@opengeni/worker-bundle 1.0.1 → 2.0.0

package/dist/activities/agent-turn/codex.d.ts

@@ -24,7 +24,7 @@ export declare function acceptsPromptCacheKeyForTurn(resolvedModel: {
 export declare function refreshCappedCodexUsageRows(db: ActivityServices["db"], settings: Settings, workspaceId: string, accounts: Array<Pick<CodexAccountStatus, "id" | "status" | "primaryUsedPercent" | "secondaryUsedPercent" | "exhaustedUntil" | "exhaustedKind">>, capacitySignals: {
     signalCodexCapacityWorkflow?: ActivityServices["signalCodexCapacityWorkflow"] | undefined;
     wakeSessionWorkflow: ActivityServices["wakeSessionWorkflow"];
-}): Promise<Array<Pick<CodexAccountStatus, "id" | "status" | "primaryUsedPercent" | "secondaryUsedPercent" | "exhaustedUntil" | "exhaustedKind">>>;
+}, acceptedTurnId?: string): Promise<Array<Pick<CodexAccountStatus, "id" | "status" | "primaryUsedPercent" | "secondaryUsedPercent" | "exhaustedUntil" | "exhaustedKind">>>;
 /**
  * True once the lifetime last confirmed by Postgres is no longer trustworthy.
  * A missing or malformed deadline fails closed for a holder that claims to be

package/dist/activities/agent-turn/compaction-prep.d.ts

@@ -1,4 +1,3 @@
-import { serializedToolsForRemoteCompaction } from "@opengeni/runtime";
 import { type Settings } from "@opengeni/config";
 import { maybeCompactContext } from "../context-compaction.js";
 import type { CompactionSummarizer, RemoteCompactionV2Requester } from "../context-compaction.js";
@@ -10,10 +9,7 @@ import type { ClaimTurnOk } from "./claim.js";
 import type { GovernanceModelOk } from "./governance-model.js";
 import type { AttemptIdentityState, BillingState, ClaimedResult, EventingState, ProviderTurnState, TurnControlState } from "./turn-context.js";
 export type RemoteCompactionPrefix = {
-    tools: Awaited<ReturnType<typeof serializedToolsForRemoteCompaction>>;
-    instructions: string;
-    toolsReady: boolean;
-    agent: Parameters<typeof serializedToolsForRemoteCompaction>[0] | null;
+    agent: ReturnType<ActivityServices["runtime"]["buildAgent"]> | null;
 };
 export type CompactionPrepDeps = {
     input: RunAgentTurnInput;

package/dist/activities/agent-turn/errors.d.ts

@@ -1,3 +1,4 @@
+import { type CompactionProviderRejection, type MaterializationVerificationDiagnostic } from "@opengeni/runtime";
 import { type McpTransportRequestFailureDiagnostic } from "@opengeni/runtime/mcp-network";
 import { ApplicationFailure } from "@temporalio/activity";
 import type { CodexAccountStatus } from "@opengeni/db";
@@ -67,11 +68,9 @@ export declare function escapedMcpTimeoutRecoveryFailure(input: {
  * Convert the atomic claim transaction's failure into a small, stable
  * Temporal wire contract. The original error remains in activity diagnostics,
  * but SQL text, parameters, and arbitrary invariant messages never enter
- * workflow history. Every database failure is safe to re-read after backoff
- * because the claim transaction contains no model/tool effects. Database
- * constraints and authorization guards can also be repaired by a deployment or
- * authority refresh, so they must preserve pending work. Only a non-database
- * claim invariant is terminal.
+ * workflow history. Operational failures retry; other persistence rejections
+ * retain accepted work behind a durable explicit-recheck fence. Repeating the
+ * same rejected transaction without changed conditions is not recovery.
  */
 export declare function preClaimAdmissionFailure(error: unknown): ApplicationFailure;
 /**
@@ -147,7 +146,29 @@ export type SafeErrorDiagnostic = {
  */
 export declare function safeErrorDiagnostic(error: unknown): SafeErrorDiagnostic;
 export declare function safeErrorForTelemetry(error: unknown): Error;
+/**
+ * Guidance appended to a definitive provider rejection. Repeating the exact
+ * request cannot succeed, so the generic "send another message to retry"
+ * advice is wrong here: a new prompt re-sends the same rejected history.
+ */
+export declare const COMPACTION_PROVIDER_REJECTION_GUIDANCE = "The provider refused this exact request, so repeating it fails the same way until the conversation changes. If a new message fails again, start a new session.";
 export declare function compactionFailureReasonFromError(error: unknown): string;
+/**
+ * Exact `turn.failed` payload for a terminal compaction failure. A definitive
+ * provider rejection additionally carries its closed identifier record so the
+ * timeline, API consumers, and operators can name the rejected field without
+ * parsing the message.
+ */
+export declare function compactionFailureTurnEventPayload(error: unknown, overrides?: {
+    error?: string;
+}): {
+    error: string;
+    code: "context_compaction_failed";
+    retryable: false;
+    recovery: "user_message";
+    compacted: false;
+    providerRejection?: CompactionProviderRejection;
+};
 export declare function isCompactionSummaryFailure(error: unknown): boolean;
 export declare function shouldRecoverCompactionProviderFailure(error: unknown): boolean;
 export declare function classifyContextWindowOverflowError(error: unknown): {
@@ -227,6 +248,9 @@ export type XaiCredentialFailure = {
 export declare function classifyXaiCredentialFailure(error: unknown): XaiCredentialFailure | null;
 export declare function agentRunFailurePayload(error: unknown, options?: {
     isCodexTurn?: boolean;
+}): ReturnType<typeof baseAgentRunFailurePayload>;
+declare function baseAgentRunFailurePayload(error: unknown, options?: {
+    isCodexTurn?: boolean;
 }): {
     error: string;
     code?: string;
@@ -246,6 +270,7 @@ export declare function agentRunFailurePayload(error: unknown, options?: {
     database?: Record<string, string>;
     historyPersistenceStage?: MandatoryHistoryPersistenceStage;
     mcpTransportDiagnostic?: McpTransportRequestFailureDiagnostic;
+    materializationDiagnostic?: MaterializationVerificationDiagnostic;
 };
 export type CodexCredentialFailure = {
     kind: "auth" | "forbidden" | "rate_limit" | "quota";
@@ -285,3 +310,4 @@ export declare function codexUsageLimitFailurePayload(info: {
     detail?: string;
 };
 export declare const CODEX_USAGE_LIMIT_MAX_RESUME_MS: number;
+export {};

package/dist/activities/agent-turn/finalization-monitor.d.ts

@@ -0,0 +1,17 @@
+import type { Observability } from "@opengeni/observability";
+import type { TurnHeartbeatDetails } from "../../op-journal.js";
+export declare const TURN_FINALIZATION_STAGES: readonly ["tool_writers", "credential_renewals", "credential_cleanup", "quiescence_receipt", "event_flush", "provider_leases", "workspace_capture", "tool_close", "sandbox_provisioning", "sandbox_rotation", "workspace_snapshot", "sandbox_release"];
+export type TurnFinalizationStage = (typeof TURN_FINALIZATION_STAGES)[number];
+/** Starts only after agent execution ends. A cleanup-stage deadline never caps
+ * agent work and never detaches a physical writer to manufacture quiescence. */
+export declare function startTurnFinalizationMonitor(input: {
+    observability: Observability;
+    details: TurnHeartbeatDetails;
+    heartbeat: (details: TurnHeartbeatDetails) => void;
+    terminateWorker: () => void;
+    timeoutMs?: number;
+    slowAfterMs?: number;
+}): {
+    enter(next: TurnFinalizationStage): void;
+    stop(): void;
+};

package/dist/activities/agent-turn/finalization.d.ts

@@ -1,5 +1,5 @@
 import type { Settings } from "@opengeni/config";
-import type { currentActivityContext } from "../streaming.js";
+import { type currentActivityContext } from "../streaming.js";
 import type { RunAgentTurnInput, TurnActivityServices as ActivityServices } from "../types.js";
 import { createModelCheckpointMemoryCollector } from "../../model-checkpoint-memory-collector.js";
 import { makeMachineOpObserver } from "../../observability-metrics.js";

package/dist/activities/agent-turn/governance-model.d.ts

@@ -1,7 +1,6 @@
 import { materializeRigVersionForAttempt } from "@opengeni/db";
 import { renderWorkspaceGovernanceContext, type OpenGeniRuntime } from "@opengeni/runtime";
 import { type Settings } from "@opengeni/config";
-import { resolveWorkspacePackRuntime } from "../packs.js";
 import { createModelHistoryAttachmentProjector } from "../run-input.js";
 import type { TurnActivityServices as ActivityServices, RunAgentTurnInput, RunAgentTurnResult } from "../types.js";
 import { buildCompanyBrainContributionReceipt } from "../../model-context-contributions.js";
@@ -35,7 +34,6 @@ export type GovernanceModelDeps = {
 };
 export type GovernanceModelOk = {
     runtimePreparationStartedAt: number;
-    packRuntime: Awaited<ReturnType<typeof resolveWorkspacePackRuntime>>;
     rigVersion: NonNullable<Awaited<ReturnType<typeof materializeRigVersionForAttempt>>>["version"] | null;
     rigName: string | null;
     agentHumanInputEnabled: boolean;

package/dist/activities/agent-turn/quiescence.d.ts

@@ -88,6 +88,7 @@ export declare function drainAttemptOwnedSandboxWriters(input: {
     gitCredentialRenewals: readonly Pick<GitCredentialRenewalController, "stop">[];
     codemodeTokenRenewal: Pick<CodemodeTokenRenewalController, "stop"> | null;
     runCredentialRenewal: Pick<RunCredentialRenewalController, "stop"> | null;
+    onStage?: (stage: "tool_writers" | "credential_renewals") => void;
 }): Promise<void>;
 /** Persist the exact turn's second-stage release only after the caller has
  * crossed the physical writer boundary. This wait is intentionally independent

package/dist/activities/agent-turn/recovery-warning.d.ts

@@ -0,0 +1,8 @@
+import { type Database } from "@opengeni/db";
+/** Opt-in belongs to this warning-aware worker implementation, not the DB
+ * client, role defaults or deployment configuration. Claim stamps it locally. */
+export declare const FILESYSTEM_DISCONTINUITY_PROTOCOL: 1;
+export declare function recoveryAwareSessionInstructions(db: Database, workspaceId: string, session: {
+    id: string;
+    instructions?: string | null;
+}): Promise<string>;

package/dist/activities/agent-turn/run-credentials.d.ts

@@ -54,7 +54,6 @@ export declare function prepareRunCredentials(deps: PrepareRunCredentialsDeps):
     initialRunCredentialMaterial: NormalizedRunCredentialMaterial | null;
     runCredentialsNote: string | undefined;
     authorizeGitHubTokenMint: GitHubTokenMintAuthorization;
-    hostCredentialRootSessionId: string | null;
     gitCredentialAuthority: import("../environment.js").GitCredentialAuthority | undefined;
     codemodeAuthority: {
         sessionId: string;

package/dist/activities/agent-turn/sandbox-establish.d.ts

@@ -4,7 +4,7 @@ import { type GitCredentialTokenWriterSession, type NormalizedRunCredentialMater
 import { type Settings } from "@opengeni/config";
 import { mergeResourceRefs } from "../common.js";
 import { type MintedRunGitCredentials, type SandboxCodemodeAuthority } from "../environment.js";
-import { rigProviderImageSourceImage } from "../packs.js";
+import { rigProviderImageSourceImage } from "../sandbox-images.js";
 import type { TurnActivityServices as ActivityServices, RunAgentTurnInput } from "../types.js";
 import type { currentActivityContext } from "../streaming.js";
 import { type ResumedTurnSandbox } from "../../sandbox-resume.js";

package/dist/activities/agent-turn/sandbox-route.d.ts

@@ -109,15 +109,6 @@ export declare function reconcileActiveSandboxPointer(db: ActivityServices["db"]
     type: SessionEventType;
     payload: unknown;
 }>) => Promise<void> | void): Promise<LoadedActivePointer>;
-/**
- * Warm the Modal private-registry image for the image ref this turn actually
- * resolved, not only the deployment-global OPENGENI_MODAL_IMAGE_REF warmed at
- * worker boot. A provider-native modalImageId bypasses registry import and is
- * resolved by ModalImageSelector.fromId during create. Otherwise packs can
- * override `modalImageRef` per workspace/turn, so a private pack image must be
- * resolved before sandbox creation or Modal falls back to the unauthenticated
- * `fromTag` path.
- */
 export declare function ensureTurnModalRegistryImage(runSettings: Settings, sandboxCreationBackend: Settings["sandboxBackend"] | undefined, ensureRegistryImage?: (settings: Settings) => Promise<void>): Promise<void>;
 export declare const SANDBOX_ARTIFACT_RUNTIME_MANIFEST = "/opt/opengeni/artifact-runtime/installation.json";
 export declare const SANDBOX_ARTIFACT_TOOL_ENTRY = "/opt/opengeni/artifact-runtime/skill-facade-entry.mjs";
@@ -125,17 +116,6 @@ export type SandboxArtifactRuntimeAdmission = Readonly<{
     available: boolean;
     environment: Readonly<Record<string, string>>;
 }>;
-/**
- * Admit the optional native standalone-file runtime only for the deployment's
- * exact base sandbox image contract. A pack/rig image override is an
- * independent filesystem and therefore fails closed even when the deployment
- * base image is capable. Collaborative artifact skills are admitted separately
- * from the frozen canonical tool catalog.
- *
- * This keeps lazy provisioning intact: CI/release proves the image closure,
- * while a before-agent-start doctor verifies the actual box before any model
- * call. No speculative sandbox is created merely to populate the skill index.
- */
 export declare function sandboxArtifactRuntimeAdmission(deploymentSettings: Settings, runSettings: Settings, backend: Settings["sandboxBackend"] | undefined, options?: Readonly<{
     production?: boolean;
 }>): SandboxArtifactRuntimeAdmission;

package/dist/activities/agent-turn/sandbox-runtime.d.ts

@@ -40,7 +40,7 @@ export declare function createSandboxTurnRuntime(deps: SandboxTurnRuntimeDeps):
     onHomeSandboxRebound: (rebound: {
         established: EstablishedSandboxSession;
         leaseEpoch: number;
-    }) => void;
+    }) => Promise<void>;
     runWorkspaceMutationForSandbox: <T>(sandbox: ResumedTurnSandbox, operation: string, mutation: () => Promise<T>, observePhase?: (measurement: {
         phase: "admission" | "provider" | "settlement" | "snapshot_wait";
         outcome: "completed" | "failed";

package/dist/activities/agent-turn/skill-remove.d.ts

@@ -0,0 +1,14 @@
+import type { AttemptToolDefinition } from "@opengeni/codemode";
+import { z } from "zod";
+import type { SkillWriteReceipt } from "@opengeni/contracts";
+export declare const SkillRemoveRequest: z.ZodObject<{
+    operationId: z.ZodUUID;
+    skillId: z.ZodUUID;
+    expectedRevisionId: z.ZodNullable<z.ZodUUID>;
+    expectedScopeVersion: z.ZodNumber;
+    reason: z.ZodString;
+}, z.core.$strict>;
+export declare function createSkillRemoveAttemptToolDefinition(input: {
+    authorize: () => Promise<void>;
+    remove: (request: z.infer<typeof SkillRemoveRequest>) => Promise<SkillWriteReceipt>;
+}): AttemptToolDefinition;

package/dist/activities/agent-turn/skill-search.d.ts

@@ -7,7 +7,7 @@ export type WorkspaceSkillSearchEntry = Readonly<{
     revisionId?: string;
     scopeVersion?: number;
     installationVersion?: number;
-    source?: "workspace" | "builtin" | "session" | "pack";
+    source?: "workspace" | "builtin" | "session";
 }>;
 export declare function createSkillSearchAttemptToolDefinition(input: {
     authorize: () => Promise<void>;

package/dist/activities/agent-turn/stream-attempt.d.ts

@@ -82,6 +82,7 @@ export type TurnStreamAttemptDeps = {
     turn: {
         executionGeneration: number;
         model: string;
+        source?: string;
     };
     trigger: NonNullable<Awaited<ReturnType<typeof getSessionEvent>>>;
     humanInputResume: Awaited<ReturnType<typeof getHumanInputResumeForEvent>>;

package/dist/activities/agent-turn/tool-environment.d.ts

@@ -9,7 +9,6 @@ import type { GovernanceModelOk } from "./governance-model.js";
 import type { SandboxTurnRuntime } from "./sandbox-runtime.js";
 import type { sandboxArtifactRuntimeAdmission } from "./sandbox-route.js";
 import type { AttemptIdentityState, EventingState, SandboxRuntimeState, WorkspaceRefState } from "./turn-context.js";
-import type { RuntimeSkillActivation } from "@opengeni/runtime";
 export type PrepareTurnToolPolicyDeps = {
     input: RunAgentTurnInput;
     db: ActivityServices["db"];
@@ -25,7 +24,6 @@ export type PrepareTurnToolPolicyDeps = {
 };
 export type PrepareTurnToolRuntimeDeps = {
     fetchKnowledgeSource?: ((input: import("../types.js").RunKnowledgeSourceSyncBatchInput) => Promise<import("../types.js").RunKnowledgeSourceSyncBatchResult>) | undefined;
-    selectedSkillActivations: readonly RuntimeSkillActivation[];
     input: RunAgentTurnInput;
     catalogSourceSettings: Settings;
     db: ActivityServices["db"];
@@ -34,7 +32,6 @@ export type PrepareTurnToolRuntimeDeps = {
     objectStorage: ActivityServices["objectStorage"];
     observability: ActivityServices["observability"];
     cancellationSignal: AbortSignal | undefined;
-    connectionCredentials: ActivityServices["connectionCredentials"];
     eventing: EventingState;
     attempt: AttemptIdentityState;
     sandboxState: SandboxRuntimeState;
@@ -55,7 +52,6 @@ export type PrepareTurnToolRuntimeDeps = {
         accountId: string;
         workspaceId: string;
     };
-    hostCredentialRootSessionId: string | null;
     sandboxArtifactRuntime: ReturnType<typeof sandboxArtifactRuntimeAdmission>;
     activeSandboxBackend: Settings["sandboxBackend"] | undefined;
     groupBoxBackend: Settings["sandboxBackend"];

package/dist/activities/agent-turn/turn-context.d.ts

@@ -1,3 +1,4 @@
+import type { TurnHeartbeatDetails } from "../../op-journal.js";
 import type { Settings } from "@opengeni/config";
 import type { CodexUsageHeaderSnapshot } from "@opengeni/codex";
 import type { AppendEventInput, ApplySessionTurnSettlementInput } from "@opengeni/db";
@@ -89,6 +90,7 @@ export type RenewalState = {
     publishedRunCredentialNotices: Set<string>;
 };
 export type EventingState = {
+    heartbeatDetails: TurnHeartbeatDetails | null;
     heartbeatTimer: ReturnType<typeof startActivityHeartbeat> | undefined;
     batcher: ReturnType<typeof createRuntimeBatcher> | null;
     preparedTools: Awaited<ReturnType<OpenGeniRuntime["prepareTools"]>> | null;

package/dist/activities/agent-turn/turn-sandbox-access.d.ts

@@ -7,6 +7,9 @@ export type ResolvedTurnSandboxAccess = Readonly<{
     session: ChannelASession;
     leaseEpoch: number;
 }>;
+/** The lazy wrapper remains the agent's owner even after provisioning fills
+ * resolvedSandbox with the raw provider handle for capture and release. */
+export declare function ownedTurnSandboxForAgent(sandboxState: TurnSandboxAccessState): import("@opengeni/runtime").EstablishedSandboxSession | undefined;
 /** Join the turn's canonical sandbox boundary and return its active routed session. */
 export declare function resolveTurnSandboxAccess(sandboxState: TurnSandboxAccessState, sdkOwnedSandboxSession: unknown, unavailableMessage: string): Promise<ResolvedTurnSandboxAccess>;
 export {};

package/dist/activities/codex-capacity.d.ts

@@ -17,7 +17,7 @@ export declare function signalCodexCapacityWakeTargets(services: CodexCapacitySi
 export declare function signalPendingCodexCapacityWakeTargets(services: CodexCapacitySignalServices & {
     db: ControlActivityServices["db"];
 }, workspaceId: string): Promise<void>;
-export declare function codexCapacityDecision<TPolicyScope = never, TUnavailableDiagnostic = never>(context: CodexCapacitySelectionContext<TPolicyScope, TUnavailableDiagnostic>): ReturnType<Parameters<typeof reconcileCodexCapacityWaitDb>[2]>;
+export declare function codexCapacityDecision<TPolicyScope = never, TUnavailableDiagnostic = never>(context: CodexCapacitySelectionContext<TPolicyScope, TUnavailableDiagnostic>, now?: Date): ReturnType<Parameters<typeof reconcileCodexCapacityWaitDb>[2]>;
 /**
  * Arm a durable Codex waiter and immediately re-evaluate it under the
  * allocator lock. A capacity mutation that commits just before the waiter is
@@ -28,6 +28,11 @@ export declare function codexCapacityDecision<TPolicyScope = never, TUnavailable
 export declare function armAndReconcileCodexCapacityWait(services: Pick<ControlActivityServices, "db" | "bus">, input: Parameters<typeof armCodexCapacityWait>[1], options?: {
     onArmed?: () => void;
 }): Promise<{
+    action: "stopped";
+    sessionStatus: "failed" | "queued";
+    waiter: import("@opengeni/db").CodexCapacityWait;
+    events: import("@opengeni/contracts").SessionEvent[];
+} | {
     action: "stale";
     waiter: import("@opengeni/db").CodexCapacityWait | null;
     events: import("@opengeni/contracts").SessionEvent[];

package/dist/activities/codex-rotation.d.ts

@@ -1,7 +1,7 @@
 import type { CodexAccountStatus, CodexCredentialLeaseSelectionContext, CodexLeaseAccountStatus, CodexPinSource } from "@opengeni/db";
 export type CodexRotationAccount = CodexAccountStatus | CodexLeaseAccountStatus;
 /** Capacity metadata worth an authoritative live read before/all through an idle. */
-export declare function codexAccountNeedsLiveCapacityRefresh(account: Pick<CodexAccountStatus, "primaryUsedPercent" | "secondaryUsedPercent" | "exhaustedUntil" | "exhaustedKind">, now: Date): boolean;
+export declare function codexAccountNeedsLiveCapacityRefresh(account: Pick<CodexAccountStatus, "primaryUsedPercent" | "secondaryUsedPercent" | "exhaustedUntil" | "exhaustedKind">, _now: Date): boolean;
 export type CodexRotationStrategy = "most_remaining" | "round_robin" | "drain_then_next" | "sharded";
 /**
  * The ONE strategy rotation-enabled workspaces run: sticky-sharded. The legacy

package/dist/activities/context-compaction.d.ts

@@ -1,5 +1,5 @@
 import { type Database } from "@opengeni/db";
-import { type CompactionItem } from "@opengeni/runtime";
+import { type CompactionItem, type CompactionProviderRejection } from "@opengeni/runtime";
 import { type Settings } from "@opengeni/config";
 import type { SessionEvent } from "@opengeni/contracts";
 export type MaybeCompactResult = {
@@ -77,6 +77,12 @@ export declare function settleFailedContextCompactionLandmark(db: Database, scop
 }, options?: {
     clearRequestedCompaction?: boolean;
     publishLiveEvents?: (events: SessionEvent[]) => Promise<void>;
+    /**
+     * Closed identifier record of a definitive provider rejection. Carried on
+     * the visible `compaction.skipped` landmark so the timeline can name the
+     * rejected field instead of offering a retry that cannot succeed.
+     */
+    providerRejection?: CompactionProviderRejection | null;
 }): Promise<Extract<MaybeCompactResult, {
     compacted: false;
 }>>;

package/dist/activities/mcp-account-routes.d.ts

@@ -0,0 +1,22 @@
+import type { Settings } from "@opengeni/config";
+import type { McpConnectionAccountBinding, ToolRef, ToolAuthNeededPayload } from "@opengeni/contracts";
+import type { ApiIntegrationRuntime } from "@opengeni/db";
+export declare function accountRouteAuthNeededPayload(payload: ToolAuthNeededPayload, bindings: readonly McpConnectionAccountBinding[] | null | undefined): ToolAuthNeededPayload;
+/** Expand only after canonical tool-policy admission. Aliases are execution
+ * identities, never an alternate way to gain admission to a connector. */
+export declare function expandMcpAccountRoutes(input: {
+    settings: Settings;
+    tools: ToolRef[];
+    bindings: readonly McpConnectionAccountBinding[] | null | undefined;
+}): {
+    settings: Settings;
+    tools: ToolRef[];
+    accountLabels: ReadonlyMap<string, string>;
+};
+/** Each adapter closes over its own immutable credential ref and authority
+ * generation. Sharing a provider transport never shares a credential resolver. */
+export declare function expandApiIntegrationAccountRoutes(input: {
+    integrations: readonly ApiIntegrationRuntime[];
+    bindings: readonly McpConnectionAccountBinding[] | null | undefined;
+    tools: readonly ToolRef[];
+}): ApiIntegrationRuntime[];

package/dist/activities/mcp-credentials.d.ts

@@ -1,22 +1,21 @@
 import type { Settings } from "@opengeni/config";
-import type { ConnectionCredentialsPort } from "@opengeni/contracts";
-import { getSessionTurnForAttempt, resolveAcceptedConnectionUse, sessionTenancyProductActivated, type Database, type ResolveConnectionCredentialInput, type ResolveConnectionCredentialResult, type SessionTurnForExecution } from "@opengeni/db";
-import { type Observability } from "@opengeni/observability";
-export declare function connectionTokenResolverForTurn(input: {
+import { resolveAcceptedConnectionUse, type Database, type ResolveConnectionCredentialInput, type ResolveConnectionCredentialResult, type SessionTurnForExecution } from "@opengeni/db";
+type TurnConnectionInput = {
     db: Database;
     settings: Settings;
-    connectionCredentials?: ConnectionCredentialsPort | null;
     accountId: string;
     workspaceId: string;
     sessionId: string;
-    rootSessionId: string;
     attemptId: string;
     turn: SessionTurnForExecution;
+    /** Policy identities before account expansion; never used to select credentials. */
+    canonicalMcpServerIds?: readonly string[];
     authorizeAcceptedUse?: typeof resolveAcceptedConnectionUse;
-    /** Test seam; production always reads the canonical active-attempt projection. */
-    getHostTurnForAttempt?: typeof getSessionTurnForAttempt;
-    /** Test seam for the activation fence on pre-snapshot workspace refs. */
-    isSessionTenancyProductActivated?: typeof sessionTenancyProductActivated;
-    /** Optional; used only for content-free compatibility-lane counters. */
-    observability?: Observability | null | undefined;
-}): (request: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult>;
+};
+type CredentialResolver = (request: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult>;
+export declare function connectionTokenResolverForTurn(input: TurnConnectionInput): CredentialResolver;
+/** Bind the ordinary credential resolver to one immutable accepted turn.
+ * Credential acquisition and refresh stay inside the native connection engine;
+ * this layer adds the exact execution context and physical-request checks. */
+export declare function bindNativeConnectionCredentialsToTurn(input: TurnConnectionInput, nativeResolver: CredentialResolver): CredentialResolver;
+export {};

package/dist/activities/mcp-operation-authority.d.ts

@@ -1,16 +1,11 @@
 import type { ConnectionUseAttribution } from "@opengeni/contracts/connection-authority";
-import type { HostMcpAcceptedAuthority } from "@opengeni/contracts/host-mcp-bindings";
 import type { ResolveConnectionCredentialInput } from "@opengeni/db";
 /** Metadata only. Callers must obtain authority from a current live fence.
  * This equality key is never authorization and never replaces physical-use checks. */
 export declare function mcpOperationAuthorityDigest(request: ResolveConnectionCredentialInput, authority: {
     native: ConnectionUseAttribution;
-    host?: never;
     principal?: {
         kind: string;
         subjectId?: string;
     };
-} | {
-    host: HostMcpAcceptedAuthority;
-    native?: never;
 }): string;

package/dist/activities/rig-verification.d.ts

@@ -4,7 +4,6 @@ import { acquireLease, commitWarmingToWarm, failWarmingToCold, markWarmLeaseInst
 import { createTurnToolCancellationController, establishSandboxSessionFromEnvelope, serializeEstablishedSandboxEnvelope, tagModalSandbox, type EstablishedSandboxSession, type TurnSandboxCommandArgs, type TurnSandboxCommandSession } from "@opengeni/runtime/sandbox";
 import type { Context } from "@temporalio/activity";
 import type { ControlActivityServices } from "./types.js";
-import { type WorkspacePackRuntime } from "./packs.js";
 type SandboxLifecycleCommandRunner = (session: TurnSandboxCommandSession, args: TurnSandboxCommandArgs) => Promise<unknown>;
 export type RigVerificationWorkflowInput = {
     workspaceId: string;
@@ -29,7 +28,7 @@ export type RigPlatformCheckResult = CommandResult & RigCheck;
  */
 export declare function rigPlatformChecksForSettings(settings: ControlActivityServices["settings"]): RigCheck[];
 export declare const RIG_VERIFICATION_OWNER_TTL_MS: number;
-export declare const RIG_VERIFICATION_OWNERS_DISABLED_MESSAGE = "Rig verification lease ownership is disabled; refusing to create an unowned verifier sandbox";
+export declare const RIG_VERIFICATION_OWNERS_DISABLED_MESSAGE = "Sandbox Environment verification lease ownership is disabled; refusing to create an unowned verifier sandbox";
 export declare class RigVerificationActivityDeadlineError extends Error {
     readonly startToCloseTimeoutMs: number;
     readonly cleanupReserveMs: number;
@@ -146,7 +145,7 @@ export declare function buildVerifiedRigProviderImage(input: {
     lifecycle: RigVerificationActivityLifecycle;
     signal: AbortSignal;
 }): Promise<RigProviderImage>;
-export declare function settingsForRigVerification(settings: ControlActivityServices["settings"], packRuntime: WorkspacePackRuntime, rigImage: string | null): ControlActivityServices["settings"];
+export declare function settingsForRigVerification(settings: ControlActivityServices["settings"], rigImage: string | null): ControlActivityServices["settings"];
 export declare function createRigVerificationActivities(services: () => Promise<ControlActivityServices>): {
     verifyRigChange: (input: {
         workspaceId: string;

package/dist/activities/sandbox-images.d.ts

@@ -1 +1 @@
-export { resolveRigProviderImageSelection, rigProviderImageSourceImage, settingsWithPackSandboxImage, settingsWithRigImage, settingsWithRigProviderImage, type RigProviderImageSelectionReason, } from "@opengeni/core";
+export { resolveRigProviderImageSelection, rigProviderImageSourceImage, settingsWithRigImage, settingsWithRigProviderImage, type RigProviderImageSelectionReason, } from "@opengeni/core";

package/dist/activities/sandbox-lease.d.ts

@@ -2,7 +2,7 @@ import type { ProviderCommandPersistence } from "@opengeni/runtime";
 import { type OpStatus } from "@opengeni/agent-proto";
 import { listLiveModalSandboxLeaseAttributions, readLease, type ReapDrainable, type RetainedProcessProviderProof, type SandboxRetainedProcess, type LeaseSnapshot } from "@opengeni/db";
 import { type ConnectedMachineBackgroundCommandClaim, type ConnectedMachineBackgroundCommandProof } from "@opengeni/db/session-background-commands";
-import { type VerifiedHostWorkspaceArchive, createSandboxClientForBackend, inspectModalSandboxLifecycle, resolveModalCheckpointProviderBindingForSession, terminateModalSandboxById, type ModalOrphanSweepTermination, type ModalCheckpointProviderBinding, type ProviderWorkspaceCapturePolicy, type WorkspaceArchiveDescriptor, type ControlRpc } from "@opengeni/runtime/sandbox";
+import { type VerifiedHostWorkspaceArchive, createSandboxClientForBackend, inspectModalSandboxLifecycle, OpStreamExecClient, resolveModalCheckpointProviderBindingForSession, terminateModalSandboxById, type ModalOrphanSweepTermination, type ModalCheckpointProviderBinding, type ProviderWorkspaceCapturePolicy, type WorkspaceArchiveDescriptor, type ControlRpc } from "@opengeni/runtime/sandbox";
 import { type SandboxDrainActivityInput, type SandboxLeaseSweepMaintenanceInput } from "../sandbox-reaper-contract.js";
 import type { ControlActivityServices as ActivityServices } from "./types.js";
 import { type RetainedProcessReconciliationOutcome } from "../observability-metrics.js";
@@ -60,7 +60,7 @@ export type DrainCaptureDisposition = "capture_required" | "archive_published";
  *  Test seams may return the legacy boolean shorthand. Production returns the
  *  typed outcome so the cold commit can distinguish a clean stop from definitive
  *  provider disappearance before capture. */
-export type TerminateBoxFn = (settings: ActivityServices["settings"], lease: NonNullable<Awaited<ReturnType<typeof readLease>>>, observability: ActivityServices["observability"], persistArchive: PersistArchiveFn, providerCaptureRequestId?: string, captureDisposition?: DrainCaptureDisposition, capturePolicy?: ProviderWorkspaceCapturePolicy | null, diskBackedArchives?: boolean, releaseFailedCapture?: () => Promise<void>) => Promise<boolean | ProviderTerminationOutcome>;
+export type TerminateBoxFn = (settings: ActivityServices["settings"], lease: NonNullable<Awaited<ReturnType<typeof readLease>>>, observability: ActivityServices["observability"], persistArchive: PersistArchiveFn, providerCaptureRequestId?: string, captureDisposition?: DrainCaptureDisposition, capturePolicy?: ProviderWorkspaceCapturePolicy | null, diskBackedArchives?: boolean, releaseFailedCapture?: () => Promise<void>, workspaceId?: string) => Promise<boolean | ProviderTerminationOutcome>;
 export type SweepModalOrphansFn = (settings: ActivityServices["settings"], db: ActivityServices["db"], observability: ActivityServices["observability"]) => Promise<number>;
 export type InspectOpenSandboxKubernetesInventoryFn = (input: {
     namespace: string;
@@ -154,6 +154,7 @@ export declare function createSandboxLeaseActivities(services: () => Promise<Act
  * adoption. A successor enrollment connection is intentionally irrelevant: no
  * query or cancellation is ever rebound to it. */
 export declare function reconcileConnectedMachineBackgroundCommands(db: ActivityServices["db"], settings: ActivityServices["settings"], observability: ActivityServices["observability"], bus: ActivityServices["bus"], controlRpcOverride?: ControlRpc): Promise<void>;
+export declare function replayConnectedCommandOutput(client: Pick<OpStreamExecClient, "readExisting">, opId: string, terminalKnown: boolean, capture: Parameters<OpStreamExecClient["readExisting"]>[2]): Promise<void>;
 export declare function probeConnectedMachineBackgroundCommand(claim: ConnectedMachineBackgroundCommandClaim, controlRpc: ControlRpc, controlTimeoutMs: number, observedAt?: Date): Promise<ConnectedMachineBackgroundCommandProof | null>;
 export declare function connectedCommandProofFromStatus(status: OpStatus, observedAt: Date): ConnectedMachineBackgroundCommandProof | null;
 type RetainedProcessDeferralOutcome = Extract<RetainedProcessProbeResult, {
@@ -207,4 +208,4 @@ export declare function sandboxDrainReason(lease: Pick<LeaseSnapshot, "rotationR
  * draining until its adapter can prove termination. A truly instance-less or
  * `none`-backed row is a no-op.
  */
-export declare function terminateProviderBox(settings: ActivityServices["settings"], lease: NonNullable<Awaited<ReturnType<typeof readLease>>>, observability: ActivityServices["observability"], persistArchive: PersistArchiveFn, createClientForBackend?: CreateSandboxClientForBackendFn, terminateModalById?: typeof terminateModalSandboxById, providerCaptureRequestId?: string, captureDisposition?: DrainCaptureDisposition, claimedCapturePolicy?: ProviderWorkspaceCapturePolicy | null, diskBackedArchives?: boolean, releaseFailedCapture?: () => Promise<void>): Promise<ProviderTerminationOutcome>;
+export declare function terminateProviderBox(settings: ActivityServices["settings"], lease: NonNullable<Awaited<ReturnType<typeof readLease>>>, observability: ActivityServices["observability"], persistArchive: PersistArchiveFn, createClientForBackend?: CreateSandboxClientForBackendFn, terminateModalById?: typeof terminateModalSandboxById, providerCaptureRequestId?: string, captureDisposition?: DrainCaptureDisposition, claimedCapturePolicy?: ProviderWorkspaceCapturePolicy | null, diskBackedArchives?: boolean, releaseFailedCapture?: () => Promise<void>, workspaceId?: string): Promise<ProviderTerminationOutcome>;

package/dist/activities/session-state.d.ts

@@ -1,4 +1,4 @@
-import { settleSessionAttemptInterruptions, applySessionTurnSettlement, enqueueSessionWorkflowWake, failSessionWorkBeforeAttemptClaim, requestSessionTurnRecovery, recoverSessionDispatch, reconcileSessionAttemptQuiescence, peekSessionWork as peekSessionWorkDb, settleSessionInputWait as settleSessionInputWaitDb, countQueuedTurns, getSessionAttemptActivityRef, getSessionEvent, getSessionTurnForAttempt, expireSessionInteractionIntervention as expireSessionInteractionInterventionDb, expireSessionHumanInputRequest, markSessionAttemptQuiesced, requireSession, settleSessionIdleWithParentOutbox } from "@opengeni/db";
+import { settleSessionAttemptInterruptions, applySessionTurnSettlement, enqueueSessionWorkflowWake, failSessionWorkBeforeAttemptClaim, blockSessionWorkBeforeAttemptClaim, requestSessionTurnRecovery, recoverSessionDispatch, reconcileSessionAttemptQuiescence, peekSessionWork as peekSessionWorkDb, settleSessionInputWait as settleSessionInputWaitDb, countQueuedTurns, getSessionAttemptActivityRef, getSessionEvent, getSessionTurnForAttempt, expireSessionInteractionIntervention as expireSessionInteractionInterventionDb, expireSessionHumanInputRequest, markSessionAttemptQuiesced, requireSession, settleSessionIdleWithParentOutbox } from "@opengeni/db";
 import { publishDurableSessionEvents } from "@opengeni/events";
 import { deliverFailedChildTurnToParent, notifyParentOfChildIdle } from "./parent-wake.js";
 import { recordTurnsQueuedGauge, recordWorkerDeathRecoveryMetrics } from "../observability-metrics.js";
@@ -8,6 +8,7 @@ export type SessionStateActivityOverrides = Partial<{
     applySessionTurnSettlement: typeof applySessionTurnSettlement;
     enqueueSessionWorkflowWake: typeof enqueueSessionWorkflowWake;
     failSessionWorkBeforeAttemptClaim: typeof failSessionWorkBeforeAttemptClaim;
+    blockSessionWorkBeforeAttemptClaim: typeof blockSessionWorkBeforeAttemptClaim;
     requestSessionTurnRecovery: typeof requestSessionTurnRecovery;
     recoverSessionDispatch: typeof recoverSessionDispatch;
     reconcileSessionAttemptQuiescence: typeof reconcileSessionAttemptQuiescence;
@@ -38,7 +39,61 @@ export declare function createSessionStateActivities(services: () => Promise<Con
     reconcileSessionAttemptQuiescence: (input: ReconcileSessionAttemptQuiescenceInput) => Promise<ReconcileSessionAttemptQuiescenceResult>;
     recoverDispatch: (input: RecoverDispatchInput) => Promise<RecoverDispatchResult>;
     recoverEscapedMcpTimeout: (input: RecoverEscapedMcpTimeoutInput) => Promise<RecoverEscapedMcpTimeoutResult>;
-    peekSessionWork: (input: PeekSessionWorkInput) => Promise<import("@opengeni/db").SessionWorkPeek>;
+    peekSessionWork: (input: PeekSessionWorkInput) => Promise<{
+        kind: "unavailable";
+    } | {
+        kind: "attempt-owned";
+        turnId: string;
+        attemptId: string;
+        executionGeneration: number;
+        activityRef: import("@opengeni/db").SessionAttemptActivityRef;
+    } | {
+        kind: "runnable";
+        admissionFence?: import("@opengeni/db").SessionAdmissionFence;
+    } | {
+        kind: "admission-blocked";
+    } | {
+        kind: "sandbox-lifecycle-wait";
+        ref: import("@opengeni/db").SandboxLifecycleWait;
+    } | {
+        kind: "approval-pending";
+        triggerEventId: string;
+        admissionFence?: import("@opengeni/db").SessionAdmissionFence;
+    } | {
+        kind: "approval-wait";
+        humanInputRequestId?: string;
+        interactionInterventionId?: string;
+        expiresAt?: string;
+    } | {
+        kind: "capacity-wait";
+        ref: {
+            provider?: "codex" | "xai";
+            waiterId: string;
+            generation: number;
+            nextCheckAt: string;
+            wakeRevision: number;
+        };
+    } | {
+        kind: "interruption-pending";
+        attemptId: string;
+    } | {
+        kind: "cancellation-wait";
+        attemptId: string;
+    } | {
+        kind: "input-wait";
+        disposition: "held" | "timeout" | "superseded";
+        waitTurnId: string;
+        deadlineAt: string;
+    } | {
+        kind: "idle";
+    } | {
+        kind: "attempt-owned";
+        turnId: string;
+        attemptId: string;
+        executionGeneration: number;
+        activityRef: import("@opengeni/db").SessionAttemptActivityRef;
+        ownerActivityState: "pending" | "settled" | "unknown";
+    }>;
     settleSessionInputWait: (input: SettleSessionInputWaitInput) => Promise<SettleSessionInputWaitResult>;
     expireSessionHumanInput: (input: ExpireSessionHumanInputInput) => Promise<ExpireSessionHumanInputResult>;
     expireSessionInteractionIntervention: (input: ExpireSessionInteractionInterventionInput) => Promise<ExpireSessionInteractionInterventionResult>;