@opengeni/db 0.4.1 → 0.6.1

package/dist/provision-roles.d.ts

@@ -1,8 +1,8 @@
-import { SessionEventType, Permission, CapabilityKind, CapabilitySource, ScheduledTaskStatus, ScheduledTaskScheduleSpec, ScheduledTaskRunMode, ScheduledTaskOverlapPolicy, ScheduledTaskAgentConfig, SessionGoalCreatedBy, SocialProvider, SocialConnectionStatus, SessionTurnSource, ResourceRef, ToolRef, ReasoningEffort, SandboxBackend, SessionGoal, CapabilityPack, SessionMcpServerMetadata, SessionTurn, SessionEvent, SessionStatus, Session, BillingBalance, AccessContext, FileAsset, ApiKey, ScheduledTask, ScheduledTaskTriggerType, ScheduledTaskRun, SandboxOs, SocialConnection, SocialPost, Workspace, WorkspaceEnvironment, CapabilityInstallation, PackInstallation, SessionTurnStatus, CapabilityCatalogItem, FileUploadStatus, ManagedAccount, AccessGrant, WorkspaceRegisteredPack, UsageEvent, WorkspaceMember, SessionGoalStatus, WorkspaceEnvironmentVariableMetadata, PackInstallationStatus, ScheduledTaskRunStatus } from '@opengeni/contracts';
-import { environmentsEncryptionKeyBytes, Settings } from '@opengeni/config';
+import { SessionEventType, Permission, ConnectionKind, ConnectionStatus, CapabilityKind, CapabilitySource, KnowledgeMemoryStatus, KnowledgeMemoryKind, KnowledgeSourceRef, ScheduledTaskStatus, ScheduledTaskScheduleSpec, ScheduledTaskRunMode, ScheduledTaskOverlapPolicy, ScheduledTaskAgentConfig, SessionGoalCreatedBy, SocialProvider, SocialConnectionStatus, McpServerConnectionRef as McpServerConnectionRef$1, SessionTurnSource, ResourceRef, ToolRef, ReasoningEffort, SandboxBackend, SessionGoal, CapabilityPack, SessionMcpServerMetadata, SessionTurn, SessionEvent, SessionStatus, Session, BillingBalance, AccessContext, FileAsset, ApiKey, ConnectionMetadata, KnowledgeMemory, ScheduledTask, ScheduledTaskTriggerType, ScheduledTaskRun, SandboxOs, SocialConnection, SocialPost, Workspace, WorkspaceEnvironment, CapabilityInstallation, PackInstallation, SessionTurnStatus, CapabilityCatalogItem, FileUploadStatus, ManagedAccount, AccessGrant, WorkspaceRegisteredPack, UsageEvent, WorkspaceMember, SessionGoalStatus, WorkspaceEnvironmentVariableMetadata, PackInstallationStatus, ScheduledTaskRunStatus } from '@opengeni/contracts';
+import { environmentsEncryptionKeyBytes, Settings, McpServerConnectionRef } from '@opengeni/config';
 import { refreshCodexToken, CodexTokenSnapshot, CodexUsagePayload } from '@opengeni/codex';
 import { PgDatabase } from 'drizzle-orm/pg-core';
-import { s as schema, e as enrollmentOsValues, a as enrollmentExposureValues, d as deviceEnrollmentStatusValues, b as enrollmentStatusValues, c as sandboxKindValues, f as sessionRecordingCodecValues, g as sessionRecordingModeValues, h as sessionRecordingStateValues } from './schema-C7Wvjwge.js';
+import { s as schema, e as enrollmentOsValues, a as enrollmentExposureValues, d as deviceEnrollmentStatusValues, b as enrollmentStatusValues, c as sandboxKindValues, f as sessionRecordingCodecValues, g as sessionRecordingModeValues, h as sessionRecordingStateValues } from './schema-BUbuMteO.js';
 import 'drizzle-orm';
 import './migrate.js';
 
@@ -123,6 +123,50 @@ declare function buildCodexTokenResolver(db: Database, settings: Settings, works
  */
 declare function fetchCodexUsageForAccount(db: Database, settings: Settings, workspaceId: string, credentialId: string): Promise<CodexUsagePayload>;
 
+type ResolveConnectionCredentialResult = {
+    status: "ok";
+    headers: Record<string, string>;
+    connectionId: string;
+    expiresAt?: Date | null;
+} | {
+    status: "auth_needed";
+    reason: "missing_connection" | "expired" | "insufficient_scope" | "refresh_failed";
+    providerDomain: string;
+    connectionId?: string;
+    scopes?: string[];
+    resource?: string;
+    authorizationUrl?: string;
+};
+type ResolveConnectionCredentialInput = {
+    workspaceId: string;
+    subjectId?: string;
+    serverId: string;
+    toolId?: string;
+    connectionRef: McpServerConnectionRef;
+    forceRefresh?: boolean;
+};
+type ConnectionBrokerDeps = {
+    loadCredential: typeof loadConnectionCredentialForBroker;
+    recordRefresh: typeof recordConnectionTokenRefresh;
+    setStatus: typeof setConnectionStatus;
+    recordUsed: typeof recordConnectionUsed;
+    refresh: typeof refreshOAuthConnectionCredential;
+    encrypt: typeof encryptEnvironmentValue;
+    keyBytes: typeof environmentsEncryptionKeyBytes;
+    now: () => Date;
+};
+declare function buildConnectionTokenResolver(db: Database, settings: Settings, deps?: ConnectionBrokerDeps): (input: ResolveConnectionCredentialInput) => Promise<ResolveConnectionCredentialResult>;
+declare class ConnectionRefreshHttpError extends Error {
+    readonly httpStatus: number;
+    constructor(httpStatus: number);
+}
+declare function refreshOAuthConnectionCredential(cred: ConnectionCredentialForBroker, ref: McpServerConnectionRef, settings?: Settings): Promise<{
+    credential: Record<string, unknown>;
+    expiresAt: Date | null;
+    grantedScopes?: string[];
+}>;
+declare function isPrivateAddress(address: string): boolean;
+
 type Database = PgDatabase<any, typeof schema>;
 type DbClient = {
     db: Database;
@@ -418,6 +462,35 @@ type RegisterWorkspacePackInput = {
     workspaceId: string;
     pack: CapabilityPack;
 };
+type CreateKnowledgeMemoryInput = {
+    accountId: string;
+    workspaceId: string;
+    status?: KnowledgeMemoryStatus | undefined;
+    kind?: KnowledgeMemoryKind | undefined;
+    scope?: string | undefined;
+    text: string;
+    sourceRefs?: KnowledgeSourceRef[] | undefined;
+    confidence?: number | undefined;
+    metadata?: Record<string, unknown> | undefined;
+    createdBySessionId?: string | null | undefined;
+};
+type UpdateKnowledgeMemoryInput = {
+    status?: KnowledgeMemoryStatus | undefined;
+    kind?: KnowledgeMemoryKind | undefined;
+    scope?: string | undefined;
+    text?: string | undefined;
+    sourceRefs?: KnowledgeSourceRef[] | undefined;
+    confidence?: number | undefined;
+    metadata?: Record<string, unknown> | undefined;
+    reviewedBy?: string | null | undefined;
+};
+type ListKnowledgeMemoryOptions = {
+    query?: string | undefined;
+    status?: KnowledgeMemoryStatus | undefined;
+    kind?: KnowledgeMemoryKind | undefined;
+    scope?: string | undefined;
+    limit?: number | undefined;
+};
 type CreateSocialConnectionInput = {
     accountId: string;
     workspaceId: string;
@@ -443,6 +516,88 @@ type CreateSocialPostInput = {
     metrics?: Record<string, number>;
     raw?: Record<string, unknown>;
 };
+type CreateConnectionInput = {
+    accountId: string;
+    workspaceId: string;
+    subjectId?: string | null;
+    providerDomain: string;
+    kind: ConnectionKind;
+    status?: ConnectionStatus;
+    credentialEncrypted: string;
+    grantedScopes?: string[];
+    expiresAt?: Date | null;
+    metadata?: Record<string, unknown>;
+    createdBySubjectId?: string | null;
+    updatedBySubjectId?: string | null;
+};
+type UpdateConnectionInput = {
+    workspaceId: string;
+    connectionId: string;
+    visibleToSubjectId?: string | null;
+    expectedVersion?: number | undefined;
+    subjectId?: string | null;
+    providerDomain?: string;
+    kind?: ConnectionKind;
+    status?: ConnectionStatus;
+    credentialEncrypted?: string;
+    grantedScopes?: string[];
+    expiresAt?: Date | null;
+    metadata?: Record<string, unknown>;
+    updatedBySubjectId?: string | null;
+};
+type ConnectionCredentialForBroker = {
+    id: string;
+    accountId: string;
+    workspaceId: string;
+    subjectId: string | null;
+    providerDomain: string;
+    kind: ConnectionKind;
+    status: ConnectionStatus;
+    credential: Record<string, unknown>;
+    grantedScopes: string[];
+    expiresAt: Date | null;
+    lastRefreshAt: Date | null;
+    version: number;
+    metadata: Record<string, unknown>;
+};
+type IntegrationOAuthClientForUse = {
+    id: string;
+    issuer: string;
+    authorizationServer: string;
+    clientId: string;
+    clientSecret: string | null;
+    tokenEndpointAuthMethod: string;
+    metadata: Record<string, unknown>;
+    createdAt: Date;
+    updatedAt: Date;
+};
+type StoredIntegrationOAuthClient = {
+    id: string;
+    issuer: string;
+    authorizationServer: string;
+    clientId: string;
+    clientSecretEncrypted: string | null;
+    tokenEndpointAuthMethod: string;
+    metadata: Record<string, unknown>;
+    createdAt: Date;
+    updatedAt: Date;
+};
+type StoreIntegrationOAuthClientInput = {
+    issuer: string;
+    authorizationServer: string;
+    clientId: string;
+    clientSecretEncrypted?: string | null;
+    tokenEndpointAuthMethod?: string;
+    metadata?: Record<string, unknown>;
+};
+type ConsumeOAuthStateNonceInput = {
+    accountId: string;
+    workspaceId: string;
+    subjectId: string;
+    nonce: string;
+    expiresAt: Date;
+    now: Date;
+};
 type CreateCapabilityCatalogItemInput = {
     accountId: string;
     workspaceId: string;
@@ -459,6 +614,64 @@ type CreateCapabilityCatalogItemInput = {
     authModel?: string | null;
     metadata?: Record<string, unknown>;
 };
+type ImportBatch = {
+    id: string;
+    source: string;
+    snapshotDate: string;
+    snapshotRef: string | null;
+    attributionNote: string;
+    importedCount: number;
+    skippedCount: number;
+    quarantinedCount: number;
+    logoFailureCount: number;
+    staleCount: number;
+    details: Record<string, unknown>;
+    createdAt: string;
+    updatedAt: string;
+};
+type CreateImportBatchInput = {
+    source: string;
+    snapshotDate: Date;
+    snapshotRef?: string | null;
+    attributionNote: string;
+    importedCount?: number;
+    skippedCount?: number;
+    quarantinedCount?: number;
+    logoFailureCount?: number;
+    staleCount?: number;
+    details?: Record<string, unknown>;
+};
+type UpdateImportBatchCountsInput = {
+    importedCount: number;
+    skippedCount: number;
+    quarantinedCount: number;
+    logoFailureCount: number;
+    staleCount: number;
+    details?: Record<string, unknown>;
+};
+type RegistryCapabilityCatalogItemInput = {
+    id: string;
+    providerDomain: string;
+    name: string;
+    description?: string | null;
+    mcpUrl: string;
+    transport: string;
+    authKind: "oauth2" | "api_key" | "none" | "unknown";
+    credentialFacts: Array<Record<string, unknown>>;
+    tier: "verified" | "community";
+    provenance: string;
+    logoAssetPath?: string | null;
+    importBatchId: string;
+    scopesHint?: string[];
+    homepageUrl?: string | null;
+    tags?: string[];
+    metadata?: Record<string, unknown>;
+};
+type RegistryCatalogSurfaceKey = {
+    id: string;
+    providerDomain: string;
+    mcpUrl: string;
+};
 type EnableCapabilityInstallationInput = {
     accountId: string;
     workspaceId: string;
@@ -482,6 +695,7 @@ type EnabledMcpCapabilityServer = {
      * capability API surface.
      */
     headersEncrypted?: Record<string, string>;
+    connectionRef?: McpServerConnectionRef$1;
 };
 type CreateSessionMcpServerInput = {
     id: string;
@@ -490,6 +704,7 @@ type CreateSessionMcpServerInput = {
     allowedTools?: string[] | null;
     timeoutMs?: number | null;
     cacheToolsList?: boolean | null;
+    requireApproval?: boolean | string[] | null;
     headersEncrypted?: Record<string, string>;
 };
 type UpdateSessionMcpServerCredentialsInput = {
@@ -504,6 +719,7 @@ type SessionMcpServerForRun = SessionMcpServerMetadata & {
     allowedTools?: string[];
     timeoutMs?: number;
     cacheToolsList?: boolean;
+    requireApproval?: boolean | string[];
     headers: Record<string, string>;
 };
 type EnqueueSessionTurnInput = {
@@ -568,6 +784,14 @@ declare function registerWorkspacePack(db: Database, input: RegisterWorkspacePac
 declare function listWorkspacePacks(db: Database, workspaceId: string): Promise<WorkspaceRegisteredPack[]>;
 declare function getWorkspacePack(db: Database, workspaceId: string, packId: string): Promise<WorkspaceRegisteredPack | null>;
 declare function deleteWorkspacePack(db: Database, workspaceId: string, packId: string): Promise<boolean>;
+declare function createImportBatch(db: Database, input: CreateImportBatchInput): Promise<ImportBatch>;
+declare function updateImportBatchCounts(db: Database, id: string, input: UpdateImportBatchCountsInput): Promise<ImportBatch>;
+declare function upsertRegistryCapabilityCatalogItem(db: Database, input: RegistryCapabilityCatalogItemInput): Promise<CapabilityCatalogItem>;
+declare function listRegistryCatalogSurfaceKeys(db: Database): Promise<RegistryCatalogSurfaceKey[]>;
+declare function markStaleRegistryCatalogItems(db: Database, activeKeys: Iterable<{
+    providerDomain: string;
+    mcpUrl: string;
+}>, importBatchId: string): Promise<number>;
 declare function upsertCapabilityCatalogItem(db: Database, input: CreateCapabilityCatalogItemInput): Promise<CapabilityCatalogItem>;
 declare function listCapabilityCatalogItems(db: Database, workspaceId: string): Promise<CapabilityCatalogItem[]>;
 declare function getCapabilityCatalogItem(db: Database, workspaceId: string, capabilityId: string): Promise<CapabilityCatalogItem | null>;
@@ -591,6 +815,40 @@ declare function decryptedCapabilityHeaders(server: EnabledMcpCapabilityServer,
  */
 declare function getStoredCapabilityHeaderCiphertext(db: Database, workspaceId: string, capabilityId: string): Promise<Record<string, string> | null>;
 declare function mcpServerIdForCapability(capabilityId: string, metadata?: Record<string, unknown>): string;
+declare function createConnection(db: Database, input: CreateConnectionInput): Promise<ConnectionMetadata>;
+declare function listConnectionsMetadata(db: Database, workspaceId: string, subjectId?: string | null): Promise<ConnectionMetadata[]>;
+declare function getConnectionMetadata(db: Database, workspaceId: string, connectionId: string, subjectId?: string | null): Promise<ConnectionMetadata | null>;
+declare function updateConnection(db: Database, input: UpdateConnectionInput): Promise<ConnectionMetadata | null>;
+declare function revokeConnection(db: Database, workspaceId: string, connectionId: string, updatedBySubjectId?: string | null): Promise<ConnectionMetadata | null>;
+declare function loadConnectionCredentialForBroker(db: Database, settings: Settings, input: {
+    workspaceId: string;
+    connectionId?: string;
+    providerDomain: string;
+    kind?: ConnectionKind;
+    subjectId?: string | null;
+    allowSubjectOwned?: boolean;
+}): Promise<ConnectionCredentialForBroker | null>;
+declare function recordConnectionTokenRefresh(db: Database, input: {
+    id: string;
+    version: number;
+    workspaceId: string;
+    credentialEncrypted: string;
+    expiresAt: Date | null;
+    grantedScopes?: string[];
+    lastRefreshAt: Date;
+}): Promise<boolean>;
+declare function setConnectionStatus(db: Database, workspaceId: string, status: ConnectionStatus, lastError: string | null, guard: {
+    id: string;
+    version: number;
+}): Promise<boolean>;
+declare function recordConnectionUsed(db: Database, workspaceId: string, connectionId: string): Promise<void>;
+declare function loadIntegrationOAuthClient(db: Database, settings: Settings, issuer: string): Promise<IntegrationOAuthClientForUse | null>;
+declare function storeIntegrationOAuthClient(db: Database, input: StoreIntegrationOAuthClientInput): Promise<StoredIntegrationOAuthClient>;
+declare function consumeIntegrationOAuthStateNonce(db: Database, input: ConsumeOAuthStateNonceInput): Promise<boolean>;
+declare function createKnowledgeMemory(db: Database, input: CreateKnowledgeMemoryInput): Promise<KnowledgeMemory>;
+declare function updateKnowledgeMemory(db: Database, workspaceId: string, memoryId: string, input: UpdateKnowledgeMemoryInput): Promise<KnowledgeMemory>;
+declare function getKnowledgeMemory(db: Database, workspaceId: string, memoryId: string): Promise<KnowledgeMemory | null>;
+declare function listKnowledgeMemories(db: Database, workspaceId: string, options?: ListKnowledgeMemoryOptions): Promise<KnowledgeMemory[]>;
 declare function createSocialConnection(db: Database, input: CreateSocialConnectionInput): Promise<SocialConnection>;
 declare function listSocialConnections(db: Database, workspaceId: string, limit?: number): Promise<SocialConnection[]>;
 declare function getSocialConnection(db: Database, workspaceId: string, connectionId: string): Promise<SocialConnection | null>;
@@ -1077,6 +1335,23 @@ type ListSessionEventsOptions = {
 declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string): Promise<SessionEvent[]>;
 declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string, after: number, limit?: number): Promise<SessionEvent[]>;
 declare function listSessionEvents(db: Database, workspaceId: string, sessionId: string, options: ListSessionEventsOptions): Promise<SessionEvent[]>;
+type ToolspaceCallReservation = {
+    reserved: true;
+    count: number;
+} | {
+    reserved: false;
+};
+/**
+ * Atomically reserve one toolspace call against a turn's per-turn budget.
+ *
+ * A single conditional UPDATE increments `toolspace_call_count` only while it is
+ * below `limit` and returns the post-increment value. Concurrent reservations
+ * for the same turn serialize on the row lock, so exactly `limit` of N
+ * simultaneous callers observe `reserved: true` — closing the read-then-append
+ * TOCTOU the event-count approach had. `reserved: false` means the turn is at or
+ * over budget (or the turn row no longer exists).
+ */
+declare function reserveToolspaceCallForTurn(db: Database, workspaceId: string, sessionId: string, turnId: string, limit: number): Promise<ToolspaceCallReservation>;
 declare function getSessionEvent(db: Database, workspaceId: string, eventId: string): Promise<SessionEvent | null>;
 declare function getLatestRunState(db: Database, workspaceId: string, sessionId: string): Promise<{
     id: string;
@@ -1561,6 +1836,11 @@ interface MeterableWarmLease {
 declare function listMeterableWarmLeases(db: Database): Promise<MeterableWarmLease[]>;
 declare function countQueuedTurns(db: Database): Promise<number>;
 declare function countSandboxLeasesByLiveness(db: Database): Promise<Record<SandboxLeaseLiveness, number>>;
+type CreditBalanceByAccount = {
+    accountId: string;
+    balanceMicros: number;
+};
+declare function listCreditBalancesByAccount(db: Database): Promise<CreditBalanceByAccount[]>;
 declare function listLiveModalSandboxLeaseAttributions(db: Database): Promise<LiveModalSandboxLeaseAttribution[]>;
 declare function reArmDrainingLease(db: Database, input: {
     accountId: string;
@@ -1616,6 +1896,9 @@ type EnrollmentRecord = {
     pubkey: string;
     exposure: EnrollmentExposure;
     hasDisplay: boolean;
+    /** Set when a display exists but capture is not permitted (macOS Screen Recording
+     *  not granted); null when capture is permitted or the machine is headless. */
+    desktopUnavailableReason: string | null;
     allowScreenControl: boolean;
     status: EnrollmentStatus;
     os: EnrollmentOs;
@@ -1661,11 +1944,12 @@ declare function touchEnrollmentLastSeen(db: Database, input: {
     workspaceId: string;
     enrollmentId: string;
 }): Promise<void>;
-declare function setEnrollmentHasDisplay(db: Database, input: {
+declare function setEnrollmentDisplayState(db: Database, input: {
     accountId: string;
     workspaceId: string;
     enrollmentId: string;
     hasDisplay: boolean;
+    desktopUnavailableReason: string | null;
 }): Promise<{
     updated: boolean;
 }>;
@@ -2144,4 +2428,4 @@ type LockedSessionUpdateResult = {
 declare function appendSessionEventsWithLockedSessionUpdate(db: Database, workspaceId: string, sessionId: string, build: (session: Session, context: LockedSessionUpdateContext) => LockedSessionUpdateResult | Promise<LockedSessionUpdateResult>): Promise<SessionEvent[]>;
 declare function sessionSubject(workspaceId: string, sessionId: string): string;
 
-export { SandboxLeaseSupersededError as $, type AccrueWarmSecondsResult as A, type BootstrapWorkspaceInput as B, CLEARED_RUN_STATE as C, type Database as D, type EnableCapabilityInstallationInput as E, type EnrollmentExposure as F, type EnrollmentOs as G, type EnrollmentRecord as H, type EnrollmentStatus as I, type ForceDrainResult as J, type GitHubInstallation as K, type GoalContinuationDecision as L, type LeaseHolderKind as M, type LeaseSnapshot as N, type ListSessionEventsOptions as O, type LiveModalSandboxLeaseAttribution as P, type ProvisionResult, type ProvisionRolesOptions, MACHINE_METRICS_SERIES_INTERVAL_MS as Q, type MachineMetricsRow as R, type MachineMetricsSample as S, type MeterableWarmLease as T, type ReapDrainable as U, type RegisterWorkspacePackInput as V, type RlsContext as W, type RlsStrategy as X, SandboxImageConflictError as Y, type SandboxKind as Z, type SandboxLeaseLiveness as _, type AcquireLeaseInput as a, createSessionGoal as a$, type SandboxPtySessionRow as a0, type SandboxRecord as a1, type SessionCodexState as a2, type SessionMcpServerForRun as a3, type SessionRecordingCodec as a4, type SessionRecordingMode as a5, type SessionRecordingRow as a6, type SessionRecordingState as a7, type StreamAcknowledgment as a8, type UpdateQueuedSessionTurnInput as a9, commitWarmingToWarm as aA, completeFileUpload as aB, confirmDrainCold as aC, consumeDeviceEnrollmentRequest as aD, consumeSessionCompactionRequest as aE, countActiveApiKeysForWorkspace as aF, countActiveSessionHistoryItems as aG, countActiveSessionsForWorkspace as aH, countActiveSessionsUsingEnvironment as aI, countConsecutiveReactiveRotations as aJ, countQueuedTurns as aK, countSandboxLeasesByLiveness as aL, countScheduledTasksForWorkspace as aM, countScheduledTasksUsingEnvironment as aN, countSessionHistoryItems as aO, countTurnSessionHistoryItems as aP, countWorkspaceEnvironments as aQ, countWorkspacesForAccount as aR, createApiKey as aS, createDb as aT, createDeviceEnrollmentRequest as aU, createEnrollment as aV, createFileUpload as aW, createSandbox as aX, createScheduledTask as aY, createScheduledTaskRun as aZ, createSession as a_, type UpdateScheduledTaskInput as aa, type UpdateSessionMcpServerCredentialsInput as ab, type UpdateSessionMcpServerCredentialsResult as ac, type UserLookup as ad, type WakeParentForChildCompletionInput as ae, type WakeParentForChildCompletionResult as af, type WorkspaceEnvironmentForRun as ag, accrueWarmSeconds as ah, acquireLease as ai, allAccountPermissions as aj, allWorkspacePermissions as ak, appendSessionEvents as al, appendSessionEventsAndUpdateSession as am, appendSessionEventsWithLockedSessionUpdate as an, appendSessionHistoryItems as ao, applyContextCompaction as ap, applyCreditDebitUpToBalance as aq, applyCreditLedgerEntry as ar, approveDeviceEnrollmentRequest as as, bootstrapWorkspace as at, buildCodexTokenResolver as au, cancelQueuedSessionTurn as av, claimNextQueuedTurn as aw, clearSessionContext as ax, clearedContextMarkerItem as ay, closePtySession as az, type AcquireLeaseResult as b, getStoredCapabilityHeaderCiphertext as b$, createSessionMcpServers as b0, createSessionWithIdempotencyKey as b1, createSocialConnection as b2, createSocialPost as b3, createTurn as b4, createWorkspace as b5, createWorkspaceEnvironment as b6, decryptEnvironmentValue as b7, decryptedCapabilityHeaders as b8, deleteRecording as b9, getCapabilityCatalogItem as bA, getCapabilityInstallation as bB, getCodexCredentialStatus as bC, getCodexRotationSettings as bD, getDeviceEnrollmentRequestByDeviceCode as bE, getEnrollment as bF, getFile as bG, getFileUpload as bH, getLatestRunState as bI, getManagedAccount as bJ, getManagedUserByEmail as bK, getOpenPtySession as bL, getPackInstallation as bM, getPendingDeviceEnrollmentRequestByUserCode as bN, getPendingDeviceEnrollmentRequestByUserCodeGlobal as bO, getRecording as bP, getSandbox as bQ, getSandboxSessionEnvelope as bR, getScheduledTask as bS, getSession as bT, getSessionByCreateIdempotencyKey as bU, getSessionCodexState as bV, getSessionEvent as bW, getSessionGoal as bX, getSessionHistoryItems as bY, getSessionTurn as bZ, getSocialConnection as b_, deleteScheduledTask as ba, deleteWorkspace as bb, deleteWorkspaceEnvironment as bc, deleteWorkspaceEnvironmentVariable as bd, deleteWorkspacePack as be, denyDeviceEnrollmentRequest as bf, disableCapabilityInstallation as bg, disconnectAllCodexAccounts as bh, disconnectCodexAccount as bi, enableCapabilityInstallation as bj, enablePackInstallation as bk, encryptEnvironmentValue as bl, enqueueSessionTurn as bm, ensureCodexRotationSettings as bn, ensureManagedAccessForUser as bo, evaluateGoalContinuation as bp, failWarmingToCold as bq, fetchCodexUsageForAccount as br, finalizeEnrollmentByToken as bs, findActiveApiKeyByHash as bt, finishTurn as bu, forceDrainOverLimitViewerOnlyBoxes as bv, getActiveSessionHistoryItems as bw, getAnySessionInGroup as bx, getBillingBalance as by, getBillingCustomer as bz, type ActiveSandboxPointer as c, recordAuditEvent as c$, getStreamAcknowledgment as c0, getWorkspace as c1, getWorkspaceEnvironment as c2, getWorkspaceEnvironmentByName as c3, getWorkspaceEnvironmentValuesForRun as c4, getWorkspaceGrant as c5, getWorkspacePack as c6, grantWorkspaceAccess as c7, hasCreditLedgerEntry as c8, heartbeatLeaseHolder as c9, listSessionMcpServerMetadata as cA, listSessionMcpServersForRun as cB, listSessionTurns as cC, listSessions as cD, listSocialConnections as cE, listSocialPosts as cF, listUsageEvents as cG, listWorkspaceEnvironments as cH, listWorkspaceMembers as cI, listWorkspacePacks as cJ, listWorkspacesForSubject as cK, loadCodexCredentialForRun as cL, loadWorkspaceEnvironmentForRun as cM, markFileUploadFailed as cN, markStripeWebhookProcessed as cO, mcpServerIdForCapability as cP, nextSessionHistoryPosition as cQ, orphanedResultRowIndicesForRepair as cR, persistDrainSnapshot as cS, reArmDrainingLease as cT, readActiveSandbox as cU, readLease as cV, readMachineMetricsLatest as cW, readMachineMetricsLatestForWorkspace as cX, readMachineMetricsSeries as cY, reapStaleLeaseHolders as cZ, reapStaleLeaseHoldersGlobal as c_, incrementTurnWorkerDeathRedispatches as ca, ingestMachineMetricsSample as cb, insertMachineMetricsSeries as cc, insertPtySession as cd, insertRecording as ce, isCodexBilledTurn as cf, isStripeWebhookProcessed as cg, listApiKeys as ch, listCapabilityCatalogItems as ci, listCapabilityInstallations as cj, listCodexAccountStatuses as ck, listDistinctEnvironmentIdsInGroup as cl, listEnabledMcpCapabilityServers as cm, listEnrollments as cn, listGitHubInstallationIdsForWorkspace as co, listGitHubInstallationsForWorkspace as cp, listLiveModalSandboxLeaseAttributions as cq, listMeterableWarmLeases as cr, listOpenPtySessions as cs, listPackInstallations as ct, listRecordings as cu, listSandboxes as cv, listScheduledTaskRuns as cw, listScheduledTasks as cx, listSessionEvents as cy, listSessionIdsInGroup as cz, type AppendEventInput as d, upsertGitHubInstallation as d$, recordCodexAccountConnectors as d0, recordCodexAccountUsage as d1, recordCodexTokenRefresh as d2, recordLeaseDataPlaneUrl as d3, recordLeaseTerminalDataPlaneUrl as d4, recordSessionActiveCodexCredential as d5, recordStreamAcknowledgment as d6, recordStripeWebhookEvent as d7, recordUsageEvent as d8, recordWarmingSandboxCreated as d9, setCodexCredentialStatus as dA, setEnrollmentHasDisplay as dB, setRlsContext as dC, setSessionCodexPin as dD, setSessionGoalLastContinuationTurn as dE, setSessionGoalStatus as dF, setSessionLastInputTokens as dG, setSessionStatus as dH, setTemporalWorkflowId as dI, setWorkspaceEnvironmentVariable as dJ, sumUsageQuantity as dK, touchEnrollmentLastSeen as dL, updateCodexRotationSettings as dM, updatePackInstallationStatus as dN, updatePtySessionActivity as dO, updateQueuedSessionTurn as dP, updateRecording as dQ, updateScheduledTask as dR, updateScheduledTaskRun as dS, updateSessionGoal as dT, updateSessionMcpServerCredentials as dU, updateSessionTitle as dV, updateWorkspace as dW, updateWorkspaceEnvironment as dX, upsertBillingCustomer as dY, upsertCapabilityCatalogItem as dZ, upsertCodexSubscriptionCredential as d_, registerDbBinding as da, registerWorkspacePack as db, releaseLeaseHolder as dc, removeWorkspaceMember as dd, renameCodexAccount as de, reorderQueuedSessionTurns as df, requestSessionCompaction as dg, requeuePreemptedTurn as dh, requireFile as di, requireScheduledTask as dj, requireSession as dk, requireSocialConnection as dl, requireWorkspace as dm, revokeApiKey as dn, revokeEnrollment as dp, revokeViewer as dq, rlsContextForWorkspace as dr, rlsStrategyFor as ds, sanitizeEventPayload as dt, sanitizeEventString as du, saveRunState as dv, sessionSubject as dw, setActiveCodexCredential as dx, setActiveSandbox as dy, setCodexCredentialExhausted as dz, CODEX_ROTATION_STRATEGIES as e, upsertMachineMetricsLatest as e0, upsertSandboxSessionEnvelope as e1, upsertSessionGoal as e2, wakeParentSessionForChildCompletion as e3, withAccountRls as e4, withRlsContext as e5, withWorkspaceRls as e6, withWorkspaceUsageLock as e7, workspaceCodexSubscriptionActive as e8, type ClearSessionContextResult as f, type CodexAccountStatus as g, type CodexAccountUsageSnapshot as h, type CodexAuthDeps as i, type CodexCredentialForRun as j, type CodexCredentialTokens as k, type CodexRotationSettings as l, type CodexRotationStrategy as m, type CreateCapabilityCatalogItemInput as n, type CreateDbOptions as o, type CreatePackInstallationInput as p, provisionRoles, type CreateScheduledTaskInput as q, type CreateSessionGoalInput as r, type CreateSessionMcpServerInput as s, type CreateSocialConnectionInput as t, type CreateSocialPostInput as u, type DbClient as v, type DeviceEnrollmentRequestRecord as w, type DeviceEnrollmentStatus as x, type EnabledMcpCapabilityServer as y, type EnqueueSessionTurnInput as z };
+export { MACHINE_METRICS_SERIES_INTERVAL_MS as $, type AccrueWarmSecondsResult as A, type BootstrapWorkspaceInput as B, CLEARED_RUN_STATE as C, type CreateSocialConnectionInput as D, type CreateSocialPostInput as E, type CreditBalanceByAccount as F, type Database as G, type DbClient as H, type DeviceEnrollmentRequestRecord as I, type DeviceEnrollmentStatus as J, type EnableCapabilityInstallationInput as K, type EnabledMcpCapabilityServer as L, type EnqueueSessionTurnInput as M, type EnrollmentExposure as N, type EnrollmentOs as O, type EnrollmentRecord as P, type ProvisionResult, type ProvisionRolesOptions, type EnrollmentStatus as Q, type ForceDrainResult as R, type GitHubInstallation as S, type GoalContinuationDecision as T, type ImportBatch as U, type IntegrationOAuthClientForUse as V, type LeaseHolderKind as W, type LeaseSnapshot as X, type ListKnowledgeMemoryOptions as Y, type ListSessionEventsOptions as Z, type LiveModalSandboxLeaseAttribution as _, type AcquireLeaseInput as a, consumeSessionCompactionRequest as a$, type MachineMetricsRow as a0, type MachineMetricsSample as a1, type MeterableWarmLease as a2, type ReapDrainable as a3, type RegisterWorkspacePackInput as a4, type RegistryCapabilityCatalogItemInput as a5, type RegistryCatalogSurfaceKey as a6, type ResolveConnectionCredentialInput as a7, type ResolveConnectionCredentialResult as a8, type RlsContext as a9, type WakeParentForChildCompletionResult as aA, type WorkspaceEnvironmentForRun as aB, accrueWarmSeconds as aC, acquireLease as aD, allAccountPermissions as aE, allWorkspacePermissions as aF, appendSessionEvents as aG, appendSessionEventsAndUpdateSession as aH, appendSessionEventsWithLockedSessionUpdate as aI, appendSessionHistoryItems as aJ, applyContextCompaction as aK, applyCreditDebitUpToBalance as aL, applyCreditLedgerEntry as aM, approveDeviceEnrollmentRequest as aN, bootstrapWorkspace as aO, buildCodexTokenResolver as aP, buildConnectionTokenResolver as aQ, cancelQueuedSessionTurn as aR, claimNextQueuedTurn as aS, clearSessionContext as aT, clearedContextMarkerItem as aU, closePtySession as aV, commitWarmingToWarm as aW, completeFileUpload as aX, confirmDrainCold as aY, consumeDeviceEnrollmentRequest as aZ, consumeIntegrationOAuthStateNonce as a_, type RlsStrategy as aa, SandboxImageConflictError as ab, type SandboxKind as ac, type SandboxLeaseLiveness as ad, SandboxLeaseSupersededError as ae, type SandboxPtySessionRow as af, type SandboxRecord as ag, type SessionCodexState as ah, type SessionMcpServerForRun as ai, type SessionRecordingCodec as aj, type SessionRecordingMode as ak, type SessionRecordingRow as al, type SessionRecordingState as am, type StoreIntegrationOAuthClientInput as an, type StoredIntegrationOAuthClient as ao, type StreamAcknowledgment as ap, type ToolspaceCallReservation as aq, type UpdateConnectionInput as ar, type UpdateImportBatchCountsInput as as, type UpdateKnowledgeMemoryInput as at, type UpdateQueuedSessionTurnInput as au, type UpdateScheduledTaskInput as av, type UpdateSessionMcpServerCredentialsInput as aw, type UpdateSessionMcpServerCredentialsResult as ax, type UserLookup as ay, type WakeParentForChildCompletionInput as az, type AcquireLeaseResult as b, getCapabilityInstallation as b$, countActiveApiKeysForWorkspace as b0, countActiveSessionHistoryItems as b1, countActiveSessionsForWorkspace as b2, countActiveSessionsUsingEnvironment as b3, countConsecutiveReactiveRotations as b4, countQueuedTurns as b5, countSandboxLeasesByLiveness as b6, countScheduledTasksForWorkspace as b7, countScheduledTasksUsingEnvironment as b8, countSessionHistoryItems as b9, deleteScheduledTask as bA, deleteWorkspace as bB, deleteWorkspaceEnvironment as bC, deleteWorkspaceEnvironmentVariable as bD, deleteWorkspacePack as bE, denyDeviceEnrollmentRequest as bF, disableCapabilityInstallation as bG, disconnectAllCodexAccounts as bH, disconnectCodexAccount as bI, enableCapabilityInstallation as bJ, enablePackInstallation as bK, encryptEnvironmentValue as bL, enqueueSessionTurn as bM, ensureCodexRotationSettings as bN, ensureManagedAccessForUser as bO, evaluateGoalContinuation as bP, failWarmingToCold as bQ, fetchCodexUsageForAccount as bR, finalizeEnrollmentByToken as bS, findActiveApiKeyByHash as bT, finishTurn as bU, forceDrainOverLimitViewerOnlyBoxes as bV, getActiveSessionHistoryItems as bW, getAnySessionInGroup as bX, getBillingBalance as bY, getBillingCustomer as bZ, getCapabilityCatalogItem as b_, countTurnSessionHistoryItems as ba, countWorkspaceEnvironments as bb, countWorkspacesForAccount as bc, createApiKey as bd, createConnection as be, createDb as bf, createDeviceEnrollmentRequest as bg, createEnrollment as bh, createFileUpload as bi, createImportBatch as bj, createKnowledgeMemory as bk, createSandbox as bl, createScheduledTask as bm, createScheduledTaskRun as bn, createSession as bo, createSessionGoal as bp, createSessionMcpServers as bq, createSessionWithIdempotencyKey as br, createSocialConnection as bs, createSocialPost as bt, createTurn as bu, createWorkspace as bv, createWorkspaceEnvironment as bw, decryptEnvironmentValue as bx, decryptedCapabilityHeaders as by, deleteRecording as bz, type ActiveSandboxPointer as c, listRegistryCatalogSurfaceKeys as c$, getCodexCredentialStatus as c0, getCodexRotationSettings as c1, getConnectionMetadata as c2, getDeviceEnrollmentRequestByDeviceCode as c3, getEnrollment as c4, getFile as c5, getFileUpload as c6, getKnowledgeMemory as c7, getLatestRunState as c8, getManagedAccount as c9, hasCreditLedgerEntry as cA, heartbeatLeaseHolder as cB, incrementTurnWorkerDeathRedispatches as cC, ingestMachineMetricsSample as cD, insertMachineMetricsSeries as cE, insertPtySession as cF, insertRecording as cG, isCodexBilledTurn as cH, isPrivateAddress as cI, isStripeWebhookProcessed as cJ, listApiKeys as cK, listCapabilityCatalogItems as cL, listCapabilityInstallations as cM, listCodexAccountStatuses as cN, listConnectionsMetadata as cO, listCreditBalancesByAccount as cP, listDistinctEnvironmentIdsInGroup as cQ, listEnabledMcpCapabilityServers as cR, listEnrollments as cS, listGitHubInstallationIdsForWorkspace as cT, listGitHubInstallationsForWorkspace as cU, listKnowledgeMemories as cV, listLiveModalSandboxLeaseAttributions as cW, listMeterableWarmLeases as cX, listOpenPtySessions as cY, listPackInstallations as cZ, listRecordings as c_, getManagedUserByEmail as ca, getOpenPtySession as cb, getPackInstallation as cc, getPendingDeviceEnrollmentRequestByUserCode as cd, getPendingDeviceEnrollmentRequestByUserCodeGlobal as ce, getRecording as cf, getSandbox as cg, getSandboxSessionEnvelope as ch, getScheduledTask as ci, getSession as cj, getSessionByCreateIdempotencyKey as ck, getSessionCodexState as cl, getSessionEvent as cm, getSessionGoal as cn, getSessionHistoryItems as co, getSessionTurn as cp, getSocialConnection as cq, getStoredCapabilityHeaderCiphertext as cr, getStreamAcknowledgment as cs, getWorkspace as ct, getWorkspaceEnvironment as cu, getWorkspaceEnvironmentByName as cv, getWorkspaceEnvironmentValuesForRun as cw, getWorkspaceGrant as cx, getWorkspacePack as cy, grantWorkspaceAccess as cz, type AppendEventInput as d, reserveToolspaceCallForTurn as d$, listSandboxes as d0, listScheduledTaskRuns as d1, listScheduledTasks as d2, listSessionEvents as d3, listSessionIdsInGroup as d4, listSessionMcpServerMetadata as d5, listSessionMcpServersForRun as d6, listSessionTurns as d7, listSessions as d8, listSocialConnections as d9, recordAuditEvent as dA, recordCodexAccountConnectors as dB, recordCodexAccountUsage as dC, recordCodexTokenRefresh as dD, recordConnectionTokenRefresh as dE, recordConnectionUsed as dF, recordLeaseDataPlaneUrl as dG, recordLeaseTerminalDataPlaneUrl as dH, recordSessionActiveCodexCredential as dI, recordStreamAcknowledgment as dJ, recordStripeWebhookEvent as dK, recordUsageEvent as dL, recordWarmingSandboxCreated as dM, refreshOAuthConnectionCredential as dN, registerDbBinding as dO, registerWorkspacePack as dP, releaseLeaseHolder as dQ, removeWorkspaceMember as dR, renameCodexAccount as dS, reorderQueuedSessionTurns as dT, requestSessionCompaction as dU, requeuePreemptedTurn as dV, requireFile as dW, requireScheduledTask as dX, requireSession as dY, requireSocialConnection as dZ, requireWorkspace as d_, listSocialPosts as da, listUsageEvents as db, listWorkspaceEnvironments as dc, listWorkspaceMembers as dd, listWorkspacePacks as de, listWorkspacesForSubject as df, loadCodexCredentialForRun as dg, loadConnectionCredentialForBroker as dh, loadIntegrationOAuthClient as di, loadWorkspaceEnvironmentForRun as dj, markFileUploadFailed as dk, markStaleRegistryCatalogItems as dl, markStripeWebhookProcessed as dm, mcpServerIdForCapability as dn, nextSessionHistoryPosition as dp, orphanedResultRowIndicesForRepair as dq, persistDrainSnapshot as dr, reArmDrainingLease as ds, readActiveSandbox as dt, readLease as du, readMachineMetricsLatest as dv, readMachineMetricsLatestForWorkspace as dw, readMachineMetricsSeries as dx, reapStaleLeaseHolders as dy, reapStaleLeaseHoldersGlobal as dz, CODEX_ROTATION_STRATEGIES as e, revokeApiKey as e0, revokeConnection as e1, revokeEnrollment as e2, revokeViewer as e3, rlsContextForWorkspace as e4, rlsStrategyFor as e5, sanitizeEventPayload as e6, sanitizeEventString as e7, saveRunState as e8, sessionSubject as e9, updateScheduledTaskRun as eA, updateSessionGoal as eB, updateSessionMcpServerCredentials as eC, updateSessionTitle as eD, updateWorkspace as eE, updateWorkspaceEnvironment as eF, upsertBillingCustomer as eG, upsertCapabilityCatalogItem as eH, upsertCodexSubscriptionCredential as eI, upsertGitHubInstallation as eJ, upsertMachineMetricsLatest as eK, upsertRegistryCapabilityCatalogItem as eL, upsertSandboxSessionEnvelope as eM, upsertSessionGoal as eN, wakeParentSessionForChildCompletion as eO, withAccountRls as eP, withRlsContext as eQ, withWorkspaceRls as eR, withWorkspaceUsageLock as eS, workspaceCodexSubscriptionActive as eT, setActiveCodexCredential as ea, setActiveSandbox as eb, setCodexCredentialExhausted as ec, setCodexCredentialStatus as ed, setConnectionStatus as ee, setEnrollmentDisplayState as ef, setRlsContext as eg, setSessionCodexPin as eh, setSessionGoalLastContinuationTurn as ei, setSessionGoalStatus as ej, setSessionLastInputTokens as ek, setSessionStatus as el, setTemporalWorkflowId as em, setWorkspaceEnvironmentVariable as en, storeIntegrationOAuthClient as eo, sumUsageQuantity as ep, touchEnrollmentLastSeen as eq, updateCodexRotationSettings as er, updateConnection as es, updateImportBatchCounts as et, updateKnowledgeMemory as eu, updatePackInstallationStatus as ev, updatePtySessionActivity as ew, updateQueuedSessionTurn as ex, updateRecording as ey, updateScheduledTask as ez, type ClearSessionContextResult as f, type CodexAccountStatus as g, type CodexAccountUsageSnapshot as h, type CodexAuthDeps as i, type CodexCredentialForRun as j, type CodexCredentialTokens as k, type CodexRotationSettings as l, type CodexRotationStrategy as m, type ConnectionBrokerDeps as n, type ConnectionCredentialForBroker as o, ConnectionRefreshHttpError as p, provisionRoles, type ConsumeOAuthStateNonceInput as q, type CreateCapabilityCatalogItemInput as r, type CreateConnectionInput as s, type CreateDbOptions as t, type CreateImportBatchInput as u, type CreateKnowledgeMemoryInput as v, type CreatePackInstallationInput as w, type CreateScheduledTaskInput as x, type CreateSessionGoalInput as y, type CreateSessionMcpServerInput as z };