@opengeni/db 0.6.1 → 0.7.1

package/dist/{chunk-57MLICFR.js → chunk-YFQ7SGE4.js}

@@ -3,9 +3,15 @@ import postgres from "postgres";
 async function provisionRoles(adminConnection, options = {}) {
   const schema = validateIdentifier("targetSchema", options.targetSchema ?? "public");
   const rlsStrategy = options.rlsStrategy ?? "force";
-  const appRole = validateIdentifier("appRole", options.appRole ?? (process.env.OPENGENI_APP_DATABASE_USER?.trim() || "opengeni_app"));
+  const appRole = validateIdentifier(
+    "appRole",
+    options.appRole ?? (process.env.OPENGENI_APP_DATABASE_USER?.trim() || "opengeni_app")
+  );
   const appPassword = options.appPassword ?? process.env.OPENGENI_APP_DATABASE_PASSWORD;
-  const temporalRole = validateIdentifier("temporalRole", options.temporalRole ?? (process.env.OPENGENI_TEMPORAL_DATABASE_USER?.trim() || "opengeni_temporal"));
+  const temporalRole = validateIdentifier(
+    "temporalRole",
+    options.temporalRole ?? (process.env.OPENGENI_TEMPORAL_DATABASE_USER?.trim() || "opengeni_temporal")
+  );
   const temporalPassword = options.temporalPassword ?? process.env.OPENGENI_TEMPORAL_DATABASE_PASSWORD;
   const temporalDatabases = (options.temporalDatabases ?? commaSeparated(process.env.OPENGENI_TEMPORAL_DATABASES ?? "temporal,temporal_visibility")).map((name) => validateIdentifier("temporalDatabases", name));
   const sql = postgres(adminConnection, { max: 1 });
@@ -13,7 +19,9 @@ async function provisionRoles(adminConnection, options = {}) {
     let provisionedAppRole = null;
     if (rlsStrategy === "force") {
       if (!appPassword) {
-        throw new Error("OPENGENI_APP_DATABASE_PASSWORD (or appPassword) is required for rlsStrategy 'force'");
+        throw new Error(
+          "OPENGENI_APP_DATABASE_PASSWORD (or appPassword) is required for rlsStrategy 'force'"
+        );
       }
       await ensureLoginRole(sql, appRole, appPassword);
       provisionedAppRole = appRole;
@@ -58,7 +66,9 @@ async function ensureDatabase(sql, database, owner) {
   if (!existing[0]?.exists) {
     await sql.unsafe(`CREATE DATABASE ${identifier(database)} OWNER ${identifier(owner)}`);
   }
-  await sql.unsafe(`GRANT ALL PRIVILEGES ON DATABASE ${identifier(database)} TO ${identifier(owner)}`);
+  await sql.unsafe(
+    `GRANT ALL PRIVILEGES ON DATABASE ${identifier(database)} TO ${identifier(owner)}`
+  );
 }
 async function grantTemporalRoleInDatabase(adminConnection, database, role) {
   const databaseUrl = databaseUrlFor(adminConnection, database);
@@ -107,7 +117,9 @@ function databaseUrlFor(value, database) {
 if (import.meta.main) {
   const adminUrl = process.env.OPENGENI_MIGRATIONS_DATABASE_URL ?? process.env.OPENGENI_DATABASE_ADMIN_URL ?? process.env.OPENGENI_DATABASE_URL;
   if (!adminUrl) {
-    throw new Error("OPENGENI_MIGRATIONS_DATABASE_URL, OPENGENI_DATABASE_ADMIN_URL, or OPENGENI_DATABASE_URL is required");
+    throw new Error(
+      "OPENGENI_MIGRATIONS_DATABASE_URL, OPENGENI_DATABASE_ADMIN_URL, or OPENGENI_DATABASE_URL is required"
+    );
   }
   const result = await provisionRoles(adminUrl, {
     ...process.env.OPENGENI_DB_SCHEMA?.trim() ? { targetSchema: process.env.OPENGENI_DB_SCHEMA.trim() } : {}
@@ -118,4 +130,4 @@ if (import.meta.main) {
 export {
   provisionRoles
 };
-//# sourceMappingURL=chunk-57MLICFR.js.map
+//# sourceMappingURL=chunk-YFQ7SGE4.js.map

package/dist/chunk-YFQ7SGE4.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/provision-roles.ts"],"sourcesContent":["import postgres from \"postgres\";\nimport type { RlsStrategy } from \"./index\";\n\nexport type ProvisionResult = {\n  appRole: string | null;\n  temporalRole: string | null;\n  temporalDatabases: string[];\n  schema: string;\n  rlsStrategy: RlsStrategy;\n};\n\nexport type ProvisionRolesOptions = {\n  /**\n   * The schema OpenGeni's tables live in. The app-role GRANTs target this\n   * schema + `opengeni_private`. Defaults to `public` (standalone).\n   */\n  targetSchema?: string;\n  /**\n   * RLS posture (Step I). `\"force\"` (default) provisions the non-owner\n   * `opengeni_app` login role and GRANTs it table DML in the target schema —\n   * the role OpenGeni connects as under FORCE-RLS. `\"scoped\"` SKIPS the app-role\n   * provisioning entirely: the embedded host runs OpenGeni's queries over a role\n   * IT owns/manages (typically the schema owner), so OpenGeni neither creates\n   * nor grants the `opengeni_app` role. Temporal-role provisioning is unaffected\n   * by strategy.\n   */\n  rlsStrategy?: RlsStrategy;\n  appRole?: string;\n  appPassword?: string;\n  temporalRole?: string;\n  temporalPassword?: string;\n  temporalDatabases?: string[];\n};\n\n/**\n * SDK entry point (Step I): provision the OpenGeni database roles + grants over\n * a host-supplied admin connection. This is the named, parameterized form of the\n * historical env-driven `provision-roles` script (which still works as a CLI via\n * the `import.meta.main` block at the bottom — it just reads env into these\n * options).\n *\n * STANDALONE (default): `provisionRoles(adminConnection)` with no options →\n * `targetSchema: \"public\"`, `rlsStrategy: \"force\"`, reads `opengeni_app` creds\n * from env. Byte-for-byte the historical script behavior.\n *\n * EMBEDDED: `provisionRoles(adminConnection, { targetSchema, rlsStrategy })` lets\n * a host provision the app role over a dedicated schema (force) OR skip the\n * app role entirely and own the connection role itself (scoped).\n */\nexport async function provisionRoles(\n  adminConnection: string,\n  options: ProvisionRolesOptions = {},\n): Promise<ProvisionResult> {\n  const schema = validateIdentifier(\"targetSchema\", options.targetSchema ?? \"public\");\n  const rlsStrategy: RlsStrategy = options.rlsStrategy ?? \"force\";\n\n  const appRole = validateIdentifier(\n    \"appRole\",\n    options.appRole ?? (process.env.OPENGENI_APP_DATABASE_USER?.trim() || \"opengeni_app\"),\n  );\n  const appPassword = options.appPassword ?? process.env.OPENGENI_APP_DATABASE_PASSWORD;\n  const temporalRole = validateIdentifier(\n    \"temporalRole\",\n    options.temporalRole ??\n      (process.env.OPENGENI_TEMPORAL_DATABASE_USER?.trim() || \"opengeni_temporal\"),\n  );\n  const temporalPassword =\n    options.temporalPassword ?? process.env.OPENGENI_TEMPORAL_DATABASE_PASSWORD;\n  const temporalDatabases = (\n    options.temporalDatabases ??\n    commaSeparated(process.env.OPENGENI_TEMPORAL_DATABASES ?? \"temporal,temporal_visibility\")\n  ).map((name) => validateIdentifier(\"temporalDatabases\", name));\n\n  const sql = postgres(adminConnection, { max: 1 });\n  try {\n    // FORCE strategy provisions the non-owner app role OpenGeni connects as.\n    // SCOPED strategy: the host owns the connection role; OpenGeni provisions no\n    // app role (skipped here), only the optional Temporal role.\n    let provisionedAppRole: string | null = null;\n    if (rlsStrategy === \"force\") {\n      if (!appPassword) {\n        throw new Error(\n          \"OPENGENI_APP_DATABASE_PASSWORD (or appPassword) is required for rlsStrategy 'force'\",\n        );\n      }\n      await ensureLoginRole(sql, appRole, appPassword);\n      provisionedAppRole = appRole;\n    }\n\n    if (temporalPassword) {\n      await ensureLoginRole(sql, temporalRole, temporalPassword);\n      for (const database of temporalDatabases) {\n        await ensureDatabase(sql, database, temporalRole);\n        await grantTemporalRoleInDatabase(adminConnection, database, temporalRole);\n      }\n    }\n\n    if (rlsStrategy === \"force\") {\n      await grantAppRoleIfSchemaExists(sql, appRole, schema);\n    }\n\n    return {\n      appRole: provisionedAppRole,\n      temporalRole: temporalPassword ? temporalRole : null,\n      temporalDatabases: temporalPassword ? temporalDatabases : [],\n      schema,\n      rlsStrategy,\n    };\n  } finally {\n    await sql.end();\n  }\n}\n\nasync function ensureLoginRole(sql: postgres.Sql, role: string, password: string): Promise<void> {\n  await sql.unsafe(`\nDO $$\nBEGIN\n  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${literal(role)}) THEN\n    EXECUTE format('CREATE ROLE %I LOGIN PASSWORD %L', ${literal(role)}, ${literal(password)});\n  ELSE\n    EXECUTE format('ALTER ROLE %I LOGIN PASSWORD %L', ${literal(role)}, ${literal(password)});\n  END IF;\nEND $$;\n`);\n}\n\nasync function ensureDatabase(sql: postgres.Sql, database: string, owner: string): Promise<void> {\n  const existing = await sql<{ exists: boolean }[]>`\n    select exists(select 1 from pg_database where datname = ${database}) as exists\n  `;\n  if (!existing[0]?.exists) {\n    await sql.unsafe(`CREATE DATABASE ${identifier(database)} OWNER ${identifier(owner)}`);\n  }\n  await sql.unsafe(\n    `GRANT ALL PRIVILEGES ON DATABASE ${identifier(database)} TO ${identifier(owner)}`,\n  );\n}\n\nasync function grantTemporalRoleInDatabase(\n  adminConnection: string,\n  database: string,\n  role: string,\n): Promise<void> {\n  const databaseUrl = databaseUrlFor(adminConnection, database);\n  const databaseSql = postgres(databaseUrl, { max: 1 });\n  try {\n    await databaseSql.unsafe(`GRANT USAGE, CREATE ON SCHEMA public TO ${identifier(role)}`);\n  } finally {\n    await databaseSql.end();\n  }\n}\n\n/**\n * Grant the app role table DML in the OpenGeni data schema + EXECUTE on the\n * `opengeni_private` helper functions. Schema-parameterized (Step I): standalone\n * passes `public`; embedded passes the dedicated schema. The grants are guarded\n * on schema existence so provisioning before migrate is a safe no-op.\n */\nasync function grantAppRoleIfSchemaExists(\n  sql: postgres.Sql,\n  role: string,\n  schema: string,\n): Promise<void> {\n  await sql.unsafe(`\nDO $$\nBEGIN\n  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = ${literal(schema)}) THEN\n    EXECUTE format('GRANT USAGE ON SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});\n    EXECUTE format('GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});\n  END IF;\n  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'opengeni_private') THEN\n    EXECUTE format('GRANT USAGE ON SCHEMA opengeni_private TO %I', ${literal(role)});\n    EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA opengeni_private TO %I', ${literal(role)});\n  END IF;\nEND $$;\n`);\n}\n\nfunction commaSeparated(value: string): string[] {\n  return value\n    .split(\",\")\n    .map((item) => item.trim())\n    .filter(Boolean);\n}\n\nfunction validateIdentifier(name: string, value: string): string {\n  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {\n    throw new Error(`${name} contains an invalid Postgres identifier: ${value}`);\n  }\n  return value;\n}\n\nfunction identifier(value: string): string {\n  return `\"${value.replace(/\"/g, '\"\"')}\"`;\n}\n\nfunction literal(value: string): string {\n  return `'${value.replace(/'/g, \"''\")}'`;\n}\n\nfunction databaseUrlFor(value: string, database: string): string {\n  const url = new URL(value);\n  url.pathname = `/${database}`;\n  return url.toString();\n}\n\n// CLI form (unchanged behavior): read env into the SDK options and run. This is\n// what `bun src/provision-roles.ts` / the `provision-roles` package script\n// invokes — standalone byte-for-byte the historical script (public schema,\n// force strategy, env-driven creds).\nif (import.meta.main) {\n  const adminUrl =\n    process.env.OPENGENI_MIGRATIONS_DATABASE_URL ??\n    process.env.OPENGENI_DATABASE_ADMIN_URL ??\n    process.env.OPENGENI_DATABASE_URL;\n  if (!adminUrl) {\n    throw new Error(\n      \"OPENGENI_MIGRATIONS_DATABASE_URL, OPENGENI_DATABASE_ADMIN_URL, or OPENGENI_DATABASE_URL is required\",\n    );\n  }\n  const result = await provisionRoles(adminUrl, {\n    ...(process.env.OPENGENI_DB_SCHEMA?.trim()\n      ? { targetSchema: process.env.OPENGENI_DB_SCHEMA.trim() }\n      : {}),\n  });\n  console.log(JSON.stringify(result, null, 2));\n}\n"],"mappings":";AAAA,OAAO,cAAc;AAiDrB,eAAsB,eACpB,iBACA,UAAiC,CAAC,GACR;AAC1B,QAAM,SAAS,mBAAmB,gBAAgB,QAAQ,gBAAgB,QAAQ;AAClF,QAAM,cAA2B,QAAQ,eAAe;AAExD,QAAM,UAAU;AAAA,IACd;AAAA,IACA,QAAQ,YAAY,QAAQ,IAAI,4BAA4B,KAAK,KAAK;AAAA,EACxE;AACA,QAAM,cAAc,QAAQ,eAAe,QAAQ,IAAI;AACvD,QAAM,eAAe;AAAA,IACnB;AAAA,IACA,QAAQ,iBACL,QAAQ,IAAI,iCAAiC,KAAK,KAAK;AAAA,EAC5D;AACA,QAAM,mBACJ,QAAQ,oBAAoB,QAAQ,IAAI;AAC1C,QAAM,qBACJ,QAAQ,qBACR,eAAe,QAAQ,IAAI,+BAA+B,8BAA8B,GACxF,IAAI,CAAC,SAAS,mBAAmB,qBAAqB,IAAI,CAAC;AAE7D,QAAM,MAAM,SAAS,iBAAiB,EAAE,KAAK,EAAE,CAAC;AAChD,MAAI;AAIF,QAAI,qBAAoC;AACxC,QAAI,gBAAgB,SAAS;AAC3B,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,YAAM,gBAAgB,KAAK,SAAS,WAAW;AAC/C,2BAAqB;AAAA,IACvB;AAEA,QAAI,kBAAkB;AACpB,YAAM,gBAAgB,KAAK,cAAc,gBAAgB;AACzD,iBAAW,YAAY,mBAAmB;AACxC,cAAM,eAAe,KAAK,UAAU,YAAY;AAChD,cAAM,4BAA4B,iBAAiB,UAAU,YAAY;AAAA,MAC3E;AAAA,IACF;AAEA,QAAI,gBAAgB,SAAS;AAC3B,YAAM,2BAA2B,KAAK,SAAS,MAAM;AAAA,IACvD;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,cAAc,mBAAmB,eAAe;AAAA,MAChD,mBAAmB,mBAAmB,oBAAoB,CAAC;AAAA,MAC3D;AAAA,MACA;AAAA,IACF;AAAA,EACF,UAAE;AACA,UAAM,IAAI,IAAI;AAAA,EAChB;AACF;AAEA,eAAe,gBAAgB,KAAmB,MAAc,UAAiC;AAC/F,QAAM,IAAI,OAAO;AAAA;AAAA;AAAA,0DAGuC,QAAQ,IAAI,CAAC;AAAA,yDACd,QAAQ,IAAI,CAAC,KAAK,QAAQ,QAAQ,CAAC;AAAA;AAAA,wDAEpC,QAAQ,IAAI,CAAC,KAAK,QAAQ,QAAQ,CAAC;AAAA;AAAA;AAAA,CAG1F;AACD;AAEA,eAAe,eAAe,KAAmB,UAAkB,OAA8B;AAC/F,QAAM,WAAW,MAAM;AAAA,8DACqC,QAAQ;AAAA;AAEpE,MAAI,CAAC,SAAS,CAAC,GAAG,QAAQ;AACxB,UAAM,IAAI,OAAO,mBAAmB,WAAW,QAAQ,CAAC,UAAU,WAAW,KAAK,CAAC,EAAE;AAAA,EACvF;AACA,QAAM,IAAI;AAAA,IACR,oCAAoC,WAAW,QAAQ,CAAC,OAAO,WAAW,KAAK,CAAC;AAAA,EAClF;AACF;AAEA,eAAe,4BACb,iBACA,UACA,MACe;AACf,QAAM,cAAc,eAAe,iBAAiB,QAAQ;AAC5D,QAAM,cAAc,SAAS,aAAa,EAAE,KAAK,EAAE,CAAC;AACpD,MAAI;AACF,UAAM,YAAY,OAAO,2CAA2C,WAAW,IAAI,CAAC,EAAE;AAAA,EACxF,UAAE;AACA,UAAM,YAAY,IAAI;AAAA,EACxB;AACF;AAQA,eAAe,2BACb,KACA,MACA,QACe;AACf,QAAM,IAAI,OAAO;AAAA;AAAA;AAAA,0DAGuC,QAAQ,MAAM,CAAC;AAAA,uDAClB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,8FACM,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,qEAG1D,QAAQ,IAAI,CAAC;AAAA,wFACM,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,CAGpG;AACD;AAEA,SAAS,eAAe,OAAyB;AAC/C,SAAO,MACJ,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,OAAO;AACnB;AAEA,SAAS,mBAAmB,MAAc,OAAuB;AAC/D,MAAI,CAAC,2BAA2B,KAAK,KAAK,GAAG;AAC3C,UAAM,IAAI,MAAM,GAAG,IAAI,6CAA6C,KAAK,EAAE;AAAA,EAC7E;AACA,SAAO;AACT;AAEA,SAAS,WAAW,OAAuB;AACzC,SAAO,IAAI,MAAM,QAAQ,MAAM,IAAI,CAAC;AACtC;AAEA,SAAS,QAAQ,OAAuB;AACtC,SAAO,IAAI,MAAM,QAAQ,MAAM,IAAI,CAAC;AACtC;AAEA,SAAS,eAAe,OAAe,UAA0B;AAC/D,QAAM,MAAM,IAAI,IAAI,KAAK;AACzB,MAAI,WAAW,IAAI,QAAQ;AAC3B,SAAO,IAAI,SAAS;AACtB;AAMA,IAAI,YAAY,MAAM;AACpB,QAAM,WACJ,QAAQ,IAAI,oCACZ,QAAQ,IAAI,+BACZ,QAAQ,IAAI;AACd,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,MAAM,eAAe,UAAU;AAAA,IAC5C,GAAI,QAAQ,IAAI,oBAAoB,KAAK,IACrC,EAAE,cAAc,QAAQ,IAAI,mBAAmB,KAAK,EAAE,IACtD,CAAC;AAAA,EACP,CAAC;AACD,UAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC7C;","names":[]}

package/dist/index.d.ts

@@ -2,7 +2,7 @@ import '@opengeni/contracts';
 import '@opengeni/config';
 export { isCodexBilledModel } from '@opengeni/codex';
 import 'drizzle-orm/pg-core';
-import './schema-BUbuMteO.js';
+export { A as AGENT_VISIBLE_MEMORY_STATUSES, a as AcceptSessionApprovalDecisionResult, b as AccrueWarmSecondsResult, c as AcquireLeaseInput, d as AcquireLeaseResult, e as ActiveSandboxPointer, f as AddSessionSystemUpdateInput, g as AddSessionSystemUpdateResult, h as AgentCommandAuthorityError, i as AgentInternalUpdateCommandResult, j as AppendEventInput, k as ApplyContextCompactionResult, l as ApplySessionTurnSettlementInput, m as ApplySessionTurnSettlementResult, n as ArmCodexCapacityWaitResult, B as BootstrapWorkspaceInput, C as CODEX_CAPACITY_REFRESH_MAX_MS, o as CODEX_CAPACITY_REFRESH_MIN_MS, p as CODEX_CREDENTIAL_LEASE_TTL_MS, q as CODEX_ROTATION_STRATEGIES, r as ClaimSessionWorkForAttemptInput, s as ClaimSessionWorkForAttemptResult, t as ClearSessionContextResult, u as CodexAccountStatus, v as CodexAccountUsageSnapshot, w as CodexAuthDeps, x as CodexCapacityAvailabilityDecision, y as CodexCapacityMutationResult, z as CodexCapacityResetKind, D as CodexCapacitySelectionContext, E as CodexCapacityWait, F as CodexCapacityWaitStatus, G as CodexCapacityWakeTarget, H as CodexCredentialForRun, I as CodexCredentialLeaseCandidateFilter, J as CodexCredentialLeaseCandidateFilterResult, K as CodexCredentialLeasePolicyScopeResolver, L as CodexCredentialLeaseQuarantine, M as CodexCredentialLeaseResult, N as CodexCredentialLeaseSelection, O as CodexCredentialLeaseSelectionContext, P as CodexCredentialStatus, Q as CodexCredentialTokens, R as CodexLeaseAccountStatus, S as CodexPinSource, T as CodexRotationSettings, U as CodexRotationStrategy, V as ComposerDraftRow, W as ConnectionBrokerDeps, X as ConnectionCredentialForBroker, Y as ConnectionRefreshHttpError, Z as ConsumeOAuthStateNonceInput, _ as CorrectWorkspaceMemoryInput, $ as CorrectWorkspaceMemoryResult, a0 as CreateCapabilityCatalogItemInput, a1 as CreateConnectionInput, a2 as CreateDbOptions, a3 as CreateImportBatchInput, a4 as CreateKnowledgeMemoryInput, a5 as CreatePackInstallationInput, a6 as CreateScheduledTaskInput, a7 as CreateSessionGoalInput, a8 as CreateSessionMcpServerInput, a9 as CreateSocialConnectionInput, aa as CreateSocialPostInput, ab as CreditBalanceByAccount, ac as Database, ad as DbClient, ae as DeviceEnrollmentRequestRecord, af as DeviceEnrollmentStatus, ag as EditQueueCommandResult, ah as EffectiveControlBlocker, ai as EffectiveControlResumeOption, aj as EffectiveControlState, ak as EffectiveSessionControl, al as EnableCapabilityInstallationInput, am as EnabledMcpCapabilityServer, an as EnqueueSessionTurnInput, ao as EnrollmentExposure, ap as EnrollmentOs, aq as EnrollmentRecord, ar as EnrollmentStatus, as as ExpiredFileUploadCleanupClaim, at as FileUploadCleanupClaimResult, au as ForceDrainResult, av as GitHubInstallation, aw as GoalContinuationDecision, ax as ImportBatch, ay as InitializeSessionStartInput, az as InitializeSessionStartResult, aA as IntegrationOAuthClientForUse, aB as LeaseHolderKind, aC as LeaseSnapshot, aD as ListKnowledgeMemoryOptions, aE as ListSessionEventsOptions, aF as ListSessionsForSubjectOptions, aG as ListSessionsOptions, aH as LiveModalSandboxLeaseAttribution, aI as MACHINE_METRICS_SERIES_INTERVAL_MS, aJ as MAX_INTERNAL_UPDATE_BATCH_BYTES, aK as MAX_INTERNAL_UPDATE_BATCH_MEMBERS, aL as MAX_INTERNAL_UPDATE_BYTES, aM as MEMORY_ACTIVE_RECORD_CAP, aN as MEMORY_BLOCK_KIND_ORDER, aO as MEMORY_BLOCK_RECORD_LIMIT, aP as MEMORY_CORRECT_TOOL_DESCRIPTION, aQ as MEMORY_KIND_SECTION_TITLES, aR as MEMORY_NEAR_DUP_COSINE_THRESHOLD, aS as MEMORY_NEAR_DUP_NEIGHBORS, aT as MEMORY_SAVE_TOOL_DESCRIPTION, aU as MEMORY_SEARCH_DEFAULT_LIMIT, aV as MEMORY_SEARCH_MAX_LIMIT, aW as MEMORY_SEARCH_TOOL_DESCRIPTION, aX as MEMORY_TEXT_MAX_CHARS, aY as MEMORY_VISIBLE_RECORD_CAP, aZ as MachineMetricsRow, a_ as MachineMetricsSample, a$ as MarkWarmLeaseInstanceLostResult, b0 as MemoryBlockRecord, b1 as MemoryEmbedder, b2 as MemorySanitizeResult, b3 as MeterableWarmLease, b4 as PendingSessionToolCallInput, ProvisionResult, ProvisionRolesOptions, b5 as QueueCommandConflictCode, b6 as QueueCommandConflictError, b7 as QueueCommandResult, b8 as QueuedTurnRow, b9 as ReapDrainable, ba as ReconcileCodexCapacityWaitResult, bb as RecoverSessionDispatchInput, bc as RecoverSessionDispatchResult, bd as RegisterWorkspacePackInput, be as RegistryCapabilityCatalogItemInput, bf as RegistryCatalogSurfaceKey, bg as ReplaceIntegrationOAuthClientInput, bh as RequestSessionTurnRecoveryInput, bi as RequestSessionTurnRecoveryResult, bj as ResolveConnectionCredentialInput, bk as ResolveConnectionCredentialResult, bl as RigActiveVersionChangedError, bm as RigChangeAlreadyVerifyingError, bn as RigChangeTransitionError, bo as RigVersionContentInput, bp as RlsContext, bq as RlsStrategy, br as SESSION_ANCESTRY_LIMIT, bs as SandboxImageConflictError, bt as SandboxKind, bu as SandboxLeaseLiveness, bv as SandboxLeaseSupersededError, bw as SandboxPtySessionRow, bx as SandboxRecord, by as SandboxRigConflictError, bz as SaveWorkspaceMemoryInput, bA as SaveWorkspaceMemoryResult, bB as SessionAttemptInterruptionSettlement, bC as SessionCodexState, bD as SessionCommandActor, bE as SessionCommandIdempotencyError, bF as SessionCommandReceiptRow, bG as SessionContextBusyError, bH as SessionControlConflictError, bI as SessionControlInvariantError, bJ as SessionControlMutationResult, bK as SessionLineage, bL as SessionListAccessError, bM as SessionListCursor, bN as SessionListCursorError, bO as SessionMcpServerForRun, bP as SessionPinAccessError, bQ as SessionPinVersionConflictError, bR as SessionRecordingCodec, bS as SessionRecordingMode, bT as SessionRecordingRow, bU as SessionRecordingState, bV as SessionSystemUpdateOutboxDelivery, bW as SessionTurnAttemptOutcome, bX as SessionTurnRecordingSettlement, bY as SessionWorkPeek, bZ as SessionWorkTrigger, b_ as SessionWorkflowWake, b$ as SetSessionCodexPinOptions, c0 as SettleCodexCredentialFailoverResult, c1 as SettleCodexCredentialLeaseLossResult, c2 as SteerQueueCommandResult, c3 as StoreIntegrationOAuthClientInput, c4 as StoredIntegrationOAuthClient, c5 as StreamAcknowledgment, c6 as SubmitHumanPromptResult, c7 as ToolspaceCallReservation, c8 as TurnAttemptFenceRejectReason, c9 as UpdateConnectionInput, ca as UpdateImportBatchCountsInput, cb as UpdateKnowledgeMemoryInput, cc as UpdateScheduledTaskInput, cd as UpdateSessionMcpServerCredentialsInput, ce as UpdateSessionMcpServerCredentialsResult, cf as UserLookup, cg as VariableSetForRun, ch as WORKSPACE_MEMORY_BLOCK_EMPTY, ci as WORKSPACE_MEMORY_BLOCK_HEADER_POPULATED, cj as WORKSPACE_MEMORY_BLOCK_TOKEN_BUDGET, ck as WorkspaceCaptureCommitResult, cl as WorkspaceCaptureGcPlan, cm as WorkspaceCaptureGcRow, cn as WorkspaceCaptureRow, co as WorkspaceControlLockMode, cp as WorkspaceControlMutationResult, cq as WorkspaceEnvironmentForRun, cr as WorkspaceMemoryOrigin, cs as WorkspaceMemorySearchInput, ct as WorkspaceMemorySearchMode, cu as WorkspaceMemorySearchResult, cv as WorkspaceModelPolicy, cw as abandonRecordingForTurnAttempt, cx as acceptSessionApprovalDecision, cy as accrueWarmSeconds, cz as acquireCodexCredentialLease, cA as acquireLease, cB as activateRigVersion, cC as addSessionSystemUpdate, cD as addSessionSystemUpdateWithSourceMutation, cE as allAccountPermissions, cF as allWorkspacePermissions, cG as appendSessionEventToSandboxGroup, cH as appendSessionEvents, cI as appendSessionEventsAndUpdateSession, cJ as appendSessionEventsForTurnAttempt, cK as appendSessionEventsWithLockedSessionUpdate, cL as appendSessionHistoryItems, cM as applyContextCompaction, cN as applyCreditDebitUpToBalance, cO as applyCreditLedgerEntry, cP as applySessionTurnSettlement, cQ as approveDeviceEnrollmentRequest, cR as armCodexCapacityWait, cS as assertAgentCommandAuthorityInTransaction, cT as autoResumeSessionBranchInTransaction, cU as beginRigChangeVerificationAttempt, cV as bootstrapWorkspace, cW as buildChildCompletionDigest, cX as buildCodexTokenResolver, cY as buildConnectionTokenResolver, cZ as canonicalSessionCommandHash, c_ as claimExpiredFileUploadCleanup, c$ as claimFileUploadCleanup, d0 as claimPendingSessionSystemUpdateOutbox, d1 as claimPendingSessionWorkflowWakes, d2 as claimSessionWorkForAttempt, d3 as clearDurablePendingSessionToolCalls, d4 as clearEnrollmentWentOffline, d5 as clearSessionContext, d6 as clearSessionGoal, d7 as clearedContextMarkerItem, d8 as closePtySession, d9 as closeSessionTurnAttemptInTransaction, da as codexCapacityRefreshBackoffMs, db as commitWarmingToWarm, dc as completeExpiredFileUploadCleanup, dd as completeFileUpload, de as completeFileUploadCleanup, df as computeWorkspaceCaptureGcPlan, dg as confirmDrainCold, dh as consumeDeviceEnrollmentRequest, di as consumeIntegrationOAuthStateNonce, dj as correctWorkspaceMemory, dk as countActiveApiKeysForWorkspace, dl as countActiveSessionHistoryItems, dm as countActiveSessionsForWorkspace, dn as countActiveSessionsUsingEnvironment, dp as countActiveSessionsUsingVariableSet, dq as countConsecutiveReactiveRotations, dr as countQueuedTurns, ds as countRigs, dt as countSandboxLeasesByLiveness, du as countScheduledTasksForWorkspace, dv as countScheduledTasksUsingEnvironment, dw as countScheduledTasksUsingVariableSet, dx as countSessionHistoryItems, dy as countSessionsUsingRig, dz as countVariableSets, dA as countWorkspaceEnvironments, dB as countWorkspacesForAccount, dC as createApiKey, dD as createConnection, dE as createDb, dF as createDeviceEnrollmentRequest, dG as createEnrollment, dH as createFileUpload, dI as createImportBatch, dJ as createKnowledgeMemory, dK as createRig, dL as createRigChange, dM as createRigVersion, dN as createRigVersionForChangePromotion, dO as createSandbox, dP as createScheduledTask, dQ as createScheduledTaskRun, dR as createSession, dS as createSessionGoal, dT as createSessionMcpServers, dU as createSessionWithIdempotencyKey, dV as createSocialConnection, dW as createSocialPost, dX as createVariableSet, dY as createWorkspace, dZ as createWorkspaceEnvironment, d_ as decodeSessionListCursor, d$ as decryptEnvironmentValue, d$ as decryptVariableSetValue, e0 as decryptedCapabilityHeaders, e1 as deleteRecording, e2 as deleteRig, e3 as deleteRigIfNoActiveSessions, e4 as deleteScheduledTask, e5 as deleteSessionQueueItemInTransaction, e6 as deleteVariableSet, e7 as deleteVariableSetVariable, e8 as deleteWorkspace, e9 as deleteWorkspaceCaptureRows, ea as deleteWorkspaceEnvironment, eb as deleteWorkspaceEnvironmentVariable, ec as deleteWorkspacePack, ed as denyDeviceEnrollmentRequest, ee as disableCapabilityInstallation, ef as disconnectAllCodexAccounts, eg as disconnectCodexAccount, eh as editQueuedTurnInTransaction, ei as enableCapabilityInstallation, ej as enablePackInstallation, ek as encodeSessionListCursor, el as encryptEnvironmentValue, el as encryptVariableSetValue, em as enqueueSessionTurn, en as enqueueSessionWorkflowWake, eo as enqueueSessionWorkflowWakeIfRunnable, ep as enqueueSessionWorkflowWakeInTransaction, eq as ensureCodexRotationSettings, er as ensureManagedAccessForUser, es as estimateMemoryTokens, et as evaluateGoalContinuation, eu as evaluateSessionControl, ev as evaluateSessionControls, ew as failWarmingToCold, ex as fetchCodexUsageForAccount, ey as finalizeEnrollmentByToken, ez as findActiveApiKeyByHash, eA as forceDrainOverLimitViewerOnlyBoxes, eB as getActiveSessionHistoryItems, eC as getAnySessionInGroup, eD as getBillingBalance, eE as getBillingCustomer, eF as getCapabilityCatalogItem, eG as getCapabilityInstallation, eH as getCodexCapacityWaitForSession, eI as getCodexCredentialStatus, eJ as getCodexRotationSettings, eK as getComposerDraftInTransaction, eL as getConnectionMetadata, eM as getDeviceEnrollmentRequestByDeviceCode, eN as getEnrollment, eO as getFile, eP as getFileUpload, eQ as getKnowledgeMemory, eR as getLatestRunState, eS as getLatestStartedSessionTurn, eT as getManagedAccount, eU as getManagedUserByEmail, eV as getMaterializedSandboxFileResources, eW as getOpenPtySession, eX as getOrCreateSessionSystemUpdateOutbox, eY as getPackInstallation, eZ as getPendingDeviceEnrollmentRequestByUserCode, e_ as getPendingDeviceEnrollmentRequestByUserCodeGlobal, e$ as getRecording, f0 as getRig, f1 as getRigByName, f2 as getRigChange, f3 as getRigName, f4 as getRigVersion, f5 as getRigVersionById, f6 as getSandbox, f7 as getSandboxSessionEnvelope, f8 as getScheduledTask, f9 as getSession, fa as getSessionByCreateIdempotencyKey, fb as getSessionCodexState, fc as getSessionEvent, fd as getSessionEventByClientEventId, fe as getSessionForSubject, ff as getSessionGoal, fg as getSessionHistoryItems, fh as getSessionLineage, fi as getSessionQueueSnapshot, fj as getSessionTurn, fk as getSessionTurnForAttempt, fl as getSocialConnection, fm as getStoredCapabilityHeaderCiphertext, fn as getStreamAcknowledgment, fo as getVariableSet, fp as getVariableSetByName, fq as getVariableSetValuesForRun, fr as getWorkspace, fs as getWorkspaceControlEvent, ft as getWorkspaceDefaultRigId, fu as getWorkspaceEnvironment, fv as getWorkspaceEnvironmentByName, fw as getWorkspaceEnvironmentValuesForRun, fx as getWorkspaceGrant, fy as getWorkspaceModelPolicy, fz as getWorkspacePack, fA as grantWorkspaceAccess, fB as hasCreditLedgerEntry, fC as hashMemoryText, fD as heartbeatCodexCredentialLease, fE as heartbeatCodexCredentialLeaseUntil, fF as heartbeatLeaseHolder, fG as ingestMachineMetricsSample, fH as initializeSessionStartAtomically, fI as insertFailedWorkspaceCapture, fJ as insertMachineMetricsSeries, fK as insertPtySession, fL as insertRecording, fM as insertWorkspaceCapture, fN as interruptedToolCallResult, fO as isCodexBilledTurn, fP as isMemoryTextTooLong, fQ as isPrivateAddress, fR as isSessionCompactionRequested, fS as isStripeWebhookProcessed, fT as latestWorkspaceCapture, fU as listApiKeys, fV as listCapabilityCatalogItems, fW as listCapabilityInstallations, fX as listCodexAccountStatuses, fY as listConnectionsMetadata, fZ as listCreditBalancesByAccount, f_ as listDistinctRigVersionIdsInGroup, f$ as listDistinctVariableSetIdsInGroup, g0 as listEnabledMcpCapabilityServers, g1 as listEnrollments, g2 as listGitHubInstallationIdsForWorkspace, g3 as listGitHubInstallationsForWorkspace, g4 as listKnowledgeMemories, g5 as listLiveModalSandboxLeaseAttributions, g6 as listMeterableWarmLeases, g7 as listOpenPtySessions, g8 as listOutstandingSessionSystemUpdates, g9 as listPackInstallations, ga as listPendingCodexCapacityWakeTargets, gb as listPendingSessionTurns, gc as listRecordings, gd as listRegistryCatalogSurfaceKeys, ge as listRigChanges, gf as listRigVersions, gg as listRigs, gh as listSandboxes, gi as listScheduledTaskRuns, gj as listScheduledTasks, gk as listSessionEvents, gl as listSessionIdsInGroup, gm as listSessionMcpServerMetadata, gn as listSessionMcpServersForRun, go as listSessionSystemUpdatesForTurn, gp as listSessionTurns, gq as listSessions, gr as listSessionsForSubject, gs as listSocialConnections, gt as listSocialPosts, gu as listUsageEvents, gv as listVariableSets, gw as listWorkspaceControlEvents, gx as listWorkspaceEnvironments, gy as listWorkspaceMembers, gz as listWorkspacePacks, gA as listWorkspacesForSubject, gB as loadCodexCredentialForRun, gC as loadConnectionCredentialForBroker, gD as loadIntegrationOAuthClient, gE as loadVariableSetForRun, gF as loadWorkspaceEnvironmentForRun, gG as lockWorkspaceInferenceControl, gH as markFileUploadFailed, gI as markSandboxFileResourcesMaterialized, gJ as markScheduledTaskRunFailedIfQueued, gK as markSessionSystemUpdateOutboxDeliveredInTransaction, gL as markSessionSystemUpdateOutboxFailed, gM as markSessionWorkflowWakeDelivered, gN as markSessionWorkflowWakeFailed, gO as markStaleRegistryCatalogItems, gP as markStripeWebhookProcessed, gQ as markWarmLeaseInstanceLost, gR as mcpServerIdForCapability, gS as moveQueuedTurnInTransaction, gT as mutateSessionControlInTransaction, gU as mutateWorkspaceControlInTransaction, gV as nextSessionHistoryPosition, gW as normalizeBearerScheme, gX as normalizeMemoryText, gY as orphanedResultRowIndicesForRepair, gZ as peekSessionWork, g_ as persistDrainSnapshot, g$ as persistWarmSnapshot, h0 as planWorkspaceCaptureGc, provisionRoles, h1 as quarantineCodexCredentialForLease, h2 as reArmDrainingLease, h3 as readActiveSandbox, h4 as readLease, h5 as readMachineMetricsLatest, h6 as readMachineMetricsLatestForWorkspace, h7 as readMachineMetricsSeries, h8 as reapExpiredSessionListSnapshots, h9 as reapStaleLeaseHolders, ha as reapStaleLeaseHoldersGlobal, hb as reconcileCodexCapacityWait, hc as recordAuditEvent, hd as recordCodexAccountConnectors, he as recordCodexAccountUsage, hf as recordCodexAccountUsageWithWakeTargets, hg as recordCodexTokenRefresh, hh as recordConnectionTokenRefresh, hi as recordConnectionUsed, hj as recordLeaseDataPlaneUrl, hk as recordLeaseTerminalDataPlaneUrl, hl as recordPendingSessionToolCallResult, hm as recordSessionActiveCodexCredential, hn as recordSkippedContextCompaction, ho as recordStreamAcknowledgment, hp as recordStripeWebhookEvent, hq as recordUsageEvent, hr as recordWarmingSandboxCreated, hs as recoverSessionDispatch, ht as refreshOAuthConnectionCredential, hu as registerDbBinding, hv as registerInternalUpdateWakeInTransaction, hw as registerPendingSessionToolCall, hx as registerSessionTurnAttemptClaim, hy as registerSessionWorkflowWakeInTransaction, hz as registerWorkspacePack, hA as releaseCodexCredentialLease, hB as releaseLeaseHolder, hC as removeWorkspaceMember, hD as renameCodexAccount, hE as renderWorkspaceMemoryBlock, hF as replaceIntegrationOAuthClient, hG as requestSessionCompaction, hH as requestSessionTurnRecovery, hI as requireFile, hJ as requireScheduledTask, hK as requireSession, hL as requireSocialConnection, hM as requireWorkspace, hN as reserveSessionCommandReceipt, hO as reserveToolspaceCallForTurn, hP as resolveWorkspaceMemoryBlock, hQ as revokeApiKey, hR as revokeConnection, hS as revokeEnrollment, hT as revokeViewer, hU as rlsContextForWorkspace, hV as rlsStrategyFor, hW as sanitizeEventPayload, hX as sanitizeEventString, hY as sanitizeMemoryText, hZ as sanitizeModelPayload, h_ as saveComposerDraftInTransaction, h$ as saveRunState, i0 as saveWorkspaceMemory, i1 as searchWorkspaceMemories, i2 as sendAgentMessageInTransaction, i3 as serializeEffectiveSessionControl, i4 as sessionSubject, i5 as sessionsWithActiveOpOnEnrollment, i6 as setActiveCodexCredential, i7 as setActiveSandbox, i8 as setCodexCredentialExhausted, i9 as setCodexCredentialExhaustedWithWakeTargets, ia as setCodexCredentialStatus, ib as setCodexCredentialStatusById, ic as setConnectionStatus, id as setEnrollmentDisplayState, ie as setEnrollmentOpStreamState, ig as setEnrollmentWentOffline, ih as setInitialActiveCodexCredential, ii as setRlsContext, ij as setSessionCodexPin, ik as setSessionGoalLastContinuationTurn, il as setSessionGoalStatus, im as setSessionLastInputTokensForTurnAttempt, io as setSessionPin, ip as setTemporalWorkflowId, iq as setVariableSetVariable, ir as setWorkspaceDefaultRig, is as setWorkspaceEnvironmentVariable, it as settleCodexCredentialFailover, iu as settleCodexCredentialLeaseLoss, iv as settleScheduledTaskRunInTransaction, iw as settleSessionAttemptInterruptions, ix as settleSessionIdleWithParentOutbox, iy as shortMemoryId, iz as steerAgentSessionInTransaction, iA as steerQueuedTurnInTransaction, iB as storeIntegrationOAuthClient, iC as submitHumanPromptInTransaction, iD as sumUsageQuantity, iE as supersedeSessionCurrentDirectionInTransaction, iF as touchEnrollmentLastSeen, iG as touchLeaseHolder, iH as updateCodexRotationSettings, iI as updateConnection, iJ as updateImportBatchCounts, iK as updateKnowledgeMemory, iL as updatePackInstallationStatus, iM as updatePtySessionActivity, iN as updateRecording, iO as updateRig, iP as updateRigChangeStatus, iQ as updateScheduledTask, iR as updateScheduledTaskRun, iS as updateSessionCommandReceiptResult, iT as updateSessionGoal, iU as updateSessionMcpServerCredentials, iV as updateSessionTitle, iW as updateVariableSet, iX as updateWorkspace, iY as updateWorkspaceEnvironment, iZ as updateWorkspaceSettings, i_ as upsertBillingCustomer, i$ as upsertCapabilityCatalogItem, j0 as upsertCodexSubscriptionCredential, j1 as upsertGitHubInstallation, j2 as upsertMachineMetricsLatest, j3 as upsertRegistryCapabilityCatalogItem, j4 as upsertSandboxSessionEnvelope, j5 as upsertSessionGoal, j6 as upsertWorkspaceModelPolicy, j7 as withAccountRls, j8 as withCodexCapacityMutation, j9 as withCodexCredentialRefreshLock, ja as withRlsContext, jb as withWorkspaceRls, jc as withWorkspaceSubjectRls, jd as withWorkspaceUsageLock, je as workspaceCaptureAtRevision, jf as workspaceCodexSubscriptionActive } from './provision-roles.js';
+import './schema-BN5mB9xZ.js';
 export { sql as dbSql } from 'drizzle-orm';
-export { A as AccrueWarmSecondsResult, a as AcquireLeaseInput, b as AcquireLeaseResult, c as ActiveSandboxPointer, d as AppendEventInput, B as BootstrapWorkspaceInput, C as CLEARED_RUN_STATE, e as CODEX_ROTATION_STRATEGIES, f as ClearSessionContextResult, g as CodexAccountStatus, h as CodexAccountUsageSnapshot, i as CodexAuthDeps, j as CodexCredentialForRun, k as CodexCredentialTokens, l as CodexRotationSettings, m as CodexRotationStrategy, n as ConnectionBrokerDeps, o as ConnectionCredentialForBroker, p as ConnectionRefreshHttpError, q as ConsumeOAuthStateNonceInput, r as CreateCapabilityCatalogItemInput, s as CreateConnectionInput, t as CreateDbOptions, u as CreateImportBatchInput, v as CreateKnowledgeMemoryInput, w as CreatePackInstallationInput, x as CreateScheduledTaskInput, y as CreateSessionGoalInput, z as CreateSessionMcpServerInput, D as CreateSocialConnectionInput, E as CreateSocialPostInput, F as CreditBalanceByAccount, G as Database, H as DbClient, I as DeviceEnrollmentRequestRecord, J as DeviceEnrollmentStatus, K as EnableCapabilityInstallationInput, L as EnabledMcpCapabilityServer, M as EnqueueSessionTurnInput, N as EnrollmentExposure, O as EnrollmentOs, P as EnrollmentRecord, Q as EnrollmentStatus, R as ForceDrainResult, S as GitHubInstallation, T as GoalContinuationDecision, U as ImportBatch, V as IntegrationOAuthClientForUse, W as LeaseHolderKind, X as LeaseSnapshot, Y as ListKnowledgeMemoryOptions, Z as ListSessionEventsOptions, _ as LiveModalSandboxLeaseAttribution, $ as MACHINE_METRICS_SERIES_INTERVAL_MS, a0 as MachineMetricsRow, a1 as MachineMetricsSample, a2 as MeterableWarmLease, ProvisionResult, ProvisionRolesOptions, a3 as ReapDrainable, a4 as RegisterWorkspacePackInput, a5 as RegistryCapabilityCatalogItemInput, a6 as RegistryCatalogSurfaceKey, a7 as ResolveConnectionCredentialInput, a8 as ResolveConnectionCredentialResult, a9 as RlsContext, aa as RlsStrategy, ab as SandboxImageConflictError, ac as SandboxKind, ad as SandboxLeaseLiveness, ae as SandboxLeaseSupersededError, af as SandboxPtySessionRow, ag as SandboxRecord, ah as SessionCodexState, ai as SessionMcpServerForRun, aj as SessionRecordingCodec, ak as SessionRecordingMode, al as SessionRecordingRow, am as SessionRecordingState, an as StoreIntegrationOAuthClientInput, ao as StoredIntegrationOAuthClient, ap as StreamAcknowledgment, aq as ToolspaceCallReservation, ar as UpdateConnectionInput, as as UpdateImportBatchCountsInput, at as UpdateKnowledgeMemoryInput, au as UpdateQueuedSessionTurnInput, av as UpdateScheduledTaskInput, aw as UpdateSessionMcpServerCredentialsInput, ax as UpdateSessionMcpServerCredentialsResult, ay as UserLookup, az as WakeParentForChildCompletionInput, aA as WakeParentForChildCompletionResult, aB as WorkspaceEnvironmentForRun, aC as accrueWarmSeconds, aD as acquireLease, aE as allAccountPermissions, aF as allWorkspacePermissions, aG as appendSessionEvents, aH as appendSessionEventsAndUpdateSession, aI as appendSessionEventsWithLockedSessionUpdate, aJ as appendSessionHistoryItems, aK as applyContextCompaction, aL as applyCreditDebitUpToBalance, aM as applyCreditLedgerEntry, aN as approveDeviceEnrollmentRequest, aO as bootstrapWorkspace, aP as buildCodexTokenResolver, aQ as buildConnectionTokenResolver, aR as cancelQueuedSessionTurn, aS as claimNextQueuedTurn, aT as clearSessionContext, aU as clearedContextMarkerItem, aV as closePtySession, aW as commitWarmingToWarm, aX as completeFileUpload, aY as confirmDrainCold, aZ as consumeDeviceEnrollmentRequest, a_ as consumeIntegrationOAuthStateNonce, a$ as consumeSessionCompactionRequest, b0 as countActiveApiKeysForWorkspace, b1 as countActiveSessionHistoryItems, b2 as countActiveSessionsForWorkspace, b3 as countActiveSessionsUsingEnvironment, b4 as countConsecutiveReactiveRotations, b5 as countQueuedTurns, b6 as countSandboxLeasesByLiveness, b7 as countScheduledTasksForWorkspace, b8 as countScheduledTasksUsingEnvironment, b9 as countSessionHistoryItems, ba as countTurnSessionHistoryItems, bb as countWorkspaceEnvironments, bc as countWorkspacesForAccount, bd as createApiKey, be as createConnection, bf as createDb, bg as createDeviceEnrollmentRequest, bh as createEnrollment, bi as createFileUpload, bj as createImportBatch, bk as createKnowledgeMemory, bl as createSandbox, bm as createScheduledTask, bn as createScheduledTaskRun, bo as createSession, bp as createSessionGoal, bq as createSessionMcpServers, br as createSessionWithIdempotencyKey, bs as createSocialConnection, bt as createSocialPost, bu as createTurn, bv as createWorkspace, bw as createWorkspaceEnvironment, bx as decryptEnvironmentValue, by as decryptedCapabilityHeaders, bz as deleteRecording, bA as deleteScheduledTask, bB as deleteWorkspace, bC as deleteWorkspaceEnvironment, bD as deleteWorkspaceEnvironmentVariable, bE as deleteWorkspacePack, bF as denyDeviceEnrollmentRequest, bG as disableCapabilityInstallation, bH as disconnectAllCodexAccounts, bI as disconnectCodexAccount, bJ as enableCapabilityInstallation, bK as enablePackInstallation, bL as encryptEnvironmentValue, bM as enqueueSessionTurn, bN as ensureCodexRotationSettings, bO as ensureManagedAccessForUser, bP as evaluateGoalContinuation, bQ as failWarmingToCold, bR as fetchCodexUsageForAccount, bS as finalizeEnrollmentByToken, bT as findActiveApiKeyByHash, bU as finishTurn, bV as forceDrainOverLimitViewerOnlyBoxes, bW as getActiveSessionHistoryItems, bX as getAnySessionInGroup, bY as getBillingBalance, bZ as getBillingCustomer, b_ as getCapabilityCatalogItem, b$ as getCapabilityInstallation, c0 as getCodexCredentialStatus, c1 as getCodexRotationSettings, c2 as getConnectionMetadata, c3 as getDeviceEnrollmentRequestByDeviceCode, c4 as getEnrollment, c5 as getFile, c6 as getFileUpload, c7 as getKnowledgeMemory, c8 as getLatestRunState, c9 as getManagedAccount, ca as getManagedUserByEmail, cb as getOpenPtySession, cc as getPackInstallation, cd as getPendingDeviceEnrollmentRequestByUserCode, ce as getPendingDeviceEnrollmentRequestByUserCodeGlobal, cf as getRecording, cg as getSandbox, ch as getSandboxSessionEnvelope, ci as getScheduledTask, cj as getSession, ck as getSessionByCreateIdempotencyKey, cl as getSessionCodexState, cm as getSessionEvent, cn as getSessionGoal, co as getSessionHistoryItems, cp as getSessionTurn, cq as getSocialConnection, cr as getStoredCapabilityHeaderCiphertext, cs as getStreamAcknowledgment, ct as getWorkspace, cu as getWorkspaceEnvironment, cv as getWorkspaceEnvironmentByName, cw as getWorkspaceEnvironmentValuesForRun, cx as getWorkspaceGrant, cy as getWorkspacePack, cz as grantWorkspaceAccess, cA as hasCreditLedgerEntry, cB as heartbeatLeaseHolder, cC as incrementTurnWorkerDeathRedispatches, cD as ingestMachineMetricsSample, cE as insertMachineMetricsSeries, cF as insertPtySession, cG as insertRecording, cH as isCodexBilledTurn, cI as isPrivateAddress, cJ as isStripeWebhookProcessed, cK as listApiKeys, cL as listCapabilityCatalogItems, cM as listCapabilityInstallations, cN as listCodexAccountStatuses, cO as listConnectionsMetadata, cP as listCreditBalancesByAccount, cQ as listDistinctEnvironmentIdsInGroup, cR as listEnabledMcpCapabilityServers, cS as listEnrollments, cT as listGitHubInstallationIdsForWorkspace, cU as listGitHubInstallationsForWorkspace, cV as listKnowledgeMemories, cW as listLiveModalSandboxLeaseAttributions, cX as listMeterableWarmLeases, cY as listOpenPtySessions, cZ as listPackInstallations, c_ as listRecordings, c$ as listRegistryCatalogSurfaceKeys, d0 as listSandboxes, d1 as listScheduledTaskRuns, d2 as listScheduledTasks, d3 as listSessionEvents, d4 as listSessionIdsInGroup, d5 as listSessionMcpServerMetadata, d6 as listSessionMcpServersForRun, d7 as listSessionTurns, d8 as listSessions, d9 as listSocialConnections, da as listSocialPosts, db as listUsageEvents, dc as listWorkspaceEnvironments, dd as listWorkspaceMembers, de as listWorkspacePacks, df as listWorkspacesForSubject, dg as loadCodexCredentialForRun, dh as loadConnectionCredentialForBroker, di as loadIntegrationOAuthClient, dj as loadWorkspaceEnvironmentForRun, dk as markFileUploadFailed, dl as markStaleRegistryCatalogItems, dm as markStripeWebhookProcessed, dn as mcpServerIdForCapability, dp as nextSessionHistoryPosition, dq as orphanedResultRowIndicesForRepair, dr as persistDrainSnapshot, provisionRoles, ds as reArmDrainingLease, dt as readActiveSandbox, du as readLease, dv as readMachineMetricsLatest, dw as readMachineMetricsLatestForWorkspace, dx as readMachineMetricsSeries, dy as reapStaleLeaseHolders, dz as reapStaleLeaseHoldersGlobal, dA as recordAuditEvent, dB as recordCodexAccountConnectors, dC as recordCodexAccountUsage, dD as recordCodexTokenRefresh, dE as recordConnectionTokenRefresh, dF as recordConnectionUsed, dG as recordLeaseDataPlaneUrl, dH as recordLeaseTerminalDataPlaneUrl, dI as recordSessionActiveCodexCredential, dJ as recordStreamAcknowledgment, dK as recordStripeWebhookEvent, dL as recordUsageEvent, dM as recordWarmingSandboxCreated, dN as refreshOAuthConnectionCredential, dO as registerDbBinding, dP as registerWorkspacePack, dQ as releaseLeaseHolder, dR as removeWorkspaceMember, dS as renameCodexAccount, dT as reorderQueuedSessionTurns, dU as requestSessionCompaction, dV as requeuePreemptedTurn, dW as requireFile, dX as requireScheduledTask, dY as requireSession, dZ as requireSocialConnection, d_ as requireWorkspace, d$ as reserveToolspaceCallForTurn, e0 as revokeApiKey, e1 as revokeConnection, e2 as revokeEnrollment, e3 as revokeViewer, e4 as rlsContextForWorkspace, e5 as rlsStrategyFor, e6 as sanitizeEventPayload, e7 as sanitizeEventString, e8 as saveRunState, e9 as sessionSubject, ea as setActiveCodexCredential, eb as setActiveSandbox, ec as setCodexCredentialExhausted, ed as setCodexCredentialStatus, ee as setConnectionStatus, ef as setEnrollmentDisplayState, eg as setRlsContext, eh as setSessionCodexPin, ei as setSessionGoalLastContinuationTurn, ej as setSessionGoalStatus, ek as setSessionLastInputTokens, el as setSessionStatus, em as setTemporalWorkflowId, en as setWorkspaceEnvironmentVariable, eo as storeIntegrationOAuthClient, ep as sumUsageQuantity, eq as touchEnrollmentLastSeen, er as updateCodexRotationSettings, es as updateConnection, et as updateImportBatchCounts, eu as updateKnowledgeMemory, ev as updatePackInstallationStatus, ew as updatePtySessionActivity, ex as updateQueuedSessionTurn, ey as updateRecording, ez as updateScheduledTask, eA as updateScheduledTaskRun, eB as updateSessionGoal, eC as updateSessionMcpServerCredentials, eD as updateSessionTitle, eE as updateWorkspace, eF as updateWorkspaceEnvironment, eG as upsertBillingCustomer, eH as upsertCapabilityCatalogItem, eI as upsertCodexSubscriptionCredential, eJ as upsertGitHubInstallation, eK as upsertMachineMetricsLatest, eL as upsertRegistryCapabilityCatalogItem, eM as upsertSandboxSessionEnvelope, eN as upsertSessionGoal, eO as wakeParentSessionForChildCompletion, eP as withAccountRls, eQ as withRlsContext, eR as withWorkspaceRls, eS as withWorkspaceUsageLock, eT as workspaceCodexSubscriptionActive } from './provision-roles.js';
 export { migrate, runMigrations } from './migrate.js';