@opengeni/db 0.6.0 → 0.7.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (51) hide show
  1. package/dist/{chunk-OGCE6O2X.js → chunk-7LDU7F5P.js} +31 -3
  2. package/dist/chunk-7LDU7F5P.js.map +1 -0
  3. package/dist/chunk-O3D7DABC.js +2314 -0
  4. package/dist/chunk-O3D7DABC.js.map +1 -0
  5. package/dist/{chunk-57MLICFR.js → chunk-YFQ7SGE4.js} +18 -6
  6. package/dist/chunk-YFQ7SGE4.js.map +1 -0
  7. package/dist/index.d.ts +2 -2
  8. package/dist/index.js +13129 -3496
  9. package/dist/index.js.map +1 -1
  10. package/dist/migrate.js +1 -1
  11. package/dist/provision-roles.d.ts +1836 -222
  12. package/dist/provision-roles.js +1 -1
  13. package/dist/{schema-Dsz6UHNv.d.ts → schema-Dp2MbBxx.d.ts} +7480 -3305
  14. package/dist/schema.d.ts +1 -1
  15. package/dist/schema.js +33 -5
  16. package/drizzle/0043_credit_balance_observability.sql +22 -0
  17. package/drizzle/0044_reap_dead_turn_holders.sql +104 -0
  18. package/drizzle/0045_workspace_captures.sql +83 -0
  19. package/drizzle/0045_workspace_memory_v1.sql +71 -0
  20. package/drizzle/0046_variable_sets_rename.sql +56 -0
  21. package/drizzle/0047_rigs.sql +151 -0
  22. package/drizzle/0048_rig_runtime.sql +9 -0
  23. package/drizzle/0049_enrollment_went_offline.sql +28 -0
  24. package/drizzle/0050_enrollment_op_stream.sql +1 -0
  25. package/drizzle/0051_codex_pin_source.sql +48 -0
  26. package/drizzle/0052_file_upload_cleanup.sql +91 -0
  27. package/drizzle/0053_codex_credential_leases.sql +230 -0
  28. package/drizzle/0054_session_pins.sql +85 -0
  29. package/drizzle/0055_session_list_snapshots.sql +73 -0
  30. package/drizzle/0056_workspace_model_policies.sql +48 -0
  31. package/drizzle/0057_durable_queue_control.sql +536 -0
  32. package/drizzle/0058_turn_admission_usage_enrollment.sql +158 -0
  33. package/drizzle/0059_workspace_pause_control_kind.sql +12 -0
  34. package/drizzle/0060_session_system_update_deferral.sql +10 -0
  35. package/drizzle/0061_session_workflow_wake_outbox.sql +157 -0
  36. package/drizzle/0062_session_list_snapshot_reaper.sql +48 -0
  37. package/package.json +17 -13
  38. package/src/codex-token-resolver.ts +58 -23
  39. package/src/connection-token-resolver.ts +146 -57
  40. package/src/environment-crypto.ts +5 -1
  41. package/src/event-payload-sanitizer.ts +29 -1
  42. package/src/index.ts +22460 -6492
  43. package/src/memory-domain.ts +218 -0
  44. package/src/migrate.ts +58 -3
  45. package/src/provision-roles.ts +46 -17
  46. package/src/schema.ts +2557 -1121
  47. package/src/session-control-cutover-audit.ts +1203 -0
  48. package/dist/chunk-57MLICFR.js.map +0 -1
  49. package/dist/chunk-OGCE6O2X.js.map +0 -1
  50. package/dist/chunk-ZIUCA2IO.js +0 -1268
  51. package/dist/chunk-ZIUCA2IO.js.map +0 -1
package/dist/index.d.ts CHANGED
@@ -2,7 +2,7 @@ import '@opengeni/contracts';
2
2
  import '@opengeni/config';
3
3
  export { isCodexBilledModel } from '@opengeni/codex';
4
4
  import 'drizzle-orm/pg-core';
5
- import './schema-Dsz6UHNv.js';
5
+ import './schema-Dp2MbBxx.js';
6
6
  export { sql as dbSql } from 'drizzle-orm';
7
- export { A as AccrueWarmSecondsResult, a as AcquireLeaseInput, b as AcquireLeaseResult, c as ActiveSandboxPointer, d as AppendEventInput, B as BootstrapWorkspaceInput, C as CLEARED_RUN_STATE, e as CODEX_ROTATION_STRATEGIES, f as ClearSessionContextResult, g as CodexAccountStatus, h as CodexAccountUsageSnapshot, i as CodexAuthDeps, j as CodexCredentialForRun, k as CodexCredentialTokens, l as CodexRotationSettings, m as CodexRotationStrategy, n as ConnectionBrokerDeps, o as ConnectionCredentialForBroker, p as ConnectionRefreshHttpError, q as ConsumeOAuthStateNonceInput, r as CreateCapabilityCatalogItemInput, s as CreateConnectionInput, t as CreateDbOptions, u as CreateImportBatchInput, v as CreateKnowledgeMemoryInput, w as CreatePackInstallationInput, x as CreateScheduledTaskInput, y as CreateSessionGoalInput, z as CreateSessionMcpServerInput, D as CreateSocialConnectionInput, E as CreateSocialPostInput, F as Database, G as DbClient, H as DeviceEnrollmentRequestRecord, I as DeviceEnrollmentStatus, J as EnableCapabilityInstallationInput, K as EnabledMcpCapabilityServer, L as EnqueueSessionTurnInput, M as EnrollmentExposure, N as EnrollmentOs, O as EnrollmentRecord, P as EnrollmentStatus, Q as ForceDrainResult, R as GitHubInstallation, S as GoalContinuationDecision, T as ImportBatch, U as IntegrationOAuthClientForUse, V as LeaseHolderKind, W as LeaseSnapshot, X as ListKnowledgeMemoryOptions, Y as ListSessionEventsOptions, Z as LiveModalSandboxLeaseAttribution, _ as MACHINE_METRICS_SERIES_INTERVAL_MS, $ as MachineMetricsRow, a0 as MachineMetricsSample, a1 as MeterableWarmLease, ProvisionResult, ProvisionRolesOptions, a2 as ReapDrainable, a3 as RegisterWorkspacePackInput, a4 as RegistryCapabilityCatalogItemInput, a5 as RegistryCatalogSurfaceKey, a6 as ResolveConnectionCredentialInput, a7 as ResolveConnectionCredentialResult, a8 as RlsContext, a9 as RlsStrategy, aa as SandboxImageConflictError, ab as SandboxKind, ac as SandboxLeaseLiveness, ad as SandboxLeaseSupersededError, ae as SandboxPtySessionRow, af as SandboxRecord, ag as SessionCodexState, ah as SessionMcpServerForRun, ai as SessionRecordingCodec, aj as SessionRecordingMode, ak as SessionRecordingRow, al as SessionRecordingState, am as StoreIntegrationOAuthClientInput, an as StoredIntegrationOAuthClient, ao as StreamAcknowledgment, ap as ToolspaceCallReservation, aq as UpdateConnectionInput, ar as UpdateImportBatchCountsInput, as as UpdateKnowledgeMemoryInput, at as UpdateQueuedSessionTurnInput, au as UpdateScheduledTaskInput, av as UpdateSessionMcpServerCredentialsInput, aw as UpdateSessionMcpServerCredentialsResult, ax as UserLookup, ay as WakeParentForChildCompletionInput, az as WakeParentForChildCompletionResult, aA as WorkspaceEnvironmentForRun, aB as accrueWarmSeconds, aC as acquireLease, aD as allAccountPermissions, aE as allWorkspacePermissions, aF as appendSessionEvents, aG as appendSessionEventsAndUpdateSession, aH as appendSessionEventsWithLockedSessionUpdate, aI as appendSessionHistoryItems, aJ as applyContextCompaction, aK as applyCreditDebitUpToBalance, aL as applyCreditLedgerEntry, aM as approveDeviceEnrollmentRequest, aN as bootstrapWorkspace, aO as buildCodexTokenResolver, aP as buildConnectionTokenResolver, aQ as cancelQueuedSessionTurn, aR as claimNextQueuedTurn, aS as clearSessionContext, aT as clearedContextMarkerItem, aU as closePtySession, aV as commitWarmingToWarm, aW as completeFileUpload, aX as confirmDrainCold, aY as consumeDeviceEnrollmentRequest, aZ as consumeIntegrationOAuthStateNonce, a_ as consumeSessionCompactionRequest, a$ as countActiveApiKeysForWorkspace, b0 as countActiveSessionHistoryItems, b1 as countActiveSessionsForWorkspace, b2 as countActiveSessionsUsingEnvironment, b3 as countConsecutiveReactiveRotations, b4 as countQueuedTurns, b5 as countSandboxLeasesByLiveness, b6 as countScheduledTasksForWorkspace, b7 as countScheduledTasksUsingEnvironment, b8 as countSessionHistoryItems, b9 as countTurnSessionHistoryItems, ba as countWorkspaceEnvironments, bb as countWorkspacesForAccount, bc as createApiKey, bd as createConnection, be as createDb, bf as createDeviceEnrollmentRequest, bg as createEnrollment, bh as createFileUpload, bi as createImportBatch, bj as createKnowledgeMemory, bk as createSandbox, bl as createScheduledTask, bm as createScheduledTaskRun, bn as createSession, bo as createSessionGoal, bp as createSessionMcpServers, bq as createSessionWithIdempotencyKey, br as createSocialConnection, bs as createSocialPost, bt as createTurn, bu as createWorkspace, bv as createWorkspaceEnvironment, bw as decryptEnvironmentValue, bx as decryptedCapabilityHeaders, by as deleteRecording, bz as deleteScheduledTask, bA as deleteWorkspace, bB as deleteWorkspaceEnvironment, bC as deleteWorkspaceEnvironmentVariable, bD as deleteWorkspacePack, bE as denyDeviceEnrollmentRequest, bF as disableCapabilityInstallation, bG as disconnectAllCodexAccounts, bH as disconnectCodexAccount, bI as enableCapabilityInstallation, bJ as enablePackInstallation, bK as encryptEnvironmentValue, bL as enqueueSessionTurn, bM as ensureCodexRotationSettings, bN as ensureManagedAccessForUser, bO as evaluateGoalContinuation, bP as failWarmingToCold, bQ as fetchCodexUsageForAccount, bR as finalizeEnrollmentByToken, bS as findActiveApiKeyByHash, bT as finishTurn, bU as forceDrainOverLimitViewerOnlyBoxes, bV as getActiveSessionHistoryItems, bW as getAnySessionInGroup, bX as getBillingBalance, bY as getBillingCustomer, bZ as getCapabilityCatalogItem, b_ as getCapabilityInstallation, b$ as getCodexCredentialStatus, c0 as getCodexRotationSettings, c1 as getConnectionMetadata, c2 as getDeviceEnrollmentRequestByDeviceCode, c3 as getEnrollment, c4 as getFile, c5 as getFileUpload, c6 as getKnowledgeMemory, c7 as getLatestRunState, c8 as getManagedAccount, c9 as getManagedUserByEmail, ca as getOpenPtySession, cb as getPackInstallation, cc as getPendingDeviceEnrollmentRequestByUserCode, cd as getPendingDeviceEnrollmentRequestByUserCodeGlobal, ce as getRecording, cf as getSandbox, cg as getSandboxSessionEnvelope, ch as getScheduledTask, ci as getSession, cj as getSessionByCreateIdempotencyKey, ck as getSessionCodexState, cl as getSessionEvent, cm as getSessionGoal, cn as getSessionHistoryItems, co as getSessionTurn, cp as getSocialConnection, cq as getStoredCapabilityHeaderCiphertext, cr as getStreamAcknowledgment, cs as getWorkspace, ct as getWorkspaceEnvironment, cu as getWorkspaceEnvironmentByName, cv as getWorkspaceEnvironmentValuesForRun, cw as getWorkspaceGrant, cx as getWorkspacePack, cy as grantWorkspaceAccess, cz as hasCreditLedgerEntry, cA as heartbeatLeaseHolder, cB as incrementTurnWorkerDeathRedispatches, cC as ingestMachineMetricsSample, cD as insertMachineMetricsSeries, cE as insertPtySession, cF as insertRecording, cG as isCodexBilledTurn, cH as isPrivateAddress, cI as isStripeWebhookProcessed, cJ as listApiKeys, cK as listCapabilityCatalogItems, cL as listCapabilityInstallations, cM as listCodexAccountStatuses, cN as listConnectionsMetadata, cO as listDistinctEnvironmentIdsInGroup, cP as listEnabledMcpCapabilityServers, cQ as listEnrollments, cR as listGitHubInstallationIdsForWorkspace, cS as listGitHubInstallationsForWorkspace, cT as listKnowledgeMemories, cU as listLiveModalSandboxLeaseAttributions, cV as listMeterableWarmLeases, cW as listOpenPtySessions, cX as listPackInstallations, cY as listRecordings, cZ as listRegistryCatalogSurfaceKeys, c_ as listSandboxes, c$ as listScheduledTaskRuns, d0 as listScheduledTasks, d1 as listSessionEvents, d2 as listSessionIdsInGroup, d3 as listSessionMcpServerMetadata, d4 as listSessionMcpServersForRun, d5 as listSessionTurns, d6 as listSessions, d7 as listSocialConnections, d8 as listSocialPosts, d9 as listUsageEvents, da as listWorkspaceEnvironments, db as listWorkspaceMembers, dc as listWorkspacePacks, dd as listWorkspacesForSubject, de as loadCodexCredentialForRun, df as loadConnectionCredentialForBroker, dg as loadIntegrationOAuthClient, dh as loadWorkspaceEnvironmentForRun, di as markFileUploadFailed, dj as markStaleRegistryCatalogItems, dk as markStripeWebhookProcessed, dl as mcpServerIdForCapability, dm as nextSessionHistoryPosition, dn as orphanedResultRowIndicesForRepair, dp as persistDrainSnapshot, provisionRoles, dq as reArmDrainingLease, dr as readActiveSandbox, ds as readLease, dt as readMachineMetricsLatest, du as readMachineMetricsLatestForWorkspace, dv as readMachineMetricsSeries, dw as reapStaleLeaseHolders, dx as reapStaleLeaseHoldersGlobal, dy as recordAuditEvent, dz as recordCodexAccountConnectors, dA as recordCodexAccountUsage, dB as recordCodexTokenRefresh, dC as recordConnectionTokenRefresh, dD as recordConnectionUsed, dE as recordLeaseDataPlaneUrl, dF as recordLeaseTerminalDataPlaneUrl, dG as recordSessionActiveCodexCredential, dH as recordStreamAcknowledgment, dI as recordStripeWebhookEvent, dJ as recordUsageEvent, dK as recordWarmingSandboxCreated, dL as refreshOAuthConnectionCredential, dM as registerDbBinding, dN as registerWorkspacePack, dO as releaseLeaseHolder, dP as removeWorkspaceMember, dQ as renameCodexAccount, dR as reorderQueuedSessionTurns, dS as requestSessionCompaction, dT as requeuePreemptedTurn, dU as requireFile, dV as requireScheduledTask, dW as requireSession, dX as requireSocialConnection, dY as requireWorkspace, dZ as reserveToolspaceCallForTurn, d_ as revokeApiKey, d$ as revokeConnection, e0 as revokeEnrollment, e1 as revokeViewer, e2 as rlsContextForWorkspace, e3 as rlsStrategyFor, e4 as sanitizeEventPayload, e5 as sanitizeEventString, e6 as saveRunState, e7 as sessionSubject, e8 as setActiveCodexCredential, e9 as setActiveSandbox, ea as setCodexCredentialExhausted, eb as setCodexCredentialStatus, ec as setConnectionStatus, ed as setEnrollmentDisplayState, ee as setRlsContext, ef as setSessionCodexPin, eg as setSessionGoalLastContinuationTurn, eh as setSessionGoalStatus, ei as setSessionLastInputTokens, ej as setSessionStatus, ek as setTemporalWorkflowId, el as setWorkspaceEnvironmentVariable, em as storeIntegrationOAuthClient, en as sumUsageQuantity, eo as touchEnrollmentLastSeen, ep as updateCodexRotationSettings, eq as updateConnection, er as updateImportBatchCounts, es as updateKnowledgeMemory, et as updatePackInstallationStatus, eu as updatePtySessionActivity, ev as updateQueuedSessionTurn, ew as updateRecording, ex as updateScheduledTask, ey as updateScheduledTaskRun, ez as updateSessionGoal, eA as updateSessionMcpServerCredentials, eB as updateSessionTitle, eC as updateWorkspace, eD as updateWorkspaceEnvironment, eE as upsertBillingCustomer, eF as upsertCapabilityCatalogItem, eG as upsertCodexSubscriptionCredential, eH as upsertGitHubInstallation, eI as upsertMachineMetricsLatest, eJ as upsertRegistryCapabilityCatalogItem, eK as upsertSandboxSessionEnvelope, eL as upsertSessionGoal, eM as wakeParentSessionForChildCompletion, eN as withAccountRls, eO as withRlsContext, eP as withWorkspaceRls, eQ as withWorkspaceUsageLock, eR as workspaceCodexSubscriptionActive } from './provision-roles.js';
7
+ export { A as AGENT_VISIBLE_MEMORY_STATUSES, a as AcceptSessionApprovalDecisionResult, b as AccrueWarmSecondsResult, c as AcquireLeaseInput, d as AcquireLeaseResult, e as ActiveSandboxPointer, f as AddSessionSystemUpdateInput, g as AddSessionSystemUpdateResult, h as AppendEventInput, i as ApplyContextCompactionResult, j as ApplySessionTurnSettlementInput, k as ApplySessionTurnSettlementResult, l as ArmCodexCapacityWaitResult, B as BootstrapWorkspaceInput, C as CODEX_CAPACITY_REFRESH_MAX_MS, m as CODEX_CAPACITY_REFRESH_MIN_MS, n as CODEX_CREDENTIAL_LEASE_TTL_MS, o as CODEX_ROTATION_STRATEGIES, p as ChildNotificationsMode, q as ClaimSessionWorkForAttemptInput, r as ClaimSessionWorkForAttemptResult, s as ClearSessionContextResult, t as CodexAccountStatus, u as CodexAccountUsageSnapshot, v as CodexAuthDeps, w as CodexCapacityAvailabilityDecision, x as CodexCapacityMutationResult, y as CodexCapacityResetKind, z as CodexCapacitySelectionContext, D as CodexCapacityWait, E as CodexCapacityWaitStatus, F as CodexCapacityWakeTarget, G as CodexCredentialForRun, H as CodexCredentialLeaseCandidateFilter, I as CodexCredentialLeaseCandidateFilterResult, J as CodexCredentialLeasePolicyScopeResolver, K as CodexCredentialLeaseQuarantine, L as CodexCredentialLeaseResult, M as CodexCredentialLeaseSelection, N as CodexCredentialLeaseSelectionContext, O as CodexCredentialStatus, P as CodexCredentialTokens, Q as CodexLeaseAccountStatus, R as CodexPinSource, S as CodexRotationSettings, T as CodexRotationStrategy, U as ConnectionBrokerDeps, V as ConnectionCredentialForBroker, W as ConnectionRefreshHttpError, X as ConsumeOAuthStateNonceInput, Y as CorrectWorkspaceMemoryInput, Z as CorrectWorkspaceMemoryResult, _ as CreateCapabilityCatalogItemInput, $ as CreateConnectionInput, a0 as CreateDbOptions, a1 as CreateImportBatchInput, a2 as CreateKnowledgeMemoryInput, a3 as CreatePackInstallationInput, a4 as CreateScheduledTaskInput, a5 as CreateSessionGoalInput, a6 as CreateSessionMcpServerInput, a7 as CreateSocialConnectionInput, a8 as CreateSocialPostInput, a9 as CreditBalanceByAccount, aa as Database, ab as DbClient, ac as DeviceEnrollmentRequestRecord, ad as DeviceEnrollmentStatus, ae as DurableSessionControlRequest, af as DurableSessionWakeRequest, ag as EnableCapabilityInstallationInput, ah as EnabledMcpCapabilityServer, ai as EnqueueSessionMessageResult, aj as EnqueueSessionTurnInput, ak as EnrollmentExposure, al as EnrollmentOs, am as EnrollmentRecord, an as EnrollmentStatus, ao as ExpiredFileUploadCleanupClaim, ap as FileUploadCleanupClaimResult, aq as ForceDrainResult, ar as GitHubInstallation, as as GoalContinuationDecision, at as ImportBatch, au as InitializeSessionStartInput, av as InitializeSessionStartResult, aw as IntegrationOAuthClientForUse, ax as LeaseHolderKind, ay as LeaseSnapshot, az as ListKnowledgeMemoryOptions, aA as ListSessionEventsOptions, aB as ListSessionsForSubjectOptions, aC as ListSessionsOptions, aD as LiveModalSandboxLeaseAttribution, aE as MACHINE_METRICS_SERIES_INTERVAL_MS, aF as MEMORY_ACTIVE_RECORD_CAP, aG as MEMORY_BLOCK_KIND_ORDER, aH as MEMORY_BLOCK_RECORD_LIMIT, aI as MEMORY_CORRECT_TOOL_DESCRIPTION, aJ as MEMORY_KIND_SECTION_TITLES, aK as MEMORY_NEAR_DUP_COSINE_THRESHOLD, aL as MEMORY_NEAR_DUP_NEIGHBORS, aM as MEMORY_SAVE_TOOL_DESCRIPTION, aN as MEMORY_SEARCH_DEFAULT_LIMIT, aO as MEMORY_SEARCH_MAX_LIMIT, aP as MEMORY_SEARCH_TOOL_DESCRIPTION, aQ as MEMORY_TEXT_MAX_CHARS, aR as MEMORY_VISIBLE_RECORD_CAP, aS as MachineMetricsRow, aT as MachineMetricsSample, aU as MarkWarmLeaseInstanceLostResult, aV as MemoryBlockRecord, aW as MemoryEmbedder, aX as MemorySanitizeResult, aY as MeterableWarmLease, aZ as PendingSessionToolCallInput, ProvisionResult, ProvisionRolesOptions, a_ as ReapDrainable, a$ as ReconcileCodexCapacityWaitResult, b0 as RecoverSessionDispatchInput, b1 as RecoverSessionDispatchResult, b2 as RegisterWorkspacePackInput, b3 as RegistryCapabilityCatalogItemInput, b4 as RegistryCatalogSurfaceKey, b5 as RepairDetachedCodexCapacityAttemptInput, b6 as RepairDetachedCodexCapacityAttemptResult, b7 as ReparkOrphanedSessionTurnInput, b8 as ReparkOrphanedSessionTurnResult, b9 as ReplaceIntegrationOAuthClientInput, ba as RequestSessionControlResult, bb as RequestSessionTurnRecoveryInput, bc as RequestSessionTurnRecoveryResult, bd as ResolveConnectionCredentialInput, be as ResolveConnectionCredentialResult, bf as RigActiveVersionChangedError, bg as RigChangeAlreadyVerifyingError, bh as RigChangeTransitionError, bi as RigVersionContentInput, bj as RlsContext, bk as RlsStrategy, bl as SandboxImageConflictError, bm as SandboxKind, bn as SandboxLeaseLiveness, bo as SandboxLeaseSupersededError, bp as SandboxPtySessionRow, bq as SandboxRecord, br as SandboxRigConflictError, bs as SaveWorkspaceMemoryInput, bt as SaveWorkspaceMemoryResult, bu as SessionCodexState, bv as SessionContextBusyError, bw as SessionControlMode, bx as SessionLineage, by as SessionListAccessError, bz as SessionListCursor, bA as SessionListCursorError, bB as SessionMcpServerForRun, bC as SessionPinAccessError, bD as SessionPinVersionConflictError, bE as SessionQueueConflictError, bF as SessionRecordingCodec, bG as SessionRecordingMode, bH as SessionRecordingRow, bI as SessionRecordingState, bJ as SessionSystemUpdateOutboxDelivery, bK as SessionTurnRecordingSettlement, bL as SessionWorkPeek, bM as SessionWorkTrigger, bN as SessionWorkflowWake, bO as SetSessionCodexPinOptions, bP as SettleCodexCredentialFailoverResult, bQ as SettleCodexCredentialLeaseLossResult, bR as StoreIntegrationOAuthClientInput, bS as StoredIntegrationOAuthClient, bT as StreamAcknowledgment, bU as ToolspaceCallReservation, bV as TurnAttemptFenceRejectReason, bW as UpdateConnectionInput, bX as UpdateImportBatchCountsInput, bY as UpdateKnowledgeMemoryInput, bZ as UpdateScheduledTaskInput, b_ as UpdateSessionMcpServerCredentialsInput, b$ as UpdateSessionMcpServerCredentialsResult, c0 as UserLookup, c1 as VariableSetForRun, c2 as WORKSPACE_MEMORY_BLOCK_EMPTY, c3 as WORKSPACE_MEMORY_BLOCK_HEADER_POPULATED, c4 as WORKSPACE_MEMORY_BLOCK_TOKEN_BUDGET, c5 as WorkspaceCaptureCommitResult, c6 as WorkspaceCaptureGcPlan, c7 as WorkspaceCaptureGcRow, c8 as WorkspaceCaptureRow, c9 as WorkspaceEnvironmentForRun, ca as WorkspaceMemoryOrigin, cb as WorkspaceMemorySearchInput, cc as WorkspaceMemorySearchMode, cd as WorkspaceMemorySearchResult, ce as WorkspaceModelPolicy, cf as abandonRecordingForTurnAttempt, cg as acceptSessionApprovalDecision, ch as accrueWarmSeconds, ci as acquireCodexCredentialLease, cj as acquireLease, ck as activateRigVersion, cl as addSessionSystemUpdate, cm as addSessionSystemUpdateWithSourceMutation, cn as allAccountPermissions, co as allWorkspacePermissions, cp as appendSessionEventToSandboxGroup, cq as appendSessionEvents, cr as appendSessionEventsAndUpdateSession, cs as appendSessionEventsForTurnAttempt, ct as appendSessionEventsWithLockedSessionUpdate, cu as appendSessionHistoryItems, cv as applyContextCompaction, cw as applyCreditDebitUpToBalance, cx as applyCreditLedgerEntry, cy as applySessionTurnSettlement, cz as approveDeviceEnrollmentRequest, cA as armCodexCapacityWait, cB as beginRigChangeVerificationAttempt, cC as bootstrapWorkspace, cD as buildChildCompletionDigest, cE as buildCodexTokenResolver, cF as buildConnectionTokenResolver, cG as cancelQueuedSessionTurnWithVersion, cH as claimExpiredFileUploadCleanup, cI as claimFileUploadCleanup, cJ as claimPendingSessionSystemUpdateOutbox, cK as claimPendingSessionWorkflowWakes, cL as claimSessionWorkForAttempt, cM as clearDurablePendingSessionToolCalls, cN as clearEnrollmentWentOffline, cO as clearSessionContext, cP as clearSessionGoal, cQ as clearedContextMarkerItem, cR as closePtySession, cS as codexCapacityRefreshBackoffMs, cT as commitWarmingToWarm, cU as completeExpiredFileUploadCleanup, cV as completeFileUpload, cW as completeFileUploadCleanup, cX as computeWorkspaceCaptureGcPlan, cY as confirmDrainCold, cZ as consumeDeviceEnrollmentRequest, c_ as consumeIntegrationOAuthStateNonce, c$ as correctWorkspaceMemory, d0 as countActiveApiKeysForWorkspace, d1 as countActiveSessionHistoryItems, d2 as countActiveSessionsForWorkspace, d3 as countActiveSessionsUsingEnvironment, d4 as countActiveSessionsUsingVariableSet, d5 as countConsecutiveReactiveRotations, d6 as countQueuedTurns, d7 as countRigs, d8 as countSandboxLeasesByLiveness, d9 as countScheduledTasksForWorkspace, da as countScheduledTasksUsingEnvironment, db as countScheduledTasksUsingVariableSet, dc as countSessionHistoryItems, dd as countSessionsUsingRig, de as countVariableSets, df as countWorkspaceEnvironments, dg as countWorkspacesForAccount, dh as createApiKey, di as createConnection, dj as createDb, dk as createDeviceEnrollmentRequest, dl as createEnrollment, dm as createFileUpload, dn as createImportBatch, dp as createKnowledgeMemory, dq as createRig, dr as createRigChange, ds as createRigVersion, dt as createRigVersionForChangePromotion, du as createSandbox, dv as createScheduledTask, dw as createScheduledTaskRun, dx as createSession, dy as createSessionGoal, dz as createSessionMcpServers, dA as createSessionWithIdempotencyKey, dB as createSocialConnection, dC as createSocialPost, dD as createVariableSet, dE as createWorkspace, dF as createWorkspaceEnvironment, dG as decodeSessionListCursor, dH as decryptEnvironmentValue, dH as decryptVariableSetValue, dI as decryptedCapabilityHeaders, dJ as deleteRecording, dK as deleteRig, dL as deleteRigIfNoActiveSessions, dM as deleteScheduledTask, dN as deleteVariableSet, dO as deleteVariableSetVariable, dP as deleteWorkspace, dQ as deleteWorkspaceCaptureRows, dR as deleteWorkspaceEnvironment, dS as deleteWorkspaceEnvironmentVariable, dT as deleteWorkspacePack, dU as denyDeviceEnrollmentRequest, dV as disableCapabilityInstallation, dW as disconnectAllCodexAccounts, dX as disconnectCodexAccount, dY as enableCapabilityInstallation, dZ as enablePackInstallation, d_ as encodeSessionListCursor, d$ as encryptEnvironmentValue, d$ as encryptVariableSetValue, e0 as enqueueSessionMessageAtomically, e1 as enqueueSessionTurn, e2 as enqueueSessionWorkflowWake, e3 as enqueueSessionWorkflowWakeIfRunnable, e4 as enqueueSessionWorkflowWakeInTransaction, e5 as ensureCodexRotationSettings, e6 as ensureManagedAccessForUser, e7 as estimateMemoryTokens, e8 as evaluateGoalContinuation, e9 as failWarmingToCold, ea as fetchCodexUsageForAccount, eb as finalizeEnrollmentByToken, ec as findActiveApiKeyByHash, ed as forceDrainOverLimitViewerOnlyBoxes, ee as getActiveSessionHistoryItems, ef as getAnySessionInGroup, eg as getBillingBalance, eh as getBillingCustomer, ei as getCapabilityCatalogItem, ej as getCapabilityInstallation, ek as getCodexCapacityWaitForSession, el as getCodexCredentialStatus, em as getCodexRotationSettings, en as getConnectionMetadata, eo as getDeviceEnrollmentRequestByDeviceCode, ep as getEnrollment, eq as getFile, er as getFileUpload, es as getKnowledgeMemory, et as getLatestRunState, eu as getLatestStartedSessionTurn, ev as getManagedAccount, ew as getManagedUserByEmail, ex as getMaterializedSandboxFileResources, ey as getOpenPtySession, ez as getOrCreateSessionSystemUpdateOutbox, eA as getPackInstallation, eB as getPendingDeviceEnrollmentRequestByUserCode, eC as getPendingDeviceEnrollmentRequestByUserCodeGlobal, eD as getRecording, eE as getRig, eF as getRigByName, eG as getRigChange, eH as getRigName, eI as getRigVersion, eJ as getRigVersionById, eK as getSandbox, eL as getSandboxSessionEnvelope, eM as getScheduledTask, eN as getSession, eO as getSessionByCreateIdempotencyKey, eP as getSessionCodexState, eQ as getSessionEvent, eR as getSessionEventByClientEventId, eS as getSessionForSubject, eT as getSessionGoal, eU as getSessionHistoryItems, eV as getSessionLineage, eW as getSessionQueueSnapshot, eX as getSessionTurn, eY as getSessionTurnForAttempt, eZ as getSocialConnection, e_ as getStoredCapabilityHeaderCiphertext, e$ as getStreamAcknowledgment, f0 as getVariableSet, f1 as getVariableSetByName, f2 as getVariableSetValuesForRun, f3 as getWorkspace, f4 as getWorkspaceDefaultRigId, f5 as getWorkspaceEnvironment, f6 as getWorkspaceEnvironmentByName, f7 as getWorkspaceEnvironmentValuesForRun, f8 as getWorkspaceGrant, f9 as getWorkspaceModelPolicy, fa as getWorkspacePack, fb as grantWorkspaceAccess, fc as hasCreditLedgerEntry, fd as hashMemoryText, fe as heartbeatCodexCredentialLease, ff as heartbeatCodexCredentialLeaseUntil, fg as heartbeatLeaseHolder, fh as ingestMachineMetricsSample, fi as initializeSessionStartAtomically, fj as insertFailedWorkspaceCapture, fk as insertMachineMetricsSeries, fl as insertPtySession, fm as insertRecording, fn as insertWorkspaceCapture, fo as interruptedToolCallResult, fp as isCodexBilledTurn, fq as isMemoryTextTooLong, fr as isPrivateAddress, fs as isSessionCompactionRequested, ft as isStripeWebhookProcessed, fu as latestWorkspaceCapture, fv as listApiKeys, fw as listCapabilityCatalogItems, fx as listCapabilityInstallations, fy as listCodexAccountStatuses, fz as listConnectionsMetadata, fA as listCreditBalancesByAccount, fB as listDistinctRigVersionIdsInGroup, fC as listDistinctVariableSetIdsInGroup, fD as listEnabledMcpCapabilityServers, fE as listEnrollments, fF as listGitHubInstallationIdsForWorkspace, fG as listGitHubInstallationsForWorkspace, fH as listKnowledgeMemories, fI as listLiveModalSandboxLeaseAttributions, fJ as listMeterableWarmLeases, fK as listOpenPtySessions, fL as listOutstandingSessionSystemUpdates, fM as listPackInstallations, fN as listPendingCodexCapacityWakeTargets, fO as listPendingSessionTurns, fP as listRecordings, fQ as listRegistryCatalogSurfaceKeys, fR as listRigChanges, fS as listRigVersions, fT as listRigs, fU as listSandboxes, fV as listScheduledTaskRuns, fW as listScheduledTasks, fX as listSessionEvents, fY as listSessionIdsInGroup, fZ as listSessionMcpServerMetadata, f_ as listSessionMcpServersForRun, f$ as listSessionSystemUpdatesForTurn, g0 as listSessionTurns, g1 as listSessions, g2 as listSessionsForSubject, g3 as listSocialConnections, g4 as listSocialPosts, g5 as listUsageEvents, g6 as listVariableSets, g7 as listWorkspaceEnvironments, g8 as listWorkspaceMembers, g9 as listWorkspacePacks, ga as listWorkspacesForSubject, gb as loadCodexCredentialForRun, gc as loadConnectionCredentialForBroker, gd as loadIntegrationOAuthClient, ge as loadVariableSetForRun, gf as loadWorkspaceEnvironmentForRun, gg as markFileUploadFailed, gh as markSandboxFileResourcesMaterialized, gi as markScheduledTaskRunFailedIfQueued, gj as markSessionSystemUpdateOutboxDeliveredInTransaction, gk as markSessionSystemUpdateOutboxFailed, gl as markSessionWorkflowWakeDelivered, gm as markSessionWorkflowWakeFailed, gn as markStaleRegistryCatalogItems, go as markStripeWebhookProcessed, gp as markWarmLeaseInstanceLost, gq as mcpServerIdForCapability, gr as nextSessionHistoryPosition, gs as normalizeBearerScheme, gt as normalizeMemoryText, gu as orphanedResultRowIndicesForRepair, gv as peekSessionWork, gw as persistDrainSnapshot, gx as persistWarmSnapshot, gy as planWorkspaceCaptureGc, provisionRoles, gz as quarantineCodexCredentialForLease, gA as reArmDrainingLease, gB as readActiveSandbox, gC as readLease, gD as readMachineMetricsLatest, gE as readMachineMetricsLatestForWorkspace, gF as readMachineMetricsSeries, gG as reapExpiredSessionListSnapshots, gH as reapStaleLeaseHolders, gI as reapStaleLeaseHoldersGlobal, gJ as reconcileCodexCapacityWait, gK as recordAuditEvent, gL as recordCodexAccountConnectors, gM as recordCodexAccountUsage, gN as recordCodexAccountUsageWithWakeTargets, gO as recordCodexTokenRefresh, gP as recordConnectionTokenRefresh, gQ as recordConnectionUsed, gR as recordLeaseDataPlaneUrl, gS as recordLeaseTerminalDataPlaneUrl, gT as recordPendingSessionToolCallResult, gU as recordSessionActiveCodexCredential, gV as recordSkippedContextCompaction, gW as recordStreamAcknowledgment, gX as recordStripeWebhookEvent, gY as recordUsageEvent, gZ as recordWarmingSandboxCreated, g_ as recoverSessionDispatch, g$ as refreshOAuthConnectionCredential, h0 as registerDbBinding, h1 as registerPendingSessionToolCall, h2 as registerWorkspacePack, h3 as releaseCodexCredentialLease, h4 as releaseLeaseHolder, h5 as removeWorkspaceMember, h6 as renameCodexAccount, h7 as renderWorkspaceMemoryBlock, h8 as repairDetachedCodexCapacityAttempt, h9 as reparkOrphanedSessionTurn, ha as replaceIntegrationOAuthClient, hb as requestSessionCompaction, hc as requestSessionControl, hd as requestSessionTurnRecovery, he as requireFile, hf as requireScheduledTask, hg as requireSession, hh as requireSocialConnection, hi as requireWorkspace, hj as reserveToolspaceCallForTurn, hk as resolveWorkspaceMemoryBlock, hl as revokeApiKey, hm as revokeConnection, hn as revokeEnrollment, ho as revokeViewer, hp as rlsContextForWorkspace, hq as rlsStrategyFor, hr as sanitizeEventPayload, hs as sanitizeEventString, ht as sanitizeMemoryText, hu as sanitizeModelPayload, hv as saveRunState, hw as saveWorkspaceMemory, hx as searchWorkspaceMemories, hy as sessionSubject, hz as sessionsWithActiveOpOnEnrollment, hA as setActiveCodexCredential, hB as setActiveSandbox, hC as setCodexCredentialExhausted, hD as setCodexCredentialExhaustedWithWakeTargets, hE as setCodexCredentialStatus, hF as setCodexCredentialStatusById, hG as setConnectionStatus, hH as setEnrollmentDisplayState, hI as setEnrollmentOpStreamState, hJ as setEnrollmentWentOffline, hK as setInitialActiveCodexCredential, hL as setRlsContext, hM as setSessionChildNotificationsMode, hN as setSessionCodexPin, hO as setSessionGoalLastContinuationTurn, hP as setSessionGoalStatus, hQ as setSessionLastInputTokensForTurnAttempt, hR as setSessionPin, hS as setTemporalWorkflowId, hT as setVariableSetVariable, hU as setWorkspaceDefaultRig, hV as setWorkspaceEnvironmentVariable, hW as setWorkspaceInferenceControl, hX as settleCodexCredentialFailover, hY as settleCodexCredentialLeaseLoss, hZ as settlePendingSessionControl, h_ as settleScheduledTaskRunInTransaction, h$ as settleSessionIdleWithParentOutbox, i0 as shortMemoryId, i1 as storeIntegrationOAuthClient, i2 as sumUsageQuantity, i3 as touchEnrollmentLastSeen, i4 as touchLeaseHolder, i5 as updateCodexRotationSettings, i6 as updateConnection, i7 as updateImportBatchCounts, i8 as updateKnowledgeMemory, i9 as updatePackInstallationStatus, ia as updatePtySessionActivity, ib as updateRecording, ic as updateRig, id as updateRigChangeStatus, ie as updateScheduledTask, ig as updateScheduledTaskRun, ih as updateSessionGoal, ii as updateSessionMcpServerCredentials, ij as updateSessionTitle, ik as updateVariableSet, il as updateWorkspace, im as updateWorkspaceEnvironment, io as updateWorkspaceSettings, ip as upsertBillingCustomer, iq as upsertCapabilityCatalogItem, ir as upsertCodexSubscriptionCredential, is as upsertGitHubInstallation, it as upsertMachineMetricsLatest, iu as upsertRegistryCapabilityCatalogItem, iv as upsertSandboxSessionEnvelope, iw as upsertSessionGoal, ix as upsertWorkspaceModelPolicy, iy as withAccountRls, iz as withCodexCapacityMutation, iA as withCodexCredentialRefreshLock, iB as withRlsContext, iC as withWorkspaceRls, iD as withWorkspaceSubjectRls, iE as withWorkspaceUsageLock, iF as workspaceCaptureAtRevision, iG as workspaceCodexSubscriptionActive } from './provision-roles.js';
8
8
  export { migrate, runMigrations } from './migrate.js';