@opengeni/db 0.2.2 → 0.3.0

package/dist/provision-roles.d.ts

@@ -1,8 +1,8 @@
-import { SessionEventType, Permission, CapabilityKind, CapabilitySource, ScheduledTaskStatus, ScheduledTaskScheduleSpec, ScheduledTaskRunMode, ScheduledTaskOverlapPolicy, ScheduledTaskAgentConfig, SessionGoalCreatedBy, SocialProvider, SocialConnectionStatus, SessionTurnSource, ResourceRef, ToolRef, ReasoningEffort, SandboxBackend, SessionGoal, CapabilityPack, SessionTurn, SessionEvent, SessionStatus, Session, BillingBalance, AccessContext, FileAsset, ApiKey, ScheduledTask, ScheduledTaskTriggerType, ScheduledTaskRun, SandboxOs, SocialConnection, SocialPost, Workspace, WorkspaceEnvironment, CapabilityInstallation, PackInstallation, SessionTurnStatus, CapabilityCatalogItem, FileUploadStatus, ManagedAccount, AccessGrant, WorkspaceRegisteredPack, UsageEvent, WorkspaceMember, SessionGoalStatus, WorkspaceEnvironmentVariableMetadata, PackInstallationStatus, ScheduledTaskRunStatus } from '@opengeni/contracts';
+import { SessionEventType, Permission, CapabilityKind, CapabilitySource, ScheduledTaskStatus, ScheduledTaskScheduleSpec, ScheduledTaskRunMode, ScheduledTaskOverlapPolicy, ScheduledTaskAgentConfig, SessionGoalCreatedBy, SocialProvider, SocialConnectionStatus, SessionTurnSource, ResourceRef, ToolRef, ReasoningEffort, SandboxBackend, SessionGoal, CapabilityPack, SessionMcpServerMetadata, SessionTurn, SessionEvent, SessionStatus, Session, BillingBalance, AccessContext, FileAsset, ApiKey, ScheduledTask, ScheduledTaskTriggerType, ScheduledTaskRun, SandboxOs, SocialConnection, SocialPost, Workspace, WorkspaceEnvironment, CapabilityInstallation, PackInstallation, SessionTurnStatus, CapabilityCatalogItem, FileUploadStatus, ManagedAccount, AccessGrant, WorkspaceRegisteredPack, UsageEvent, WorkspaceMember, SessionGoalStatus, WorkspaceEnvironmentVariableMetadata, PackInstallationStatus, ScheduledTaskRunStatus } from '@opengeni/contracts';
 import { environmentsEncryptionKeyBytes, Settings } from '@opengeni/config';
 import { refreshCodexToken, CodexTokenSnapshot, CodexUsagePayload } from '@opengeni/codex';
 import { PgDatabase } from 'drizzle-orm/pg-core';
-import { s as schema, e as enrollmentOsValues, a as enrollmentExposureValues, d as deviceEnrollmentStatusValues, b as enrollmentStatusValues, c as sandboxKindValues, f as sessionRecordingCodecValues, g as sessionRecordingModeValues, h as sessionRecordingStateValues } from './schema-fwrPBw5T.js';
+import { s as schema, e as enrollmentOsValues, a as enrollmentExposureValues, d as deviceEnrollmentStatusValues, b as enrollmentStatusValues, c as sandboxKindValues, f as sessionRecordingCodecValues, g as sessionRecordingModeValues, h as sessionRecordingStateValues } from './schema-BI0iqN9U.js';
 import 'drizzle-orm';
 import './migrate.js';
 
@@ -483,6 +483,29 @@ type EnabledMcpCapabilityServer = {
      */
     headersEncrypted?: Record<string, string>;
 };
+type CreateSessionMcpServerInput = {
+    id: string;
+    name?: string | null;
+    url: string;
+    allowedTools?: string[] | null;
+    timeoutMs?: number | null;
+    cacheToolsList?: boolean | null;
+    headersEncrypted?: Record<string, string>;
+};
+type UpdateSessionMcpServerCredentialsInput = {
+    id: string;
+    headersEncrypted: Record<string, string>;
+};
+type UpdateSessionMcpServerCredentialsResult = {
+    servers: SessionMcpServerMetadata[];
+    missingIds: string[];
+};
+type SessionMcpServerForRun = SessionMcpServerMetadata & {
+    allowedTools?: string[];
+    timeoutMs?: number;
+    cacheToolsList?: boolean;
+    headers: Record<string, string>;
+};
 type EnqueueSessionTurnInput = {
     accountId: string;
     workspaceId: string;
@@ -951,6 +974,19 @@ declare function recordAuditEvent(db: Database, input: {
     targetId?: string | null;
     metadata?: Record<string, unknown>;
 }): Promise<void>;
+declare function createSessionMcpServers(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    servers: CreateSessionMcpServerInput[];
+}): Promise<SessionMcpServerMetadata[]>;
+declare function listSessionMcpServerMetadata(db: Database, workspaceId: string, sessionId: string): Promise<SessionMcpServerMetadata[]>;
+declare function updateSessionMcpServerCredentials(db: Database, input: {
+    workspaceId: string;
+    sessionId: string;
+    updates: UpdateSessionMcpServerCredentialsInput[];
+}): Promise<UpdateSessionMcpServerCredentialsResult>;
+declare function listSessionMcpServersForRun(db: Database, workspaceId: string, sessionId: string, encryptionKey: Uint8Array): Promise<SessionMcpServerForRun[]>;
 declare function createSession(db: Database, input: {
     accountId: string;
     workspaceId: string;
@@ -966,6 +1002,7 @@ declare function createSession(db: Database, input: {
     createIdempotencyKey?: string | null;
     sandboxGroupId?: string | null;
     sandboxOs?: SandboxOs;
+    mcpServers?: CreateSessionMcpServerInput[];
 }): Promise<Session>;
 /**
  * Inserts a session under a workspace-scoped CREATE idempotency key, collapsing
@@ -992,6 +1029,7 @@ declare function createSessionWithIdempotencyKey(db: Database, input: {
     createIdempotencyKey: string;
     sandboxGroupId?: string | null;
     sandboxOs?: SandboxOs;
+    mcpServers?: CreateSessionMcpServerInput[];
 }): Promise<{
     session: Session;
     created: boolean;
@@ -1029,7 +1067,14 @@ declare function listSessions(db: Database, workspaceId: string, limit?: number)
  */
 declare function countActiveSessionsForWorkspace(db: Database, workspaceId: string): Promise<number>;
 declare function requireSession(db: Database, workspaceId: string, sessionId: string): Promise<Session>;
-declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string, after?: number, limit?: number): Promise<SessionEvent[]>;
+type ListSessionEventsOptions = {
+    after?: number;
+    before?: number;
+    limit?: number;
+};
+declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string): Promise<SessionEvent[]>;
+declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string, after: number, limit?: number): Promise<SessionEvent[]>;
+declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string, options: ListSessionEventsOptions): Promise<SessionEvent[]>;
 declare function getSessionEvent(db: Database, workspaceId: string, eventId: string): Promise<SessionEvent | null>;
 declare function getLatestRunState(db: Database, workspaceId: string, sessionId: string): Promise<{
     id: string;
@@ -1060,8 +1105,8 @@ declare function getSessionHistoryItems(db: Database, workspaceId: string, sessi
 }>>;
 /**
  * The LIVE conversation-truth read path: only active rows, position-ordered.
- * After a client-side context compaction this returns [active summary,
- * ...active recent tail]; with no compaction yet it equals
+ * After a client-side context compaction this returns [retained user messages,
+ * active summary]; with no compaction yet it equals
  * getSessionHistoryItems. The model-facing read path uses this so superseded
  * (summarized-away) prefix rows are excluded while the full transcript stays in
  * the table as an audit trail.
@@ -1137,8 +1182,18 @@ declare function applyContextCompaction(db: Database, input: {
     turnId?: string | null;
     /** Active prefix rows with position < boundaryPosition get superseded. */
     boundaryPosition: number;
-    /** Fractional position for the new summary row (must be < boundaryPosition). */
+    /** Position for the new summary row. Old boundary mode uses a fractional half-step before the kept tail. */
     summaryPosition: number;
+    /**
+     * Optional replacement rows inserted after superseding the old active set.
+     * Used by Codex-parity client compaction to rebuild active history as retained
+     * user messages plus one summary. These rows are synthetic replay rows, so
+     * they intentionally do not inherit the current compaction turn id.
+     */
+    replacementItems?: Array<{
+        position: number;
+        item: Record<string, unknown>;
+    }>;
     summaryItem: Record<string, unknown>;
 }): Promise<void>;
 /**
@@ -2047,7 +2102,10 @@ declare function appendSessionEventsAndUpdateSession(db: Database, workspaceId:
     status?: SessionStatus;
     activeTurnId?: string | null;
 }): Promise<SessionEvent[]>;
-declare function appendSessionEventsWithLockedSessionUpdate(db: Database, workspaceId: string, sessionId: string, build: (session: Session) => {
+type LockedSessionUpdateContext = {
+    updateSessionMcpServerCredentials: (updates: UpdateSessionMcpServerCredentialsInput[]) => Promise<UpdateSessionMcpServerCredentialsResult>;
+};
+type LockedSessionUpdateResult = {
     events: AppendEventInput[];
     update?: {
         resources?: ResourceRef[];
@@ -2057,7 +2115,8 @@ declare function appendSessionEventsWithLockedSessionUpdate(db: Database, worksp
         status?: SessionStatus;
         activeTurnId?: string | null;
     };
-}): Promise<SessionEvent[]>;
+};
+declare function appendSessionEventsWithLockedSessionUpdate(db: Database, workspaceId: string, sessionId: string, build: (session: Session, context: LockedSessionUpdateContext) => LockedSessionUpdateResult | Promise<LockedSessionUpdateResult>): Promise<SessionEvent[]>;
 declare function sessionSubject(workspaceId: string, sessionId: string): string;
 
-export { type SessionCodexState as $, type AccrueWarmSecondsResult as A, type BootstrapWorkspaceInput as B, CLEARED_RUN_STATE as C, type Database as D, type EnableCapabilityInstallationInput as E, type EnrollmentOs as F, type EnrollmentRecord as G, type EnrollmentStatus as H, type ForceDrainResult as I, type GitHubInstallation as J, type GoalContinuationDecision as K, type LeaseHolderKind as L, type LeaseSnapshot as M, MACHINE_METRICS_SERIES_INTERVAL_MS as N, type MachineMetricsRow as O, type MachineMetricsSample as P, type ProvisionResult, type ProvisionRolesOptions, type MeterableWarmLease as Q, type ReapDrainable as R, type RegisterWorkspacePackInput as S, type RlsContext as T, type RlsStrategy as U, SandboxImageConflictError as V, type SandboxKind as W, type SandboxLeaseLiveness as X, SandboxLeaseSupersededError as Y, type SandboxPtySessionRow as Z, type SandboxRecord as _, type AcquireLeaseInput as a, decryptedCapabilityHeaders as a$, type SessionRecordingCodec as a0, type SessionRecordingMode as a1, type SessionRecordingRow as a2, type SessionRecordingState as a3, type StreamAcknowledgment as a4, type UpdateQueuedSessionTurnInput as a5, type UpdateScheduledTaskInput as a6, type UserLookup as a7, type WakeParentForChildCompletionInput as a8, type WakeParentForChildCompletionResult as a9, countActiveSessionHistoryItems as aA, countActiveSessionsForWorkspace as aB, countActiveSessionsUsingEnvironment as aC, countConsecutiveReactiveRotations as aD, countScheduledTasksForWorkspace as aE, countScheduledTasksUsingEnvironment as aF, countSessionHistoryItems as aG, countTurnSessionHistoryItems as aH, countWorkspaceEnvironments as aI, countWorkspacesForAccount as aJ, createApiKey as aK, createDb as aL, createDeviceEnrollmentRequest as aM, createEnrollment as aN, createFileUpload as aO, createSandbox as aP, createScheduledTask as aQ, createScheduledTaskRun as aR, createSession as aS, createSessionGoal as aT, createSessionWithIdempotencyKey as aU, createSocialConnection as aV, createSocialPost as aW, createTurn as aX, createWorkspace as aY, createWorkspaceEnvironment as aZ, decryptEnvironmentValue as a_, type WorkspaceEnvironmentForRun as aa, accrueWarmSeconds as ab, acquireLease as ac, allAccountPermissions as ad, allWorkspacePermissions as ae, appendSessionEvents as af, appendSessionEventsAndUpdateSession as ag, appendSessionEventsWithLockedSessionUpdate as ah, appendSessionHistoryItems as ai, applyContextCompaction as aj, applyCreditDebitUpToBalance as ak, applyCreditLedgerEntry as al, approveDeviceEnrollmentRequest as am, bootstrapWorkspace as an, buildCodexTokenResolver as ao, cancelQueuedSessionTurn as ap, claimNextQueuedTurn as aq, clearSessionContext as ar, clearedContextMarkerItem as as, closePtySession as at, commitWarmingToWarm as au, completeFileUpload as av, confirmDrainCold as aw, consumeDeviceEnrollmentRequest as ax, consumeSessionCompactionRequest as ay, countActiveApiKeysForWorkspace as az, type AcquireLeaseResult as b, hasCreditLedgerEntry as b$, deleteRecording as b0, deleteScheduledTask as b1, deleteWorkspace as b2, deleteWorkspaceEnvironment as b3, deleteWorkspaceEnvironmentVariable as b4, deleteWorkspacePack as b5, denyDeviceEnrollmentRequest as b6, disableCapabilityInstallation as b7, disconnectAllCodexAccounts as b8, disconnectCodexAccount as b9, getManagedAccount as bA, getManagedUserByEmail as bB, getOpenPtySession as bC, getPackInstallation as bD, getPendingDeviceEnrollmentRequestByUserCode as bE, getPendingDeviceEnrollmentRequestByUserCodeGlobal as bF, getRecording as bG, getSandbox as bH, getSandboxSessionEnvelope as bI, getScheduledTask as bJ, getSession as bK, getSessionByCreateIdempotencyKey as bL, getSessionCodexState as bM, getSessionEvent as bN, getSessionGoal as bO, getSessionHistoryItems as bP, getSessionTurn as bQ, getSocialConnection as bR, getStoredCapabilityHeaderCiphertext as bS, getStreamAcknowledgment as bT, getWorkspace as bU, getWorkspaceEnvironment as bV, getWorkspaceEnvironmentByName as bW, getWorkspaceEnvironmentValuesForRun as bX, getWorkspaceGrant as bY, getWorkspacePack as bZ, grantWorkspaceAccess as b_, enableCapabilityInstallation as ba, enablePackInstallation as bb, encryptEnvironmentValue as bc, enqueueSessionTurn as bd, ensureCodexRotationSettings as be, ensureManagedAccessForUser as bf, evaluateGoalContinuation as bg, failWarmingToCold as bh, fetchCodexUsageForAccount as bi, finalizeEnrollmentByToken as bj, findActiveApiKeyByHash as bk, finishTurn as bl, forceDrainOverLimitViewerOnlyBoxes as bm, getActiveSessionHistoryItems as bn, getAnySessionInGroup as bo, getBillingBalance as bp, getBillingCustomer as bq, getCapabilityCatalogItem as br, getCapabilityInstallation as bs, getCodexCredentialStatus as bt, getCodexRotationSettings as bu, getDeviceEnrollmentRequestByDeviceCode as bv, getEnrollment as bw, getFile as bx, getFileUpload as by, getLatestRunState as bz, type ActiveSandboxPointer as c, releaseLeaseHolder as c$, heartbeatLeaseHolder as c0, incrementTurnWorkerDeathRedispatches as c1, ingestMachineMetricsSample as c2, insertMachineMetricsSeries as c3, insertPtySession as c4, insertRecording as c5, isCodexBilledTurn as c6, isStripeWebhookProcessed as c7, listApiKeys as c8, listCapabilityCatalogItems as c9, loadWorkspaceEnvironmentForRun as cA, markFileUploadFailed as cB, markStripeWebhookProcessed as cC, mcpServerIdForCapability as cD, nextSessionHistoryPosition as cE, orphanedResultRowIndicesForRepair as cF, persistDrainSnapshot as cG, reArmDrainingLease as cH, readActiveSandbox as cI, readLease as cJ, readMachineMetricsLatest as cK, readMachineMetricsLatestForWorkspace as cL, readMachineMetricsSeries as cM, reapStaleLeaseHolders as cN, reapStaleLeaseHoldersGlobal as cO, recordAuditEvent as cP, recordCodexAccountConnectors as cQ, recordCodexAccountUsage as cR, recordCodexTokenRefresh as cS, recordLeaseDataPlaneUrl as cT, recordLeaseTerminalDataPlaneUrl as cU, recordSessionActiveCodexCredential as cV, recordStreamAcknowledgment as cW, recordStripeWebhookEvent as cX, recordUsageEvent as cY, registerDbBinding as cZ, registerWorkspacePack as c_, listCapabilityInstallations as ca, listCodexAccountStatuses as cb, listDistinctEnvironmentIdsInGroup as cc, listEnabledMcpCapabilityServers as cd, listEnrollments as ce, listGitHubInstallationIdsForWorkspace as cf, listGitHubInstallationsForWorkspace as cg, listMeterableWarmLeases as ch, listOpenPtySessions as ci, listPackInstallations as cj, listRecordings as ck, listSandboxes as cl, listScheduledTaskRuns as cm, listScheduledTasks as cn, listSessionEvents as co, listSessionIdsInGroup as cp, listSessionTurns as cq, listSessions as cr, listSocialConnections as cs, listSocialPosts as ct, listUsageEvents as cu, listWorkspaceEnvironments as cv, listWorkspaceMembers as cw, listWorkspacePacks as cx, listWorkspacesForSubject as cy, loadCodexCredentialForRun as cz, type AppendEventInput as d, removeWorkspaceMember as d0, renameCodexAccount as d1, reorderQueuedSessionTurns as d2, requestSessionCompaction as d3, requeuePreemptedTurn as d4, requireFile as d5, requireScheduledTask as d6, requireSession as d7, requireSocialConnection as d8, requireWorkspace as d9, updatePackInstallationStatus as dA, updatePtySessionActivity as dB, updateQueuedSessionTurn as dC, updateRecording as dD, updateScheduledTask as dE, updateScheduledTaskRun as dF, updateSessionGoal as dG, updateSessionTitle as dH, updateWorkspace as dI, updateWorkspaceEnvironment as dJ, upsertBillingCustomer as dK, upsertCapabilityCatalogItem as dL, upsertCodexSubscriptionCredential as dM, upsertGitHubInstallation as dN, upsertMachineMetricsLatest as dO, upsertSandboxSessionEnvelope as dP, upsertSessionGoal as dQ, wakeParentSessionForChildCompletion as dR, withAccountRls as dS, withRlsContext as dT, withWorkspaceRls as dU, withWorkspaceUsageLock as dV, workspaceCodexSubscriptionActive as dW, revokeApiKey as da, revokeEnrollment as db, revokeViewer as dc, rlsContextForWorkspace as dd, rlsStrategyFor as de, sanitizeEventPayload as df, sanitizeEventString as dg, saveRunState as dh, sessionSubject as di, setActiveCodexCredential as dj, setActiveSandbox as dk, setCodexCredentialExhausted as dl, setCodexCredentialStatus as dm, setEnrollmentHasDisplay as dn, setRlsContext as dp, setSessionCodexPin as dq, setSessionGoalLastContinuationTurn as dr, setSessionGoalStatus as ds, setSessionLastInputTokens as dt, setSessionStatus as du, setTemporalWorkflowId as dv, setWorkspaceEnvironmentVariable as dw, sumUsageQuantity as dx, touchEnrollmentLastSeen as dy, updateCodexRotationSettings as dz, CODEX_ROTATION_STRATEGIES as e, type ClearSessionContextResult as f, type CodexAccountStatus as g, type CodexAccountUsageSnapshot as h, type CodexAuthDeps as i, type CodexCredentialForRun as j, type CodexCredentialTokens as k, type CodexRotationSettings as l, type CodexRotationStrategy as m, type CreateCapabilityCatalogItemInput as n, type CreateDbOptions as o, type CreatePackInstallationInput as p, provisionRoles, type CreateScheduledTaskInput as q, type CreateSessionGoalInput as r, type CreateSocialConnectionInput as s, type CreateSocialPostInput as t, type DbClient as u, type DeviceEnrollmentRequestRecord as v, type DeviceEnrollmentStatus as w, type EnabledMcpCapabilityServer as x, type EnqueueSessionTurnInput as y, type EnrollmentExposure as z };
+export { type SandboxPtySessionRow as $, type AccrueWarmSecondsResult as A, type BootstrapWorkspaceInput as B, CLEARED_RUN_STATE as C, type Database as D, type EnableCapabilityInstallationInput as E, type EnrollmentExposure as F, type EnrollmentOs as G, type EnrollmentRecord as H, type EnrollmentStatus as I, type ForceDrainResult as J, type GitHubInstallation as K, type GoalContinuationDecision as L, type LeaseHolderKind as M, type LeaseSnapshot as N, type ListSessionEventsOptions as O, MACHINE_METRICS_SERIES_INTERVAL_MS as P, type ProvisionResult, type ProvisionRolesOptions, type MachineMetricsRow as Q, type MachineMetricsSample as R, type MeterableWarmLease as S, type ReapDrainable as T, type RegisterWorkspacePackInput as U, type RlsContext as V, type RlsStrategy as W, SandboxImageConflictError as X, type SandboxKind as Y, type SandboxLeaseLiveness as Z, SandboxLeaseSupersededError as _, type AcquireLeaseInput as a, createSocialConnection as a$, type SandboxRecord as a0, type SessionCodexState as a1, type SessionMcpServerForRun as a2, type SessionRecordingCodec as a3, type SessionRecordingMode as a4, type SessionRecordingRow as a5, type SessionRecordingState as a6, type StreamAcknowledgment as a7, type UpdateQueuedSessionTurnInput as a8, type UpdateScheduledTaskInput as a9, completeFileUpload as aA, confirmDrainCold as aB, consumeDeviceEnrollmentRequest as aC, consumeSessionCompactionRequest as aD, countActiveApiKeysForWorkspace as aE, countActiveSessionHistoryItems as aF, countActiveSessionsForWorkspace as aG, countActiveSessionsUsingEnvironment as aH, countConsecutiveReactiveRotations as aI, countScheduledTasksForWorkspace as aJ, countScheduledTasksUsingEnvironment as aK, countSessionHistoryItems as aL, countTurnSessionHistoryItems as aM, countWorkspaceEnvironments as aN, countWorkspacesForAccount as aO, createApiKey as aP, createDb as aQ, createDeviceEnrollmentRequest as aR, createEnrollment as aS, createFileUpload as aT, createSandbox as aU, createScheduledTask as aV, createScheduledTaskRun as aW, createSession as aX, createSessionGoal as aY, createSessionMcpServers as aZ, createSessionWithIdempotencyKey as a_, type UpdateSessionMcpServerCredentialsInput as aa, type UpdateSessionMcpServerCredentialsResult as ab, type UserLookup as ac, type WakeParentForChildCompletionInput as ad, type WakeParentForChildCompletionResult as ae, type WorkspaceEnvironmentForRun as af, accrueWarmSeconds as ag, acquireLease as ah, allAccountPermissions as ai, allWorkspacePermissions as aj, appendSessionEvents as ak, appendSessionEventsAndUpdateSession as al, appendSessionEventsWithLockedSessionUpdate as am, appendSessionHistoryItems as an, applyContextCompaction as ao, applyCreditDebitUpToBalance as ap, applyCreditLedgerEntry as aq, approveDeviceEnrollmentRequest as ar, bootstrapWorkspace as as, buildCodexTokenResolver as at, cancelQueuedSessionTurn as au, claimNextQueuedTurn as av, clearSessionContext as aw, clearedContextMarkerItem as ax, closePtySession as ay, commitWarmingToWarm as az, type AcquireLeaseResult as b, getWorkspaceEnvironment as b$, createSocialPost as b0, createTurn as b1, createWorkspace as b2, createWorkspaceEnvironment as b3, decryptEnvironmentValue as b4, decryptedCapabilityHeaders as b5, deleteRecording as b6, deleteScheduledTask as b7, deleteWorkspace as b8, deleteWorkspaceEnvironment as b9, getCodexRotationSettings as bA, getDeviceEnrollmentRequestByDeviceCode as bB, getEnrollment as bC, getFile as bD, getFileUpload as bE, getLatestRunState as bF, getManagedAccount as bG, getManagedUserByEmail as bH, getOpenPtySession as bI, getPackInstallation as bJ, getPendingDeviceEnrollmentRequestByUserCode as bK, getPendingDeviceEnrollmentRequestByUserCodeGlobal as bL, getRecording as bM, getSandbox as bN, getSandboxSessionEnvelope as bO, getScheduledTask as bP, getSession as bQ, getSessionByCreateIdempotencyKey as bR, getSessionCodexState as bS, getSessionEvent as bT, getSessionGoal as bU, getSessionHistoryItems as bV, getSessionTurn as bW, getSocialConnection as bX, getStoredCapabilityHeaderCiphertext as bY, getStreamAcknowledgment as bZ, getWorkspace as b_, deleteWorkspaceEnvironmentVariable as ba, deleteWorkspacePack as bb, denyDeviceEnrollmentRequest as bc, disableCapabilityInstallation as bd, disconnectAllCodexAccounts as be, disconnectCodexAccount as bf, enableCapabilityInstallation as bg, enablePackInstallation as bh, encryptEnvironmentValue as bi, enqueueSessionTurn as bj, ensureCodexRotationSettings as bk, ensureManagedAccessForUser as bl, evaluateGoalContinuation as bm, failWarmingToCold as bn, fetchCodexUsageForAccount as bo, finalizeEnrollmentByToken as bp, findActiveApiKeyByHash as bq, finishTurn as br, forceDrainOverLimitViewerOnlyBoxes as bs, getActiveSessionHistoryItems as bt, getAnySessionInGroup as bu, getBillingBalance as bv, getBillingCustomer as bw, getCapabilityCatalogItem as bx, getCapabilityInstallation as by, getCodexCredentialStatus as bz, type ActiveSandboxPointer as c, recordLeaseDataPlaneUrl as c$, getWorkspaceEnvironmentByName as c0, getWorkspaceEnvironmentValuesForRun as c1, getWorkspaceGrant as c2, getWorkspacePack as c3, grantWorkspaceAccess as c4, hasCreditLedgerEntry as c5, heartbeatLeaseHolder as c6, incrementTurnWorkerDeathRedispatches as c7, ingestMachineMetricsSample as c8, insertMachineMetricsSeries as c9, listSocialConnections as cA, listSocialPosts as cB, listUsageEvents as cC, listWorkspaceEnvironments as cD, listWorkspaceMembers as cE, listWorkspacePacks as cF, listWorkspacesForSubject as cG, loadCodexCredentialForRun as cH, loadWorkspaceEnvironmentForRun as cI, markFileUploadFailed as cJ, markStripeWebhookProcessed as cK, mcpServerIdForCapability as cL, nextSessionHistoryPosition as cM, orphanedResultRowIndicesForRepair as cN, persistDrainSnapshot as cO, reArmDrainingLease as cP, readActiveSandbox as cQ, readLease as cR, readMachineMetricsLatest as cS, readMachineMetricsLatestForWorkspace as cT, readMachineMetricsSeries as cU, reapStaleLeaseHolders as cV, reapStaleLeaseHoldersGlobal as cW, recordAuditEvent as cX, recordCodexAccountConnectors as cY, recordCodexAccountUsage as cZ, recordCodexTokenRefresh as c_, insertPtySession as ca, insertRecording as cb, isCodexBilledTurn as cc, isStripeWebhookProcessed as cd, listApiKeys as ce, listCapabilityCatalogItems as cf, listCapabilityInstallations as cg, listCodexAccountStatuses as ch, listDistinctEnvironmentIdsInGroup as ci, listEnabledMcpCapabilityServers as cj, listEnrollments as ck, listGitHubInstallationIdsForWorkspace as cl, listGitHubInstallationsForWorkspace as cm, listMeterableWarmLeases as cn, listOpenPtySessions as co, listPackInstallations as cp, listRecordings as cq, listSandboxes as cr, listScheduledTaskRuns as cs, listScheduledTasks as ct, listSessionEvents as cu, listSessionIdsInGroup as cv, listSessionMcpServerMetadata as cw, listSessionMcpServersForRun as cx, listSessionTurns as cy, listSessions as cz, type AppendEventInput as d, withAccountRls as d$, recordLeaseTerminalDataPlaneUrl as d0, recordSessionActiveCodexCredential as d1, recordStreamAcknowledgment as d2, recordStripeWebhookEvent as d3, recordUsageEvent as d4, registerDbBinding as d5, registerWorkspacePack as d6, releaseLeaseHolder as d7, removeWorkspaceMember as d8, renameCodexAccount as d9, setSessionGoalStatus as dA, setSessionLastInputTokens as dB, setSessionStatus as dC, setTemporalWorkflowId as dD, setWorkspaceEnvironmentVariable as dE, sumUsageQuantity as dF, touchEnrollmentLastSeen as dG, updateCodexRotationSettings as dH, updatePackInstallationStatus as dI, updatePtySessionActivity as dJ, updateQueuedSessionTurn as dK, updateRecording as dL, updateScheduledTask as dM, updateScheduledTaskRun as dN, updateSessionGoal as dO, updateSessionMcpServerCredentials as dP, updateSessionTitle as dQ, updateWorkspace as dR, updateWorkspaceEnvironment as dS, upsertBillingCustomer as dT, upsertCapabilityCatalogItem as dU, upsertCodexSubscriptionCredential as dV, upsertGitHubInstallation as dW, upsertMachineMetricsLatest as dX, upsertSandboxSessionEnvelope as dY, upsertSessionGoal as dZ, wakeParentSessionForChildCompletion as d_, reorderQueuedSessionTurns as da, requestSessionCompaction as db, requeuePreemptedTurn as dc, requireFile as dd, requireScheduledTask as de, requireSession as df, requireSocialConnection as dg, requireWorkspace as dh, revokeApiKey as di, revokeEnrollment as dj, revokeViewer as dk, rlsContextForWorkspace as dl, rlsStrategyFor as dm, sanitizeEventPayload as dn, sanitizeEventString as dp, saveRunState as dq, sessionSubject as dr, setActiveCodexCredential as ds, setActiveSandbox as dt, setCodexCredentialExhausted as du, setCodexCredentialStatus as dv, setEnrollmentHasDisplay as dw, setRlsContext as dx, setSessionCodexPin as dy, setSessionGoalLastContinuationTurn as dz, CODEX_ROTATION_STRATEGIES as e, withRlsContext as e0, withWorkspaceRls as e1, withWorkspaceUsageLock as e2, workspaceCodexSubscriptionActive as e3, type ClearSessionContextResult as f, type CodexAccountStatus as g, type CodexAccountUsageSnapshot as h, type CodexAuthDeps as i, type CodexCredentialForRun as j, type CodexCredentialTokens as k, type CodexRotationSettings as l, type CodexRotationStrategy as m, type CreateCapabilityCatalogItemInput as n, type CreateDbOptions as o, type CreatePackInstallationInput as p, provisionRoles, type CreateScheduledTaskInput as q, type CreateSessionGoalInput as r, type CreateSessionMcpServerInput as s, type CreateSocialConnectionInput as t, type CreateSocialPostInput as u, type DbClient as v, type DeviceEnrollmentRequestRecord as w, type DeviceEnrollmentStatus as x, type EnabledMcpCapabilityServer as y, type EnqueueSessionTurnInput as z };

package/dist/{schema-fwrPBw5T.d.ts → schema-BI0iqN9U.d.ts}

@@ -2057,6 +2057,255 @@ declare const sessions: drizzle_orm_pg_core.PgTableWithColumns<{
     };
     dialect: "pg";
 }>;
+declare const sessionMcpServers: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "session_mcp_servers";
+    schema: undefined;
+    columns: {
+        id: drizzle_orm_pg_core.PgColumn<{
+            name: "id";
+            tableName: "session_mcp_servers";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        accountId: drizzle_orm_pg_core.PgColumn<{
+            name: "account_id";
+            tableName: "session_mcp_servers";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        workspaceId: drizzle_orm_pg_core.PgColumn<{
+            name: "workspace_id";
+            tableName: "session_mcp_servers";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        sessionId: drizzle_orm_pg_core.PgColumn<{
+            name: "session_id";
+            tableName: "session_mcp_servers";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        serverId: drizzle_orm_pg_core.PgColumn<{
+            name: "server_id";
+            tableName: "session_mcp_servers";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        name: drizzle_orm_pg_core.PgColumn<{
+            name: "name";
+            tableName: "session_mcp_servers";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        url: drizzle_orm_pg_core.PgColumn<{
+            name: "url";
+            tableName: "session_mcp_servers";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        allowedTools: drizzle_orm_pg_core.PgColumn<{
+            name: "allowed_tools";
+            tableName: "session_mcp_servers";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: string[];
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: string[];
+        }>;
+        timeoutMs: drizzle_orm_pg_core.PgColumn<{
+            name: "timeout_ms";
+            tableName: "session_mcp_servers";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        cacheToolsList: drizzle_orm_pg_core.PgColumn<{
+            name: "cache_tools_list";
+            tableName: "session_mcp_servers";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        headersEncrypted: drizzle_orm_pg_core.PgColumn<{
+            name: "headers_encrypted";
+            tableName: "session_mcp_servers";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, string>;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, string>;
+        }>;
+        credentialVersion: drizzle_orm_pg_core.PgColumn<{
+            name: "credential_version";
+            tableName: "session_mcp_servers";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: drizzle_orm_pg_core.PgColumn<{
+            name: "created_at";
+            tableName: "session_mcp_servers";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: drizzle_orm_pg_core.PgColumn<{
+            name: "updated_at";
+            tableName: "session_mcp_servers";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
 declare const files: drizzle_orm_pg_core.PgTableWithColumns<{
     name: "files";
     schema: undefined;
@@ -9683,6 +9932,7 @@ declare const schema_scheduledTasks: typeof scheduledTasks;
 declare const schema_sessionEvents: typeof sessionEvents;
 declare const schema_sessionGoals: typeof sessionGoals;
 declare const schema_sessionHistoryItems: typeof sessionHistoryItems;
+declare const schema_sessionMcpServers: typeof sessionMcpServers;
 declare const schema_sessionRecordingCodecValues: typeof sessionRecordingCodecValues;
 declare const schema_sessionRecordingModeValues: typeof sessionRecordingModeValues;
 declare const schema_sessionRecordingStateValues: typeof sessionRecordingStateValues;
@@ -9699,7 +9949,7 @@ declare const schema_workspaceMemberships: typeof workspaceMemberships;
 declare const schema_workspacePacks: typeof workspacePacks;
 declare const schema_workspaces: typeof workspaces;
 declare namespace schema {
-  export { schema_agentRunStates as agentRunStates, schema_apiKeys as apiKeys, schema_auditEvents as auditEvents, schema_billingCustomers as billingCustomers, schema_capabilityCatalogItems as capabilityCatalogItems, schema_capabilityInstallations as capabilityInstallations, schema_codexRotationSettings as codexRotationSettings, schema_codexSubscriptionCredentials as codexSubscriptionCredentials, schema_creditLedgerEntries as creditLedgerEntries, schema_deviceEnrollmentRequests as deviceEnrollmentRequests, schema_deviceEnrollmentStatusValues as deviceEnrollmentStatusValues, schema_documentBases as documentBases, schema_documentChunks as documentChunks, schema_documents as documents, schema_enrollmentExposureValues as enrollmentExposureValues, schema_enrollmentOsValues as enrollmentOsValues, schema_enrollmentStatusValues as enrollmentStatusValues, schema_enrollments as enrollments, schema_fileUploads as fileUploads, schema_files as files, schema_githubInstallations as githubInstallations, schema_machineMetricsLatest as machineMetricsLatest, schema_machineMetricsSeries as machineMetricsSeries, schema_managedAccounts as managedAccounts, schema_packInstallations as packInstallations, schema_sandboxKindValues as sandboxKindValues, schema_sandboxLeaseHolders as sandboxLeaseHolders, schema_sandboxLeaseLivenessValues as sandboxLeaseLivenessValues, schema_sandboxLeases as sandboxLeases, schema_sandboxPtySessions as sandboxPtySessions, schema_sandboxSessionEnvelopes as sandboxSessionEnvelopes, schema_sandboxes as sandboxes, schema_scheduledTaskRuns as scheduledTaskRuns, schema_scheduledTasks as scheduledTasks, schema_sessionEvents as sessionEvents, schema_sessionGoals as sessionGoals, schema_sessionHistoryItems as sessionHistoryItems, schema_sessionRecordingCodecValues as sessionRecordingCodecValues, schema_sessionRecordingModeValues as sessionRecordingModeValues, schema_sessionRecordingStateValues as sessionRecordingStateValues, schema_sessionRecordings as sessionRecordings, schema_sessionTurns as sessionTurns, schema_sessions as sessions, schema_socialConnections as socialConnections, schema_socialPosts as socialPosts, schema_stripeWebhookEvents as stripeWebhookEvents, schema_usageEvents as usageEvents, schema_workspaceEnvironmentVariables as workspaceEnvironmentVariables, schema_workspaceEnvironments as workspaceEnvironments, schema_workspaceMemberships as workspaceMemberships, schema_workspacePacks as workspacePacks, schema_workspaces as workspaces };
+  export { schema_agentRunStates as agentRunStates, schema_apiKeys as apiKeys, schema_auditEvents as auditEvents, schema_billingCustomers as billingCustomers, schema_capabilityCatalogItems as capabilityCatalogItems, schema_capabilityInstallations as capabilityInstallations, schema_codexRotationSettings as codexRotationSettings, schema_codexSubscriptionCredentials as codexSubscriptionCredentials, schema_creditLedgerEntries as creditLedgerEntries, schema_deviceEnrollmentRequests as deviceEnrollmentRequests, schema_deviceEnrollmentStatusValues as deviceEnrollmentStatusValues, schema_documentBases as documentBases, schema_documentChunks as documentChunks, schema_documents as documents, schema_enrollmentExposureValues as enrollmentExposureValues, schema_enrollmentOsValues as enrollmentOsValues, schema_enrollmentStatusValues as enrollmentStatusValues, schema_enrollments as enrollments, schema_fileUploads as fileUploads, schema_files as files, schema_githubInstallations as githubInstallations, schema_machineMetricsLatest as machineMetricsLatest, schema_machineMetricsSeries as machineMetricsSeries, schema_managedAccounts as managedAccounts, schema_packInstallations as packInstallations, schema_sandboxKindValues as sandboxKindValues, schema_sandboxLeaseHolders as sandboxLeaseHolders, schema_sandboxLeaseLivenessValues as sandboxLeaseLivenessValues, schema_sandboxLeases as sandboxLeases, schema_sandboxPtySessions as sandboxPtySessions, schema_sandboxSessionEnvelopes as sandboxSessionEnvelopes, schema_sandboxes as sandboxes, schema_scheduledTaskRuns as scheduledTaskRuns, schema_scheduledTasks as scheduledTasks, schema_sessionEvents as sessionEvents, schema_sessionGoals as sessionGoals, schema_sessionHistoryItems as sessionHistoryItems, schema_sessionMcpServers as sessionMcpServers, schema_sessionRecordingCodecValues as sessionRecordingCodecValues, schema_sessionRecordingModeValues as sessionRecordingModeValues, schema_sessionRecordingStateValues as sessionRecordingStateValues, schema_sessionRecordings as sessionRecordings, schema_sessionTurns as sessionTurns, schema_sessions as sessions, schema_socialConnections as socialConnections, schema_socialPosts as socialPosts, schema_stripeWebhookEvents as stripeWebhookEvents, schema_usageEvents as usageEvents, schema_workspaceEnvironmentVariables as workspaceEnvironmentVariables, schema_workspaceEnvironments as workspaceEnvironments, schema_workspaceMemberships as workspaceMemberships, schema_workspacePacks as workspacePacks, schema_workspaces as workspaces };
 }
 
-export { machineMetricsLatest as A, machineMetricsSeries as B, managedAccounts as C, packInstallations as D, sandboxLeaseHolders as E, sandboxLeaseLivenessValues as F, sandboxLeases as G, sandboxPtySessions as H, sandboxSessionEnvelopes as I, sandboxes as J, scheduledTaskRuns as K, scheduledTasks as L, sessionEvents as M, sessionGoals as N, sessionHistoryItems as O, sessionRecordings as P, sessionTurns as Q, sessions as R, socialConnections as S, socialPosts as T, stripeWebhookEvents as U, usageEvents as V, workspaceEnvironmentVariables as W, workspaceEnvironments as X, workspaceMemberships as Y, workspacePacks as Z, workspaces as _, enrollmentExposureValues as a, enrollmentStatusValues as b, sandboxKindValues as c, deviceEnrollmentStatusValues as d, enrollmentOsValues as e, sessionRecordingCodecValues as f, sessionRecordingModeValues as g, sessionRecordingStateValues as h, agentRunStates as i, apiKeys as j, auditEvents as k, billingCustomers as l, capabilityCatalogItems as m, capabilityInstallations as n, codexRotationSettings as o, codexSubscriptionCredentials as p, creditLedgerEntries as q, deviceEnrollmentRequests as r, schema as s, documentBases as t, documentChunks as u, documents as v, enrollments as w, fileUploads as x, files as y, githubInstallations as z };
+export { workspaces as $, machineMetricsLatest as A, machineMetricsSeries as B, managedAccounts as C, packInstallations as D, sandboxLeaseHolders as E, sandboxLeaseLivenessValues as F, sandboxLeases as G, sandboxPtySessions as H, sandboxSessionEnvelopes as I, sandboxes as J, scheduledTaskRuns as K, scheduledTasks as L, sessionEvents as M, sessionGoals as N, sessionHistoryItems as O, sessionMcpServers as P, sessionRecordings as Q, sessionTurns as R, sessions as S, socialConnections as T, socialPosts as U, stripeWebhookEvents as V, usageEvents as W, workspaceEnvironmentVariables as X, workspaceEnvironments as Y, workspaceMemberships as Z, workspacePacks as _, enrollmentExposureValues as a, enrollmentStatusValues as b, sandboxKindValues as c, deviceEnrollmentStatusValues as d, enrollmentOsValues as e, sessionRecordingCodecValues as f, sessionRecordingModeValues as g, sessionRecordingStateValues as h, agentRunStates as i, apiKeys as j, auditEvents as k, billingCustomers as l, capabilityCatalogItems as m, capabilityInstallations as n, codexRotationSettings as o, codexSubscriptionCredentials as p, creditLedgerEntries as q, deviceEnrollmentRequests as r, schema as s, documentBases as t, documentChunks as u, documents as v, enrollments as w, fileUploads as x, files as y, githubInstallations as z };

package/dist/schema.d.ts

@@ -1,3 +1,3 @@
 import 'drizzle-orm';
 import 'drizzle-orm/pg-core';
-export { i as agentRunStates, j as apiKeys, k as auditEvents, l as billingCustomers, m as capabilityCatalogItems, n as capabilityInstallations, o as codexRotationSettings, p as codexSubscriptionCredentials, q as creditLedgerEntries, r as deviceEnrollmentRequests, d as deviceEnrollmentStatusValues, t as documentBases, u as documentChunks, v as documents, a as enrollmentExposureValues, e as enrollmentOsValues, b as enrollmentStatusValues, w as enrollments, x as fileUploads, y as files, z as githubInstallations, A as machineMetricsLatest, B as machineMetricsSeries, C as managedAccounts, D as packInstallations, c as sandboxKindValues, E as sandboxLeaseHolders, F as sandboxLeaseLivenessValues, G as sandboxLeases, H as sandboxPtySessions, I as sandboxSessionEnvelopes, J as sandboxes, K as scheduledTaskRuns, L as scheduledTasks, M as sessionEvents, N as sessionGoals, O as sessionHistoryItems, f as sessionRecordingCodecValues, g as sessionRecordingModeValues, h as sessionRecordingStateValues, P as sessionRecordings, Q as sessionTurns, R as sessions, S as socialConnections, T as socialPosts, U as stripeWebhookEvents, V as usageEvents, W as workspaceEnvironmentVariables, X as workspaceEnvironments, Y as workspaceMemberships, Z as workspacePacks, _ as workspaces } from './schema-fwrPBw5T.js';
+export { i as agentRunStates, j as apiKeys, k as auditEvents, l as billingCustomers, m as capabilityCatalogItems, n as capabilityInstallations, o as codexRotationSettings, p as codexSubscriptionCredentials, q as creditLedgerEntries, r as deviceEnrollmentRequests, d as deviceEnrollmentStatusValues, t as documentBases, u as documentChunks, v as documents, a as enrollmentExposureValues, e as enrollmentOsValues, b as enrollmentStatusValues, w as enrollments, x as fileUploads, y as files, z as githubInstallations, A as machineMetricsLatest, B as machineMetricsSeries, C as managedAccounts, D as packInstallations, c as sandboxKindValues, E as sandboxLeaseHolders, F as sandboxLeaseLivenessValues, G as sandboxLeases, H as sandboxPtySessions, I as sandboxSessionEnvelopes, J as sandboxes, K as scheduledTaskRuns, L as scheduledTasks, M as sessionEvents, N as sessionGoals, O as sessionHistoryItems, P as sessionMcpServers, f as sessionRecordingCodecValues, g as sessionRecordingModeValues, h as sessionRecordingStateValues, Q as sessionRecordings, R as sessionTurns, S as sessions, T as socialConnections, U as socialPosts, V as stripeWebhookEvents, W as usageEvents, X as workspaceEnvironmentVariables, Y as workspaceEnvironments, Z as workspaceMemberships, _ as workspacePacks, $ as workspaces } from './schema-BI0iqN9U.js';

package/dist/schema.js

@@ -36,6 +36,7 @@ import {
   sessionEvents,
   sessionGoals,
   sessionHistoryItems,
+  sessionMcpServers,
   sessionRecordingCodecValues,
   sessionRecordingModeValues,
   sessionRecordingStateValues,
@@ -51,7 +52,7 @@ import {
   workspaceMemberships,
   workspacePacks,
   workspaces
-} from "./chunk-PSX56ZTL.js";
+} from "./chunk-NZA6YVN7.js";
 import "./chunk-PZ5AY32C.js";
 export {
   agentRunStates,
@@ -91,6 +92,7 @@ export {
   sessionEvents,
   sessionGoals,
   sessionHistoryItems,
+  sessionMcpServers,
   sessionRecordingCodecValues,
   sessionRecordingModeValues,
   sessionRecordingStateValues,

package/drizzle/0035_session_mcp_servers.sql

@@ -0,0 +1,50 @@
+CREATE TABLE IF NOT EXISTS "session_mcp_servers" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  "account_id" uuid NOT NULL REFERENCES "managed_accounts"("id") ON DELETE CASCADE,
+  "workspace_id" uuid NOT NULL REFERENCES "workspaces"("id") ON DELETE CASCADE,
+  "session_id" uuid NOT NULL REFERENCES "sessions"("id") ON DELETE CASCADE,
+  "server_id" text NOT NULL,
+  "name" text,
+  "url" text NOT NULL,
+  "allowed_tools" jsonb,
+  "timeout_ms" integer,
+  "cache_tools_list" boolean NOT NULL DEFAULT false,
+  "headers_encrypted" jsonb NOT NULL DEFAULT '{}'::jsonb,
+  "credential_version" integer NOT NULL DEFAULT 1,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "updated_at" timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT "session_mcp_servers_allowed_tools_array_chk"
+    CHECK ("allowed_tools" IS NULL OR jsonb_typeof("allowed_tools") = 'array'),
+  CONSTRAINT "session_mcp_servers_headers_object_chk"
+    CHECK (jsonb_typeof("headers_encrypted") = 'object'),
+  CONSTRAINT "session_mcp_servers_timeout_positive_chk"
+    CHECK ("timeout_ms" IS NULL OR "timeout_ms" > 0),
+  CONSTRAINT "session_mcp_servers_credential_version_positive_chk"
+    CHECK ("credential_version" > 0)
+);
+CREATE UNIQUE INDEX IF NOT EXISTS "session_mcp_servers_session_server_idx"
+  ON "session_mcp_servers" ("workspace_id", "session_id", "server_id");
+CREATE INDEX IF NOT EXISTS "session_mcp_servers_session_idx"
+  ON "session_mcp_servers" ("workspace_id", "session_id");
+
+ALTER TABLE "session_mcp_servers" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "session_mcp_servers" FORCE ROW LEVEL SECURITY;
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM pg_policies
+    WHERE schemaname = current_schema() AND tablename = 'session_mcp_servers' AND policyname = 'workspace_isolation'
+  ) THEN
+    DROP POLICY workspace_isolation ON "session_mcp_servers";
+  END IF;
+END $$;
+CREATE POLICY workspace_isolation ON "session_mcp_servers"
+  USING (opengeni_private.workspace_rls_visible(account_id, workspace_id))
+  WITH CHECK (opengeni_private.workspace_rls_visible(account_id, workspace_id));
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO opengeni_app;
+  END IF;
+END $$;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/db",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "description": "OpenGeni persistence: Drizzle schema, RLS-scoped query layer, the SQL migration runner, and role provisioning.",
   "license": "Apache-2.0",
   "repository": {
@@ -52,8 +52,8 @@
   },
   "dependencies": {
     "@opengeni/codex": "^0.2.1",
-    "@opengeni/config": "^0.2.2",
-    "@opengeni/contracts": "^0.4.0",
+    "@opengeni/config": "^0.2.3",
+    "@opengeni/contracts": "^0.5.0",
     "drizzle-orm": "^0.45.2",
     "postgres": "^3.4.7"
   },

package/src/event-payload-sanitizer.ts

@@ -81,9 +81,66 @@ export function sanitizeEventPayload<T>(payload: T): T {
   }
   if (payload && typeof payload === "object") {
     const entries = Object.entries(payload as Record<string, unknown>).map(
-      ([key, value]) => [sanitizeEventString(key), sanitizeEventPayload(value)] as const,
+      ([key, value]) => [sanitizeEventString(key), sanitizeSensitiveEventField(key, value)] as const,
     );
     return Object.fromEntries(entries) as unknown as T;
   }
   return payload;
 }
+
+function sanitizeSensitiveEventField(key: string, value: unknown): unknown {
+  if (key === "mcpServers") {
+    return sanitizeSessionMcpServerList(value);
+  }
+  if (key === "mcpCredentialUpdates") {
+    return sanitizeMcpCredentialUpdateList(value);
+  }
+  return sanitizeEventPayload(value);
+}
+
+function sanitizeSessionMcpServerList(value: unknown): unknown {
+  if (!Array.isArray(value)) {
+    return sanitizeEventPayload(value);
+  }
+  return value.map((item) => {
+    if (!isPlainObject(item)) {
+      return sanitizeEventPayload(item);
+    }
+    const { headers, headersEncrypted, ...rest } = item;
+    const cleaned = sanitizeEventPayload(rest) as Record<string, unknown>;
+    const headerNames = safeHeaderNames(headers) ?? safeHeaderNames(headersEncrypted);
+    if (headerNames) {
+      cleaned.headerNames = headerNames;
+    }
+    return cleaned;
+  });
+}
+
+function sanitizeMcpCredentialUpdateList(value: unknown): unknown {
+  if (!Array.isArray(value)) {
+    return sanitizeEventPayload(value);
+  }
+  return value.map((item) => {
+    if (!isPlainObject(item)) {
+      return sanitizeEventPayload(item);
+    }
+    const { headers, headersEncrypted, ...rest } = item;
+    const cleaned = sanitizeEventPayload(rest) as Record<string, unknown>;
+    const headerNames = safeHeaderNames(headers) ?? safeHeaderNames(headersEncrypted);
+    if (headerNames) {
+      cleaned.headerNames = headerNames;
+    }
+    return cleaned;
+  });
+}
+
+function safeHeaderNames(value: unknown): string[] | null {
+  if (!isPlainObject(value)) {
+    return null;
+  }
+  return Object.keys(value).map(sanitizeEventString).sort();
+}
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}