@opengeni/db 0.2.2 → 0.4.0

package/dist/provision-roles.d.ts

@@ -1,8 +1,8 @@
-import { SessionEventType, Permission, CapabilityKind, CapabilitySource, ScheduledTaskStatus, ScheduledTaskScheduleSpec, ScheduledTaskRunMode, ScheduledTaskOverlapPolicy, ScheduledTaskAgentConfig, SessionGoalCreatedBy, SocialProvider, SocialConnectionStatus, SessionTurnSource, ResourceRef, ToolRef, ReasoningEffort, SandboxBackend, SessionGoal, CapabilityPack, SessionTurn, SessionEvent, SessionStatus, Session, BillingBalance, AccessContext, FileAsset, ApiKey, ScheduledTask, ScheduledTaskTriggerType, ScheduledTaskRun, SandboxOs, SocialConnection, SocialPost, Workspace, WorkspaceEnvironment, CapabilityInstallation, PackInstallation, SessionTurnStatus, CapabilityCatalogItem, FileUploadStatus, ManagedAccount, AccessGrant, WorkspaceRegisteredPack, UsageEvent, WorkspaceMember, SessionGoalStatus, WorkspaceEnvironmentVariableMetadata, PackInstallationStatus, ScheduledTaskRunStatus } from '@opengeni/contracts';
+import { SessionEventType, Permission, CapabilityKind, CapabilitySource, ScheduledTaskStatus, ScheduledTaskScheduleSpec, ScheduledTaskRunMode, ScheduledTaskOverlapPolicy, ScheduledTaskAgentConfig, SessionGoalCreatedBy, SocialProvider, SocialConnectionStatus, SessionTurnSource, ResourceRef, ToolRef, ReasoningEffort, SandboxBackend, SessionGoal, CapabilityPack, SessionMcpServerMetadata, SessionTurn, SessionEvent, SessionStatus, Session, BillingBalance, AccessContext, FileAsset, ApiKey, ScheduledTask, ScheduledTaskTriggerType, ScheduledTaskRun, SandboxOs, SocialConnection, SocialPost, Workspace, WorkspaceEnvironment, CapabilityInstallation, PackInstallation, SessionTurnStatus, CapabilityCatalogItem, FileUploadStatus, ManagedAccount, AccessGrant, WorkspaceRegisteredPack, UsageEvent, WorkspaceMember, SessionGoalStatus, WorkspaceEnvironmentVariableMetadata, PackInstallationStatus, ScheduledTaskRunStatus } from '@opengeni/contracts';
 import { environmentsEncryptionKeyBytes, Settings } from '@opengeni/config';
 import { refreshCodexToken, CodexTokenSnapshot, CodexUsagePayload } from '@opengeni/codex';
 import { PgDatabase } from 'drizzle-orm/pg-core';
-import { s as schema, e as enrollmentOsValues, a as enrollmentExposureValues, d as deviceEnrollmentStatusValues, b as enrollmentStatusValues, c as sandboxKindValues, f as sessionRecordingCodecValues, g as sessionRecordingModeValues, h as sessionRecordingStateValues } from './schema-fwrPBw5T.js';
+import { s as schema, e as enrollmentOsValues, a as enrollmentExposureValues, d as deviceEnrollmentStatusValues, b as enrollmentStatusValues, c as sandboxKindValues, f as sessionRecordingCodecValues, g as sessionRecordingModeValues, h as sessionRecordingStateValues } from './schema-DuRsrmzD.js';
 import 'drizzle-orm';
 import './migrate.js';
 
@@ -483,6 +483,29 @@ type EnabledMcpCapabilityServer = {
      */
     headersEncrypted?: Record<string, string>;
 };
+type CreateSessionMcpServerInput = {
+    id: string;
+    name?: string | null;
+    url: string;
+    allowedTools?: string[] | null;
+    timeoutMs?: number | null;
+    cacheToolsList?: boolean | null;
+    headersEncrypted?: Record<string, string>;
+};
+type UpdateSessionMcpServerCredentialsInput = {
+    id: string;
+    headersEncrypted: Record<string, string>;
+};
+type UpdateSessionMcpServerCredentialsResult = {
+    servers: SessionMcpServerMetadata[];
+    missingIds: string[];
+};
+type SessionMcpServerForRun = SessionMcpServerMetadata & {
+    allowedTools?: string[];
+    timeoutMs?: number;
+    cacheToolsList?: boolean;
+    headers: Record<string, string>;
+};
 type EnqueueSessionTurnInput = {
     accountId: string;
     workspaceId: string;
@@ -951,6 +974,19 @@ declare function recordAuditEvent(db: Database, input: {
     targetId?: string | null;
     metadata?: Record<string, unknown>;
 }): Promise<void>;
+declare function createSessionMcpServers(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sessionId: string;
+    servers: CreateSessionMcpServerInput[];
+}): Promise<SessionMcpServerMetadata[]>;
+declare function listSessionMcpServerMetadata(db: Database, workspaceId: string, sessionId: string): Promise<SessionMcpServerMetadata[]>;
+declare function updateSessionMcpServerCredentials(db: Database, input: {
+    workspaceId: string;
+    sessionId: string;
+    updates: UpdateSessionMcpServerCredentialsInput[];
+}): Promise<UpdateSessionMcpServerCredentialsResult>;
+declare function listSessionMcpServersForRun(db: Database, workspaceId: string, sessionId: string, encryptionKey: Uint8Array): Promise<SessionMcpServerForRun[]>;
 declare function createSession(db: Database, input: {
     accountId: string;
     workspaceId: string;
@@ -962,10 +998,12 @@ declare function createSession(db: Database, input: {
     sandboxBackend: SandboxBackend;
     environmentId?: string | null;
     firstPartyMcpPermissions?: Permission[] | null;
+    instructions?: string | null;
     parentSessionId?: string | null;
     createIdempotencyKey?: string | null;
     sandboxGroupId?: string | null;
     sandboxOs?: SandboxOs;
+    mcpServers?: CreateSessionMcpServerInput[];
 }): Promise<Session>;
 /**
  * Inserts a session under a workspace-scoped CREATE idempotency key, collapsing
@@ -988,10 +1026,12 @@ declare function createSessionWithIdempotencyKey(db: Database, input: {
     sandboxBackend: SandboxBackend;
     environmentId?: string | null;
     firstPartyMcpPermissions?: Permission[] | null;
+    instructions?: string | null;
     parentSessionId?: string | null;
     createIdempotencyKey: string;
     sandboxGroupId?: string | null;
     sandboxOs?: SandboxOs;
+    mcpServers?: CreateSessionMcpServerInput[];
 }): Promise<{
     session: Session;
     created: boolean;
@@ -1029,7 +1069,14 @@ declare function listSessions(db: Database, workspaceId: string, limit?: number)
  */
 declare function countActiveSessionsForWorkspace(db: Database, workspaceId: string): Promise<number>;
 declare function requireSession(db: Database, workspaceId: string, sessionId: string): Promise<Session>;
-declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string, after?: number, limit?: number): Promise<SessionEvent[]>;
+type ListSessionEventsOptions = {
+    after?: number;
+    before?: number;
+    limit?: number;
+};
+declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string): Promise<SessionEvent[]>;
+declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string, after: number, limit?: number): Promise<SessionEvent[]>;
+declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string, options: ListSessionEventsOptions): Promise<SessionEvent[]>;
 declare function getSessionEvent(db: Database, workspaceId: string, eventId: string): Promise<SessionEvent | null>;
 declare function getLatestRunState(db: Database, workspaceId: string, sessionId: string): Promise<{
     id: string;
@@ -1060,8 +1107,8 @@ declare function getSessionHistoryItems(db: Database, workspaceId: string, sessi
 }>>;
 /**
  * The LIVE conversation-truth read path: only active rows, position-ordered.
- * After a client-side context compaction this returns [active summary,
- * ...active recent tail]; with no compaction yet it equals
+ * After a client-side context compaction this returns [retained user messages,
+ * active summary]; with no compaction yet it equals
  * getSessionHistoryItems. The model-facing read path uses this so superseded
  * (summarized-away) prefix rows are excluded while the full transcript stays in
  * the table as an audit trail.
@@ -1137,8 +1184,18 @@ declare function applyContextCompaction(db: Database, input: {
     turnId?: string | null;
     /** Active prefix rows with position < boundaryPosition get superseded. */
     boundaryPosition: number;
-    /** Fractional position for the new summary row (must be < boundaryPosition). */
+    /** Position for the new summary row. Old boundary mode uses a fractional half-step before the kept tail. */
     summaryPosition: number;
+    /**
+     * Optional replacement rows inserted after superseding the old active set.
+     * Used by Codex-parity client compaction to rebuild active history as retained
+     * user messages plus one summary. These rows are synthetic replay rows, so
+     * they intentionally do not inherit the current compaction turn id.
+     */
+    replacementItems?: Array<{
+        position: number;
+        item: Record<string, unknown>;
+    }>;
     summaryItem: Record<string, unknown>;
 }): Promise<void>;
 /**
@@ -1377,6 +1434,13 @@ interface LeaseSnapshot {
     resumeState: Record<string, unknown> | null;
     expiresAt: Date;
 }
+interface LiveModalSandboxLeaseAttribution {
+    leaseId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    instanceId: string | null;
+    liveness: SandboxLeaseLiveness;
+}
 interface AcquireLeaseInput {
     accountId: string;
     workspaceId: string;
@@ -1429,6 +1493,19 @@ declare function commitWarmingToWarm(db: Database, input: {
     committed: boolean;
     lease: LeaseSnapshot | null;
 }>;
+declare function recordWarmingSandboxCreated(db: Database, input: {
+    accountId: string;
+    workspaceId: string;
+    sandboxGroupId: string;
+    expectedEpoch: number;
+    instanceId: string;
+    resumeBackendId?: string | null;
+    resumeState?: Record<string, unknown> | null;
+    leaseTtlMs: number;
+}): Promise<{
+    recorded: boolean;
+    lease: LeaseSnapshot | null;
+}>;
 declare function failWarmingToCold(db: Database, input: {
     accountId: string;
     workspaceId: string;
@@ -1482,6 +1559,7 @@ interface MeterableWarmLease {
     backend: string;
 }
 declare function listMeterableWarmLeases(db: Database): Promise<MeterableWarmLease[]>;
+declare function listLiveModalSandboxLeaseAttributions(db: Database): Promise<LiveModalSandboxLeaseAttribution[]>;
 declare function reArmDrainingLease(db: Database, input: {
     accountId: string;
     workspaceId: string;
@@ -2047,7 +2125,10 @@ declare function appendSessionEventsAndUpdateSession(db: Database, workspaceId:
     status?: SessionStatus;
     activeTurnId?: string | null;
 }): Promise<SessionEvent[]>;
-declare function appendSessionEventsWithLockedSessionUpdate(db: Database, workspaceId: string, sessionId: string, build: (session: Session) => {
+type LockedSessionUpdateContext = {
+    updateSessionMcpServerCredentials: (updates: UpdateSessionMcpServerCredentialsInput[]) => Promise<UpdateSessionMcpServerCredentialsResult>;
+};
+type LockedSessionUpdateResult = {
     events: AppendEventInput[];
     update?: {
         resources?: ResourceRef[];
@@ -2057,7 +2138,8 @@ declare function appendSessionEventsWithLockedSessionUpdate(db: Database, worksp
         status?: SessionStatus;
         activeTurnId?: string | null;
     };
-}): Promise<SessionEvent[]>;
+};
+declare function appendSessionEventsWithLockedSessionUpdate(db: Database, workspaceId: string, sessionId: string, build: (session: Session, context: LockedSessionUpdateContext) => LockedSessionUpdateResult | Promise<LockedSessionUpdateResult>): Promise<SessionEvent[]>;
 declare function sessionSubject(workspaceId: string, sessionId: string): string;
 
-export { type SessionCodexState as $, type AccrueWarmSecondsResult as A, type BootstrapWorkspaceInput as B, CLEARED_RUN_STATE as C, type Database as D, type EnableCapabilityInstallationInput as E, type EnrollmentOs as F, type EnrollmentRecord as G, type EnrollmentStatus as H, type ForceDrainResult as I, type GitHubInstallation as J, type GoalContinuationDecision as K, type LeaseHolderKind as L, type LeaseSnapshot as M, MACHINE_METRICS_SERIES_INTERVAL_MS as N, type MachineMetricsRow as O, type MachineMetricsSample as P, type ProvisionResult, type ProvisionRolesOptions, type MeterableWarmLease as Q, type ReapDrainable as R, type RegisterWorkspacePackInput as S, type RlsContext as T, type RlsStrategy as U, SandboxImageConflictError as V, type SandboxKind as W, type SandboxLeaseLiveness as X, SandboxLeaseSupersededError as Y, type SandboxPtySessionRow as Z, type SandboxRecord as _, type AcquireLeaseInput as a, decryptedCapabilityHeaders as a$, type SessionRecordingCodec as a0, type SessionRecordingMode as a1, type SessionRecordingRow as a2, type SessionRecordingState as a3, type StreamAcknowledgment as a4, type UpdateQueuedSessionTurnInput as a5, type UpdateScheduledTaskInput as a6, type UserLookup as a7, type WakeParentForChildCompletionInput as a8, type WakeParentForChildCompletionResult as a9, countActiveSessionHistoryItems as aA, countActiveSessionsForWorkspace as aB, countActiveSessionsUsingEnvironment as aC, countConsecutiveReactiveRotations as aD, countScheduledTasksForWorkspace as aE, countScheduledTasksUsingEnvironment as aF, countSessionHistoryItems as aG, countTurnSessionHistoryItems as aH, countWorkspaceEnvironments as aI, countWorkspacesForAccount as aJ, createApiKey as aK, createDb as aL, createDeviceEnrollmentRequest as aM, createEnrollment as aN, createFileUpload as aO, createSandbox as aP, createScheduledTask as aQ, createScheduledTaskRun as aR, createSession as aS, createSessionGoal as aT, createSessionWithIdempotencyKey as aU, createSocialConnection as aV, createSocialPost as aW, createTurn as aX, createWorkspace as aY, createWorkspaceEnvironment as aZ, decryptEnvironmentValue as a_, type WorkspaceEnvironmentForRun as aa, accrueWarmSeconds as ab, acquireLease as ac, allAccountPermissions as ad, allWorkspacePermissions as ae, appendSessionEvents as af, appendSessionEventsAndUpdateSession as ag, appendSessionEventsWithLockedSessionUpdate as ah, appendSessionHistoryItems as ai, applyContextCompaction as aj, applyCreditDebitUpToBalance as ak, applyCreditLedgerEntry as al, approveDeviceEnrollmentRequest as am, bootstrapWorkspace as an, buildCodexTokenResolver as ao, cancelQueuedSessionTurn as ap, claimNextQueuedTurn as aq, clearSessionContext as ar, clearedContextMarkerItem as as, closePtySession as at, commitWarmingToWarm as au, completeFileUpload as av, confirmDrainCold as aw, consumeDeviceEnrollmentRequest as ax, consumeSessionCompactionRequest as ay, countActiveApiKeysForWorkspace as az, type AcquireLeaseResult as b, hasCreditLedgerEntry as b$, deleteRecording as b0, deleteScheduledTask as b1, deleteWorkspace as b2, deleteWorkspaceEnvironment as b3, deleteWorkspaceEnvironmentVariable as b4, deleteWorkspacePack as b5, denyDeviceEnrollmentRequest as b6, disableCapabilityInstallation as b7, disconnectAllCodexAccounts as b8, disconnectCodexAccount as b9, getManagedAccount as bA, getManagedUserByEmail as bB, getOpenPtySession as bC, getPackInstallation as bD, getPendingDeviceEnrollmentRequestByUserCode as bE, getPendingDeviceEnrollmentRequestByUserCodeGlobal as bF, getRecording as bG, getSandbox as bH, getSandboxSessionEnvelope as bI, getScheduledTask as bJ, getSession as bK, getSessionByCreateIdempotencyKey as bL, getSessionCodexState as bM, getSessionEvent as bN, getSessionGoal as bO, getSessionHistoryItems as bP, getSessionTurn as bQ, getSocialConnection as bR, getStoredCapabilityHeaderCiphertext as bS, getStreamAcknowledgment as bT, getWorkspace as bU, getWorkspaceEnvironment as bV, getWorkspaceEnvironmentByName as bW, getWorkspaceEnvironmentValuesForRun as bX, getWorkspaceGrant as bY, getWorkspacePack as bZ, grantWorkspaceAccess as b_, enableCapabilityInstallation as ba, enablePackInstallation as bb, encryptEnvironmentValue as bc, enqueueSessionTurn as bd, ensureCodexRotationSettings as be, ensureManagedAccessForUser as bf, evaluateGoalContinuation as bg, failWarmingToCold as bh, fetchCodexUsageForAccount as bi, finalizeEnrollmentByToken as bj, findActiveApiKeyByHash as bk, finishTurn as bl, forceDrainOverLimitViewerOnlyBoxes as bm, getActiveSessionHistoryItems as bn, getAnySessionInGroup as bo, getBillingBalance as bp, getBillingCustomer as bq, getCapabilityCatalogItem as br, getCapabilityInstallation as bs, getCodexCredentialStatus as bt, getCodexRotationSettings as bu, getDeviceEnrollmentRequestByDeviceCode as bv, getEnrollment as bw, getFile as bx, getFileUpload as by, getLatestRunState as bz, type ActiveSandboxPointer as c, releaseLeaseHolder as c$, heartbeatLeaseHolder as c0, incrementTurnWorkerDeathRedispatches as c1, ingestMachineMetricsSample as c2, insertMachineMetricsSeries as c3, insertPtySession as c4, insertRecording as c5, isCodexBilledTurn as c6, isStripeWebhookProcessed as c7, listApiKeys as c8, listCapabilityCatalogItems as c9, loadWorkspaceEnvironmentForRun as cA, markFileUploadFailed as cB, markStripeWebhookProcessed as cC, mcpServerIdForCapability as cD, nextSessionHistoryPosition as cE, orphanedResultRowIndicesForRepair as cF, persistDrainSnapshot as cG, reArmDrainingLease as cH, readActiveSandbox as cI, readLease as cJ, readMachineMetricsLatest as cK, readMachineMetricsLatestForWorkspace as cL, readMachineMetricsSeries as cM, reapStaleLeaseHolders as cN, reapStaleLeaseHoldersGlobal as cO, recordAuditEvent as cP, recordCodexAccountConnectors as cQ, recordCodexAccountUsage as cR, recordCodexTokenRefresh as cS, recordLeaseDataPlaneUrl as cT, recordLeaseTerminalDataPlaneUrl as cU, recordSessionActiveCodexCredential as cV, recordStreamAcknowledgment as cW, recordStripeWebhookEvent as cX, recordUsageEvent as cY, registerDbBinding as cZ, registerWorkspacePack as c_, listCapabilityInstallations as ca, listCodexAccountStatuses as cb, listDistinctEnvironmentIdsInGroup as cc, listEnabledMcpCapabilityServers as cd, listEnrollments as ce, listGitHubInstallationIdsForWorkspace as cf, listGitHubInstallationsForWorkspace as cg, listMeterableWarmLeases as ch, listOpenPtySessions as ci, listPackInstallations as cj, listRecordings as ck, listSandboxes as cl, listScheduledTaskRuns as cm, listScheduledTasks as cn, listSessionEvents as co, listSessionIdsInGroup as cp, listSessionTurns as cq, listSessions as cr, listSocialConnections as cs, listSocialPosts as ct, listUsageEvents as cu, listWorkspaceEnvironments as cv, listWorkspaceMembers as cw, listWorkspacePacks as cx, listWorkspacesForSubject as cy, loadCodexCredentialForRun as cz, type AppendEventInput as d, removeWorkspaceMember as d0, renameCodexAccount as d1, reorderQueuedSessionTurns as d2, requestSessionCompaction as d3, requeuePreemptedTurn as d4, requireFile as d5, requireScheduledTask as d6, requireSession as d7, requireSocialConnection as d8, requireWorkspace as d9, updatePackInstallationStatus as dA, updatePtySessionActivity as dB, updateQueuedSessionTurn as dC, updateRecording as dD, updateScheduledTask as dE, updateScheduledTaskRun as dF, updateSessionGoal as dG, updateSessionTitle as dH, updateWorkspace as dI, updateWorkspaceEnvironment as dJ, upsertBillingCustomer as dK, upsertCapabilityCatalogItem as dL, upsertCodexSubscriptionCredential as dM, upsertGitHubInstallation as dN, upsertMachineMetricsLatest as dO, upsertSandboxSessionEnvelope as dP, upsertSessionGoal as dQ, wakeParentSessionForChildCompletion as dR, withAccountRls as dS, withRlsContext as dT, withWorkspaceRls as dU, withWorkspaceUsageLock as dV, workspaceCodexSubscriptionActive as dW, revokeApiKey as da, revokeEnrollment as db, revokeViewer as dc, rlsContextForWorkspace as dd, rlsStrategyFor as de, sanitizeEventPayload as df, sanitizeEventString as dg, saveRunState as dh, sessionSubject as di, setActiveCodexCredential as dj, setActiveSandbox as dk, setCodexCredentialExhausted as dl, setCodexCredentialStatus as dm, setEnrollmentHasDisplay as dn, setRlsContext as dp, setSessionCodexPin as dq, setSessionGoalLastContinuationTurn as dr, setSessionGoalStatus as ds, setSessionLastInputTokens as dt, setSessionStatus as du, setTemporalWorkflowId as dv, setWorkspaceEnvironmentVariable as dw, sumUsageQuantity as dx, touchEnrollmentLastSeen as dy, updateCodexRotationSettings as dz, CODEX_ROTATION_STRATEGIES as e, type ClearSessionContextResult as f, type CodexAccountStatus as g, type CodexAccountUsageSnapshot as h, type CodexAuthDeps as i, type CodexCredentialForRun as j, type CodexCredentialTokens as k, type CodexRotationSettings as l, type CodexRotationStrategy as m, type CreateCapabilityCatalogItemInput as n, type CreateDbOptions as o, type CreatePackInstallationInput as p, provisionRoles, type CreateScheduledTaskInput as q, type CreateSessionGoalInput as r, type CreateSocialConnectionInput as s, type CreateSocialPostInput as t, type DbClient as u, type DeviceEnrollmentRequestRecord as v, type DeviceEnrollmentStatus as w, type EnabledMcpCapabilityServer as x, type EnqueueSessionTurnInput as y, type EnrollmentExposure as z };
+export { SandboxLeaseSupersededError as $, type AccrueWarmSecondsResult as A, type BootstrapWorkspaceInput as B, CLEARED_RUN_STATE as C, type Database as D, type EnableCapabilityInstallationInput as E, type EnrollmentExposure as F, type EnrollmentOs as G, type EnrollmentRecord as H, type EnrollmentStatus as I, type ForceDrainResult as J, type GitHubInstallation as K, type GoalContinuationDecision as L, type LeaseHolderKind as M, type LeaseSnapshot as N, type ListSessionEventsOptions as O, type LiveModalSandboxLeaseAttribution as P, type ProvisionResult, type ProvisionRolesOptions, MACHINE_METRICS_SERIES_INTERVAL_MS as Q, type MachineMetricsRow as R, type MachineMetricsSample as S, type MeterableWarmLease as T, type ReapDrainable as U, type RegisterWorkspacePackInput as V, type RlsContext as W, type RlsStrategy as X, SandboxImageConflictError as Y, type SandboxKind as Z, type SandboxLeaseLiveness as _, type AcquireLeaseInput as a, createSessionWithIdempotencyKey as a$, type SandboxPtySessionRow as a0, type SandboxRecord as a1, type SessionCodexState as a2, type SessionMcpServerForRun as a3, type SessionRecordingCodec as a4, type SessionRecordingMode as a5, type SessionRecordingRow as a6, type SessionRecordingState as a7, type StreamAcknowledgment as a8, type UpdateQueuedSessionTurnInput as a9, commitWarmingToWarm as aA, completeFileUpload as aB, confirmDrainCold as aC, consumeDeviceEnrollmentRequest as aD, consumeSessionCompactionRequest as aE, countActiveApiKeysForWorkspace as aF, countActiveSessionHistoryItems as aG, countActiveSessionsForWorkspace as aH, countActiveSessionsUsingEnvironment as aI, countConsecutiveReactiveRotations as aJ, countScheduledTasksForWorkspace as aK, countScheduledTasksUsingEnvironment as aL, countSessionHistoryItems as aM, countTurnSessionHistoryItems as aN, countWorkspaceEnvironments as aO, countWorkspacesForAccount as aP, createApiKey as aQ, createDb as aR, createDeviceEnrollmentRequest as aS, createEnrollment as aT, createFileUpload as aU, createSandbox as aV, createScheduledTask as aW, createScheduledTaskRun as aX, createSession as aY, createSessionGoal as aZ, createSessionMcpServers as a_, type UpdateScheduledTaskInput as aa, type UpdateSessionMcpServerCredentialsInput as ab, type UpdateSessionMcpServerCredentialsResult as ac, type UserLookup as ad, type WakeParentForChildCompletionInput as ae, type WakeParentForChildCompletionResult as af, type WorkspaceEnvironmentForRun as ag, accrueWarmSeconds as ah, acquireLease as ai, allAccountPermissions as aj, allWorkspacePermissions as ak, appendSessionEvents as al, appendSessionEventsAndUpdateSession as am, appendSessionEventsWithLockedSessionUpdate as an, appendSessionHistoryItems as ao, applyContextCompaction as ap, applyCreditDebitUpToBalance as aq, applyCreditLedgerEntry as ar, approveDeviceEnrollmentRequest as as, bootstrapWorkspace as at, buildCodexTokenResolver as au, cancelQueuedSessionTurn as av, claimNextQueuedTurn as aw, clearSessionContext as ax, clearedContextMarkerItem as ay, closePtySession as az, type AcquireLeaseResult as b, getWorkspace as b$, createSocialConnection as b0, createSocialPost as b1, createTurn as b2, createWorkspace as b3, createWorkspaceEnvironment as b4, decryptEnvironmentValue as b5, decryptedCapabilityHeaders as b6, deleteRecording as b7, deleteScheduledTask as b8, deleteWorkspace as b9, getCodexCredentialStatus as bA, getCodexRotationSettings as bB, getDeviceEnrollmentRequestByDeviceCode as bC, getEnrollment as bD, getFile as bE, getFileUpload as bF, getLatestRunState as bG, getManagedAccount as bH, getManagedUserByEmail as bI, getOpenPtySession as bJ, getPackInstallation as bK, getPendingDeviceEnrollmentRequestByUserCode as bL, getPendingDeviceEnrollmentRequestByUserCodeGlobal as bM, getRecording as bN, getSandbox as bO, getSandboxSessionEnvelope as bP, getScheduledTask as bQ, getSession as bR, getSessionByCreateIdempotencyKey as bS, getSessionCodexState as bT, getSessionEvent as bU, getSessionGoal as bV, getSessionHistoryItems as bW, getSessionTurn as bX, getSocialConnection as bY, getStoredCapabilityHeaderCiphertext as bZ, getStreamAcknowledgment as b_, deleteWorkspaceEnvironment as ba, deleteWorkspaceEnvironmentVariable as bb, deleteWorkspacePack as bc, denyDeviceEnrollmentRequest as bd, disableCapabilityInstallation as be, disconnectAllCodexAccounts as bf, disconnectCodexAccount as bg, enableCapabilityInstallation as bh, enablePackInstallation as bi, encryptEnvironmentValue as bj, enqueueSessionTurn as bk, ensureCodexRotationSettings as bl, ensureManagedAccessForUser as bm, evaluateGoalContinuation as bn, failWarmingToCold as bo, fetchCodexUsageForAccount as bp, finalizeEnrollmentByToken as bq, findActiveApiKeyByHash as br, finishTurn as bs, forceDrainOverLimitViewerOnlyBoxes as bt, getActiveSessionHistoryItems as bu, getAnySessionInGroup as bv, getBillingBalance as bw, getBillingCustomer as bx, getCapabilityCatalogItem as by, getCapabilityInstallation as bz, type ActiveSandboxPointer as c, recordCodexAccountUsage as c$, getWorkspaceEnvironment as c0, getWorkspaceEnvironmentByName as c1, getWorkspaceEnvironmentValuesForRun as c2, getWorkspaceGrant as c3, getWorkspacePack as c4, grantWorkspaceAccess as c5, hasCreditLedgerEntry as c6, heartbeatLeaseHolder as c7, incrementTurnWorkerDeathRedispatches as c8, ingestMachineMetricsSample as c9, listSessionTurns as cA, listSessions as cB, listSocialConnections as cC, listSocialPosts as cD, listUsageEvents as cE, listWorkspaceEnvironments as cF, listWorkspaceMembers as cG, listWorkspacePacks as cH, listWorkspacesForSubject as cI, loadCodexCredentialForRun as cJ, loadWorkspaceEnvironmentForRun as cK, markFileUploadFailed as cL, markStripeWebhookProcessed as cM, mcpServerIdForCapability as cN, nextSessionHistoryPosition as cO, orphanedResultRowIndicesForRepair as cP, persistDrainSnapshot as cQ, reArmDrainingLease as cR, readActiveSandbox as cS, readLease as cT, readMachineMetricsLatest as cU, readMachineMetricsLatestForWorkspace as cV, readMachineMetricsSeries as cW, reapStaleLeaseHolders as cX, reapStaleLeaseHoldersGlobal as cY, recordAuditEvent as cZ, recordCodexAccountConnectors as c_, insertMachineMetricsSeries as ca, insertPtySession as cb, insertRecording as cc, isCodexBilledTurn as cd, isStripeWebhookProcessed as ce, listApiKeys as cf, listCapabilityCatalogItems as cg, listCapabilityInstallations as ch, listCodexAccountStatuses as ci, listDistinctEnvironmentIdsInGroup as cj, listEnabledMcpCapabilityServers as ck, listEnrollments as cl, listGitHubInstallationIdsForWorkspace as cm, listGitHubInstallationsForWorkspace as cn, listLiveModalSandboxLeaseAttributions as co, listMeterableWarmLeases as cp, listOpenPtySessions as cq, listPackInstallations as cr, listRecordings as cs, listSandboxes as ct, listScheduledTaskRuns as cu, listScheduledTasks as cv, listSessionEvents as cw, listSessionIdsInGroup as cx, listSessionMcpServerMetadata as cy, listSessionMcpServersForRun as cz, type AppendEventInput as d, upsertSandboxSessionEnvelope as d$, recordCodexTokenRefresh as d0, recordLeaseDataPlaneUrl as d1, recordLeaseTerminalDataPlaneUrl as d2, recordSessionActiveCodexCredential as d3, recordStreamAcknowledgment as d4, recordStripeWebhookEvent as d5, recordUsageEvent as d6, recordWarmingSandboxCreated as d7, registerDbBinding as d8, registerWorkspacePack as d9, setRlsContext as dA, setSessionCodexPin as dB, setSessionGoalLastContinuationTurn as dC, setSessionGoalStatus as dD, setSessionLastInputTokens as dE, setSessionStatus as dF, setTemporalWorkflowId as dG, setWorkspaceEnvironmentVariable as dH, sumUsageQuantity as dI, touchEnrollmentLastSeen as dJ, updateCodexRotationSettings as dK, updatePackInstallationStatus as dL, updatePtySessionActivity as dM, updateQueuedSessionTurn as dN, updateRecording as dO, updateScheduledTask as dP, updateScheduledTaskRun as dQ, updateSessionGoal as dR, updateSessionMcpServerCredentials as dS, updateSessionTitle as dT, updateWorkspace as dU, updateWorkspaceEnvironment as dV, upsertBillingCustomer as dW, upsertCapabilityCatalogItem as dX, upsertCodexSubscriptionCredential as dY, upsertGitHubInstallation as dZ, upsertMachineMetricsLatest as d_, releaseLeaseHolder as da, removeWorkspaceMember as db, renameCodexAccount as dc, reorderQueuedSessionTurns as dd, requestSessionCompaction as de, requeuePreemptedTurn as df, requireFile as dg, requireScheduledTask as dh, requireSession as di, requireSocialConnection as dj, requireWorkspace as dk, revokeApiKey as dl, revokeEnrollment as dm, revokeViewer as dn, rlsContextForWorkspace as dp, rlsStrategyFor as dq, sanitizeEventPayload as dr, sanitizeEventString as ds, saveRunState as dt, sessionSubject as du, setActiveCodexCredential as dv, setActiveSandbox as dw, setCodexCredentialExhausted as dx, setCodexCredentialStatus as dy, setEnrollmentHasDisplay as dz, CODEX_ROTATION_STRATEGIES as e, upsertSessionGoal as e0, wakeParentSessionForChildCompletion as e1, withAccountRls as e2, withRlsContext as e3, withWorkspaceRls as e4, withWorkspaceUsageLock as e5, workspaceCodexSubscriptionActive as e6, type ClearSessionContextResult as f, type CodexAccountStatus as g, type CodexAccountUsageSnapshot as h, type CodexAuthDeps as i, type CodexCredentialForRun as j, type CodexCredentialTokens as k, type CodexRotationSettings as l, type CodexRotationStrategy as m, type CreateCapabilityCatalogItemInput as n, type CreateDbOptions as o, type CreatePackInstallationInput as p, provisionRoles, type CreateScheduledTaskInput as q, type CreateSessionGoalInput as r, type CreateSessionMcpServerInput as s, type CreateSocialConnectionInput as t, type CreateSocialPostInput as u, type DbClient as v, type DeviceEnrollmentRequestRecord as w, type DeviceEnrollmentStatus as x, type EnabledMcpCapabilityServer as y, type EnqueueSessionTurnInput as z };

package/dist/{schema-fwrPBw5T.d.ts → schema-DuRsrmzD.d.ts}

@@ -1655,6 +1655,23 @@ declare const sessions: drizzle_orm_pg_core.PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        instructions: drizzle_orm_pg_core.PgColumn<{
+            name: "instructions";
+            tableName: "sessions";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         resources: drizzle_orm_pg_core.PgColumn<{
             name: "resources";
             tableName: "sessions";
@@ -2057,6 +2074,255 @@ declare const sessions: drizzle_orm_pg_core.PgTableWithColumns<{
     };
     dialect: "pg";
 }>;
+declare const sessionMcpServers: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "session_mcp_servers";
+    schema: undefined;
+    columns: {
+        id: drizzle_orm_pg_core.PgColumn<{
+            name: "id";
+            tableName: "session_mcp_servers";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        accountId: drizzle_orm_pg_core.PgColumn<{
+            name: "account_id";
+            tableName: "session_mcp_servers";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        workspaceId: drizzle_orm_pg_core.PgColumn<{
+            name: "workspace_id";
+            tableName: "session_mcp_servers";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        sessionId: drizzle_orm_pg_core.PgColumn<{
+            name: "session_id";
+            tableName: "session_mcp_servers";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        serverId: drizzle_orm_pg_core.PgColumn<{
+            name: "server_id";
+            tableName: "session_mcp_servers";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        name: drizzle_orm_pg_core.PgColumn<{
+            name: "name";
+            tableName: "session_mcp_servers";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        url: drizzle_orm_pg_core.PgColumn<{
+            name: "url";
+            tableName: "session_mcp_servers";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        allowedTools: drizzle_orm_pg_core.PgColumn<{
+            name: "allowed_tools";
+            tableName: "session_mcp_servers";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: string[];
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: string[];
+        }>;
+        timeoutMs: drizzle_orm_pg_core.PgColumn<{
+            name: "timeout_ms";
+            tableName: "session_mcp_servers";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        cacheToolsList: drizzle_orm_pg_core.PgColumn<{
+            name: "cache_tools_list";
+            tableName: "session_mcp_servers";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        headersEncrypted: drizzle_orm_pg_core.PgColumn<{
+            name: "headers_encrypted";
+            tableName: "session_mcp_servers";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, string>;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, string>;
+        }>;
+        credentialVersion: drizzle_orm_pg_core.PgColumn<{
+            name: "credential_version";
+            tableName: "session_mcp_servers";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: drizzle_orm_pg_core.PgColumn<{
+            name: "created_at";
+            tableName: "session_mcp_servers";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: drizzle_orm_pg_core.PgColumn<{
+            name: "updated_at";
+            tableName: "session_mcp_servers";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
 declare const files: drizzle_orm_pg_core.PgTableWithColumns<{
     name: "files";
     schema: undefined;
@@ -9683,6 +9949,7 @@ declare const schema_scheduledTasks: typeof scheduledTasks;
 declare const schema_sessionEvents: typeof sessionEvents;
 declare const schema_sessionGoals: typeof sessionGoals;
 declare const schema_sessionHistoryItems: typeof sessionHistoryItems;
+declare const schema_sessionMcpServers: typeof sessionMcpServers;
 declare const schema_sessionRecordingCodecValues: typeof sessionRecordingCodecValues;
 declare const schema_sessionRecordingModeValues: typeof sessionRecordingModeValues;
 declare const schema_sessionRecordingStateValues: typeof sessionRecordingStateValues;
@@ -9699,7 +9966,7 @@ declare const schema_workspaceMemberships: typeof workspaceMemberships;
 declare const schema_workspacePacks: typeof workspacePacks;
 declare const schema_workspaces: typeof workspaces;
 declare namespace schema {
-  export { schema_agentRunStates as agentRunStates, schema_apiKeys as apiKeys, schema_auditEvents as auditEvents, schema_billingCustomers as billingCustomers, schema_capabilityCatalogItems as capabilityCatalogItems, schema_capabilityInstallations as capabilityInstallations, schema_codexRotationSettings as codexRotationSettings, schema_codexSubscriptionCredentials as codexSubscriptionCredentials, schema_creditLedgerEntries as creditLedgerEntries, schema_deviceEnrollmentRequests as deviceEnrollmentRequests, schema_deviceEnrollmentStatusValues as deviceEnrollmentStatusValues, schema_documentBases as documentBases, schema_documentChunks as documentChunks, schema_documents as documents, schema_enrollmentExposureValues as enrollmentExposureValues, schema_enrollmentOsValues as enrollmentOsValues, schema_enrollmentStatusValues as enrollmentStatusValues, schema_enrollments as enrollments, schema_fileUploads as fileUploads, schema_files as files, schema_githubInstallations as githubInstallations, schema_machineMetricsLatest as machineMetricsLatest, schema_machineMetricsSeries as machineMetricsSeries, schema_managedAccounts as managedAccounts, schema_packInstallations as packInstallations, schema_sandboxKindValues as sandboxKindValues, schema_sandboxLeaseHolders as sandboxLeaseHolders, schema_sandboxLeaseLivenessValues as sandboxLeaseLivenessValues, schema_sandboxLeases as sandboxLeases, schema_sandboxPtySessions as sandboxPtySessions, schema_sandboxSessionEnvelopes as sandboxSessionEnvelopes, schema_sandboxes as sandboxes, schema_scheduledTaskRuns as scheduledTaskRuns, schema_scheduledTasks as scheduledTasks, schema_sessionEvents as sessionEvents, schema_sessionGoals as sessionGoals, schema_sessionHistoryItems as sessionHistoryItems, schema_sessionRecordingCodecValues as sessionRecordingCodecValues, schema_sessionRecordingModeValues as sessionRecordingModeValues, schema_sessionRecordingStateValues as sessionRecordingStateValues, schema_sessionRecordings as sessionRecordings, schema_sessionTurns as sessionTurns, schema_sessions as sessions, schema_socialConnections as socialConnections, schema_socialPosts as socialPosts, schema_stripeWebhookEvents as stripeWebhookEvents, schema_usageEvents as usageEvents, schema_workspaceEnvironmentVariables as workspaceEnvironmentVariables, schema_workspaceEnvironments as workspaceEnvironments, schema_workspaceMemberships as workspaceMemberships, schema_workspacePacks as workspacePacks, schema_workspaces as workspaces };
+  export { schema_agentRunStates as agentRunStates, schema_apiKeys as apiKeys, schema_auditEvents as auditEvents, schema_billingCustomers as billingCustomers, schema_capabilityCatalogItems as capabilityCatalogItems, schema_capabilityInstallations as capabilityInstallations, schema_codexRotationSettings as codexRotationSettings, schema_codexSubscriptionCredentials as codexSubscriptionCredentials, schema_creditLedgerEntries as creditLedgerEntries, schema_deviceEnrollmentRequests as deviceEnrollmentRequests, schema_deviceEnrollmentStatusValues as deviceEnrollmentStatusValues, schema_documentBases as documentBases, schema_documentChunks as documentChunks, schema_documents as documents, schema_enrollmentExposureValues as enrollmentExposureValues, schema_enrollmentOsValues as enrollmentOsValues, schema_enrollmentStatusValues as enrollmentStatusValues, schema_enrollments as enrollments, schema_fileUploads as fileUploads, schema_files as files, schema_githubInstallations as githubInstallations, schema_machineMetricsLatest as machineMetricsLatest, schema_machineMetricsSeries as machineMetricsSeries, schema_managedAccounts as managedAccounts, schema_packInstallations as packInstallations, schema_sandboxKindValues as sandboxKindValues, schema_sandboxLeaseHolders as sandboxLeaseHolders, schema_sandboxLeaseLivenessValues as sandboxLeaseLivenessValues, schema_sandboxLeases as sandboxLeases, schema_sandboxPtySessions as sandboxPtySessions, schema_sandboxSessionEnvelopes as sandboxSessionEnvelopes, schema_sandboxes as sandboxes, schema_scheduledTaskRuns as scheduledTaskRuns, schema_scheduledTasks as scheduledTasks, schema_sessionEvents as sessionEvents, schema_sessionGoals as sessionGoals, schema_sessionHistoryItems as sessionHistoryItems, schema_sessionMcpServers as sessionMcpServers, schema_sessionRecordingCodecValues as sessionRecordingCodecValues, schema_sessionRecordingModeValues as sessionRecordingModeValues, schema_sessionRecordingStateValues as sessionRecordingStateValues, schema_sessionRecordings as sessionRecordings, schema_sessionTurns as sessionTurns, schema_sessions as sessions, schema_socialConnections as socialConnections, schema_socialPosts as socialPosts, schema_stripeWebhookEvents as stripeWebhookEvents, schema_usageEvents as usageEvents, schema_workspaceEnvironmentVariables as workspaceEnvironmentVariables, schema_workspaceEnvironments as workspaceEnvironments, schema_workspaceMemberships as workspaceMemberships, schema_workspacePacks as workspacePacks, schema_workspaces as workspaces };
 }
 
-export { machineMetricsLatest as A, machineMetricsSeries as B, managedAccounts as C, packInstallations as D, sandboxLeaseHolders as E, sandboxLeaseLivenessValues as F, sandboxLeases as G, sandboxPtySessions as H, sandboxSessionEnvelopes as I, sandboxes as J, scheduledTaskRuns as K, scheduledTasks as L, sessionEvents as M, sessionGoals as N, sessionHistoryItems as O, sessionRecordings as P, sessionTurns as Q, sessions as R, socialConnections as S, socialPosts as T, stripeWebhookEvents as U, usageEvents as V, workspaceEnvironmentVariables as W, workspaceEnvironments as X, workspaceMemberships as Y, workspacePacks as Z, workspaces as _, enrollmentExposureValues as a, enrollmentStatusValues as b, sandboxKindValues as c, deviceEnrollmentStatusValues as d, enrollmentOsValues as e, sessionRecordingCodecValues as f, sessionRecordingModeValues as g, sessionRecordingStateValues as h, agentRunStates as i, apiKeys as j, auditEvents as k, billingCustomers as l, capabilityCatalogItems as m, capabilityInstallations as n, codexRotationSettings as o, codexSubscriptionCredentials as p, creditLedgerEntries as q, deviceEnrollmentRequests as r, schema as s, documentBases as t, documentChunks as u, documents as v, enrollments as w, fileUploads as x, files as y, githubInstallations as z };
+export { workspaces as $, machineMetricsLatest as A, machineMetricsSeries as B, managedAccounts as C, packInstallations as D, sandboxLeaseHolders as E, sandboxLeaseLivenessValues as F, sandboxLeases as G, sandboxPtySessions as H, sandboxSessionEnvelopes as I, sandboxes as J, scheduledTaskRuns as K, scheduledTasks as L, sessionEvents as M, sessionGoals as N, sessionHistoryItems as O, sessionMcpServers as P, sessionRecordings as Q, sessionTurns as R, sessions as S, socialConnections as T, socialPosts as U, stripeWebhookEvents as V, usageEvents as W, workspaceEnvironmentVariables as X, workspaceEnvironments as Y, workspaceMemberships as Z, workspacePacks as _, enrollmentExposureValues as a, enrollmentStatusValues as b, sandboxKindValues as c, deviceEnrollmentStatusValues as d, enrollmentOsValues as e, sessionRecordingCodecValues as f, sessionRecordingModeValues as g, sessionRecordingStateValues as h, agentRunStates as i, apiKeys as j, auditEvents as k, billingCustomers as l, capabilityCatalogItems as m, capabilityInstallations as n, codexRotationSettings as o, codexSubscriptionCredentials as p, creditLedgerEntries as q, deviceEnrollmentRequests as r, schema as s, documentBases as t, documentChunks as u, documents as v, enrollments as w, fileUploads as x, files as y, githubInstallations as z };

package/dist/schema.d.ts

@@ -1,3 +1,3 @@
 import 'drizzle-orm';
 import 'drizzle-orm/pg-core';
-export { i as agentRunStates, j as apiKeys, k as auditEvents, l as billingCustomers, m as capabilityCatalogItems, n as capabilityInstallations, o as codexRotationSettings, p as codexSubscriptionCredentials, q as creditLedgerEntries, r as deviceEnrollmentRequests, d as deviceEnrollmentStatusValues, t as documentBases, u as documentChunks, v as documents, a as enrollmentExposureValues, e as enrollmentOsValues, b as enrollmentStatusValues, w as enrollments, x as fileUploads, y as files, z as githubInstallations, A as machineMetricsLatest, B as machineMetricsSeries, C as managedAccounts, D as packInstallations, c as sandboxKindValues, E as sandboxLeaseHolders, F as sandboxLeaseLivenessValues, G as sandboxLeases, H as sandboxPtySessions, I as sandboxSessionEnvelopes, J as sandboxes, K as scheduledTaskRuns, L as scheduledTasks, M as sessionEvents, N as sessionGoals, O as sessionHistoryItems, f as sessionRecordingCodecValues, g as sessionRecordingModeValues, h as sessionRecordingStateValues, P as sessionRecordings, Q as sessionTurns, R as sessions, S as socialConnections, T as socialPosts, U as stripeWebhookEvents, V as usageEvents, W as workspaceEnvironmentVariables, X as workspaceEnvironments, Y as workspaceMemberships, Z as workspacePacks, _ as workspaces } from './schema-fwrPBw5T.js';
+export { i as agentRunStates, j as apiKeys, k as auditEvents, l as billingCustomers, m as capabilityCatalogItems, n as capabilityInstallations, o as codexRotationSettings, p as codexSubscriptionCredentials, q as creditLedgerEntries, r as deviceEnrollmentRequests, d as deviceEnrollmentStatusValues, t as documentBases, u as documentChunks, v as documents, a as enrollmentExposureValues, e as enrollmentOsValues, b as enrollmentStatusValues, w as enrollments, x as fileUploads, y as files, z as githubInstallations, A as machineMetricsLatest, B as machineMetricsSeries, C as managedAccounts, D as packInstallations, c as sandboxKindValues, E as sandboxLeaseHolders, F as sandboxLeaseLivenessValues, G as sandboxLeases, H as sandboxPtySessions, I as sandboxSessionEnvelopes, J as sandboxes, K as scheduledTaskRuns, L as scheduledTasks, M as sessionEvents, N as sessionGoals, O as sessionHistoryItems, P as sessionMcpServers, f as sessionRecordingCodecValues, g as sessionRecordingModeValues, h as sessionRecordingStateValues, Q as sessionRecordings, R as sessionTurns, S as sessions, T as socialConnections, U as socialPosts, V as stripeWebhookEvents, W as usageEvents, X as workspaceEnvironmentVariables, Y as workspaceEnvironments, Z as workspaceMemberships, _ as workspacePacks, $ as workspaces } from './schema-DuRsrmzD.js';

package/dist/schema.js

@@ -36,6 +36,7 @@ import {
   sessionEvents,
   sessionGoals,
   sessionHistoryItems,
+  sessionMcpServers,
   sessionRecordingCodecValues,
   sessionRecordingModeValues,
   sessionRecordingStateValues,
@@ -51,7 +52,7 @@ import {
   workspaceMemberships,
   workspacePacks,
   workspaces
-} from "./chunk-PSX56ZTL.js";
+} from "./chunk-T2U4H4Z2.js";
 import "./chunk-PZ5AY32C.js";
 export {
   agentRunStates,
@@ -91,6 +92,7 @@ export {
   sessionEvents,
   sessionGoals,
   sessionHistoryItems,
+  sessionMcpServers,
   sessionRecordingCodecValues,
   sessionRecordingModeValues,
   sessionRecordingStateValues,

package/drizzle/0035_session_mcp_servers.sql

@@ -0,0 +1,50 @@
+CREATE TABLE IF NOT EXISTS "session_mcp_servers" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  "account_id" uuid NOT NULL REFERENCES "managed_accounts"("id") ON DELETE CASCADE,
+  "workspace_id" uuid NOT NULL REFERENCES "workspaces"("id") ON DELETE CASCADE,
+  "session_id" uuid NOT NULL REFERENCES "sessions"("id") ON DELETE CASCADE,
+  "server_id" text NOT NULL,
+  "name" text,
+  "url" text NOT NULL,
+  "allowed_tools" jsonb,
+  "timeout_ms" integer,
+  "cache_tools_list" boolean NOT NULL DEFAULT false,
+  "headers_encrypted" jsonb NOT NULL DEFAULT '{}'::jsonb,
+  "credential_version" integer NOT NULL DEFAULT 1,
+  "created_at" timestamptz NOT NULL DEFAULT now(),
+  "updated_at" timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT "session_mcp_servers_allowed_tools_array_chk"
+    CHECK ("allowed_tools" IS NULL OR jsonb_typeof("allowed_tools") = 'array'),
+  CONSTRAINT "session_mcp_servers_headers_object_chk"
+    CHECK (jsonb_typeof("headers_encrypted") = 'object'),
+  CONSTRAINT "session_mcp_servers_timeout_positive_chk"
+    CHECK ("timeout_ms" IS NULL OR "timeout_ms" > 0),
+  CONSTRAINT "session_mcp_servers_credential_version_positive_chk"
+    CHECK ("credential_version" > 0)
+);
+CREATE UNIQUE INDEX IF NOT EXISTS "session_mcp_servers_session_server_idx"
+  ON "session_mcp_servers" ("workspace_id", "session_id", "server_id");
+CREATE INDEX IF NOT EXISTS "session_mcp_servers_session_idx"
+  ON "session_mcp_servers" ("workspace_id", "session_id");
+
+ALTER TABLE "session_mcp_servers" ENABLE ROW LEVEL SECURITY;
+ALTER TABLE "session_mcp_servers" FORCE ROW LEVEL SECURITY;
+DO $$
+BEGIN
+  IF EXISTS (
+    SELECT 1 FROM pg_policies
+    WHERE schemaname = current_schema() AND tablename = 'session_mcp_servers' AND policyname = 'workspace_isolation'
+  ) THEN
+    DROP POLICY workspace_isolation ON "session_mcp_servers";
+  END IF;
+END $$;
+CREATE POLICY workspace_isolation ON "session_mcp_servers"
+  USING (opengeni_private.workspace_rls_visible(account_id, workspace_id))
+  WITH CHECK (opengeni_private.workspace_rls_visible(account_id, workspace_id));
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'opengeni_app') THEN
+    GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO opengeni_app;
+  END IF;
+END $$;