)
+        return { holderAlive: true, leaseExtended: false, fence: "epoch" };
+      if (lease.liveness !== "warm" && lease.liveness !== "warming")
+        return { holderAlive: true, leaseExtended: false, fence: "liveness" };
+      if (lease.rotation_requested_at !== null)
+        return { holderAlive: true, leaseExtended: false, fence: "rotation_requested" };
+      if ((input.billingMode ?? snapshot?.mode) === "credits" && snapshot?.mode === "credits" && snapshot.rateMicrosPerSecond > 0 && (await getBillingBalance(tx, input.accountId)).balanceMicros <= 0) {
+        return { holderAlive: true, leaseExtended: false, fence: "funding" };
+      }
       const leaseRows = await tx.execute(sql87`
         update sandbox_leases set
           expires_at = now() + (${String(input.leaseTtlMs)} || ' milliseconds')::interval,
@@ -73125,6 +73501,8 @@ async function enrollUnobservableCommandIdleDrain(db, input) {
             'quarantined_provider_binding_mismatch')
       `);
     }
+    const deadlineStopGraceMs = SANDBOX_DEADLINE_COMMAND_STOP_GRACE_MS;
+    const deadlineRotation = initial.rotationReason === "provider_deadline" && initial.rotationRequestedAt !== null;
     const processes = await rawRows(
       tx,
       sql87`
@@ -73151,10 +73529,43 @@ async function enrollUnobservableCommandIdleDrain(db, input) {
                     (${input.idleGraceMs}::bigint * interval '1 millisecond')
               )
             )
+            or (
+              ${deadlineRotation}
+              and process.deadline_cancellation_requested_at < now() -
+                (${deadlineStopGraceMs}::bigint * interval '1 millisecond')
+              and process.reconcile_attempts >= 1
+              and (
+                (process.owner_actor_kind = 'turn' and attempt.state = 'closed'
+                  and attempt.quiesced_at is not null
+                  and greatest(attempt.quiesced_at, process.started_at) < now() -
+                    (${deadlineStopGraceMs}::bigint * interval '1 millisecond'))
+                or (process.owner_actor_kind = 'direct' and process.owner_attempt_id is null
+                  and process.started_at < now() -
+                    (${deadlineStopGraceMs}::bigint * interval '1 millisecond'))
+              )
+            )
           )
-          and attempt.state = 'closed'
-          and greatest(coalesce(attempt.quiesced_at, attempt.closed_at, attempt.updated_at), process.started_at) < now() -
-            (${input.idleGraceMs}::bigint * interval '1 millisecond')) as eligible
+          and (attempt.state = 'closed' or (
+            ${deadlineRotation}
+            and process.owner_actor_kind = 'direct' and process.owner_attempt_id is null))
+          and (
+            (attempt.state = 'closed' and
+              greatest(coalesce(attempt.quiesced_at, attempt.closed_at, attempt.updated_at), process.started_at) < now() -
+                (${input.idleGraceMs}::bigint * interval '1 millisecond'))
+            or (
+              ${deadlineRotation}
+              and process.deadline_cancellation_requested_at < now() -
+                (${deadlineStopGraceMs}::bigint * interval '1 millisecond')
+              and (
+                (process.owner_actor_kind = 'turn' and attempt.quiesced_at is not null
+                  and greatest(attempt.quiesced_at, process.started_at) < now() -
+                    (${deadlineStopGraceMs}::bigint * interval '1 millisecond'))
+                or (process.owner_actor_kind = 'direct' and process.owner_attempt_id is null
+                  and process.started_at < now() -
+                    (${deadlineStopGraceMs}::bigint * interval '1 millisecond'))
+              )
+            )
+          )) as eligible
       from sandbox_retained_processes process
       left join session_turn_attempts attempt on attempt.id = process.owner_attempt_id
         and attempt.workspace_id = process.workspace_id and attempt.session_id = process.session_id
@@ -73192,7 +73603,10 @@ async function enrollUnobservableCommandIdleDrain(db, input) {
     ))
       return null;
     if (!enrolled) {
-      if (lease.archive_capture_id !== null || await hasSandboxGroupAttemptActivityTx(tx, input))
+      if (lease.archive_capture_id !== null || await hasSandboxGroupAttemptActivityTx(tx, {
+        ...input,
+        idleGraceMs: deadlineRotation ? deadlineStopGraceMs : input.idleGraceMs
+      }))
         return null;
       await tx.execute(sql87`
         update sandbox_leases set unobservable_command_drain_ids = ${`{${ids.join(",")}}`}::uuid[],
@@ -73385,10 +73799,26 @@ async function reArmDrainingLease(db, input) {
   return await withRlsContext(
     db,
     { accountId: input.accountId, workspaceId: input.workspaceId },
-    async (scopedDb) => {
-      const rows = await scopedDb.execute(sql87`
+    async (scopedDb) => await scopedDb.transaction(async (txRaw) => {
+      const tx = txRaw;
+      const [lease] = await tx.execute(sql87`
+        select * from sandbox_leases
+        where workspace_id = ${input.workspaceId} and sandbox_group_id = ${input.sandboxGroupId}
+        for update
+      `);
+      if (!lease || lease.liveness !== "draining") return { rearmed: false };
+      const snapshot = warmBillingSnapshot(lease);
+      if (lease.resume_state?.opengeniWarmBilling && !snapshot) {
+        throw new Error("sandbox warm billing snapshot is invalid");
+      }
+      const activeMode = input.warmBilling?.mode ?? snapshot?.mode ?? "usage_only";
+      if (activeMode === "credits" && (snapshot ? snapshot.mode === "credits" && snapshot.rateMicrosPerSecond > 0 : input.warmBilling?.rateMicrosPerSecond !== void 0 && input.warmBilling.rateMicrosPerSecond > 0) && (await getBillingBalance(tx, input.accountId)).balanceMicros <= 0) {
+        throw new SandboxPaidComputeAdmissionError(input.workspaceId, input.sandboxGroupId);
+      }
+      const rows = await tx.execute(sql87`
         update sandbox_leases set
           liveness = 'warm',
+          resume_state = resume_state #- '{opengeniWarmBilling,stopChargeAt}',
           expires_at = now() + (${String(input.leaseTtlMs)} || ' milliseconds')::interval,
           updated_at = now()
         where workspace_id = ${input.workspaceId} and sandbox_group_id = ${input.sandboxGroupId}
@@ -73415,7 +73845,7 @@ async function reArmDrainingLease(db, input) {
         returning id
       `);
       return { rearmed: rows.length > 0 };
-    }
+    })
   );
 }
 async function confirmDrainCold(db, input) {
@@ -73706,6 +74136,9 @@ function mapRetainedProcess(row) {
     reconcileClaimedAt: row.reconcileClaimedAt?.toISOString() ?? null,
     reconcileAttempts: row.reconcileAttempts,
     lastReconcileOutcome: row.lastReconcileOutcome ?? null,
+    cancellationRequestedAt: row.cancellationRequestedAt?.toISOString() ?? null,
+    cancellationReason: row.cancellationReason ?? null,
+    deadlineCancellationRequestedAt: row.deadlineCancellationRequestedAt?.toISOString() ?? null,
     reconcileProofOutcome: row.reconcileProofOutcome ?? null,
     reconcileProofExitCode: row.reconcileProofExitCode ?? null,
     reconcileProofReason: row.reconcileProofReason ?? null,
@@ -79312,45 +79745,71 @@ async function accrueWarmSeconds(db, input) {
     async (scopedDb) => await scopedDb.transaction(async (txRaw) => {
       const tx = txRaw;
       const rows = await tx.execute(sql87`
-        select *,
-          case when last_meter_at is null then null
-               else floor(extract(epoch from (now() - last_meter_at)))::int end as meter_elapsed_s
+        select *
         from sandbox_leases
         where workspace_id = ${input.workspaceId} and sandbox_group_id = ${input.sandboxGroupId}
         for update
       `);
       const row = rows[0];
       if (!row) return none;
-      if (Number(row.lease_epoch) !== input.expectedEpoch || row.liveness !== "warm") {
+      if (Number(row.lease_epoch) !== input.expectedEpoch || row.liveness !== "warm" && !(input.finalDrain && row.liveness === "draining")) {
         return none;
       }
-      if (row.last_meter_at == null) {
+      const recovery = row.resume_state?.opengeniRecovery;
+      const warmStartedAt = recovery?.restore?.completedAt;
+      const warmStartMs = typeof warmStartedAt === "string" ? Date.parse(warmStartedAt) : NaN;
+      const snapshot = warmBillingSnapshot(row);
+      if (row.resume_state?.opengeniWarmBilling && !snapshot) {
+        throw new Error("sandbox warm billing snapshot is invalid");
+      }
+      const mode = input.billingMode === "credits" ? snapshot?.mode ?? "usage_only" : input.billingMode ?? snapshot?.mode ?? "usage_only";
+      const rate = snapshot?.rateMicrosPerSecond ?? input.warmRateMicrosPerSecond;
+      if (!Number.isFinite(warmStartMs) && mode === "credits" && rate > 0) {
+        throw new Error("paid warm lease has no valid warm-transition timestamp");
+      }
+      if (!Number.isFinite(warmStartMs) && row.last_meter_at == null) {
         await tx.execute(sql87`
-          update sandbox_leases set last_meter_at = now(), updated_at = now()
-          where id = ${row.id}
-        `);
+            update sandbox_leases set last_meter_at = now(), updated_at = now()
+            where id = ${row.id}
+          `);
         return none;
       }
-      const elapsedS = Number(row.meter_elapsed_s ?? 0);
-      if (elapsedS <= 0) {
+      const cursorMs = row.last_meter_at ? new Date(row.last_meter_at).getTime() : 0;
+      const startMs = Number.isFinite(warmStartMs) ? Math.max(cursorMs, warmStartMs) : cursorMs;
+      if (input.finalDrain && !snapshot?.stopChargeAt) {
+        throw new Error("sandbox final tick has no durable stop cutoff");
+      }
+      const upperBound = snapshot?.stopChargeAt && input.finalDrain ? sql87`${snapshot.stopChargeAt}::timestamptz` : sql87`clock_timestamp()`;
+      const elapsedRows = await tx.execute(sql87`
+          select greatest(0, floor(extract(epoch from (${upperBound} -
+            ${new Date(startMs).toISOString()}::timestamptz)) * 1000))::bigint as elapsed_ms
+        `);
+      const elapsedMs = Number(elapsedRows[0]?.elapsed_ms ?? 0);
+      const elapsedS = Math.floor(elapsedMs / 1e3);
+      if (elapsedS <= 0 && !(input.finalDrain && elapsedMs > 0)) {
         return none;
       }
       const tick = Number(row.last_meter_tick) + 1;
-      const costMicros = Math.round(elapsedS * Math.max(0, input.warmRateMicrosPerSecond));
+      const costMicros = mode === "usage_only" ? 0 : Math.round((input.finalDrain ? elapsedMs / 1e3 : elapsedS) * rate);
+      if (!Number.isSafeInteger(costMicros) || costMicros < 0) {
+        throw new Error("warm-cost estimate exceeds safe integer micros");
+      }
       await tx.execute(sql87`
         insert into usage_events
           (account_id, workspace_id, subject_id, event_type, quantity, unit,
-           source_resource_type, source_resource_id, idempotency_key, occurred_at)
+           source_resource_type, source_resource_id, idempotency_key, initiator_context, occurred_at)
         values
           (${input.accountId}, ${input.workspaceId}, ${input.subjectId ?? null},
            'sandbox.warm_seconds', ${elapsedS}, 'seconds',
            'sandbox_lease', ${`${input.sandboxGroupId}:${input.expectedEpoch}`},
            ${`usage:sandbox.warm_seconds:${input.sandboxGroupId}:${input.expectedEpoch}:${tick}`},
-           now())
+           ${JSON.stringify(mode === "shadow" ? { warmCostShadowMicros: costMicros } : {})}::jsonb, now())
         on conflict (idempotency_key) do nothing
       `);
-      if (costMicros > 0) {
-        await tx.execute(sql87`
+      let settledCostMicros = costMicros;
+      if (costMicros > 0 && mode === "credits") {
+        const costKey = `usage:sandbox.warm_cost:${input.sandboxGroupId}:${input.expectedEpoch}:${tick}`;
+        const inserted = await tx.execute(sql87`
           insert into usage_events
             (account_id, workspace_id, subject_id, event_type, quantity, unit,
              source_resource_type, source_resource_id, idempotency_key, occurred_at)
@@ -79358,30 +79817,43 @@ async function accrueWarmSeconds(db, input) {
             (${input.accountId}, ${input.workspaceId}, ${input.subjectId ?? null},
              'sandbox.warm_cost', ${costMicros}, 'usd_micros',
              'sandbox_lease', ${`${input.sandboxGroupId}:${input.expectedEpoch}`},
-             ${`usage:sandbox.warm_cost:${input.sandboxGroupId}:${input.expectedEpoch}:${tick}`},
+             ${costKey},
              now())
           on conflict (idempotency_key) do nothing
+          returning quantity
         `);
+        const previous = inserted[0] ? null : await tx.execute(sql87`
+                select quantity from usage_events
+                where idempotency_key = ${costKey}
+                  and account_id = ${input.accountId}
+                  and workspace_id = ${input.workspaceId}
+                  and event_type = 'sandbox.warm_cost'
+              `);
+        settledCostMicros = Number((inserted[0] ?? previous?.[0])?.quantity ?? 0);
+        if (!Number.isSafeInteger(settledCostMicros) || settledCostMicros <= 0) {
+          throw new Error("warm-cost tick idempotency key conflicts with another usage event");
+        }
+      }
+      if (costMicros > 0 && mode === "credits") {
+        await applyCreditDebitAfterUse(tx, {
+          accountId: input.accountId,
+          workspaceId: input.workspaceId,
+          type: "sandbox.warm_cost",
+          amountMicros: settledCostMicros,
+          sourceType: "sandbox_lease",
+          sourceId: `${input.sandboxGroupId}:${input.expectedEpoch}`,
+          idempotencyKey: `debit:sandbox.warm_cost:${input.sandboxGroupId}:${input.expectedEpoch}:${tick}`
+        });
       }
       await tx.execute(sql87`
         update sandbox_leases set
-          last_meter_at = now(), last_meter_tick = ${tick}, updated_at = now()
+          last_meter_at = ${new Date(startMs).toISOString()}::timestamptz + (${String(input.finalDrain ? elapsedMs : elapsedS * 1e3)} || ' milliseconds')::interval,
+          last_meter_tick = ${tick}, updated_at = now()
         where id = ${row.id}
       `);
-      return { accrued: true, seconds: elapsedS, tick, costMicros };
+      return { accrued: true, seconds: elapsedS, tick, costMicros: settledCostMicros };
     })
   );
-  if (result.accrued && result.costMicros > 0 && (input.debitCredits ?? true)) {
-    await applyCreditDebitUpToBalance(db, {
-      accountId: input.accountId,
-      workspaceId: input.workspaceId,
-      type: "sandbox.warm_cost",
-      requestedAmountMicros: result.costMicros,
-      sourceType: "sandbox_lease",
-      sourceId: `${input.sandboxGroupId}:${input.expectedEpoch}`,
-      idempotencyKey: `debit:sandbox.warm_cost:${input.sandboxGroupId}:${input.expectedEpoch}:${result.tick}`
-    }).catch(() => void 0);
-  }
   return result;
 }
 function startOfUtcMonthDefault(date = /* @__PURE__ */ new Date()) {
@@ -79390,9 +79862,7 @@ function startOfUtcMonthDefault(date = /* @__PURE__ */ new Date()) {
 async function forceDrainOverLimitViewerOnlyBoxes(db, input) {
   return await withWorkspaceUsageLock(db, input.workspaceId, async (scopedDb) => {
     let reason = null;
-    if (input.enforceBalance && input.balanceMicros <= 0) {
-      reason = "balance";
-    } else if (input.maxWarmSecondsPerWorkspace > 0) {
+    if (input.maxWarmSecondsPerWorkspace > 0) {
       const since = input.capWindowStart ?? startOfUtcMonthDefault();
       const [{ total } = { total: 0 }] = await scopedDb.select({
         total: sql87`coalesce(sum(${usageEvents.quantity}), 0)`
@@ -79435,76 +79905,25 @@ async function forceDrainOverLimitViewerOnlyBoxes(db, input) {
         )
     `);
     await scopedDb.execute(sql87`
-      select id from sandbox_leases
-      where workspace_id = ${input.workspaceId}
-        and liveness = 'warm' and turn_holders = 0
+      select lease.id from sandbox_leases lease
+      where lease.workspace_id = ${input.workspaceId}
+        and lease.liveness = 'warm' and lease.refcount = 0
+        and not exists (select 1 from sandbox_lease_holders h where h.lease_id = lease.id)
       order by id
       for update
     `);
-    const lostBrowsers = await scopedDb.execute(sql87`
-      update browser_sessions browser set
-        lifecycle = 'lost',
-        controller_id = null,
-        controller_generation = null,
-        placement_instance_id = null,
-        controller_heartbeat_at = null,
-        failure_code = 'workspace_force_drained',
-        updated_at = now()
-      where browser.workspace_id = ${input.workspaceId}
-        and browser.lifecycle in ('starting', 'active', 'suspending', 'restoring', 'ending')
-        and browser.controller_host_sandbox_group_id in (
-          select sandbox_group_id from sandbox_leases
-          where workspace_id = ${input.workspaceId}
-            and liveness = 'warm' and turn_holders = 0
-        )
-      returning browser.id
-    `);
-    const lostComputers = await scopedDb.execute(sql87`
-      update computer_sessions computer set
-        lifecycle = 'lost',
-        controller_id = null,
-        controller_generation = null,
-        placement_instance_id = null,
-        controller_heartbeat_at = null,
-        failure_code = 'workspace_force_drained',
-        updated_at = now()
-      where computer.workspace_id = ${input.workspaceId}
-        and computer.lifecycle in ('starting', 'active', 'suspending', 'restoring', 'ending')
-        and computer.sandbox_group_id in (
-          select sandbox_group_id from sandbox_leases
-          where workspace_id = ${input.workspaceId}
-            and liveness = 'warm' and turn_holders = 0
-        )
-      returning computer.id
-    `);
-    if (lostBrowsers.length > 0 || lostComputers.length > 0) {
-      await scopedDb.execute(sql87`
-        update workspace_interaction_revisions set
-          revision = revision + 1,
-          updated_at = now()
-        where workspace_id = ${input.workspaceId}
-      `);
-    }
-    await scopedDb.execute(sql87`
-      delete from sandbox_lease_holders h
-      where h.kind in ('viewer', 'interaction')
-        and h.lease_id in (
-          select id from sandbox_leases
-          where workspace_id = ${input.workspaceId}
-            and liveness = 'warm' and turn_holders = 0
-        )
-    `);
     const drained = await rawRows(
       scopedDb,
       sql87`
-      update sandbox_leases set
+      update sandbox_leases lease set
         liveness = 'draining',
         refcount = 0, turn_holders = 0, viewer_holders = 0,
         expires_at = now() + (${String(input.idleGraceMs)} || ' milliseconds')::interval,
         updated_at = now()
-      where workspace_id = ${input.workspaceId}
-        and liveness = 'warm' and turn_holders = 0
-      returning sandbox_group_id
+      where lease.workspace_id = ${input.workspaceId}
+        and lease.liveness = 'warm' and lease.refcount = 0
+        and not exists (select 1 from sandbox_lease_holders h where h.lease_id = lease.id)
+      returning lease.sandbox_group_id
     `
     );
     return {
@@ -93800,6 +94219,7 @@ export {
   SandboxLeaseRecoveryBlockedError,
   SandboxLeaseSupersededError,
   SandboxLeaseTransitionError,
+  SandboxPaidComputeAdmissionError,
   SandboxProviderReadLockUnavailableError,
   SandboxRecoveryConflictError,
   SandboxRetainedProcessPromotionFencedError,
@@ -93960,6 +94380,7 @@ export {
   appendSessionRealtimeOutboundInTransaction,
   applyCanonicalHumanIdentityOperation,
   applyContextCompaction,
+  applyCreditDebitAfterUse,
   applyCreditDebitUpToBalance,
   applyCreditLedgerEntry,
   applyKnowledgeMemoryOperation,
@@ -94273,6 +94694,7 @@ export {
   createWorkspaceOpenRouterCustomModel,
   createXaiSubscriptionCredential,
   currentMemorySlackConfigurationMatches,
+  currentSessionRlsActorIdentityKey,
   databaseFailureCode,
   sql88 as dbSql,
   deactivatePreferenceRegistry,
@@ -94397,6 +94819,7 @@ export {
   failHostExportBatch,
   failMemorySlackPublication,
   failOrganizationRetentionDeletion,
+  failPreparedBrowserSessionSuspend,
   failSandboxRematerialization,
   failScheduledGeneratedSessionRoute,
   failSessionRealtimeConnectionInTransaction,
@@ -94424,6 +94847,7 @@ export {
   forceDrainOverLimitViewerOnlyBoxes,
   forkSessionContent,
   freezeAgentLearningPolicy,
+  freezeKnowledgeIndexBillingMode,
   frozenInitiatorForCommandActor,
   getActiveSessionHistoryItems,
   getActiveSessionHistoryItemsPaged,
@@ -94560,6 +94984,7 @@ export {
   getRetainedFileArtifact,
   getRetainedProcess,
   getRetainedScreenshotArtifact,
+  getRetainedScreenshotArtifactForToolCall,
   getRig,
   getRigByName,
   getRigChange,
@@ -94682,6 +95107,7 @@ export {
   getXaiSubscriptionAccountAuthoritySnapshot,
   getXaiSubscriptionAccountMetadata,
   grantWorkspaceAccess,
+  guardPaidKnowledgeIndexPublication,
   hasAuditableGitHubInstallationAuthority,
   hasCreditLedgerEntry,
   hasPendingSteerAfterContextCompaction,
@@ -94731,6 +95157,7 @@ export {
   isStripeWebhookProcessed,
   issueSelfUserResourceGrant,
   issueToolGatewayApproval,
+  knowledgeIndexBillingActivationTime,
   knowledgeOriginalFileAsset,
   latestWorkspaceCapture,
   linkKnowledgeClaims,
@@ -94946,6 +95373,7 @@ export {
   markVideoGenerationSubmissionUncertain,
   markVideoGenerationTerminalUpdate,
   markVideoGenerationTerminalUpdateInTransaction,
+  markWarmBillingStopCutoff,
   markWarmLeaseInstanceLost,
   materializeConfirmedRememberKnowledgeMemory,
   materializeGoalContinuation,
@@ -95064,6 +95492,7 @@ export {
   readScheduledKnowledgeSource,
   readSessionFileAttachments,
   readSkillRemovalScope,
+  readStoredBrowserCapabilities,
   readVariableSetSecretAtomically,
   readWorkspaceArchiveCapturePreflight,
   readWorkspaceInsightsModelBundle,
@@ -95528,6 +95957,7 @@ export {
   verifyRetainedProcessMutationSettlement,
   verifyWorkspaceMutationSettlement,
   waitForSessionInputWithEvent,
+  waitKnowledgeIndexForFunding,
   wakeXaiCapacityWaiters,
   withAccountRls,
   withCodexAppsRequestAuthorization,
@@ -95536,6 +95966,7 @@ export {
   withCodexTokenDeadline,
   withDatabaseStatementTimeout,
   withDatabaseTimingObserver,
+  withKnowledgeQueryAccountLock,
   withOrganizationModelProviderCustomModelReadLock,
   withOrganizationXaiCapacityMutation,
   withRlsContext,