@opengeni/db 0.4.0 → 0.6.0

package/dist/provision-roles.d.ts

@@ -1,8 +1,8 @@
-import { SessionEventType, Permission, CapabilityKind, CapabilitySource, ScheduledTaskStatus, ScheduledTaskScheduleSpec, ScheduledTaskRunMode, ScheduledTaskOverlapPolicy, ScheduledTaskAgentConfig, SessionGoalCreatedBy, SocialProvider, SocialConnectionStatus, SessionTurnSource, ResourceRef, ToolRef, ReasoningEffort, SandboxBackend, SessionGoal, CapabilityPack, SessionMcpServerMetadata, SessionTurn, SessionEvent, SessionStatus, Session, BillingBalance, AccessContext, FileAsset, ApiKey, ScheduledTask, ScheduledTaskTriggerType, ScheduledTaskRun, SandboxOs, SocialConnection, SocialPost, Workspace, WorkspaceEnvironment, CapabilityInstallation, PackInstallation, SessionTurnStatus, CapabilityCatalogItem, FileUploadStatus, ManagedAccount, AccessGrant, WorkspaceRegisteredPack, UsageEvent, WorkspaceMember, SessionGoalStatus, WorkspaceEnvironmentVariableMetadata, PackInstallationStatus, ScheduledTaskRunStatus } from '@opengeni/contracts';
-import { environmentsEncryptionKeyBytes, Settings } from '@opengeni/config';
+import { SessionEventType, Permission, ConnectionKind, ConnectionStatus, CapabilityKind, CapabilitySource, KnowledgeMemoryStatus, KnowledgeMemoryKind, KnowledgeSourceRef, ScheduledTaskStatus, ScheduledTaskScheduleSpec, ScheduledTaskRunMode, ScheduledTaskOverlapPolicy, ScheduledTaskAgentConfig, SessionGoalCreatedBy, SocialProvider, SocialConnectionStatus, McpServerConnectionRef as McpServerConnectionRef$1, SessionTurnSource, ResourceRef, ToolRef, ReasoningEffort, SandboxBackend, SessionGoal, CapabilityPack, SessionMcpServerMetadata, SessionTurn, SessionEvent, SessionStatus, Session, BillingBalance, AccessContext, FileAsset, ApiKey, ConnectionMetadata, KnowledgeMemory, ScheduledTask, ScheduledTaskTriggerType, ScheduledTaskRun, SandboxOs, SocialConnection, SocialPost, Workspace, WorkspaceEnvironment, CapabilityInstallation, PackInstallation, SessionTurnStatus, CapabilityCatalogItem, FileUploadStatus, ManagedAccount, AccessGrant, WorkspaceRegisteredPack, UsageEvent, WorkspaceMember, SessionGoalStatus, WorkspaceEnvironmentVariableMetadata, PackInstallationStatus, ScheduledTaskRunStatus } from '@opengeni/contracts';
+import { environmentsEncryptionKeyBytes, Settings, McpServerConnectionRef } from '@opengeni/config';
 import { refreshCodexToken, CodexTokenSnapshot, CodexUsagePayload } from '@opengeni/codex';
 import { PgDatabase } from 'drizzle-orm/pg-core';
-import { s as schema, e as enrollmentOsValues, a as enrollmentExposureValues, d as deviceEnrollmentStatusValues, b as enrollmentStatusValues, c as sandboxKindValues, f as sessionRecordingCodecValues, g as sessionRecordingModeValues, h as sessionRecordingStateValues } from './schema-DuRsrmzD.js';
+import { s as schema, e as enrollmentOsValues, a as enrollmentExposureValues, d as deviceEnrollmentStatusValues, b as enrollmentStatusValues, c as sandboxKindValues, f as sessionRecordingCodecValues, g as sessionRecordingModeValues, h as sessionRecordingStateValues } from './schema-Dsz6UHNv.js';
 import 'drizzle-orm';
 import './migrate.js';
 
@@ -123,6 +123,50 @@ declare function buildCodexTokenResolver(db: Database, settings: Settings, works
  */
 declare function fetchCodexUsageForAccount(db: Database, settings: Settings, workspaceId: string, credentialId: string): Promise<CodexUsagePayload>;
 
+type ResolveConnectionCredentialResult = {
+    status: "ok";
+    headers: Record<string, string>;
+    connectionId: string;
+    expiresAt?: Date | null;
+} | {
+    status: "auth_needed";
+    reason: "missing_connection" | "expired" | "insufficient_scope" | "refresh_failed";
+    providerDomain: string;
+    connectionId?: string;
+    scopes?: string[];
+    resource?: string;
+    authorizationUrl?: string;
+};
+type ResolveConnectionCredentialInput = {
+    workspaceId: string;
+    subjectId?: string;
+    serverId: string;
+    toolId?: string;
+    connectionRef: McpServerConnectionRef;
+    forceRefresh?: boolean;
+};
+type ConnectionBrokerDeps = {
+    loadCredential: typeof loadConnectionCredentialForBroker;
+    recordRefresh: typeof recordConnectionTokenRefresh;
+    setStatus: typeof setConnectionStatus;
+    recordUsed: typeof recordConnectionUsed;
+    refresh: typeof refreshOAuthConnectionCredential;
+    encrypt: typeof encryptEnvironmentValue;
+    keyBytes: typeof environmentsEncryptionKeyBytes;
+    now: () => Date;
+};
+declare function buildConnectionTokenResolver(db: Database, settings: Settings, deps?: ConnectionBrokerDeps): (input: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult>;
+declare class ConnectionRefreshHttpError extends Error {
+    readonly httpStatus: number;
+    constructor(httpStatus: number);
+}
+declare function refreshOAuthConnectionCredential(cred: ConnectionCredentialForBroker, ref: McpServerConnectionRef, settings?: Settings): Promise<{
+    credential: Record<string, unknown>;
+    expiresAt: Date | null;
+    grantedScopes?: string[];
+}>;
+declare function isPrivateAddress(address: string): boolean;
+
 type Database = PgDatabase<any, typeof schema>;
 type DbClient = {
     db: Database;
@@ -418,6 +462,35 @@ type RegisterWorkspacePackInput = {
     workspaceId: string;
     pack: CapabilityPack;
 };
+type CreateKnowledgeMemoryInput = {
+    accountId: string;
+    workspaceId: string;
+    status?: KnowledgeMemoryStatus | undefined;
+    kind?: KnowledgeMemoryKind | undefined;
+    scope?: string | undefined;
+    text: string;
+    sourceRefs?: KnowledgeSourceRef[] | undefined;
+    confidence?: number | undefined;
+    metadata?: Record<string, unknown> | undefined;
+    createdBySessionId?: string | null | undefined;
+};
+type UpdateKnowledgeMemoryInput = {
+    status?: KnowledgeMemoryStatus | undefined;
+    kind?: KnowledgeMemoryKind | undefined;
+    scope?: string | undefined;
+    text?: string | undefined;
+    sourceRefs?: KnowledgeSourceRef[] | undefined;
+    confidence?: number | undefined;
+    metadata?: Record<string, unknown> | undefined;
+    reviewedBy?: string | null | undefined;
+};
+type ListKnowledgeMemoryOptions = {
+    query?: string | undefined;
+    status?: KnowledgeMemoryStatus | undefined;
+    kind?: KnowledgeMemoryKind | undefined;
+    scope?: string | undefined;
+    limit?: number | undefined;
+};
 type CreateSocialConnectionInput = {
     accountId: string;
     workspaceId: string;
@@ -443,6 +516,88 @@ type CreateSocialPostInput = {
     metrics?: Record<string, number>;
     raw?: Record<string, unknown>;
 };
+type CreateConnectionInput = {
+    accountId: string;
+    workspaceId: string;
+    subjectId?: string | null;
+    providerDomain: string;
+    kind: ConnectionKind;
+    status?: ConnectionStatus;
+    credentialEncrypted: string;
+    grantedScopes?: string[];
+    expiresAt?: Date | null;
+    metadata?: Record<string, unknown>;
+    createdBySubjectId?: string | null;
+    updatedBySubjectId?: string | null;
+};
+type UpdateConnectionInput = {
+    workspaceId: string;
+    connectionId: string;
+    visibleToSubjectId?: string | null;
+    expectedVersion?: number | undefined;
+    subjectId?: string | null;
+    providerDomain?: string;
+    kind?: ConnectionKind;
+    status?: ConnectionStatus;
+    credentialEncrypted?: string;
+    grantedScopes?: string[];
+    expiresAt?: Date | null;
+    metadata?: Record<string, unknown>;
+    updatedBySubjectId?: string | null;
+};
+type ConnectionCredentialForBroker = {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    subjectId: string | null;
+    providerDomain: string;
+    kind: ConnectionKind;
+    status: ConnectionStatus;
+    credential: Record<string, unknown>;
+    grantedScopes: string[];
+    expiresAt: Date | null;
+    lastRefreshAt: Date | null;
+    version: number;
+    metadata: Record<string, unknown>;
+};
+type IntegrationOAuthClientForUse = {
+    id: string;
+    issuer: string;
+    authorizationServer: string;
+    clientId: string;
+    clientSecret: string | null;
+    tokenEndpointAuthMethod: string;
+    metadata: Record<string, unknown>;
+    createdAt: Date;
+    updatedAt: Date;
+};
+type StoredIntegrationOAuthClient = {
+    id: string;
+    issuer: string;
+    authorizationServer: string;
+    clientId: string;
+    clientSecretEncrypted: string | null;
+    tokenEndpointAuthMethod: string;
+    metadata: Record<string, unknown>;
+    createdAt: Date;
+    updatedAt: Date;
+};
+type StoreIntegrationOAuthClientInput = {
+    issuer: string;
+    authorizationServer: string;
+    clientId: string;
+    clientSecretEncrypted?: string | null;
+    tokenEndpointAuthMethod?: string;
+    metadata?: Record<string, unknown>;
+};
+type ConsumeOAuthStateNonceInput = {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    nonce: string;
+    expiresAt: Date;
+    now: Date;
+};
 type CreateCapabilityCatalogItemInput = {
     accountId: string;
     workspaceId: string;
@@ -459,6 +614,64 @@ type CreateCapabilityCatalogItemInput = {
     authModel?: string | null;
     metadata?: Record<string, unknown>;
 };
+type ImportBatch = {
+    id: string;
+    source: string;
+    snapshotDate: string;
+    snapshotRef: string | null;
+    attributionNote: string;
+    importedCount: number;
+    skippedCount: number;
+    quarantinedCount: number;
+    logoFailureCount: number;
+    staleCount: number;
+    details: Record<string, unknown>;
+    createdAt: string;
+    updatedAt: string;
+};
+type CreateImportBatchInput = {
+    source: string;
+    snapshotDate: Date;
+    snapshotRef?: string | null;
+    attributionNote: string;
+    importedCount?: number;
+    skippedCount?: number;
+    quarantinedCount?: number;
+    logoFailureCount?: number;
+    staleCount?: number;
+    details?: Record<string, unknown>;
+};
+type UpdateImportBatchCountsInput = {
+    importedCount: number;
+    skippedCount: number;
+    quarantinedCount: number;
+    logoFailureCount: number;
+    staleCount: number;
+    details?: Record<string, unknown>;
+};
+type RegistryCapabilityCatalogItemInput = {
+    id: string;
+    providerDomain: string;
+    name: string;
+    description?: string | null;
+    mcpUrl: string;
+    transport: string;
+    authKind: "oauth2" | "api_key" | "none" | "unknown";
+    credentialFacts: Array<Record<string, unknown>>;
+    tier: "verified" | "community";
+    provenance: string;
+    logoAssetPath?: string | null;
+    importBatchId: string;
+    scopesHint?: string[];
+    homepageUrl?: string | null;
+    tags?: string[];
+    metadata?: Record<string, unknown>;
+};
+type RegistryCatalogSurfaceKey = {
+    id: string;
+    providerDomain: string;
+    mcpUrl: string;
+};
 type EnableCapabilityInstallationInput = {
     accountId: string;
     workspaceId: string;
@@ -482,6 +695,7 @@ type EnabledMcpCapabilityServer = {
      * capability API surface.
      */
     headersEncrypted?: Record<string, string>;
+    connectionRef?: McpServerConnectionRef$1;
 };
 type CreateSessionMcpServerInput = {
     id: string;
@@ -490,6 +704,7 @@ type CreateSessionMcpServerInput = {
     allowedTools?: string[] | null;
     timeoutMs?: number | null;
     cacheToolsList?: boolean | null;
+    requireApproval?: boolean | string[] | null;
     headersEncrypted?: Record<string, string>;
 };
 type UpdateSessionMcpServerCredentialsInput = {
@@ -504,6 +719,7 @@ type SessionMcpServerForRun = SessionMcpServerMetadata & {
     allowedTools?: string[];
     timeoutMs?: number;
     cacheToolsList?: boolean;
+    requireApproval?: boolean | string[];
     headers: Record<string, string>;
 };
 type EnqueueSessionTurnInput = {
@@ -568,6 +784,14 @@ declare function registerWorkspacePack(db: Database, input: RegisterWorkspacePac
 declare function listWorkspacePacks(db: Database, workspaceId: string): Promise<WorkspaceRegisteredPack[]>;
 declare function getWorkspacePack(db: Database, workspaceId: string, packId: string): Promise<WorkspaceRegisteredPack | null>;
 declare function deleteWorkspacePack(db: Database, workspaceId: string, packId: string): Promise<boolean>;
+declare function createImportBatch(db: Database, input: CreateImportBatchInput): Promise<ImportBatch>;
+declare function updateImportBatchCounts(db: Database, id: string, input: UpdateImportBatchCountsInput): Promise<ImportBatch>;
+declare function upsertRegistryCapabilityCatalogItem(db: Database, input: RegistryCapabilityCatalogItemInput): Promise<CapabilityCatalogItem>;
+declare function listRegistryCatalogSurfaceKeys(db: Database): Promise<RegistryCatalogSurfaceKey[]>;
+declare function markStaleRegistryCatalogItems(db: Database, activeKeys: Iterable<{
+    providerDomain: string;
+    mcpUrl: string;
+}>, importBatchId: string): Promise<number>;
 declare function upsertCapabilityCatalogItem(db: Database, input: CreateCapabilityCatalogItemInput): Promise<CapabilityCatalogItem>;
 declare function listCapabilityCatalogItems(db: Database, workspaceId: string): Promise<CapabilityCatalogItem[]>;
 declare function getCapabilityCatalogItem(db: Database, workspaceId: string, capabilityId: string): Promise<CapabilityCatalogItem | null>;
@@ -591,6 +815,40 @@ declare function decryptedCapabilityHeaders(server: EnabledMcpCapabilityServer,
  */
 declare function getStoredCapabilityHeaderCiphertext(db: Database, workspaceId: string, capabilityId: string): Promise<Record<string, string> | null>;
 declare function mcpServerIdForCapability(capabilityId: string, metadata?: Record<string, unknown>): string;
+declare function createConnection(db: Database, input: CreateConnectionInput): Promise<ConnectionMetadata>;
+declare function listConnectionsMetadata(db: Database, workspaceId: string, subjectId?: string | null): Promise<ConnectionMetadata[]>;
+declare function getConnectionMetadata(db: Database, workspaceId: string, connectionId: string, subjectId?: string | null): Promise<ConnectionMetadata | null>;
+declare function updateConnection(db: Database, input: UpdateConnectionInput): Promise<ConnectionMetadata | null>;
+declare function revokeConnection(db: Database, workspaceId: string, connectionId: string, updatedBySubjectId?: string | null): Promise<ConnectionMetadata | null>;
+declare function loadConnectionCredentialForBroker(db: Database, settings: Settings, input: {
+    workspaceId: string;
+    connectionId?: string;
+    providerDomain: string;
+    kind?: ConnectionKind;
+    subjectId?: string | null;
+    allowSubjectOwned?: boolean;
+}): Promise<ConnectionCredentialForBroker | null>;
+declare function recordConnectionTokenRefresh(db: Database, input: {
+    id: string;
+    version: number;
+    workspaceId: string;
+    credentialEncrypted: string;
+    expiresAt: Date | null;
+    grantedScopes?: string[];
+    lastRefreshAt: Date;
+}): Promise<boolean>;
+declare function setConnectionStatus(db: Database, workspaceId: string, status: ConnectionStatus, lastError: string | null, guard: {
+    id: string;
+    version: number;
+}): Promise<boolean>;
+declare function recordConnectionUsed(db: Database, workspaceId: string, connectionId: string): Promise<void>;
+declare function loadIntegrationOAuthClient(db: Database, settings: Settings, issuer: string): Promise<IntegrationOAuthClientForUse | null>;
+declare function storeIntegrationOAuthClient(db: Database, input: StoreIntegrationOAuthClientInput): Promise<StoredIntegrationOAuthClient>;
+declare function consumeIntegrationOAuthStateNonce(db: Database, input: ConsumeOAuthStateNonceInput): Promise<boolean>;
+declare function createKnowledgeMemory(db: Database, input: CreateKnowledgeMemoryInput): Promise<KnowledgeMemory>;
+declare function updateKnowledgeMemory(db: Database, workspaceId: string, memoryId: string, input: UpdateKnowledgeMemoryInput): Promise<KnowledgeMemory>;
+declare function getKnowledgeMemory(db: Database, workspaceId: string, memoryId: string): Promise<KnowledgeMemory | null>;
+declare function listKnowledgeMemories(db: Database, workspaceId: string, options?: ListKnowledgeMemoryOptions): Promise<KnowledgeMemory[]>;
 declare function createSocialConnection(db: Database, input: CreateSocialConnectionInput): Promise<SocialConnection>;
 declare function listSocialConnections(db: Database, workspaceId: string, limit?: number): Promise<SocialConnection[]>;
 declare function getSocialConnection(db: Database, workspaceId: string, connectionId: string): Promise<SocialConnection | null>;
@@ -1077,6 +1335,23 @@ type ListSessionEventsOptions = {
 declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string): Promise<SessionEvent[]>;
 declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string, after: number, limit?: number): Promise<SessionEvent[]>;
 declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string, options: ListSessionEventsOptions): Promise<SessionEvent[]>;
+type ToolspaceCallReservation = {
+    reserved: true;
+    count: number;
+} | {
+    reserved: false;
+};
+/**
+ * Atomically reserve one toolspace call against a turn's per-turn budget.
+ *
+ * A single conditional UPDATE increments `toolspace_call_count` only while it is
+ * below `limit` and returns the post-increment value. Concurrent reservations
+ * for the same turn serialize on the row lock, so exactly `limit` of N
+ * simultaneous callers observe `reserved: true` — closing the read-then-append
+ * TOCTOU the event-count approach had. `reserved: false` means the turn is at or
+ * over budget (or the turn row no longer exists).
+ */
+declare function reserveToolspaceCallForTurn(db: Database, workspaceId: string, sessionId: string, turnId: string, limit: number): Promise<ToolspaceCallReservation>;
 declare function getSessionEvent(db: Database, workspaceId: string, eventId: string): Promise<SessionEvent | null>;
 declare function getLatestRunState(db: Database, workspaceId: string, sessionId: string): Promise<{
     id: string;
@@ -1559,6 +1834,8 @@ interface MeterableWarmLease {
     backend: string;
 }
 declare function listMeterableWarmLeases(db: Database): Promise<MeterableWarmLease[]>;
+declare function countQueuedTurns(db: Database): Promise<number>;
+declare function countSandboxLeasesByLiveness(db: Database): Promise<Record<SandboxLeaseLiveness, number>>;
 declare function listLiveModalSandboxLeaseAttributions(db: Database): Promise<LiveModalSandboxLeaseAttribution[]>;
 declare function reArmDrainingLease(db: Database, input: {
     accountId: string;
@@ -1614,6 +1891,9 @@ type EnrollmentRecord = {
     pubkey: string;
     exposure: EnrollmentExposure;
     hasDisplay: boolean;
+    /** Set when a display exists but capture is not permitted (macOS Screen Recording
+     *  not granted); null when capture is permitted or the machine is headless. */
+    desktopUnavailableReason: string | null;
     allowScreenControl: boolean;
     status: EnrollmentStatus;
     os: EnrollmentOs;
@@ -1659,11 +1939,12 @@ declare function touchEnrollmentLastSeen(db: Database, input: {
     workspaceId: string;
     enrollmentId: string;
 }): Promise<void>;
-declare function setEnrollmentHasDisplay(db: Database, input: {
+declare function setEnrollmentDisplayState(db: Database, input: {
     accountId: string;
     workspaceId: string;
     enrollmentId: string;
     hasDisplay: boolean;
+    desktopUnavailableReason: string | null;
 }): Promise<{
     updated: boolean;
 }>;
@@ -2142,4 +2423,4 @@ type LockedSessionUpdateResult = {
 declare function appendSessionEventsWithLockedSessionUpdate(db: Database, workspaceId: string, sessionId: string, build: (session: Session, context: LockedSessionUpdateContext) => LockedSessionUpdateResult | Promise<LockedSessionUpdateResult>): Promise<SessionEvent[]>;
 declare function sessionSubject(workspaceId: string, sessionId: string): string;
 
-export { SandboxLeaseSupersededError as $, type AccrueWarmSecondsResult as A, type BootstrapWorkspaceInput as B, CLEARED_RUN_STATE as C, type Database as D, type EnableCapabilityInstallationInput as E, type EnrollmentExposure as F, type EnrollmentOs as G, type EnrollmentRecord as H, type EnrollmentStatus as I, type ForceDrainResult as J, type GitHubInstallation as K, type GoalContinuationDecision as L, type LeaseHolderKind as M, type LeaseSnapshot as N, type ListSessionEventsOptions as O, type LiveModalSandboxLeaseAttribution as P, type ProvisionResult, type ProvisionRolesOptions, MACHINE_METRICS_SERIES_INTERVAL_MS as Q, type MachineMetricsRow as R, type MachineMetricsSample as S, type MeterableWarmLease as T, type ReapDrainable as U, type RegisterWorkspacePackInput as V, type RlsContext as W, type RlsStrategy as X, SandboxImageConflictError as Y, type SandboxKind as Z, type SandboxLeaseLiveness as _, type AcquireLeaseInput as a, createSessionWithIdempotencyKey as a$, type SandboxPtySessionRow as a0, type SandboxRecord as a1, type SessionCodexState as a2, type SessionMcpServerForRun as a3, type SessionRecordingCodec as a4, type SessionRecordingMode as a5, type SessionRecordingRow as a6, type SessionRecordingState as a7, type StreamAcknowledgment as a8, type UpdateQueuedSessionTurnInput as a9, commitWarmingToWarm as aA, completeFileUpload as aB, confirmDrainCold as aC, consumeDeviceEnrollmentRequest as aD, consumeSessionCompactionRequest as aE, countActiveApiKeysForWorkspace as aF, countActiveSessionHistoryItems as aG, countActiveSessionsForWorkspace as aH, countActiveSessionsUsingEnvironment as aI, countConsecutiveReactiveRotations as aJ, countScheduledTasksForWorkspace as aK, countScheduledTasksUsingEnvironment as aL, countSessionHistoryItems as aM, countTurnSessionHistoryItems as aN, countWorkspaceEnvironments as aO, countWorkspacesForAccount as aP, createApiKey as aQ, createDb as aR, createDeviceEnrollmentRequest as aS, createEnrollment as aT, createFileUpload as aU, createSandbox as aV, createScheduledTask as aW, createScheduledTaskRun as aX, createSession as aY, createSessionGoal as aZ, createSessionMcpServers as a_, type UpdateScheduledTaskInput as aa, type UpdateSessionMcpServerCredentialsInput as ab, type UpdateSessionMcpServerCredentialsResult as ac, type UserLookup as ad, type WakeParentForChildCompletionInput as ae, type WakeParentForChildCompletionResult as af, type WorkspaceEnvironmentForRun as ag, accrueWarmSeconds as ah, acquireLease as ai, allAccountPermissions as aj, allWorkspacePermissions as ak, appendSessionEvents as al, appendSessionEventsAndUpdateSession as am, appendSessionEventsWithLockedSessionUpdate as an, appendSessionHistoryItems as ao, applyContextCompaction as ap, applyCreditDebitUpToBalance as aq, applyCreditLedgerEntry as ar, approveDeviceEnrollmentRequest as as, bootstrapWorkspace as at, buildCodexTokenResolver as au, cancelQueuedSessionTurn as av, claimNextQueuedTurn as aw, clearSessionContext as ax, clearedContextMarkerItem as ay, closePtySession as az, type AcquireLeaseResult as b, getWorkspace as b$, createSocialConnection as b0, createSocialPost as b1, createTurn as b2, createWorkspace as b3, createWorkspaceEnvironment as b4, decryptEnvironmentValue as b5, decryptedCapabilityHeaders as b6, deleteRecording as b7, deleteScheduledTask as b8, deleteWorkspace as b9, getCodexCredentialStatus as bA, getCodexRotationSettings as bB, getDeviceEnrollmentRequestByDeviceCode as bC, getEnrollment as bD, getFile as bE, getFileUpload as bF, getLatestRunState as bG, getManagedAccount as bH, getManagedUserByEmail as bI, getOpenPtySession as bJ, getPackInstallation as bK, getPendingDeviceEnrollmentRequestByUserCode as bL, getPendingDeviceEnrollmentRequestByUserCodeGlobal as bM, getRecording as bN, getSandbox as bO, getSandboxSessionEnvelope as bP, getScheduledTask as bQ, getSession as bR, getSessionByCreateIdempotencyKey as bS, getSessionCodexState as bT, getSessionEvent as bU, getSessionGoal as bV, getSessionHistoryItems as bW, getSessionTurn as bX, getSocialConnection as bY, getStoredCapabilityHeaderCiphertext as bZ, getStreamAcknowledgment as b_, deleteWorkspaceEnvironment as ba, deleteWorkspaceEnvironmentVariable as bb, deleteWorkspacePack as bc, denyDeviceEnrollmentRequest as bd, disableCapabilityInstallation as be, disconnectAllCodexAccounts as bf, disconnectCodexAccount as bg, enableCapabilityInstallation as bh, enablePackInstallation as bi, encryptEnvironmentValue as bj, enqueueSessionTurn as bk, ensureCodexRotationSettings as bl, ensureManagedAccessForUser as bm, evaluateGoalContinuation as bn, failWarmingToCold as bo, fetchCodexUsageForAccount as bp, finalizeEnrollmentByToken as bq, findActiveApiKeyByHash as br, finishTurn as bs, forceDrainOverLimitViewerOnlyBoxes as bt, getActiveSessionHistoryItems as bu, getAnySessionInGroup as bv, getBillingBalance as bw, getBillingCustomer as bx, getCapabilityCatalogItem as by, getCapabilityInstallation as bz, type ActiveSandboxPointer as c, recordCodexAccountUsage as c$, getWorkspaceEnvironment as c0, getWorkspaceEnvironmentByName as c1, getWorkspaceEnvironmentValuesForRun as c2, getWorkspaceGrant as c3, getWorkspacePack as c4, grantWorkspaceAccess as c5, hasCreditLedgerEntry as c6, heartbeatLeaseHolder as c7, incrementTurnWorkerDeathRedispatches as c8, ingestMachineMetricsSample as c9, listSessionTurns as cA, listSessions as cB, listSocialConnections as cC, listSocialPosts as cD, listUsageEvents as cE, listWorkspaceEnvironments as cF, listWorkspaceMembers as cG, listWorkspacePacks as cH, listWorkspacesForSubject as cI, loadCodexCredentialForRun as cJ, loadWorkspaceEnvironmentForRun as cK, markFileUploadFailed as cL, markStripeWebhookProcessed as cM, mcpServerIdForCapability as cN, nextSessionHistoryPosition as cO, orphanedResultRowIndicesForRepair as cP, persistDrainSnapshot as cQ, reArmDrainingLease as cR, readActiveSandbox as cS, readLease as cT, readMachineMetricsLatest as cU, readMachineMetricsLatestForWorkspace as cV, readMachineMetricsSeries as cW, reapStaleLeaseHolders as cX, reapStaleLeaseHoldersGlobal as cY, recordAuditEvent as cZ, recordCodexAccountConnectors as c_, insertMachineMetricsSeries as ca, insertPtySession as cb, insertRecording as cc, isCodexBilledTurn as cd, isStripeWebhookProcessed as ce, listApiKeys as cf, listCapabilityCatalogItems as cg, listCapabilityInstallations as ch, listCodexAccountStatuses as ci, listDistinctEnvironmentIdsInGroup as cj, listEnabledMcpCapabilityServers as ck, listEnrollments as cl, listGitHubInstallationIdsForWorkspace as cm, listGitHubInstallationsForWorkspace as cn, listLiveModalSandboxLeaseAttributions as co, listMeterableWarmLeases as cp, listOpenPtySessions as cq, listPackInstallations as cr, listRecordings as cs, listSandboxes as ct, listScheduledTaskRuns as cu, listScheduledTasks as cv, listSessionEvents as cw, listSessionIdsInGroup as cx, listSessionMcpServerMetadata as cy, listSessionMcpServersForRun as cz, type AppendEventInput as d, upsertSandboxSessionEnvelope as d$, recordCodexTokenRefresh as d0, recordLeaseDataPlaneUrl as d1, recordLeaseTerminalDataPlaneUrl as d2, recordSessionActiveCodexCredential as d3, recordStreamAcknowledgment as d4, recordStripeWebhookEvent as d5, recordUsageEvent as d6, recordWarmingSandboxCreated as d7, registerDbBinding as d8, registerWorkspacePack as d9, setRlsContext as dA, setSessionCodexPin as dB, setSessionGoalLastContinuationTurn as dC, setSessionGoalStatus as dD, setSessionLastInputTokens as dE, setSessionStatus as dF, setTemporalWorkflowId as dG, setWorkspaceEnvironmentVariable as dH, sumUsageQuantity as dI, touchEnrollmentLastSeen as dJ, updateCodexRotationSettings as dK, updatePackInstallationStatus as dL, updatePtySessionActivity as dM, updateQueuedSessionTurn as dN, updateRecording as dO, updateScheduledTask as dP, updateScheduledTaskRun as dQ, updateSessionGoal as dR, updateSessionMcpServerCredentials as dS, updateSessionTitle as dT, updateWorkspace as dU, updateWorkspaceEnvironment as dV, upsertBillingCustomer as dW, upsertCapabilityCatalogItem as dX, upsertCodexSubscriptionCredential as dY, upsertGitHubInstallation as dZ, upsertMachineMetricsLatest as d_, releaseLeaseHolder as da, removeWorkspaceMember as db, renameCodexAccount as dc, reorderQueuedSessionTurns as dd, requestSessionCompaction as de, requeuePreemptedTurn as df, requireFile as dg, requireScheduledTask as dh, requireSession as di, requireSocialConnection as dj, requireWorkspace as dk, revokeApiKey as dl, revokeEnrollment as dm, revokeViewer as dn, rlsContextForWorkspace as dp, rlsStrategyFor as dq, sanitizeEventPayload as dr, sanitizeEventString as ds, saveRunState as dt, sessionSubject as du, setActiveCodexCredential as dv, setActiveSandbox as dw, setCodexCredentialExhausted as dx, setCodexCredentialStatus as dy, setEnrollmentHasDisplay as dz, CODEX_ROTATION_STRATEGIES as e, upsertSessionGoal as e0, wakeParentSessionForChildCompletion as e1, withAccountRls as e2, withRlsContext as e3, withWorkspaceRls as e4, withWorkspaceUsageLock as e5, workspaceCodexSubscriptionActive as e6, type ClearSessionContextResult as f, type CodexAccountStatus as g, type CodexAccountUsageSnapshot as h, type CodexAuthDeps as i, type CodexCredentialForRun as j, type CodexCredentialTokens as k, type CodexRotationSettings as l, type CodexRotationStrategy as m, type CreateCapabilityCatalogItemInput as n, type CreateDbOptions as o, type CreatePackInstallationInput as p, provisionRoles, type CreateScheduledTaskInput as q, type CreateSessionGoalInput as r, type CreateSessionMcpServerInput as s, type CreateSocialConnectionInput as t, type CreateSocialPostInput as u, type DbClient as v, type DeviceEnrollmentRequestRecord as w, type DeviceEnrollmentStatus as x, type EnabledMcpCapabilityServer as y, type EnqueueSessionTurnInput as z };
+export { type MachineMetricsRow as $, type AccrueWarmSecondsResult as A, type BootstrapWorkspaceInput as B, CLEARED_RUN_STATE as C, type CreateSocialConnectionInput as D, type CreateSocialPostInput as E, type Database as F, type DbClient as G, type DeviceEnrollmentRequestRecord as H, type DeviceEnrollmentStatus as I, type EnableCapabilityInstallationInput as J, type EnabledMcpCapabilityServer as K, type EnqueueSessionTurnInput as L, type EnrollmentExposure as M, type EnrollmentOs as N, type EnrollmentRecord as O, type EnrollmentStatus as P, type ProvisionResult, type ProvisionRolesOptions, type ForceDrainResult as Q, type GitHubInstallation as R, type GoalContinuationDecision as S, type ImportBatch as T, type IntegrationOAuthClientForUse as U, type LeaseHolderKind as V, type LeaseSnapshot as W, type ListKnowledgeMemoryOptions as X, type ListSessionEventsOptions as Y, type LiveModalSandboxLeaseAttribution as Z, MACHINE_METRICS_SERIES_INTERVAL_MS as _, type AcquireLeaseInput as a, countActiveApiKeysForWorkspace as a$, type MachineMetricsSample as a0, type MeterableWarmLease as a1, type ReapDrainable as a2, type RegisterWorkspacePackInput as a3, type RegistryCapabilityCatalogItemInput as a4, type RegistryCatalogSurfaceKey as a5, type ResolveConnectionCredentialInput as a6, type ResolveConnectionCredentialResult as a7, type RlsContext as a8, type RlsStrategy as a9, type WorkspaceEnvironmentForRun as aA, accrueWarmSeconds as aB, acquireLease as aC, allAccountPermissions as aD, allWorkspacePermissions as aE, appendSessionEvents as aF, appendSessionEventsAndUpdateSession as aG, appendSessionEventsWithLockedSessionUpdate as aH, appendSessionHistoryItems as aI, applyContextCompaction as aJ, applyCreditDebitUpToBalance as aK, applyCreditLedgerEntry as aL, approveDeviceEnrollmentRequest as aM, bootstrapWorkspace as aN, buildCodexTokenResolver as aO, buildConnectionTokenResolver as aP, cancelQueuedSessionTurn as aQ, claimNextQueuedTurn as aR, clearSessionContext as aS, clearedContextMarkerItem as aT, closePtySession as aU, commitWarmingToWarm as aV, completeFileUpload as aW, confirmDrainCold as aX, consumeDeviceEnrollmentRequest as aY, consumeIntegrationOAuthStateNonce as aZ, consumeSessionCompactionRequest as a_, SandboxImageConflictError as aa, type SandboxKind as ab, type SandboxLeaseLiveness as ac, SandboxLeaseSupersededError as ad, type SandboxPtySessionRow as ae, type SandboxRecord as af, type SessionCodexState as ag, type SessionMcpServerForRun as ah, type SessionRecordingCodec as ai, type SessionRecordingMode as aj, type SessionRecordingRow as ak, type SessionRecordingState as al, type StoreIntegrationOAuthClientInput as am, type StoredIntegrationOAuthClient as an, type StreamAcknowledgment as ao, type ToolspaceCallReservation as ap, type UpdateConnectionInput as aq, type UpdateImportBatchCountsInput as ar, type UpdateKnowledgeMemoryInput as as, type UpdateQueuedSessionTurnInput as at, type UpdateScheduledTaskInput as au, type UpdateSessionMcpServerCredentialsInput as av, type UpdateSessionMcpServerCredentialsResult as aw, type UserLookup as ax, type WakeParentForChildCompletionInput as ay, type WakeParentForChildCompletionResult as az, type AcquireLeaseResult as b, getCodexCredentialStatus as b$, countActiveSessionHistoryItems as b0, countActiveSessionsForWorkspace as b1, countActiveSessionsUsingEnvironment as b2, countConsecutiveReactiveRotations as b3, countQueuedTurns as b4, countSandboxLeasesByLiveness as b5, countScheduledTasksForWorkspace as b6, countScheduledTasksUsingEnvironment as b7, countSessionHistoryItems as b8, countTurnSessionHistoryItems as b9, deleteWorkspace as bA, deleteWorkspaceEnvironment as bB, deleteWorkspaceEnvironmentVariable as bC, deleteWorkspacePack as bD, denyDeviceEnrollmentRequest as bE, disableCapabilityInstallation as bF, disconnectAllCodexAccounts as bG, disconnectCodexAccount as bH, enableCapabilityInstallation as bI, enablePackInstallation as bJ, encryptEnvironmentValue as bK, enqueueSessionTurn as bL, ensureCodexRotationSettings as bM, ensureManagedAccessForUser as bN, evaluateGoalContinuation as bO, failWarmingToCold as bP, fetchCodexUsageForAccount as bQ, finalizeEnrollmentByToken as bR, findActiveApiKeyByHash as bS, finishTurn as bT, forceDrainOverLimitViewerOnlyBoxes as bU, getActiveSessionHistoryItems as bV, getAnySessionInGroup as bW, getBillingBalance as bX, getBillingCustomer as bY, getCapabilityCatalogItem as bZ, getCapabilityInstallation as b_, countWorkspaceEnvironments as ba, countWorkspacesForAccount as bb, createApiKey as bc, createConnection as bd, createDb as be, createDeviceEnrollmentRequest as bf, createEnrollment as bg, createFileUpload as bh, createImportBatch as bi, createKnowledgeMemory as bj, createSandbox as bk, createScheduledTask as bl, createScheduledTaskRun as bm, createSession as bn, createSessionGoal as bo, createSessionMcpServers as bp, createSessionWithIdempotencyKey as bq, createSocialConnection as br, createSocialPost as bs, createTurn as bt, createWorkspace as bu, createWorkspaceEnvironment as bv, decryptEnvironmentValue as bw, decryptedCapabilityHeaders as bx, deleteRecording as by, deleteScheduledTask as bz, type ActiveSandboxPointer as c, listScheduledTaskRuns as c$, getCodexRotationSettings as c0, getConnectionMetadata as c1, getDeviceEnrollmentRequestByDeviceCode as c2, getEnrollment as c3, getFile as c4, getFileUpload as c5, getKnowledgeMemory as c6, getLatestRunState as c7, getManagedAccount as c8, getManagedUserByEmail as c9, heartbeatLeaseHolder as cA, incrementTurnWorkerDeathRedispatches as cB, ingestMachineMetricsSample as cC, insertMachineMetricsSeries as cD, insertPtySession as cE, insertRecording as cF, isCodexBilledTurn as cG, isPrivateAddress as cH, isStripeWebhookProcessed as cI, listApiKeys as cJ, listCapabilityCatalogItems as cK, listCapabilityInstallations as cL, listCodexAccountStatuses as cM, listConnectionsMetadata as cN, listDistinctEnvironmentIdsInGroup as cO, listEnabledMcpCapabilityServers as cP, listEnrollments as cQ, listGitHubInstallationIdsForWorkspace as cR, listGitHubInstallationsForWorkspace as cS, listKnowledgeMemories as cT, listLiveModalSandboxLeaseAttributions as cU, listMeterableWarmLeases as cV, listOpenPtySessions as cW, listPackInstallations as cX, listRecordings as cY, listRegistryCatalogSurfaceKeys as cZ, listSandboxes as c_, getOpenPtySession as ca, getPackInstallation as cb, getPendingDeviceEnrollmentRequestByUserCode as cc, getPendingDeviceEnrollmentRequestByUserCodeGlobal as cd, getRecording as ce, getSandbox as cf, getSandboxSessionEnvelope as cg, getScheduledTask as ch, getSession as ci, getSessionByCreateIdempotencyKey as cj, getSessionCodexState as ck, getSessionEvent as cl, getSessionGoal as cm, getSessionHistoryItems as cn, getSessionTurn as co, getSocialConnection as cp, getStoredCapabilityHeaderCiphertext as cq, getStreamAcknowledgment as cr, getWorkspace as cs, getWorkspaceEnvironment as ct, getWorkspaceEnvironmentByName as cu, getWorkspaceEnvironmentValuesForRun as cv, getWorkspaceGrant as cw, getWorkspacePack as cx, grantWorkspaceAccess as cy, hasCreditLedgerEntry as cz, type AppendEventInput as d, revokeConnection as d$, listScheduledTasks as d0, listSessionEvents as d1, listSessionIdsInGroup as d2, listSessionMcpServerMetadata as d3, listSessionMcpServersForRun as d4, listSessionTurns as d5, listSessions as d6, listSocialConnections as d7, listSocialPosts as d8, listUsageEvents as d9, recordCodexAccountUsage as dA, recordCodexTokenRefresh as dB, recordConnectionTokenRefresh as dC, recordConnectionUsed as dD, recordLeaseDataPlaneUrl as dE, recordLeaseTerminalDataPlaneUrl as dF, recordSessionActiveCodexCredential as dG, recordStreamAcknowledgment as dH, recordStripeWebhookEvent as dI, recordUsageEvent as dJ, recordWarmingSandboxCreated as dK, refreshOAuthConnectionCredential as dL, registerDbBinding as dM, registerWorkspacePack as dN, releaseLeaseHolder as dO, removeWorkspaceMember as dP, renameCodexAccount as dQ, reorderQueuedSessionTurns as dR, requestSessionCompaction as dS, requeuePreemptedTurn as dT, requireFile as dU, requireScheduledTask as dV, requireSession as dW, requireSocialConnection as dX, requireWorkspace as dY, reserveToolspaceCallForTurn as dZ, revokeApiKey as d_, listWorkspaceEnvironments as da, listWorkspaceMembers as db, listWorkspacePacks as dc, listWorkspacesForSubject as dd, loadCodexCredentialForRun as de, loadConnectionCredentialForBroker as df, loadIntegrationOAuthClient as dg, loadWorkspaceEnvironmentForRun as dh, markFileUploadFailed as di, markStaleRegistryCatalogItems as dj, markStripeWebhookProcessed as dk, mcpServerIdForCapability as dl, nextSessionHistoryPosition as dm, orphanedResultRowIndicesForRepair as dn, persistDrainSnapshot as dp, reArmDrainingLease as dq, readActiveSandbox as dr, readLease as ds, readMachineMetricsLatest as dt, readMachineMetricsLatestForWorkspace as du, readMachineMetricsSeries as dv, reapStaleLeaseHolders as dw, reapStaleLeaseHoldersGlobal as dx, recordAuditEvent as dy, recordCodexAccountConnectors as dz, CODEX_ROTATION_STRATEGIES as e, revokeEnrollment as e0, revokeViewer as e1, rlsContextForWorkspace as e2, rlsStrategyFor as e3, sanitizeEventPayload as e4, sanitizeEventString as e5, saveRunState as e6, sessionSubject as e7, setActiveCodexCredential as e8, setActiveSandbox as e9, updateSessionMcpServerCredentials as eA, updateSessionTitle as eB, updateWorkspace as eC, updateWorkspaceEnvironment as eD, upsertBillingCustomer as eE, upsertCapabilityCatalogItem as eF, upsertCodexSubscriptionCredential as eG, upsertGitHubInstallation as eH, upsertMachineMetricsLatest as eI, upsertRegistryCapabilityCatalogItem as eJ, upsertSandboxSessionEnvelope as eK, upsertSessionGoal as eL, wakeParentSessionForChildCompletion as eM, withAccountRls as eN, withRlsContext as eO, withWorkspaceRls as eP, withWorkspaceUsageLock as eQ, workspaceCodexSubscriptionActive as eR, setCodexCredentialExhausted as ea, setCodexCredentialStatus as eb, setConnectionStatus as ec, setEnrollmentDisplayState as ed, setRlsContext as ee, setSessionCodexPin as ef, setSessionGoalLastContinuationTurn as eg, setSessionGoalStatus as eh, setSessionLastInputTokens as ei, setSessionStatus as ej, setTemporalWorkflowId as ek, setWorkspaceEnvironmentVariable as el, storeIntegrationOAuthClient as em, sumUsageQuantity as en, touchEnrollmentLastSeen as eo, updateCodexRotationSettings as ep, updateConnection as eq, updateImportBatchCounts as er, updateKnowledgeMemory as es, updatePackInstallationStatus as et, updatePtySessionActivity as eu, updateQueuedSessionTurn as ev, updateRecording as ew, updateScheduledTask as ex, updateScheduledTaskRun as ey, updateSessionGoal as ez, type ClearSessionContextResult as f, type CodexAccountStatus as g, type CodexAccountUsageSnapshot as h, type CodexAuthDeps as i, type CodexCredentialForRun as j, type CodexCredentialTokens as k, type CodexRotationSettings as l, type CodexRotationStrategy as m, type ConnectionBrokerDeps as n, type ConnectionCredentialForBroker as o, ConnectionRefreshHttpError as p, provisionRoles, type ConsumeOAuthStateNonceInput as q, type CreateCapabilityCatalogItemInput as r, type CreateConnectionInput as s, type CreateDbOptions as t, type CreateImportBatchInput as u, type CreateKnowledgeMemoryInput as v, type CreatePackInstallationInput as w, type CreateScheduledTaskInput as x, type CreateSessionGoalInput as y, type CreateSessionMcpServerInput as z };