@opengeni/db 0.10.7 → 0.12.0

package/dist/{chunk-KW526IJA.js → chunk-Y5WZZVQK.js}

@@ -4,6 +4,9 @@ import { dirname, join } from "path";
 import { fileURLToPath } from "url";
 import postgres from "postgres";
 var DEFAULT_DATABASE_URL = "postgres://opengeni:opengeni@127.0.0.1:5432/opengeni";
+var DEFAULT_MAX_NESTED_AGENT_DEPTH = 3;
+var MAX_NESTED_AGENT_DEPTH = 2147483647;
+var batchedBackfillDirective = /^-- opengeni:batched-backfill batch-size=(\d+) lock-timeout=(\d+(?:ms|s|min)) statement-timeout=(\d+(?:ms|s|min))$/;
 var concurrentIndexDirective = /^-- opengeni:concurrent-index lock-timeout=(\d+(?:ms|s|min))$/;
 var concurrentIndexStatement = /^CREATE\s+(?:UNIQUE\s+)?INDEX\s+CONCURRENTLY\s+(?:(IF\s+NOT\s+EXISTS)\s+)?(?:"((?:[^"]|"")+)"|([A-Za-z_][A-Za-z0-9_]*))\s+ON\b/is;
 var governedLegacyConcurrentIndexMigrations = /* @__PURE__ */ new Set([
@@ -56,7 +59,44 @@ function parseConcurrentIndexMigration(file, sqlText) {
     statement
   };
 }
+function parseBatchedBackfillMigration(file, sqlText) {
+  const lines = sqlText.replaceAll("\r\n", "\n").split("\n");
+  const directiveIndex = /^-- deployment-mode: (?:rolling|maintenance)$/.test(
+    lines[0]?.trim() ?? ""
+  ) ? 1 : 0;
+  const directive = batchedBackfillDirective.exec(lines[directiveIndex]?.trim() ?? "");
+  if (!directive) return null;
+  const statement = lines.slice(directiveIndex + 1).filter((line) => !line.trim().startsWith("--")).join("\n").trim();
+  const withoutTrailingSemicolon = statement.endsWith(";") ? statement.slice(0, -1).trimEnd() : statement;
+  const batchSize = Number(directive[1]);
+  if (!Number.isSafeInteger(batchSize) || batchSize < 1 || batchSize > 1e4 || !/^WITH\b/is.test(withoutTrailingSemicolon) || !/\bUPDATE\b/is.test(withoutTrailingSemicolon) || !/\bRETURNING\b/is.test(withoutTrailingSemicolon) || !new RegExp(`\\bLIMIT\\s+${batchSize}\\b`, "i").test(withoutTrailingSemicolon) || withoutTrailingSemicolon.includes(";")) {
+    throw new Error(
+      `${file}: opengeni:batched-backfill requires one bounded WITH ... UPDATE ... RETURNING statement whose LIMIT matches batch-size`
+    );
+  }
+  return {
+    batchSize,
+    lockTimeout: directive[2],
+    statementTimeout: directive[3],
+    statement
+  };
+}
 async function executeMigrationFile(sql, file, sqlText) {
+  const batchedBackfill = parseBatchedBackfillMigration(file, sqlText);
+  if (batchedBackfill) {
+    await sql`select set_config('lock_timeout', ${batchedBackfill.lockTimeout}, false)`;
+    await sql`select set_config('statement_timeout', ${batchedBackfill.statementTimeout}, false)`;
+    try {
+      for (; ; ) {
+        const result = await sql.unsafe(batchedBackfill.statement);
+        if (result.length === 0) break;
+      }
+    } finally {
+      await sql`select set_config('statement_timeout', '0', false)`;
+      await sql`select set_config('lock_timeout', '0', false)`;
+    }
+    return;
+  }
   const concurrentIndex = parseConcurrentIndexMigration(file, sqlText);
   if (!concurrentIndex) {
     await sql.unsafe(sqlText);
@@ -82,9 +122,42 @@ async function executeMigrationFile(sql, file, sqlText) {
     await sql`select set_config('lock_timeout', '0', false)`;
   }
 }
-async function migrate(databaseUrl = process.env.OPENGENI_MIGRATIONS_DATABASE_URL ?? process.env.OPENGENI_DATABASE_URL ?? DEFAULT_DATABASE_URL, schema = process.env.OPENGENI_DB_SCHEMA?.trim() || void 0) {
+function deploymentDepthPolicy(options) {
+  const raw = options === void 0 ? process.env.OPENGENI_MAX_NESTED_AGENT_DEPTH?.trim() || void 0 : options.maxNestedAgentDepth;
+  if (raw === void 0) {
+    return { maxNestedAgentDepth: DEFAULT_MAX_NESTED_AGENT_DEPTH, source: "default" };
+  }
+  const value = typeof raw === "number" ? raw : Number(raw);
+  if (!Number.isSafeInteger(value) || value < 0 || value > MAX_NESTED_AGENT_DEPTH || typeof raw === "string" && !/^(0|[1-9][0-9]*)$/.test(raw)) {
+    throw new Error(
+      `OPENGENI_MAX_NESTED_AGENT_DEPTH must be a non-negative 32-bit integer: ${raw}`
+    );
+  }
+  return { maxNestedAgentDepth: value, source: "deployment" };
+}
+async function persistDeploymentDepthPolicy(sql, policy) {
+  const [relation] = await sql`
+    select to_regclass('nested_agent_depth_configuration') is not null as exists
+  `;
+  if (!relation?.exists) return;
+  await sql`
+    insert into "nested_agent_depth_configuration" (
+      "singleton", "max_nested_agent_depth", "policy_source", "updated_at"
+    ) values (true, ${policy.maxNestedAgentDepth}, ${policy.source}, now())
+    on conflict ("singleton") do update
+    set "max_nested_agent_depth" = excluded."max_nested_agent_depth",
+        "policy_source" = excluded."policy_source",
+        "updated_at" = now()
+    where "nested_agent_depth_configuration"."max_nested_agent_depth"
+            is distinct from excluded."max_nested_agent_depth"
+       or "nested_agent_depth_configuration"."policy_source"
+            is distinct from excluded."policy_source"
+  `;
+}
+async function migrate(databaseUrl = process.env.OPENGENI_MIGRATIONS_DATABASE_URL ?? process.env.OPENGENI_DATABASE_URL ?? DEFAULT_DATABASE_URL, schema = process.env.OPENGENI_DB_SCHEMA?.trim() || void 0, runtimeOptions) {
   const migrationsDir = join(dirname(fileURLToPath(import.meta.url)), "../drizzle");
   const files = (await readdir(migrationsDir)).filter((file) => file.endsWith(".sql")).sort();
+  const depthPolicy = deploymentDepthPolicy(runtimeOptions);
   const sql = postgres(databaseUrl, { max: 1 });
   try {
     await sql`SELECT pg_advisory_lock(727458)`;
@@ -94,6 +167,8 @@ async function migrate(databaseUrl = process.env.OPENGENI_MIGRATIONS_DATABASE_UR
       await sql.unsafe(`CREATE SCHEMA IF NOT EXISTS "opengeni_private"`);
       await sql.unsafe(`SET search_path = "${schema}", "opengeni_private", "public"`);
     }
+    await sql`select set_config('opengeni.max_nested_agent_depth', ${String(depthPolicy.maxNestedAgentDepth)}, false)`;
+    await sql`select set_config('opengeni.nested_agent_depth_policy_source', ${depthPolicy.source}, false)`;
     await sql.unsafe(
       `CREATE TABLE IF NOT EXISTS "schema_migrations" ("name" text PRIMARY KEY, "applied_at" timestamptz NOT NULL DEFAULT now())`
     );
@@ -107,12 +182,13 @@ async function migrate(databaseUrl = process.env.OPENGENI_MIGRATIONS_DATABASE_UR
       await executeMigrationFile(sql, file, sqlText);
       await sql`INSERT INTO "schema_migrations" ("name") VALUES (${file}) ON CONFLICT DO NOTHING`;
     }
+    await persistDeploymentDepthPolicy(sql, depthPolicy);
   } finally {
     await sql.end();
   }
 }
-async function runMigrations(adminConnection, targetSchema) {
-  await migrate(adminConnection, targetSchema);
+async function runMigrations(adminConnection, targetSchema, runtimeOptions) {
+  await migrate(adminConnection, targetSchema, runtimeOptions);
 }
 if (import.meta.main) {
   await migrate();
@@ -124,4 +200,4 @@ export {
   migrate,
   runMigrations
 };
-//# sourceMappingURL=chunk-KW526IJA.js.map
+//# sourceMappingURL=chunk-Y5WZZVQK.js.map

package/dist/chunk-Y5WZZVQK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/migrate.ts"],"sourcesContent":["import { readdir, readFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport postgres from \"postgres\";\n\nconst DEFAULT_DATABASE_URL = \"postgres://opengeni:opengeni@127.0.0.1:5432/opengeni\";\nconst DEFAULT_MAX_NESTED_AGENT_DEPTH = 3;\nconst MAX_NESTED_AGENT_DEPTH = 2_147_483_647;\nconst batchedBackfillDirective =\n  /^-- opengeni:batched-backfill batch-size=(\\d+) lock-timeout=(\\d+(?:ms|s|min)) statement-timeout=(\\d+(?:ms|s|min))$/;\nconst concurrentIndexDirective = /^-- opengeni:concurrent-index lock-timeout=(\\d+(?:ms|s|min))$/;\nconst concurrentIndexStatement =\n  /^CREATE\\s+(?:UNIQUE\\s+)?INDEX\\s+CONCURRENTLY\\s+(?:(IF\\s+NOT\\s+EXISTS)\\s+)?(?:\"((?:[^\"]|\"\")+)\"|([A-Za-z_][A-Za-z0-9_]*))\\s+ON\\b/is;\nconst governedLegacyConcurrentIndexMigrations = new Set([\n  \"0066_session_interruption_attempt_lookup.sql\",\n  \"0070_session_event_type_sequence_lookup.sql\",\n  \"0071_session_event_monitoring_tail.sql\",\n  \"0072_sessions_workspace_created_id_idx.sql\",\n  \"0073_sessions_workspace_updated_id_idx.sql\",\n  \"0075_sessions_workspace_activity_revision_idx.sql\",\n  \"0077_session_attempt_latest_lookup.sql\",\n]);\n\nexport interface ConcurrentIndexMigration {\n  indexName: string;\n  lockTimeout: string;\n  skipWhenValid: boolean;\n  statement: string;\n}\n\nexport type MigrationRuntimeOptions = {\n  maxNestedAgentDepth?: number;\n};\n\ntype DeploymentDepthPolicy = {\n  maxNestedAgentDepth: number;\n  source: \"deployment\" | \"default\";\n};\n\n/** A bare Postgres identifier (schema/role name) safe to interpolate into DDL. */\nfunction assertIdentifier(name: string, value: string): string {\n  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {\n    throw new Error(`${name} is not a valid Postgres identifier: ${value}`);\n  }\n  return value;\n}\n\n/**\n * Most migration files intentionally execute as one implicit transaction.\n * PostgreSQL forbids CREATE INDEX CONCURRENTLY there, so a migration may opt\n * into one narrowly validated transactionless statement with:\n *\n *   -- opengeni:concurrent-index lock-timeout=5s\n *   CREATE [UNIQUE] INDEX CONCURRENTLY IF NOT EXISTS ...;\n *\n * The directive is deliberately not a generic \"no transaction\" escape hatch:\n * only one idempotent concurrent-index statement is accepted, lock acquisition\n * is always bounded, and an invalid artifact left by a failed concurrent build\n * is removed before retry. Seven governed historical migrations predate the\n * IF NOT EXISTS rule; only those exact filenames may use their immutable bare\n * statements, and the runner makes their retries idempotent by skipping an\n * already-valid index. This keeps additive large-table indexes online without\n * rewriting shipped history or making arbitrary partially-applied migration\n * scripts possible.\n */\nexport function parseConcurrentIndexMigration(\n  file: string,\n  sqlText: string,\n): ConcurrentIndexMigration | null {\n  const lines = sqlText.replaceAll(\"\\r\\n\", \"\\n\").split(\"\\n\");\n  const firstLine = lines[0]?.trim() ?? \"\";\n  const deploymentPrefixed = /^-- deployment-mode: (?:rolling|maintenance)$/.test(firstLine);\n  const directiveIndex = deploymentPrefixed ? 1 : 0;\n  const directiveLine = lines[directiveIndex]?.trim() ?? \"\";\n  const directive = concurrentIndexDirective.exec(directiveLine);\n  if (!directive) {\n    if (directiveLine.startsWith(\"-- opengeni:\")) {\n      throw new Error(`Unsupported OpenGeni migration directive in ${file}`);\n    }\n    return null;\n  }\n\n  const lockTimeout = directive[1]!;\n  const statement = lines\n    .slice(directiveIndex + 1)\n    .join(\"\\n\")\n    .trim();\n  const withoutTrailingSemicolon = statement.endsWith(\";\")\n    ? statement.slice(0, -1).trimEnd()\n    : statement;\n  const parsedStatement = concurrentIndexStatement.exec(withoutTrailingSemicolon);\n  if (!parsedStatement || withoutTrailingSemicolon.includes(\";\")) {\n    throw new Error(\n      `${file}: opengeni:concurrent-index requires exactly one CREATE [UNIQUE] INDEX CONCURRENTLY IF NOT EXISTS statement with an unqualified index name`,\n    );\n  }\n  const idempotentInSql = parsedStatement[1] !== undefined;\n  if (!idempotentInSql && !governedLegacyConcurrentIndexMigrations.has(file)) {\n    throw new Error(\n      `${file}: opengeni:concurrent-index requires IF NOT EXISTS; bare statements are supported only for governed historical migrations`,\n    );\n  }\n  return {\n    indexName: (parsedStatement[2] ?? parsedStatement[3]!).replaceAll('\"\"', '\"'),\n    lockTimeout,\n    skipWhenValid: !idempotentInSql,\n    statement,\n  };\n}\n\nfunction parseBatchedBackfillMigration(\n  file: string,\n  sqlText: string,\n): { batchSize: number; lockTimeout: string; statementTimeout: string; statement: string } | null {\n  const lines = sqlText.replaceAll(\"\\r\\n\", \"\\n\").split(\"\\n\");\n  const directiveIndex = /^-- deployment-mode: (?:rolling|maintenance)$/.test(\n    lines[0]?.trim() ?? \"\",\n  )\n    ? 1\n    : 0;\n  const directive = batchedBackfillDirective.exec(lines[directiveIndex]?.trim() ?? \"\");\n  if (!directive) return null;\n  const statement = lines\n    .slice(directiveIndex + 1)\n    .filter((line) => !line.trim().startsWith(\"--\"))\n    .join(\"\\n\")\n    .trim();\n  const withoutTrailingSemicolon = statement.endsWith(\";\")\n    ? statement.slice(0, -1).trimEnd()\n    : statement;\n  const batchSize = Number(directive[1]!);\n  if (\n    !Number.isSafeInteger(batchSize) ||\n    batchSize < 1 ||\n    batchSize > 10_000 ||\n    !/^WITH\\b/is.test(withoutTrailingSemicolon) ||\n    !/\\bUPDATE\\b/is.test(withoutTrailingSemicolon) ||\n    !/\\bRETURNING\\b/is.test(withoutTrailingSemicolon) ||\n    !new RegExp(`\\\\bLIMIT\\\\s+${batchSize}\\\\b`, \"i\").test(withoutTrailingSemicolon) ||\n    withoutTrailingSemicolon.includes(\";\")\n  ) {\n    throw new Error(\n      `${file}: opengeni:batched-backfill requires one bounded WITH ... UPDATE ... RETURNING statement whose LIMIT matches batch-size`,\n    );\n  }\n  return {\n    batchSize,\n    lockTimeout: directive[2]!,\n    statementTimeout: directive[3]!,\n    statement,\n  };\n}\n\nasync function executeMigrationFile(\n  sql: postgres.Sql,\n  file: string,\n  sqlText: string,\n): Promise<void> {\n  const batchedBackfill = parseBatchedBackfillMigration(file, sqlText);\n  if (batchedBackfill) {\n    await sql`select set_config('lock_timeout', ${batchedBackfill.lockTimeout}, false)`;\n    await sql`select set_config('statement_timeout', ${batchedBackfill.statementTimeout}, false)`;\n    try {\n      for (;;) {\n        const result = await sql.unsafe(batchedBackfill.statement);\n        if (result.length === 0) break;\n      }\n    } finally {\n      await sql`select set_config('statement_timeout', '0', false)`;\n      await sql`select set_config('lock_timeout', '0', false)`;\n    }\n    return;\n  }\n  const concurrentIndex = parseConcurrentIndexMigration(file, sqlText);\n  if (!concurrentIndex) {\n    await sql.unsafe(sqlText);\n    return;\n  }\n\n  await sql`select set_config('lock_timeout', ${concurrentIndex.lockTimeout}, false)`;\n  try {\n    const [existing] = await sql<Array<{ valid: boolean; ready: boolean }>>`\n      select i.indisvalid as valid, i.indisready as ready\n      from pg_catalog.pg_class c\n      join pg_catalog.pg_namespace n on n.oid = c.relnamespace\n      join pg_catalog.pg_index i on i.indexrelid = c.oid\n      where n.nspname = current_schema() and c.relname = ${concurrentIndex.indexName}\n    `;\n    if (existing && (!existing.valid || !existing.ready)) {\n      const quotedIndexName = `\"${concurrentIndex.indexName.replaceAll('\"', '\"\"')}\"`;\n      await sql.unsafe(`DROP INDEX CONCURRENTLY ${quotedIndexName}`);\n    } else if (existing && concurrentIndex.skipWhenValid) {\n      return;\n    }\n    await sql.unsafe(concurrentIndex.statement);\n  } finally {\n    await sql`select set_config('lock_timeout', '0', false)`;\n  }\n}\n\nfunction deploymentDepthPolicy(\n  options: MigrationRuntimeOptions | undefined,\n): DeploymentDepthPolicy {\n  const raw =\n    options === undefined\n      ? process.env.OPENGENI_MAX_NESTED_AGENT_DEPTH?.trim() || undefined\n      : options.maxNestedAgentDepth;\n  if (raw === undefined) {\n    return { maxNestedAgentDepth: DEFAULT_MAX_NESTED_AGENT_DEPTH, source: \"default\" };\n  }\n  const value = typeof raw === \"number\" ? raw : Number(raw);\n  if (\n    !Number.isSafeInteger(value) ||\n    value < 0 ||\n    value > MAX_NESTED_AGENT_DEPTH ||\n    (typeof raw === \"string\" && !/^(0|[1-9][0-9]*)$/.test(raw))\n  ) {\n    throw new Error(\n      `OPENGENI_MAX_NESTED_AGENT_DEPTH must be a non-negative 32-bit integer: ${raw}`,\n    );\n  }\n  return { maxNestedAgentDepth: value, source: \"deployment\" };\n}\n\nasync function persistDeploymentDepthPolicy(\n  sql: postgres.Sql,\n  policy: DeploymentDepthPolicy,\n): Promise<void> {\n  const [relation] = await sql<{ exists: boolean }[]>`\n    select to_regclass('nested_agent_depth_configuration') is not null as exists\n  `;\n  if (!relation?.exists) return;\n  await sql`\n    insert into \"nested_agent_depth_configuration\" (\n      \"singleton\", \"max_nested_agent_depth\", \"policy_source\", \"updated_at\"\n    ) values (true, ${policy.maxNestedAgentDepth}, ${policy.source}, now())\n    on conflict (\"singleton\") do update\n    set \"max_nested_agent_depth\" = excluded.\"max_nested_agent_depth\",\n        \"policy_source\" = excluded.\"policy_source\",\n        \"updated_at\" = now()\n    where \"nested_agent_depth_configuration\".\"max_nested_agent_depth\"\n            is distinct from excluded.\"max_nested_agent_depth\"\n       or \"nested_agent_depth_configuration\".\"policy_source\"\n            is distinct from excluded.\"policy_source\"\n  `;\n}\n\n/**\n * Apply the OpenGeni SQL migration chain.\n *\n * STANDALONE (default, unchanged): `migrate()` / `migrate(databaseUrl)` runs the\n * whole chain with NO search_path manipulation, so every unqualified\n * table/index/policy lands in the server default schema (`public`). This is the\n * byte-for-byte historical behavior — the migration test suite calls\n * `migrate(DB_URL)` and is unaffected.\n *\n * EMBEDDED SCHEMA MODE: pass a `schema` (or set\n * `OPENGENI_DB_SCHEMA`). The migrate session then `CREATE SCHEMA IF NOT EXISTS`\n * for both `<schema>` and `opengeni_private`, and sets\n * `search_path = \"<schema>\", \"opengeni_private\", \"public\"`, so EVERY unqualified\n * DDL statement lands in the dedicated schema with NO per-statement SQL rewrite\n * (the schema-isolation contract). Two things make this work and stay idempotent:\n *   1. The policy-existence guards in the migration SQL use `current_schema()`\n *      (not a hardcoded `'public'`) — so a re-run finds the policy it already\n *      created in `<schema>` and DROP/CREATEs idempotently instead of failing\n *      with \"policy already exists\". (This guard substitution is the migrate-\n *      time enabler for the runtime search_path approach; without it the SDK\n *      entry point silently fails on re-run — the migration replay hazard.)\n *   2. `public` stays LAST on the path so `gen_random_uuid()` (pgcrypto) and the\n *      `vector` type — both installed into `public` by 0000 — still resolve. The\n *      `opengeni_private.*` helpers are always called with an absolute prefix.\n *\n * `OPENGENI_DB_SCHEMA` defaults UNSET → `public` → standalone, so the default\n * binding never regresses.\n */\nexport async function migrate(\n  databaseUrl = process.env.OPENGENI_MIGRATIONS_DATABASE_URL ??\n    process.env.OPENGENI_DATABASE_URL ??\n    DEFAULT_DATABASE_URL,\n  schema: string | undefined = process.env.OPENGENI_DB_SCHEMA?.trim() || undefined,\n  runtimeOptions?: MigrationRuntimeOptions,\n): Promise<void> {\n  const migrationsDir = join(dirname(fileURLToPath(import.meta.url)), \"../drizzle\");\n  const files = (await readdir(migrationsDir)).filter((file) => file.endsWith(\".sql\")).sort();\n  const depthPolicy = deploymentDepthPolicy(runtimeOptions);\n  const sql = postgres(databaseUrl, { max: 1 });\n  try {\n    // Serialize concurrent migrate() runs; the session-level lock is released\n    // when the connection closes.\n    await sql`SELECT pg_advisory_lock(727458)`;\n    if (schema) {\n      assertIdentifier(\"OPENGENI_DB_SCHEMA\", schema);\n      await sql.unsafe(`CREATE SCHEMA IF NOT EXISTS \"${schema}\"`);\n      // opengeni_private is also created by 0001 with an absolute prefix, but the\n      // session search_path must already resolve it for the policy predicates\n      // and the SECURITY DEFINER functions that inherit the caller's path.\n      await sql.unsafe(`CREATE SCHEMA IF NOT EXISTS \"opengeni_private\"`);\n      await sql.unsafe(`SET search_path = \"${schema}\", \"opengeni_private\", \"public\"`);\n    }\n    await sql`select set_config('opengeni.max_nested_agent_depth', ${String(depthPolicy.maxNestedAgentDepth)}, false)`;\n    await sql`select set_config('opengeni.nested_agent_depth_policy_source', ${depthPolicy.source}, false)`;\n    await sql.unsafe(\n      `CREATE TABLE IF NOT EXISTS \"schema_migrations\" (\"name\" text PRIMARY KEY, \"applied_at\" timestamptz NOT NULL DEFAULT now())`,\n    );\n    const appliedRows = await sql`SELECT \"name\" FROM \"schema_migrations\"`;\n    const applied = new Set(appliedRows.map((row) => row.name as string));\n    for (const file of files) {\n      if (applied.has(file)) {\n        continue;\n      }\n      const sqlText = await readFile(join(migrationsDir, file), \"utf8\");\n      await executeMigrationFile(sql, file, sqlText);\n      await sql`INSERT INTO \"schema_migrations\" (\"name\") VALUES (${file}) ON CONFLICT DO NOTHING`;\n    }\n    // Reconcile even when all migration names were already recorded. This is\n    // the only supported way to change deployment policy in a live database.\n    await persistDeploymentDepthPolicy(sql, depthPolicy);\n  } finally {\n    await sql.end();\n  }\n}\n\n/**\n * SDK entry point (Step I): run the migration chain over a host-supplied admin\n * connection string against an explicit target schema. This is the embedded\n * topology's named entry — a host calls `runMigrations(adminConnection,\n * targetSchema)` from its own provisioning code instead of relying on env vars.\n * `targetSchema` undefined → `public` → standalone behavior. Thin wrapper over\n * `migrate` so there is one migration engine.\n */\nexport async function runMigrations(\n  adminConnection: string,\n  targetSchema?: string,\n  runtimeOptions?: MigrationRuntimeOptions,\n): Promise<void> {\n  await migrate(adminConnection, targetSchema, runtimeOptions);\n}\n\nif (import.meta.main) {\n  await migrate();\n  console.log(\"Applied Drizzle SQL migrations.\");\n}\n"],"mappings":";AAAA,SAAS,SAAS,gBAAgB;AAClC,SAAS,SAAS,YAAY;AAC9B,SAAS,qBAAqB;AAC9B,OAAO,cAAc;AAErB,IAAM,uBAAuB;AAC7B,IAAM,iCAAiC;AACvC,IAAM,yBAAyB;AAC/B,IAAM,2BACJ;AACF,IAAM,2BAA2B;AACjC,IAAM,2BACJ;AACF,IAAM,0CAA0C,oBAAI,IAAI;AAAA,EACtD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAmBD,SAAS,iBAAiB,MAAc,OAAuB;AAC7D,MAAI,CAAC,2BAA2B,KAAK,KAAK,GAAG;AAC3C,UAAM,IAAI,MAAM,GAAG,IAAI,wCAAwC,KAAK,EAAE;AAAA,EACxE;AACA,SAAO;AACT;AAoBO,SAAS,8BACd,MACA,SACiC;AACjC,QAAM,QAAQ,QAAQ,WAAW,QAAQ,IAAI,EAAE,MAAM,IAAI;AACzD,QAAM,YAAY,MAAM,CAAC,GAAG,KAAK,KAAK;AACtC,QAAM,qBAAqB,gDAAgD,KAAK,SAAS;AACzF,QAAM,iBAAiB,qBAAqB,IAAI;AAChD,QAAM,gBAAgB,MAAM,cAAc,GAAG,KAAK,KAAK;AACvD,QAAM,YAAY,yBAAyB,KAAK,aAAa;AAC7D,MAAI,CAAC,WAAW;AACd,QAAI,cAAc,WAAW,cAAc,GAAG;AAC5C,YAAM,IAAI,MAAM,+CAA+C,IAAI,EAAE;AAAA,IACvE;AACA,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,UAAU,CAAC;AAC/B,QAAM,YAAY,MACf,MAAM,iBAAiB,CAAC,EACxB,KAAK,IAAI,EACT,KAAK;AACR,QAAM,2BAA2B,UAAU,SAAS,GAAG,IACnD,UAAU,MAAM,GAAG,EAAE,EAAE,QAAQ,IAC/B;AACJ,QAAM,kBAAkB,yBAAyB,KAAK,wBAAwB;AAC9E,MAAI,CAAC,mBAAmB,yBAAyB,SAAS,GAAG,GAAG;AAC9D,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,QAAM,kBAAkB,gBAAgB,CAAC,MAAM;AAC/C,MAAI,CAAC,mBAAmB,CAAC,wCAAwC,IAAI,IAAI,GAAG;AAC1E,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,SAAO;AAAA,IACL,YAAY,gBAAgB,CAAC,KAAK,gBAAgB,CAAC,GAAI,WAAW,MAAM,GAAG;AAAA,IAC3E;AAAA,IACA,eAAe,CAAC;AAAA,IAChB;AAAA,EACF;AACF;AAEA,SAAS,8BACP,MACA,SACgG;AAChG,QAAM,QAAQ,QAAQ,WAAW,QAAQ,IAAI,EAAE,MAAM,IAAI;AACzD,QAAM,iBAAiB,gDAAgD;AAAA,IACrE,MAAM,CAAC,GAAG,KAAK,KAAK;AAAA,EACtB,IACI,IACA;AACJ,QAAM,YAAY,yBAAyB,KAAK,MAAM,cAAc,GAAG,KAAK,KAAK,EAAE;AACnF,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,YAAY,MACf,MAAM,iBAAiB,CAAC,EACxB,OAAO,CAAC,SAAS,CAAC,KAAK,KAAK,EAAE,WAAW,IAAI,CAAC,EAC9C,KAAK,IAAI,EACT,KAAK;AACR,QAAM,2BAA2B,UAAU,SAAS,GAAG,IACnD,UAAU,MAAM,GAAG,EAAE,EAAE,QAAQ,IAC/B;AACJ,QAAM,YAAY,OAAO,UAAU,CAAC,CAAE;AACtC,MACE,CAAC,OAAO,cAAc,SAAS,KAC/B,YAAY,KACZ,YAAY,OACZ,CAAC,YAAY,KAAK,wBAAwB,KAC1C,CAAC,eAAe,KAAK,wBAAwB,KAC7C,CAAC,kBAAkB,KAAK,wBAAwB,KAChD,CAAC,IAAI,OAAO,eAAe,SAAS,OAAO,GAAG,EAAE,KAAK,wBAAwB,KAC7E,yBAAyB,SAAS,GAAG,GACrC;AACA,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,SAAO;AAAA,IACL;AAAA,IACA,aAAa,UAAU,CAAC;AAAA,IACxB,kBAAkB,UAAU,CAAC;AAAA,IAC7B;AAAA,EACF;AACF;AAEA,eAAe,qBACb,KACA,MACA,SACe;AACf,QAAM,kBAAkB,8BAA8B,MAAM,OAAO;AACnE,MAAI,iBAAiB;AACnB,UAAM,wCAAwC,gBAAgB,WAAW;AACzE,UAAM,6CAA6C,gBAAgB,gBAAgB;AACnF,QAAI;AACF,iBAAS;AACP,cAAM,SAAS,MAAM,IAAI,OAAO,gBAAgB,SAAS;AACzD,YAAI,OAAO,WAAW,EAAG;AAAA,MAC3B;AAAA,IACF,UAAE;AACA,YAAM;AACN,YAAM;AAAA,IACR;AACA;AAAA,EACF;AACA,QAAM,kBAAkB,8BAA8B,MAAM,OAAO;AACnE,MAAI,CAAC,iBAAiB;AACpB,UAAM,IAAI,OAAO,OAAO;AACxB;AAAA,EACF;AAEA,QAAM,wCAAwC,gBAAgB,WAAW;AACzE,MAAI;AACF,UAAM,CAAC,QAAQ,IAAI,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,2DAK8B,gBAAgB,SAAS;AAAA;AAEhF,QAAI,aAAa,CAAC,SAAS,SAAS,CAAC,SAAS,QAAQ;AACpD,YAAM,kBAAkB,IAAI,gBAAgB,UAAU,WAAW,KAAK,IAAI,CAAC;AAC3E,YAAM,IAAI,OAAO,2BAA2B,eAAe,EAAE;AAAA,IAC/D,WAAW,YAAY,gBAAgB,eAAe;AACpD;AAAA,IACF;AACA,UAAM,IAAI,OAAO,gBAAgB,SAAS;AAAA,EAC5C,UAAE;AACA,UAAM;AAAA,EACR;AACF;AAEA,SAAS,sBACP,SACuB;AACvB,QAAM,MACJ,YAAY,SACR,QAAQ,IAAI,iCAAiC,KAAK,KAAK,SACvD,QAAQ;AACd,MAAI,QAAQ,QAAW;AACrB,WAAO,EAAE,qBAAqB,gCAAgC,QAAQ,UAAU;AAAA,EAClF;AACA,QAAM,QAAQ,OAAO,QAAQ,WAAW,MAAM,OAAO,GAAG;AACxD,MACE,CAAC,OAAO,cAAc,KAAK,KAC3B,QAAQ,KACR,QAAQ,0BACP,OAAO,QAAQ,YAAY,CAAC,oBAAoB,KAAK,GAAG,GACzD;AACA,UAAM,IAAI;AAAA,MACR,0EAA0E,GAAG;AAAA,IAC/E;AAAA,EACF;AACA,SAAO,EAAE,qBAAqB,OAAO,QAAQ,aAAa;AAC5D;AAEA,eAAe,6BACb,KACA,QACe;AACf,QAAM,CAAC,QAAQ,IAAI,MAAM;AAAA;AAAA;AAGzB,MAAI,CAAC,UAAU,OAAQ;AACvB,QAAM;AAAA;AAAA;AAAA,sBAGc,OAAO,mBAAmB,KAAK,OAAO,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUlE;AA8BA,eAAsB,QACpB,cAAc,QAAQ,IAAI,oCACxB,QAAQ,IAAI,yBACZ,sBACF,SAA6B,QAAQ,IAAI,oBAAoB,KAAK,KAAK,QACvE,gBACe;AACf,QAAM,gBAAgB,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,YAAY;AAChF,QAAM,SAAS,MAAM,QAAQ,aAAa,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,MAAM,CAAC,EAAE,KAAK;AAC1F,QAAM,cAAc,sBAAsB,cAAc;AACxD,QAAM,MAAM,SAAS,aAAa,EAAE,KAAK,EAAE,CAAC;AAC5C,MAAI;AAGF,UAAM;AACN,QAAI,QAAQ;AACV,uBAAiB,sBAAsB,MAAM;AAC7C,YAAM,IAAI,OAAO,gCAAgC,MAAM,GAAG;AAI1D,YAAM,IAAI,OAAO,gDAAgD;AACjE,YAAM,IAAI,OAAO,sBAAsB,MAAM,iCAAiC;AAAA,IAChF;AACA,UAAM,2DAA2D,OAAO,YAAY,mBAAmB,CAAC;AACxG,UAAM,qEAAqE,YAAY,MAAM;AAC7F,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AACA,UAAM,cAAc,MAAM;AAC1B,UAAM,UAAU,IAAI,IAAI,YAAY,IAAI,CAAC,QAAQ,IAAI,IAAc,CAAC;AACpE,eAAW,QAAQ,OAAO;AACxB,UAAI,QAAQ,IAAI,IAAI,GAAG;AACrB;AAAA,MACF;AACA,YAAM,UAAU,MAAM,SAAS,KAAK,eAAe,IAAI,GAAG,MAAM;AAChE,YAAM,qBAAqB,KAAK,MAAM,OAAO;AAC7C,YAAM,uDAAuD,IAAI;AAAA,IACnE;AAGA,UAAM,6BAA6B,KAAK,WAAW;AAAA,EACrD,UAAE;AACA,UAAM,IAAI,IAAI;AAAA,EAChB;AACF;AAUA,eAAsB,cACpB,iBACA,cACA,gBACe;AACf,QAAM,QAAQ,iBAAiB,cAAc,cAAc;AAC7D;AAEA,IAAI,YAAY,MAAM;AACpB,QAAM,QAAQ;AACd,UAAQ,IAAI,iCAAiC;AAC/C;","names":[]}

package/dist/index.d.ts

@@ -2,8 +2,9 @@ import '@opengeni/contracts';
 import '@opengeni/config';
 export { isCodexBilledModel } from '@opengeni/codex';
 export { sql as dbSql } from 'drizzle-orm';
-export { A as AGENT_VISIBLE_MEMORY_STATUSES, a as AcceptSessionApprovalDecisionResult, b as AcceptSessionHumanInputResponseResult, c as AccrueWarmSecondsResult, d as AcquireLeaseInput, e as AcquireLeaseResult, f as ActiveSandboxPointer, g as AddSessionSystemUpdateInput, h as AddSessionSystemUpdateResult, i as AdoptCodexResetRedemptionResult, j as AgentCommandAuthorityError, k as AgentInternalUpdateCommandResult, l as AppendEventInput, m as ApplyContextCompactionResult, n as ApplySessionTurnSettlementInput, o as ApplySessionTurnSettlementResult, p as ArmCodexCapacityWaitResult, B as BootstrapWorkspaceInput, C as CODEX_CAPACITY_REFRESH_MAX_MS, q as CODEX_CAPACITY_REFRESH_MIN_MS, r as CODEX_CREDENTIAL_LEASE_TTL_MS, s as CODEX_RESET_REDEMPTION_OUTCOMES, t as CODEX_ROTATION_STRATEGIES, u as ClaimCodexResetRedemptionResult, v as ClaimSessionWorkForAttemptInput, w as ClaimSessionWorkForAttemptResult, x as ClearSessionContextResult, y as CodexAccountStatus, z as CodexAccountUsageSnapshot, D as CodexAllocatorUpdateResult, E as CodexAuthDeps, F as CodexCapacityAvailabilityDecision, G as CodexCapacityMutationResult, H as CodexCapacityResetKind, I as CodexCapacitySelectionContext, J as CodexCapacityWait, K as CodexCapacityWaitStatus, L as CodexCapacityWakeTarget, M as CodexCredentialForRun, N as CodexCredentialLeaseCandidateFilter, O as CodexCredentialLeaseCandidateFilterResult, P as CodexCredentialLeasePolicyScopeResolver, Q as CodexCredentialLeaseQuarantine, R as CodexCredentialLeaseResult, S as CodexCredentialLeaseSelection, T as CodexCredentialLeaseSelectionContext, U as CodexCredentialStatus, V as CodexCredentialTokens, W as CodexLeaseAccountStatus, X as CodexPinSource, Y as CodexRateLimitResetCreditsAccountResult, Z as CodexResetRedemptionAttempt, _ as CodexResetRedemptionOutcome, $ as CodexResetRedemptionRecovery, a0 as CodexResetRedemptionSendNotReadyReason, a1 as CodexResetRedemptionStatus, a2 as CodexRotationSettings, a3 as CodexRotationStrategy, a4 as CodexTokenDeadlineClock, a5 as CodexTokenDeadlineOptions, a6 as ComposerDraftRow, a7 as ConnectionBrokerDeps, a8 as ConnectionCredentialForBroker, a9 as ConnectionRefreshHttpError, aa as ConsumeOAuthStateNonceInput, ab as CorrectWorkspaceMemoryInput, ac as CorrectWorkspaceMemoryResult, ad as CreateCapabilityCatalogItemInput, ae as CreateConnectionInput, af as CreateDbOptions, ag as CreateImportBatchInput, ah as CreateKnowledgeMemoryInput, ai as CreatePackInstallationInput, aj as CreateScheduledTaskInput, ak as CreateSessionGoalInput, al as CreateSessionMcpServerInput, am as CreateSocialConnectionInput, an as CreateSocialPostInput, ao as CreditBalanceByAccount, ap as Database, aq as DatabaseFailureCode, ar as DbClient, as as DeviceEnrollmentRequestRecord, at as DeviceEnrollmentStatus, au as EditQueueCommandResult, av as EffectiveControlBlocker, aw as EffectiveControlResumeOption, ax as EffectiveControlState, ay as EffectiveSessionControl, az as EnableCapabilityInstallationInput, aA as EnabledMcpCapabilityServer, aB as EnqueueSessionTurnInput, aC as EnrollmentExposure, aD as EnrollmentOs, aE as EnrollmentRecord, aF as EnrollmentStatus, aG as ExpiredFileUploadCleanupClaim, aH as FenceCodexResetRedemptionSendResult, aI as FileUploadCleanupClaimResult, aJ as ForceDrainResult, aK as FrozenTurnInitiator, aL as GitHubInstallation, aM as GitHubInstallationAccess, aN as GoalContinuationDecision, aO as HostExportConsumerStatus, aP as HostExportKind, aQ as HostExportPayloadError, aR as HostMcpCredentialBindingError, aS as HostMcpCredentialResolverContext, aT as HostMcpCredentialScopeError, aU as HumanInputResponseValidationError, aV as IdempotentPersistenceTransactionOptions, aW as ImportBatch, aX as InitializeSessionStartInput, aY as InitializeSessionStartResult, aZ as InstallOrReadTurnExecutionPolicyForAttemptResult, a_ as IntegrationOAuthClientForUse, a$ as LeaseHolderKind, b0 as LeaseSnapshot, b1 as ListKnowledgeMemoryOptions, b2 as ListSessionEventPageOptions, b3 as ListSessionEventsOptions, b4 as ListSessionsForSubjectOptions, b5 as ListSessionsOptions, b6 as LiveModalSandboxLeaseAttribution, b7 as MACHINE_METRICS_SERIES_INTERVAL_MS, b8 as MAX_INTERNAL_UPDATE_BATCH_BYTES, b9 as MAX_INTERNAL_UPDATE_BATCH_MEMBERS, ba as MAX_INTERNAL_UPDATE_BYTES, bb as MEMORY_ACTIVE_RECORD_CAP, bc as MEMORY_BLOCK_KIND_ORDER, bd as MEMORY_BLOCK_RECORD_LIMIT, be as MEMORY_CORRECT_TOOL_DESCRIPTION, bf as MEMORY_KIND_SECTION_TITLES, bg as MEMORY_NEAR_DUP_COSINE_THRESHOLD, bh as MEMORY_NEAR_DUP_NEIGHBORS, bi as MEMORY_SAVE_TOOL_DESCRIPTION, bj as MEMORY_SEARCH_DEFAULT_LIMIT, bk as MEMORY_SEARCH_MAX_LIMIT, bl as MEMORY_SEARCH_TOOL_DESCRIPTION, bm as MEMORY_TEXT_MAX_CHARS, bn as MEMORY_VISIBLE_RECORD_CAP, bo as MachineMetricsRow, bp as MachineMetricsSample, bq as MarkWarmLeaseInstanceLostResult, br as MemoryBlockRecord, bs as MemoryEmbedder, bt as MemorySanitizeResult, bu as MeterableWarmLease, bv as PendingSessionToolCallInput, bw as PersistenceFailureDetails, bx as PersistenceRetryOutcome, ProvisionResult, ProvisionRolesOptions, by as QueueCommandConflictCode, bz as QueueCommandConflictError, bA as QueueCommandResult, bB as QueuedTurnRow, bC as ReapDrainable, bD as ReconcileCodexCapacityWaitResult, bE as RecoverSessionDispatchInput, bF as RecoverSessionDispatchResult, bG as RefreshTransportOptions, bH as RegisterWorkspacePackInput, bI as RegistryCapabilityCatalogItemInput, bJ as RegistryCatalogSurfaceKey, bK as ReplaceIntegrationOAuthClientInput, bL as RequestSessionTurnRecoveryInput, bM as RequestSessionTurnRecoveryResult, bN as ResolveConnectionCredentialInput, bO as ResolveConnectionCredentialResult, bP as RetainedFileArtifact, bQ as RigActiveVersionChangedError, bR as RigChangeAlreadyVerifyingError, bS as RigChangeMonitoringSummary, bT as RigChangeTransitionError, bU as RigVersionContentInput, bV as RigVersionMonitoringSummary, bW as RlsContext, bX as RlsStrategy, bY as SESSION_ANCESTRY_LIMIT, bZ as SESSION_DISCOVERY_CONTROL_TARGET_LIMIT, b_ as SESSION_DISCOVERY_CONTROL_TITLE_MAX_CHARS, b$ as SESSION_DISCOVERY_GOAL_MAX_CHARS, c0 as SESSION_DISCOVERY_MESSAGE_MAX_CHARS, c1 as SESSION_EVENT_DB_PAGE_MAX_BYTES, c2 as SafeDatabaseErrorFacts, c3 as SandboxImageConflictError, c4 as SandboxKind, c5 as SandboxLeaseLiveness, c6 as SandboxLeaseSupersededError, c7 as SandboxPtySessionRow, c8 as SandboxRecord, c9 as SandboxRigConflictError, ca as SanitizedDatabasePersistenceCause, cb as SaveWorkspaceMemoryInput, cc as SaveWorkspaceMemoryResult, cd as SessionAttemptInterruptionSettlement, ce as SessionCodexState, cf as SessionCommandActor, cg as SessionCommandIdempotencyError, ch as SessionCommandReceiptRow, ci as SessionContextBusyError, cj as SessionControlConflictError, ck as SessionControlInvariantError, cl as SessionControlMutationResult, cm as SessionDiscoveryControl, cn as SessionDiscoveryCursor, co as SessionDiscoveryOrderBy, cp as SessionDiscoverySummary, cq as SessionEventPage, cr as SessionEventPersistenceError, cs as SessionEventWriteLockInput, ct as SessionEventWriteLocks, cu as SessionIdConflictError, cv as SessionLineage, cw as SessionListAccessError, cx as SessionListCursor, cy as SessionListCursorError, cz as SessionMcpServerForRun, cA as SessionPinAccessError, cB as SessionPinVersionConflictError, cC as SessionRecordingCodec, cD as SessionRecordingMode, cE as SessionRecordingRow, cF as SessionRecordingState, cG as SessionSystemUpdateOutboxDelivery, cH as SessionTurnAttemptOutcome, cI as SessionTurnForExecution, cJ as SessionTurnRecordingSettlement, cK as SessionWorkPeek, cL as SessionWorkTrigger, cM as SessionWorkflowWake, cN as SessionWorkflowWakeDeliveryResult, cO as SetSessionCodexPinOptions, cP as SettleCodexCredentialFailoverResult, cQ as SettleCodexCredentialLeaseLossResult, cR as SteerQueueCommandResult, cS as StoreIntegrationOAuthClientInput, cT as StoredIntegrationOAuthClient, cU as StreamAcknowledgment, cV as SubmitHumanPromptResult, cW as ToolspaceCallReservation, cX as ToolspaceTurnAttemptClaims, cY as TurnAttemptFenceRejectReason, cZ as UpdateConnectionInput, c_ as UpdateImportBatchCountsInput, c$ as UpdateKnowledgeMemoryInput, d0 as UpdateScheduledTaskInput, d1 as UpdateSessionMcpApprovalPolicyResult, d2 as UpdateSessionMcpServerCredentialsInput, d3 as UpdateSessionMcpServerCredentialsResult, d4 as UpsertCodexSubscriptionCredentialResult, d5 as UserLookup, d6 as VariableSetForRun, d7 as WORKSPACE_MEMORY_BLOCK_EMPTY, d8 as WORKSPACE_MEMORY_BLOCK_HEADER_POPULATED, d9 as WORKSPACE_MEMORY_BLOCK_TOKEN_BUDGET, da as WorkspaceCaptureCommitResult, db as WorkspaceCaptureGcPlan, dc as WorkspaceCaptureGcRow, dd as WorkspaceCaptureRow, de as WorkspaceControlLockMode, df as WorkspaceControlMutationResult, dg as WorkspaceControlRow, dh as WorkspaceEnvironmentForRun, di as WorkspaceMemoryOrigin, dj as WorkspaceMemorySearchInput, dk as WorkspaceMemorySearchMode, dl as WorkspaceMemorySearchResult, dm as WorkspaceModelPolicy, dn as abandonCodexResetRedemptionBeforeProvider, dp as abandonRecordingForTurnAttempt, dq as acceptSessionApprovalDecision, dr as acceptSessionHumanInputResponse, ds as accrueWarmSeconds, dt as acknowledgeHostExportBatch, du as acquireCodexCredentialLease, dv as acquireLease, dw as activateRigVersion, dx as addSessionSystemUpdate, dy as addSessionSystemUpdateWithSourceMutation, dz as admitToolspaceTurnAttempt, dA as adoptCodexResetRedemptionAttempt, dB as allAccountPermissions, dC as allWorkspacePermissions, dD as appendSessionEventToSandboxGroup, dE as appendSessionEvents, dF as appendSessionEventsAndUpdateSession, dG as appendSessionEventsForTurnAttempt, dH as appendSessionEventsWithLockedSessionUpdate, dI as appendSessionHistoryItems, dJ as applyContextCompaction, dK as applyCreditDebitUpToBalance, dL as applyCreditLedgerEntry, dM as applySessionTurnSettlement, dN as approveDeviceEnrollmentRequest, dO as areGitHubRepositoriesAllowedForWorkspace, dP as armCodexCapacityWait, dQ as assertAgentCommandAuthorityInTransaction, dR as autoResumeSessionBranchInTransaction, dS as beginRigChangeVerificationAttempt, dT as bindGitHubInstallationRepositories, dU as bootstrapWorkspace, dV as buildChildCompletionDigest, dW as buildCodexTokenResolver, dX as buildConnectionTokenResolver, dY as buildHostConnectionTokenResolver, dZ as canonicalSessionCommandHash, d_ as claimCodexResetRedemption, d$ as claimExpiredFileUploadCleanup, e0 as claimFileUploadCleanup, e1 as claimHostExportBatch, e2 as claimPendingSessionSystemUpdateOutbox, e3 as claimPendingSessionWorkflowWakes, e4 as claimSessionWorkForAttempt, e5 as clearDurablePendingSessionToolCalls, e6 as clearEnrollmentWentOffline, e7 as clearPendingSessionToolspaceCall, e8 as clearSessionContext, e9 as clearSessionGoal, ea as clearedContextMarkerItem, eb as closePtySession, ec as closeSessionTurnAttemptInTransaction, ed as codexCapacityRefreshBackoffMs, ee as commitWarmingToWarm, ef as completeCodexResetRedemption, eg as completeExpiredFileUploadCleanup, eh as completeFileUpload, ei as completeFileUploadCleanup, ej as computeWorkspaceCaptureGcPlan, ek as confirmDrainCold, el as consumeDeviceEnrollmentRequest, em as consumeIntegrationOAuthStateNonce, en as correctWorkspaceMemory, eo as countActiveApiKeysForWorkspace, ep as countActiveSessionHistoryItems, eq as countActiveSessionsForWorkspace, er as countActiveSessionsUsingEnvironment, es as countActiveSessionsUsingVariableSet, et as countConsecutiveReactiveRotations, eu as countQueuedTurns, ev as countRigs, ew as countSandboxLeasesByLiveness, ex as countScheduledTasksForWorkspace, ey as countScheduledTasksUsingEnvironment, ez as countScheduledTasksUsingVariableSet, eA as countSessionHistoryItems, eB as countSessionsUsingRig, eC as countVariableSets, eD as countWorkspaceEnvironments, eE as countWorkspacesForAccount, eF as createApiKey, eG as createConnection, eH as createDb, eI as createDeviceEnrollmentRequest, eJ as createEnrollment, eK as createFileUpload, eL as createImportBatch, eM as createKnowledgeMemory, eN as createRig, eO as createRigChange, eP as createRigVersion, eQ as createRigVersionForChangePromotion, eR as createSandbox, eS as createScheduledTask, eT as createScheduledTaskRun, eU as createSession, eV as createSessionGoal, eW as createSessionMcpServers, eX as createSessionWithIdempotencyKey, eY as createSocialConnection, eZ as createSocialPost, e_ as createVariableSet, e$ as createWorkspace, f0 as createWorkspaceEnvironment, f1 as databaseFailureCode, f2 as deadLetterHostExportHead, f3 as decodeSessionListCursor, f4 as decryptEnvironmentValue, f4 as decryptVariableSetValue, f5 as decryptedCapabilityHeaders, f6 as deleteGitHubInstallationBinding, f7 as deleteRecording, f8 as deleteRig, f9 as deleteRigIfNoActiveSessions, fa as deleteScheduledTask, fb as deleteSessionQueueItemInTransaction, fc as deleteVariableSet, fd as deleteVariableSetVariable, fe as deleteWorkspace, ff as deleteWorkspaceCaptureRows, fg as deleteWorkspaceEnvironment, fh as deleteWorkspaceEnvironmentVariable, fi as deleteWorkspacePack, fj as denyDeviceEnrollmentRequest, fk as disableCapabilityInstallation, fl as disableHostExportConsumer, fm as disconnectAllCodexAccounts, fn as disconnectCodexAccount, fo as editQueuedTurnInTransaction, fp as enableCapabilityInstallation, fq as enablePackInstallation, fr as encodeSessionListCursor, fs as encryptEnvironmentValue, fs as encryptVariableSetValue, ft as enqueueSessionTurn, fu as enqueueSessionWorkflowWake, fv as enqueueSessionWorkflowWakeIfRunnable, fw as enqueueSessionWorkflowWakeInTransaction, fx as ensureCodexRotationSettings, fy as ensureManagedAccessForUser, fz as estimateMemoryTokens, fA as evaluateGoalContinuation, fB as evaluateSessionControl, fC as evaluateSessionControls, fD as evaluateSessionDiscoveryControls, fE as expireSessionHumanInputRequest, fF as failHostExportBatch, fG as failWarmingToCold, fH as fenceCodexResetRedemptionSend, fI as fetchCodexRateLimitResetCreditsForAccount, fJ as fetchCodexUsageForAccount, fK as finalizeEnrollmentByToken, fL as findActiveApiKeyByHash, fM as forceDrainOverLimitViewerOnlyBoxes, fN as frozenInitiatorForCommandActor, fO as getActiveSessionHistoryItems, fP as getActiveSessionTurnForExecution, fQ as getAnySessionInGroup, fR as getBillingBalance, fS as getBillingCustomer, fT as getCapabilityCatalogItem, fU as getCapabilityInstallation, fV as getCodexCapacityWaitForSession, fW as getCodexCredentialStatus, fX as getCodexResetRedemptionAttempt, fY as getCodexRotationSettings, fZ as getComposerDraftInTransaction, f_ as getConnectionMetadata, f$ as getDeviceEnrollmentRequestByDeviceCode, g0 as getEnrollment, g1 as getFile, g2 as getFileUpload, g3 as getHostExportConsumerStatus, g4 as getHumanInputResumeForEvent, g5 as getKnowledgeMemory, g6 as getLatestRunState, g7 as getLatestStartedSessionTurn, g8 as getManagedAccount, g9 as getManagedUserByEmail, ga as getMaterializedSandboxFileResources, gb as getOpenPtySession, gc as getOrCreateSessionSystemUpdateOutbox, gd as getPackInstallation, ge as getPendingDeviceEnrollmentRequestByUserCode, gf as getPendingDeviceEnrollmentRequestByUserCodeGlobal, gg as getRecording, gh as getRetainedFileArtifact, gi as getRig, gj as getRigByName, gk as getRigChange, gl as getRigName, gm as getRigVersion, gn as getRigVersionById, go as getSandbox, gp as getSandboxSessionEnvelope, gq as getScheduledTask, gr as getSession, gs as getSessionByCreateIdempotencyKey, gt as getSessionCodexState, gu as getSessionEvent, gv as getSessionEventByClientEventId, gw as getSessionForSubject, gx as getSessionGoal, gy as getSessionHistoryItems, gz as getSessionHumanInputRequest, gA as getSessionLineage, gB as getSessionQueueSnapshot, gC as getSessionRootId, gD as getSessionSystemUpdateOutboxByDedupeKey, gE as getSessionTurn, gF as getSessionTurnForAttempt, gG as getSocialConnection, gH as getStoredCapabilityHeaderCiphertext, gI as getStreamAcknowledgment, gJ as getVariableSet, gK as getVariableSetByName, gL as getVariableSetValuesForRun, gM as getWorkspace, gN as getWorkspaceControlEvent, gO as getWorkspaceDefaultRigId, gP as getWorkspaceEnvironment, gQ as getWorkspaceEnvironmentByName, gR as getWorkspaceEnvironmentValuesForRun, gS as getWorkspaceGrant, gT as getWorkspaceModelPolicy, gU as getWorkspacePack, gV as grantWorkspaceAccess, gW as hasCreditLedgerEntry, gX as hashMemoryText, gY as heartbeatCodexCredentialLease, gZ as heartbeatCodexCredentialLeaseUntil, g_ as heartbeatLeaseHolder, g$ as ingestMachineMetricsSample, h0 as initializeSessionStartAtomically, h1 as insertFailedWorkspaceCapture, h2 as insertMachineMetricsSeries, h3 as insertPtySession, h4 as insertRecording, h5 as insertWorkspaceCapture, h6 as installOrReadTurnExecutionPolicyForAttempt, h7 as interruptedToolCallResult, h8 as isCodexBilledTurn, h9 as isDatabasePersistenceFailure, ha as isMemoryTextTooLong, hb as isRetryablePersistenceSqlState, hc as isSessionCompactionRequested, hd as isSessionEventPersistenceError, he as isStripeWebhookProcessed, hf as latestWorkspaceCapture, hg as listApiKeys, hh as listCapabilityCatalogItems, hi as listCapabilityInstallations, hj as listCodexAccountStatuses, hk as listCodexResetRedemptionRecoveries, hl as listConnectionsMetadata, hm as listCreditBalancesByAccount, hn as listDistinctRigVersionIdsInGroup, ho as listDistinctVariableSetIdsInGroup, hp as listEnabledMcpCapabilityServers, hq as listEnrollments, hr as listGitHubInstallationAccessForWorkspace, hs as listGitHubInstallationIdsForWorkspace, ht as listGitHubInstallationsForWorkspace, hu as listKnowledgeMemories, hv as listLiveModalSandboxLeaseAttributions, hw as listMeterableWarmLeases, hx as listOpenPtySessions, hy as listOutstandingSessionSystemUpdates, hz as listPackInstallations, hA as listPendingCodexCapacityWakeTargets, hB as listPendingSessionTurns, hC as listRecordings, hD as listRegistryCatalogSurfaceKeys, hE as listRigChangeMonitoringSummaries, hF as listRigChanges, hG as listRigVersionMonitoringSummaries, hH as listRigVersions, hI as listRigs, hJ as listSandboxes, hK as listScheduledTaskRuns, hL as listScheduledTasks, hM as listSessionDiscoverySummaries, hN as listSessionEventPage, hO as listSessionEvents, hP as listSessionHumanInputRequests, hQ as listSessionIdsInGroup, hR as listSessionMcpServerMetadata, hS as listSessionMcpServersForChildInheritance, hT as listSessionMcpServersForRun, hU as listSessionSystemUpdatesForTurn, hV as listSessionTurns, hW as listSessions, hX as listSessionsForSubject, hY as listSocialConnections, hZ as listSocialPosts, h_ as listUsageEvents, h$ as listVariableSets, i0 as listWorkspaceControlEvents, i1 as listWorkspaceEnvironments, i2 as listWorkspaceMembers, i3 as listWorkspacePacks, i4 as listWorkspacesForSubject, i5 as loadCodexCredentialForRun, i6 as loadConnectionCredentialForBroker, i7 as loadIntegrationOAuthClient, i8 as loadVariableSetForRun, i9 as loadWorkspaceEnvironmentForRun, ia as lockSessionEventWriteRows, ib as lockWorkspaceInferenceControl, ic as markFileUploadFailed, id as markSandboxFileResourcesMaterialized, ie as markScheduledTaskRunFailedIfQueued, ig as markSessionAttemptQuiesced, ih as markSessionSystemUpdateOutboxDeliveredInTransaction, ii as markSessionSystemUpdateOutboxFailed, ij as markSessionWorkflowWakeDelivered, ik as markSessionWorkflowWakeFailed, il as markStaleRegistryCatalogItems, im as markStripeWebhookProcessed, io as markWarmLeaseInstanceLost, ip as mcpServerIdForCapability, iq as moveQueuedTurnInTransaction, ir as mutateSessionControlInTransaction, is as mutateWorkspaceControlInTransaction, it as nestedPostgresSqlState, iu as nextSessionHistoryPosition, iv as normalizeBearerScheme, iw as normalizeMemoryText, ix as orphanedResultRowIndicesForRepair, iy as peekSessionWork, iz as persistDrainSnapshot, iA as persistWarmSnapshot, iB as planWorkspaceCaptureGc, iC as projectEffectiveControlForRelatedAccess, iD as projectSessionForRelatedAccess, provisionRoles, iE as pruneHostExportOutbox, iF as quarantineCodexCredentialForLease, iG as reArmDrainingLease, iH as readActiveSandbox, iI as readLease, iJ as readMachineMetricsLatest, iK as readMachineMetricsLatestForWorkspace, iL as readMachineMetricsSeries, iM as reapExpiredSessionListSnapshots, iN as reapStaleLeaseHolders, iO as reapStaleLeaseHoldersGlobal, iP as reconcileCodexCapacityWait, iQ as recordAuditEvent, iR as recordCodexAccountConnectors, iS as recordCodexAccountUsage, iT as recordCodexAccountUsageWithWakeTargets, iU as recordCodexTokenRefresh, iV as recordConnectionTokenRefresh, iW as recordConnectionUsed, iX as recordLeaseDataPlaneUrl, iY as recordLeaseTerminalDataPlaneUrl, iZ as recordPendingSessionToolCallResult, i_ as recordSessionActiveCodexCredential, i$ as recordSkippedContextCompaction, j0 as recordStreamAcknowledgment, j1 as recordStripeWebhookEvent, j2 as recordUsageEvent, j3 as recordWarmingSandboxCreated, j4 as recoverSessionDispatch, j5 as refreshOAuthConnectionCredential, j6 as registerDbBinding, j7 as registerHostExportConsumer, j8 as registerInternalUpdateWakeInTransaction, j9 as registerPendingSessionToolCall, ja as registerSessionTurnAttemptClaim, jb as registerSessionWorkflowWakeInTransaction, jc as registerWorkspacePack, jd as releaseCodexCredentialLease, je as releaseCodexResetRedemptionClaim, jf as releaseLeaseHolder, jg as removeWorkspaceMember, jh as renameCodexAccount, ji as renderWorkspaceMemoryBlock, jj as replaceIntegrationOAuthClient, jk as requestSessionCompaction, jl as requestSessionTurnRecovery, jm as requireFile, jn as requireScheduledTask, jo as requireSession, jp as requireSocialConnection, jq as requireWorkspace, jr as reserveSessionCommandReceipt, js as reserveToolspaceCallForAttempt, jt as resolveWorkspaceMemoryBlock, ju as resumeHostExportConsumer, jv as retireHostExportConsumer, jw as revokeApiKey, jx as revokeConnection, jy as revokeEnrollment, jz as revokeViewer, jA as rewindHostExportConsumer, jB as rlsContextForWorkspace, jC as rlsStrategyFor, jD as runIdempotentPersistenceTransaction, jE as safeDatabaseErrorFacts, jF as sanitizeEventPayload, jG as sanitizeEventString, jH as sanitizeMemoryText, jI as sanitizeModelPayload, jJ as saveComposerDraftInTransaction, jK as saveRunState, jL as saveWorkspaceMemory, jM as searchWorkspaceMemories, jN as sendAgentMessageInTransaction, jO as serializeEffectiveSessionControl, jP as sessionAuthorizationScopeFilter, jQ as sessionSubject, jR as sessionTreeStatsForSessions, jS as sessionsWithActiveOpOnEnrollment, jT as setActiveCodexCredential, jU as setActiveSandbox, jV as setCodexCredentialExhausted, jW as setCodexCredentialExhaustedWithWakeTargets, jX as setCodexCredentialStatus, jY as setCodexCredentialStatusById, jZ as setConnectionStatus, j_ as setEnrollmentDisplayState, j$ as setEnrollmentOpStreamState, k0 as setEnrollmentWentOffline, k1 as setInitialActiveCodexCredential, k2 as setRlsContext, k3 as setSessionCodexPin, k4 as setSessionGoalLastContinuationTurn, k5 as setSessionGoalStatus, k6 as setSessionLastInputTokensForTurnAttempt, k7 as setSessionPin, k8 as setTemporalWorkflowId, k9 as setVariableSetVariable, ka as setWorkspaceDefaultRig, kb as setWorkspaceEnvironmentVariable, kc as settleCodexCredentialFailover, kd as settleCodexCredentialLeaseLoss, ke as settleScheduledTaskRunInTransaction, kf as settleSessionAttemptInterruptions, kg as settleSessionIdleWithParentOutbox, kh as shortMemoryId, ki as steerAgentSessionInTransaction, kj as steerQueuedTurnInTransaction, kk as storeIntegrationOAuthClient, kl as submitHumanPromptInTransaction, km as sumUsageQuantity, kn as supersedeSessionCurrentDirectionInTransaction, ko as touchEnrollmentLastSeen, kp as touchLeaseHolder, kq as updateCodexAllocatorEligibility, kr as updateCodexRotationSettings, ks as updateConnection, kt as updateImportBatchCounts, ku as updateKnowledgeMemory, kv as updatePackInstallationStatus, kw as updatePtySessionActivity, kx as updateRecording, ky as updateRig, kz as updateRigChangeStatus, kA as updateScheduledTask, kB as updateScheduledTaskRun, kC as updateSessionCommandReceiptResult, kD as updateSessionGoal, kE as updateSessionMcpApprovalPolicy, kF as updateSessionMcpServerCredentials, kG as updateSessionTitle, kH as updateVariableSet, kI as updateWorkspace, kJ as updateWorkspaceEnvironment, kK as updateWorkspaceSettings, kL as upsertBillingCustomer, kM as upsertCapabilityCatalogItem, kN as upsertCodexSubscriptionCredential, kO as upsertGitHubInstallation, kP as upsertMachineMetricsLatest, kQ as upsertRegistryCapabilityCatalogItem, kR as upsertSandboxSessionEnvelope, kS as upsertSessionGoal, kT as upsertWorkspaceModelPolicy, kU as validateHumanInputResponse, kV as withAccountRls, kW as withCodexCapacityMutation, kX as withCodexCredentialRefreshLock, kY as withCodexTokenDeadline, kZ as withRlsContext, k_ as withWorkspaceRls, k$ as withWorkspaceSubjectRls, l0 as withWorkspaceUsageLock, l1 as workspaceCaptureAtRevision, l2 as workspaceCodexSubscriptionActive } from './provision-roles.js';
+export { A as AGENT_VISIBLE_MEMORY_STATUSES, a as AcceptSessionApprovalDecisionResult, b as AcceptSessionHumanInputResponseResult, c as AccrueWarmSecondsResult, d as AcquireLeaseInput, e as AcquireLeaseResult, f as ActiveSandboxPointer, g as AddSessionSystemUpdateInput, h as AddSessionSystemUpdateResult, i as AdoptCodexResetRedemptionResult, j as AgentCommandAuthorityError, k as AgentInternalUpdateCommandResult, l as AppendEventInput, m as ApplyContextCompactionResult, n as ApplySessionTurnSettlementInput, o as ApplySessionTurnSettlementResult, p as ArmCodexCapacityWaitResult, B as BeginSandboxRematerializationResult, q as BootstrapWorkspaceInput, C as CODEX_CAPACITY_REFRESH_MAX_MS, r as CODEX_CAPACITY_REFRESH_MIN_MS, s as CODEX_CREDENTIAL_LEASE_TTL_MS, t as CODEX_RESET_REDEMPTION_OUTCOMES, u as CODEX_ROTATION_STRATEGIES, v as ClaimCodexResetRedemptionResult, w as ClaimSessionWorkForAttemptInput, x as ClaimSessionWorkForAttemptResult, y as ClearSessionContextResult, z as CodexAccountStatus, D as CodexAccountUsageSnapshot, E as CodexAllocatorUpdateResult, F as CodexAuthDeps, G as CodexCapacityAvailabilityDecision, H as CodexCapacityMutationResult, I as CodexCapacityResetKind, J as CodexCapacitySelectionContext, K as CodexCapacityWait, L as CodexCapacityWaitStatus, M as CodexCapacityWakeTarget, N as CodexCredentialForRun, O as CodexCredentialLeaseCandidateFilter, P as CodexCredentialLeaseCandidateFilterResult, Q as CodexCredentialLeasePolicyScopeResolver, R as CodexCredentialLeaseQuarantine, S as CodexCredentialLeaseResult, T as CodexCredentialLeaseSelection, U as CodexCredentialLeaseSelectionContext, V as CodexCredentialStatus, W as CodexCredentialTokens, X as CodexLeaseAccountStatus, Y as CodexPinSource, Z as CodexRateLimitResetCreditsAccountResult, _ as CodexResetRedemptionAttempt, $ as CodexResetRedemptionOutcome, a0 as CodexResetRedemptionRecovery, a1 as CodexResetRedemptionSendNotReadyReason, a2 as CodexResetRedemptionStatus, a3 as CodexRotationSettings, a4 as CodexRotationStrategy, a5 as CodexTokenDeadlineClock, a6 as CodexTokenDeadlineOptions, a7 as ComposerDraftRow, a8 as ConnectionBrokerDeps, a9 as ConnectionCredentialForBroker, aa as ConnectionRefreshHttpError, ab as ConsumeOAuthStateNonceInput, ac as CorrectWorkspaceMemoryInput, ad as CorrectWorkspaceMemoryResult, ae as CreateCapabilityCatalogItemInput, af as CreateConnectionInput, ag as CreateDbOptions, ah as CreateImportBatchInput, ai as CreateKnowledgeMemoryInput, aj as CreatePackInstallationInput, ak as CreateScheduledTaskInput, al as CreateSessionGoalInput, am as CreateSessionMcpServerInput, an as CreateSocialConnectionInput, ao as CreateSocialPostInput, ap as CreditBalanceByAccount, aq as Database, ar as DatabaseFailureCode, as as DbClient, at as DbSession, au as DeviceEnrollmentRequestRecord, av as DeviceEnrollmentStatus, aw as EditQueueCommandResult, ax as EffectiveControlBlocker, ay as EffectiveControlResumeOption, az as EffectiveControlState, aA as EffectiveSessionControl, aB as EnableCapabilityInstallationInput, aC as EnabledMcpCapabilityServer, aD as EnqueueSessionTurnInput, aE as EnrollmentExposure, aF as EnrollmentOs, aG as EnrollmentRecord, aH as EnrollmentStatus, aI as ExpiredFileUploadCleanupClaim, aJ as FenceCodexResetRedemptionSendResult, aK as FileUploadCleanupClaimResult, aL as ForceDrainResult, aM as FrozenTurnInitiator, aN as GitHubInstallation, aO as GitHubInstallationAccess, aP as GoalContinuationDecision, aQ as HostExportConsumerStatus, aR as HostExportKind, aS as HostExportPayloadError, aT as HostMcpCredentialBindingError, aU as HostMcpCredentialResolverContext, aV as HostMcpCredentialScopeError, aW as HumanInputResponseValidationError, aX as IdempotentPersistenceTransactionOptions, aY as ImportBatch, aZ as InitializeSessionStartInput, a_ as InitializeSessionStartResult, a$ as InstallOrReadTurnExecutionPolicyForAttemptResult, b0 as IntegrationOAuthClientForUse, b1 as LeaseHolderKind, b2 as LeaseSnapshot, b3 as ListKnowledgeMemoryOptions, b4 as ListSessionEventPageOptions, b5 as ListSessionEventsOptions, b6 as ListSessionsForSubjectOptions, b7 as ListSessionsOptions, b8 as LiveModalSandboxLeaseAttribution, b9 as MACHINE_METRICS_SERIES_INTERVAL_MS, ba as MAX_INTERNAL_UPDATE_BATCH_BYTES, bb as MAX_INTERNAL_UPDATE_BATCH_MEMBERS, bc as MAX_INTERNAL_UPDATE_BYTES, bd as MEMORY_ACTIVE_RECORD_CAP, be as MEMORY_BLOCK_KIND_ORDER, bf as MEMORY_BLOCK_RECORD_LIMIT, bg as MEMORY_CORRECT_TOOL_DESCRIPTION, bh as MEMORY_KIND_SECTION_TITLES, bi as MEMORY_NEAR_DUP_COSINE_THRESHOLD, bj as MEMORY_NEAR_DUP_NEIGHBORS, bk as MEMORY_SAVE_TOOL_DESCRIPTION, bl as MEMORY_SEARCH_DEFAULT_LIMIT, bm as MEMORY_SEARCH_MAX_LIMIT, bn as MEMORY_SEARCH_TOOL_DESCRIPTION, bo as MEMORY_TEXT_MAX_CHARS, bp as MEMORY_VISIBLE_RECORD_CAP, bq as MachineMetricsRow, br as MachineMetricsSample, bs as MarkWarmLeaseInstanceLostResult, bt as MaterializeGoalContinuationResult, bu as MemoryBlockRecord, bv as MemoryEmbedder, bw as MemorySanitizeResult, bx as MeterableWarmLease, by as NestedAgentDepthDeploymentPolicy, bz as NestedAgentDepthPolicySource, bA as NewSessionDraftAccessError, bB as NewSessionDraftConflictError, bC as NewSessionDraftRow, bD as PendingSessionToolCallInput, bE as PersistenceFailureDetails, bF as PersistenceRetryOutcome, ProvisionResult, ProvisionRolesOptions, bG as QueueCommandConflictCode, bH as QueueCommandConflictError, bI as QueueCommandResult, bJ as QueuedTurnRow, bK as ReapDrainable, bL as ReconcileCodexCapacityWaitResult, bM as RecoverSessionDispatchInput, bN as RecoverSessionDispatchResult, bO as RefreshTransportOptions, bP as RegisterWorkspacePackInput, bQ as RegistryCapabilityCatalogItemInput, bR as RegistryCatalogSurfaceKey, bS as ReplaceIntegrationOAuthClientInput, bT as RequestSessionTurnRecoveryInput, bU as RequestSessionTurnRecoveryResult, bV as ResolveConnectionCredentialInput, bW as ResolveConnectionCredentialResult, bX as RetainedFileArtifact, bY as RigActiveVersionChangedError, bZ as RigChangeAlreadyVerifyingError, b_ as RigChangeMonitoringSummary, b$ as RigChangeTransitionError, c0 as RigVersionContentInput, c1 as RigVersionMonitoringSummary, c2 as RlsContext, c3 as RlsStrategy, c4 as SESSION_ANCESTRY_LIMIT, c5 as SESSION_DISCOVERY_CONTROL_TARGET_LIMIT, c6 as SESSION_DISCOVERY_CONTROL_TITLE_MAX_CHARS, c7 as SESSION_DISCOVERY_GOAL_MAX_CHARS, c8 as SESSION_DISCOVERY_MESSAGE_MAX_CHARS, c9 as SESSION_EVENT_DB_PAGE_MAX_BYTES, ca as SESSION_LIST_SNAPSHOT_MAX_ACTIVE_PER_SUBJECT, cb as SESSION_LIST_SNAPSHOT_MAX_IDS, cc as SafeDatabaseErrorFacts, cd as SandboxArchiveAvailability, ce as SandboxArchiveRevision, cf as SandboxImageConflictError, cg as SandboxKind, ch as SandboxLeaseLiveness, ci as SandboxLeaseRecoveryBlockedError, cj as SandboxLeaseSupersededError, ck as SandboxOpenPtySessionRow, cl as SandboxProviderExistence, cm as SandboxPtyProcessIdentity, cn as SandboxPtySessionRow, co as SandboxRecord, cp as SandboxRecoveryState, cq as SandboxRestoreStatus, cr as SandboxRetainedProcess, cs as SandboxRetainedProcessState, ct as SandboxRigConflictError, cu as SandboxWorkspaceMutationAdmission, cv as SandboxWorkspaceMutationFencedError, cw as SandboxWorkspaceMutationProviderOutcome, cx as SandboxWorkspaceReadiness, cy as SanitizedDatabasePersistenceCause, cz as SaveWorkspaceMemoryInput, cA as SaveWorkspaceMemoryResult, cB as SessionAttemptInterruptionSettlement, cC as SessionCodexState, cD as SessionCommandActor, cE as SessionCommandIdempotencyError, cF as SessionCommandReceiptRow, cG as SessionContextBusyError, cH as SessionControlConflictError, cI as SessionControlInvariantError, cJ as SessionControlMutationResult, cK as SessionCreateDeniedResult, cL as SessionCreateInput, cM as SessionCreateResult, cN as SessionCreateSuccessResult, cO as SessionDepthPolicy, cP as SessionDiscoveryControl, cQ as SessionDiscoveryCursor, cR as SessionDiscoveryOrderBy, cS as SessionDiscoverySummary, cT as SessionEventPage, cU as SessionEventPersistenceError, cV as SessionEventWriteLockInput, cW as SessionEventWriteLocks, cX as SessionGoalContinuationProjection, cY as SessionIdConflictError, cZ as SessionLineage, c_ as SessionListAccessError, c$ as SessionListCursor, d0 as SessionListCursorError, d1 as SessionListCursorExpiredError, d2 as SessionListSnapshotLimitError, d3 as SessionMcpServerForRun, d4 as SessionPinAccessError, d5 as SessionPinVersionConflictError, d6 as SessionRecordingCodec, d7 as SessionRecordingMode, d8 as SessionRecordingRow, d9 as SessionRecordingState, da as SessionSpawnDenial, db as SessionSpawnDenialCode, dc as SessionSpawnDeniedDbError, dd as SessionSystemUpdateOutboxDelivery, de as SessionTurnAttemptOutcome, df as SessionTurnForExecution, dg as SessionTurnRecordingSettlement, dh as SessionWorkPeek, di as SessionWorkTrigger, dj as SessionWorkflowWake, dk as SessionWorkflowWakeDeliveryResult, dl as SetSessionCodexPinOptions, dm as SetSessionGoalStatusEvent, dn as SettleCodexCredentialFailoverResult, dp as SettleCodexCredentialLeaseLossResult, dq as SteerQueueCommandResult, dr as StoreIntegrationOAuthClientInput, ds as StoredIntegrationOAuthClient, dt as StreamAcknowledgment, du as SubmitHumanPromptResult, dv as ToolspaceCallReservation, dw as ToolspaceTurnAttemptClaims, dx as TurnAttemptFenceRejectReason, dy as UpdateConnectionInput, dz as UpdateImportBatchCountsInput, dA as UpdateKnowledgeMemoryInput, dB as UpdateScheduledTaskInput, dC as UpdateSessionMcpApprovalPolicyResult, dD as UpdateSessionMcpServerCredentialsInput, dE as UpdateSessionMcpServerCredentialsResult, dF as UpsertCodexSubscriptionCredentialResult, dG as UserLookup, dH as VariableSetForRun, dI as WORKSPACE_MEMORY_BLOCK_EMPTY, dJ as WORKSPACE_MEMORY_BLOCK_HEADER_POPULATED, dK as WORKSPACE_MEMORY_BLOCK_TOKEN_BUDGET, dL as WorkspaceCaptureCommitResult, dM as WorkspaceCaptureGcPlan, dN as WorkspaceCaptureGcRow, dO as WorkspaceCaptureRow, dP as WorkspaceControlLockMode, dQ as WorkspaceControlMutationResult, dR as WorkspaceControlRow, dS as WorkspaceEnvironmentForRun, dT as WorkspaceMemoryOrigin, dU as WorkspaceMemorySearchInput, dV as WorkspaceMemorySearchMode, dW as WorkspaceMemorySearchResult, dX as WorkspaceModelPolicy, dY as abandonCodexResetRedemptionBeforeProvider, dZ as abandonRecordingForTurnAttempt, d_ as acceptSessionApprovalDecision, d$ as acceptSessionHumanInputResponse, e0 as accrueWarmSeconds, e1 as acknowledgeHostExportBatch, e2 as acquireCodexCredentialLease, e3 as acquireLease, e4 as activateRigVersion, e5 as addSessionSystemUpdate, e6 as addSessionSystemUpdateWithSourceMutation, e7 as admitToolspaceTurnAttempt, e8 as adoptCodexResetRedemptionAttempt, e9 as advanceWorkspaceGeneration, ea as advanceWorkspaceGenerationForDirectRequest, eb as advanceWorkspaceGenerationForRetainedProcess, ec as allAccountPermissions, ed as allWorkspacePermissions, ee as appendSessionEventToSandboxGroup, ef as appendSessionEvents, eg as appendSessionEventsAndUpdateSession, eh as appendSessionEventsForTurnAttempt, ei as appendSessionEventsWithLockedSessionUpdate, ej as appendSessionHistoryItems, ek as applyContextCompaction, el as applyCreditDebitUpToBalance, em as applyCreditLedgerEntry, en as applySessionTurnSettlement, eo as approveDeviceEnrollmentRequest, ep as areGitHubRepositoriesAllowedForWorkspace, eq as armCodexCapacityWait, er as assertAgentCommandAuthorityInTransaction, es as autoResumeSessionBranchInTransaction, et as beginRigChangeVerificationAttempt, eu as beginSandboxRematerialization, ev as bindGitHubInstallationRepositories, ew as bootstrapWorkspace, ex as buildChildCompletionDigest, ey as buildCodexTokenResolver, ez as buildConnectionTokenResolver, eA as buildHostConnectionTokenResolver, eB as canonicalSessionCommandHash, eC as claimCodexResetRedemption, eD as claimExpiredFileUploadCleanup, eE as claimFileUploadCleanup, eF as claimHostExportBatch, eG as claimPendingSessionSystemUpdateOutbox, eH as claimPendingSessionWorkflowWakes, eI as claimSessionWorkForAttempt, eJ as clearDurablePendingSessionToolCalls, eK as clearEnrollmentWentOffline, eL as clearPendingSessionToolspaceCall, eM as clearSessionContext, eN as clearSessionGoal, eO as clearedContextMarkerItem, eP as closePtySession, eQ as closeSessionTurnAttemptInTransaction, eR as codexCapacityRefreshBackoffMs, eS as commitWarmingToWarm, eT as completeCodexResetRedemption, eU as completeExpiredFileUploadCleanup, eV as completeFileUpload, eW as completeFileUploadCleanup, eX as computeWorkspaceCaptureGcPlan, eY as confirmDrainCold, eZ as consumeDeviceEnrollmentRequest, e_ as consumeIntegrationOAuthStateNonce, e$ as consumeNewSessionDraftInTransaction, f0 as correctWorkspaceMemory, f1 as countActiveApiKeysForWorkspace, f2 as countActiveSessionHistoryItems, f3 as countActiveSessionsForWorkspace, f4 as countActiveSessionsUsingEnvironment, f5 as countActiveSessionsUsingVariableSet, f6 as countConsecutiveReactiveRotations, f7 as countQueuedTurns, f8 as countRigs, f9 as countSandboxLeasesByLiveness, fa as countScheduledTasksForWorkspace, fb as countScheduledTasksUsingEnvironment, fc as countScheduledTasksUsingVariableSet, fd as countSessionHistoryItems, fe as countSessionsUsingRig, ff as countVariableSets, fg as countWorkspaceEnvironments, fh as countWorkspacesForAccount, fi as createApiKey, fj as createConnection, fk as createDb, fl as createDeviceEnrollmentRequest, fm as createEnrollment, fn as createFileUpload, fo as createImportBatch, fp as createKnowledgeMemory, fq as createRig, fr as createRigChange, fs as createRigVersion, ft as createRigVersionForChangePromotion, fu as createSandbox, fv as createScheduledTask, fw as createScheduledTaskRun, fx as createSession, fy as createSessionGoal, fz as createSessionMcpServers, fA as createSessionWithIdempotencyKey, fB as createSessionWithIdempotencyKeyResult, fC as createSocialConnection, fD as createSocialPost, fE as createVariableSet, fF as createWorkspace, fG as createWorkspaceEnvironment, fH as databaseFailureCode, fI as deadLetterHostExportHead, fJ as decodeSessionListCursor, fK as decryptEnvironmentValue, fK as decryptVariableSetValue, fL as decryptedCapabilityHeaders, fM as deleteGitHubInstallationBinding, fN as deleteRecording, fO as deleteRig, fP as deleteRigIfNoActiveSessions, fQ as deleteScheduledTask, fR as deleteSessionQueueItemInTransaction, fS as deleteVariableSet, fT as deleteVariableSetVariable, fU as deleteWorkspace, fV as deleteWorkspaceCaptureRows, fW as deleteWorkspaceEnvironment, fX as deleteWorkspaceEnvironmentVariable, fY as deleteWorkspacePack, fZ as denyDeviceEnrollmentRequest, f_ as disableCapabilityInstallation, f$ as disableHostExportConsumer, g0 as disconnectAllCodexAccounts, g1 as disconnectCodexAccount, g2 as editQueuedTurnInTransaction, g3 as enableCapabilityInstallation, g4 as enablePackInstallation, g5 as encodeSessionListCursor, g6 as encryptEnvironmentValue, g6 as encryptVariableSetValue, g7 as enqueueSessionTurn, g8 as enqueueSessionWorkflowWake, g9 as enqueueSessionWorkflowWakeIfRunnable, ga as enqueueSessionWorkflowWakeInTransaction, gb as ensureCodexRotationSettings, gc as ensureManagedAccessForUser, gd as estimateMemoryTokens, ge as evaluateGoalContinuation, gf as evaluateSessionControl, gg as evaluateSessionControls, gh as evaluateSessionDiscoveryControls, gi as expireSessionHumanInputRequest, gj as failHostExportBatch, gk as failSandboxRematerialization, gl as failWarmingToCold, gm as fenceCodexResetRedemptionSend, gn as fetchCodexRateLimitResetCreditsForAccount, go as fetchCodexUsageForAccount, gp as finalizeEnrollmentByToken, gq as findActiveApiKeyByHash, gr as forceDrainOverLimitViewerOnlyBoxes, gs as frozenInitiatorForCommandActor, gt as getActiveSessionHistoryItems, gu as getActiveSessionTurnForExecution, gv as getAnySessionInGroup, gw as getBillingBalance, gx as getBillingCustomer, gy as getCapabilityCatalogItem, gz as getCapabilityInstallation, gA as getCodexCapacityWaitForSession, gB as getCodexCredentialStatus, gC as getCodexResetRedemptionAttempt, gD as getCodexRotationSettings, gE as getComposerDraftInTransaction, gF as getConnectionMetadata, gG as getDeviceEnrollmentRequestByDeviceCode, gH as getEnrollment, gI as getFile, gJ as getFileUpload, gK as getHostExportConsumerStatus, gL as getHumanInputResumeForEvent, gM as getKnowledgeMemory, gN as getLatestRunState, gO as getLatestStartedSessionTurn, gP as getManagedAccount, gQ as getManagedUserByEmail, gR as getMaterializedSandboxFileResources, gS as getNestedAgentDepthDeploymentPolicy, gT as getNewSessionDraftInTransaction, gU as getOpenPtySession, gV as getOrCreateSessionSystemUpdateOutbox, gW as getPackInstallation, gX as getPendingDeviceEnrollmentRequestByUserCode, gY as getPendingDeviceEnrollmentRequestByUserCodeGlobal, gZ as getRecording, g_ as getRetainedFileArtifact, g$ as getRetainedProcess, h0 as getRig, h1 as getRigByName, h2 as getRigChange, h3 as getRigName, h4 as getRigVersion, h5 as getRigVersionById, h6 as getSandbox, h7 as getSandboxSessionEnvelope, h8 as getScheduledTask, h9 as getSession, ha as getSessionByCreateIdempotencyKey, hb as getSessionCodexState, hc as getSessionEvent, hd as getSessionEventByClientEventId, he as getSessionForSubject, hf as getSessionGoal, hg as getSessionGoalWithContinuation, hh as getSessionHistoryItems, hi as getSessionHumanInputRequest, hj as getSessionLineage, hk as getSessionQueueSnapshot, hl as getSessionRootId, hm as getSessionSpawnDenial, hn as getSessionSpawnDenialByIdempotencyKey, ho as getSessionSystemUpdateOutboxByDedupeKey, hp as getSessionTurn, hq as getSessionTurnForAttempt, hr as getSocialConnection, hs as getStoredCapabilityHeaderCiphertext, ht as getStreamAcknowledgment, hu as getVariableSet, hv as getVariableSetByName, hw as getVariableSetValuesForRun, hx as getWorkspace, hy as getWorkspaceControlEvent, hz as getWorkspaceDefaultRigId, hA as getWorkspaceEnvironment, hB as getWorkspaceEnvironmentByName, hC as getWorkspaceEnvironmentValuesForRun, hD as getWorkspaceGrant, hE as getWorkspaceModelPolicy, hF as getWorkspacePack, hG as grantWorkspaceAccess, hH as hasCreditLedgerEntry, hI as hashMemoryText, hJ as heartbeatCodexCredentialLease, hK as heartbeatCodexCredentialLeaseUntil, hL as heartbeatLeaseHolder, hM as ingestMachineMetricsSample, hN as initializeSessionStartAtomically, hO as insertFailedWorkspaceCapture, hP as insertMachineMetricsSeries, hQ as insertPtySession, hR as insertRecording, hS as insertWorkspaceCapture, hT as installOrReadTurnExecutionPolicyForAttempt, hU as interruptedToolCallResult, hV as isCodexBilledTurn, hW as isDatabasePersistenceFailure, hX as isMemoryTextTooLong, hY as isRetryablePersistenceSqlState, hZ as isSessionCompactionRequested, h_ as isSessionEventPersistenceError, h$ as isStripeWebhookProcessed, i0 as latestWorkspaceCapture, i1 as listApiKeys, i2 as listCapabilityCatalogItems, i3 as listCapabilityInstallations, i4 as listCodexAccountStatuses, i5 as listCodexResetRedemptionRecoveries, i6 as listConnectionsMetadata, i7 as listCreditBalancesByAccount, i8 as listDistinctRigVersionIdsInGroup, i9 as listDistinctVariableSetIdsInGroup, ia as listEnabledMcpCapabilityServers, ib as listEnrollments, ic as listGitHubInstallationAccessForWorkspace, id as listGitHubInstallationIdsForWorkspace, ie as listGitHubInstallationsForWorkspace, ig as listKnowledgeMemories, ih as listLiveModalSandboxLeaseAttributions, ii as listMeterableWarmLeases, ij as listOpenPtySessions, ik as listOutstandingSessionSystemUpdates, il as listPackInstallations, im as listPendingCodexCapacityWakeTargets, io as listPendingSessionTurns, ip as listRecordings, iq as listRegistryCatalogSurfaceKeys, ir as listRigChangeMonitoringSummaries, is as listRigChanges, it as listRigVersionMonitoringSummaries, iu as listRigVersions, iv as listRigs, iw as listSandboxes, ix as listScheduledTaskRuns, iy as listScheduledTasks, iz as listSessionDiscoverySummaries, iA as listSessionEventPage, iB as listSessionEvents, iC as listSessionHumanInputRequests, iD as listSessionIdsInGroup, iE as listSessionMcpServerMetadata, iF as listSessionMcpServersForChildInheritance, iG as listSessionMcpServersForRun, iH as listSessionSpawnDenials, iI as listSessionSystemUpdatesForTurn, iJ as listSessionTurns, iK as listSessions, iL as listSessionsForSubject, iM as listSocialConnections, iN as listSocialPosts, iO as listUsageEvents, iP as listVariableSets, iQ as listWorkspaceControlEvents, iR as listWorkspaceEnvironments, iS as listWorkspaceMembers, iT as listWorkspacePacks, iU as listWorkspacesForSubject, iV as loadCodexCredentialForRun, iW as loadConnectionCredentialForBroker, iX as loadIntegrationOAuthClient, iY as loadVariableSetForRun, iZ as loadWorkspaceEnvironmentForRun, i_ as lockSessionEventWriteRows, i$ as lockWorkspaceInferenceControl, j0 as markFileUploadFailed, j1 as markSandboxFileResourcesMaterialized, j2 as markSandboxProviderReady, j3 as markSandboxRestoreVerifying, j4 as markScheduledTaskRunFailedIfQueued, j5 as markSessionAttemptQuiesced, j6 as markSessionSystemUpdateOutboxDeliveredInTransaction, j7 as markSessionSystemUpdateOutboxFailed, j8 as markSessionWorkflowWakeDelivered, j9 as markSessionWorkflowWakeFailed, ja as markStaleRegistryCatalogItems, jb as markStripeWebhookProcessed, jc as markWarmLeaseInstanceLost, jd as materializeGoalContinuation, je as mcpServerIdForCapability, jf as moveQueuedTurnInTransaction, jg as mutateSessionControlInTransaction, jh as mutateWorkspaceControlInTransaction, ji as nestedPostgresSqlState, jj as nextSessionHistoryPosition, jk as normalizeBearerScheme, jl as normalizeMemoryText, jm as orphanedResultRowIndicesForRepair, jn as peekSessionWork, jo as persistDrainSnapshot, jp as persistWarmSnapshot, jq as planWorkspaceCaptureGc, jr as projectEffectiveControlForRelatedAccess, js as projectSessionForRelatedAccess, provisionRoles, jt as pruneHostExportOutbox, ju as quarantineCodexCredentialForLease, jv as reArmDrainingLease, jw as readActiveSandbox, jx as readLease, jy as readMachineMetricsLatest, jz as readMachineMetricsLatestForWorkspace, jA as readMachineMetricsSeries, jB as readWorkspaceArchiveCapturePreflight, jC as reapExpiredSessionListSnapshots, jD as reapStaleLeaseHolders, jE as reapStaleLeaseHoldersGlobal, jF as reconcileCodexCapacityWait, jG as recordAuditEvent, jH as recordCodexAccountConnectors, jI as recordCodexAccountUsage, jJ as recordCodexAccountUsageWithWakeTargets, jK as recordCodexTokenRefresh, jL as recordConnectionTokenRefresh, jM as recordConnectionUsed, jN as recordLeaseDataPlaneUrl, jO as recordLeaseTerminalDataPlaneUrl, jP as recordPendingSessionToolCallResult, jQ as recordSessionActiveCodexCredential, jR as recordSkippedContextCompaction, jS as recordStreamAcknowledgment, jT as recordStripeWebhookEvent, jU as recordUsageEvent, jV as recordWarmingSandboxCreated, jW as recoverSessionDispatch, jX as refreshOAuthConnectionCredential, jY as registerDbBinding, jZ as registerHostExportConsumer, j_ as registerInternalUpdateWakeInTransaction, j$ as registerPendingSessionToolCall, k0 as registerSessionTurnAttemptClaim, k1 as registerSessionWorkflowWakeInTransaction, k2 as registerWorkspacePack, k3 as releaseCodexCredentialLease, k4 as releaseCodexResetRedemptionClaim, k5 as releaseLeaseHolder, k6 as removeWorkspaceMember, k7 as renameCodexAccount, k8 as renderWorkspaceMemoryBlock, k9 as replaceIntegrationOAuthClient, ka as requestSessionCompaction, kb as requestSessionTurnRecovery, kc as requireFile, kd as requireScheduledTask, ke as requireSession, kf as requireSocialConnection, kg as requireWorkspace, kh as reserveSessionCommandReceipt, ki as reserveToolspaceCallForAttempt, kj as resolveWorkspaceMemoryBlock, kk as resumeHostExportConsumer, kl as retainWorkspaceMutationProcess, km as retireHostExportConsumer, kn as revokeApiKey, ko as revokeConnection, kp as revokeEnrollment, kq as revokeViewer, kr as rewindHostExportConsumer, ks as rlsContextForWorkspace, kt as rlsStrategyFor, ku as rotateWorkspaceArchives, kv as runIdempotentPersistenceTransaction, kw as safeDatabaseErrorFacts, kx as sanitizeEventPayload, ky as sanitizeEventString, kz as sanitizeMemoryText, kA as sanitizeModelPayload, kB as saveComposerDraftInTransaction, kC as saveNewSessionDraftInTransaction, kD as saveRunState, kE as saveWorkspaceMemory, kF as searchWorkspaceMemories, kG as sendAgentMessageInTransaction, kH as serializeEffectiveSessionControl, kI as sessionAuthorizationScopeFilter, kJ as sessionSubject, kK as sessionTreeStatsForSessions, kL as sessionsWithActiveOpOnEnrollment, kM as setActiveCodexCredential, kN as setActiveSandbox, kO as setCodexCredentialExhausted, kP as setCodexCredentialExhaustedWithWakeTargets, kQ as setCodexCredentialStatus, kR as setCodexCredentialStatusById, kS as setConnectionStatus, kT as setEnrollmentDisplayState, kU as setEnrollmentOpStreamState, kV as setEnrollmentWentOffline, kW as setInitialActiveCodexCredential, kX as setRlsContext, kY as setSessionCodexPin, kZ as setSessionGoalLastContinuationTurn, k_ as setSessionGoalStatus, k$ as setSessionGoalStatusWithEvent, l0 as setSessionLastInputTokensForTurnAttempt, l1 as setSessionPin, l2 as setSubjectRlsContext, l3 as setTemporalWorkflowId, l4 as setVariableSetVariable, l5 as setWorkspaceDefaultRig, l6 as setWorkspaceEnvironmentVariable, l7 as settleCodexCredentialFailover, l8 as settleCodexCredentialLeaseLoss, l9 as settleRetainedProcess, la as settleScheduledTaskRunInTransaction, lb as settleSessionAttemptInterruptions, lc as settleSessionIdleWithParentOutbox, ld as shortMemoryId, le as steerAgentSessionInTransaction, lf as steerQueuedTurnInTransaction, lg as storeIntegrationOAuthClient, lh as submitHumanPromptInTransaction, li as sumUsageQuantity, lj as supersedeSessionCurrentDirectionInTransaction, lk as touchEnrollmentLastSeen, ll as touchLeaseHolder, lm as updateCodexAllocatorEligibility, ln as updateCodexRotationSettings, lo as updateConnection, lp as updateImportBatchCounts, lq as updateKnowledgeMemory, lr as updatePackInstallationStatus, ls as updatePtySessionActivity, lt as updateRecording, lu as updateRig, lv as updateRigChangeStatus, lw as updateScheduledTask, lx as updateScheduledTaskRun, ly as updateSessionCommandReceiptResult, lz as updateSessionGoal, lA as updateSessionGoalWithEvent, lB as updateSessionMcpApprovalPolicy, lC as updateSessionMcpServerCredentials, lD as updateSessionTitle, lE as updateVariableSet, lF as updateWorkspace, lG as updateWorkspaceEnvironment, lH as updateWorkspaceSettings, lI as upsertBillingCustomer, lJ as upsertCapabilityCatalogItem, lK as upsertCodexSubscriptionCredential, lL as upsertGitHubInstallation, lM as upsertMachineMetricsLatest, lN as upsertRegistryCapabilityCatalogItem, lO as upsertSandboxSessionEnvelope, lP as upsertSessionGoal, lQ as upsertSessionGoalWithEvent, lR as upsertWorkspaceModelPolicy, lS as validateHumanInputResponse, lT as verifyDirectWorkspaceMutationSettlement, lU as verifyRetainedProcessMutationSettlement, lV as verifyWorkspaceMutationSettlement, lW as withAccountRls, lX as withCodexCapacityMutation, lY as withCodexCredentialRefreshLock, lZ as withCodexTokenDeadline, l_ as withRlsContext, l$ as withWorkspaceRls, m0 as withWorkspaceSubjectRls, m1 as withWorkspaceUsageLock, m2 as workspaceCaptureAtRevision, m3 as workspaceCodexSubscriptionActive } from './provision-roles.js';
 import 'drizzle-orm/pg-core';
-import './schema-CqkzrBRS.js';
+import 'postgres';
+import './schema-CnpD6BcX.js';
 export { migrate, runMigrations } from './migrate.js';
 export { isPrivateAddress } from '@opengeni/network';