@opengeni/db 0.7.2 → 0.9.3

package/dist/{chunk-YFQ7SGE4.js → chunk-BMFDXFPA.js}

@@ -8,6 +8,11 @@ async function provisionRoles(adminConnection, options = {}) {
     options.appRole ?? (process.env.OPENGENI_APP_DATABASE_USER?.trim() || "opengeni_app")
   );
   const appPassword = options.appPassword ?? process.env.OPENGENI_APP_DATABASE_PASSWORD;
+  const hostExportRole = validateIdentifier(
+    "hostExportRole",
+    options.hostExportRole ?? (process.env.OPENGENI_HOST_EXPORT_DATABASE_USER?.trim() || "opengeni_host_exporter")
+  );
+  const hostExportPassword = options.hostExportPassword ?? process.env.OPENGENI_HOST_EXPORT_DATABASE_PASSWORD;
   const temporalRole = validateIdentifier(
     "temporalRole",
     options.temporalRole ?? (process.env.OPENGENI_TEMPORAL_DATABASE_USER?.trim() || "opengeni_temporal")
@@ -33,11 +38,16 @@ async function provisionRoles(adminConnection, options = {}) {
         await grantTemporalRoleInDatabase(adminConnection, database, temporalRole);
       }
     }
+    if (hostExportPassword) {
+      await ensureLoginRole(sql, hostExportRole, hostExportPassword);
+      await grantHostExportRoleIfSchemaExists(sql, hostExportRole);
+    }
     if (rlsStrategy === "force") {
       await grantAppRoleIfSchemaExists(sql, appRole, schema);
     }
     return {
       appRole: provisionedAppRole,
+      hostExportRole: hostExportPassword ? hostExportRole : null,
       temporalRole: temporalPassword ? temporalRole : null,
       temporalDatabases: temporalPassword ? temporalDatabases : [],
       schema,
@@ -47,6 +57,18 @@ async function provisionRoles(adminConnection, options = {}) {
     await sql.end();
   }
 }
+async function grantHostExportRoleIfSchemaExists(sql, role) {
+  await sql.unsafe(`
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'opengeni_host_export') THEN
+    EXECUTE format('GRANT USAGE ON SCHEMA opengeni_host_export TO %I', ${literal(role)});
+    EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA opengeni_host_export TO %I', ${literal(role)});
+    EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA opengeni_host_export GRANT EXECUTE ON FUNCTIONS TO %I', ${literal(role)});
+  END IF;
+END $$;
+`);
+}
 async function ensureLoginRole(sql, role, password) {
   await sql.unsafe(`
 DO $$
@@ -130,4 +152,4 @@ if (import.meta.main) {
 export {
   provisionRoles
 };
-//# sourceMappingURL=chunk-YFQ7SGE4.js.map
+//# sourceMappingURL=chunk-BMFDXFPA.js.map

package/dist/chunk-BMFDXFPA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/provision-roles.ts"],"sourcesContent":["import postgres from \"postgres\";\nimport type { RlsStrategy } from \"./index\";\n\nexport type ProvisionResult = {\n  appRole: string | null;\n  hostExportRole: string | null;\n  temporalRole: string | null;\n  temporalDatabases: string[];\n  schema: string;\n  rlsStrategy: RlsStrategy;\n};\n\nexport type ProvisionRolesOptions = {\n  /**\n   * The schema OpenGeni's tables live in. The app-role GRANTs target this\n   * schema + `opengeni_private`. Defaults to `public` (standalone).\n   */\n  targetSchema?: string;\n  /**\n   * RLS posture (Step I). `\"force\"` (default) provisions the non-owner\n   * `opengeni_app` login role and GRANTs it table DML in the target schema —\n   * the role OpenGeni connects as under FORCE-RLS. `\"scoped\"` SKIPS the app-role\n   * provisioning entirely: the embedded host runs OpenGeni's queries over a role\n   * IT owns/manages (typically the schema owner), so OpenGeni neither creates\n   * nor grants the `opengeni_app` role. Temporal-role provisioning is unaffected\n   * by strategy.\n   */\n  rlsStrategy?: RlsStrategy;\n  appRole?: string;\n  appPassword?: string;\n  /**\n   * Optional cross-workspace projection role. It receives schema USAGE and\n   * EXECUTE only on the host-export API; it receives no table privileges.\n   * Provision it after the first migration run so the schema exists. The\n   * provisioner also registers same-owner default privileges for future\n   * host-export functions; shipped migrations preserve existing exporter ACLs\n   * when a migration-only upgrade adds a function.\n   */\n  hostExportRole?: string;\n  hostExportPassword?: string;\n  temporalRole?: string;\n  temporalPassword?: string;\n  temporalDatabases?: string[];\n};\n\n/**\n * SDK entry point (Step I): provision the OpenGeni database roles + grants over\n * a host-supplied admin connection. This is the named, parameterized form of the\n * historical env-driven `provision-roles` script (which still works as a CLI via\n * the `import.meta.main` block at the bottom — it just reads env into these\n * options).\n *\n * STANDALONE (default): `provisionRoles(adminConnection)` with no options →\n * `targetSchema: \"public\"`, `rlsStrategy: \"force\"`, reads `opengeni_app` creds\n * from env. Byte-for-byte the historical script behavior.\n *\n * EMBEDDED: `provisionRoles(adminConnection, { targetSchema, rlsStrategy })` lets\n * a host provision the app role over a dedicated schema (force) OR skip the\n * app role entirely and own the connection role itself (scoped).\n */\nexport async function provisionRoles(\n  adminConnection: string,\n  options: ProvisionRolesOptions = {},\n): Promise<ProvisionResult> {\n  const schema = validateIdentifier(\"targetSchema\", options.targetSchema ?? \"public\");\n  const rlsStrategy: RlsStrategy = options.rlsStrategy ?? \"force\";\n\n  const appRole = validateIdentifier(\n    \"appRole\",\n    options.appRole ?? (process.env.OPENGENI_APP_DATABASE_USER?.trim() || \"opengeni_app\"),\n  );\n  const appPassword = options.appPassword ?? process.env.OPENGENI_APP_DATABASE_PASSWORD;\n  const hostExportRole = validateIdentifier(\n    \"hostExportRole\",\n    options.hostExportRole ??\n      (process.env.OPENGENI_HOST_EXPORT_DATABASE_USER?.trim() || \"opengeni_host_exporter\"),\n  );\n  const hostExportPassword =\n    options.hostExportPassword ?? process.env.OPENGENI_HOST_EXPORT_DATABASE_PASSWORD;\n  const temporalRole = validateIdentifier(\n    \"temporalRole\",\n    options.temporalRole ??\n      (process.env.OPENGENI_TEMPORAL_DATABASE_USER?.trim() || \"opengeni_temporal\"),\n  );\n  const temporalPassword =\n    options.temporalPassword ?? process.env.OPENGENI_TEMPORAL_DATABASE_PASSWORD;\n  const temporalDatabases = (\n    options.temporalDatabases ??\n    commaSeparated(process.env.OPENGENI_TEMPORAL_DATABASES ?? \"temporal,temporal_visibility\")\n  ).map((name) => validateIdentifier(\"temporalDatabases\", name));\n\n  const sql = postgres(adminConnection, { max: 1 });\n  try {\n    // FORCE strategy provisions the non-owner app role OpenGeni connects as.\n    // SCOPED strategy: the host owns the connection role; OpenGeni provisions no\n    // app role (skipped here), only the optional Temporal role.\n    let provisionedAppRole: string | null = null;\n    if (rlsStrategy === \"force\") {\n      if (!appPassword) {\n        throw new Error(\n          \"OPENGENI_APP_DATABASE_PASSWORD (or appPassword) is required for rlsStrategy 'force'\",\n        );\n      }\n      await ensureLoginRole(sql, appRole, appPassword);\n      provisionedAppRole = appRole;\n    }\n\n    if (temporalPassword) {\n      await ensureLoginRole(sql, temporalRole, temporalPassword);\n      for (const database of temporalDatabases) {\n        await ensureDatabase(sql, database, temporalRole);\n        await grantTemporalRoleInDatabase(adminConnection, database, temporalRole);\n      }\n    }\n\n    if (hostExportPassword) {\n      await ensureLoginRole(sql, hostExportRole, hostExportPassword);\n      await grantHostExportRoleIfSchemaExists(sql, hostExportRole);\n    }\n\n    if (rlsStrategy === \"force\") {\n      await grantAppRoleIfSchemaExists(sql, appRole, schema);\n    }\n\n    return {\n      appRole: provisionedAppRole,\n      hostExportRole: hostExportPassword ? hostExportRole : null,\n      temporalRole: temporalPassword ? temporalRole : null,\n      temporalDatabases: temporalPassword ? temporalDatabases : [],\n      schema,\n      rlsStrategy,\n    };\n  } finally {\n    await sql.end();\n  }\n}\n\n/**\n * The exporter is intentionally separate from `opengeni_app`: its functions\n * project every workspace into a host-owned sink and therefore cannot be made\n * available to the tenant-scoped application role.\n */\nasync function grantHostExportRoleIfSchemaExists(sql: postgres.Sql, role: string): Promise<void> {\n  await sql.unsafe(`\nDO $$\nBEGIN\n  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'opengeni_host_export') THEN\n    EXECUTE format('GRANT USAGE ON SCHEMA opengeni_host_export TO %I', ${literal(role)});\n    EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA opengeni_host_export TO %I', ${literal(role)});\n    EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA opengeni_host_export GRANT EXECUTE ON FUNCTIONS TO %I', ${literal(role)});\n  END IF;\nEND $$;\n`);\n}\n\nasync function ensureLoginRole(sql: postgres.Sql, role: string, password: string): Promise<void> {\n  await sql.unsafe(`\nDO $$\nBEGIN\n  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${literal(role)}) THEN\n    EXECUTE format('CREATE ROLE %I LOGIN PASSWORD %L', ${literal(role)}, ${literal(password)});\n  ELSE\n    EXECUTE format('ALTER ROLE %I LOGIN PASSWORD %L', ${literal(role)}, ${literal(password)});\n  END IF;\nEND $$;\n`);\n}\n\nasync function ensureDatabase(sql: postgres.Sql, database: string, owner: string): Promise<void> {\n  const existing = await sql<{ exists: boolean }[]>`\n    select exists(select 1 from pg_database where datname = ${database}) as exists\n  `;\n  if (!existing[0]?.exists) {\n    await sql.unsafe(`CREATE DATABASE ${identifier(database)} OWNER ${identifier(owner)}`);\n  }\n  await sql.unsafe(\n    `GRANT ALL PRIVILEGES ON DATABASE ${identifier(database)} TO ${identifier(owner)}`,\n  );\n}\n\nasync function grantTemporalRoleInDatabase(\n  adminConnection: string,\n  database: string,\n  role: string,\n): Promise<void> {\n  const databaseUrl = databaseUrlFor(adminConnection, database);\n  const databaseSql = postgres(databaseUrl, { max: 1 });\n  try {\n    await databaseSql.unsafe(`GRANT USAGE, CREATE ON SCHEMA public TO ${identifier(role)}`);\n  } finally {\n    await databaseSql.end();\n  }\n}\n\n/**\n * Grant the app role table DML in the OpenGeni data schema + EXECUTE on the\n * `opengeni_private` helper functions. Schema-parameterized (Step I): standalone\n * passes `public`; embedded passes the dedicated schema. The grants are guarded\n * on schema existence so provisioning before migrate is a safe no-op.\n */\nasync function grantAppRoleIfSchemaExists(\n  sql: postgres.Sql,\n  role: string,\n  schema: string,\n): Promise<void> {\n  await sql.unsafe(`\nDO $$\nBEGIN\n  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = ${literal(schema)}) THEN\n    EXECUTE format('GRANT USAGE ON SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});\n    EXECUTE format('GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});\n  END IF;\n  IF EXISTS (SELECT 1 FROM pg_namespace WHERE nspname = 'opengeni_private') THEN\n    EXECUTE format('GRANT USAGE ON SCHEMA opengeni_private TO %I', ${literal(role)});\n    EXECUTE format('GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA opengeni_private TO %I', ${literal(role)});\n  END IF;\nEND $$;\n`);\n}\n\nfunction commaSeparated(value: string): string[] {\n  return value\n    .split(\",\")\n    .map((item) => item.trim())\n    .filter(Boolean);\n}\n\nfunction validateIdentifier(name: string, value: string): string {\n  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {\n    throw new Error(`${name} contains an invalid Postgres identifier: ${value}`);\n  }\n  return value;\n}\n\nfunction identifier(value: string): string {\n  return `\"${value.replace(/\"/g, '\"\"')}\"`;\n}\n\nfunction literal(value: string): string {\n  return `'${value.replace(/'/g, \"''\")}'`;\n}\n\nfunction databaseUrlFor(value: string, database: string): string {\n  const url = new URL(value);\n  url.pathname = `/${database}`;\n  return url.toString();\n}\n\n// CLI form (unchanged behavior): read env into the SDK options and run. This is\n// what `bun src/provision-roles.ts` / the `provision-roles` package script\n// invokes — standalone byte-for-byte the historical script (public schema,\n// force strategy, env-driven creds).\nif (import.meta.main) {\n  const adminUrl =\n    process.env.OPENGENI_MIGRATIONS_DATABASE_URL ??\n    process.env.OPENGENI_DATABASE_ADMIN_URL ??\n    process.env.OPENGENI_DATABASE_URL;\n  if (!adminUrl) {\n    throw new Error(\n      \"OPENGENI_MIGRATIONS_DATABASE_URL, OPENGENI_DATABASE_ADMIN_URL, or OPENGENI_DATABASE_URL is required\",\n    );\n  }\n  const result = await provisionRoles(adminUrl, {\n    ...(process.env.OPENGENI_DB_SCHEMA?.trim()\n      ? { targetSchema: process.env.OPENGENI_DB_SCHEMA.trim() }\n      : {}),\n  });\n  console.log(JSON.stringify(result, null, 2));\n}\n"],"mappings":";AAAA,OAAO,cAAc;AA4DrB,eAAsB,eACpB,iBACA,UAAiC,CAAC,GACR;AAC1B,QAAM,SAAS,mBAAmB,gBAAgB,QAAQ,gBAAgB,QAAQ;AAClF,QAAM,cAA2B,QAAQ,eAAe;AAExD,QAAM,UAAU;AAAA,IACd;AAAA,IACA,QAAQ,YAAY,QAAQ,IAAI,4BAA4B,KAAK,KAAK;AAAA,EACxE;AACA,QAAM,cAAc,QAAQ,eAAe,QAAQ,IAAI;AACvD,QAAM,iBAAiB;AAAA,IACrB;AAAA,IACA,QAAQ,mBACL,QAAQ,IAAI,oCAAoC,KAAK,KAAK;AAAA,EAC/D;AACA,QAAM,qBACJ,QAAQ,sBAAsB,QAAQ,IAAI;AAC5C,QAAM,eAAe;AAAA,IACnB;AAAA,IACA,QAAQ,iBACL,QAAQ,IAAI,iCAAiC,KAAK,KAAK;AAAA,EAC5D;AACA,QAAM,mBACJ,QAAQ,oBAAoB,QAAQ,IAAI;AAC1C,QAAM,qBACJ,QAAQ,qBACR,eAAe,QAAQ,IAAI,+BAA+B,8BAA8B,GACxF,IAAI,CAAC,SAAS,mBAAmB,qBAAqB,IAAI,CAAC;AAE7D,QAAM,MAAM,SAAS,iBAAiB,EAAE,KAAK,EAAE,CAAC;AAChD,MAAI;AAIF,QAAI,qBAAoC;AACxC,QAAI,gBAAgB,SAAS;AAC3B,UAAI,CAAC,aAAa;AAChB,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,YAAM,gBAAgB,KAAK,SAAS,WAAW;AAC/C,2BAAqB;AAAA,IACvB;AAEA,QAAI,kBAAkB;AACpB,YAAM,gBAAgB,KAAK,cAAc,gBAAgB;AACzD,iBAAW,YAAY,mBAAmB;AACxC,cAAM,eAAe,KAAK,UAAU,YAAY;AAChD,cAAM,4BAA4B,iBAAiB,UAAU,YAAY;AAAA,MAC3E;AAAA,IACF;AAEA,QAAI,oBAAoB;AACtB,YAAM,gBAAgB,KAAK,gBAAgB,kBAAkB;AAC7D,YAAM,kCAAkC,KAAK,cAAc;AAAA,IAC7D;AAEA,QAAI,gBAAgB,SAAS;AAC3B,YAAM,2BAA2B,KAAK,SAAS,MAAM;AAAA,IACvD;AAEA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,gBAAgB,qBAAqB,iBAAiB;AAAA,MACtD,cAAc,mBAAmB,eAAe;AAAA,MAChD,mBAAmB,mBAAmB,oBAAoB,CAAC;AAAA,MAC3D;AAAA,MACA;AAAA,IACF;AAAA,EACF,UAAE;AACA,UAAM,IAAI,IAAI;AAAA,EAChB;AACF;AAOA,eAAe,kCAAkC,KAAmB,MAA6B;AAC/F,QAAM,IAAI,OAAO;AAAA;AAAA;AAAA;AAAA,yEAIsD,QAAQ,IAAI,CAAC;AAAA,4FACM,QAAQ,IAAI,CAAC;AAAA,iHACQ,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,CAG7H;AACD;AAEA,eAAe,gBAAgB,KAAmB,MAAc,UAAiC;AAC/F,QAAM,IAAI,OAAO;AAAA;AAAA;AAAA,0DAGuC,QAAQ,IAAI,CAAC;AAAA,yDACd,QAAQ,IAAI,CAAC,KAAK,QAAQ,QAAQ,CAAC;AAAA;AAAA,wDAEpC,QAAQ,IAAI,CAAC,KAAK,QAAQ,QAAQ,CAAC;AAAA;AAAA;AAAA,CAG1F;AACD;AAEA,eAAe,eAAe,KAAmB,UAAkB,OAA8B;AAC/F,QAAM,WAAW,MAAM;AAAA,8DACqC,QAAQ;AAAA;AAEpE,MAAI,CAAC,SAAS,CAAC,GAAG,QAAQ;AACxB,UAAM,IAAI,OAAO,mBAAmB,WAAW,QAAQ,CAAC,UAAU,WAAW,KAAK,CAAC,EAAE;AAAA,EACvF;AACA,QAAM,IAAI;AAAA,IACR,oCAAoC,WAAW,QAAQ,CAAC,OAAO,WAAW,KAAK,CAAC;AAAA,EAClF;AACF;AAEA,eAAe,4BACb,iBACA,UACA,MACe;AACf,QAAM,cAAc,eAAe,iBAAiB,QAAQ;AAC5D,QAAM,cAAc,SAAS,aAAa,EAAE,KAAK,EAAE,CAAC;AACpD,MAAI;AACF,UAAM,YAAY,OAAO,2CAA2C,WAAW,IAAI,CAAC,EAAE;AAAA,EACxF,UAAE;AACA,UAAM,YAAY,IAAI;AAAA,EACxB;AACF;AAQA,eAAe,2BACb,KACA,MACA,QACe;AACf,QAAM,IAAI,OAAO;AAAA;AAAA;AAAA,0DAGuC,QAAQ,MAAM,CAAC;AAAA,uDAClB,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA,8FACM,QAAQ,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,qEAG1D,QAAQ,IAAI,CAAC;AAAA,wFACM,QAAQ,IAAI,CAAC;AAAA;AAAA;AAAA,CAGpG;AACD;AAEA,SAAS,eAAe,OAAyB;AAC/C,SAAO,MACJ,MAAM,GAAG,EACT,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EACzB,OAAO,OAAO;AACnB;AAEA,SAAS,mBAAmB,MAAc,OAAuB;AAC/D,MAAI,CAAC,2BAA2B,KAAK,KAAK,GAAG;AAC3C,UAAM,IAAI,MAAM,GAAG,IAAI,6CAA6C,KAAK,EAAE;AAAA,EAC7E;AACA,SAAO;AACT;AAEA,SAAS,WAAW,OAAuB;AACzC,SAAO,IAAI,MAAM,QAAQ,MAAM,IAAI,CAAC;AACtC;AAEA,SAAS,QAAQ,OAAuB;AACtC,SAAO,IAAI,MAAM,QAAQ,MAAM,IAAI,CAAC;AACtC;AAEA,SAAS,eAAe,OAAe,UAA0B;AAC/D,QAAM,MAAM,IAAI,IAAI,KAAK;AACzB,MAAI,WAAW,IAAI,QAAQ;AAC3B,SAAO,IAAI,SAAS;AACtB;AAMA,IAAI,YAAY,MAAM;AACpB,QAAM,WACJ,QAAQ,IAAI,oCACZ,QAAQ,IAAI,+BACZ,QAAQ,IAAI;AACd,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,MAAM,eAAe,UAAU;AAAA,IAC5C,GAAI,QAAQ,IAAI,oBAAoB,KAAK,IACrC,EAAE,cAAc,QAAQ,IAAI,mBAAmB,KAAK,EAAE,IACtD,CAAC;AAAA,EACP,CAAC;AACD,UAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC7C;","names":[]}

package/dist/chunk-KW526IJA.js

@@ -0,0 +1,127 @@
+// src/migrate.ts
+import { readdir, readFile } from "fs/promises";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+import postgres from "postgres";
+var DEFAULT_DATABASE_URL = "postgres://opengeni:opengeni@127.0.0.1:5432/opengeni";
+var concurrentIndexDirective = /^-- opengeni:concurrent-index lock-timeout=(\d+(?:ms|s|min))$/;
+var concurrentIndexStatement = /^CREATE\s+(?:UNIQUE\s+)?INDEX\s+CONCURRENTLY\s+(?:(IF\s+NOT\s+EXISTS)\s+)?(?:"((?:[^"]|"")+)"|([A-Za-z_][A-Za-z0-9_]*))\s+ON\b/is;
+var governedLegacyConcurrentIndexMigrations = /* @__PURE__ */ new Set([
+  "0066_session_interruption_attempt_lookup.sql",
+  "0070_session_event_type_sequence_lookup.sql",
+  "0071_session_event_monitoring_tail.sql",
+  "0072_sessions_workspace_created_id_idx.sql",
+  "0073_sessions_workspace_updated_id_idx.sql",
+  "0075_sessions_workspace_activity_revision_idx.sql",
+  "0077_session_attempt_latest_lookup.sql"
+]);
+function assertIdentifier(name, value) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {
+    throw new Error(`${name} is not a valid Postgres identifier: ${value}`);
+  }
+  return value;
+}
+function parseConcurrentIndexMigration(file, sqlText) {
+  const lines = sqlText.replaceAll("\r\n", "\n").split("\n");
+  const firstLine = lines[0]?.trim() ?? "";
+  const deploymentPrefixed = /^-- deployment-mode: (?:rolling|maintenance)$/.test(firstLine);
+  const directiveIndex = deploymentPrefixed ? 1 : 0;
+  const directiveLine = lines[directiveIndex]?.trim() ?? "";
+  const directive = concurrentIndexDirective.exec(directiveLine);
+  if (!directive) {
+    if (directiveLine.startsWith("-- opengeni:")) {
+      throw new Error(`Unsupported OpenGeni migration directive in ${file}`);
+    }
+    return null;
+  }
+  const lockTimeout = directive[1];
+  const statement = lines.slice(directiveIndex + 1).join("\n").trim();
+  const withoutTrailingSemicolon = statement.endsWith(";") ? statement.slice(0, -1).trimEnd() : statement;
+  const parsedStatement = concurrentIndexStatement.exec(withoutTrailingSemicolon);
+  if (!parsedStatement || withoutTrailingSemicolon.includes(";")) {
+    throw new Error(
+      `${file}: opengeni:concurrent-index requires exactly one CREATE [UNIQUE] INDEX CONCURRENTLY IF NOT EXISTS statement with an unqualified index name`
+    );
+  }
+  const idempotentInSql = parsedStatement[1] !== void 0;
+  if (!idempotentInSql && !governedLegacyConcurrentIndexMigrations.has(file)) {
+    throw new Error(
+      `${file}: opengeni:concurrent-index requires IF NOT EXISTS; bare statements are supported only for governed historical migrations`
+    );
+  }
+  return {
+    indexName: (parsedStatement[2] ?? parsedStatement[3]).replaceAll('""', '"'),
+    lockTimeout,
+    skipWhenValid: !idempotentInSql,
+    statement
+  };
+}
+async function executeMigrationFile(sql, file, sqlText) {
+  const concurrentIndex = parseConcurrentIndexMigration(file, sqlText);
+  if (!concurrentIndex) {
+    await sql.unsafe(sqlText);
+    return;
+  }
+  await sql`select set_config('lock_timeout', ${concurrentIndex.lockTimeout}, false)`;
+  try {
+    const [existing] = await sql`
+      select i.indisvalid as valid, i.indisready as ready
+      from pg_catalog.pg_class c
+      join pg_catalog.pg_namespace n on n.oid = c.relnamespace
+      join pg_catalog.pg_index i on i.indexrelid = c.oid
+      where n.nspname = current_schema() and c.relname = ${concurrentIndex.indexName}
+    `;
+    if (existing && (!existing.valid || !existing.ready)) {
+      const quotedIndexName = `"${concurrentIndex.indexName.replaceAll('"', '""')}"`;
+      await sql.unsafe(`DROP INDEX CONCURRENTLY ${quotedIndexName}`);
+    } else if (existing && concurrentIndex.skipWhenValid) {
+      return;
+    }
+    await sql.unsafe(concurrentIndex.statement);
+  } finally {
+    await sql`select set_config('lock_timeout', '0', false)`;
+  }
+}
+async function migrate(databaseUrl = process.env.OPENGENI_MIGRATIONS_DATABASE_URL ?? process.env.OPENGENI_DATABASE_URL ?? DEFAULT_DATABASE_URL, schema = process.env.OPENGENI_DB_SCHEMA?.trim() || void 0) {
+  const migrationsDir = join(dirname(fileURLToPath(import.meta.url)), "../drizzle");
+  const files = (await readdir(migrationsDir)).filter((file) => file.endsWith(".sql")).sort();
+  const sql = postgres(databaseUrl, { max: 1 });
+  try {
+    await sql`SELECT pg_advisory_lock(727458)`;
+    if (schema) {
+      assertIdentifier("OPENGENI_DB_SCHEMA", schema);
+      await sql.unsafe(`CREATE SCHEMA IF NOT EXISTS "${schema}"`);
+      await sql.unsafe(`CREATE SCHEMA IF NOT EXISTS "opengeni_private"`);
+      await sql.unsafe(`SET search_path = "${schema}", "opengeni_private", "public"`);
+    }
+    await sql.unsafe(
+      `CREATE TABLE IF NOT EXISTS "schema_migrations" ("name" text PRIMARY KEY, "applied_at" timestamptz NOT NULL DEFAULT now())`
+    );
+    const appliedRows = await sql`SELECT "name" FROM "schema_migrations"`;
+    const applied = new Set(appliedRows.map((row) => row.name));
+    for (const file of files) {
+      if (applied.has(file)) {
+        continue;
+      }
+      const sqlText = await readFile(join(migrationsDir, file), "utf8");
+      await executeMigrationFile(sql, file, sqlText);
+      await sql`INSERT INTO "schema_migrations" ("name") VALUES (${file}) ON CONFLICT DO NOTHING`;
+    }
+  } finally {
+    await sql.end();
+  }
+}
+async function runMigrations(adminConnection, targetSchema) {
+  await migrate(adminConnection, targetSchema);
+}
+if (import.meta.main) {
+  await migrate();
+  console.log("Applied Drizzle SQL migrations.");
+}
+
+export {
+  parseConcurrentIndexMigration,
+  migrate,
+  runMigrations
+};
+//# sourceMappingURL=chunk-KW526IJA.js.map

package/dist/chunk-KW526IJA.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/migrate.ts"],"sourcesContent":["import { readdir, readFile } from \"node:fs/promises\";\nimport { dirname, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport postgres from \"postgres\";\n\nconst DEFAULT_DATABASE_URL = \"postgres://opengeni:opengeni@127.0.0.1:5432/opengeni\";\nconst concurrentIndexDirective = /^-- opengeni:concurrent-index lock-timeout=(\\d+(?:ms|s|min))$/;\nconst concurrentIndexStatement =\n  /^CREATE\\s+(?:UNIQUE\\s+)?INDEX\\s+CONCURRENTLY\\s+(?:(IF\\s+NOT\\s+EXISTS)\\s+)?(?:\"((?:[^\"]|\"\")+)\"|([A-Za-z_][A-Za-z0-9_]*))\\s+ON\\b/is;\nconst governedLegacyConcurrentIndexMigrations = new Set([\n  \"0066_session_interruption_attempt_lookup.sql\",\n  \"0070_session_event_type_sequence_lookup.sql\",\n  \"0071_session_event_monitoring_tail.sql\",\n  \"0072_sessions_workspace_created_id_idx.sql\",\n  \"0073_sessions_workspace_updated_id_idx.sql\",\n  \"0075_sessions_workspace_activity_revision_idx.sql\",\n  \"0077_session_attempt_latest_lookup.sql\",\n]);\n\nexport interface ConcurrentIndexMigration {\n  indexName: string;\n  lockTimeout: string;\n  skipWhenValid: boolean;\n  statement: string;\n}\n\n/** A bare Postgres identifier (schema/role name) safe to interpolate into DDL. */\nfunction assertIdentifier(name: string, value: string): string {\n  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value)) {\n    throw new Error(`${name} is not a valid Postgres identifier: ${value}`);\n  }\n  return value;\n}\n\n/**\n * Most migration files intentionally execute as one implicit transaction.\n * PostgreSQL forbids CREATE INDEX CONCURRENTLY there, so a migration may opt\n * into one narrowly validated transactionless statement with:\n *\n *   -- opengeni:concurrent-index lock-timeout=5s\n *   CREATE [UNIQUE] INDEX CONCURRENTLY IF NOT EXISTS ...;\n *\n * The directive is deliberately not a generic \"no transaction\" escape hatch:\n * only one idempotent concurrent-index statement is accepted, lock acquisition\n * is always bounded, and an invalid artifact left by a failed concurrent build\n * is removed before retry. Seven governed historical migrations predate the\n * IF NOT EXISTS rule; only those exact filenames may use their immutable bare\n * statements, and the runner makes their retries idempotent by skipping an\n * already-valid index. This keeps additive large-table indexes online without\n * rewriting shipped history or making arbitrary partially-applied migration\n * scripts possible.\n */\nexport function parseConcurrentIndexMigration(\n  file: string,\n  sqlText: string,\n): ConcurrentIndexMigration | null {\n  const lines = sqlText.replaceAll(\"\\r\\n\", \"\\n\").split(\"\\n\");\n  const firstLine = lines[0]?.trim() ?? \"\";\n  const deploymentPrefixed = /^-- deployment-mode: (?:rolling|maintenance)$/.test(firstLine);\n  const directiveIndex = deploymentPrefixed ? 1 : 0;\n  const directiveLine = lines[directiveIndex]?.trim() ?? \"\";\n  const directive = concurrentIndexDirective.exec(directiveLine);\n  if (!directive) {\n    if (directiveLine.startsWith(\"-- opengeni:\")) {\n      throw new Error(`Unsupported OpenGeni migration directive in ${file}`);\n    }\n    return null;\n  }\n\n  const lockTimeout = directive[1]!;\n  const statement = lines\n    .slice(directiveIndex + 1)\n    .join(\"\\n\")\n    .trim();\n  const withoutTrailingSemicolon = statement.endsWith(\";\")\n    ? statement.slice(0, -1).trimEnd()\n    : statement;\n  const parsedStatement = concurrentIndexStatement.exec(withoutTrailingSemicolon);\n  if (!parsedStatement || withoutTrailingSemicolon.includes(\";\")) {\n    throw new Error(\n      `${file}: opengeni:concurrent-index requires exactly one CREATE [UNIQUE] INDEX CONCURRENTLY IF NOT EXISTS statement with an unqualified index name`,\n    );\n  }\n  const idempotentInSql = parsedStatement[1] !== undefined;\n  if (!idempotentInSql && !governedLegacyConcurrentIndexMigrations.has(file)) {\n    throw new Error(\n      `${file}: opengeni:concurrent-index requires IF NOT EXISTS; bare statements are supported only for governed historical migrations`,\n    );\n  }\n  return {\n    indexName: (parsedStatement[2] ?? parsedStatement[3]!).replaceAll('\"\"', '\"'),\n    lockTimeout,\n    skipWhenValid: !idempotentInSql,\n    statement,\n  };\n}\n\nasync function executeMigrationFile(\n  sql: postgres.Sql,\n  file: string,\n  sqlText: string,\n): Promise<void> {\n  const concurrentIndex = parseConcurrentIndexMigration(file, sqlText);\n  if (!concurrentIndex) {\n    await sql.unsafe(sqlText);\n    return;\n  }\n\n  await sql`select set_config('lock_timeout', ${concurrentIndex.lockTimeout}, false)`;\n  try {\n    const [existing] = await sql<Array<{ valid: boolean; ready: boolean }>>`\n      select i.indisvalid as valid, i.indisready as ready\n      from pg_catalog.pg_class c\n      join pg_catalog.pg_namespace n on n.oid = c.relnamespace\n      join pg_catalog.pg_index i on i.indexrelid = c.oid\n      where n.nspname = current_schema() and c.relname = ${concurrentIndex.indexName}\n    `;\n    if (existing && (!existing.valid || !existing.ready)) {\n      const quotedIndexName = `\"${concurrentIndex.indexName.replaceAll('\"', '\"\"')}\"`;\n      await sql.unsafe(`DROP INDEX CONCURRENTLY ${quotedIndexName}`);\n    } else if (existing && concurrentIndex.skipWhenValid) {\n      return;\n    }\n    await sql.unsafe(concurrentIndex.statement);\n  } finally {\n    await sql`select set_config('lock_timeout', '0', false)`;\n  }\n}\n\n/**\n * Apply the OpenGeni SQL migration chain.\n *\n * STANDALONE (default, unchanged): `migrate()` / `migrate(databaseUrl)` runs the\n * whole chain with NO search_path manipulation, so every unqualified\n * table/index/policy lands in the server default schema (`public`). This is the\n * byte-for-byte historical behavior — the migration test suite calls\n * `migrate(DB_URL)` and is unaffected.\n *\n * EMBEDDED SCHEMA MODE: pass a `schema` (or set\n * `OPENGENI_DB_SCHEMA`). The migrate session then `CREATE SCHEMA IF NOT EXISTS`\n * for both `<schema>` and `opengeni_private`, and sets\n * `search_path = \"<schema>\", \"opengeni_private\", \"public\"`, so EVERY unqualified\n * DDL statement lands in the dedicated schema with NO per-statement SQL rewrite\n * (the schema-isolation contract). Two things make this work and stay idempotent:\n *   1. The policy-existence guards in the migration SQL use `current_schema()`\n *      (not a hardcoded `'public'`) — so a re-run finds the policy it already\n *      created in `<schema>` and DROP/CREATEs idempotently instead of failing\n *      with \"policy already exists\". (This guard substitution is the migrate-\n *      time enabler for the runtime search_path approach; without it the SDK\n *      entry point silently fails on re-run — the migration replay hazard.)\n *   2. `public` stays LAST on the path so `gen_random_uuid()` (pgcrypto) and the\n *      `vector` type — both installed into `public` by 0000 — still resolve. The\n *      `opengeni_private.*` helpers are always called with an absolute prefix.\n *\n * `OPENGENI_DB_SCHEMA` defaults UNSET → `public` → standalone, so the default\n * binding never regresses.\n */\nexport async function migrate(\n  databaseUrl = process.env.OPENGENI_MIGRATIONS_DATABASE_URL ??\n    process.env.OPENGENI_DATABASE_URL ??\n    DEFAULT_DATABASE_URL,\n  schema: string | undefined = process.env.OPENGENI_DB_SCHEMA?.trim() || undefined,\n): Promise<void> {\n  const migrationsDir = join(dirname(fileURLToPath(import.meta.url)), \"../drizzle\");\n  const files = (await readdir(migrationsDir)).filter((file) => file.endsWith(\".sql\")).sort();\n  const sql = postgres(databaseUrl, { max: 1 });\n  try {\n    // Serialize concurrent migrate() runs; the session-level lock is released\n    // when the connection closes.\n    await sql`SELECT pg_advisory_lock(727458)`;\n    if (schema) {\n      assertIdentifier(\"OPENGENI_DB_SCHEMA\", schema);\n      await sql.unsafe(`CREATE SCHEMA IF NOT EXISTS \"${schema}\"`);\n      // opengeni_private is also created by 0001 with an absolute prefix, but the\n      // session search_path must already resolve it for the policy predicates\n      // and the SECURITY DEFINER functions that inherit the caller's path.\n      await sql.unsafe(`CREATE SCHEMA IF NOT EXISTS \"opengeni_private\"`);\n      await sql.unsafe(`SET search_path = \"${schema}\", \"opengeni_private\", \"public\"`);\n    }\n    await sql.unsafe(\n      `CREATE TABLE IF NOT EXISTS \"schema_migrations\" (\"name\" text PRIMARY KEY, \"applied_at\" timestamptz NOT NULL DEFAULT now())`,\n    );\n    const appliedRows = await sql`SELECT \"name\" FROM \"schema_migrations\"`;\n    const applied = new Set(appliedRows.map((row) => row.name as string));\n    for (const file of files) {\n      if (applied.has(file)) {\n        continue;\n      }\n      const sqlText = await readFile(join(migrationsDir, file), \"utf8\");\n      await executeMigrationFile(sql, file, sqlText);\n      await sql`INSERT INTO \"schema_migrations\" (\"name\") VALUES (${file}) ON CONFLICT DO NOTHING`;\n    }\n  } finally {\n    await sql.end();\n  }\n}\n\n/**\n * SDK entry point (Step I): run the migration chain over a host-supplied admin\n * connection string against an explicit target schema. This is the embedded\n * topology's named entry — a host calls `runMigrations(adminConnection,\n * targetSchema)` from its own provisioning code instead of relying on env vars.\n * `targetSchema` undefined → `public` → standalone behavior. Thin wrapper over\n * `migrate` so there is one migration engine.\n */\nexport async function runMigrations(adminConnection: string, targetSchema?: string): Promise<void> {\n  await migrate(adminConnection, targetSchema);\n}\n\nif (import.meta.main) {\n  await migrate();\n  console.log(\"Applied Drizzle SQL migrations.\");\n}\n"],"mappings":";AAAA,SAAS,SAAS,gBAAgB;AAClC,SAAS,SAAS,YAAY;AAC9B,SAAS,qBAAqB;AAC9B,OAAO,cAAc;AAErB,IAAM,uBAAuB;AAC7B,IAAM,2BAA2B;AACjC,IAAM,2BACJ;AACF,IAAM,0CAA0C,oBAAI,IAAI;AAAA,EACtD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAUD,SAAS,iBAAiB,MAAc,OAAuB;AAC7D,MAAI,CAAC,2BAA2B,KAAK,KAAK,GAAG;AAC3C,UAAM,IAAI,MAAM,GAAG,IAAI,wCAAwC,KAAK,EAAE;AAAA,EACxE;AACA,SAAO;AACT;AAoBO,SAAS,8BACd,MACA,SACiC;AACjC,QAAM,QAAQ,QAAQ,WAAW,QAAQ,IAAI,EAAE,MAAM,IAAI;AACzD,QAAM,YAAY,MAAM,CAAC,GAAG,KAAK,KAAK;AACtC,QAAM,qBAAqB,gDAAgD,KAAK,SAAS;AACzF,QAAM,iBAAiB,qBAAqB,IAAI;AAChD,QAAM,gBAAgB,MAAM,cAAc,GAAG,KAAK,KAAK;AACvD,QAAM,YAAY,yBAAyB,KAAK,aAAa;AAC7D,MAAI,CAAC,WAAW;AACd,QAAI,cAAc,WAAW,cAAc,GAAG;AAC5C,YAAM,IAAI,MAAM,+CAA+C,IAAI,EAAE;AAAA,IACvE;AACA,WAAO;AAAA,EACT;AAEA,QAAM,cAAc,UAAU,CAAC;AAC/B,QAAM,YAAY,MACf,MAAM,iBAAiB,CAAC,EACxB,KAAK,IAAI,EACT,KAAK;AACR,QAAM,2BAA2B,UAAU,SAAS,GAAG,IACnD,UAAU,MAAM,GAAG,EAAE,EAAE,QAAQ,IAC/B;AACJ,QAAM,kBAAkB,yBAAyB,KAAK,wBAAwB;AAC9E,MAAI,CAAC,mBAAmB,yBAAyB,SAAS,GAAG,GAAG;AAC9D,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,QAAM,kBAAkB,gBAAgB,CAAC,MAAM;AAC/C,MAAI,CAAC,mBAAmB,CAAC,wCAAwC,IAAI,IAAI,GAAG;AAC1E,UAAM,IAAI;AAAA,MACR,GAAG,IAAI;AAAA,IACT;AAAA,EACF;AACA,SAAO;AAAA,IACL,YAAY,gBAAgB,CAAC,KAAK,gBAAgB,CAAC,GAAI,WAAW,MAAM,GAAG;AAAA,IAC3E;AAAA,IACA,eAAe,CAAC;AAAA,IAChB;AAAA,EACF;AACF;AAEA,eAAe,qBACb,KACA,MACA,SACe;AACf,QAAM,kBAAkB,8BAA8B,MAAM,OAAO;AACnE,MAAI,CAAC,iBAAiB;AACpB,UAAM,IAAI,OAAO,OAAO;AACxB;AAAA,EACF;AAEA,QAAM,wCAAwC,gBAAgB,WAAW;AACzE,MAAI;AACF,UAAM,CAAC,QAAQ,IAAI,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA,2DAK8B,gBAAgB,SAAS;AAAA;AAEhF,QAAI,aAAa,CAAC,SAAS,SAAS,CAAC,SAAS,QAAQ;AACpD,YAAM,kBAAkB,IAAI,gBAAgB,UAAU,WAAW,KAAK,IAAI,CAAC;AAC3E,YAAM,IAAI,OAAO,2BAA2B,eAAe,EAAE;AAAA,IAC/D,WAAW,YAAY,gBAAgB,eAAe;AACpD;AAAA,IACF;AACA,UAAM,IAAI,OAAO,gBAAgB,SAAS;AAAA,EAC5C,UAAE;AACA,UAAM;AAAA,EACR;AACF;AA8BA,eAAsB,QACpB,cAAc,QAAQ,IAAI,oCACxB,QAAQ,IAAI,yBACZ,sBACF,SAA6B,QAAQ,IAAI,oBAAoB,KAAK,KAAK,QACxD;AACf,QAAM,gBAAgB,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,YAAY;AAChF,QAAM,SAAS,MAAM,QAAQ,aAAa,GAAG,OAAO,CAAC,SAAS,KAAK,SAAS,MAAM,CAAC,EAAE,KAAK;AAC1F,QAAM,MAAM,SAAS,aAAa,EAAE,KAAK,EAAE,CAAC;AAC5C,MAAI;AAGF,UAAM;AACN,QAAI,QAAQ;AACV,uBAAiB,sBAAsB,MAAM;AAC7C,YAAM,IAAI,OAAO,gCAAgC,MAAM,GAAG;AAI1D,YAAM,IAAI,OAAO,gDAAgD;AACjE,YAAM,IAAI,OAAO,sBAAsB,MAAM,iCAAiC;AAAA,IAChF;AACA,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AACA,UAAM,cAAc,MAAM;AAC1B,UAAM,UAAU,IAAI,IAAI,YAAY,IAAI,CAAC,QAAQ,IAAI,IAAc,CAAC;AACpE,eAAW,QAAQ,OAAO;AACxB,UAAI,QAAQ,IAAI,IAAI,GAAG;AACrB;AAAA,MACF;AACA,YAAM,UAAU,MAAM,SAAS,KAAK,eAAe,IAAI,GAAG,MAAM;AAChE,YAAM,qBAAqB,KAAK,MAAM,OAAO;AAC7C,YAAM,uDAAuD,IAAI;AAAA,IACnE;AAAA,EACF,UAAE;AACA,UAAM,IAAI,IAAI;AAAA,EAChB;AACF;AAUA,eAAsB,cAAc,iBAAyB,cAAsC;AACjG,QAAM,QAAQ,iBAAiB,YAAY;AAC7C;AAEA,IAAI,YAAY,MAAM;AACpB,QAAM,QAAQ;AACd,UAAQ,IAAI,iCAAiC;AAC/C;","names":[]}

package/dist/index.d.ts

@@ -1,8 +1,8 @@
 import '@opengeni/contracts';
 import '@opengeni/config';
 export { isCodexBilledModel } from '@opengeni/codex';
-import 'drizzle-orm/pg-core';
-export { A as AGENT_VISIBLE_MEMORY_STATUSES, a as AcceptSessionApprovalDecisionResult, b as AccrueWarmSecondsResult, c as AcquireLeaseInput, d as AcquireLeaseResult, e as ActiveSandboxPointer, f as AddSessionSystemUpdateInput, g as AddSessionSystemUpdateResult, h as AgentCommandAuthorityError, i as AgentInternalUpdateCommandResult, j as AppendEventInput, k as ApplyContextCompactionResult, l as ApplySessionTurnSettlementInput, m as ApplySessionTurnSettlementResult, n as ArmCodexCapacityWaitResult, B as BootstrapWorkspaceInput, C as CODEX_CAPACITY_REFRESH_MAX_MS, o as CODEX_CAPACITY_REFRESH_MIN_MS, p as CODEX_CREDENTIAL_LEASE_TTL_MS, q as CODEX_ROTATION_STRATEGIES, r as ClaimSessionWorkForAttemptInput, s as ClaimSessionWorkForAttemptResult, t as ClearSessionContextResult, u as CodexAccountStatus, v as CodexAccountUsageSnapshot, w as CodexAuthDeps, x as CodexCapacityAvailabilityDecision, y as CodexCapacityMutationResult, z as CodexCapacityResetKind, D as CodexCapacitySelectionContext, E as CodexCapacityWait, F as CodexCapacityWaitStatus, G as CodexCapacityWakeTarget, H as CodexCredentialForRun, I as CodexCredentialLeaseCandidateFilter, J as CodexCredentialLeaseCandidateFilterResult, K as CodexCredentialLeasePolicyScopeResolver, L as CodexCredentialLeaseQuarantine, M as CodexCredentialLeaseResult, N as CodexCredentialLeaseSelection, O as CodexCredentialLeaseSelectionContext, P as CodexCredentialStatus, Q as CodexCredentialTokens, R as CodexLeaseAccountStatus, S as CodexPinSource, T as CodexRotationSettings, U as CodexRotationStrategy, V as ComposerDraftRow, W as ConnectionBrokerDeps, X as ConnectionCredentialForBroker, Y as ConnectionRefreshHttpError, Z as ConsumeOAuthStateNonceInput, _ as CorrectWorkspaceMemoryInput, $ as CorrectWorkspaceMemoryResult, a0 as CreateCapabilityCatalogItemInput, a1 as CreateConnectionInput, a2 as CreateDbOptions, a3 as CreateImportBatchInput, a4 as CreateKnowledgeMemoryInput, a5 as CreatePackInstallationInput, a6 as CreateScheduledTaskInput, a7 as CreateSessionGoalInput, a8 as CreateSessionMcpServerInput, a9 as CreateSocialConnectionInput, aa as CreateSocialPostInput, ab as CreditBalanceByAccount, ac as Database, ad as DbClient, ae as DeviceEnrollmentRequestRecord, af as DeviceEnrollmentStatus, ag as EditQueueCommandResult, ah as EffectiveControlBlocker, ai as EffectiveControlResumeOption, aj as EffectiveControlState, ak as EffectiveSessionControl, al as EnableCapabilityInstallationInput, am as EnabledMcpCapabilityServer, an as EnqueueSessionTurnInput, ao as EnrollmentExposure, ap as EnrollmentOs, aq as EnrollmentRecord, ar as EnrollmentStatus, as as ExpiredFileUploadCleanupClaim, at as FileUploadCleanupClaimResult, au as ForceDrainResult, av as GitHubInstallation, aw as GoalContinuationDecision, ax as ImportBatch, ay as InitializeSessionStartInput, az as InitializeSessionStartResult, aA as IntegrationOAuthClientForUse, aB as LeaseHolderKind, aC as LeaseSnapshot, aD as ListKnowledgeMemoryOptions, aE as ListSessionEventsOptions, aF as ListSessionsForSubjectOptions, aG as ListSessionsOptions, aH as LiveModalSandboxLeaseAttribution, aI as MACHINE_METRICS_SERIES_INTERVAL_MS, aJ as MAX_INTERNAL_UPDATE_BATCH_BYTES, aK as MAX_INTERNAL_UPDATE_BATCH_MEMBERS, aL as MAX_INTERNAL_UPDATE_BYTES, aM as MEMORY_ACTIVE_RECORD_CAP, aN as MEMORY_BLOCK_KIND_ORDER, aO as MEMORY_BLOCK_RECORD_LIMIT, aP as MEMORY_CORRECT_TOOL_DESCRIPTION, aQ as MEMORY_KIND_SECTION_TITLES, aR as MEMORY_NEAR_DUP_COSINE_THRESHOLD, aS as MEMORY_NEAR_DUP_NEIGHBORS, aT as MEMORY_SAVE_TOOL_DESCRIPTION, aU as MEMORY_SEARCH_DEFAULT_LIMIT, aV as MEMORY_SEARCH_MAX_LIMIT, aW as MEMORY_SEARCH_TOOL_DESCRIPTION, aX as MEMORY_TEXT_MAX_CHARS, aY as MEMORY_VISIBLE_RECORD_CAP, aZ as MachineMetricsRow, a_ as MachineMetricsSample, a$ as MarkWarmLeaseInstanceLostResult, b0 as MemoryBlockRecord, b1 as MemoryEmbedder, b2 as MemorySanitizeResult, b3 as MeterableWarmLease, b4 as PendingSessionToolCallInput, ProvisionResult, ProvisionRolesOptions, b5 as QueueCommandConflictCode, b6 as QueueCommandConflictError, b7 as QueueCommandResult, b8 as QueuedTurnRow, b9 as ReapDrainable, ba as ReconcileCodexCapacityWaitResult, bb as RecoverSessionDispatchInput, bc as RecoverSessionDispatchResult, bd as RegisterWorkspacePackInput, be as RegistryCapabilityCatalogItemInput, bf as RegistryCatalogSurfaceKey, bg as ReplaceIntegrationOAuthClientInput, bh as RequestSessionTurnRecoveryInput, bi as RequestSessionTurnRecoveryResult, bj as ResolveConnectionCredentialInput, bk as ResolveConnectionCredentialResult, bl as RigActiveVersionChangedError, bm as RigChangeAlreadyVerifyingError, bn as RigChangeTransitionError, bo as RigVersionContentInput, bp as RlsContext, bq as RlsStrategy, br as SESSION_ANCESTRY_LIMIT, bs as SandboxImageConflictError, bt as SandboxKind, bu as SandboxLeaseLiveness, bv as SandboxLeaseSupersededError, bw as SandboxPtySessionRow, bx as SandboxRecord, by as SandboxRigConflictError, bz as SaveWorkspaceMemoryInput, bA as SaveWorkspaceMemoryResult, bB as SessionAttemptInterruptionSettlement, bC as SessionCodexState, bD as SessionCommandActor, bE as SessionCommandIdempotencyError, bF as SessionCommandReceiptRow, bG as SessionContextBusyError, bH as SessionControlConflictError, bI as SessionControlInvariantError, bJ as SessionControlMutationResult, bK as SessionLineage, bL as SessionListAccessError, bM as SessionListCursor, bN as SessionListCursorError, bO as SessionMcpServerForRun, bP as SessionPinAccessError, bQ as SessionPinVersionConflictError, bR as SessionRecordingCodec, bS as SessionRecordingMode, bT as SessionRecordingRow, bU as SessionRecordingState, bV as SessionSystemUpdateOutboxDelivery, bW as SessionTurnAttemptOutcome, bX as SessionTurnRecordingSettlement, bY as SessionWorkPeek, bZ as SessionWorkTrigger, b_ as SessionWorkflowWake, b$ as SetSessionCodexPinOptions, c0 as SettleCodexCredentialFailoverResult, c1 as SettleCodexCredentialLeaseLossResult, c2 as SteerQueueCommandResult, c3 as StoreIntegrationOAuthClientInput, c4 as StoredIntegrationOAuthClient, c5 as StreamAcknowledgment, c6 as SubmitHumanPromptResult, c7 as ToolspaceCallReservation, c8 as TurnAttemptFenceRejectReason, c9 as UpdateConnectionInput, ca as UpdateImportBatchCountsInput, cb as UpdateKnowledgeMemoryInput, cc as UpdateScheduledTaskInput, cd as UpdateSessionMcpServerCredentialsInput, ce as UpdateSessionMcpServerCredentialsResult, cf as UserLookup, cg as VariableSetForRun, ch as WORKSPACE_MEMORY_BLOCK_EMPTY, ci as WORKSPACE_MEMORY_BLOCK_HEADER_POPULATED, cj as WORKSPACE_MEMORY_BLOCK_TOKEN_BUDGET, ck as WorkspaceCaptureCommitResult, cl as WorkspaceCaptureGcPlan, cm as WorkspaceCaptureGcRow, cn as WorkspaceCaptureRow, co as WorkspaceControlLockMode, cp as WorkspaceControlMutationResult, cq as WorkspaceEnvironmentForRun, cr as WorkspaceMemoryOrigin, cs as WorkspaceMemorySearchInput, ct as WorkspaceMemorySearchMode, cu as WorkspaceMemorySearchResult, cv as WorkspaceModelPolicy, cw as abandonRecordingForTurnAttempt, cx as acceptSessionApprovalDecision, cy as accrueWarmSeconds, cz as acquireCodexCredentialLease, cA as acquireLease, cB as activateRigVersion, cC as addSessionSystemUpdate, cD as addSessionSystemUpdateWithSourceMutation, cE as allAccountPermissions, cF as allWorkspacePermissions, cG as appendSessionEventToSandboxGroup, cH as appendSessionEvents, cI as appendSessionEventsAndUpdateSession, cJ as appendSessionEventsForTurnAttempt, cK as appendSessionEventsWithLockedSessionUpdate, cL as appendSessionHistoryItems, cM as applyContextCompaction, cN as applyCreditDebitUpToBalance, cO as applyCreditLedgerEntry, cP as applySessionTurnSettlement, cQ as approveDeviceEnrollmentRequest, cR as armCodexCapacityWait, cS as assertAgentCommandAuthorityInTransaction, cT as autoResumeSessionBranchInTransaction, cU as beginRigChangeVerificationAttempt, cV as bootstrapWorkspace, cW as buildChildCompletionDigest, cX as buildCodexTokenResolver, cY as buildConnectionTokenResolver, cZ as canonicalSessionCommandHash, c_ as claimExpiredFileUploadCleanup, c$ as claimFileUploadCleanup, d0 as claimPendingSessionSystemUpdateOutbox, d1 as claimPendingSessionWorkflowWakes, d2 as claimSessionWorkForAttempt, d3 as clearDurablePendingSessionToolCalls, d4 as clearEnrollmentWentOffline, d5 as clearSessionContext, d6 as clearSessionGoal, d7 as clearedContextMarkerItem, d8 as closePtySession, d9 as closeSessionTurnAttemptInTransaction, da as codexCapacityRefreshBackoffMs, db as commitWarmingToWarm, dc as completeExpiredFileUploadCleanup, dd as completeFileUpload, de as completeFileUploadCleanup, df as computeWorkspaceCaptureGcPlan, dg as confirmDrainCold, dh as consumeDeviceEnrollmentRequest, di as consumeIntegrationOAuthStateNonce, dj as correctWorkspaceMemory, dk as countActiveApiKeysForWorkspace, dl as countActiveSessionHistoryItems, dm as countActiveSessionsForWorkspace, dn as countActiveSessionsUsingEnvironment, dp as countActiveSessionsUsingVariableSet, dq as countConsecutiveReactiveRotations, dr as countQueuedTurns, ds as countRigs, dt as countSandboxLeasesByLiveness, du as countScheduledTasksForWorkspace, dv as countScheduledTasksUsingEnvironment, dw as countScheduledTasksUsingVariableSet, dx as countSessionHistoryItems, dy as countSessionsUsingRig, dz as countVariableSets, dA as countWorkspaceEnvironments, dB as countWorkspacesForAccount, dC as createApiKey, dD as createConnection, dE as createDb, dF as createDeviceEnrollmentRequest, dG as createEnrollment, dH as createFileUpload, dI as createImportBatch, dJ as createKnowledgeMemory, dK as createRig, dL as createRigChange, dM as createRigVersion, dN as createRigVersionForChangePromotion, dO as createSandbox, dP as createScheduledTask, dQ as createScheduledTaskRun, dR as createSession, dS as createSessionGoal, dT as createSessionMcpServers, dU as createSessionWithIdempotencyKey, dV as createSocialConnection, dW as createSocialPost, dX as createVariableSet, dY as createWorkspace, dZ as createWorkspaceEnvironment, d_ as decodeSessionListCursor, d$ as decryptEnvironmentValue, d$ as decryptVariableSetValue, e0 as decryptedCapabilityHeaders, e1 as deleteRecording, e2 as deleteRig, e3 as deleteRigIfNoActiveSessions, e4 as deleteScheduledTask, e5 as deleteSessionQueueItemInTransaction, e6 as deleteVariableSet, e7 as deleteVariableSetVariable, e8 as deleteWorkspace, e9 as deleteWorkspaceCaptureRows, ea as deleteWorkspaceEnvironment, eb as deleteWorkspaceEnvironmentVariable, ec as deleteWorkspacePack, ed as denyDeviceEnrollmentRequest, ee as disableCapabilityInstallation, ef as disconnectAllCodexAccounts, eg as disconnectCodexAccount, eh as editQueuedTurnInTransaction, ei as enableCapabilityInstallation, ej as enablePackInstallation, ek as encodeSessionListCursor, el as encryptEnvironmentValue, el as encryptVariableSetValue, em as enqueueSessionTurn, en as enqueueSessionWorkflowWake, eo as enqueueSessionWorkflowWakeIfRunnable, ep as enqueueSessionWorkflowWakeInTransaction, eq as ensureCodexRotationSettings, er as ensureManagedAccessForUser, es as estimateMemoryTokens, et as evaluateGoalContinuation, eu as evaluateSessionControl, ev as evaluateSessionControls, ew as failWarmingToCold, ex as fetchCodexUsageForAccount, ey as finalizeEnrollmentByToken, ez as findActiveApiKeyByHash, eA as forceDrainOverLimitViewerOnlyBoxes, eB as getActiveSessionHistoryItems, eC as getAnySessionInGroup, eD as getBillingBalance, eE as getBillingCustomer, eF as getCapabilityCatalogItem, eG as getCapabilityInstallation, eH as getCodexCapacityWaitForSession, eI as getCodexCredentialStatus, eJ as getCodexRotationSettings, eK as getComposerDraftInTransaction, eL as getConnectionMetadata, eM as getDeviceEnrollmentRequestByDeviceCode, eN as getEnrollment, eO as getFile, eP as getFileUpload, eQ as getKnowledgeMemory, eR as getLatestRunState, eS as getLatestStartedSessionTurn, eT as getManagedAccount, eU as getManagedUserByEmail, eV as getMaterializedSandboxFileResources, eW as getOpenPtySession, eX as getOrCreateSessionSystemUpdateOutbox, eY as getPackInstallation, eZ as getPendingDeviceEnrollmentRequestByUserCode, e_ as getPendingDeviceEnrollmentRequestByUserCodeGlobal, e$ as getRecording, f0 as getRig, f1 as getRigByName, f2 as getRigChange, f3 as getRigName, f4 as getRigVersion, f5 as getRigVersionById, f6 as getSandbox, f7 as getSandboxSessionEnvelope, f8 as getScheduledTask, f9 as getSession, fa as getSessionByCreateIdempotencyKey, fb as getSessionCodexState, fc as getSessionEvent, fd as getSessionEventByClientEventId, fe as getSessionForSubject, ff as getSessionGoal, fg as getSessionHistoryItems, fh as getSessionLineage, fi as getSessionQueueSnapshot, fj as getSessionTurn, fk as getSessionTurnForAttempt, fl as getSocialConnection, fm as getStoredCapabilityHeaderCiphertext, fn as getStreamAcknowledgment, fo as getVariableSet, fp as getVariableSetByName, fq as getVariableSetValuesForRun, fr as getWorkspace, fs as getWorkspaceControlEvent, ft as getWorkspaceDefaultRigId, fu as getWorkspaceEnvironment, fv as getWorkspaceEnvironmentByName, fw as getWorkspaceEnvironmentValuesForRun, fx as getWorkspaceGrant, fy as getWorkspaceModelPolicy, fz as getWorkspacePack, fA as grantWorkspaceAccess, fB as hasCreditLedgerEntry, fC as hashMemoryText, fD as heartbeatCodexCredentialLease, fE as heartbeatCodexCredentialLeaseUntil, fF as heartbeatLeaseHolder, fG as ingestMachineMetricsSample, fH as initializeSessionStartAtomically, fI as insertFailedWorkspaceCapture, fJ as insertMachineMetricsSeries, fK as insertPtySession, fL as insertRecording, fM as insertWorkspaceCapture, fN as interruptedToolCallResult, fO as isCodexBilledTurn, fP as isMemoryTextTooLong, fQ as isPrivateAddress, fR as isSessionCompactionRequested, fS as isStripeWebhookProcessed, fT as latestWorkspaceCapture, fU as listApiKeys, fV as listCapabilityCatalogItems, fW as listCapabilityInstallations, fX as listCodexAccountStatuses, fY as listConnectionsMetadata, fZ as listCreditBalancesByAccount, f_ as listDistinctRigVersionIdsInGroup, f$ as listDistinctVariableSetIdsInGroup, g0 as listEnabledMcpCapabilityServers, g1 as listEnrollments, g2 as listGitHubInstallationIdsForWorkspace, g3 as listGitHubInstallationsForWorkspace, g4 as listKnowledgeMemories, g5 as listLiveModalSandboxLeaseAttributions, g6 as listMeterableWarmLeases, g7 as listOpenPtySessions, g8 as listOutstandingSessionSystemUpdates, g9 as listPackInstallations, ga as listPendingCodexCapacityWakeTargets, gb as listPendingSessionTurns, gc as listRecordings, gd as listRegistryCatalogSurfaceKeys, ge as listRigChanges, gf as listRigVersions, gg as listRigs, gh as listSandboxes, gi as listScheduledTaskRuns, gj as listScheduledTasks, gk as listSessionEvents, gl as listSessionIdsInGroup, gm as listSessionMcpServerMetadata, gn as listSessionMcpServersForRun, go as listSessionSystemUpdatesForTurn, gp as listSessionTurns, gq as listSessions, gr as listSessionsForSubject, gs as listSocialConnections, gt as listSocialPosts, gu as listUsageEvents, gv as listVariableSets, gw as listWorkspaceControlEvents, gx as listWorkspaceEnvironments, gy as listWorkspaceMembers, gz as listWorkspacePacks, gA as listWorkspacesForSubject, gB as loadCodexCredentialForRun, gC as loadConnectionCredentialForBroker, gD as loadIntegrationOAuthClient, gE as loadVariableSetForRun, gF as loadWorkspaceEnvironmentForRun, gG as lockWorkspaceInferenceControl, gH as markFileUploadFailed, gI as markSandboxFileResourcesMaterialized, gJ as markScheduledTaskRunFailedIfQueued, gK as markSessionSystemUpdateOutboxDeliveredInTransaction, gL as markSessionSystemUpdateOutboxFailed, gM as markSessionWorkflowWakeDelivered, gN as markSessionWorkflowWakeFailed, gO as markStaleRegistryCatalogItems, gP as markStripeWebhookProcessed, gQ as markWarmLeaseInstanceLost, gR as mcpServerIdForCapability, gS as moveQueuedTurnInTransaction, gT as mutateSessionControlInTransaction, gU as mutateWorkspaceControlInTransaction, gV as nextSessionHistoryPosition, gW as normalizeBearerScheme, gX as normalizeMemoryText, gY as orphanedResultRowIndicesForRepair, gZ as peekSessionWork, g_ as persistDrainSnapshot, g$ as persistWarmSnapshot, h0 as planWorkspaceCaptureGc, provisionRoles, h1 as quarantineCodexCredentialForLease, h2 as reArmDrainingLease, h3 as readActiveSandbox, h4 as readLease, h5 as readMachineMetricsLatest, h6 as readMachineMetricsLatestForWorkspace, h7 as readMachineMetricsSeries, h8 as reapExpiredSessionListSnapshots, h9 as reapStaleLeaseHolders, ha as reapStaleLeaseHoldersGlobal, hb as reconcileCodexCapacityWait, hc as recordAuditEvent, hd as recordCodexAccountConnectors, he as recordCodexAccountUsage, hf as recordCodexAccountUsageWithWakeTargets, hg as recordCodexTokenRefresh, hh as recordConnectionTokenRefresh, hi as recordConnectionUsed, hj as recordLeaseDataPlaneUrl, hk as recordLeaseTerminalDataPlaneUrl, hl as recordPendingSessionToolCallResult, hm as recordSessionActiveCodexCredential, hn as recordSkippedContextCompaction, ho as recordStreamAcknowledgment, hp as recordStripeWebhookEvent, hq as recordUsageEvent, hr as recordWarmingSandboxCreated, hs as recoverSessionDispatch, ht as refreshOAuthConnectionCredential, hu as registerDbBinding, hv as registerInternalUpdateWakeInTransaction, hw as registerPendingSessionToolCall, hx as registerSessionTurnAttemptClaim, hy as registerSessionWorkflowWakeInTransaction, hz as registerWorkspacePack, hA as releaseCodexCredentialLease, hB as releaseLeaseHolder, hC as removeWorkspaceMember, hD as renameCodexAccount, hE as renderWorkspaceMemoryBlock, hF as replaceIntegrationOAuthClient, hG as requestSessionCompaction, hH as requestSessionTurnRecovery, hI as requireFile, hJ as requireScheduledTask, hK as requireSession, hL as requireSocialConnection, hM as requireWorkspace, hN as reserveSessionCommandReceipt, hO as reserveToolspaceCallForTurn, hP as resolveWorkspaceMemoryBlock, hQ as revokeApiKey, hR as revokeConnection, hS as revokeEnrollment, hT as revokeViewer, hU as rlsContextForWorkspace, hV as rlsStrategyFor, hW as sanitizeEventPayload, hX as sanitizeEventString, hY as sanitizeMemoryText, hZ as sanitizeModelPayload, h_ as saveComposerDraftInTransaction, h$ as saveRunState, i0 as saveWorkspaceMemory, i1 as searchWorkspaceMemories, i2 as sendAgentMessageInTransaction, i3 as serializeEffectiveSessionControl, i4 as sessionSubject, i5 as sessionsWithActiveOpOnEnrollment, i6 as setActiveCodexCredential, i7 as setActiveSandbox, i8 as setCodexCredentialExhausted, i9 as setCodexCredentialExhaustedWithWakeTargets, ia as setCodexCredentialStatus, ib as setCodexCredentialStatusById, ic as setConnectionStatus, id as setEnrollmentDisplayState, ie as setEnrollmentOpStreamState, ig as setEnrollmentWentOffline, ih as setInitialActiveCodexCredential, ii as setRlsContext, ij as setSessionCodexPin, ik as setSessionGoalLastContinuationTurn, il as setSessionGoalStatus, im as setSessionLastInputTokensForTurnAttempt, io as setSessionPin, ip as setTemporalWorkflowId, iq as setVariableSetVariable, ir as setWorkspaceDefaultRig, is as setWorkspaceEnvironmentVariable, it as settleCodexCredentialFailover, iu as settleCodexCredentialLeaseLoss, iv as settleScheduledTaskRunInTransaction, iw as settleSessionAttemptInterruptions, ix as settleSessionIdleWithParentOutbox, iy as shortMemoryId, iz as steerAgentSessionInTransaction, iA as steerQueuedTurnInTransaction, iB as storeIntegrationOAuthClient, iC as submitHumanPromptInTransaction, iD as sumUsageQuantity, iE as supersedeSessionCurrentDirectionInTransaction, iF as touchEnrollmentLastSeen, iG as touchLeaseHolder, iH as updateCodexRotationSettings, iI as updateConnection, iJ as updateImportBatchCounts, iK as updateKnowledgeMemory, iL as updatePackInstallationStatus, iM as updatePtySessionActivity, iN as updateRecording, iO as updateRig, iP as updateRigChangeStatus, iQ as updateScheduledTask, iR as updateScheduledTaskRun, iS as updateSessionCommandReceiptResult, iT as updateSessionGoal, iU as updateSessionMcpServerCredentials, iV as updateSessionTitle, iW as updateVariableSet, iX as updateWorkspace, iY as updateWorkspaceEnvironment, iZ as updateWorkspaceSettings, i_ as upsertBillingCustomer, i$ as upsertCapabilityCatalogItem, j0 as upsertCodexSubscriptionCredential, j1 as upsertGitHubInstallation, j2 as upsertMachineMetricsLatest, j3 as upsertRegistryCapabilityCatalogItem, j4 as upsertSandboxSessionEnvelope, j5 as upsertSessionGoal, j6 as upsertWorkspaceModelPolicy, j7 as withAccountRls, j8 as withCodexCapacityMutation, j9 as withCodexCredentialRefreshLock, ja as withRlsContext, jb as withWorkspaceRls, jc as withWorkspaceSubjectRls, jd as withWorkspaceUsageLock, je as workspaceCaptureAtRevision, jf as workspaceCodexSubscriptionActive } from './provision-roles.js';
-import './schema-BN5mB9xZ.js';
 export { sql as dbSql } from 'drizzle-orm';
+export { A as AGENT_VISIBLE_MEMORY_STATUSES, a as AcceptSessionApprovalDecisionResult, b as AcceptSessionHumanInputResponseResult, c as AccrueWarmSecondsResult, d as AcquireLeaseInput, e as AcquireLeaseResult, f as ActiveSandboxPointer, g as AddSessionSystemUpdateInput, h as AddSessionSystemUpdateResult, i as AgentCommandAuthorityError, j as AgentInternalUpdateCommandResult, k as AppendEventInput, l as ApplyContextCompactionResult, m as ApplySessionTurnSettlementInput, n as ApplySessionTurnSettlementResult, o as ArmCodexCapacityWaitResult, B as BootstrapWorkspaceInput, C as CODEX_CAPACITY_REFRESH_MAX_MS, p as CODEX_CAPACITY_REFRESH_MIN_MS, q as CODEX_CREDENTIAL_LEASE_TTL_MS, r as CODEX_ROTATION_STRATEGIES, s as ClaimSessionWorkForAttemptInput, t as ClaimSessionWorkForAttemptResult, u as ClearSessionContextResult, v as CodexAccountStatus, w as CodexAccountUsageSnapshot, x as CodexAuthDeps, y as CodexCapacityAvailabilityDecision, z as CodexCapacityMutationResult, D as CodexCapacityResetKind, E as CodexCapacitySelectionContext, F as CodexCapacityWait, G as CodexCapacityWaitStatus, H as CodexCapacityWakeTarget, I as CodexCredentialForRun, J as CodexCredentialLeaseCandidateFilter, K as CodexCredentialLeaseCandidateFilterResult, L as CodexCredentialLeasePolicyScopeResolver, M as CodexCredentialLeaseQuarantine, N as CodexCredentialLeaseResult, O as CodexCredentialLeaseSelection, P as CodexCredentialLeaseSelectionContext, Q as CodexCredentialStatus, R as CodexCredentialTokens, S as CodexLeaseAccountStatus, T as CodexPinSource, U as CodexRotationSettings, V as CodexRotationStrategy, W as ComposerDraftRow, X as ConnectionBrokerDeps, Y as ConnectionCredentialForBroker, Z as ConnectionRefreshHttpError, _ as ConsumeOAuthStateNonceInput, $ as CorrectWorkspaceMemoryInput, a0 as CorrectWorkspaceMemoryResult, a1 as CreateCapabilityCatalogItemInput, a2 as CreateConnectionInput, a3 as CreateDbOptions, a4 as CreateImportBatchInput, a5 as CreateKnowledgeMemoryInput, a6 as CreatePackInstallationInput, a7 as CreateScheduledTaskInput, a8 as CreateSessionGoalInput, a9 as CreateSessionMcpServerInput, aa as CreateSocialConnectionInput, ab as CreateSocialPostInput, ac as CreditBalanceByAccount, ad as Database, ae as DatabaseFailureCode, af as DbClient, ag as DeviceEnrollmentRequestRecord, ah as DeviceEnrollmentStatus, ai as EditQueueCommandResult, aj as EffectiveControlBlocker, ak as EffectiveControlResumeOption, al as EffectiveControlState, am as EffectiveSessionControl, an as EnableCapabilityInstallationInput, ao as EnabledMcpCapabilityServer, ap as EnqueueSessionTurnInput, aq as EnrollmentExposure, ar as EnrollmentOs, as as EnrollmentRecord, at as EnrollmentStatus, au as ExpiredFileUploadCleanupClaim, av as FileUploadCleanupClaimResult, aw as ForceDrainResult, ax as FrozenTurnInitiator, ay as GitHubInstallation, az as GitHubInstallationAccess, aA as GoalContinuationDecision, aB as HostExportConsumerStatus, aC as HostExportKind, aD as HostExportPayloadError, aE as HostMcpCredentialBindingError, aF as HostMcpCredentialResolverContext, aG as HostMcpCredentialScopeError, aH as HumanInputResponseValidationError, aI as IdempotentPersistenceTransactionOptions, aJ as ImportBatch, aK as InitializeSessionStartInput, aL as InitializeSessionStartResult, aM as IntegrationOAuthClientForUse, aN as LeaseHolderKind, aO as LeaseSnapshot, aP as ListKnowledgeMemoryOptions, aQ as ListSessionEventPageOptions, aR as ListSessionEventsOptions, aS as ListSessionsForSubjectOptions, aT as ListSessionsOptions, aU as LiveModalSandboxLeaseAttribution, aV as MACHINE_METRICS_SERIES_INTERVAL_MS, aW as MAX_INTERNAL_UPDATE_BATCH_BYTES, aX as MAX_INTERNAL_UPDATE_BATCH_MEMBERS, aY as MAX_INTERNAL_UPDATE_BYTES, aZ as MEMORY_ACTIVE_RECORD_CAP, a_ as MEMORY_BLOCK_KIND_ORDER, a$ as MEMORY_BLOCK_RECORD_LIMIT, b0 as MEMORY_CORRECT_TOOL_DESCRIPTION, b1 as MEMORY_KIND_SECTION_TITLES, b2 as MEMORY_NEAR_DUP_COSINE_THRESHOLD, b3 as MEMORY_NEAR_DUP_NEIGHBORS, b4 as MEMORY_SAVE_TOOL_DESCRIPTION, b5 as MEMORY_SEARCH_DEFAULT_LIMIT, b6 as MEMORY_SEARCH_MAX_LIMIT, b7 as MEMORY_SEARCH_TOOL_DESCRIPTION, b8 as MEMORY_TEXT_MAX_CHARS, b9 as MEMORY_VISIBLE_RECORD_CAP, ba as MachineMetricsRow, bb as MachineMetricsSample, bc as MarkWarmLeaseInstanceLostResult, bd as MemoryBlockRecord, be as MemoryEmbedder, bf as MemorySanitizeResult, bg as MeterableWarmLease, bh as PendingSessionToolCallInput, bi as PersistenceFailureDetails, bj as PersistenceRetryOutcome, ProvisionResult, ProvisionRolesOptions, bk as QueueCommandConflictCode, bl as QueueCommandConflictError, bm as QueueCommandResult, bn as QueuedTurnRow, bo as ReapDrainable, bp as ReconcileCodexCapacityWaitResult, bq as RecoverSessionDispatchInput, br as RecoverSessionDispatchResult, bs as RegisterWorkspacePackInput, bt as RegistryCapabilityCatalogItemInput, bu as RegistryCatalogSurfaceKey, bv as ReplaceIntegrationOAuthClientInput, bw as RequestSessionTurnRecoveryInput, bx as RequestSessionTurnRecoveryResult, by as ResolveConnectionCredentialInput, bz as ResolveConnectionCredentialResult, bA as RigActiveVersionChangedError, bB as RigChangeAlreadyVerifyingError, bC as RigChangeMonitoringSummary, bD as RigChangeTransitionError, bE as RigVersionContentInput, bF as RigVersionMonitoringSummary, bG as RlsContext, bH as RlsStrategy, bI as SESSION_ANCESTRY_LIMIT, bJ as SESSION_DISCOVERY_CONTROL_TARGET_LIMIT, bK as SESSION_DISCOVERY_CONTROL_TITLE_MAX_CHARS, bL as SESSION_DISCOVERY_GOAL_MAX_CHARS, bM as SESSION_DISCOVERY_MESSAGE_MAX_CHARS, bN as SESSION_EVENT_DB_PAGE_MAX_BYTES, bO as SafeDatabaseErrorFacts, bP as SandboxImageConflictError, bQ as SandboxKind, bR as SandboxLeaseLiveness, bS as SandboxLeaseSupersededError, bT as SandboxPtySessionRow, bU as SandboxRecord, bV as SandboxRigConflictError, bW as SanitizedDatabasePersistenceCause, bX as SaveWorkspaceMemoryInput, bY as SaveWorkspaceMemoryResult, bZ as SessionAttemptInterruptionSettlement, b_ as SessionCodexState, b$ as SessionCommandActor, c0 as SessionCommandIdempotencyError, c1 as SessionCommandReceiptRow, c2 as SessionContextBusyError, c3 as SessionControlConflictError, c4 as SessionControlInvariantError, c5 as SessionControlMutationResult, c6 as SessionDiscoveryControl, c7 as SessionDiscoveryCursor, c8 as SessionDiscoveryOrderBy, c9 as SessionDiscoverySummary, ca as SessionEventPage, cb as SessionEventPersistenceError, cc as SessionEventWriteLockInput, cd as SessionEventWriteLocks, ce as SessionIdConflictError, cf as SessionLineage, cg as SessionListAccessError, ch as SessionListCursor, ci as SessionListCursorError, cj as SessionMcpServerForRun, ck as SessionPinAccessError, cl as SessionPinVersionConflictError, cm as SessionRecordingCodec, cn as SessionRecordingMode, co as SessionRecordingRow, cp as SessionRecordingState, cq as SessionSystemUpdateOutboxDelivery, cr as SessionTurnAttemptOutcome, cs as SessionTurnForExecution, ct as SessionTurnRecordingSettlement, cu as SessionWorkPeek, cv as SessionWorkTrigger, cw as SessionWorkflowWake, cx as SetSessionCodexPinOptions, cy as SettleCodexCredentialFailoverResult, cz as SettleCodexCredentialLeaseLossResult, cA as SteerQueueCommandResult, cB as StoreIntegrationOAuthClientInput, cC as StoredIntegrationOAuthClient, cD as StreamAcknowledgment, cE as SubmitHumanPromptResult, cF as ToolspaceCallReservation, cG as TurnAttemptFenceRejectReason, cH as UpdateConnectionInput, cI as UpdateImportBatchCountsInput, cJ as UpdateKnowledgeMemoryInput, cK as UpdateScheduledTaskInput, cL as UpdateSessionMcpServerCredentialsInput, cM as UpdateSessionMcpServerCredentialsResult, cN as UserLookup, cO as VariableSetForRun, cP as WORKSPACE_MEMORY_BLOCK_EMPTY, cQ as WORKSPACE_MEMORY_BLOCK_HEADER_POPULATED, cR as WORKSPACE_MEMORY_BLOCK_TOKEN_BUDGET, cS as WorkspaceCaptureCommitResult, cT as WorkspaceCaptureGcPlan, cU as WorkspaceCaptureGcRow, cV as WorkspaceCaptureRow, cW as WorkspaceControlLockMode, cX as WorkspaceControlMutationResult, cY as WorkspaceControlRow, cZ as WorkspaceEnvironmentForRun, c_ as WorkspaceMemoryOrigin, c$ as WorkspaceMemorySearchInput, d0 as WorkspaceMemorySearchMode, d1 as WorkspaceMemorySearchResult, d2 as WorkspaceModelPolicy, d3 as abandonRecordingForTurnAttempt, d4 as acceptSessionApprovalDecision, d5 as acceptSessionHumanInputResponse, d6 as accrueWarmSeconds, d7 as acknowledgeHostExportBatch, d8 as acquireCodexCredentialLease, d9 as acquireLease, da as activateRigVersion, db as addSessionSystemUpdate, dc as addSessionSystemUpdateWithSourceMutation, dd as allAccountPermissions, de as allWorkspacePermissions, df as appendSessionEventToSandboxGroup, dg as appendSessionEvents, dh as appendSessionEventsAndUpdateSession, di as appendSessionEventsForTurnAttempt, dj as appendSessionEventsWithLockedSessionUpdate, dk as appendSessionHistoryItems, dl as applyContextCompaction, dm as applyCreditDebitUpToBalance, dn as applyCreditLedgerEntry, dp as applySessionTurnSettlement, dq as approveDeviceEnrollmentRequest, dr as areGitHubRepositoriesAllowedForWorkspace, ds as armCodexCapacityWait, dt as assertAgentCommandAuthorityInTransaction, du as autoResumeSessionBranchInTransaction, dv as beginRigChangeVerificationAttempt, dw as bindGitHubInstallationRepositories, dx as bootstrapWorkspace, dy as buildChildCompletionDigest, dz as buildCodexTokenResolver, dA as buildConnectionTokenResolver, dB as buildHostConnectionTokenResolver, dC as canonicalSessionCommandHash, dD as claimExpiredFileUploadCleanup, dE as claimFileUploadCleanup, dF as claimHostExportBatch, dG as claimPendingSessionSystemUpdateOutbox, dH as claimPendingSessionWorkflowWakes, dI as claimSessionWorkForAttempt, dJ as clearDurablePendingSessionToolCalls, dK as clearEnrollmentWentOffline, dL as clearSessionContext, dM as clearSessionGoal, dN as clearedContextMarkerItem, dO as closePtySession, dP as closeSessionTurnAttemptInTransaction, dQ as codexCapacityRefreshBackoffMs, dR as commitWarmingToWarm, dS as completeExpiredFileUploadCleanup, dT as completeFileUpload, dU as completeFileUploadCleanup, dV as computeWorkspaceCaptureGcPlan, dW as confirmDrainCold, dX as consumeDeviceEnrollmentRequest, dY as consumeIntegrationOAuthStateNonce, dZ as correctWorkspaceMemory, d_ as countActiveApiKeysForWorkspace, d$ as countActiveSessionHistoryItems, e0 as countActiveSessionsForWorkspace, e1 as countActiveSessionsUsingEnvironment, e2 as countActiveSessionsUsingVariableSet, e3 as countConsecutiveReactiveRotations, e4 as countQueuedTurns, e5 as countRigs, e6 as countSandboxLeasesByLiveness, e7 as countScheduledTasksForWorkspace, e8 as countScheduledTasksUsingEnvironment, e9 as countScheduledTasksUsingVariableSet, ea as countSessionHistoryItems, eb as countSessionsUsingRig, ec as countVariableSets, ed as countWorkspaceEnvironments, ee as countWorkspacesForAccount, ef as createApiKey, eg as createConnection, eh as createDb, ei as createDeviceEnrollmentRequest, ej as createEnrollment, ek as createFileUpload, el as createImportBatch, em as createKnowledgeMemory, en as createRig, eo as createRigChange, ep as createRigVersion, eq as createRigVersionForChangePromotion, er as createSandbox, es as createScheduledTask, et as createScheduledTaskRun, eu as createSession, ev as createSessionGoal, ew as createSessionMcpServers, ex as createSessionWithIdempotencyKey, ey as createSocialConnection, ez as createSocialPost, eA as createVariableSet, eB as createWorkspace, eC as createWorkspaceEnvironment, eD as databaseFailureCode, eE as deadLetterHostExportHead, eF as decodeSessionListCursor, eG as decryptEnvironmentValue, eG as decryptVariableSetValue, eH as decryptedCapabilityHeaders, eI as deleteGitHubInstallationBinding, eJ as deleteRecording, eK as deleteRig, eL as deleteRigIfNoActiveSessions, eM as deleteScheduledTask, eN as deleteSessionQueueItemInTransaction, eO as deleteVariableSet, eP as deleteVariableSetVariable, eQ as deleteWorkspace, eR as deleteWorkspaceCaptureRows, eS as deleteWorkspaceEnvironment, eT as deleteWorkspaceEnvironmentVariable, eU as deleteWorkspacePack, eV as denyDeviceEnrollmentRequest, eW as disableCapabilityInstallation, eX as disableHostExportConsumer, eY as disconnectAllCodexAccounts, eZ as disconnectCodexAccount, e_ as editQueuedTurnInTransaction, e$ as enableCapabilityInstallation, f0 as enablePackInstallation, f1 as encodeSessionListCursor, f2 as encryptEnvironmentValue, f2 as encryptVariableSetValue, f3 as enqueueSessionTurn, f4 as enqueueSessionWorkflowWake, f5 as enqueueSessionWorkflowWakeIfRunnable, f6 as enqueueSessionWorkflowWakeInTransaction, f7 as ensureCodexRotationSettings, f8 as ensureManagedAccessForUser, f9 as estimateMemoryTokens, fa as evaluateGoalContinuation, fb as evaluateSessionControl, fc as evaluateSessionControls, fd as evaluateSessionDiscoveryControls, fe as expireSessionHumanInputRequest, ff as failHostExportBatch, fg as failWarmingToCold, fh as fetchCodexUsageForAccount, fi as finalizeEnrollmentByToken, fj as findActiveApiKeyByHash, fk as forceDrainOverLimitViewerOnlyBoxes, fl as frozenInitiatorForCommandActor, fm as getActiveSessionHistoryItems, fn as getAnySessionInGroup, fo as getBillingBalance, fp as getBillingCustomer, fq as getCapabilityCatalogItem, fr as getCapabilityInstallation, fs as getCodexCapacityWaitForSession, ft as getCodexCredentialStatus, fu as getCodexRotationSettings, fv as getComposerDraftInTransaction, fw as getConnectionMetadata, fx as getDeviceEnrollmentRequestByDeviceCode, fy as getEnrollment, fz as getFile, fA as getFileUpload, fB as getHostExportConsumerStatus, fC as getHumanInputResumeForEvent, fD as getKnowledgeMemory, fE as getLatestRunState, fF as getLatestStartedSessionTurn, fG as getManagedAccount, fH as getManagedUserByEmail, fI as getMaterializedSandboxFileResources, fJ as getOpenPtySession, fK as getOrCreateSessionSystemUpdateOutbox, fL as getPackInstallation, fM as getPendingDeviceEnrollmentRequestByUserCode, fN as getPendingDeviceEnrollmentRequestByUserCodeGlobal, fO as getRecording, fP as getRig, fQ as getRigByName, fR as getRigChange, fS as getRigName, fT as getRigVersion, fU as getRigVersionById, fV as getSandbox, fW as getSandboxSessionEnvelope, fX as getScheduledTask, fY as getSession, fZ as getSessionByCreateIdempotencyKey, f_ as getSessionCodexState, f$ as getSessionEvent, g0 as getSessionEventByClientEventId, g1 as getSessionForSubject, g2 as getSessionGoal, g3 as getSessionHistoryItems, g4 as getSessionHumanInputRequest, g5 as getSessionLineage, g6 as getSessionQueueSnapshot, g7 as getSessionRootId, g8 as getSessionSystemUpdateOutboxByDedupeKey, g9 as getSessionTurn, ga as getSessionTurnForAttempt, gb as getSocialConnection, gc as getStoredCapabilityHeaderCiphertext, gd as getStreamAcknowledgment, ge as getVariableSet, gf as getVariableSetByName, gg as getVariableSetValuesForRun, gh as getWorkspace, gi as getWorkspaceControlEvent, gj as getWorkspaceDefaultRigId, gk as getWorkspaceEnvironment, gl as getWorkspaceEnvironmentByName, gm as getWorkspaceEnvironmentValuesForRun, gn as getWorkspaceGrant, go as getWorkspaceModelPolicy, gp as getWorkspacePack, gq as grantWorkspaceAccess, gr as hasCreditLedgerEntry, gs as hashMemoryText, gt as heartbeatCodexCredentialLease, gu as heartbeatCodexCredentialLeaseUntil, gv as heartbeatLeaseHolder, gw as ingestMachineMetricsSample, gx as initializeSessionStartAtomically, gy as insertFailedWorkspaceCapture, gz as insertMachineMetricsSeries, gA as insertPtySession, gB as insertRecording, gC as insertWorkspaceCapture, gD as interruptedToolCallResult, gE as isCodexBilledTurn, gF as isDatabasePersistenceFailure, gG as isMemoryTextTooLong, gH as isPrivateAddress, gI as isRetryablePersistenceSqlState, gJ as isSessionCompactionRequested, gK as isSessionEventPersistenceError, gL as isStripeWebhookProcessed, gM as latestWorkspaceCapture, gN as listApiKeys, gO as listCapabilityCatalogItems, gP as listCapabilityInstallations, gQ as listCodexAccountStatuses, gR as listConnectionsMetadata, gS as listCreditBalancesByAccount, gT as listDistinctRigVersionIdsInGroup, gU as listDistinctVariableSetIdsInGroup, gV as listEnabledMcpCapabilityServers, gW as listEnrollments, gX as listGitHubInstallationAccessForWorkspace, gY as listGitHubInstallationIdsForWorkspace, gZ as listGitHubInstallationsForWorkspace, g_ as listKnowledgeMemories, g$ as listLiveModalSandboxLeaseAttributions, h0 as listMeterableWarmLeases, h1 as listOpenPtySessions, h2 as listOutstandingSessionSystemUpdates, h3 as listPackInstallations, h4 as listPendingCodexCapacityWakeTargets, h5 as listPendingSessionTurns, h6 as listRecordings, h7 as listRegistryCatalogSurfaceKeys, h8 as listRigChangeMonitoringSummaries, h9 as listRigChanges, ha as listRigVersionMonitoringSummaries, hb as listRigVersions, hc as listRigs, hd as listSandboxes, he as listScheduledTaskRuns, hf as listScheduledTasks, hg as listSessionDiscoverySummaries, hh as listSessionEventPage, hi as listSessionEvents, hj as listSessionHumanInputRequests, hk as listSessionIdsInGroup, hl as listSessionMcpServerMetadata, hm as listSessionMcpServersForChildInheritance, hn as listSessionMcpServersForRun, ho as listSessionSystemUpdatesForTurn, hp as listSessionTurns, hq as listSessions, hr as listSessionsForSubject, hs as listSocialConnections, ht as listSocialPosts, hu as listUsageEvents, hv as listVariableSets, hw as listWorkspaceControlEvents, hx as listWorkspaceEnvironments, hy as listWorkspaceMembers, hz as listWorkspacePacks, hA as listWorkspacesForSubject, hB as loadCodexCredentialForRun, hC as loadConnectionCredentialForBroker, hD as loadIntegrationOAuthClient, hE as loadVariableSetForRun, hF as loadWorkspaceEnvironmentForRun, hG as lockSessionEventWriteRows, hH as lockWorkspaceInferenceControl, hI as markFileUploadFailed, hJ as markSandboxFileResourcesMaterialized, hK as markScheduledTaskRunFailedIfQueued, hL as markSessionAttemptQuiesced, hM as markSessionSystemUpdateOutboxDeliveredInTransaction, hN as markSessionSystemUpdateOutboxFailed, hO as markSessionWorkflowWakeDelivered, hP as markSessionWorkflowWakeFailed, hQ as markStaleRegistryCatalogItems, hR as markStripeWebhookProcessed, hS as markWarmLeaseInstanceLost, hT as mcpServerIdForCapability, hU as moveQueuedTurnInTransaction, hV as mutateSessionControlInTransaction, hW as mutateWorkspaceControlInTransaction, hX as nestedPostgresSqlState, hY as nextSessionHistoryPosition, hZ as normalizeBearerScheme, h_ as normalizeMemoryText, h$ as orphanedResultRowIndicesForRepair, i0 as peekSessionWork, i1 as persistDrainSnapshot, i2 as persistWarmSnapshot, i3 as planWorkspaceCaptureGc, i4 as projectEffectiveControlForRelatedAccess, i5 as projectSessionForRelatedAccess, provisionRoles, i6 as pruneHostExportOutbox, i7 as quarantineCodexCredentialForLease, i8 as reArmDrainingLease, i9 as readActiveSandbox, ia as readLease, ib as readMachineMetricsLatest, ic as readMachineMetricsLatestForWorkspace, id as readMachineMetricsSeries, ie as reapExpiredSessionListSnapshots, ig as reapStaleLeaseHolders, ih as reapStaleLeaseHoldersGlobal, ii as reconcileCodexCapacityWait, ij as recordAuditEvent, ik as recordCodexAccountConnectors, il as recordCodexAccountUsage, im as recordCodexAccountUsageWithWakeTargets, io as recordCodexTokenRefresh, ip as recordConnectionTokenRefresh, iq as recordConnectionUsed, ir as recordLeaseDataPlaneUrl, is as recordLeaseTerminalDataPlaneUrl, it as recordPendingSessionToolCallResult, iu as recordSessionActiveCodexCredential, iv as recordSkippedContextCompaction, iw as recordStreamAcknowledgment, ix as recordStripeWebhookEvent, iy as recordUsageEvent, iz as recordWarmingSandboxCreated, iA as recoverSessionDispatch, iB as refreshOAuthConnectionCredential, iC as registerDbBinding, iD as registerHostExportConsumer, iE as registerInternalUpdateWakeInTransaction, iF as registerPendingSessionToolCall, iG as registerSessionTurnAttemptClaim, iH as registerSessionWorkflowWakeInTransaction, iI as registerWorkspacePack, iJ as releaseCodexCredentialLease, iK as releaseLeaseHolder, iL as removeWorkspaceMember, iM as renameCodexAccount, iN as renderWorkspaceMemoryBlock, iO as replaceIntegrationOAuthClient, iP as requestSessionCompaction, iQ as requestSessionTurnRecovery, iR as requireFile, iS as requireScheduledTask, iT as requireSession, iU as requireSocialConnection, iV as requireWorkspace, iW as reserveSessionCommandReceipt, iX as reserveToolspaceCallForTurn, iY as resolveWorkspaceMemoryBlock, iZ as resumeHostExportConsumer, i_ as retireHostExportConsumer, i$ as revokeApiKey, j0 as revokeConnection, j1 as revokeEnrollment, j2 as revokeViewer, j3 as rewindHostExportConsumer, j4 as rlsContextForWorkspace, j5 as rlsStrategyFor, j6 as runIdempotentPersistenceTransaction, j7 as safeDatabaseErrorFacts, j8 as sanitizeEventPayload, j9 as sanitizeEventString, ja as sanitizeMemoryText, jb as sanitizeModelPayload, jc as saveComposerDraftInTransaction, jd as saveRunState, je as saveWorkspaceMemory, jf as searchWorkspaceMemories, jg as sendAgentMessageInTransaction, jh as serializeEffectiveSessionControl, ji as sessionAuthorizationScopeFilter, jj as sessionSubject, jk as sessionTreeStatsForSessions, jl as sessionsWithActiveOpOnEnrollment, jm as setActiveCodexCredential, jn as setActiveSandbox, jo as setCodexCredentialExhausted, jp as setCodexCredentialExhaustedWithWakeTargets, jq as setCodexCredentialStatus, jr as setCodexCredentialStatusById, js as setConnectionStatus, jt as setEnrollmentDisplayState, ju as setEnrollmentOpStreamState, jv as setEnrollmentWentOffline, jw as setInitialActiveCodexCredential, jx as setRlsContext, jy as setSessionCodexPin, jz as setSessionGoalLastContinuationTurn, jA as setSessionGoalStatus, jB as setSessionLastInputTokensForTurnAttempt, jC as setSessionPin, jD as setTemporalWorkflowId, jE as setVariableSetVariable, jF as setWorkspaceDefaultRig, jG as setWorkspaceEnvironmentVariable, jH as settleCodexCredentialFailover, jI as settleCodexCredentialLeaseLoss, jJ as settleScheduledTaskRunInTransaction, jK as settleSessionAttemptInterruptions, jL as settleSessionIdleWithParentOutbox, jM as shortMemoryId, jN as steerAgentSessionInTransaction, jO as steerQueuedTurnInTransaction, jP as storeIntegrationOAuthClient, jQ as submitHumanPromptInTransaction, jR as sumUsageQuantity, jS as supersedeSessionCurrentDirectionInTransaction, jT as touchEnrollmentLastSeen, jU as touchLeaseHolder, jV as updateCodexRotationSettings, jW as updateConnection, jX as updateImportBatchCounts, jY as updateKnowledgeMemory, jZ as updatePackInstallationStatus, j_ as updatePtySessionActivity, j$ as updateRecording, k0 as updateRig, k1 as updateRigChangeStatus, k2 as updateScheduledTask, k3 as updateScheduledTaskRun, k4 as updateSessionCommandReceiptResult, k5 as updateSessionGoal, k6 as updateSessionMcpServerCredentials, k7 as updateSessionTitle, k8 as updateVariableSet, k9 as updateWorkspace, ka as updateWorkspaceEnvironment, kb as updateWorkspaceSettings, kc as upsertBillingCustomer, kd as upsertCapabilityCatalogItem, ke as upsertCodexSubscriptionCredential, kf as upsertGitHubInstallation, kg as upsertMachineMetricsLatest, kh as upsertRegistryCapabilityCatalogItem, ki as upsertSandboxSessionEnvelope, kj as upsertSessionGoal, kk as upsertWorkspaceModelPolicy, kl as validateHumanInputResponse, km as withAccountRls, kn as withCodexCapacityMutation, ko as withCodexCredentialRefreshLock, kp as withRlsContext, kq as withWorkspaceRls, kr as withWorkspaceSubjectRls, ks as withWorkspaceUsageLock, kt as workspaceCaptureAtRevision, ku as workspaceCodexSubscriptionActive } from './provision-roles.js';
+import 'drizzle-orm/pg-core';
+import './schema-CdPGTHlD.js';
 export { migrate, runMigrations } from './migrate.js';