@opengeni/db 0.12.1 → 0.13.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (37) hide show
  1. package/dist/chunk-ELMUCYZF.js +906 -0
  2. package/dist/chunk-ELMUCYZF.js.map +1 -0
  3. package/dist/chunk-N4WTE6SB.js +4033 -0
  4. package/dist/chunk-N4WTE6SB.js.map +1 -0
  5. package/dist/index.d.ts +2 -2
  6. package/dist/index.js +3594 -2059
  7. package/dist/index.js.map +1 -1
  8. package/dist/provision-roles.d.ts +472 -43
  9. package/dist/provision-roles.js +1 -1
  10. package/dist/{schema-BejThLcd.d.ts → schema-Bh1Hr7xY.d.ts} +2507 -970
  11. package/dist/schema.d.ts +1 -1
  12. package/dist/schema.js +9 -1
  13. package/drizzle/0122_codex_capacity_same_turn.sql +59 -0
  14. package/drizzle/0123_session_tool_policy_version.sql +14 -0
  15. package/drizzle/0124_session_event_duplicate_lookup.sql +4 -0
  16. package/drizzle/0125_document_drops_visibility.sql +29 -0
  17. package/drizzle/0126_document_access_constraints.sql +138 -0
  18. package/drizzle/0127_document_default_base_index.sql +5 -0
  19. package/drizzle/0128_github_installation_authority.sql +69 -0
  20. package/drizzle/0129_retained_process_reconciliation.sql +356 -0
  21. package/drizzle/0130_workspace_instruction_policies.sql +330 -0
  22. package/drizzle/0131_slack_bot_install_and_post_idempotency.sql +133 -0
  23. package/package.json +4 -3
  24. package/src/event-payload-sanitizer.ts +167 -55
  25. package/src/index.ts +1850 -264
  26. package/src/new-session-drafts.ts +127 -6
  27. package/src/provision-roles.ts +184 -2
  28. package/src/runtime-posture-cli.ts +57 -0
  29. package/src/runtime-posture.ts +770 -0
  30. package/src/schema.ts +243 -3
  31. package/src/session-control.ts +1 -0
  32. package/src/workspace-instruction-policies-schema.ts +140 -0
  33. package/src/workspace-instruction-policies.ts +624 -0
  34. package/dist/chunk-BMFDXFPA.js +0 -155
  35. package/dist/chunk-BMFDXFPA.js.map +0 -1
  36. package/dist/chunk-VUKRIBO5.js +0 -3679
  37. package/dist/chunk-VUKRIBO5.js.map +0 -1
package/dist/index.d.ts CHANGED
@@ -2,9 +2,9 @@ import '@opengeni/contracts';
2
2
  import '@opengeni/config';
3
3
  export { isCodexBilledModel } from '@opengeni/codex';
4
4
  export { sql as dbSql } from 'drizzle-orm';
5
- export { A as AGENT_VISIBLE_MEMORY_STATUSES, a as AcceptSessionApprovalDecisionResult, b as AcceptSessionHumanInputResponseResult, c as AccrueWarmSecondsResult, d as AcquireLeaseInput, e as AcquireLeaseResult, f as ActiveSandboxPointer, g as AddSessionSystemUpdateInput, h as AddSessionSystemUpdateResult, i as AdoptCodexResetRedemptionResult, j as AgentCommandAuthorityError, k as AgentInternalUpdateCommandResult, l as AppendEventInput, m as ApplyContextCompactionResult, n as ApplySessionTurnSettlementInput, o as ApplySessionTurnSettlementResult, p as ArmCodexCapacityWaitResult, B as BeginSandboxRematerializationResult, q as BootstrapWorkspaceInput, C as CODEX_CAPACITY_REFRESH_MAX_MS, r as CODEX_CAPACITY_REFRESH_MIN_MS, s as CODEX_CREDENTIAL_LEASE_TTL_MS, t as CODEX_RESET_REDEMPTION_OUTCOMES, u as CODEX_ROTATION_STRATEGIES, v as ClaimCodexResetRedemptionResult, w as ClaimSessionWorkForAttemptInput, x as ClaimSessionWorkForAttemptResult, y as ClearSessionContextResult, z as CodexAccountStatus, D as CodexAccountUsageSnapshot, E as CodexAllocatorUpdateResult, F as CodexAuthDeps, G as CodexCapacityAvailabilityDecision, H as CodexCapacityMutationResult, I as CodexCapacityResetKind, J as CodexCapacitySelectionContext, K as CodexCapacityWait, L as CodexCapacityWaitStatus, M as CodexCapacityWakeTarget, N as CodexCredentialForRun, O as CodexCredentialLeaseCandidateFilter, P as CodexCredentialLeaseCandidateFilterResult, Q as CodexCredentialLeasePolicyScopeResolver, R as CodexCredentialLeaseQuarantine, S as CodexCredentialLeaseResult, T as CodexCredentialLeaseSelection, U as CodexCredentialLeaseSelectionContext, V as CodexCredentialStatus, W as CodexCredentialTokens, X as CodexLeaseAccountStatus, Y as CodexPinSource, Z as CodexRateLimitResetCreditsAccountResult, _ as CodexResetRedemptionAttempt, $ as CodexResetRedemptionOutcome, a0 as CodexResetRedemptionRecovery, a1 as CodexResetRedemptionSendNotReadyReason, a2 as CodexResetRedemptionStatus, a3 as CodexRotationSettings, a4 as CodexRotationStrategy, a5 as CodexTokenDeadlineClock, a6 as CodexTokenDeadlineOptions, a7 as ComposerDraftRow, a8 as ConnectionBrokerDeps, a9 as ConnectionCredentialForBroker, aa as ConnectionRefreshHttpError, ab as ConsumeOAuthStateNonceInput, ac as CorrectWorkspaceMemoryInput, ad as CorrectWorkspaceMemoryResult, ae as CreateCapabilityCatalogItemInput, af as CreateConnectionInput, ag as CreateDbOptions, ah as CreateImportBatchInput, ai as CreateKnowledgeMemoryInput, aj as CreatePackInstallationInput, ak as CreateScheduledTaskInput, al as CreateSessionGoalInput, am as CreateSessionMcpServerInput, an as CreateSocialConnectionInput, ao as CreateSocialPostInput, ap as CreditBalanceByAccount, aq as Database, ar as DatabaseFailureCode, as as DbClient, at as DbSession, au as DeviceEnrollmentRequestRecord, av as DeviceEnrollmentStatus, aw as EditQueueCommandResult, ax as EffectiveControlBlocker, ay as EffectiveControlResumeOption, az as EffectiveControlState, aA as EffectiveSessionControl, aB as EnableCapabilityInstallationInput, aC as EnabledMcpCapabilityServer, aD as EnqueueSessionTurnInput, aE as EnrollmentExposure, aF as EnrollmentOs, aG as EnrollmentRecord, aH as EnrollmentStatus, aI as ExpiredFileUploadCleanupClaim, aJ as FenceCodexResetRedemptionSendResult, aK as FileUploadCleanupClaimResult, aL as ForceDrainResult, aM as FrozenTurnInitiator, aN as GitHubInstallation, aO as GitHubInstallationAccess, aP as GoalContinuationDecision, aQ as HostExportConsumerStatus, aR as HostExportKind, aS as HostExportPayloadError, aT as HostMcpCredentialBindingError, aU as HostMcpCredentialResolverContext, aV as HostMcpCredentialScopeError, aW as HumanInputResponseValidationError, aX as IdempotentPersistenceTransactionOptions, aY as ImportBatch, aZ as InitializeSessionStartInput, a_ as InitializeSessionStartResult, a$ as InstallOrReadTurnExecutionPolicyForAttemptResult, b0 as IntegrationOAuthClientForUse, b1 as LeaseHolderKind, b2 as LeaseSnapshot, b3 as ListKnowledgeMemoryOptions, b4 as ListSessionEventPageOptions, b5 as ListSessionEventsOptions, b6 as ListSessionsForSubjectOptions, b7 as ListSessionsOptions, b8 as LiveModalSandboxLeaseAttribution, b9 as MACHINE_METRICS_SERIES_INTERVAL_MS, ba as MAX_INTERNAL_UPDATE_BATCH_BYTES, bb as MAX_INTERNAL_UPDATE_BATCH_MEMBERS, bc as MAX_INTERNAL_UPDATE_BYTES, bd as MEMORY_ACTIVE_RECORD_CAP, be as MEMORY_BLOCK_KIND_ORDER, bf as MEMORY_BLOCK_RECORD_LIMIT, bg as MEMORY_CORRECT_TOOL_DESCRIPTION, bh as MEMORY_KIND_SECTION_TITLES, bi as MEMORY_NEAR_DUP_COSINE_THRESHOLD, bj as MEMORY_NEAR_DUP_NEIGHBORS, bk as MEMORY_SAVE_TOOL_DESCRIPTION, bl as MEMORY_SEARCH_DEFAULT_LIMIT, bm as MEMORY_SEARCH_MAX_LIMIT, bn as MEMORY_SEARCH_TOOL_DESCRIPTION, bo as MEMORY_TEXT_MAX_CHARS, bp as MEMORY_VISIBLE_RECORD_CAP, bq as MachineMetricsRow, br as MachineMetricsSample, bs as MarkWarmLeaseInstanceLostResult, bt as MaterializeGoalContinuationResult, bu as MemoryBlockRecord, bv as MemoryEmbedder, bw as MemorySanitizeResult, bx as MeterableWarmLease, by as NestedAgentDepthDeploymentPolicy, bz as NestedAgentDepthPolicySource, bA as NewSessionDraftAccessError, bB as NewSessionDraftConflictError, bC as NewSessionDraftRow, bD as PendingSessionToolCallInput, bE as PersistenceFailureDetails, bF as PersistenceRetryOutcome, ProvisionResult, ProvisionRolesOptions, bG as QueueCommandConflictCode, bH as QueueCommandConflictError, bI as QueueCommandResult, bJ as QueuedTurnRow, bK as ReapDrainable, bL as ReconcileCodexCapacityWaitResult, bM as RecoverSessionDispatchInput, bN as RecoverSessionDispatchResult, bO as RefreshTransportOptions, bP as RegisterWorkspacePackInput, bQ as RegistryCapabilityCatalogItemInput, bR as RegistryCatalogSurfaceKey, bS as ReplaceIntegrationOAuthClientInput, bT as RequestSessionTurnRecoveryInput, bU as RequestSessionTurnRecoveryResult, bV as ResolveConnectionCredentialInput, bW as ResolveConnectionCredentialResult, bX as RetainedFileArtifact, bY as RigActiveVersionChangedError, bZ as RigChangeAlreadyVerifyingError, b_ as RigChangeMonitoringSummary, b$ as RigChangeTransitionError, c0 as RigVersionContentInput, c1 as RigVersionMonitoringSummary, c2 as RlsContext, c3 as RlsStrategy, c4 as SESSION_ANCESTRY_LIMIT, c5 as SESSION_DISCOVERY_CONTROL_TARGET_LIMIT, c6 as SESSION_DISCOVERY_CONTROL_TITLE_MAX_CHARS, c7 as SESSION_DISCOVERY_GOAL_MAX_CHARS, c8 as SESSION_DISCOVERY_MESSAGE_MAX_CHARS, c9 as SESSION_EVENT_DB_PAGE_MAX_BYTES, ca as SESSION_LIST_SNAPSHOT_MAX_ACTIVE_PER_SUBJECT, cb as SESSION_LIST_SNAPSHOT_MAX_IDS, cc as SafeDatabaseErrorFacts, cd as SandboxArchiveAvailability, ce as SandboxArchiveRevision, cf as SandboxImageConflictError, cg as SandboxKind, ch as SandboxLeaseLiveness, ci as SandboxLeaseRecoveryBlockedError, cj as SandboxLeaseSupersededError, ck as SandboxOpenPtySessionRow, cl as SandboxProviderExistence, cm as SandboxPtyProcessIdentity, cn as SandboxPtySessionRow, co as SandboxRecord, cp as SandboxRecoveryState, cq as SandboxRestoreStatus, cr as SandboxRetainedProcess, cs as SandboxRetainedProcessState, ct as SandboxRigConflictError, cu as SandboxWorkspaceMutationAdmission, cv as SandboxWorkspaceMutationFencedError, cw as SandboxWorkspaceMutationProviderOutcome, cx as SandboxWorkspaceReadiness, cy as SanitizedDatabasePersistenceCause, cz as SaveWorkspaceMemoryInput, cA as SaveWorkspaceMemoryResult, cB as SessionAttemptInterruptionSettlement, cC as SessionCodexState, cD as SessionCommandActor, cE as SessionCommandIdempotencyError, cF as SessionCommandReceiptRow, cG as SessionContextBusyError, cH as SessionControlConflictError, cI as SessionControlInvariantError, cJ as SessionControlMutationResult, cK as SessionCreateDeniedResult, cL as SessionCreateInput, cM as SessionCreateResult, cN as SessionCreateSuccessResult, cO as SessionDepthPolicy, cP as SessionDiscoveryControl, cQ as SessionDiscoveryCursor, cR as SessionDiscoveryOrderBy, cS as SessionDiscoverySummary, cT as SessionEventPage, cU as SessionEventPersistenceError, cV as SessionEventWriteLockInput, cW as SessionEventWriteLocks, cX as SessionGoalContinuationProjection, cY as SessionIdConflictError, cZ as SessionLineage, c_ as SessionListAccessError, c$ as SessionListCursor, d0 as SessionListCursorError, d1 as SessionListCursorExpiredError, d2 as SessionListSnapshotLimitError, d3 as SessionMcpServerForRun, d4 as SessionPinAccessError, d5 as SessionPinVersionConflictError, d6 as SessionRecordingCodec, d7 as SessionRecordingMode, d8 as SessionRecordingRow, d9 as SessionRecordingState, da as SessionSpawnDenial, db as SessionSpawnDenialCode, dc as SessionSpawnDeniedDbError, dd as SessionSystemUpdateOutboxDelivery, de as SessionTurnAttemptOutcome, df as SessionTurnForExecution, dg as SessionTurnRecordingSettlement, dh as SessionWorkPeek, di as SessionWorkTrigger, dj as SessionWorkflowWake, dk as SessionWorkflowWakeDeliveryResult, dl as SetSessionCodexPinOptions, dm as SetSessionGoalStatusEvent, dn as SettleCodexCredentialFailoverResult, dp as SettleCodexCredentialLeaseLossResult, dq as SteerQueueCommandResult, dr as StoreIntegrationOAuthClientInput, ds as StoredIntegrationOAuthClient, dt as StreamAcknowledgment, du as SubmitHumanPromptResult, dv as ToolspaceCallReservation, dw as ToolspaceTurnAttemptClaims, dx as TurnAttemptFenceRejectReason, dy as UpdateConnectionInput, dz as UpdateImportBatchCountsInput, dA as UpdateKnowledgeMemoryInput, dB as UpdateScheduledTaskInput, dC as UpdateSessionMcpApprovalPolicyResult, dD as UpdateSessionMcpServerCredentialsInput, dE as UpdateSessionMcpServerCredentialsResult, dF as UpsertCodexSubscriptionCredentialResult, dG as UserLookup, dH as VariableSetForRun, dI as WORKSPACE_MEMORY_BLOCK_EMPTY, dJ as WORKSPACE_MEMORY_BLOCK_HEADER_POPULATED, dK as WORKSPACE_MEMORY_BLOCK_TOKEN_BUDGET, dL as WorkspaceCaptureCommitResult, dM as WorkspaceCaptureGcPlan, dN as WorkspaceCaptureGcRow, dO as WorkspaceCaptureRow, dP as WorkspaceControlLockMode, dQ as WorkspaceControlMutationResult, dR as WorkspaceControlRow, dS as WorkspaceEnvironmentForRun, dT as WorkspaceMemoryOrigin, dU as WorkspaceMemorySearchInput, dV as WorkspaceMemorySearchMode, dW as WorkspaceMemorySearchResult, dX as WorkspaceModelPolicy, dY as abandonCodexResetRedemptionBeforeProvider, dZ as abandonRecordingForTurnAttempt, d_ as acceptSessionApprovalDecision, d$ as acceptSessionHumanInputResponse, e0 as accrueWarmSeconds, e1 as acknowledgeHostExportBatch, e2 as acquireCodexCredentialLease, e3 as acquireLease, e4 as activateRigVersion, e5 as addSessionSystemUpdate, e6 as addSessionSystemUpdateWithSourceMutation, e7 as admitToolspaceTurnAttempt, e8 as adoptCodexResetRedemptionAttempt, e9 as advanceWorkspaceGeneration, ea as advanceWorkspaceGenerationForDirectRequest, eb as advanceWorkspaceGenerationForRetainedProcess, ec as allAccountPermissions, ed as allWorkspacePermissions, ee as appendSessionEventToSandboxGroup, ef as appendSessionEvents, eg as appendSessionEventsAndUpdateSession, eh as appendSessionEventsForTurnAttempt, ei as appendSessionEventsWithLockedSessionUpdate, ej as appendSessionHistoryItems, ek as applyContextCompaction, el as applyCreditDebitUpToBalance, em as applyCreditLedgerEntry, en as applySessionTurnSettlement, eo as approveDeviceEnrollmentRequest, ep as areGitHubRepositoriesAllowedForWorkspace, eq as armCodexCapacityWait, er as assertAgentCommandAuthorityInTransaction, es as autoResumeSessionBranchInTransaction, et as beginRigChangeVerificationAttempt, eu as beginSandboxRematerialization, ev as bindGitHubInstallationRepositories, ew as bootstrapWorkspace, ex as buildChildCompletionDigest, ey as buildCodexTokenResolver, ez as buildConnectionTokenResolver, eA as buildHostConnectionTokenResolver, eB as canonicalSessionCommandHash, eC as claimCodexResetRedemption, eD as claimExpiredFileUploadCleanup, eE as claimFileUploadCleanup, eF as claimHostExportBatch, eG as claimPendingSessionSystemUpdateOutbox, eH as claimPendingSessionWorkflowWakes, eI as claimSessionWorkForAttempt, eJ as clearDurablePendingSessionToolCalls, eK as clearEnrollmentWentOffline, eL as clearPendingSessionToolspaceCall, eM as clearSessionContext, eN as clearSessionGoal, eO as clearedContextMarkerItem, eP as closePtySession, eQ as closeSessionTurnAttemptInTransaction, eR as codexCapacityRefreshBackoffMs, eS as commitWarmingToWarm, eT as completeCodexResetRedemption, eU as completeExpiredFileUploadCleanup, eV as completeFileUpload, eW as completeFileUploadCleanup, eX as computeWorkspaceCaptureGcPlan, eY as confirmDrainCold, eZ as consumeDeviceEnrollmentRequest, e_ as consumeIntegrationOAuthStateNonce, e$ as consumeNewSessionDraftInTransaction, f0 as correctWorkspaceMemory, f1 as countActiveApiKeysForWorkspace, f2 as countActiveSessionHistoryItems, f3 as countActiveSessionsForWorkspace, f4 as countActiveSessionsUsingEnvironment, f5 as countActiveSessionsUsingVariableSet, f6 as countConsecutiveReactiveRotations, f7 as countQueuedTurns, f8 as countRigs, f9 as countSandboxLeasesByLiveness, fa as countScheduledTasksForWorkspace, fb as countScheduledTasksUsingEnvironment, fc as countScheduledTasksUsingVariableSet, fd as countSessionHistoryItems, fe as countSessionsUsingRig, ff as countVariableSets, fg as countWorkspaceEnvironments, fh as countWorkspacesForAccount, fi as createApiKey, fj as createConnection, fk as createDb, fl as createDeviceEnrollmentRequest, fm as createEnrollment, fn as createFileUpload, fo as createImportBatch, fp as createKnowledgeMemory, fq as createRig, fr as createRigChange, fs as createRigVersion, ft as createRigVersionForChangePromotion, fu as createSandbox, fv as createScheduledTask, fw as createScheduledTaskRun, fx as createSession, fy as createSessionGoal, fz as createSessionMcpServers, fA as createSessionWithIdempotencyKey, fB as createSessionWithIdempotencyKeyResult, fC as createSocialConnection, fD as createSocialPost, fE as createVariableSet, fF as createWorkspace, fG as createWorkspaceEnvironment, fH as databaseFailureCode, fI as deadLetterHostExportHead, fJ as decodeSessionListCursor, fK as decryptEnvironmentValue, fK as decryptVariableSetValue, fL as decryptedCapabilityHeaders, fM as deleteGitHubInstallationBinding, fN as deleteRecording, fO as deleteRig, fP as deleteRigIfNoActiveSessions, fQ as deleteScheduledTask, fR as deleteSessionQueueItemInTransaction, fS as deleteVariableSet, fT as deleteVariableSetVariable, fU as deleteWorkspace, fV as deleteWorkspaceCaptureRows, fW as deleteWorkspaceEnvironment, fX as deleteWorkspaceEnvironmentVariable, fY as deleteWorkspacePack, fZ as denyDeviceEnrollmentRequest, f_ as disableCapabilityInstallation, f$ as disableHostExportConsumer, g0 as disconnectAllCodexAccounts, g1 as disconnectCodexAccount, g2 as editQueuedTurnInTransaction, g3 as enableCapabilityInstallation, g4 as enablePackInstallation, g5 as encodeSessionListCursor, g6 as encryptEnvironmentValue, g6 as encryptVariableSetValue, g7 as enqueueSessionTurn, g8 as enqueueSessionWorkflowWake, g9 as enqueueSessionWorkflowWakeIfRunnable, ga as enqueueSessionWorkflowWakeInTransaction, gb as ensureCodexRotationSettings, gc as ensureManagedAccessForUser, gd as estimateMemoryTokens, ge as evaluateGoalContinuation, gf as evaluateSessionControl, gg as evaluateSessionControls, gh as evaluateSessionDiscoveryControls, gi as expireSessionHumanInputRequest, gj as failHostExportBatch, gk as failSandboxRematerialization, gl as failWarmingToCold, gm as fenceCodexResetRedemptionSend, gn as fetchCodexRateLimitResetCreditsForAccount, go as fetchCodexUsageForAccount, gp as finalizeEnrollmentByToken, gq as findActiveApiKeyByHash, gr as forceDrainOverLimitViewerOnlyBoxes, gs as frozenInitiatorForCommandActor, gt as getActiveSessionHistoryItems, gu as getActiveSessionTurnForExecution, gv as getAnySessionInGroup, gw as getBillingBalance, gx as getBillingCustomer, gy as getCapabilityCatalogItem, gz as getCapabilityInstallation, gA as getCodexCapacityWaitForSession, gB as getCodexCredentialStatus, gC as getCodexResetRedemptionAttempt, gD as getCodexRotationSettings, gE as getComposerDraftInTransaction, gF as getConnectionMetadata, gG as getDeviceEnrollmentRequestByDeviceCode, gH as getEnrollment, gI as getFile, gJ as getFileUpload, gK as getHostExportConsumerStatus, gL as getHumanInputResumeForEvent, gM as getKnowledgeMemory, gN as getLatestRunState, gO as getLatestStartedSessionTurn, gP as getManagedAccount, gQ as getManagedUserByEmail, gR as getMaterializedSandboxFileResources, gS as getNestedAgentDepthDeploymentPolicy, gT as getNewSessionDraftInTransaction, gU as getOpenPtySession, gV as getOrCreateSessionSystemUpdateOutbox, gW as getPackInstallation, gX as getPendingDeviceEnrollmentRequestByUserCode, gY as getPendingDeviceEnrollmentRequestByUserCodeGlobal, gZ as getRecording, g_ as getRetainedFileArtifact, g$ as getRetainedProcess, h0 as getRig, h1 as getRigByName, h2 as getRigChange, h3 as getRigName, h4 as getRigVersion, h5 as getRigVersionById, h6 as getSandbox, h7 as getSandboxSessionEnvelope, h8 as getScheduledTask, h9 as getSession, ha as getSessionByCreateIdempotencyKey, hb as getSessionCodexState, hc as getSessionEvent, hd as getSessionEventByClientEventId, he as getSessionForSubject, hf as getSessionGoal, hg as getSessionGoalWithContinuation, hh as getSessionHistoryItems, hi as getSessionHumanInputRequest, hj as getSessionLineage, hk as getSessionQueueSnapshot, hl as getSessionRootId, hm as getSessionSpawnDenial, hn as getSessionSpawnDenialByIdempotencyKey, ho as getSessionSystemUpdateOutboxByDedupeKey, hp as getSessionTurn, hq as getSessionTurnForAttempt, hr as getSocialConnection, hs as getStoredCapabilityHeaderCiphertext, ht as getStreamAcknowledgment, hu as getVariableSet, hv as getVariableSetByName, hw as getVariableSetValuesForRun, hx as getWorkspace, hy as getWorkspaceControlEvent, hz as getWorkspaceDefaultRigId, hA as getWorkspaceEnvironment, hB as getWorkspaceEnvironmentByName, hC as getWorkspaceEnvironmentValuesForRun, hD as getWorkspaceGrant, hE as getWorkspaceModelPolicy, hF as getWorkspacePack, hG as grantWorkspaceAccess, hH as hasCreditLedgerEntry, hI as hashMemoryText, hJ as heartbeatCodexCredentialLease, hK as heartbeatCodexCredentialLeaseUntil, hL as heartbeatLeaseHolder, hM as ingestMachineMetricsSample, hN as initializeSessionStartAtomically, hO as insertFailedWorkspaceCapture, hP as insertMachineMetricsSeries, hQ as insertPtySession, hR as insertRecording, hS as insertWorkspaceCapture, hT as installOrReadTurnExecutionPolicyForAttempt, hU as interruptedToolCallResult, hV as isCodexBilledTurn, hW as isDatabasePersistenceFailure, hX as isMemoryTextTooLong, hY as isRetryablePersistenceSqlState, hZ as isSessionCompactionRequested, h_ as isSessionEventPersistenceError, h$ as isStripeWebhookProcessed, i0 as latestWorkspaceCapture, i1 as listApiKeys, i2 as listCapabilityCatalogItems, i3 as listCapabilityInstallations, i4 as listCodexAccountStatuses, i5 as listCodexResetRedemptionRecoveries, i6 as listConnectionsMetadata, i7 as listCreditBalancesByAccount, i8 as listDistinctRigVersionIdsInGroup, i9 as listDistinctVariableSetIdsInGroup, ia as listEnabledMcpCapabilityServers, ib as listEnrollments, ic as listGitHubInstallationAccessForWorkspace, id as listGitHubInstallationIdsForWorkspace, ie as listGitHubInstallationsForWorkspace, ig as listKnowledgeMemories, ih as listLiveModalSandboxLeaseAttributions, ii as listMeterableWarmLeases, ij as listOpenPtySessions, ik as listOutstandingSessionSystemUpdates, il as listPackInstallations, im as listPendingCodexCapacityWakeTargets, io as listPendingSessionTurns, ip as listRecordings, iq as listRegistryCatalogSurfaceKeys, ir as listRigChangeMonitoringSummaries, is as listRigChanges, it as listRigVersionMonitoringSummaries, iu as listRigVersions, iv as listRigs, iw as listSandboxes, ix as listScheduledTaskRuns, iy as listScheduledTasks, iz as listSessionDiscoverySummaries, iA as listSessionEventPage, iB as listSessionEvents, iC as listSessionHumanInputRequests, iD as listSessionIdsInGroup, iE as listSessionMcpServerMetadata, iF as listSessionMcpServersForChildInheritance, iG as listSessionMcpServersForRun, iH as listSessionSpawnDenials, iI as listSessionSystemUpdatesForTurn, iJ as listSessionTurns, iK as listSessions, iL as listSessionsForSubject, iM as listSocialConnections, iN as listSocialPosts, iO as listUsageEvents, iP as listVariableSets, iQ as listWorkspaceControlEvents, iR as listWorkspaceEnvironments, iS as listWorkspaceMembers, iT as listWorkspacePacks, iU as listWorkspacesForSubject, iV as loadCodexCredentialForRun, iW as loadConnectionCredentialForBroker, iX as loadIntegrationOAuthClient, iY as loadVariableSetForRun, iZ as loadWorkspaceEnvironmentForRun, i_ as lockSessionEventWriteRows, i$ as lockWorkspaceInferenceControl, j0 as markFileUploadFailed, j1 as markSandboxFileResourcesMaterialized, j2 as markSandboxProviderReady, j3 as markSandboxRestoreVerifying, j4 as markScheduledTaskRunFailedIfQueued, j5 as markSessionAttemptQuiesced, j6 as markSessionSystemUpdateOutboxDeliveredInTransaction, j7 as markSessionSystemUpdateOutboxFailed, j8 as markSessionWorkflowWakeDelivered, j9 as markSessionWorkflowWakeFailed, ja as markStaleRegistryCatalogItems, jb as markStripeWebhookProcessed, jc as markWarmLeaseInstanceLost, jd as materializeGoalContinuation, je as mcpServerIdForCapability, jf as moveQueuedTurnInTransaction, jg as mutateSessionControlInTransaction, jh as mutateWorkspaceControlInTransaction, ji as nestedPostgresSqlState, jj as nextSessionHistoryPosition, jk as normalizeBearerScheme, jl as normalizeMemoryText, jm as orphanedResultRowIndicesForRepair, jn as peekSessionWork, jo as persistDrainSnapshot, jp as persistWarmSnapshot, jq as planWorkspaceCaptureGc, jr as projectEffectiveControlForRelatedAccess, js as projectSessionForRelatedAccess, provisionRoles, jt as pruneHostExportOutbox, ju as quarantineCodexCredentialForLease, jv as reArmDrainingLease, jw as readActiveSandbox, jx as readLease, jy as readMachineMetricsLatest, jz as readMachineMetricsLatestForWorkspace, jA as readMachineMetricsSeries, jB as readWorkspaceArchiveCapturePreflight, jC as reapExpiredSessionListSnapshots, jD as reapStaleLeaseHolders, jE as reapStaleLeaseHoldersGlobal, jF as reconcileCodexCapacityWait, jG as recordAuditEvent, jH as recordCodexAccountConnectors, jI as recordCodexAccountUsage, jJ as recordCodexAccountUsageWithWakeTargets, jK as recordCodexTokenRefresh, jL as recordConnectionTokenRefresh, jM as recordConnectionUsed, jN as recordLeaseDataPlaneUrl, jO as recordLeaseTerminalDataPlaneUrl, jP as recordPendingSessionToolCallResult, jQ as recordSessionActiveCodexCredential, jR as recordSkippedContextCompaction, jS as recordStreamAcknowledgment, jT as recordStripeWebhookEvent, jU as recordUsageEvent, jV as recordWarmingSandboxCreated, jW as recoverSessionDispatch, jX as refreshOAuthConnectionCredential, jY as registerDbBinding, jZ as registerHostExportConsumer, j_ as registerInternalUpdateWakeInTransaction, j$ as registerPendingSessionToolCall, k0 as registerSessionTurnAttemptClaim, k1 as registerSessionWorkflowWakeInTransaction, k2 as registerWorkspacePack, k3 as releaseCodexCredentialLease, k4 as releaseCodexResetRedemptionClaim, k5 as releaseLeaseHolder, k6 as removeWorkspaceMember, k7 as renameCodexAccount, k8 as renderWorkspaceMemoryBlock, k9 as replaceIntegrationOAuthClient, ka as requestSessionCompaction, kb as requestSessionTurnRecovery, kc as requireFile, kd as requireScheduledTask, ke as requireSession, kf as requireSocialConnection, kg as requireWorkspace, kh as reserveSessionCommandReceipt, ki as reserveToolspaceCallForAttempt, kj as resolveWorkspaceMemoryBlock, kk as resumeHostExportConsumer, kl as retainWorkspaceMutationProcess, km as retireHostExportConsumer, kn as revokeApiKey, ko as revokeConnection, kp as revokeEnrollment, kq as revokeViewer, kr as rewindHostExportConsumer, ks as rlsContextForWorkspace, kt as rlsStrategyFor, ku as rotateWorkspaceArchives, kv as runIdempotentPersistenceTransaction, kw as safeDatabaseErrorFacts, kx as sanitizeEventPayload, ky as sanitizeEventString, kz as sanitizeMemoryText, kA as sanitizeModelPayload, kB as saveComposerDraftInTransaction, kC as saveNewSessionDraftInTransaction, kD as saveRunState, kE as saveWorkspaceMemory, kF as searchWorkspaceMemories, kG as sendAgentMessageInTransaction, kH as serializeEffectiveSessionControl, kI as sessionAuthorizationScopeFilter, kJ as sessionSubject, kK as sessionTreeStatsForSessions, kL as sessionsWithActiveOpOnEnrollment, kM as setActiveCodexCredential, kN as setActiveSandbox, kO as setCodexCredentialExhausted, kP as setCodexCredentialExhaustedWithWakeTargets, kQ as setCodexCredentialStatus, kR as setCodexCredentialStatusById, kS as setConnectionStatus, kT as setEnrollmentDisplayState, kU as setEnrollmentOpStreamState, kV as setEnrollmentWentOffline, kW as setInitialActiveCodexCredential, kX as setRlsContext, kY as setSessionCodexPin, kZ as setSessionGoalLastContinuationTurn, k_ as setSessionGoalStatus, k$ as setSessionGoalStatusWithEvent, l0 as setSessionLastInputTokensForTurnAttempt, l1 as setSessionPin, l2 as setSubjectRlsContext, l3 as setTemporalWorkflowId, l4 as setVariableSetVariable, l5 as setWorkspaceDefaultRig, l6 as setWorkspaceEnvironmentVariable, l7 as settleCodexCredentialFailover, l8 as settleCodexCredentialLeaseLoss, l9 as settleRetainedProcess, la as settleScheduledTaskRunInTransaction, lb as settleSessionAttemptInterruptions, lc as settleSessionIdleWithParentOutbox, ld as shortMemoryId, le as steerAgentSessionInTransaction, lf as steerQueuedTurnInTransaction, lg as storeIntegrationOAuthClient, lh as submitHumanPromptInTransaction, li as sumUsageQuantity, lj as supersedeSessionCurrentDirectionInTransaction, lk as touchEnrollmentLastSeen, ll as touchLeaseHolder, lm as updateCodexAllocatorEligibility, ln as updateCodexRotationSettings, lo as updateConnection, lp as updateImportBatchCounts, lq as updateKnowledgeMemory, lr as updatePackInstallationStatus, ls as updatePtySessionActivity, lt as updateRecording, lu as updateRig, lv as updateRigChangeStatus, lw as updateScheduledTask, lx as updateScheduledTaskRun, ly as updateSessionCommandReceiptResult, lz as updateSessionGoal, lA as updateSessionGoalWithEvent, lB as updateSessionMcpApprovalPolicy, lC as updateSessionMcpServerCredentials, lD as updateSessionTitle, lE as updateVariableSet, lF as updateWorkspace, lG as updateWorkspaceEnvironment, lH as updateWorkspaceSettings, lI as upsertBillingCustomer, lJ as upsertCapabilityCatalogItem, lK as upsertCodexSubscriptionCredential, lL as upsertGitHubInstallation, lM as upsertMachineMetricsLatest, lN as upsertRegistryCapabilityCatalogItem, lO as upsertSandboxSessionEnvelope, lP as upsertSessionGoal, lQ as upsertSessionGoalWithEvent, lR as upsertWorkspaceModelPolicy, lS as validateHumanInputResponse, lT as verifyDirectWorkspaceMutationSettlement, lU as verifyRetainedProcessMutationSettlement, lV as verifyWorkspaceMutationSettlement, lW as withAccountRls, lX as withCodexCapacityMutation, lY as withCodexCredentialRefreshLock, lZ as withCodexTokenDeadline, l_ as withRlsContext, l$ as withWorkspaceRls, m0 as withWorkspaceSubjectRls, m1 as withWorkspaceUsageLock, m2 as workspaceCaptureAtRevision, m3 as workspaceCodexSubscriptionActive } from './provision-roles.js';
5
+ export { A as AGENT_VISIBLE_MEMORY_STATUSES, a as AcceptSessionApprovalDecisionResult, b as AcceptSessionHumanInputResponseResult, c as AccrueWarmSecondsResult, d as AcquireLeaseInput, e as AcquireLeaseResult, f as ActiveRetainedProcessOwnerCount, g as ActiveSandboxPointer, h as AddSessionSystemUpdateInput, i as AddSessionSystemUpdateResult, j as AdoptCodexResetRedemptionResult, k as AgentCommandAuthorityError, l as AgentInternalUpdateCommandResult, m as AppendEventInput, n as ApplyContextCompactionResult, o as ApplySessionTurnSettlementInput, p as ApplySessionTurnSettlementResult, q as ArmCodexCapacityWaitResult, B as BeginSandboxRematerializationResult, r as BootstrapWorkspaceInput, C as CODEX_CAPACITY_REFRESH_MAX_MS, s as CODEX_CAPACITY_REFRESH_MIN_MS, t as CODEX_CREDENTIAL_LEASE_TTL_MS, u as CODEX_RESET_REDEMPTION_OUTCOMES, v as CODEX_ROTATION_STRATEGIES, w as ClaimCodexResetRedemptionResult, x as ClaimSessionWorkForAttemptInput, y as ClaimSessionWorkForAttemptResult, z as ClaimSlackBotPostOperationResult, D as ClearSessionContextResult, E as CodexAccountStatus, F as CodexAccountUsageSnapshot, G as CodexAllocatorUpdateResult, H as CodexAuthDeps, I as CodexCapacityAvailabilityDecision, J as CodexCapacityMutationResult, K as CodexCapacityResetKind, L as CodexCapacitySelectionContext, M as CodexCapacityWait, N as CodexCapacityWaitStatus, O as CodexCapacityWakeTarget, P as CodexCredentialForRun, Q as CodexCredentialLeaseCandidateFilter, R as CodexCredentialLeaseCandidateFilterResult, S as CodexCredentialLeasePolicyScopeResolver, T as CodexCredentialLeaseQuarantine, U as CodexCredentialLeaseResult, V as CodexCredentialLeaseSelection, W as CodexCredentialLeaseSelectionContext, X as CodexCredentialStatus, Y as CodexCredentialTokens, Z as CodexLeaseAccountStatus, _ as CodexPinSource, $ as CodexRateLimitResetCreditsAccountResult, a0 as CodexResetRedemptionAttempt, a1 as CodexResetRedemptionOutcome, a2 as CodexResetRedemptionRecovery, a3 as CodexResetRedemptionSendNotReadyReason, a4 as CodexResetRedemptionStatus, a5 as CodexRotationSettings, a6 as CodexRotationStrategy, a7 as CodexTokenDeadlineClock, a8 as CodexTokenDeadlineOptions, a9 as CompleteSlackBotPostOperationResult, aa as ComposerDraftRow, ab as ConnectionBrokerDeps, ac as ConnectionCredentialForBroker, ad as ConnectionMetadataWithVerification, ae as ConnectionRefreshHttpError, af as ConsumeOAuthStateNonceInput, ag as CorrectWorkspaceMemoryInput, ah as CorrectWorkspaceMemoryResult, ai as CreateCapabilityCatalogItemInput, aj as CreateConnectionInput, ak as CreateDbOptions, al as CreateImportBatchInput, am as CreateKnowledgeMemoryInput, an as CreatePackInstallationInput, ao as CreateScheduledTaskInput, ap as CreateSessionGoalInput, aq as CreateSessionMcpServerInput, ar as CreateSocialConnectionInput, as as CreateSocialPostInput, at as CreditBalanceByAccount, au as Database, av as DatabaseFailureCode, aw as DbClient, ax as DbSession, ay as DeviceEnrollmentRequestRecord, az as DeviceEnrollmentStatus, aA as EditQueueCommandResult, aB as EffectiveControlBlocker, aC as EffectiveControlResumeOption, aD as EffectiveControlState, aE as EffectiveSessionControl, aF as EnableCapabilityInstallationInput, aG as EnabledMcpCapabilityServer, aH as EnqueueSessionTurnInput, aI as EnrollmentExposure, aJ as EnrollmentOs, aK as EnrollmentRecord, aL as EnrollmentStatus, aM as ExpiredDrainingSandboxLeaseCount, aN as ExpiredFileUploadCleanupClaim, aO as FORCE_RLS_TABLES, aP as FenceCodexResetRedemptionSendResult, aQ as FileUploadCleanupClaimResult, aR as ForceDrainResult, aS as FrozenTurnInitiator, aT as GitHubInstallation, aU as GitHubInstallationAccess, aV as GitHubInstallationAuthorityCommitError, aW as GoalContinuationDecision, aX as HostExportConsumerStatus, aY as HostExportKind, aZ as HostExportPayloadError, a_ as HostMcpCredentialBindingError, a$ as HostMcpCredentialResolverContext, b0 as HostMcpCredentialScopeError, b1 as HumanInputResponseValidationError, b2 as IdempotentPersistenceTransactionOptions, b3 as ImportBatch, b4 as InitializeSessionStartInput, b5 as InitializeSessionStartResult, b6 as InstallOrReadTurnExecutionPolicyForAttemptResult, b7 as IntegrationOAuthClientForUse, b8 as LeaseHolderKind, b9 as LeaseSnapshot, ba as ListKnowledgeMemoryOptions, bb as ListSessionEventPageOptions, bc as ListSessionEventsOptions, bd as ListSessionsForSubjectOptions, be as ListSessionsOptions, bf as LiveModalSandboxLeaseAttribution, bg as LostProviderWorkspaceSettlement, bh as MACHINE_METRICS_SERIES_INTERVAL_MS, bi as MAX_INTERNAL_UPDATE_BATCH_BYTES, bj as MAX_INTERNAL_UPDATE_BATCH_MEMBERS, bk as MAX_INTERNAL_UPDATE_BYTES, bl as MEMORY_ACTIVE_RECORD_CAP, bm as MEMORY_BLOCK_KIND_ORDER, bn as MEMORY_BLOCK_RECORD_LIMIT, bo as MEMORY_CORRECT_TOOL_DESCRIPTION, bp as MEMORY_KIND_SECTION_TITLES, bq as MEMORY_NEAR_DUP_COSINE_THRESHOLD, br as MEMORY_NEAR_DUP_NEIGHBORS, bs as MEMORY_SAVE_TOOL_DESCRIPTION, bt as MEMORY_SEARCH_DEFAULT_LIMIT, bu as MEMORY_SEARCH_MAX_LIMIT, bv as MEMORY_SEARCH_TOOL_DESCRIPTION, bw as MEMORY_TEXT_MAX_CHARS, bx as MEMORY_VISIBLE_RECORD_CAP, by as MachineMetricsRow, bz as MachineMetricsSample, bA as MarkWarmLeaseInstanceLostResult, bB as MaterializeGoalContinuationResult, bC as MemoryBlockRecord, bD as MemoryEmbedder, bE as MemorySanitizeResult, bF as MeterableWarmLease, bG as NON_RLS_RUNTIME_TABLES, bH as NestedAgentDepthDeploymentPolicy, bI as NestedAgentDepthPolicySource, bJ as NewSessionDraftAccessError, bK as NewSessionDraftConflictError, bL as NewSessionDraftRow, bM as PROTECTED_NO_DIRECT_DML_TABLES, bN as PendingSessionToolCallInput, bO as PersistenceFailureDetails, bP as PersistenceRetryOutcome, ProvisionResult, ProvisionRolesOptions, bQ as QueueCommandConflictCode, bR as QueueCommandConflictError, bS as QueueCommandResult, bT as QueuedTurnRow, bU as RUNTIME_DML_TABLES, bV as RUNTIME_FULL_DML_TABLES, bW as RUNTIME_READ_INSERT_TABLES, bX as RUNTIME_READ_ONLY_TABLES, bY as RUNTIME_TABLE_PRIVILEGES, bZ as ReapDrainable, b_ as ReconcileCodexCapacityWaitResult, b$ as ReconcileColdLostLeaseInstanceBlockersResult, c0 as RecoverSessionDispatchInput, c1 as RecoverSessionDispatchResult, c2 as RefreshTransportOptions, c3 as RegisterWorkspacePackInput, c4 as RegistryCapabilityCatalogItemInput, c5 as RegistryCatalogSurfaceKey, c6 as ReplaceIntegrationOAuthClientInput, c7 as RequestSessionTurnRecoveryInput, c8 as RequestSessionTurnRecoveryResult, c9 as ResolveConnectionCredentialInput, ca as ResolveConnectionCredentialResult, cb as RetainedFileArtifact, cc as RetainedProcessProviderProof, cd as RigActiveVersionChangedError, ce as RigChangeAlreadyVerifyingError, cf as RigChangeMonitoringSummary, cg as RigChangeTransitionError, ch as RigVersionContentInput, ci as RigVersionMonitoringSummary, cj as RlsContext, ck as RlsStrategy, cl as RuntimeDatabaseIdentity, cm as RuntimeDatabasePosture, cn as RuntimeDatabasePostureError, co as RuntimeDatabasePostureOptions, cp as RuntimeRoutinePosture, cq as RuntimeSchemaPosture, cr as RuntimeTableDmlPrivilege, cs as RuntimeTablePosture, ct as RuntimeTablePrivilegeContract, cu as SESSION_ANCESTRY_LIMIT, cv as SESSION_DISCOVERY_CONTROL_TARGET_LIMIT, cw as SESSION_DISCOVERY_CONTROL_TITLE_MAX_CHARS, cx as SESSION_DISCOVERY_GOAL_MAX_CHARS, cy as SESSION_DISCOVERY_MESSAGE_MAX_CHARS, cz as SESSION_EVENT_DB_PAGE_MAX_BYTES, cA as SESSION_LIST_SNAPSHOT_MAX_ACTIVE_PER_SUBJECT, cB as SESSION_LIST_SNAPSHOT_MAX_IDS, cC as SafeDatabaseErrorFacts, cD as SandboxArchiveAvailability, cE as SandboxArchiveRevision, cF as SandboxImageConflictError, cG as SandboxKind, cH as SandboxLeaseLiveness, cI as SandboxLeaseRecoveryBlockedError, cJ as SandboxLeaseSupersededError, cK as SandboxOpenPtySessionRow, cL as SandboxProviderExistence, cM as SandboxPtyProcessIdentity, cN as SandboxPtySessionRow, cO as SandboxRecord, cP as SandboxRecoveryState, cQ as SandboxRestoreStatus, cR as SandboxRetainedProcess, cS as SandboxRetainedProcessIdentity, cT as SandboxRetainedProcessPromotionFencedError, cU as SandboxRetainedProcessReconciliationClaim, cV as SandboxRetainedProcessState, cW as SandboxRigConflictError, cX as SandboxWorkspaceMutationAdmission, cY as SandboxWorkspaceMutationFencedError, cZ as SandboxWorkspaceMutationProviderOutcome, c_ as SandboxWorkspaceReadiness, c$ as SanitizedDatabasePersistenceCause, d0 as SaveWorkspaceMemoryInput, d1 as SaveWorkspaceMemoryResult, d2 as SessionAttemptInterruptionSettlement, d3 as SessionCodexState, d4 as SessionCommandActor, d5 as SessionCommandIdempotencyError, d6 as SessionCommandReceiptRow, d7 as SessionContextBusyError, d8 as SessionControlConflictError, d9 as SessionControlInvariantError, da as SessionControlMutationResult, db as SessionCreateDeniedResult, dc as SessionCreateInput, dd as SessionCreateResult, de as SessionCreateSuccessResult, df as SessionDepthPolicy, dg as SessionDiscoveryControl, dh as SessionDiscoveryCursor, di as SessionDiscoveryOrderBy, dj as SessionDiscoverySummary, dk as SessionEventPage, dl as SessionEventPersistenceError, dm as SessionEventWriteLockInput, dn as SessionEventWriteLocks, dp as SessionGoalContinuationProjection, dq as SessionIdConflictError, dr as SessionLineage, ds as SessionListAccessError, dt as SessionListCursor, du as SessionListCursorError, dv as SessionListCursorExpiredError, dw as SessionListSnapshotLimitError, dx as SessionMcpServerForRun, dy as SessionPinAccessError, dz as SessionPinVersionConflictError, dA as SessionRecordingCodec, dB as SessionRecordingMode, dC as SessionRecordingRow, dD as SessionRecordingState, dE as SessionSpawnDenial, dF as SessionSpawnDenialCode, dG as SessionSpawnDeniedDbError, dH as SessionSystemUpdateOutboxDelivery, dI as SessionToolPolicyVersionConflictError, dJ as SessionTurnAttemptOutcome, dK as SessionTurnForExecution, dL as SessionTurnRecordingSettlement, dM as SessionWorkPeek, dN as SessionWorkTrigger, dO as SessionWorkflowWake, dP as SessionWorkflowWakeDeliveryResult, dQ as SetSessionCodexPinOptions, dR as SetSessionGoalStatusEvent, dS as SettleCodexCredentialFailoverResult, dT as SettleCodexCredentialLeaseLossResult, dU as SlackBotPostOperation, dV as SteerQueueCommandResult, dW as StoreIntegrationOAuthClientInput, dX as StoredIntegrationOAuthClient, dY as StreamAcknowledgment, dZ as SubmitHumanPromptResult, d_ as ToolspaceCallReservation, d$ as ToolspaceTurnAttemptClaims, e0 as TurnAttemptFenceRejectReason, e1 as UpdateConnectionInput, e2 as UpdateImportBatchCountsInput, e3 as UpdateKnowledgeMemoryInput, e4 as UpdateScheduledTaskInput, e5 as UpdateSessionMcpApprovalPolicyResult, e6 as UpdateSessionMcpServerCredentialsInput, e7 as UpdateSessionMcpServerCredentialsResult, e8 as UpsertCodexSubscriptionCredentialResult, e9 as UserLookup, ea as VariableSetForRun, eb as WORKSPACE_MEMORY_BLOCK_EMPTY, ec as WORKSPACE_MEMORY_BLOCK_HEADER_POPULATED, ed as WORKSPACE_MEMORY_BLOCK_TOKEN_BUDGET, ee as WorkspaceCaptureCommitResult, ef as WorkspaceCaptureGcPlan, eg as WorkspaceCaptureGcRow, eh as WorkspaceCaptureRow, ei as WorkspaceControlLockMode, ej as WorkspaceControlMutationResult, ek as WorkspaceControlRow, el as WorkspaceEnvironmentForRun, em as WorkspaceInstructionPolicyConflictError, en as WorkspaceInstructionPolicyInvalidOperationError, eo as WorkspaceInstructionPolicyLegacyUnavailableError, ep as WorkspaceInstructionPolicyNotFoundError, eq as WorkspaceMemoryOrigin, er as WorkspaceMemorySearchInput, es as WorkspaceMemorySearchMode, et as WorkspaceMemorySearchResult, eu as WorkspaceModelPolicy, ev as abandonCodexResetRedemptionBeforeProvider, ew as abandonRecordingForTurnAttempt, ex as acceptSessionApprovalDecision, ey as acceptSessionHumanInputResponse, ez as accrueWarmSeconds, eA as acknowledgeHostExportBatch, eB as acquireCodexCredentialLease, eC as acquireLease, eD as activateRigVersion, eE as activateWorkspaceInstructionPolicyRevision, eF as addSessionSystemUpdate, eG as addSessionSystemUpdateWithSourceMutation, eH as admitToolspaceTurnAttempt, eI as adoptCodexResetRedemptionAttempt, eJ as advanceWorkspaceGeneration, eK as advanceWorkspaceGenerationForDirectRequest, eL as advanceWorkspaceGenerationForRetainedProcess, eM as allAccountPermissions, eN as allWorkspacePermissions, eO as appendSessionEventToSandboxGroup, eP as appendSessionEvents, eQ as appendSessionEventsAndUpdateSession, eR as appendSessionEventsForTurnAttempt, eS as appendSessionEventsWithLockedSessionUpdate, eT as appendSessionHistoryItems, eU as applyContextCompaction, eV as applyCreditDebitUpToBalance, eW as applyCreditLedgerEntry, eX as applySessionTurnSettlement, eY as approveDeviceEnrollmentRequest, eZ as areGitHubRepositoriesAllowedForWorkspace, e_ as armCodexCapacityWait, e$ as assertAgentCommandAuthorityInTransaction, f0 as assertRuntimeDatabasePosture, f1 as autoResumeSessionBranchInTransaction, f2 as beginRigChangeVerificationAttempt, f3 as beginSandboxRematerialization, f4 as bindAuthorizedGitHubInstallationRepositories, f5 as bindGitHubInstallationRepositories, f6 as bootstrapWorkspace, f7 as buildChildCompletionDigest, f8 as buildCodexTokenResolver, f9 as buildConnectionTokenResolver, fa as buildHostConnectionTokenResolver, fb as canonicalSessionCommandHash, fc as claimCodexResetRedemption, fd as claimExpiredFileUploadCleanup, fe as claimFileUploadCleanup, ff as claimHostExportBatch, fg as claimPendingSessionSystemUpdateOutbox, fh as claimPendingSessionWorkflowWakes, fi as claimSessionWorkForAttempt, fj as claimSlackBotPostOperation, fk as claimTerminalRetainedProcesses, fl as clearDurablePendingSessionToolCalls, fm as clearEnrollmentWentOffline, fn as clearPendingSessionToolspaceCall, fo as clearSessionContext, fp as clearSessionGoal, fq as clearedContextMarkerItem, fr as closePtySession, fs as closeSessionTurnAttemptInTransaction, ft as codexCapacityRefreshBackoffMs, fu as commitWarmingToWarm, fv as completeCodexResetRedemption, fw as completeExpiredFileUploadCleanup, fx as completeFileUpload, fy as completeFileUploadCleanup, fz as completeSlackBotPostOperation, fA as computeWorkspaceCaptureGcPlan, fB as confirmDrainCold, fC as consumeDeviceEnrollmentRequest, fD as consumeIntegrationOAuthStateNonce, fE as consumeNewSessionDraftInTransaction, fF as correctWorkspaceMemory, fG as countActiveApiKeysForWorkspace, fH as countActiveRetainedProcessesByOwnerState, fI as countActiveSessionHistoryItems, fJ as countActiveSessionsForWorkspace, fK as countActiveSessionsUsingEnvironment, fL as countActiveSessionsUsingVariableSet, fM as countConsecutiveReactiveRotations, fN as countExpiredDrainingSandboxLeases, fO as countQueuedTurns, fP as countRigs, fQ as countSandboxLeasesByLiveness, fR as countScheduledTasksForWorkspace, fS as countScheduledTasksUsingEnvironment, fT as countScheduledTasksUsingVariableSet, fU as countSessionHistoryItems, fV as countSessionsUsingRig, fW as countVariableSets, fX as countWorkspaceEnvironments, fY as countWorkspacesForAccount, fZ as createApiKey, f_ as createConnection, f$ as createDb, g0 as createDeviceEnrollmentRequest, g1 as createEnrollment, g2 as createFileUpload, g3 as createImportBatch, g4 as createKnowledgeMemory, g5 as createRig, g6 as createRigChange, g7 as createRigVersion, g8 as createRigVersionForChangePromotion, g9 as createSandbox, ga as createScheduledTask, gb as createScheduledTaskRun, gc as createSession, gd as createSessionGoal, ge as createSessionMcpServers, gf as createSessionWithIdempotencyKey, gg as createSessionWithIdempotencyKeyResult, gh as createSocialConnection, gi as createSocialPost, gj as createVariableSet, gk as createWorkspace, gl as createWorkspaceEnvironment, gm as createWorkspaceInstructionPolicyDraft, gn as databaseFailureCode, go as deadLetterHostExportHead, gp as decodeSessionListCursor, gq as decryptEnvironmentValue, gq as decryptVariableSetValue, gr as decryptedCapabilityHeaders, gs as deferRetainedProcessReconciliation, gt as deleteGitHubInstallationBinding, gu as deleteRecording, gv as deleteRig, gw as deleteRigIfNoActiveSessions, gx as deleteScheduledTask, gy as deleteSessionQueueItemInTransaction, gz as deleteVariableSet, gA as deleteVariableSetVariable, gB as deleteWorkspace, gC as deleteWorkspaceCaptureRows, gD as deleteWorkspaceEnvironment, gE as deleteWorkspaceEnvironmentVariable, gF as deleteWorkspacePack, gG as denyDeviceEnrollmentRequest, gH as diffWorkspaceInstructionPolicyContent, gI as diffWorkspaceInstructionPolicyRevisions, gJ as disableCapabilityInstallation, gK as disableHostExportConsumer, gL as disconnectAllCodexAccounts, gM as disconnectCodexAccount, gN as editQueuedTurnInTransaction, gO as enableCapabilityInstallation, gP as enablePackInstallation, gQ as encodeSessionListCursor, gR as encryptEnvironmentValue, gR as encryptVariableSetValue, gS as enqueueSessionTurn, gT as enqueueSessionWorkflowWake, gU as enqueueSessionWorkflowWakeIfRunnable, gV as enqueueSessionWorkflowWakeInTransaction, gW as ensureCodexRotationSettings, gX as ensureManagedAccessForUser, gY as estimateMemoryTokens, gZ as evaluateGoalContinuation, g_ as evaluateRuntimeDatabasePosture, g$ as evaluateSessionControl, h0 as evaluateSessionControls, h1 as evaluateSessionDiscoveryControls, h2 as expireSessionHumanInputRequest, h3 as failHostExportBatch, h4 as failSandboxRematerialization, h5 as failWarmingToCold, h6 as fenceCodexResetRedemptionSend, h7 as fetchCodexRateLimitResetCreditsForAccount, h8 as fetchCodexUsageForAccount, h9 as finalizeEnrollmentByToken, ha as findActiveApiKeyByHash, hb as forceDrainOverLimitViewerOnlyBoxes, hc as frozenInitiatorForCommandActor, hd as getActiveSessionHistoryItems, he as getActiveSessionTurnForExecution, hf as getAnySessionInGroup, hg as getBillingBalance, hh as getBillingCustomer, hi as getCapabilityCatalogItem, hj as getCapabilityInstallation, hk as getCodexCapacityWaitForSession, hl as getCodexCredentialStatus, hm as getCodexResetRedemptionAttempt, hn as getCodexRotationSettings, ho as getComposerDraftInTransaction, hp as getConnectionMetadata, hq as getDeviceEnrollmentRequestByDeviceCode, hr as getEnrollment, hs as getFile, ht as getFileUpload, hu as getHostExportConsumerStatus, hv as getHumanInputResumeForEvent, hw as getKnowledgeMemory, hx as getLatestRunState, hy as getLatestStartedSessionTurn, hz as getManagedAccount, hA as getManagedUserByEmail, hB as getMaterializedSandboxFileResources, hC as getNestedAgentDepthDeploymentPolicy, hD as getNewSessionDraftInTransaction, hE as getOpenPtySession, hF as getOrCreateSessionSystemUpdateOutbox, hG as getPackInstallation, hH as getPendingDeviceEnrollmentRequestByUserCode, hI as getPendingDeviceEnrollmentRequestByUserCodeGlobal, hJ as getRecording, hK as getRetainedFileArtifact, hL as getRetainedProcess, hM as getRig, hN as getRigByName, hO as getRigChange, hP as getRigName, hQ as getRigVersion, hR as getRigVersionById, hS as getSandbox, hT as getSandboxSessionEnvelope, hU as getScheduledTask, hV as getSession, hW as getSessionByCreateIdempotencyKey, hX as getSessionCodexState, hY as getSessionEvent, hZ as getSessionEventByClientEventId, h_ as getSessionForSubject, h$ as getSessionGoal, i0 as getSessionGoalWithContinuation, i1 as getSessionHistoryItems, i2 as getSessionHumanInputRequest, i3 as getSessionLineage, i4 as getSessionQueueSnapshot, i5 as getSessionRootId, i6 as getSessionSpawnDenial, i7 as getSessionSpawnDenialByIdempotencyKey, i8 as getSessionSystemUpdateOutboxByDedupeKey, i9 as getSessionTurn, ia as getSessionTurnForAttempt, ib as getSlackBotPostOperation, ic as getSocialConnection, id as getStoredCapabilityHeaderCiphertext, ie as getStreamAcknowledgment, ig as getVariableSet, ih as getVariableSetByName, ii as getVariableSetValuesForRun, ij as getWorkspace, ik as getWorkspaceControlEvent, il as getWorkspaceDefaultRigId, im as getWorkspaceEnvironment, io as getWorkspaceEnvironmentByName, ip as getWorkspaceEnvironmentValuesForRun, iq as getWorkspaceGrant, ir as getWorkspaceInstructionPolicyRevision, is as getWorkspaceModelPolicy, it as getWorkspacePack, iu as grantWorkspaceAccess, iv as hasAuditableGitHubInstallationAuthority, iw as hasCreditLedgerEntry, ix as hashMemoryText, iy as heartbeatCodexCredentialLease, iz as heartbeatCodexCredentialLeaseUntil, iA as heartbeatLeaseHolder, iB as importLegacyWorkspaceInstructionPolicyDraft, iC as ingestMachineMetricsSample, iD as initializeSessionStartAtomically, iE as insertFailedWorkspaceCapture, iF as insertMachineMetricsSeries, iG as insertPtySession, iH as insertRecording, iI as insertWorkspaceCapture, iJ as inspectRuntimeDatabasePosture, iK as installOrReadTurnExecutionPolicyForAttempt, iL as interruptedToolCallResult, iM as isCodexBilledTurn, iN as isDatabasePersistenceFailure, iO as isMemoryTextTooLong, iP as isRetryablePersistenceSqlState, iQ as isSessionCompactionRequested, iR as isSessionEventPersistenceError, iS as isStripeWebhookProcessed, iT as latestWorkspaceCapture, iU as listApiKeys, iV as listCapabilityCatalogItems, iW as listCapabilityInstallations, iX as listCodexAccountStatuses, iY as listCodexResetRedemptionRecoveries, iZ as listConnectionsMetadata, i_ as listCreditBalancesByAccount, i$ as listDistinctRigVersionIdsInGroup, j0 as listDistinctVariableSetIdsInGroup, j1 as listEnabledMcpCapabilityServers, j2 as listEnrollments, j3 as listGitHubInstallationAccessForWorkspace, j4 as listGitHubInstallationIdsForWorkspace, j5 as listGitHubInstallationsForWorkspace, j6 as listKnowledgeMemories, j7 as listLiveModalSandboxLeaseAttributions, j8 as listMeterableWarmLeases, j9 as listOpenPtySessions, ja as listOutstandingSessionSystemUpdates, jb as listPackInstallations, jc as listPendingCodexCapacityWakeTargets, jd as listPendingSessionTurns, je as listRecordings, jf as listRegistryCatalogSurfaceKeys, jg as listRigChangeMonitoringSummaries, jh as listRigChanges, ji as listRigVersionMonitoringSummaries, jj as listRigVersions, jk as listRigs, jl as listSandboxes, jm as listScheduledTaskRuns, jn as listScheduledTasks, jo as listSessionDiscoverySummaries, jp as listSessionEventPage, jq as listSessionEvents, jr as listSessionHumanInputRequests, js as listSessionIdsInGroup, jt as listSessionMcpServerMetadata, ju as listSessionMcpServersForChildInheritance, jv as listSessionMcpServersForRun, jw as listSessionSpawnDenials, jx as listSessionSystemUpdatesForTurn, jy as listSessionTurns, jz as listSessions, jA as listSessionsForSubject, jB as listSocialConnections, jC as listSocialPosts, jD as listUsageEvents, jE as listVariableSets, jF as listWorkspaceControlEvents, jG as listWorkspaceEnvironments, jH as listWorkspaceInstructionPolicyRevisions, jI as listWorkspaceMembers, jJ as listWorkspacePacks, jK as listWorkspacesForSubject, jL as loadCodexCredentialForRun, jM as loadConnectionCredentialForBroker, jN as loadIntegrationOAuthClient, jO as loadVariableSetForRun, jP as loadWorkspaceEnvironmentForRun, jQ as lockSessionEventWriteRows, jR as lockWorkspaceInferenceControl, jS as markFileUploadFailed, jT as markSandboxFileResourcesMaterialized, jU as markSandboxProviderReady, jV as markSandboxRestoreVerifying, jW as markScheduledTaskRunFailedIfQueued, jX as markSessionAttemptQuiesced, jY as markSessionSystemUpdateOutboxDeliveredInTransaction, jZ as markSessionSystemUpdateOutboxFailed, j_ as markSessionWorkflowWakeDelivered, j$ as markSessionWorkflowWakeFailed, k0 as markStaleRegistryCatalogItems, k1 as markStripeWebhookProcessed, k2 as markWarmLeaseInstanceLost, k3 as materializeGoalContinuation, k4 as mcpServerIdForCapability, k5 as moveQueuedTurnInTransaction, k6 as mutateSessionControlInTransaction, k7 as mutateWorkspaceControlInTransaction, k8 as nestedPostgresSqlState, k9 as newSessionDraftToolsProvided, ka as nextSessionHistoryPosition, kb as normalizeBearerScheme, kc as normalizeMemoryText, kd as orphanedResultRowIndicesForRepair, ke as peekSessionWork, kf as persistDrainSnapshot, kg as persistWarmSnapshot, kh as planWorkspaceCaptureGc, ki as projectEffectiveControlForRelatedAccess, kj as projectSessionForRelatedAccess, provisionRoles, kk as pruneHostExportOutbox, kl as publicNewSessionDraftOptions, km as quarantineCodexCredentialForLease, kn as reArmDrainingLease, ko as readActiveSandbox, kp as readLease, kq as readMachineMetricsLatest, kr as readMachineMetricsLatestForWorkspace, ks as readMachineMetricsSeries, kt as readWorkspaceArchiveCapturePreflight, ku as reapExpiredSessionListSnapshots, kv as reapStaleLeaseHolders, kw as reapStaleLeaseHoldersGlobal, kx as reconcileCodexCapacityWait, ky as reconcileColdLostLeaseInstanceBlockers, kz as recordAuditEvent, kA as recordCodexAccountConnectors, kB as recordCodexAccountUsage, kC as recordCodexAccountUsageWithWakeTargets, kD as recordCodexTokenRefresh, kE as recordConnectionTokenRefresh, kF as recordConnectionUsed, kG as recordLeaseDataPlaneUrl, kH as recordLeaseTerminalDataPlaneUrl, kI as recordPendingSessionToolCallResult, kJ as recordRetainedProcessReconciliationProof, kK as recordSessionActiveCodexCredential, kL as recordSkippedContextCompaction, kM as recordStreamAcknowledgment, kN as recordStripeWebhookEvent, kO as recordUsageEvent, kP as recordWarmingSandboxCreated, kQ as recoverSessionDispatch, kR as refreshOAuthConnectionCredential, kS as registerDbBinding, kT as registerHostExportConsumer, kU as registerInternalUpdateWakeInTransaction, kV as registerPendingSessionToolCall, kW as registerSessionTurnAttemptClaim, kX as registerSessionWorkflowWakeInTransaction, kY as registerWorkspacePack, kZ as releaseCodexCredentialLease, k_ as releaseCodexResetRedemptionClaim, k$ as releaseLeaseHolder, l0 as releaseSlackBotPostOperationClaim, l1 as removeWorkspaceMember, l2 as renameCodexAccount, l3 as renderWorkspaceMemoryBlock, l4 as replaceIntegrationOAuthClient, l5 as requestSessionCompaction, l6 as requestSessionTurnRecovery, l7 as requireFile, l8 as requireScheduledTask, l9 as requireSession, la as requireSocialConnection, lb as requireWorkspace, lc as reserveSessionCommandReceipt, ld as reserveToolspaceCallForAttempt, le as resolveWorkspaceMemoryBlock, lf as resumeHostExportConsumer, lg as retainWorkspaceMutationProcess, lh as retainedProcessReconciliationProof, li as retainedProcessSettlementIdentity, lj as retireHostExportConsumer, lk as revokeApiKey, ll as revokeConnection, lm as revokeEnrollment, ln as revokeViewer, lo as rewindHostExportConsumer, lp as rlsContextForWorkspace, lq as rlsStrategyFor, lr as rollbackWorkspaceInstructionPolicyRevision, ls as rotateWorkspaceArchives, lt as runIdempotentPersistenceTransaction, lu as runtimeDatabaseReadyCheck, lv as safeDatabaseErrorFacts, lw as sanitizeEventPayload, lx as sanitizeEventString, ly as sanitizeMemoryText, lz as sanitizeModelPayload, lA as saveComposerDraftInTransaction, lB as saveNewSessionDraftInTransaction, lC as saveRunState, lD as saveWorkspaceMemory, lE as searchWorkspaceMemories, lF as seedNewSessionDraftInTransaction, lG as sendAgentMessageInTransaction, lH as serializeEffectiveSessionControl, lI as sessionAuthorizationScopeFilter, lJ as sessionSubject, lK as sessionTreeStatsForSessions, lL as sessionsWithActiveOpOnEnrollment, lM as setActiveCodexCredential, lN as setActiveSandbox, lO as setCodexCredentialExhausted, lP as setCodexCredentialExhaustedWithWakeTargets, lQ as setCodexCredentialStatus, lR as setCodexCredentialStatusById, lS as setConnectionStatus, lT as setEnrollmentDisplayState, lU as setEnrollmentOpStreamState, lV as setEnrollmentWentOffline, lW as setInitialActiveCodexCredential, lX as setRlsContext, lY as setSessionCodexPin, lZ as setSessionGoalLastContinuationTurn, l_ as setSessionGoalStatus, l$ as setSessionGoalStatusWithEvent, m0 as setSessionLastInputTokensForTurnAttempt, m1 as setSessionPin, m2 as setSubjectRlsContext, m3 as setTemporalWorkflowId, m4 as setVariableSetVariable, m5 as setWorkspaceDefaultRig, m6 as setWorkspaceEnvironmentVariable, m7 as settleCodexCredentialFailover, m8 as settleCodexCredentialLeaseLoss, m9 as settleRetainedProcess, ma as settleScheduledTaskRunInTransaction, mb as settleSessionAttemptInterruptions, mc as settleSessionIdleWithParentOutbox, md as shortMemoryId, me as steerAgentSessionInTransaction, mf as steerQueuedTurnInTransaction, mg as storeIntegrationOAuthClient, mh as submitHumanPromptInTransaction, mi as sumUsageQuantity, mj as supersedeSessionCurrentDirectionInTransaction, mk as touchEnrollmentLastSeen, ml as touchLeaseHolder, mm as updateCodexAllocatorEligibility, mn as updateCodexRotationSettings, mo as updateConnection, mp as updateImportBatchCounts, mq as updateKnowledgeMemory, mr as updatePackInstallationStatus, ms as updatePtySessionActivity, mt as updateRecording, mu as updateRig, mv as updateRigChangeStatus, mw as updateScheduledTask, mx as updateScheduledTaskRun, my as updateSessionCommandReceiptResult, mz as updateSessionGoal, mA as updateSessionGoalWithEvent, mB as updateSessionMcpApprovalPolicy, mC as updateSessionMcpServerCredentials, mD as updateSessionTitle, mE as updateVariableSet, mF as updateWorkspace, mG as updateWorkspaceEnvironment, mH as updateWorkspaceSettings, mI as upsertBillingCustomer, mJ as upsertCapabilityCatalogItem, mK as upsertCodexSubscriptionCredential, mL as upsertGitHubInstallation, mM as upsertMachineMetricsLatest, mN as upsertRegistryCapabilityCatalogItem, mO as upsertSandboxSessionEnvelope, mP as upsertSessionGoal, mQ as upsertSessionGoalWithEvent, mR as upsertWorkspaceModelPolicy, mS as validateHumanInputResponse, mT as verifyDirectWorkspaceMutationSettlement, mU as verifyRetainedProcessMutationSettlement, mV as verifyWorkspaceMutationSettlement, mW as withAccountRls, mX as withCodexCapacityMutation, mY as withCodexCredentialRefreshLock, mZ as withCodexTokenDeadline, m_ as withRlsContext, m$ as withWorkspaceRls, n0 as withWorkspaceSubjectRls, n1 as withWorkspaceUsageLock, n2 as workspaceCaptureAtRevision, n3 as workspaceCodexSubscriptionActive } from './provision-roles.js';
6
6
  import 'drizzle-orm/pg-core';
7
7
  import 'postgres';
8
- import './schema-BejThLcd.js';
8
+ import './schema-Bh1Hr7xY.js';
9
9
  export { migrate, runMigrations } from './migrate.js';
10
10
  export { isPrivateAddress } from '@opengeni/network';