@opengeni/db 0.2.0

package/dist/provision-roles.d.ts

@@ -0,0 +1,2063 @@
+import { SessionEventType, Permission, CapabilityKind, CapabilitySource, ScheduledTaskStatus, ScheduledTaskScheduleSpec, ScheduledTaskRunMode, ScheduledTaskOverlapPolicy, ScheduledTaskAgentConfig, SessionGoalCreatedBy, SocialProvider, SocialConnectionStatus, SessionTurnSource, ResourceRef, ToolRef, ReasoningEffort, SandboxBackend, SessionGoal, CapabilityPack, SessionTurn, SessionEvent, SessionStatus, Session, BillingBalance, AccessContext, FileAsset, ApiKey, ScheduledTask, ScheduledTaskTriggerType, ScheduledTaskRun, SandboxOs, SocialConnection, SocialPost, Workspace, WorkspaceEnvironment, CapabilityInstallation, PackInstallation, SessionTurnStatus, CapabilityCatalogItem, FileUploadStatus, ManagedAccount, AccessGrant, WorkspaceRegisteredPack, UsageEvent, WorkspaceMember, SessionGoalStatus, WorkspaceEnvironmentVariableMetadata, PackInstallationStatus, ScheduledTaskRunStatus } from '@opengeni/contracts';
+import { environmentsEncryptionKeyBytes, Settings } from '@opengeni/config';
+import { refreshCodexToken, CodexTokenSnapshot, CodexUsagePayload } from '@opengeni/codex';
+import { PgDatabase } from 'drizzle-orm/pg-core';
+import { s as schema, e as enrollmentOsValues, a as enrollmentExposureValues, d as deviceEnrollmentStatusValues, b as enrollmentStatusValues, c as sandboxKindValues, f as sessionRecordingCodecValues, g as sessionRecordingModeValues, h as sessionRecordingStateValues } from './schema-CaeZQAJQ.js';
+import 'drizzle-orm';
+import './migrate.js';
+
+/**
+ * Encrypts one workspace environment variable value with AES-256-GCM under an
+ * operator key held outside Postgres. Output format: `v1:<b64 iv>:<b64 ciphertext||tag>`.
+ */
+declare function encryptEnvironmentValue(key: Uint8Array, plaintext: string): string;
+/**
+ * Decrypts a stored `v1:` value. Error messages never echo plaintext or
+ * ciphertext: unknown versions throw "unsupported environment value format",
+ * auth-tag mismatches throw "environment value decryption failed".
+ */
+declare function decryptEnvironmentValue(key: Uint8Array, stored: string): string;
+
+/**
+ * Last line of defense against a session event crashing a whole turn.
+ *
+ * Postgres `text`/`jsonb` cannot store a NUL byte (U+0000) nor lone UTF-16
+ * surrogates. Raw exec output routinely carries both -- chrome/crashpad logs,
+ * `cat` of a binary, random bytes -- and the worker persists that output verbatim
+ * inside `agent.toolCall.output` / `sandbox.command.output` event payloads. When
+ * such a payload reaches `INSERT INTO session_events`, the driver rejects it
+ * ("Failed query: insert into session_events") and the turn dies.
+ *
+ * `sanitizeEventPayload` deep-walks any payload value (objects, arrays, nested)
+ * and, for every string, strips NUL and rewrites invalid/lone UTF-16 surrogates
+ * to the Unicode replacement char (U+FFFD), so the result is always valid UTF-8
+ * that jsonb can store. It is cheap and total: only strings are touched, and only
+ * the two disallowed classes of code unit -- no meaningful text is lost, no
+ * truncation (truncation is handled elsewhere).
+ */
+/**
+ * Strip NUL and repair invalid/lone UTF-16 surrogates in a single string.
+ * Returns the input unchanged (same reference) when it is already clean, so the
+ * common case allocates nothing.
+ */
+declare function sanitizeEventString(value: string): string;
+/**
+ * Deep-walk a session event payload and sanitize every string value. Mirrors the
+ * shape of the worker redaction deep-walk: objects, arrays, and nested
+ * combinations are traversed; non-string leaves pass through untouched. Object
+ * keys are sanitized too -- they are jsonb-constrained the same as values.
+ */
+declare function sanitizeEventPayload<T>(payload: T): T;
+
+type ProvisionResult = {
+    appRole: string | null;
+    temporalRole: string | null;
+    temporalDatabases: string[];
+    schema: string;
+    rlsStrategy: RlsStrategy;
+};
+type ProvisionRolesOptions = {
+    /**
+     * The schema OpenGeni's tables live in. The app-role GRANTs target this
+     * schema + `opengeni_private`. Defaults to `public` (standalone).
+     */
+    targetSchema?: string;
+    /**
+     * RLS posture (Step I). `"force"` (default) provisions the non-owner
+     * `opengeni_app` login role and GRANTs it table DML in the target schema —
+     * the role OpenGeni connects as under FORCE-RLS. `"scoped"` SKIPS the app-role
+     * provisioning entirely: the embedded host runs OpenGeni's queries over a role
+     * IT owns/manages (typically the schema owner), so OpenGeni neither creates
+     * nor grants the `opengeni_app` role. Temporal-role provisioning is unaffected
+     * by strategy.
+     */
+    rlsStrategy?: RlsStrategy;
+    appRole?: string;
+    appPassword?: string;
+    temporalRole?: string;
+    temporalPassword?: string;
+    temporalDatabases?: string[];
+};
+/**
+ * SDK entry point (Step I): provision the OpenGeni database roles + grants over
+ * a host-supplied admin connection. This is the named, parameterized form of the
+ * historical env-driven `provision-roles` script (which still works as a CLI via
+ * the `import.meta.main` block at the bottom — it just reads env into these
+ * options).
+ *
+ * STANDALONE (default): `provisionRoles(adminConnection)` with no options →
+ * `targetSchema: "public"`, `rlsStrategy: "force"`, reads `opengeni_app` creds
+ * from env. Byte-for-byte the historical script behavior.
+ *
+ * EMBEDDED: `provisionRoles(adminConnection, { targetSchema, rlsStrategy })` lets
+ * a host provision the app role over a dedicated schema (force) OR skip the
+ * app role entirely and own the connection role itself (scoped).
+ */
+declare function provisionRoles(adminConnection: string, options?: ProvisionRolesOptions): Promise<ProvisionResult>;
+
+type CodexAuthDeps = {
+    loadCredential: typeof loadCodexCredentialForRun;
+    recordRefresh: typeof recordCodexTokenRefresh;
+    setStatus: typeof setCodexCredentialStatus;
+    refresh: typeof refreshCodexToken;
+    encrypt: typeof encryptEnvironmentValue;
+    keyBytes: typeof environmentsEncryptionKeyBytes;
+};
+declare function buildCodexTokenResolver(db: Database, settings: Settings, workspaceId: string, credentialId: string, deps?: CodexAuthDeps): {
+    getToken: () => Promise<CodexTokenSnapshot>;
+    refresh: () => Promise<CodexTokenSnapshot>;
+};
+/**
+ * THE single per-account usage path both the api route and an (optional) worker
+ * poll call, so the refresh discipline and the cache-write can never drift.
+ *
+ *   1. resolve a REFRESHING bearer for THIS account (proactive staleness refresh,
+ *      single-flight, (id,version) CAS-persist) — this is what stops an idle
+ *      account's expired JWT from 401-ing the usage read.
+ *   2. fetch GET /wham/usage with that bearer.
+ *   3. normalize (§3) into the P2/P3 contract.
+ *   4. on any windows present, write the five usage-cache columns (the TTL clock).
+ *
+ * A refresh that stamps needs_relogin returns { status:"error", reason } and never
+ * hits the provider; a transient refresh error returns a plain error payload.
+ */
+declare function fetchCodexUsageForAccount(db: Database, settings: Settings, workspaceId: string, credentialId: string): Promise<CodexUsagePayload>;
+
+type Database = PgDatabase<any, typeof schema>;
+type DbClient = {
+    db: Database;
+    close: () => Promise<void>;
+};
+type RlsContext = {
+    accountId: string;
+    workspaceId?: string | null;
+};
+/**
+ * RLS posture for the connection OpenGeni's query layer runs over (Step I, §7.7).
+ *
+ * - `"force"` (DEFAULT — today's standalone behavior, byte-for-byte): OpenGeni
+ *   connects as a NON-OWNER role (`opengeni_app`) and every table carries
+ *   `FORCE ROW LEVEL SECURITY`, so the workspace/account GUCs set by
+ *   `setRlsContext` are the ONLY thing that admits rows — even the table owner
+ *   is subject to RLS. This is the Fork-A isolation guarantee.
+ * - `"scoped"` (embedded Fork-B opt-in): the host runs OpenGeni's queries over a
+ *   role that OWNS the dedicated schema (RLS need not be forced for that role),
+ *   relying on the host's own tenant boundary. OpenGeni STILL emits the
+ *   `set_config('opengeni.account_id'/'workspace_id', …)` GUCs defensively on
+ *   every scoped query, so the application query path is byte-identical between
+ *   the two strategies and the app code is RLS-mode-agnostic. The strategy is a
+ *   declared posture (consumed by `provisionRoles` and as a documented
+ *   invariant), NOT a query-path branch — there is deliberately no `if
+ *   (strategy === …)` anywhere in the helpers below. Picking `"scoped"` does not
+ *   relax any GUC; it only changes which DB role the host provisions/connects as
+ *   and asserts that the host accepts owning the isolation boundary.
+ */
+type RlsStrategy = "force" | "scoped";
+/**
+ * Resolve a host-IdP/Better-Auth user *identifier* by email. Injected via
+ * `createDb({ userLookup })` (Step I). UNSET → today's raw parameterized select
+ * against Better Auth's `auth_users` table (see `getManagedUserByEmail`), which
+ * relies on the postgres-js array-shaped `db.execute` result. An embedded host
+ * whose identity lives elsewhere (a different IdP table, a different driver, or
+ * a non-`auth_users` user store) injects this closure so OpenGeni never touches
+ * `auth_users` directly. Returns the user id, or null when no such user exists.
+ */
+type UserLookup = (db: Database, email: string) => Promise<string | null>;
+type CreateDbOptions = {
+    /**
+     * The Postgres `search_path` for this connection (Step I, §7.8 runtime half).
+     * UNSET → today's behavior: NO `search_path` startup parameter is sent, so the
+     * server default applies (`public` for standalone, where every table + the
+     * `vector` extension + `gen_random_uuid()` live). For an embedded dedicated
+     * schema, pass e.g. `"opengeni,opengeni_private,public"` — postgres-js sends
+     * it as a per-session startup parameter (the supported, query-param-free way;
+     * URL `?search_path=` is IGNORED by postgres-js). Keep `public` LAST so the
+     * `vector` type and `gen_random_uuid()` (which live in `public` on the
+     * pgvector image) still resolve — the SPIKE-1 live footgun.
+     */
+    searchPath?: string;
+    /** RLS posture; defaults to `"force"` (today's standalone). */
+    rlsStrategy?: RlsStrategy;
+    /** Host-provided user-by-email resolver; unset → today's raw `auth_users` query. */
+    userLookup?: UserLookup;
+    /** postgres-js pool size; defaults to today's `10`. */
+    max?: number;
+};
+/** The strategy bound to a handle (or the `"force"` default). */
+declare function rlsStrategyFor(db: Database): RlsStrategy;
+declare function createDb(databaseUrl: string, options?: CreateDbOptions): DbClient;
+/**
+ * Register a host's `rlsStrategy`/`userLookup` against an externally-constructed
+ * `Database` handle (e.g. one the embedded host built from its own driver and
+ * injected, rather than via `createDb`). Lets the same WeakMap-backed lookups
+ * work for injected handles. Standalone never calls this (it uses `createDb`).
+ */
+declare function registerDbBinding(db: Database, binding: {
+    rlsStrategy?: RlsStrategy;
+    userLookup?: UserLookup;
+}): void;
+declare function setRlsContext(db: Database, context: RlsContext): Promise<void>;
+declare function withRlsContext<T>(db: Database, context: RlsContext, fn: (db: Database) => Promise<T>): Promise<T>;
+declare function rlsContextForWorkspace(db: Database, workspaceId: string): Promise<RlsContext>;
+declare function withWorkspaceRls<T>(db: Database, workspaceId: string, fn: (db: Database) => Promise<T>): Promise<T>;
+declare function withWorkspaceUsageLock<T>(db: Database, workspaceId: string, fn: (db: Database) => Promise<T>): Promise<T>;
+declare function withAccountRls<T>(db: Database, accountId: string, fn: (db: Database) => Promise<T>): Promise<T>;
+declare const allWorkspacePermissions: Permission[];
+declare const allAccountPermissions: Permission[];
+type BootstrapWorkspaceInput = {
+    accountExternalSource: string;
+    accountExternalId: string;
+    accountName: string;
+    workspaceExternalSource: string;
+    workspaceExternalId: string;
+    workspaceName: string;
+    subjectId: string;
+    subjectLabel?: string;
+    accountPermissions?: Permission[];
+    workspacePermissions?: Permission[];
+};
+declare function bootstrapWorkspace(db: Database, input: BootstrapWorkspaceInput): Promise<AccessContext>;
+declare function ensureManagedAccessForUser(db: Database, input: {
+    userId: string;
+    email: string;
+    name: string;
+}): Promise<AccessContext>;
+declare function getWorkspace(db: Database, workspaceId: string): Promise<Workspace | null>;
+declare function getManagedAccount(db: Database, accountId: string): Promise<ManagedAccount | null>;
+declare function requireWorkspace(db: Database, workspaceId: string): Promise<Workspace>;
+declare function listWorkspacesForSubject(db: Database, subjectId: string, limit?: number): Promise<Workspace[]>;
+declare function countWorkspacesForAccount(db: Database, accountId: string): Promise<number>;
+declare function createWorkspace(db: Database, input: {
+    accountId: string;
+    name: string;
+    slug?: string | null;
+    externalSource?: string | null;
+    externalId?: string | null;
+    agentInstructions?: string | null;
+}): Promise<Workspace>;
+declare function grantWorkspaceAccess(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    subjectLabel?: string;
+    role?: string;
+    permissions: Permission[];
+}): Promise<void>;
+declare function updateWorkspace(db: Database, workspaceId: string, input: {
+    name?: string;
+    slug?: string | null;
+    agentInstructions?: string | null;
+}): Promise<Workspace>;
+declare function getWorkspaceGrant(db: Database, subjectId: string, workspaceId: string): Promise<AccessGrant | null>;
+declare function listWorkspaceMembers(db: Database, workspaceId: string): Promise<WorkspaceMember[]>;
+declare function removeWorkspaceMember(db: Database, workspaceId: string, subjectId: string): Promise<boolean>;
+/**
+ * Resolve a managed user email to its user id.
+ *
+ * STANDALONE (default, unchanged): the `auth_users` table is owned by Better
+ * Auth and is NOT in the Drizzle schema, so this runs the raw parameterized
+ * select below — matching emails case-insensitively, returning the id or null.
+ *
+ * EMBEDDED (Step I `userLookup` port): when the handle was built via
+ * `createDb({ userLookup })` (or registered with `registerDbBinding`), this
+ * delegates to the host's resolver instead — so a host whose identity lives in
+ * a different IdP/table/driver never forces OpenGeni to touch `auth_users`. The
+ * raw query also assumes the postgres-js array-shaped `db.execute` result; the
+ * port is the cross-driver escape hatch for that too.
+ *
+ * Used to add an already-registered user to a workspace; email invites for
+ * unknown users are deferred.
+ */
+declare function getManagedUserByEmail(db: Database, email: string): Promise<string | null>;
+declare function deleteWorkspace(db: Database, workspaceId: string): Promise<void>;
+declare function createApiKey(db: Database, input: {
+    accountId: string;
+    workspaceId?: string | null;
+    name: string;
+    prefix: string;
+    keyHash: string;
+    permissions: Permission[];
+    expiresAt?: Date | null;
+}): Promise<ApiKey>;
+declare function listApiKeys(db: Database, workspaceId: string): Promise<ApiKey[]>;
+declare function countActiveApiKeysForWorkspace(db: Database, workspaceId: string): Promise<number>;
+declare function revokeApiKey(db: Database, workspaceId: string, apiKeyId: string): Promise<ApiKey>;
+declare function findActiveApiKeyByHash(db: Database, keyHash: string): Promise<ApiKey | null>;
+type GitHubInstallation = {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    installationId: number;
+    accountLogin: string | null;
+    accountType: string | null;
+    createdAt: string;
+    updatedAt: string;
+};
+declare function upsertGitHubInstallation(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    installationId: number;
+    accountLogin?: string | null;
+    accountType?: string | null;
+}): Promise<GitHubInstallation>;
+declare function listGitHubInstallationsForWorkspace(db: Database, workspaceId: string): Promise<GitHubInstallation[]>;
+declare function listGitHubInstallationIdsForWorkspace(db: Database, workspaceId: string): Promise<number[]>;
+declare function recordUsageEvent(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    subjectId?: string | null;
+    eventType: string;
+    quantity: number;
+    unit: string;
+    sourceResourceType?: string | null;
+    sourceResourceId?: string | null;
+    idempotencyKey: string;
+    occurredAt?: Date;
+}): Promise<UsageEvent>;
+declare function listUsageEvents(db: Database, input: {
+    accountId: string;
+    workspaceId?: string;
+    limit?: number;
+}): Promise<UsageEvent[]>;
+declare function sumUsageQuantity(db: Database, input: {
+    accountId?: string;
+    workspaceId?: string;
+    eventType: string;
+    since?: Date;
+}): Promise<number>;
+declare function applyCreditLedgerEntry(db: Database, input: {
+    accountId: string;
+    workspaceId?: string | null;
+    type: string;
+    amountMicros: number;
+    sourceType?: string | null;
+    sourceId?: string | null;
+    idempotencyKey: string;
+    metadata?: Record<string, unknown>;
+    occurredAt?: Date;
+}): Promise<BillingBalance>;
+declare function applyCreditDebitUpToBalance(db: Database, input: {
+    accountId: string;
+    workspaceId?: string | null;
+    type: string;
+    requestedAmountMicros: number;
+    sourceType?: string | null;
+    sourceId?: string | null;
+    idempotencyKey: string;
+    metadata?: Record<string, unknown>;
+    occurredAt?: Date;
+}): Promise<{
+    balance: BillingBalance;
+    debitedMicros: number;
+}>;
+declare function hasCreditLedgerEntry(db: Database, accountId: string, idempotencyKey: string): Promise<boolean>;
+declare function getBillingCustomer(db: Database, accountId: string, provider?: string): Promise<{
+    accountId: string;
+    provider: string;
+    providerCustomerId: string;
+    email: string | null;
+} | null>;
+declare function upsertBillingCustomer(db: Database, input: {
+    accountId: string;
+    provider?: string;
+    providerCustomerId: string;
+    email?: string | null;
+}): Promise<void>;
+declare function recordStripeWebhookEvent(db: Database, input: {
+    id: string;
+    type: string;
+    livemode: boolean;
+    payload: unknown;
+}): Promise<boolean>;
+declare function isStripeWebhookProcessed(db: Database, id: string): Promise<boolean>;
+declare function markStripeWebhookProcessed(db: Database, id: string): Promise<void>;
+declare function getBillingBalance(db: Database, accountId: string): Promise<BillingBalance>;
+declare function countScheduledTasksForWorkspace(db: Database, workspaceId: string): Promise<number>;
+type AppendEventInput = {
+    type: SessionEventType;
+    payload?: unknown;
+    clientEventId?: string;
+    turnId?: string | null;
+    producerId?: string;
+    producerSeq?: number;
+    occurredAt?: Date;
+};
+type CreateScheduledTaskInput = {
+    id?: string;
+    accountId: string;
+    workspaceId: string;
+    name: string;
+    status: ScheduledTaskStatus;
+    schedule: ScheduledTaskScheduleSpec;
+    temporalScheduleId: string;
+    runMode: ScheduledTaskRunMode;
+    overlapPolicy: ScheduledTaskOverlapPolicy;
+    agentConfig: ScheduledTaskAgentConfig;
+    environmentId?: string | null;
+    metadata: Record<string, unknown>;
+};
+type UpdateScheduledTaskInput = Partial<{
+    name: string;
+    status: ScheduledTaskStatus;
+    schedule: ScheduledTaskScheduleSpec;
+    runMode: ScheduledTaskRunMode;
+    overlapPolicy: ScheduledTaskOverlapPolicy;
+    agentConfig: ScheduledTaskAgentConfig;
+    reusableSessionId: string | null;
+    environmentId: string | null;
+    metadata: Record<string, unknown>;
+}>;
+type CreatePackInstallationInput = {
+    accountId: string;
+    workspaceId: string;
+    packId: string;
+    metadata?: Record<string, unknown>;
+};
+type RegisterWorkspacePackInput = {
+    accountId: string;
+    workspaceId: string;
+    pack: CapabilityPack;
+};
+type CreateSocialConnectionInput = {
+    accountId: string;
+    workspaceId: string;
+    provider: SocialProvider;
+    accountHandle: string;
+    accountName?: string | null;
+    externalAccountId?: string | null;
+    status: SocialConnectionStatus;
+    scopes?: string[];
+    credentialRef?: string | null;
+    tokenMetadata?: Record<string, unknown>;
+    metadata?: Record<string, unknown>;
+};
+type CreateSocialPostInput = {
+    accountId: string;
+    workspaceId: string;
+    connectionId: string;
+    externalPostId?: string | null;
+    url?: string | null;
+    authorHandle?: string | null;
+    text: string;
+    publishedAt: Date;
+    metrics?: Record<string, number>;
+    raw?: Record<string, unknown>;
+};
+type CreateCapabilityCatalogItemInput = {
+    accountId: string;
+    workspaceId: string;
+    id: string;
+    kind: Exclude<CapabilityKind, "pack">;
+    source: CapabilitySource;
+    name: string;
+    description?: string | null;
+    category?: string;
+    tags?: string[];
+    homepageUrl?: string | null;
+    endpointUrl?: string | null;
+    installUrl?: string | null;
+    authModel?: string | null;
+    metadata?: Record<string, unknown>;
+};
+type EnableCapabilityInstallationInput = {
+    accountId: string;
+    workspaceId: string;
+    capabilityId: string;
+    kind: CapabilityKind;
+    config?: Record<string, unknown>;
+    metadata?: Record<string, unknown>;
+};
+type EnabledMcpCapabilityServer = {
+    capabilityId: string;
+    id: string;
+    name: string;
+    url: string;
+    allowedTools?: string[];
+    timeoutMs?: number;
+    cacheToolsList?: boolean;
+    /**
+     * Credential request headers stored encrypted at enable time
+     * (AES-256-GCM under the workspace-environments key). Decrypted only at
+     * the runtime boundary that builds the MCP client; never exposed by the
+     * capability API surface.
+     */
+    headersEncrypted?: Record<string, string>;
+};
+type EnqueueSessionTurnInput = {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    triggerEventId: string;
+    temporalWorkflowId: string;
+    source: SessionTurnSource;
+    prompt: string;
+    resources: ResourceRef[];
+    tools: ToolRef[];
+    model: string;
+    reasoningEffort: ReasoningEffort;
+    sandboxBackend: SandboxBackend;
+    metadata: Record<string, unknown>;
+};
+type UpdateQueuedSessionTurnInput = Partial<{
+    prompt: string;
+    resources: ResourceRef[];
+    tools: ToolRef[];
+    model: string;
+    reasoningEffort: ReasoningEffort;
+    sandboxBackend: SandboxBackend;
+    metadata: Record<string, unknown>;
+}>;
+declare function createFileUpload(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    fileId: string;
+    filename: string;
+    safeFilename: string;
+    contentType: string;
+    sizeBytes: number;
+    sha256?: string | null;
+    bucket: string;
+    objectKey: string;
+    expiresAt: Date;
+}): Promise<{
+    file: FileAsset;
+    uploadId: string;
+    expiresAt: string;
+}>;
+declare function getFile(db: Database, workspaceId: string, fileId: string): Promise<FileAsset | null>;
+declare function requireFile(db: Database, workspaceId: string, fileId: string): Promise<FileAsset>;
+declare function getFileUpload(db: Database, workspaceId: string, uploadId: string): Promise<{
+    id: string;
+    status: FileUploadStatus;
+    expiresAt: Date;
+    file: FileAsset;
+} | null>;
+declare function completeFileUpload(db: Database, workspaceId: string, uploadId: string): Promise<FileAsset>;
+declare function markFileUploadFailed(db: Database, workspaceId: string, uploadId: string, fileId: string): Promise<void>;
+declare function enablePackInstallation(db: Database, input: CreatePackInstallationInput): Promise<PackInstallation>;
+declare function listPackInstallations(db: Database, workspaceId: string): Promise<PackInstallation[]>;
+declare function getPackInstallation(db: Database, workspaceId: string, packId: string): Promise<PackInstallation | null>;
+declare function updatePackInstallationStatus(db: Database, workspaceId: string, packId: string, status: PackInstallationStatus): Promise<PackInstallation>;
+declare function registerWorkspacePack(db: Database, input: RegisterWorkspacePackInput): Promise<{
+    pack: WorkspaceRegisteredPack;
+    created: boolean;
+}>;
+declare function listWorkspacePacks(db: Database, workspaceId: string): Promise<WorkspaceRegisteredPack[]>;
+declare function getWorkspacePack(db: Database, workspaceId: string, packId: string): Promise<WorkspaceRegisteredPack | null>;
+declare function deleteWorkspacePack(db: Database, workspaceId: string, packId: string): Promise<boolean>;
+declare function upsertCapabilityCatalogItem(db: Database, input: CreateCapabilityCatalogItemInput): Promise<CapabilityCatalogItem>;
+declare function listCapabilityCatalogItems(db: Database, workspaceId: string): Promise<CapabilityCatalogItem[]>;
+declare function getCapabilityCatalogItem(db: Database, workspaceId: string, capabilityId: string): Promise<CapabilityCatalogItem | null>;
+declare function enableCapabilityInstallation(db: Database, input: EnableCapabilityInstallationInput): Promise<CapabilityInstallation>;
+declare function disableCapabilityInstallation(db: Database, workspaceId: string, capabilityId: string): Promise<CapabilityInstallation>;
+declare function listCapabilityInstallations(db: Database, workspaceId: string): Promise<CapabilityInstallation[]>;
+declare function getCapabilityInstallation(db: Database, workspaceId: string, capabilityId: string): Promise<CapabilityInstallation | null>;
+declare function listEnabledMcpCapabilityServers(db: Database, workspaceId: string): Promise<EnabledMcpCapabilityServer[]>;
+/**
+ * Decrypts an enabled capability MCP's stored credential headers. Returns
+ * null when the server has none, and "unavailable" when headers exist but
+ * cannot be recovered (missing key or failed decryption) — in which case the
+ * server must be skipped rather than connected without credentials.
+ */
+declare function decryptedCapabilityHeaders(server: EnabledMcpCapabilityServer, encryptionKey: Uint8Array | null): Record<string, string> | null | "unavailable";
+/**
+ * Returns the encrypted credential-header map stored on a capability
+ * installation, or null when none is stored. This is the only read path for
+ * the ciphertext besides listEnabledMcpCapabilityServers; the generic
+ * installation mapping redacts it to header names.
+ */
+declare function getStoredCapabilityHeaderCiphertext(db: Database, workspaceId: string, capabilityId: string): Promise<Record<string, string> | null>;
+declare function mcpServerIdForCapability(capabilityId: string, metadata?: Record<string, unknown>): string;
+declare function createSocialConnection(db: Database, input: CreateSocialConnectionInput): Promise<SocialConnection>;
+declare function listSocialConnections(db: Database, workspaceId: string, limit?: number): Promise<SocialConnection[]>;
+declare function getSocialConnection(db: Database, workspaceId: string, connectionId: string): Promise<SocialConnection | null>;
+declare function requireSocialConnection(db: Database, workspaceId: string, connectionId: string): Promise<SocialConnection>;
+declare function createSocialPost(db: Database, input: CreateSocialPostInput): Promise<SocialPost>;
+declare function listSocialPosts(db: Database, options: {
+    workspaceId: string;
+    connectionIds?: string[];
+    since?: Date;
+    limit?: number;
+}): Promise<SocialPost[]>;
+declare function createScheduledTask(db: Database, input: CreateScheduledTaskInput): Promise<ScheduledTask>;
+declare function updateScheduledTask(db: Database, workspaceId: string, taskId: string, input: UpdateScheduledTaskInput): Promise<ScheduledTask>;
+declare function getScheduledTask(db: Database, workspaceId: string, taskId: string): Promise<ScheduledTask | null>;
+declare function requireScheduledTask(db: Database, workspaceId: string, taskId: string): Promise<ScheduledTask>;
+declare function listScheduledTasks(db: Database, workspaceId: string, limit?: number): Promise<ScheduledTask[]>;
+declare function deleteScheduledTask(db: Database, workspaceId: string, taskId: string): Promise<void>;
+declare function createScheduledTaskRun(db: Database, input: {
+    workspaceId: string;
+    taskId: string;
+    triggerType: ScheduledTaskTriggerType;
+    scheduledAt?: Date | null;
+    firedAt?: Date;
+}): Promise<ScheduledTaskRun>;
+declare function updateScheduledTaskRun(db: Database, workspaceId: string, runId: string, input: Partial<{
+    status: ScheduledTaskRunStatus;
+    sessionId: string | null;
+    triggerEventId: string | null;
+    error: string | null;
+}>): Promise<ScheduledTaskRun>;
+declare function listScheduledTaskRuns(db: Database, workspaceId: string, taskId: string, limit?: number): Promise<ScheduledTaskRun[]>;
+declare function createWorkspaceEnvironment(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    name: string;
+    description?: string | null;
+    variables?: Array<{
+        name: string;
+        valueEncrypted: string;
+    }>;
+}): Promise<WorkspaceEnvironment>;
+declare function listWorkspaceEnvironments(db: Database, workspaceId: string): Promise<WorkspaceEnvironment[]>;
+declare function getWorkspaceEnvironment(db: Database, workspaceId: string, environmentId: string): Promise<WorkspaceEnvironment | null>;
+declare function getWorkspaceEnvironmentByName(db: Database, workspaceId: string, name: string): Promise<WorkspaceEnvironment | null>;
+declare function updateWorkspaceEnvironment(db: Database, workspaceId: string, environmentId: string, input: {
+    name?: string;
+    description?: string | null;
+}): Promise<WorkspaceEnvironment>;
+declare function deleteWorkspaceEnvironment(db: Database, workspaceId: string, environmentId: string): Promise<boolean>;
+declare function countWorkspaceEnvironments(db: Database, workspaceId: string): Promise<number>;
+declare function countScheduledTasksUsingEnvironment(db: Database, workspaceId: string, environmentId: string): Promise<number>;
+declare function countActiveSessionsUsingEnvironment(db: Database, workspaceId: string, environmentId: string): Promise<number>;
+declare function setWorkspaceEnvironmentVariable(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    environmentId: string;
+    name: string;
+    valueEncrypted: string;
+}): Promise<WorkspaceEnvironmentVariableMetadata>;
+declare function deleteWorkspaceEnvironmentVariable(db: Database, workspaceId: string, environmentId: string, name: string): Promise<boolean>;
+/**
+ * The ONLY helper that selects value_encrypted. Used exclusively by the worker
+ * activity that materializes a sandbox for a run whose session carries an
+ * environment attachment. Do not call from API routes: values are write-only.
+ */
+declare function getWorkspaceEnvironmentValuesForRun(db: Database, workspaceId: string, environmentId: string): Promise<{
+    environment: {
+        id: string;
+        name: string;
+        description: string | null;
+    };
+    values: Record<string, string>;
+} | null>;
+type WorkspaceEnvironmentForRun = {
+    id: string;
+    name: string;
+    description: string | null;
+    values: Record<string, string>;
+};
+/**
+ * Load and decrypt the workspace environment attached to a run's session. SHARED
+ * by the worker TURN path (apps/worker agent-turn) AND the API-direct ATTACH paths
+ * (viewer / Channel-A / desktop / terminal) so a box first warmed by an attach is
+ * created with the SAME decrypted workspace-environment values the turn declares —
+ * the box-manifest env must match the agent-manifest env or the SDK's
+ * `validateNoEnvironmentDelta` throws when the agent injects its manifest into the
+ * resumed non-owned box.
+ *
+ * `environmentId === null` is the unattached path: zero DB work and behavior
+ * byte-identical to deployments without this feature. Attached runs fail closed: a
+ * missing key or a deleted environment throws (names/ids only in messages) instead
+ * of silently running without the secrets the run expects.
+ */
+declare function loadWorkspaceEnvironmentForRun(db: Database, settings: Settings, workspaceId: string, environmentId: string | null): Promise<WorkspaceEnvironmentForRun | null>;
+type CodexCredentialTokens = {
+    accessToken: string;
+    refreshToken: string;
+    idToken: string;
+};
+type CodexCredentialForRun = {
+    id: string;
+    version: number;
+    workspaceId: string;
+    tokens: CodexCredentialTokens;
+    chatgptAccountId: string | null;
+    scopes: string | null;
+    planType: string | null;
+    isFedramp: boolean;
+    expiresAt: Date | null;
+    lastRefreshAt: Date | null;
+    status: string;
+    lastError: string | null;
+};
+/**
+ * Login / rotation write (multi-account P1). Caller passes the PRE-encrypted
+ * credential blob. Keyed on the composite partial index (workspace, chatgpt
+ * account): re-connecting the SAME ChatGPT account updates that row in place
+ * (re-asserts account_id, bumps version); connecting a NEW account inserts a new
+ * row. Returns the row id + whether it was newly inserted. The route — not this
+ * accessor — auto-activates a brand-new first account and ensures the
+ * rotation-settings row exists.
+ */
+declare function upsertCodexSubscriptionCredential(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    credentialEncrypted: string;
+    chatgptAccountId: string | null;
+    scopes: string | null;
+    planType: string | null;
+    isFedramp: boolean;
+    expiresAt: Date | null;
+    lastRefreshAt: Date | null;
+    accountEmail?: string | null;
+    label?: string | null;
+}): Promise<{
+    id: string;
+    isNew: boolean;
+}>;
+/**
+ * The ONLY decrypt-read accessor. Fails closed. Never call from an API route that
+ * returns the result.
+ *
+ * The run's account is the resolved pin-or-active credential id, not LIMIT 1: the
+ * caller (worker) resolves the effective credential id and passes it here so a
+ * pinned session loads its SPECIFIC account. RLS still constrains the row to the
+ * workspace; an unknown/disconnected id returns null → the caller treats it as
+ * "needs relogin / re-pick".
+ */
+declare function loadCodexCredentialForRun(db: Database, settings: Settings, workspaceId: string, credentialId: string): Promise<CodexCredentialForRun | null>;
+/**
+ * Persist rotated tokens after a successful refresh. Caller pre-encrypts.
+ *
+ * COMPARE-AND-SET (P1-c): the write is guarded by the (id, version) the resolver
+ * loaded. If a disconnect→reconnect replaced/rotated the row between the load and
+ * this write, the guard matches 0 rows and we DO NOT clobber the freshly
+ * reconnected credential with tokens from the now-defunct family. Returns true
+ * iff the guarded row was updated; false means "credential changed under me —
+ * the rotation is moot, drop it."
+ */
+declare function recordCodexTokenRefresh(db: Database, input: {
+    id: string;
+    version: number;
+    workspaceId: string;
+    credentialEncrypted: string;
+    expiresAt: Date | null;
+    lastRefreshAt: Date;
+}): Promise<boolean>;
+/**
+ * Surface a permanent or transient failure on a SPECIFIC credential row.
+ *
+ * COMPARE-AND-SET (P1-c): the status is stamped only if the row STILL matches the
+ * (id, version) the resolver loaded. This stops a refresh that began before a
+ * disconnect→reconnect (or a manual account switch) from stamping `needs_relogin`
+ * on the brand-new, good credential — with N accounts per workspace a
+ * workspace-wide write would be flat-out wrong (it would scribble on every
+ * account). Returns true iff the guarded row was updated.
+ */
+declare function setCodexCredentialStatus(db: Database, workspaceId: string, status: "active" | "needs_relogin" | "error", lastError: string | null, target: {
+    id: string;
+    version: number;
+}): Promise<boolean>;
+/**
+ * Metadata-only read for API routes, repointed to the per-workspace ACTIVE
+ * credential. NEVER selects credential_encrypted.
+ *
+ * Reads codex_rotation_settings.active_credential_id and joins the credential by
+ * id (deterministic). If the pointer is NULL but credentials exist (the
+ * mid-disconnect window), it falls back to the most-recently-connected row and
+ * lazily repairs the pointer so the next read is deterministic. The returned
+ * `credentialId` is the active row's id (null when no credential exists at all).
+ */
+declare function getCodexCredentialStatus(db: Database, workspaceId: string): Promise<{
+    connected: boolean;
+    credentialId: string | null;
+    chatgptAccountId: string | null;
+    scopes: string | null;
+    planType: string | null;
+    status: string;
+    expiresAt: Date | null;
+    lastRefreshAt: Date | null;
+    lastError: string | null;
+} | null>;
+/**
+ * Single source of truth for "this workspace has an ACTIVE ChatGPT/Codex
+ * subscription connected AND the feature is enabled for this deployment."
+ *
+ * This is the SAME condition `settingsWithCodexCredential` (worker) uses to
+ * decide whether to inject the synthetic codex-subscription provider, so billing
+ * and provider-injection cannot drift. Metadata-only read (never the secret).
+ */
+declare function workspaceCodexSubscriptionActive(db: Database, settings: Pick<Settings, "codexSubscriptionEnabled">, workspaceId: string): Promise<boolean>;
+/**
+ * CANONICAL "is this a Codex-billed turn?" predicate.
+ *
+ * True iff: the turn's model is a `codex/<slug>` id (`isCodexBilledModel`) AND
+ * the deployment flag is on AND the workspace has an ACTIVE credential. A true
+ * result means the turn is paid by the USER's ChatGPT/Codex plan and MUST consume
+ * ZERO OpenGeni credits: callers skip the credit-balance / model-cost / token
+ * gates and skip OpenGeni pricing + credit debit.
+ *
+ * The prefix ALONE never returns true: an unconnected user typing `codex/...`
+ * gets the normal gates (and the worker fails the turn for a missing credential),
+ * so there is no free/uncapped-run bypass.
+ */
+declare function isCodexBilledTurn(input: {
+    db: Database;
+    settings: Pick<Settings, "codexSubscriptionEnabled">;
+    workspaceId: string;
+    model: string | null | undefined;
+    /**
+     * Precomputed `workspaceCodexSubscriptionActive` result (P2-b). When the caller
+     * already resolved the active flag for provider injection, pass it here so the
+     * billed-turn predicate and the routing overlay read the credential ONCE and
+     * cannot disagree across a concurrent disconnect/reconnect — a drift that would
+     * either wrongly debit OpenGeni credits for a ChatGPT-paid turn or the inverse.
+     */
+    active?: boolean;
+}): Promise<boolean>;
+type CodexAccountStatus = {
+    id: string;
+    chatgptAccountId: string | null;
+    label: string | null;
+    accountEmail: string | null;
+    planType: string | null;
+    status: string;
+    isActive: boolean;
+    expiresAt: Date | null;
+    lastRefreshAt: Date | null;
+    lastError: string | null;
+    primaryUsedPercent: number | null;
+    primaryResetAt: Date | null;
+    secondaryUsedPercent: number | null;
+    secondaryResetAt: Date | null;
+    usageCheckedAt: Date | null;
+    exhaustedUntil: Date | null;
+    connectorNamespaces: string[] | null;
+    connectorsCheckedAt: Date | null;
+};
+/**
+ * Metadata-only list of every connected Codex account in the workspace, for the
+ * accounts UI + the worker's selection resolver. NEVER decrypts. `isActive` marks
+ * the workspace active pointer. Ordered by created_at ASC (stable list order).
+ */
+declare function listCodexAccountStatuses(db: Database, workspaceId: string): Promise<CodexAccountStatus[]>;
+/** The P2 usage-cache snapshot written by the refreshing usage wrapper. */
+type CodexAccountUsageSnapshot = {
+    primaryUsedPercent: number | null;
+    primaryResetAt: Date | null;
+    secondaryUsedPercent: number | null;
+    secondaryResetAt: Date | null;
+    checkedAt: Date;
+};
+/**
+ * Cache-write for P2 quota bars: persist the five plaintext usage columns on a
+ * SPECIFIC credential row. NEVER touches credential_encrypted. RLS-scoped, guarded
+ * by (id, workspace_id) so it can only write a row the workspace owns. Returns true
+ * iff a row was updated (false ⇒ the credential was disconnected under us — the
+ * snapshot is moot, drop it). This is the only writer of the usage_checked_at TTL
+ * clock that `listCodexAccountStatuses` reads back.
+ */
+declare function recordCodexAccountUsage(db: Database, workspaceId: string, credentialId: string, snapshot: CodexAccountUsageSnapshot): Promise<boolean>;
+type CodexRotationSettings = {
+    activeCredentialId: string | null;
+    rotationEnabled: boolean;
+    rotationStrategy: string;
+};
+/** The per-workspace rotation/active-pointer row (null when none exists yet). */
+declare function getCodexRotationSettings(db: Database, workspaceId: string): Promise<CodexRotationSettings | null>;
+/** Idempotently ensure the per-workspace rotation-settings row exists. */
+declare function ensureCodexRotationSettings(db: Database, accountId: string, workspaceId: string): Promise<void>;
+/**
+ * THE manual-switch primitive (workspace scope). Validates the credential id
+ * belongs to the workspace, then one-cell UPDATEs active_credential_id. Returns
+ * false if the id is unknown (so the route can 404).
+ */
+declare function setActiveCodexCredential(db: Database, workspaceId: string, credentialId: string): Promise<boolean>;
+/**
+ * P3 rotation cooldown writer: stamp `exhausted_until` on a SPECIFIC credential row so the
+ * rotation engine treats it as cooling-down (capped) until `until`. Pass `until = null` to
+ * clear the cooldown. Modeled EXACTLY on recordCodexAccountUsage: RLS-scoped, guarded by
+ * (id, workspace_id), and — critically — NO `version` bump and NO `updatedAt` touch, so it can
+ * never race the (id, version) token-refresh CAS in recordCodexTokenRefresh / setCodexCredentialStatus.
+ * Returns true iff a row was updated (false ⇒ the credential was disconnected under us).
+ */
+declare function setCodexCredentialExhausted(db: Database, workspaceId: string, credentialId: string, until: Date | null): Promise<boolean>;
+/**
+ * P3 reactive-rotation boundedness (Finding 1b): the number of CONSECUTIVE rotated
+ * 429-failover turns since the session last had a SUCCESSFUL turn. Counts
+ * `turn.failed` events carrying the `rotated` marker that occurred AFTER the most
+ * recent `turn.completed` event (the natural reset anchor — any successful turn
+ * moves the anchor past every prior failover, so the streak resets to 0). The
+ * reactive 429 catch consults this to bound its otherwise-0-delay re-dispatch:
+ * once the streak exceeds ~(connected accounts + margin) the path degrades to a
+ * fixed positive idle instead of another hot re-dispatch (invariant 4: NO THRASH),
+ * covering the double-fault where a cooldown write did not persist AND the 429
+ * carried no usage headers. Derived from persisted events so it is correct across
+ * the Temporal re-dispatch (each failover is a NEW turn, but its event survives).
+ */
+declare function countConsecutiveReactiveRotations(db: Database, workspaceId: string, sessionId: string): Promise<number>;
+/**
+ * P4 connector-set cache writer: persist the set of ORIGINAL-dotted connector
+ * namespaces a SPECIFIC credential exposes via codex_apps (+ the freshness clock).
+ * Modeled byte-for-byte on recordCodexAccountUsage / setCodexCredentialExhausted:
+ * RLS-scoped, guarded by (id, workspace_id), and — critically — NO `version` bump and
+ * NO `updatedAt` touch, so it can never race the (id, version) token-refresh CAS.
+ *
+ * The CALLER must only invoke this with a NON-EMPTY set: codex_apps connects
+ * best-effort (a transient failure yields an empty tools/list), and overwriting a
+ * known non-empty set with [] would falsely "drop" coverage on a flaky turn. A
+ * genuinely connector-less account stays null (the ranker treats null as unknown).
+ * Returns true iff a row was updated (false ⇒ the credential was disconnected under us).
+ */
+declare function recordCodexAccountConnectors(db: Database, workspaceId: string, credentialId: string, namespaces: string[]): Promise<boolean>;
+/** The supported rotation strategies (P3). */
+declare const CODEX_ROTATION_STRATEGIES: readonly ["most_remaining", "round_robin", "drain_then_next"];
+type CodexRotationStrategy = (typeof CODEX_ROTATION_STRATEGIES)[number];
+/**
+ * P3 rotation-settings write path: one-cell UPDATE of `rotation_enabled` and/or
+ * `rotation_strategy` on the per-workspace row. Validates the strategy enum (rejects unknown).
+ * Guarded by workspaceId; ensureCodexRotationSettings guarantees the row exists. Returns the
+ * effective settings after the patch (null when no row exists yet — caller should ensure first).
+ */
+declare function updateCodexRotationSettings(db: Database, workspaceId: string, patch: {
+    rotationEnabled?: boolean;
+    rotationStrategy?: CodexRotationStrategy;
+}): Promise<CodexRotationSettings | null>;
+/** P1 rename (label only); P3 widens to rotation fields. */
+declare function renameCodexAccount(db: Database, workspaceId: string, credentialId: string, label: string | null): Promise<boolean>;
+type SessionCodexState = {
+    pinnedCredentialId: string | null;
+    lastCredentialId: string | null;
+};
+/** The session's pin + last-ran-on Codex account (drives the worker resolver + indicator). */
+declare function getSessionCodexState(db: Database, workspaceId: string, sessionId: string): Promise<SessionCodexState | null>;
+/**
+ * Per-session pin (manual override). pinnedCredentialId === null clears the pin
+ * (follow the workspace active). Validates the id belongs to the workspace when
+ * non-null. Returns false if the session is unknown or the id is invalid.
+ */
+declare function setSessionCodexPin(db: Database, workspaceId: string, sessionId: string, pinnedCredentialId: string | null): Promise<boolean>;
+/** Written by the worker at the turn boundary; drives the in-session indicator. */
+declare function recordSessionActiveCodexCredential(db: Database, workspaceId: string, sessionId: string, credentialId: string): Promise<void>;
+/**
+ * Disconnect ONE account. DELETE WHERE id = credentialId AND workspace_id. If it
+ * was the active pointer, the FK ON DELETE SET NULL clears it; this fn then
+ * re-picks the most-recently-connected remaining account as active, atomically in
+ * the same RLS txn. Returns whether a row was removed + the new active id.
+ */
+declare function disconnectCodexAccount(db: Database, workspaceId: string, credentialId: string): Promise<{
+    removed: boolean;
+    newActiveCredentialId: string | null;
+}>;
+/** Legacy "disconnect all" (old workspace-wide behavior). Returns rows removed. */
+declare function disconnectAllCodexAccounts(db: Database, workspaceId: string): Promise<number>;
+declare function recordAuditEvent(db: Database, input: {
+    accountId: string;
+    workspaceId?: string | null;
+    subjectId?: string | null;
+    action: string;
+    targetType?: string | null;
+    targetId?: string | null;
+    metadata?: Record<string, unknown>;
+}): Promise<void>;
+declare function createSession(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    initialMessage: string;
+    resources: ResourceRef[];
+    tools?: ToolRef[];
+    metadata: Record<string, unknown>;
+    model: string;
+    sandboxBackend: SandboxBackend;
+    environmentId?: string | null;
+    firstPartyMcpPermissions?: Permission[] | null;
+    parentSessionId?: string | null;
+    createIdempotencyKey?: string | null;
+    sandboxGroupId?: string | null;
+    sandboxOs?: SandboxOs;
+}): Promise<Session>;
+/**
+ * Inserts a session under a workspace-scoped CREATE idempotency key, collapsing
+ * a concurrent race on the same key to a single row. On the unique-violation
+ * the conflicting insert does nothing (`onConflictDoNothing` on the partial
+ * unique index) and the now-existing winning row is fetched and returned, so
+ * two near-simultaneous creates with the same key yield ONE session and both
+ * callers see the same id. `created` distinguishes the winner (true: this call
+ * inserted and must run the rest of the start flow) from the loser/dup (false:
+ * the row already existed and must be returned as-is).
+ */
+declare function createSessionWithIdempotencyKey(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    initialMessage: string;
+    resources: ResourceRef[];
+    tools?: ToolRef[];
+    metadata: Record<string, unknown>;
+    model: string;
+    sandboxBackend: SandboxBackend;
+    environmentId?: string | null;
+    firstPartyMcpPermissions?: Permission[] | null;
+    parentSessionId?: string | null;
+    createIdempotencyKey: string;
+    sandboxGroupId?: string | null;
+    sandboxOs?: SandboxOs;
+}): Promise<{
+    session: Session;
+    created: boolean;
+}>;
+declare function getSessionByCreateIdempotencyKey(db: Database, workspaceId: string, createIdempotencyKey: string): Promise<Session | null>;
+declare function getSession(db: Database, workspaceId: string, sessionId: string): Promise<Session | null>;
+/**
+ * Resolve ANY session that belongs to a shared-sandbox group (addendum 05 §D.3,
+ * stress (e)). Used by the create-session `sandbox:{groupId}` join path to (1)
+ * prove the group exists and (2) inherit its box's (backend, os).
+ *
+ * `workspaceId` is a MANDATORY access boundary, NOT optional: the group uuid is
+ * caller-supplied, so the workspace filter (inside RLS) is what forbids a
+ * cross-workspace join — a foreign group returns null → the caller 404s. The
+ * group uuid itself is never an authorization boundary. Returns the first member
+ * session (any one suffices to read the shared box's backend/os); null when the
+ * group has no session in this workspace.
+ */
+declare function getAnySessionInGroup(db: Database, workspaceId: string, sandboxGroupId: string): Promise<Session | null>;
+/**
+ * The DISTINCT environmentIds across a group's member sessions (workspace-
+ * scoped; null = no environment attached). The env-aware create check compares
+ * a joiner against EVERY member — an arbitrary single member (getAnySessionInGroup)
+ * makes the compatibility verdict nondeterministic for legacy env-blind groups
+ * whose members carry mixed environmentIds.
+ */
+declare function listDistinctEnvironmentIdsInGroup(db: Database, workspaceId: string, sandboxGroupId: string): Promise<Array<string | null>>;
+declare function listSessions(db: Database, workspaceId: string, limit?: number): Promise<Session[]>;
+/**
+ * Count sessions still attached to a live Temporal workflow: queued, running,
+ * or awaiting an approval (requires_action). idle has no running execution and
+ * failed/cancelled are terminal, so neither blocks a workspace delete. The
+ * delete path uses this to refuse (409) while a session could still be running
+ * in Temporal, since there is no clean session-terminate to call first.
+ */
+declare function countActiveSessionsForWorkspace(db: Database, workspaceId: string): Promise<number>;
+declare function requireSession(db: Database, workspaceId: string, sessionId: string): Promise<Session>;
+declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string, after?: number, limit?: number): Promise<SessionEvent[]>;
+declare function getSessionEvent(db: Database, workspaceId: string, eventId: string): Promise<SessionEvent | null>;
+declare function getLatestRunState(db: Database, workspaceId: string, sessionId: string): Promise<{
+    id: string;
+    serializedRunState: string;
+    pendingApprovals: unknown[];
+    frozenCodexCredentialId: string | null;
+} | null>;
+/**
+ * Append conversation items (verbatim SDK AgentInputItems) to the session's
+ * history. Idempotent on (workspace, session, position): concurrent or
+ * repeated writers (streaming writes + turn-end reconciliation) converge
+ * instead of duplicating.
+ */
+declare function appendSessionHistoryItems(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId?: string | null;
+    producerCodexCredentialId?: string | null;
+    items: Array<{
+        position: number;
+        item: Record<string, unknown>;
+    }>;
+}): Promise<void>;
+declare function getSessionHistoryItems(db: Database, workspaceId: string, sessionId: string): Promise<Array<{
+    position: number;
+    item: Record<string, unknown>;
+}>>;
+/**
+ * The LIVE conversation-truth read path: only active rows, position-ordered.
+ * After a client-side context compaction this returns [active summary,
+ * ...active recent tail]; with no compaction yet it equals
+ * getSessionHistoryItems. The model-facing read path uses this so superseded
+ * (summarized-away) prefix rows are excluded while the full transcript stays in
+ * the table as an audit trail.
+ */
+declare function getActiveSessionHistoryItems(db: Database, workspaceId: string, sessionId: string): Promise<Array<{
+    position: number;
+    item: Record<string, unknown>;
+    producerCodexCredentialId: string | null;
+}>>;
+/**
+ * Count of ACTIVE (live, model-facing) history rows for a session. This is the
+ * length of the history the next turn is seeded from — the dual-write slice
+ * index — which after a compaction is far smaller than the total persisted-row
+ * count (countSessionHistoryItems still includes the superseded prefix).
+ */
+declare function countActiveSessionHistoryItems(db: Database, workspaceId: string, sessionId: string): Promise<number>;
+/**
+ * Pure TypeScript SPEC for the one-time orphan repair (migration 0014),
+ * mirroring its SQL WHERE clause so the deletion rule is unit-testable without a
+ * database. Given the ACTIVE history rows of a single session in position order,
+ * returns the indices of the orphaned tool-call RESULT rows the repair deletes.
+ *
+ * An orphan is a result-type row (function_call_result / computer_call_result /
+ * shell_call_output / apply_patch_call_output) with no matching CALL of the
+ * paired type, same correlation id (camelCase `callId` OR snake_case `call_id`),
+ * at a STRICTLY EARLIER position in the same session. This is exactly the
+ * session-bricking row the Responses API 400s on ("No tool call found for
+ * function call output").
+ *
+ * DANGLING CALLS (a call with no result yet) are intentionally NOT returned: a
+ * call awaiting a not-yet-settled result is valid, not corruption. Only unpaired
+ * results are removed.
+ *
+ * EXISTENCE, not consumption: like the migration's `NOT EXISTS (... earlier
+ * call ...)`, a result is kept whenever ANY earlier matching call exists. A
+ * second result that re-uses a call_id already settled earlier is therefore NOT
+ * flagged here (a matching call still exists before it) — this conservative
+ * choice matches the SQL exactly and never deletes a row whose call is present;
+ * the read-path sanitizer (which consumes calls one-for-one) still drops such a
+ * rare duplicate in-memory, so the model request stays valid regardless.
+ *
+ * Callers pass rows already ordered by position. The earlier-position test is
+ * by array order (the SQL orders by the numeric position column, which the read
+ * path also orders by), so identical inputs yield identical decisions.
+ */
+declare function orphanedResultRowIndicesForRepair(activeRowsInPositionOrder: ReadonlyArray<{
+    item: Record<string, unknown>;
+}>): number[];
+/**
+ * Apply a client-side context compaction as an atomic, audit-preserving write:
+ *
+ *  - supersede (set active=false) every active row whose position lies in
+ *    [0, boundaryPosition) — i.e. the summarized prefix — EXCLUDING the tail.
+ *    Rows are never deleted.
+ *  - insert ONE active synthetic summary row at `summaryPosition` (a FRACTIONAL
+ *    position — boundaryPosition - 0.5 — that sorts immediately before the kept
+ *    tail and collides with NO existing row, so no real prefix row is ever
+ *    overwritten). Idempotent on position: a retry that finds the summary row
+ *    already there does not duplicate it (it only re-activates the existing
+ *    summary row at that fractional position) and — crucially — never mutates
+ *    the real row at boundaryPosition - 1.
+ *
+ * The caller computes the boundary from the orphan-safe planner so no tool-call
+ * pair straddles the cut. `summaryPosition` must be < boundaryPosition (between
+ * the last superseded prefix row and the kept tail), guaranteeing it sorts
+ * before the tail. Because positions are whole numbers and summaries are
+ * half-steps, the summary's fractional position can never equal a real row.
+ */
+declare function applyContextCompaction(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId?: string | null;
+    /** Active prefix rows with position < boundaryPosition get superseded. */
+    boundaryPosition: number;
+    /** Fractional position for the new summary row (must be < boundaryPosition). */
+    summaryPosition: number;
+    summaryItem: Record<string, unknown>;
+}): Promise<void>;
+/**
+ * The next free WHOLE-NUMBER history position for a session: one past the
+ * largest existing position (active or superseded), floored so the synthetic
+ * summary's fractional half-step never shifts the count. The dual-write
+ * watermark uses this to append new rows at fresh absolute positions, decoupled
+ * from the in-memory history length (which, after a compaction, is far shorter
+ * than the total persisted-row count and so cannot serve as the next position).
+ */
+declare function nextSessionHistoryPosition(db: Database, workspaceId: string, sessionId: string): Promise<number>;
+/**
+ * Record the actual input-token count of the most recent turn's final model
+ * call, for the next turn's pre-read compaction trigger.
+ */
+declare function setSessionLastInputTokens(db: Database, workspaceId: string, sessionId: string, lastInputTokens: number): Promise<void>;
+/**
+ * The neutral marker written by clearSessionContext as the sole active history
+ * row. It keeps getActiveSessionHistoryItems().length > 0 so the items read
+ * path (run-input.ts messageInput) stays selected and never falls through to
+ * the getLatestRunState blob — that fallback is the resurrection vector a clear
+ * must defeat. A plain user message is a valid, sanitizer-clean item.
+ */
+declare function clearedContextMarkerItem(): Record<string, unknown>;
+/**
+ * The sentinel serializedRunState written by clearSessionContext, re-exported
+ * from @opengeni/contracts so the writer (here) and the readers (run-input /
+ * runtime) share one definition. It is audit-honest (carries no prior
+ * conversation) and is NOT a real Agents-SDK run state — it has no
+ * `$schemaVersion`/history, so `RunState.fromString` throws on it.
+ *
+ * Both run-state read paths therefore guard against it explicitly via
+ * {@link isClearedRunStateBlob}:
+ *  - the message path (run-input messageInput) honors it in BOTH items and
+ *    run_state history modes — in items mode the boundary marker keeps the
+ *    active read non-empty so the blob is never reached, and in run_state mode
+ *    the sentinel is recognized and treated as a fresh empty start;
+ *  - the approval path is additionally refused by the API for mid-turn /
+ *    requires_action sessions, so it never sees the sentinel.
+ * Stored so getLatestRunState (the run_state-source read path) reflects the
+ * clear instead of resurrecting the pre-clear blob.
+ */
+declare const CLEARED_RUN_STATE: string;
+type ClearSessionContextResult = {
+    /** Active history rows superseded (active=true -> false). */
+    supersededItems: number;
+    /** Position of the inserted neutral boundary marker. */
+    markerPosition: number;
+    /** stateVersion of the fresh cleared run-state row. */
+    runStateVersion: number;
+};
+/**
+ * Clear a session's conversation context in ONE transaction, audit-preserving
+ * and idempotent. Defeats the RunState-fallback resurrection on BOTH model read
+ * paths:
+ *
+ *  (a) supersede every active session_history_items row (active=true -> false).
+ *      Nothing is deleted — the full transcript stays as an audit trail, same
+ *      pattern as applyContextCompaction.
+ *  (b) insert ONE active neutral boundary marker at max(position)+1 so the
+ *      active read path returns length 1 (not 0) and run-input.ts stays on the
+ *      items route, away from the getLatestRunState blob (the bug).
+ *  (c) insert a fresh agent_run_states row (stateVersion = max+1) with an empty
+ *      cleared blob and pendingApprovals:[], so getLatestRunState (approval /
+ *      run_state-source read path) also reflects the clear.
+ *
+ * Also resets last_input_tokens to 0 so the next turn's compaction trigger
+ * starts fresh against the now-short context.
+ *
+ * Idempotent: a re-run supersedes the (now sole, already-marker) active row,
+ * inserts another marker at the next position, and another cleared run-state.
+ * The post-conditions (one active marker row, latest run-state cleared) hold.
+ */
+declare function clearSessionContext(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+}): Promise<ClearSessionContextResult>;
+declare function countSessionHistoryItems(db: Database, workspaceId: string, sessionId: string): Promise<number>;
+/**
+ * Set the operator /compact request flag. The worker honors it before the next
+ * turn (forced client-side compaction) and clears it. Idempotent: repeated
+ * requests collapse to one pending compaction.
+ */
+declare function requestSessionCompaction(db: Database, workspaceId: string, sessionId: string): Promise<void>;
+/**
+ * Atomically consume the /compact request flag: clear it and report whether it
+ * was set. The worker calls this pre-turn; only the call that observed `true`
+ * runs the forced compaction, so concurrent turns can't double-compact.
+ */
+declare function consumeSessionCompactionRequest(db: Database, workspaceId: string, sessionId: string): Promise<boolean>;
+/**
+ * Number of conversation-truth items a specific turn persisted. The
+ * worker-death requeue path uses this to decide whether the re-dispatched
+ * turn must enter through a resume notice (its partial progress is already
+ * part of conversation truth, so replaying the original trigger would hand
+ * the model duplicate input) or can replay its original trigger cleanly.
+ */
+declare function countTurnSessionHistoryItems(db: Database, workspaceId: string, turnId: string): Promise<number>;
+/**
+ * Persist the session's sandbox recovery descriptor (the small versioned
+ * envelope used to reattach / snapshot-restore / rebuild the sandbox),
+ * decoupled from the RunState blob.
+ */
+declare function upsertSandboxSessionEnvelope(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    envelope: Record<string, unknown>;
+}): Promise<void>;
+declare function getSandboxSessionEnvelope(db: Database, workspaceId: string, sessionId: string): Promise<Record<string, unknown> | null>;
+type SessionRecordingState = (typeof sessionRecordingStateValues)[number];
+type SessionRecordingMode = (typeof sessionRecordingModeValues)[number];
+type SessionRecordingCodec = (typeof sessionRecordingCodecValues)[number];
+type SessionRecordingRow = {
+    id: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId: string | null;
+    state: SessionRecordingState;
+    mode: SessionRecordingMode;
+    codec: SessionRecordingCodec;
+    storageKey: string | null;
+    sizeBytes: number | null;
+    durationSeconds: number | null;
+    width: number;
+    height: number;
+    reason: string | null;
+    createdAt: Date;
+    finalizedAt: Date | null;
+};
+declare function insertRecording(db: Database, input: {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId?: string | null;
+    mode: SessionRecordingMode;
+    codec: SessionRecordingCodec;
+    width: number;
+    height: number;
+    reason?: string | null;
+}): Promise<SessionRecordingRow>;
+declare function updateRecording(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    recordingId: string;
+    state: SessionRecordingState;
+    storageKey?: string | null;
+    sizeBytes?: number | null;
+    durationSeconds?: number | null;
+    reason?: string | null;
+    finalized?: boolean;
+}): Promise<SessionRecordingRow | null>;
+/**
+ * Hard-delete a recording row. Used to DISCARD an on-turn recording that captured
+ * NO computer-use activity (a plain text turn): the row was inserted at
+ * `beginRecording` (state "recording") but the turn never drove the desktop, so it
+ * is removed entirely rather than surfaced as a phantom recording or a failure. No
+ * other table FK-references session_recordings, so the delete is self-contained.
+ */
+declare function deleteRecording(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    recordingId: string;
+}): Promise<void>;
+declare function getRecording(db: Database, workspaceId: string, recordingId: string): Promise<SessionRecordingRow | null>;
+declare function listRecordings(db: Database, workspaceId: string, sessionId: string): Promise<SessionRecordingRow[]>;
+type SandboxPtySessionRow = {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    execSessionId: number | null;
+    leaseEpoch: number;
+    cols: number;
+    rows: number;
+    shell: string;
+    cwd: string;
+    status: "open" | "closed";
+    openedBy: string;
+    lastInputAt: string;
+    createdAt: string;
+    closedAt: string | null;
+};
+declare function insertPtySession(db: Database, input: {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    execSessionId?: number | null;
+    leaseEpoch: number;
+    cols: number;
+    rows: number;
+    shell: string;
+    cwd: string;
+    openedBy: string;
+}): Promise<SandboxPtySessionRow>;
+/** Read an OPEN PTY row by ptyId. Returns null when absent or already closed. */
+declare function getOpenPtySession(db: Database, workspaceId: string, ptyId: string): Promise<SandboxPtySessionRow | null>;
+/** Stamp the SDK exec-session id (known only after the open exec yields a still-
+ *  running process) + refresh the input-activity TTL. */
+declare function updatePtySessionActivity(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    ptyId: string;
+    execSessionId?: number | null;
+    cols?: number;
+    rows?: number;
+}): Promise<SandboxPtySessionRow | null>;
+/** Mark a PTY closed (idempotent — a double close on a closed row is a no-op). */
+declare function closePtySession(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    ptyId: string;
+}): Promise<SandboxPtySessionRow | null>;
+/** List a session's OPEN PTYs (reattach + reap). */
+declare function listOpenPtySessions(db: Database, workspaceId: string, sessionId: string): Promise<SandboxPtySessionRow[]>;
+type SandboxLeaseLiveness = "cold" | "warming" | "warm" | "draining";
+type LeaseHolderKind = "turn" | "viewer";
+interface LeaseSnapshot {
+    id: string;
+    sandboxGroupId: string;
+    liveness: SandboxLeaseLiveness;
+    refcount: number;
+    turnHolders: number;
+    viewerHolders: number;
+    instanceId: string | null;
+    backend: string;
+    os: string;
+    image: string | null;
+    dataPlaneUrl: string | null;
+    terminalDataPlaneUrl: string | null;
+    leaseEpoch: number;
+    resumeBackendId: string | null;
+    resumeState: Record<string, unknown> | null;
+    expiresAt: Date;
+}
+interface AcquireLeaseInput {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    kind: LeaseHolderKind;
+    holderId: string;
+    subjectId?: string | null;
+    backend: string;
+    os?: string;
+    image?: string | null;
+    leaseTtlMs: number;
+    expectedEpoch?: number;
+}
+type AcquireLeaseResult = {
+    role: "spawner";
+    lease: LeaseSnapshot;
+} | {
+    role: "attached";
+    lease: LeaseSnapshot;
+} | {
+    role: "rearmed";
+    lease: LeaseSnapshot;
+} | {
+    role: "fenced";
+    lease: LeaseSnapshot;
+};
+declare class SandboxLeaseSupersededError extends Error {
+    readonly sandboxGroupId: string;
+    readonly leaseEpoch: number;
+    constructor(sandboxGroupId: string, leaseEpoch: number);
+}
+declare class SandboxImageConflictError extends Error {
+    readonly sandboxGroupId: string;
+    readonly currentImage: string;
+    readonly requestedImage: string;
+    constructor(sandboxGroupId: string, currentImage: string, requestedImage: string);
+}
+declare function acquireLease(db: Database, input: AcquireLeaseInput): Promise<AcquireLeaseResult>;
+declare function commitWarmingToWarm(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    expectedEpoch: number;
+    instanceId: string;
+    dataPlaneUrl?: string | null;
+    resumeBackendId?: string | null;
+    resumeState?: Record<string, unknown> | null;
+    leaseTtlMs: number;
+}): Promise<{
+    committed: boolean;
+    lease: LeaseSnapshot | null;
+}>;
+declare function failWarmingToCold(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    expectedEpoch: number;
+}): Promise<void>;
+declare function releaseLeaseHolder(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    kind: LeaseHolderKind;
+    holderId: string;
+    idleGraceMs: number;
+}): Promise<{
+    liveness: SandboxLeaseLiveness;
+    refcount: number;
+} | null>;
+declare function heartbeatLeaseHolder(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    kind: LeaseHolderKind;
+    holderId: string;
+    leaseTtlMs: number;
+    expectedEpoch: number;
+}): Promise<boolean>;
+interface ReapDrainable {
+    workspaceId: string;
+    sandboxGroupId: string;
+    instanceId: string | null;
+    leaseEpoch: number;
+}
+declare function reapStaleLeaseHolders(db: Database, input: {
+    workspaceId: string;
+    viewerHolderTtlMs: number;
+    idleGraceMs: number;
+}): Promise<{
+    reapedViewers: number;
+    warmingReset: number;
+    drained: ReapDrainable[];
+}>;
+declare function reapStaleLeaseHoldersGlobal(db: Database, input: {
+    viewerHolderTtlMs: number;
+    idleGraceMs: number;
+}): Promise<ReapDrainable[]>;
+interface MeterableWarmLease {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    leaseEpoch: number;
+    backend: string;
+}
+declare function listMeterableWarmLeases(db: Database): Promise<MeterableWarmLease[]>;
+declare function reArmDrainingLease(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    leaseTtlMs: number;
+}): Promise<{
+    rearmed: boolean;
+}>;
+declare function confirmDrainCold(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    expectedEpoch: number;
+}): Promise<{
+    wentCold: boolean;
+}>;
+declare function persistDrainSnapshot(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    expectedEpoch: number;
+    /** base64 of the provider snapshot-ref / tar archive from persistWorkspace().
+     *  Pass null to CAS-check without writing (for backends with no persistWorkspace). */
+    workspaceArchive: string | null;
+}): Promise<{
+    wrote: boolean;
+    priorArchive: string | null;
+}>;
+declare function readLease(db: Database, workspaceId: string, sandboxGroupId: string): Promise<LeaseSnapshot | null>;
+declare function recordLeaseDataPlaneUrl(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    expectedEpoch: number;
+    dataPlaneUrl: string | null;
+}): Promise<LeaseSnapshot | null>;
+declare function recordLeaseTerminalDataPlaneUrl(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    expectedEpoch: number;
+    terminalDataPlaneUrl: string | null;
+}): Promise<LeaseSnapshot | null>;
+type SandboxKind = (typeof sandboxKindValues)[number];
+type EnrollmentExposure = (typeof enrollmentExposureValues)[number];
+type EnrollmentStatus = (typeof enrollmentStatusValues)[number];
+type EnrollmentOs = (typeof enrollmentOsValues)[number];
+type EnrollmentRecord = {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    pubkey: string;
+    exposure: EnrollmentExposure;
+    hasDisplay: boolean;
+    allowScreenControl: boolean;
+    status: EnrollmentStatus;
+    os: EnrollmentOs;
+    arch: string;
+    lastSeenAt: string | null;
+    createdAt: string;
+    revokedAt: string | null;
+    updatedAt: string;
+};
+type SandboxRecord = {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    kind: SandboxKind;
+    name: string;
+    enrollmentId: string | null;
+    createdAt: string;
+    updatedAt: string;
+};
+declare function createEnrollment(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    pubkey: string;
+    exposure?: EnrollmentExposure;
+    hasDisplay?: boolean;
+    allowScreenControl?: boolean;
+    os?: EnrollmentOs;
+    arch?: string;
+}): Promise<EnrollmentRecord>;
+declare function getEnrollment(db: Database, workspaceId: string, enrollmentId: string): Promise<EnrollmentRecord | null>;
+declare function listEnrollments(db: Database, workspaceId: string, options?: {
+    status?: EnrollmentStatus;
+}): Promise<EnrollmentRecord[]>;
+declare function revokeEnrollment(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    enrollmentId: string;
+}): Promise<{
+    revoked: boolean;
+}>;
+declare function touchEnrollmentLastSeen(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    enrollmentId: string;
+}): Promise<void>;
+declare function setEnrollmentHasDisplay(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    enrollmentId: string;
+    hasDisplay: boolean;
+}): Promise<{
+    updated: boolean;
+}>;
+type DeviceEnrollmentStatus = (typeof deviceEnrollmentStatusValues)[number];
+type DeviceEnrollmentRequestRecord = {
+    id: string;
+    deviceCode: string;
+    userCode: string;
+    accountId: string;
+    workspaceId: string;
+    pubkey: string;
+    os: EnrollmentOs;
+    arch: string;
+    machineName: string | null;
+    requestedExposure: EnrollmentExposure;
+    canOfferDisplay: boolean;
+    requestsScreenControl: boolean;
+    status: DeviceEnrollmentStatus;
+    approvedBySubjectId: string | null;
+    approvedBySubjectLabel: string | null;
+    allowScreenControl: boolean;
+    approvedAt: string | null;
+    enrollmentId: string | null;
+    sandboxId: string | null;
+    expiresAt: string;
+    createdAt: string;
+    updatedAt: string;
+};
+declare function createDeviceEnrollmentRequest(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    deviceCode: string;
+    userCode: string;
+    pubkey: string;
+    os?: EnrollmentOs;
+    arch?: string;
+    machineName?: string | null;
+    requestedExposure?: EnrollmentExposure;
+    canOfferDisplay?: boolean;
+    requestsScreenControl?: boolean;
+    expiresAt: Date;
+}): Promise<DeviceEnrollmentRequestRecord>;
+declare function getDeviceEnrollmentRequestByDeviceCode(db: Database, deviceCode: string): Promise<DeviceEnrollmentRequestRecord | null>;
+declare function getPendingDeviceEnrollmentRequestByUserCode(db: Database, workspaceId: string, userCode: string): Promise<DeviceEnrollmentRequestRecord | null>;
+declare function getPendingDeviceEnrollmentRequestByUserCodeGlobal(db: Database, userCode: string): Promise<DeviceEnrollmentRequestRecord | null>;
+declare function finalizeEnrollmentByToken(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    pubkey: string;
+    hasDisplay: boolean;
+    allowScreenControl: boolean;
+    os: EnrollmentOs;
+    arch: string;
+    sandboxName: string;
+    now?: Date;
+}): Promise<{
+    enrollment: EnrollmentRecord;
+    sandbox: SandboxRecord;
+}>;
+declare function approveDeviceEnrollmentRequest(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    requestId: string;
+    allowScreenControl: boolean;
+    approvedBySubjectId: string;
+    approvedBySubjectLabel?: string | null;
+    sandboxName: string;
+    now?: Date;
+}): Promise<{
+    approved: boolean;
+    enrollment: EnrollmentRecord | null;
+    sandbox: SandboxRecord | null;
+}>;
+declare function denyDeviceEnrollmentRequest(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    requestId: string;
+}): Promise<{
+    denied: boolean;
+}>;
+declare function consumeDeviceEnrollmentRequest(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    requestId: string;
+}): Promise<{
+    consumed: boolean;
+}>;
+declare function createSandbox(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    kind: SandboxKind;
+    name: string;
+    enrollmentId?: string | null;
+}): Promise<SandboxRecord>;
+declare function getSandbox(db: Database, workspaceId: string, sandboxId: string): Promise<SandboxRecord | null>;
+declare function listSandboxes(db: Database, workspaceId: string): Promise<SandboxRecord[]>;
+type ActiveSandboxPointer = {
+    activeSandboxId: string | null;
+    activeEpoch: number;
+    workingDir: string | null;
+};
+declare function readActiveSandbox(db: Database, workspaceId: string, sessionId: string): Promise<ActiveSandboxPointer | null>;
+declare function setActiveSandbox(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    targetSandboxId: string | null;
+    expectedEpoch: number;
+    workingDir?: string | null;
+}): Promise<{
+    swapped: boolean;
+    pointer: ActiveSandboxPointer | null;
+}>;
+type MachineMetricsSample = {
+    cpuPercent?: number | null;
+    load1?: number | null;
+    load5?: number | null;
+    load15?: number | null;
+    memUsedBytes?: number | null;
+    memTotalBytes?: number | null;
+    diskUsedBytes?: number | null;
+    diskTotalBytes?: number | null;
+    gpuUtilPercent?: number | null;
+    gpuMemUsedBytes?: number | null;
+    gpuMemTotalBytes?: number | null;
+    contention?: number | null;
+    sampledAt: Date;
+};
+declare function upsertMachineMetricsLatest(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    enrollmentId: string;
+    sample: MachineMetricsSample;
+}): Promise<void>;
+declare function insertMachineMetricsSeries(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    enrollmentId: string;
+    sample: MachineMetricsSample;
+}): Promise<void>;
+declare const MACHINE_METRICS_SERIES_INTERVAL_MS = 60000;
+/**
+ * Ingest ONE sampled metrics point for an enrollment (the M10 ingestion seam):
+ *   1. UPSERT machine_metrics_latest (the "now" row, one per enrollment) — always.
+ *   2. APPEND a machine_metrics_series row only when >= ~1/min has elapsed since
+ *      the last series row (downsample) — so the 5s heartbeat cadence does not
+ *      flood the history table.
+ * Both happen under the same RLS context. Returns whether a series row was
+ * appended (the downsample decision) so the caller / tests can assert the ~1/min
+ * spacing. A null/absent `sampledAt` on the prior row treats it as "no prior" →
+ * append.
+ */
+declare function ingestMachineMetricsSample(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    enrollmentId: string;
+    sample: MachineMetricsSample;
+    /** Override the downsample interval (tests). Defaults to ~1/min. */
+    seriesIntervalMs?: number;
+}): Promise<{
+    latestUpserted: true;
+    seriesAppended: boolean;
+}>;
+type MachineMetricsRow = {
+    enrollmentId: string;
+    cpuPercent: number | null;
+    load1: number | null;
+    load5: number | null;
+    load15: number | null;
+    memUsedBytes: number | null;
+    memTotalBytes: number | null;
+    diskUsedBytes: number | null;
+    diskTotalBytes: number | null;
+    gpuUtilPercent: number | null;
+    gpuMemUsedBytes: number | null;
+    gpuMemTotalBytes: number | null;
+    contention: number | null;
+    sampledAt: string;
+};
+declare function readMachineMetricsLatest(db: Database, workspaceId: string, enrollmentId: string): Promise<MachineMetricsRow | null>;
+declare function readMachineMetricsLatestForWorkspace(db: Database, workspaceId: string): Promise<Map<string, MachineMetricsRow>>;
+declare function readMachineMetricsSeries(db: Database, input: {
+    workspaceId: string;
+    enrollmentId: string;
+    since: Date;
+    limit?: number;
+}): Promise<MachineMetricsRow[]>;
+interface StreamAcknowledgment {
+    acknowledgedUnredacted: boolean;
+    acknowledgedShared: boolean;
+}
+declare function recordStreamAcknowledgment(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    subjectId: string;
+    acknowledgeUnredacted: boolean;
+    acknowledgeShared: boolean;
+}): Promise<StreamAcknowledgment>;
+declare function getStreamAcknowledgment(db: Database, input: {
+    workspaceId: string;
+    sandboxGroupId: string;
+    subjectId: string;
+}): Promise<StreamAcknowledgment | null>;
+declare function listSessionIdsInGroup(db: Database, workspaceId: string, sandboxGroupId: string): Promise<string[]>;
+declare function revokeViewer(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    viewerId: string;
+    idleGraceMs: number;
+}): Promise<{
+    liveness: SandboxLeaseLiveness;
+    refcount: number;
+} | null>;
+interface AccrueWarmSecondsResult {
+    /** false when nothing was accrued (epoch fenced / not warm / no elapsed / the
+     *  first tick that only seeds the cursor). */
+    accrued: boolean;
+    /** Whole seconds metered this tick (0 when accrued:false). */
+    seconds: number;
+    /** The monotonic tick index this accrual was recorded under. */
+    tick: number;
+    /** usd_micros charged for this tick (0 when rate is 0). */
+    costMicros: number;
+}
+/**
+ * Accrue warm-seconds for the elapsed wall-clock since the lease's last meter
+ * cursor, idempotent on (sandbox_group_id, lease_epoch, tick). EPOCH-FENCED +
+ * liveness-guarded (warm only): a stale-epoch tick or a draining/cold lease is a
+ * no-op, so a superseded writer that re-fires cannot mis-meter. The FIRST tick on
+ * a never-metered lease (last_meter_at IS NULL) only SEEDS the cursor — it
+ * accrues nothing (there is no prior cursor to diff against), matching the
+ * "delta since last tick" contract. warmRateMicrosPerSecond > 0 also records a
+ * sandbox.warm_cost event (cost = seconds x rate) AND debits the same micros from
+ * the credit balance via applyCreditDebitUpToBalance (the model-cost precedent),
+ * idempotent on the SAME (group, epoch, tick) key. The usage event is the
+ * REQUESTED cost; the ledger is the ACTUAL debit (they legitimately differ when
+ * balance is low — M2). Set debitCredits:false to meter without debiting.
+ */
+declare function accrueWarmSeconds(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    /** The epoch the tick observed; the fence — a stale writer no-ops. */
+    expectedEpoch: number;
+    /** usd_micros per warm-second for this box's backend (0 = meter only, no cost). */
+    warmRateMicrosPerSecond: number;
+    /** Optional attribution: the founding/observing session (visibility only — the
+     *  group meter key makes the workspace charge correct regardless). */
+    subjectId?: string | null;
+    /** Debit credits for warm-cost (default true). The force-drain at 0 balance
+     *  depends on this decrementing the balance. */
+    debitCredits?: boolean;
+}): Promise<AccrueWarmSecondsResult>;
+interface ForceDrainResult {
+    /** Whether the workspace was over a limit (0 balance or over the warm cap). */
+    overLimit: boolean;
+    /** The reason, for observability. */
+    reason: "balance" | "warm_cap" | null;
+    /** The (workspaceId, sandboxGroupId) viewer-only boxes CASed warm->draining. */
+    drained: {
+        workspaceId: string;
+        sandboxGroupId: string;
+    }[];
+}
+declare function forceDrainOverLimitViewerOnlyBoxes(db: Database, input: {
+    workspaceId: string;
+    /** account balance gate: when <= 0 (and a billing/managed mode is on) drain. */
+    balanceMicros: number;
+    enforceBalance: boolean;
+    /** warm-second cap (cumulative this UTC month). 0 = unbounded (no cap gate). */
+    maxWarmSecondsPerWorkspace: number;
+    /** start of the cap window (caller passes startOfUtcMonth() so the fn stays
+     *  time-source-agnostic for tests). */
+    capWindowStart?: Date;
+    /** drain-grace horizon stamped on the newly-draining rows (matches the reaper). */
+    idleGraceMs: number;
+}): Promise<ForceDrainResult>;
+declare function saveRunState(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    turnId?: string | null;
+    serializedRunState: string;
+    pendingApprovals: unknown[];
+    frozenCodexCredentialId?: string | null;
+}): Promise<void>;
+type CreateSessionGoalInput = {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    text: string;
+    successCriteria?: string | null;
+    maxAutoContinuations?: number | null;
+    createdBy: SessionGoalCreatedBy;
+};
+declare function createSessionGoal(db: Database, input: CreateSessionGoalInput): Promise<SessionGoal>;
+declare function getSessionGoal(db: Database, workspaceId: string, sessionId: string): Promise<SessionGoal | null>;
+/**
+ * goal_set semantics: insert, or replace the existing goal in place. A replace
+ * re-activates the goal (even when paused or completed), bumps the version,
+ * and resets the continuation counters — re-stating the objective re-arms the
+ * auto-continuation budget.
+ */
+declare function upsertSessionGoal(db: Database, input: CreateSessionGoalInput): Promise<{
+    goal: SessionGoal;
+    replaced: boolean;
+}>;
+/**
+ * goal_update semantics: revise text/criteria without changing status. The
+ * version bump counts as progress for the no-progress detector.
+ */
+declare function updateSessionGoal(db: Database, workspaceId: string, sessionId: string, input: {
+    text?: string;
+    successCriteria?: string | null;
+}): Promise<SessionGoal>;
+/**
+ * Sets a session's display title. The clobber guard lives entirely in this
+ * single atomic UPDATE: a user-set title is permanent, so agent/auto writes
+ * carry an `AND title_source IS DISTINCT FROM 'user'` guard (NULL-safe in
+ * Postgres) while user writes are unconditional. Never read-modify-write.
+ * Returns `{ updated, title }`: `updated` is false when an agent write was
+ * skipped because a user title already pinned the session, true otherwise;
+ * `title` is the resulting title (null when skipped).
+ */
+declare function updateSessionTitle(db: Database, input: {
+    workspaceId: string;
+    sessionId: string;
+    title: string;
+    source: "user" | "agent";
+}): Promise<{
+    updated: boolean;
+    title: string | null;
+}>;
+/**
+ * Status transition helper. Idempotent: requesting the current status returns
+ * `changed: false` so callers can skip emitting a duplicate event. `completed`
+ * is terminal for transitions; only `upsertSessionGoal` can replace a
+ * completed goal. Resuming to `active` clears the pause fields and resets the
+ * continuation counters.
+ */
+declare function setSessionGoalStatus(db: Database, workspaceId: string, sessionId: string, input: {
+    status: SessionGoalStatus;
+    evidence?: string;
+    rationale?: string;
+    pausedReason?: string;
+}): Promise<{
+    goal: SessionGoal;
+    changed: boolean;
+}>;
+declare function setSessionGoalLastContinuationTurn(db: Database, workspaceId: string, sessionId: string, turnId: string): Promise<void>;
+type GoalContinuationDecision = {
+    decision: "none";
+} | {
+    decision: "queue";
+} | {
+    decision: "paused";
+    reason: "no_progress" | "max_auto_continuations" | "limits";
+    goal: SessionGoal;
+} | {
+    decision: "continue";
+    goal: SessionGoal;
+    autoContinuation: number;
+    cap: number | null;
+};
+/**
+ * Core continuation decision, taken in one transaction with the goal row
+ * locked. Queued work always wins; any non-terminal turn (queued, running, or
+ * requires_action awaiting a human approval) blocks auto-continuation. The
+ * no-progress and max-continuation guards mutate counters here only, so a
+ * replaying workflow re-reads recorded activity results and never recomputes
+ * them.
+ */
+declare function evaluateGoalContinuation(db: Database, input: {
+    workspaceId: string;
+    sessionId: string;
+    defaultMaxAutoContinuations?: number | null;
+    noProgressLimit: number;
+    budgetBlocked?: string | null;
+}): Promise<GoalContinuationDecision>;
+declare function createTurn(db: Database, input: {
+    workspaceId: string;
+    sessionId: string;
+    triggerEventId: string;
+    temporalWorkflowId: string;
+}): Promise<string>;
+declare function enqueueSessionTurn(db: Database, input: EnqueueSessionTurnInput): Promise<SessionTurn>;
+declare function claimNextQueuedTurn(db: Database, workspaceId: string, sessionId: string, workflowId: string): Promise<SessionTurn | null>;
+declare function setSessionStatus(db: Database, workspaceId: string, sessionId: string, status: SessionStatus, activeTurnId?: string | null): Promise<void>;
+type WakeParentForChildCompletionInput = {
+    workspaceId: string;
+    parentSessionId: string;
+    clientEventId: string;
+    text: string;
+    childCompletion: Record<string, unknown>;
+    reasoningEffortFallback: ReasoningEffort;
+};
+type WakeParentForChildCompletionResult = {
+    delivered: false;
+    reason: "already_delivered" | "parent_cancelled";
+} | {
+    delivered: true;
+    turn: SessionTurn;
+    triggerEvent: SessionEvent;
+    events: SessionEvent[];
+    temporalWorkflowId: string;
+};
+/**
+ * Deliver a one-shot completion wake from a spawned worker into its parent
+ * (manager) session: append a system-authored `user.message`, transition the
+ * parent idle/failed -> queued (a queued/running parent already has a turn in
+ * flight and keeps it), and enqueue the resulting turn. The whole thing runs
+ * under the parent's row lock in one transaction, and is idempotent on
+ * `clientEventId`: a duplicate call for the same terminal episode (activity
+ * retry, the workflow's idle re-check) is a no-op that enqueues no second
+ * turn. The caller publishes the returned events and signals the parent's
+ * Temporal workflow (signalWithStart) only when `delivered` is true.
+ *
+ * Mirrors `acceptSessionUserMessage`/`postUserMessageTurn` in the API domain:
+ * cancelled is the one parent state that refuses the wake (an explicit stop);
+ * failed stays revivable, matching the revivable-failed-sessions contract.
+ */
+declare function wakeParentSessionForChildCompletion(db: Database, input: WakeParentForChildCompletionInput): Promise<WakeParentForChildCompletionResult>;
+declare function setTemporalWorkflowId(db: Database, workspaceId: string, sessionId: string, workflowId: string): Promise<void>;
+declare function finishTurn(db: Database, workspaceId: string, turnId: string, status: SessionStatus | SessionTurnStatus): Promise<void>;
+/**
+ * Put a preempted (worker shutdown mid-flight) turn back on the session
+ * queue so the workflow's next claim re-dispatches it on a healthy worker.
+ * The trigger event is swapped when the resumed attempt should enter
+ * through a synthesized resume notice instead of replaying the original
+ * trigger (the original input is already part of persisted conversation
+ * truth by then). Keeping the original position lets the resumed turn run
+ * before any turns queued behind it. Accepts `running` turns and
+ * `requires_action` turns: an approval rerun re-dispatches the same turn
+ * without a fresh claim, so the row still carries the approval-wait status
+ * while the rerun activity executes.
+ */
+declare function requeuePreemptedTurn(db: Database, workspaceId: string, turnId: string, triggerEventId: string): Promise<void>;
+/**
+ * Bump the per-turn worker-death redispatch counter and return the new value.
+ * Stored in the turn row's metadata (not workflow-local state) so the
+ * crash-loop guard is replay-safe: the count survives workflow replay, worker
+ * restarts, and even a session-workflow re-run, and the increment is a single
+ * atomic statement.
+ */
+declare function incrementTurnWorkerDeathRedispatches(db: Database, workspaceId: string, turnId: string): Promise<number>;
+declare function getSessionTurn(db: Database, workspaceId: string, turnId: string): Promise<SessionTurn | null>;
+declare function listSessionTurns(db: Database, workspaceId: string, sessionId: string, limit?: number): Promise<SessionTurn[]>;
+declare function updateQueuedSessionTurn(db: Database, workspaceId: string, turnId: string, input: UpdateQueuedSessionTurnInput): Promise<SessionTurn>;
+declare function cancelQueuedSessionTurn(db: Database, workspaceId: string, turnId: string): Promise<SessionTurn>;
+declare function reorderQueuedSessionTurns(db: Database, workspaceId: string, sessionId: string, turnIds: string[]): Promise<SessionTurn[]>;
+declare function appendSessionEvents(db: Database, workspaceId: string, sessionId: string, inputs: AppendEventInput[]): Promise<SessionEvent[]>;
+declare function appendSessionEventsAndUpdateSession(db: Database, workspaceId: string, sessionId: string, inputs: AppendEventInput[], update: {
+    resources?: ResourceRef[];
+    tools?: ToolRef[];
+    model?: string;
+    metadata?: Record<string, unknown>;
+    status?: SessionStatus;
+    activeTurnId?: string | null;
+}): Promise<SessionEvent[]>;
+declare function appendSessionEventsWithLockedSessionUpdate(db: Database, workspaceId: string, sessionId: string, build: (session: Session) => {
+    events: AppendEventInput[];
+    update?: {
+        resources?: ResourceRef[];
+        tools?: ToolRef[];
+        model?: string;
+        metadata?: Record<string, unknown>;
+        status?: SessionStatus;
+        activeTurnId?: string | null;
+    };
+}): Promise<SessionEvent[]>;
+declare function sessionSubject(workspaceId: string, sessionId: string): string;
+
+export { type SessionCodexState as $, type AccrueWarmSecondsResult as A, type BootstrapWorkspaceInput as B, CLEARED_RUN_STATE as C, type Database as D, type EnableCapabilityInstallationInput as E, type EnrollmentOs as F, type EnrollmentRecord as G, type EnrollmentStatus as H, type ForceDrainResult as I, type GitHubInstallation as J, type GoalContinuationDecision as K, type LeaseHolderKind as L, type LeaseSnapshot as M, MACHINE_METRICS_SERIES_INTERVAL_MS as N, type MachineMetricsRow as O, type MachineMetricsSample as P, type ProvisionResult, type ProvisionRolesOptions, type MeterableWarmLease as Q, type ReapDrainable as R, type RegisterWorkspacePackInput as S, type RlsContext as T, type RlsStrategy as U, SandboxImageConflictError as V, type SandboxKind as W, type SandboxLeaseLiveness as X, SandboxLeaseSupersededError as Y, type SandboxPtySessionRow as Z, type SandboxRecord as _, type AcquireLeaseInput as a, decryptedCapabilityHeaders as a$, type SessionRecordingCodec as a0, type SessionRecordingMode as a1, type SessionRecordingRow as a2, type SessionRecordingState as a3, type StreamAcknowledgment as a4, type UpdateQueuedSessionTurnInput as a5, type UpdateScheduledTaskInput as a6, type UserLookup as a7, type WakeParentForChildCompletionInput as a8, type WakeParentForChildCompletionResult as a9, countActiveSessionHistoryItems as aA, countActiveSessionsForWorkspace as aB, countActiveSessionsUsingEnvironment as aC, countConsecutiveReactiveRotations as aD, countScheduledTasksForWorkspace as aE, countScheduledTasksUsingEnvironment as aF, countSessionHistoryItems as aG, countTurnSessionHistoryItems as aH, countWorkspaceEnvironments as aI, countWorkspacesForAccount as aJ, createApiKey as aK, createDb as aL, createDeviceEnrollmentRequest as aM, createEnrollment as aN, createFileUpload as aO, createSandbox as aP, createScheduledTask as aQ, createScheduledTaskRun as aR, createSession as aS, createSessionGoal as aT, createSessionWithIdempotencyKey as aU, createSocialConnection as aV, createSocialPost as aW, createTurn as aX, createWorkspace as aY, createWorkspaceEnvironment as aZ, decryptEnvironmentValue as a_, type WorkspaceEnvironmentForRun as aa, accrueWarmSeconds as ab, acquireLease as ac, allAccountPermissions as ad, allWorkspacePermissions as ae, appendSessionEvents as af, appendSessionEventsAndUpdateSession as ag, appendSessionEventsWithLockedSessionUpdate as ah, appendSessionHistoryItems as ai, applyContextCompaction as aj, applyCreditDebitUpToBalance as ak, applyCreditLedgerEntry as al, approveDeviceEnrollmentRequest as am, bootstrapWorkspace as an, buildCodexTokenResolver as ao, cancelQueuedSessionTurn as ap, claimNextQueuedTurn as aq, clearSessionContext as ar, clearedContextMarkerItem as as, closePtySession as at, commitWarmingToWarm as au, completeFileUpload as av, confirmDrainCold as aw, consumeDeviceEnrollmentRequest as ax, consumeSessionCompactionRequest as ay, countActiveApiKeysForWorkspace as az, type AcquireLeaseResult as b, hasCreditLedgerEntry as b$, deleteRecording as b0, deleteScheduledTask as b1, deleteWorkspace as b2, deleteWorkspaceEnvironment as b3, deleteWorkspaceEnvironmentVariable as b4, deleteWorkspacePack as b5, denyDeviceEnrollmentRequest as b6, disableCapabilityInstallation as b7, disconnectAllCodexAccounts as b8, disconnectCodexAccount as b9, getManagedAccount as bA, getManagedUserByEmail as bB, getOpenPtySession as bC, getPackInstallation as bD, getPendingDeviceEnrollmentRequestByUserCode as bE, getPendingDeviceEnrollmentRequestByUserCodeGlobal as bF, getRecording as bG, getSandbox as bH, getSandboxSessionEnvelope as bI, getScheduledTask as bJ, getSession as bK, getSessionByCreateIdempotencyKey as bL, getSessionCodexState as bM, getSessionEvent as bN, getSessionGoal as bO, getSessionHistoryItems as bP, getSessionTurn as bQ, getSocialConnection as bR, getStoredCapabilityHeaderCiphertext as bS, getStreamAcknowledgment as bT, getWorkspace as bU, getWorkspaceEnvironment as bV, getWorkspaceEnvironmentByName as bW, getWorkspaceEnvironmentValuesForRun as bX, getWorkspaceGrant as bY, getWorkspacePack as bZ, grantWorkspaceAccess as b_, enableCapabilityInstallation as ba, enablePackInstallation as bb, encryptEnvironmentValue as bc, enqueueSessionTurn as bd, ensureCodexRotationSettings as be, ensureManagedAccessForUser as bf, evaluateGoalContinuation as bg, failWarmingToCold as bh, fetchCodexUsageForAccount as bi, finalizeEnrollmentByToken as bj, findActiveApiKeyByHash as bk, finishTurn as bl, forceDrainOverLimitViewerOnlyBoxes as bm, getActiveSessionHistoryItems as bn, getAnySessionInGroup as bo, getBillingBalance as bp, getBillingCustomer as bq, getCapabilityCatalogItem as br, getCapabilityInstallation as bs, getCodexCredentialStatus as bt, getCodexRotationSettings as bu, getDeviceEnrollmentRequestByDeviceCode as bv, getEnrollment as bw, getFile as bx, getFileUpload as by, getLatestRunState as bz, type ActiveSandboxPointer as c, releaseLeaseHolder as c$, heartbeatLeaseHolder as c0, incrementTurnWorkerDeathRedispatches as c1, ingestMachineMetricsSample as c2, insertMachineMetricsSeries as c3, insertPtySession as c4, insertRecording as c5, isCodexBilledTurn as c6, isStripeWebhookProcessed as c7, listApiKeys as c8, listCapabilityCatalogItems as c9, loadWorkspaceEnvironmentForRun as cA, markFileUploadFailed as cB, markStripeWebhookProcessed as cC, mcpServerIdForCapability as cD, nextSessionHistoryPosition as cE, orphanedResultRowIndicesForRepair as cF, persistDrainSnapshot as cG, reArmDrainingLease as cH, readActiveSandbox as cI, readLease as cJ, readMachineMetricsLatest as cK, readMachineMetricsLatestForWorkspace as cL, readMachineMetricsSeries as cM, reapStaleLeaseHolders as cN, reapStaleLeaseHoldersGlobal as cO, recordAuditEvent as cP, recordCodexAccountConnectors as cQ, recordCodexAccountUsage as cR, recordCodexTokenRefresh as cS, recordLeaseDataPlaneUrl as cT, recordLeaseTerminalDataPlaneUrl as cU, recordSessionActiveCodexCredential as cV, recordStreamAcknowledgment as cW, recordStripeWebhookEvent as cX, recordUsageEvent as cY, registerDbBinding as cZ, registerWorkspacePack as c_, listCapabilityInstallations as ca, listCodexAccountStatuses as cb, listDistinctEnvironmentIdsInGroup as cc, listEnabledMcpCapabilityServers as cd, listEnrollments as ce, listGitHubInstallationIdsForWorkspace as cf, listGitHubInstallationsForWorkspace as cg, listMeterableWarmLeases as ch, listOpenPtySessions as ci, listPackInstallations as cj, listRecordings as ck, listSandboxes as cl, listScheduledTaskRuns as cm, listScheduledTasks as cn, listSessionEvents as co, listSessionIdsInGroup as cp, listSessionTurns as cq, listSessions as cr, listSocialConnections as cs, listSocialPosts as ct, listUsageEvents as cu, listWorkspaceEnvironments as cv, listWorkspaceMembers as cw, listWorkspacePacks as cx, listWorkspacesForSubject as cy, loadCodexCredentialForRun as cz, type AppendEventInput as d, removeWorkspaceMember as d0, renameCodexAccount as d1, reorderQueuedSessionTurns as d2, requestSessionCompaction as d3, requeuePreemptedTurn as d4, requireFile as d5, requireScheduledTask as d6, requireSession as d7, requireSocialConnection as d8, requireWorkspace as d9, updatePackInstallationStatus as dA, updatePtySessionActivity as dB, updateQueuedSessionTurn as dC, updateRecording as dD, updateScheduledTask as dE, updateScheduledTaskRun as dF, updateSessionGoal as dG, updateSessionTitle as dH, updateWorkspace as dI, updateWorkspaceEnvironment as dJ, upsertBillingCustomer as dK, upsertCapabilityCatalogItem as dL, upsertCodexSubscriptionCredential as dM, upsertGitHubInstallation as dN, upsertMachineMetricsLatest as dO, upsertSandboxSessionEnvelope as dP, upsertSessionGoal as dQ, wakeParentSessionForChildCompletion as dR, withAccountRls as dS, withRlsContext as dT, withWorkspaceRls as dU, withWorkspaceUsageLock as dV, workspaceCodexSubscriptionActive as dW, revokeApiKey as da, revokeEnrollment as db, revokeViewer as dc, rlsContextForWorkspace as dd, rlsStrategyFor as de, sanitizeEventPayload as df, sanitizeEventString as dg, saveRunState as dh, sessionSubject as di, setActiveCodexCredential as dj, setActiveSandbox as dk, setCodexCredentialExhausted as dl, setCodexCredentialStatus as dm, setEnrollmentHasDisplay as dn, setRlsContext as dp, setSessionCodexPin as dq, setSessionGoalLastContinuationTurn as dr, setSessionGoalStatus as ds, setSessionLastInputTokens as dt, setSessionStatus as du, setTemporalWorkflowId as dv, setWorkspaceEnvironmentVariable as dw, sumUsageQuantity as dx, touchEnrollmentLastSeen as dy, updateCodexRotationSettings as dz, CODEX_ROTATION_STRATEGIES as e, type ClearSessionContextResult as f, type CodexAccountStatus as g, type CodexAccountUsageSnapshot as h, type CodexAuthDeps as i, type CodexCredentialForRun as j, type CodexCredentialTokens as k, type CodexRotationSettings as l, type CodexRotationStrategy as m, type CreateCapabilityCatalogItemInput as n, type CreateDbOptions as o, type CreatePackInstallationInput as p, provisionRoles, type CreateScheduledTaskInput as q, type CreateSessionGoalInput as r, type CreateSocialConnectionInput as s, type CreateSocialPostInput as t, type DbClient as u, type DeviceEnrollmentRequestRecord as v, type DeviceEnrollmentStatus as w, type EnabledMcpCapabilityServer as x, type EnqueueSessionTurnInput as y, type EnrollmentExposure as z };