@opengeni/db 0.4.1 → 0.6.0

package/dist/provision-roles.d.ts

@@ -1,8 +1,8 @@
-import { SessionEventType, Permission, CapabilityKind, CapabilitySource, ScheduledTaskStatus, ScheduledTaskScheduleSpec, ScheduledTaskRunMode, ScheduledTaskOverlapPolicy, ScheduledTaskAgentConfig, SessionGoalCreatedBy, SocialProvider, SocialConnectionStatus, SessionTurnSource, ResourceRef, ToolRef, ReasoningEffort, SandboxBackend, SessionGoal, CapabilityPack, SessionMcpServerMetadata, SessionTurn, SessionEvent, SessionStatus, Session, BillingBalance, AccessContext, FileAsset, ApiKey, ScheduledTask, ScheduledTaskTriggerType, ScheduledTaskRun, SandboxOs, SocialConnection, SocialPost, Workspace, WorkspaceEnvironment, CapabilityInstallation, PackInstallation, SessionTurnStatus, CapabilityCatalogItem, FileUploadStatus, ManagedAccount, AccessGrant, WorkspaceRegisteredPack, UsageEvent, WorkspaceMember, SessionGoalStatus, WorkspaceEnvironmentVariableMetadata, PackInstallationStatus, ScheduledTaskRunStatus } from '@opengeni/contracts';
-import { environmentsEncryptionKeyBytes, Settings } from '@opengeni/config';
+import { SessionEventType, Permission, ConnectionKind, ConnectionStatus, CapabilityKind, CapabilitySource, KnowledgeMemoryStatus, KnowledgeMemoryKind, KnowledgeSourceRef, ScheduledTaskStatus, ScheduledTaskScheduleSpec, ScheduledTaskRunMode, ScheduledTaskOverlapPolicy, ScheduledTaskAgentConfig, SessionGoalCreatedBy, SocialProvider, SocialConnectionStatus, McpServerConnectionRef as McpServerConnectionRef$1, SessionTurnSource, ResourceRef, ToolRef, ReasoningEffort, SandboxBackend, SessionGoal, CapabilityPack, SessionMcpServerMetadata, SessionTurn, SessionEvent, SessionStatus, Session, BillingBalance, AccessContext, FileAsset, ApiKey, ConnectionMetadata, KnowledgeMemory, ScheduledTask, ScheduledTaskTriggerType, ScheduledTaskRun, SandboxOs, SocialConnection, SocialPost, Workspace, WorkspaceEnvironment, CapabilityInstallation, PackInstallation, SessionTurnStatus, CapabilityCatalogItem, FileUploadStatus, ManagedAccount, AccessGrant, WorkspaceRegisteredPack, UsageEvent, WorkspaceMember, SessionGoalStatus, WorkspaceEnvironmentVariableMetadata, PackInstallationStatus, ScheduledTaskRunStatus } from '@opengeni/contracts';
+import { environmentsEncryptionKeyBytes, Settings, McpServerConnectionRef } from '@opengeni/config';
 import { refreshCodexToken, CodexTokenSnapshot, CodexUsagePayload } from '@opengeni/codex';
 import { PgDatabase } from 'drizzle-orm/pg-core';
-import { s as schema, e as enrollmentOsValues, a as enrollmentExposureValues, d as deviceEnrollmentStatusValues, b as enrollmentStatusValues, c as sandboxKindValues, f as sessionRecordingCodecValues, g as sessionRecordingModeValues, h as sessionRecordingStateValues } from './schema-C7Wvjwge.js';
+import { s as schema, e as enrollmentOsValues, a as enrollmentExposureValues, d as deviceEnrollmentStatusValues, b as enrollmentStatusValues, c as sandboxKindValues, f as sessionRecordingCodecValues, g as sessionRecordingModeValues, h as sessionRecordingStateValues } from './schema-Dsz6UHNv.js';
 import 'drizzle-orm';
 import './migrate.js';
 
@@ -123,6 +123,50 @@ declare function buildCodexTokenResolver(db: Database, settings: Settings, works
  */
 declare function fetchCodexUsageForAccount(db: Database, settings: Settings, workspaceId: string, credentialId: string): Promise<CodexUsagePayload>;
 
+type ResolveConnectionCredentialResult = {
+    status: "ok";
+    headers: Record<string, string>;
+    connectionId: string;
+    expiresAt?: Date | null;
+} | {
+    status: "auth_needed";
+    reason: "missing_connection" | "expired" | "insufficient_scope" | "refresh_failed";
+    providerDomain: string;
+    connectionId?: string;
+    scopes?: string[];
+    resource?: string;
+    authorizationUrl?: string;
+};
+type ResolveConnectionCredentialInput = {
+    workspaceId: string;
+    subjectId?: string;
+    serverId: string;
+    toolId?: string;
+    connectionRef: McpServerConnectionRef;
+    forceRefresh?: boolean;
+};
+type ConnectionBrokerDeps = {
+    loadCredential: typeof loadConnectionCredentialForBroker;
+    recordRefresh: typeof recordConnectionTokenRefresh;
+    setStatus: typeof setConnectionStatus;
+    recordUsed: typeof recordConnectionUsed;
+    refresh: typeof refreshOAuthConnectionCredential;
+    encrypt: typeof encryptEnvironmentValue;
+    keyBytes: typeof environmentsEncryptionKeyBytes;
+    now: () => Date;
+};
+declare function buildConnectionTokenResolver(db: Database, settings: Settings, deps?: ConnectionBrokerDeps): (input: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult>;
+declare class ConnectionRefreshHttpError extends Error {
+    readonly httpStatus: number;
+    constructor(httpStatus: number);
+}
+declare function refreshOAuthConnectionCredential(cred: ConnectionCredentialForBroker, ref: McpServerConnectionRef, settings?: Settings): Promise<{
+    credential: Record<string, unknown>;
+    expiresAt: Date | null;
+    grantedScopes?: string[];
+}>;
+declare function isPrivateAddress(address: string): boolean;
+
 type Database = PgDatabase<any, typeof schema>;
 type DbClient = {
     db: Database;
@@ -418,6 +462,35 @@ type RegisterWorkspacePackInput = {
     workspaceId: string;
     pack: CapabilityPack;
 };
+type CreateKnowledgeMemoryInput = {
+    accountId: string;
+    workspaceId: string;
+    status?: KnowledgeMemoryStatus | undefined;
+    kind?: KnowledgeMemoryKind | undefined;
+    scope?: string | undefined;
+    text: string;
+    sourceRefs?: KnowledgeSourceRef[] | undefined;
+    confidence?: number | undefined;
+    metadata?: Record<string, unknown> | undefined;
+    createdBySessionId?: string | null | undefined;
+};
+type UpdateKnowledgeMemoryInput = {
+    status?: KnowledgeMemoryStatus | undefined;
+    kind?: KnowledgeMemoryKind | undefined;
+    scope?: string | undefined;
+    text?: string | undefined;
+    sourceRefs?: KnowledgeSourceRef[] | undefined;
+    confidence?: number | undefined;
+    metadata?: Record<string, unknown> | undefined;
+    reviewedBy?: string | null | undefined;
+};
+type ListKnowledgeMemoryOptions = {
+    query?: string | undefined;
+    status?: KnowledgeMemoryStatus | undefined;
+    kind?: KnowledgeMemoryKind | undefined;
+    scope?: string | undefined;
+    limit?: number | undefined;
+};
 type CreateSocialConnectionInput = {
     accountId: string;
     workspaceId: string;
@@ -443,6 +516,88 @@ type CreateSocialPostInput = {
     metrics?: Record<string, number>;
     raw?: Record<string, unknown>;
 };
+type CreateConnectionInput = {
+    accountId: string;
+    workspaceId: string;
+    subjectId?: string | null;
+    providerDomain: string;
+    kind: ConnectionKind;
+    status?: ConnectionStatus;
+    credentialEncrypted: string;
+    grantedScopes?: string[];
+    expiresAt?: Date | null;
+    metadata?: Record<string, unknown>;
+    createdBySubjectId?: string | null;
+    updatedBySubjectId?: string | null;
+};
+type UpdateConnectionInput = {
+    workspaceId: string;
+    connectionId: string;
+    visibleToSubjectId?: string | null;
+    expectedVersion?: number | undefined;
+    subjectId?: string | null;
+    providerDomain?: string;
+    kind?: ConnectionKind;
+    status?: ConnectionStatus;
+    credentialEncrypted?: string;
+    grantedScopes?: string[];
+    expiresAt?: Date | null;
+    metadata?: Record<string, unknown>;
+    updatedBySubjectId?: string | null;
+};
+type ConnectionCredentialForBroker = {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    subjectId: string | null;
+    providerDomain: string;
+    kind: ConnectionKind;
+    status: ConnectionStatus;
+    credential: Record<string, unknown>;
+    grantedScopes: string[];
+    expiresAt: Date | null;
+    lastRefreshAt: Date | null;
+    version: number;
+    metadata: Record<string, unknown>;
+};
+type IntegrationOAuthClientForUse = {
+    id: string;
+    issuer: string;
+    authorizationServer: string;
+    clientId: string;
+    clientSecret: string | null;
+    tokenEndpointAuthMethod: string;
+    metadata: Record<string, unknown>;
+    createdAt: Date;
+    updatedAt: Date;
+};
+type StoredIntegrationOAuthClient = {
+    id: string;
+    issuer: string;
+    authorizationServer: string;
+    clientId: string;
+    clientSecretEncrypted: string | null;
+    tokenEndpointAuthMethod: string;
+    metadata: Record<string, unknown>;
+    createdAt: Date;
+    updatedAt: Date;
+};
+type StoreIntegrationOAuthClientInput = {
+    issuer: string;
+    authorizationServer: string;
+    clientId: string;
+    clientSecretEncrypted?: string | null;
+    tokenEndpointAuthMethod?: string;
+    metadata?: Record<string, unknown>;
+};
+type ConsumeOAuthStateNonceInput = {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    nonce: string;
+    expiresAt: Date;
+    now: Date;
+};
 type CreateCapabilityCatalogItemInput = {
     accountId: string;
     workspaceId: string;
@@ -459,6 +614,64 @@ type CreateCapabilityCatalogItemInput = {
     authModel?: string | null;
     metadata?: Record<string, unknown>;
 };
+type ImportBatch = {
+    id: string;
+    source: string;
+    snapshotDate: string;
+    snapshotRef: string | null;
+    attributionNote: string;
+    importedCount: number;
+    skippedCount: number;
+    quarantinedCount: number;
+    logoFailureCount: number;
+    staleCount: number;
+    details: Record<string, unknown>;
+    createdAt: string;
+    updatedAt: string;
+};
+type CreateImportBatchInput = {
+    source: string;
+    snapshotDate: Date;
+    snapshotRef?: string | null;
+    attributionNote: string;
+    importedCount?: number;
+    skippedCount?: number;
+    quarantinedCount?: number;
+    logoFailureCount?: number;
+    staleCount?: number;
+    details?: Record<string, unknown>;
+};
+type UpdateImportBatchCountsInput = {
+    importedCount: number;
+    skippedCount: number;
+    quarantinedCount: number;
+    logoFailureCount: number;
+    staleCount: number;
+    details?: Record<string, unknown>;
+};
+type RegistryCapabilityCatalogItemInput = {
+    id: string;
+    providerDomain: string;
+    name: string;
+    description?: string | null;
+    mcpUrl: string;
+    transport: string;
+    authKind: "oauth2" | "api_key" | "none" | "unknown";
+    credentialFacts: Array<Record<string, unknown>>;
+    tier: "verified" | "community";
+    provenance: string;
+    logoAssetPath?: string | null;
+    importBatchId: string;
+    scopesHint?: string[];
+    homepageUrl?: string | null;
+    tags?: string[];
+    metadata?: Record<string, unknown>;
+};
+type RegistryCatalogSurfaceKey = {
+    id: string;
+    providerDomain: string;
+    mcpUrl: string;
+};
 type EnableCapabilityInstallationInput = {
     accountId: string;
     workspaceId: string;
@@ -482,6 +695,7 @@ type EnabledMcpCapabilityServer = {
      * capability API surface.
      */
     headersEncrypted?: Record<string, string>;
+    connectionRef?: McpServerConnectionRef$1;
 };
 type CreateSessionMcpServerInput = {
     id: string;
@@ -490,6 +704,7 @@ type CreateSessionMcpServerInput = {
     allowedTools?: string[] | null;
     timeoutMs?: number | null;
     cacheToolsList?: boolean | null;
+    requireApproval?: boolean | string[] | null;
     headersEncrypted?: Record<string, string>;
 };
 type UpdateSessionMcpServerCredentialsInput = {
@@ -504,6 +719,7 @@ type SessionMcpServerForRun = SessionMcpServerMetadata & {
     allowedTools?: string[];
     timeoutMs?: number;
     cacheToolsList?: boolean;
+    requireApproval?: boolean | string[];
     headers: Record<string, string>;
 };
 type EnqueueSessionTurnInput = {
@@ -568,6 +784,14 @@ declare function registerWorkspacePack(db: Database, input: RegisterWorkspacePac
 declare function listWorkspacePacks(db: Database, workspaceId: string): Promise<WorkspaceRegisteredPack[]>;
 declare function getWorkspacePack(db: Database, workspaceId: string, packId: string): Promise<WorkspaceRegisteredPack | null>;
 declare function deleteWorkspacePack(db: Database, workspaceId: string, packId: string): Promise<boolean>;
+declare function createImportBatch(db: Database, input: CreateImportBatchInput): Promise<ImportBatch>;
+declare function updateImportBatchCounts(db: Database, id: string, input: UpdateImportBatchCountsInput): Promise<ImportBatch>;
+declare function upsertRegistryCapabilityCatalogItem(db: Database, input: RegistryCapabilityCatalogItemInput): Promise<CapabilityCatalogItem>;
+declare function listRegistryCatalogSurfaceKeys(db: Database): Promise<RegistryCatalogSurfaceKey[]>;
+declare function markStaleRegistryCatalogItems(db: Database, activeKeys: Iterable<{
+    providerDomain: string;
+    mcpUrl: string;
+}>, importBatchId: string): Promise<number>;
 declare function upsertCapabilityCatalogItem(db: Database, input: CreateCapabilityCatalogItemInput): Promise<CapabilityCatalogItem>;
 declare function listCapabilityCatalogItems(db: Database, workspaceId: string): Promise<CapabilityCatalogItem[]>;
 declare function getCapabilityCatalogItem(db: Database, workspaceId: string, capabilityId: string): Promise<CapabilityCatalogItem | null>;
@@ -591,6 +815,40 @@ declare function decryptedCapabilityHeaders(server: EnabledMcpCapabilityServer,
  */
 declare function getStoredCapabilityHeaderCiphertext(db: Database, workspaceId: string, capabilityId: string): Promise<Record<string, string> | null>;
 declare function mcpServerIdForCapability(capabilityId: string, metadata?: Record<string, unknown>): string;
+declare function createConnection(db: Database, input: CreateConnectionInput): Promise<ConnectionMetadata>;
+declare function listConnectionsMetadata(db: Database, workspaceId: string, subjectId?: string | null): Promise<ConnectionMetadata[]>;
+declare function getConnectionMetadata(db: Database, workspaceId: string, connectionId: string, subjectId?: string | null): Promise<ConnectionMetadata | null>;
+declare function updateConnection(db: Database, input: UpdateConnectionInput): Promise<ConnectionMetadata | null>;
+declare function revokeConnection(db: Database, workspaceId: string, connectionId: string, updatedBySubjectId?: string | null): Promise<ConnectionMetadata | null>;
+declare function loadConnectionCredentialForBroker(db: Database, settings: Settings, input: {
+    workspaceId: string;
+    connectionId?: string;
+    providerDomain: string;
+    kind?: ConnectionKind;
+    subjectId?: string | null;
+    allowSubjectOwned?: boolean;
+}): Promise<ConnectionCredentialForBroker | null>;
+declare function recordConnectionTokenRefresh(db: Database, input: {
+    id: string;
+    version: number;
+    workspaceId: string;
+    credentialEncrypted: string;
+    expiresAt: Date | null;
+    grantedScopes?: string[];
+    lastRefreshAt: Date;
+}): Promise<boolean>;
+declare function setConnectionStatus(db: Database, workspaceId: string, status: ConnectionStatus, lastError: string | null, guard: {
+    id: string;
+    version: number;
+}): Promise<boolean>;
+declare function recordConnectionUsed(db: Database, workspaceId: string, connectionId: string): Promise<void>;
+declare function loadIntegrationOAuthClient(db: Database, settings: Settings, issuer: string): Promise<IntegrationOAuthClientForUse | null>;
+declare function storeIntegrationOAuthClient(db: Database, input: StoreIntegrationOAuthClientInput): Promise<StoredIntegrationOAuthClient>;
+declare function consumeIntegrationOAuthStateNonce(db: Database, input: ConsumeOAuthStateNonceInput): Promise<boolean>;
+declare function createKnowledgeMemory(db: Database, input: CreateKnowledgeMemoryInput): Promise<KnowledgeMemory>;
+declare function updateKnowledgeMemory(db: Database, workspaceId: string, memoryId: string, input: UpdateKnowledgeMemoryInput): Promise<KnowledgeMemory>;
+declare function getKnowledgeMemory(db: Database, workspaceId: string, memoryId: string): Promise<KnowledgeMemory | null>;
+declare function listKnowledgeMemories(db: Database, workspaceId: string, options?: ListKnowledgeMemoryOptions): Promise<KnowledgeMemory[]>;
 declare function createSocialConnection(db: Database, input: CreateSocialConnectionInput): Promise<SocialConnection>;
 declare function listSocialConnections(db: Database, workspaceId: string, limit?: number): Promise<SocialConnection[]>;
 declare function getSocialConnection(db: Database, workspaceId: string, connectionId: string): Promise<SocialConnection | null>;
@@ -1077,6 +1335,23 @@ type ListSessionEventsOptions = {
 declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string): Promise<SessionEvent[]>;
 declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string, after: number, limit?: number): Promise<SessionEvent[]>;
 declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string, options: ListSessionEventsOptions): Promise<SessionEvent[]>;
+type ToolspaceCallReservation = {
+    reserved: true;
+    count: number;
+} | {
+    reserved: false;
+};
+/**
+ * Atomically reserve one toolspace call against a turn's per-turn budget.
+ *
+ * A single conditional UPDATE increments `toolspace_call_count` only while it is
+ * below `limit` and returns the post-increment value. Concurrent reservations
+ * for the same turn serialize on the row lock, so exactly `limit` of N
+ * simultaneous callers observe `reserved: true` — closing the read-then-append
+ * TOCTOU the event-count approach had. `reserved: false` means the turn is at or
+ * over budget (or the turn row no longer exists).
+ */
+declare function reserveToolspaceCallForTurn(db: Database, workspaceId: string, sessionId: string, turnId: string, limit: number): Promise<ToolspaceCallReservation>;
 declare function getSessionEvent(db: Database, workspaceId: string, eventId: string): Promise<SessionEvent | null>;
 declare function getLatestRunState(db: Database, workspaceId: string, sessionId: string): Promise<{
     id: string;
@@ -1616,6 +1891,9 @@ type EnrollmentRecord = {
     pubkey: string;
     exposure: EnrollmentExposure;
     hasDisplay: boolean;
+    /** Set when a display exists but capture is not permitted (macOS Screen Recording
+     *  not granted); null when capture is permitted or the machine is headless. */
+    desktopUnavailableReason: string | null;
     allowScreenControl: boolean;
     status: EnrollmentStatus;
     os: EnrollmentOs;
@@ -1661,11 +1939,12 @@ declare function touchEnrollmentLastSeen(db: Database, input: {
     workspaceId: string;
     enrollmentId: string;
 }): Promise<void>;
-declare function setEnrollmentHasDisplay(db: Database, input: {
+declare function setEnrollmentDisplayState(db: Database, input: {
     accountId: string;
     workspaceId: string;
     enrollmentId: string;
     hasDisplay: boolean;
+    desktopUnavailableReason: string | null;
 }): Promise<{
     updated: boolean;
 }>;
@@ -2144,4 +2423,4 @@ type LockedSessionUpdateResult = {
 declare function appendSessionEventsWithLockedSessionUpdate(db: Database, workspaceId: string, sessionId: string, build: (session: Session, context: LockedSessionUpdateContext) => LockedSessionUpdateResult | Promise<LockedSessionUpdateResult>): Promise<SessionEvent[]>;
 declare function sessionSubject(workspaceId: string, sessionId: string): string;
 
-export { SandboxLeaseSupersededError as $, type AccrueWarmSecondsResult as A, type BootstrapWorkspaceInput as B, CLEARED_RUN_STATE as C, type Database as D, type EnableCapabilityInstallationInput as E, type EnrollmentExposure as F, type EnrollmentOs as G, type EnrollmentRecord as H, type EnrollmentStatus as I, type ForceDrainResult as J, type GitHubInstallation as K, type GoalContinuationDecision as L, type LeaseHolderKind as M, type LeaseSnapshot as N, type ListSessionEventsOptions as O, type LiveModalSandboxLeaseAttribution as P, type ProvisionResult, type ProvisionRolesOptions, MACHINE_METRICS_SERIES_INTERVAL_MS as Q, type MachineMetricsRow as R, type MachineMetricsSample as S, type MeterableWarmLease as T, type ReapDrainable as U, type RegisterWorkspacePackInput as V, type RlsContext as W, type RlsStrategy as X, SandboxImageConflictError as Y, type SandboxKind as Z, type SandboxLeaseLiveness as _, type AcquireLeaseInput as a, createSessionGoal as a$, type SandboxPtySessionRow as a0, type SandboxRecord as a1, type SessionCodexState as a2, type SessionMcpServerForRun as a3, type SessionRecordingCodec as a4, type SessionRecordingMode as a5, type SessionRecordingRow as a6, type SessionRecordingState as a7, type StreamAcknowledgment as a8, type UpdateQueuedSessionTurnInput as a9, commitWarmingToWarm as aA, completeFileUpload as aB, confirmDrainCold as aC, consumeDeviceEnrollmentRequest as aD, consumeSessionCompactionRequest as aE, countActiveApiKeysForWorkspace as aF, countActiveSessionHistoryItems as aG, countActiveSessionsForWorkspace as aH, countActiveSessionsUsingEnvironment as aI, countConsecutiveReactiveRotations as aJ, countQueuedTurns as aK, countSandboxLeasesByLiveness as aL, countScheduledTasksForWorkspace as aM, countScheduledTasksUsingEnvironment as aN, countSessionHistoryItems as aO, countTurnSessionHistoryItems as aP, countWorkspaceEnvironments as aQ, countWorkspacesForAccount as aR, createApiKey as aS, createDb as aT, createDeviceEnrollmentRequest as aU, createEnrollment as aV, createFileUpload as aW, createSandbox as aX, createScheduledTask as aY, createScheduledTaskRun as aZ, createSession as a_, type UpdateScheduledTaskInput as aa, type UpdateSessionMcpServerCredentialsInput as ab, type UpdateSessionMcpServerCredentialsResult as ac, type UserLookup as ad, type WakeParentForChildCompletionInput as ae, type WakeParentForChildCompletionResult as af, type WorkspaceEnvironmentForRun as ag, accrueWarmSeconds as ah, acquireLease as ai, allAccountPermissions as aj, allWorkspacePermissions as ak, appendSessionEvents as al, appendSessionEventsAndUpdateSession as am, appendSessionEventsWithLockedSessionUpdate as an, appendSessionHistoryItems as ao, applyContextCompaction as ap, applyCreditDebitUpToBalance as aq, applyCreditLedgerEntry as ar, approveDeviceEnrollmentRequest as as, bootstrapWorkspace as at, buildCodexTokenResolver as au, cancelQueuedSessionTurn as av, claimNextQueuedTurn as aw, clearSessionContext as ax, clearedContextMarkerItem as ay, closePtySession as az, type AcquireLeaseResult as b, getStoredCapabilityHeaderCiphertext as b$, createSessionMcpServers as b0, createSessionWithIdempotencyKey as b1, createSocialConnection as b2, createSocialPost as b3, createTurn as b4, createWorkspace as b5, createWorkspaceEnvironment as b6, decryptEnvironmentValue as b7, decryptedCapabilityHeaders as b8, deleteRecording as b9, getCapabilityCatalogItem as bA, getCapabilityInstallation as bB, getCodexCredentialStatus as bC, getCodexRotationSettings as bD, getDeviceEnrollmentRequestByDeviceCode as bE, getEnrollment as bF, getFile as bG, getFileUpload as bH, getLatestRunState as bI, getManagedAccount as bJ, getManagedUserByEmail as bK, getOpenPtySession as bL, getPackInstallation as bM, getPendingDeviceEnrollmentRequestByUserCode as bN, getPendingDeviceEnrollmentRequestByUserCodeGlobal as bO, getRecording as bP, getSandbox as bQ, getSandboxSessionEnvelope as bR, getScheduledTask as bS, getSession as bT, getSessionByCreateIdempotencyKey as bU, getSessionCodexState as bV, getSessionEvent as bW, getSessionGoal as bX, getSessionHistoryItems as bY, getSessionTurn as bZ, getSocialConnection as b_, deleteScheduledTask as ba, deleteWorkspace as bb, deleteWorkspaceEnvironment as bc, deleteWorkspaceEnvironmentVariable as bd, deleteWorkspacePack as be, denyDeviceEnrollmentRequest as bf, disableCapabilityInstallation as bg, disconnectAllCodexAccounts as bh, disconnectCodexAccount as bi, enableCapabilityInstallation as bj, enablePackInstallation as bk, encryptEnvironmentValue as bl, enqueueSessionTurn as bm, ensureCodexRotationSettings as bn, ensureManagedAccessForUser as bo, evaluateGoalContinuation as bp, failWarmingToCold as bq, fetchCodexUsageForAccount as br, finalizeEnrollmentByToken as bs, findActiveApiKeyByHash as bt, finishTurn as bu, forceDrainOverLimitViewerOnlyBoxes as bv, getActiveSessionHistoryItems as bw, getAnySessionInGroup as bx, getBillingBalance as by, getBillingCustomer as bz, type ActiveSandboxPointer as c, recordAuditEvent as c$, getStreamAcknowledgment as c0, getWorkspace as c1, getWorkspaceEnvironment as c2, getWorkspaceEnvironmentByName as c3, getWorkspaceEnvironmentValuesForRun as c4, getWorkspaceGrant as c5, getWorkspacePack as c6, grantWorkspaceAccess as c7, hasCreditLedgerEntry as c8, heartbeatLeaseHolder as c9, listSessionMcpServerMetadata as cA, listSessionMcpServersForRun as cB, listSessionTurns as cC, listSessions as cD, listSocialConnections as cE, listSocialPosts as cF, listUsageEvents as cG, listWorkspaceEnvironments as cH, listWorkspaceMembers as cI, listWorkspacePacks as cJ, listWorkspacesForSubject as cK, loadCodexCredentialForRun as cL, loadWorkspaceEnvironmentForRun as cM, markFileUploadFailed as cN, markStripeWebhookProcessed as cO, mcpServerIdForCapability as cP, nextSessionHistoryPosition as cQ, orphanedResultRowIndicesForRepair as cR, persistDrainSnapshot as cS, reArmDrainingLease as cT, readActiveSandbox as cU, readLease as cV, readMachineMetricsLatest as cW, readMachineMetricsLatestForWorkspace as cX, readMachineMetricsSeries as cY, reapStaleLeaseHolders as cZ, reapStaleLeaseHoldersGlobal as c_, incrementTurnWorkerDeathRedispatches as ca, ingestMachineMetricsSample as cb, insertMachineMetricsSeries as cc, insertPtySession as cd, insertRecording as ce, isCodexBilledTurn as cf, isStripeWebhookProcessed as cg, listApiKeys as ch, listCapabilityCatalogItems as ci, listCapabilityInstallations as cj, listCodexAccountStatuses as ck, listDistinctEnvironmentIdsInGroup as cl, listEnabledMcpCapabilityServers as cm, listEnrollments as cn, listGitHubInstallationIdsForWorkspace as co, listGitHubInstallationsForWorkspace as cp, listLiveModalSandboxLeaseAttributions as cq, listMeterableWarmLeases as cr, listOpenPtySessions as cs, listPackInstallations as ct, listRecordings as cu, listSandboxes as cv, listScheduledTaskRuns as cw, listScheduledTasks as cx, listSessionEvents as cy, listSessionIdsInGroup as cz, type AppendEventInput as d, upsertGitHubInstallation as d$, recordCodexAccountConnectors as d0, recordCodexAccountUsage as d1, recordCodexTokenRefresh as d2, recordLeaseDataPlaneUrl as d3, recordLeaseTerminalDataPlaneUrl as d4, recordSessionActiveCodexCredential as d5, recordStreamAcknowledgment as d6, recordStripeWebhookEvent as d7, recordUsageEvent as d8, recordWarmingSandboxCreated as d9, setCodexCredentialStatus as dA, setEnrollmentHasDisplay as dB, setRlsContext as dC, setSessionCodexPin as dD, setSessionGoalLastContinuationTurn as dE, setSessionGoalStatus as dF, setSessionLastInputTokens as dG, setSessionStatus as dH, setTemporalWorkflowId as dI, setWorkspaceEnvironmentVariable as dJ, sumUsageQuantity as dK, touchEnrollmentLastSeen as dL, updateCodexRotationSettings as dM, updatePackInstallationStatus as dN, updatePtySessionActivity as dO, updateQueuedSessionTurn as dP, updateRecording as dQ, updateScheduledTask as dR, updateScheduledTaskRun as dS, updateSessionGoal as dT, updateSessionMcpServerCredentials as dU, updateSessionTitle as dV, updateWorkspace as dW, updateWorkspaceEnvironment as dX, upsertBillingCustomer as dY, upsertCapabilityCatalogItem as dZ, upsertCodexSubscriptionCredential as d_, registerDbBinding as da, registerWorkspacePack as db, releaseLeaseHolder as dc, removeWorkspaceMember as dd, renameCodexAccount as de, reorderQueuedSessionTurns as df, requestSessionCompaction as dg, requeuePreemptedTurn as dh, requireFile as di, requireScheduledTask as dj, requireSession as dk, requireSocialConnection as dl, requireWorkspace as dm, revokeApiKey as dn, revokeEnrollment as dp, revokeViewer as dq, rlsContextForWorkspace as dr, rlsStrategyFor as ds, sanitizeEventPayload as dt, sanitizeEventString as du, saveRunState as dv, sessionSubject as dw, setActiveCodexCredential as dx, setActiveSandbox as dy, setCodexCredentialExhausted as dz, CODEX_ROTATION_STRATEGIES as e, upsertMachineMetricsLatest as e0, upsertSandboxSessionEnvelope as e1, upsertSessionGoal as e2, wakeParentSessionForChildCompletion as e3, withAccountRls as e4, withRlsContext as e5, withWorkspaceRls as e6, withWorkspaceUsageLock as e7, workspaceCodexSubscriptionActive as e8, type ClearSessionContextResult as f, type CodexAccountStatus as g, type CodexAccountUsageSnapshot as h, type CodexAuthDeps as i, type CodexCredentialForRun as j, type CodexCredentialTokens as k, type CodexRotationSettings as l, type CodexRotationStrategy as m, type CreateCapabilityCatalogItemInput as n, type CreateDbOptions as o, type CreatePackInstallationInput as p, provisionRoles, type CreateScheduledTaskInput as q, type CreateSessionGoalInput as r, type CreateSessionMcpServerInput as s, type CreateSocialConnectionInput as t, type CreateSocialPostInput as u, type DbClient as v, type DeviceEnrollmentRequestRecord as w, type DeviceEnrollmentStatus as x, type EnabledMcpCapabilityServer as y, type EnqueueSessionTurnInput as z };
+export { type MachineMetricsRow as $, type AccrueWarmSecondsResult as A, type BootstrapWorkspaceInput as B, CLEARED_RUN_STATE as C, type CreateSocialConnectionInput as D, type CreateSocialPostInput as E, type Database as F, type DbClient as G, type DeviceEnrollmentRequestRecord as H, type DeviceEnrollmentStatus as I, type EnableCapabilityInstallationInput as J, type EnabledMcpCapabilityServer as K, type EnqueueSessionTurnInput as L, type EnrollmentExposure as M, type EnrollmentOs as N, type EnrollmentRecord as O, type EnrollmentStatus as P, type ProvisionResult, type ProvisionRolesOptions, type ForceDrainResult as Q, type GitHubInstallation as R, type GoalContinuationDecision as S, type ImportBatch as T, type IntegrationOAuthClientForUse as U, type LeaseHolderKind as V, type LeaseSnapshot as W, type ListKnowledgeMemoryOptions as X, type ListSessionEventsOptions as Y, type LiveModalSandboxLeaseAttribution as Z, MACHINE_METRICS_SERIES_INTERVAL_MS as _, type AcquireLeaseInput as a, countActiveApiKeysForWorkspace as a$, type MachineMetricsSample as a0, type MeterableWarmLease as a1, type ReapDrainable as a2, type RegisterWorkspacePackInput as a3, type RegistryCapabilityCatalogItemInput as a4, type RegistryCatalogSurfaceKey as a5, type ResolveConnectionCredentialInput as a6, type ResolveConnectionCredentialResult as a7, type RlsContext as a8, type RlsStrategy as a9, type WorkspaceEnvironmentForRun as aA, accrueWarmSeconds as aB, acquireLease as aC, allAccountPermissions as aD, allWorkspacePermissions as aE, appendSessionEvents as aF, appendSessionEventsAndUpdateSession as aG, appendSessionEventsWithLockedSessionUpdate as aH, appendSessionHistoryItems as aI, applyContextCompaction as aJ, applyCreditDebitUpToBalance as aK, applyCreditLedgerEntry as aL, approveDeviceEnrollmentRequest as aM, bootstrapWorkspace as aN, buildCodexTokenResolver as aO, buildConnectionTokenResolver as aP, cancelQueuedSessionTurn as aQ, claimNextQueuedTurn as aR, clearSessionContext as aS, clearedContextMarkerItem as aT, closePtySession as aU, commitWarmingToWarm as aV, completeFileUpload as aW, confirmDrainCold as aX, consumeDeviceEnrollmentRequest as aY, consumeIntegrationOAuthStateNonce as aZ, consumeSessionCompactionRequest as a_, SandboxImageConflictError as aa, type SandboxKind as ab, type SandboxLeaseLiveness as ac, SandboxLeaseSupersededError as ad, type SandboxPtySessionRow as ae, type SandboxRecord as af, type SessionCodexState as ag, type SessionMcpServerForRun as ah, type SessionRecordingCodec as ai, type SessionRecordingMode as aj, type SessionRecordingRow as ak, type SessionRecordingState as al, type StoreIntegrationOAuthClientInput as am, type StoredIntegrationOAuthClient as an, type StreamAcknowledgment as ao, type ToolspaceCallReservation as ap, type UpdateConnectionInput as aq, type UpdateImportBatchCountsInput as ar, type UpdateKnowledgeMemoryInput as as, type UpdateQueuedSessionTurnInput as at, type UpdateScheduledTaskInput as au, type UpdateSessionMcpServerCredentialsInput as av, type UpdateSessionMcpServerCredentialsResult as aw, type UserLookup as ax, type WakeParentForChildCompletionInput as ay, type WakeParentForChildCompletionResult as az, type AcquireLeaseResult as b, getCodexCredentialStatus as b$, countActiveSessionHistoryItems as b0, countActiveSessionsForWorkspace as b1, countActiveSessionsUsingEnvironment as b2, countConsecutiveReactiveRotations as b3, countQueuedTurns as b4, countSandboxLeasesByLiveness as b5, countScheduledTasksForWorkspace as b6, countScheduledTasksUsingEnvironment as b7, countSessionHistoryItems as b8, countTurnSessionHistoryItems as b9, deleteWorkspace as bA, deleteWorkspaceEnvironment as bB, deleteWorkspaceEnvironmentVariable as bC, deleteWorkspacePack as bD, denyDeviceEnrollmentRequest as bE, disableCapabilityInstallation as bF, disconnectAllCodexAccounts as bG, disconnectCodexAccount as bH, enableCapabilityInstallation as bI, enablePackInstallation as bJ, encryptEnvironmentValue as bK, enqueueSessionTurn as bL, ensureCodexRotationSettings as bM, ensureManagedAccessForUser as bN, evaluateGoalContinuation as bO, failWarmingToCold as bP, fetchCodexUsageForAccount as bQ, finalizeEnrollmentByToken as bR, findActiveApiKeyByHash as bS, finishTurn as bT, forceDrainOverLimitViewerOnlyBoxes as bU, getActiveSessionHistoryItems as bV, getAnySessionInGroup as bW, getBillingBalance as bX, getBillingCustomer as bY, getCapabilityCatalogItem as bZ, getCapabilityInstallation as b_, countWorkspaceEnvironments as ba, countWorkspacesForAccount as bb, createApiKey as bc, createConnection as bd, createDb as be, createDeviceEnrollmentRequest as bf, createEnrollment as bg, createFileUpload as bh, createImportBatch as bi, createKnowledgeMemory as bj, createSandbox as bk, createScheduledTask as bl, createScheduledTaskRun as bm, createSession as bn, createSessionGoal as bo, createSessionMcpServers as bp, createSessionWithIdempotencyKey as bq, createSocialConnection as br, createSocialPost as bs, createTurn as bt, createWorkspace as bu, createWorkspaceEnvironment as bv, decryptEnvironmentValue as bw, decryptedCapabilityHeaders as bx, deleteRecording as by, deleteScheduledTask as bz, type ActiveSandboxPointer as c, listScheduledTaskRuns as c$, getCodexRotationSettings as c0, getConnectionMetadata as c1, getDeviceEnrollmentRequestByDeviceCode as c2, getEnrollment as c3, getFile as c4, getFileUpload as c5, getKnowledgeMemory as c6, getLatestRunState as c7, getManagedAccount as c8, getManagedUserByEmail as c9, heartbeatLeaseHolder as cA, incrementTurnWorkerDeathRedispatches as cB, ingestMachineMetricsSample as cC, insertMachineMetricsSeries as cD, insertPtySession as cE, insertRecording as cF, isCodexBilledTurn as cG, isPrivateAddress as cH, isStripeWebhookProcessed as cI, listApiKeys as cJ, listCapabilityCatalogItems as cK, listCapabilityInstallations as cL, listCodexAccountStatuses as cM, listConnectionsMetadata as cN, listDistinctEnvironmentIdsInGroup as cO, listEnabledMcpCapabilityServers as cP, listEnrollments as cQ, listGitHubInstallationIdsForWorkspace as cR, listGitHubInstallationsForWorkspace as cS, listKnowledgeMemories as cT, listLiveModalSandboxLeaseAttributions as cU, listMeterableWarmLeases as cV, listOpenPtySessions as cW, listPackInstallations as cX, listRecordings as cY, listRegistryCatalogSurfaceKeys as cZ, listSandboxes as c_, getOpenPtySession as ca, getPackInstallation as cb, getPendingDeviceEnrollmentRequestByUserCode as cc, getPendingDeviceEnrollmentRequestByUserCodeGlobal as cd, getRecording as ce, getSandbox as cf, getSandboxSessionEnvelope as cg, getScheduledTask as ch, getSession as ci, getSessionByCreateIdempotencyKey as cj, getSessionCodexState as ck, getSessionEvent as cl, getSessionGoal as cm, getSessionHistoryItems as cn, getSessionTurn as co, getSocialConnection as cp, getStoredCapabilityHeaderCiphertext as cq, getStreamAcknowledgment as cr, getWorkspace as cs, getWorkspaceEnvironment as ct, getWorkspaceEnvironmentByName as cu, getWorkspaceEnvironmentValuesForRun as cv, getWorkspaceGrant as cw, getWorkspacePack as cx, grantWorkspaceAccess as cy, hasCreditLedgerEntry as cz, type AppendEventInput as d, revokeConnection as d$, listScheduledTasks as d0, listSessionEvents as d1, listSessionIdsInGroup as d2, listSessionMcpServerMetadata as d3, listSessionMcpServersForRun as d4, listSessionTurns as d5, listSessions as d6, listSocialConnections as d7, listSocialPosts as d8, listUsageEvents as d9, recordCodexAccountUsage as dA, recordCodexTokenRefresh as dB, recordConnectionTokenRefresh as dC, recordConnectionUsed as dD, recordLeaseDataPlaneUrl as dE, recordLeaseTerminalDataPlaneUrl as dF, recordSessionActiveCodexCredential as dG, recordStreamAcknowledgment as dH, recordStripeWebhookEvent as dI, recordUsageEvent as dJ, recordWarmingSandboxCreated as dK, refreshOAuthConnectionCredential as dL, registerDbBinding as dM, registerWorkspacePack as dN, releaseLeaseHolder as dO, removeWorkspaceMember as dP, renameCodexAccount as dQ, reorderQueuedSessionTurns as dR, requestSessionCompaction as dS, requeuePreemptedTurn as dT, requireFile as dU, requireScheduledTask as dV, requireSession as dW, requireSocialConnection as dX, requireWorkspace as dY, reserveToolspaceCallForTurn as dZ, revokeApiKey as d_, listWorkspaceEnvironments as da, listWorkspaceMembers as db, listWorkspacePacks as dc, listWorkspacesForSubject as dd, loadCodexCredentialForRun as de, loadConnectionCredentialForBroker as df, loadIntegrationOAuthClient as dg, loadWorkspaceEnvironmentForRun as dh, markFileUploadFailed as di, markStaleRegistryCatalogItems as dj, markStripeWebhookProcessed as dk, mcpServerIdForCapability as dl, nextSessionHistoryPosition as dm, orphanedResultRowIndicesForRepair as dn, persistDrainSnapshot as dp, reArmDrainingLease as dq, readActiveSandbox as dr, readLease as ds, readMachineMetricsLatest as dt, readMachineMetricsLatestForWorkspace as du, readMachineMetricsSeries as dv, reapStaleLeaseHolders as dw, reapStaleLeaseHoldersGlobal as dx, recordAuditEvent as dy, recordCodexAccountConnectors as dz, CODEX_ROTATION_STRATEGIES as e, revokeEnrollment as e0, revokeViewer as e1, rlsContextForWorkspace as e2, rlsStrategyFor as e3, sanitizeEventPayload as e4, sanitizeEventString as e5, saveRunState as e6, sessionSubject as e7, setActiveCodexCredential as e8, setActiveSandbox as e9, updateSessionMcpServerCredentials as eA, updateSessionTitle as eB, updateWorkspace as eC, updateWorkspaceEnvironment as eD, upsertBillingCustomer as eE, upsertCapabilityCatalogItem as eF, upsertCodexSubscriptionCredential as eG, upsertGitHubInstallation as eH, upsertMachineMetricsLatest as eI, upsertRegistryCapabilityCatalogItem as eJ, upsertSandboxSessionEnvelope as eK, upsertSessionGoal as eL, wakeParentSessionForChildCompletion as eM, withAccountRls as eN, withRlsContext as eO, withWorkspaceRls as eP, withWorkspaceUsageLock as eQ, workspaceCodexSubscriptionActive as eR, setCodexCredentialExhausted as ea, setCodexCredentialStatus as eb, setConnectionStatus as ec, setEnrollmentDisplayState as ed, setRlsContext as ee, setSessionCodexPin as ef, setSessionGoalLastContinuationTurn as eg, setSessionGoalStatus as eh, setSessionLastInputTokens as ei, setSessionStatus as ej, setTemporalWorkflowId as ek, setWorkspaceEnvironmentVariable as el, storeIntegrationOAuthClient as em, sumUsageQuantity as en, touchEnrollmentLastSeen as eo, updateCodexRotationSettings as ep, updateConnection as eq, updateImportBatchCounts as er, updateKnowledgeMemory as es, updatePackInstallationStatus as et, updatePtySessionActivity as eu, updateQueuedSessionTurn as ev, updateRecording as ew, updateScheduledTask as ex, updateScheduledTaskRun as ey, updateSessionGoal as ez, type ClearSessionContextResult as f, type CodexAccountStatus as g, type CodexAccountUsageSnapshot as h, type CodexAuthDeps as i, type CodexCredentialForRun as j, type CodexCredentialTokens as k, type CodexRotationSettings as l, type CodexRotationStrategy as m, type ConnectionBrokerDeps as n, type ConnectionCredentialForBroker as o, ConnectionRefreshHttpError as p, provisionRoles, type ConsumeOAuthStateNonceInput as q, type CreateCapabilityCatalogItemInput as r, type CreateConnectionInput as s, type CreateDbOptions as t, type CreateImportBatchInput as u, type CreateKnowledgeMemoryInput as v, type CreatePackInstallationInput as w, type CreateScheduledTaskInput as x, type CreateSessionGoalInput as y, type CreateSessionMcpServerInput as z };