@opengeni/db 0.7.3 → 0.9.3

package/dist/{chunk-B22X3IEZ.js → chunk-4LG5NBTC.js}

@@ -29,7 +29,13 @@ __export(schema_exports, {
   enrollments: () => enrollments,
   fileUploads: () => fileUploads,
   files: () => files,
+  githubInstallationRepositories: () => githubInstallationRepositories,
   githubInstallations: () => githubInstallations,
+  hostExportConfig: () => hostExportConfig,
+  hostExportConsumers: () => hostExportConsumers,
+  hostExportCursorState: () => hostExportCursorState,
+  hostExportDeadLetters: () => hostExportDeadLetters,
+  hostExportOutbox: () => hostExportOutbox,
   importBatches: () => importBatches,
   integrationOauthClients: () => integrationOauthClients,
   integrationOauthStateNonces: () => integrationOauthStateNonces,
@@ -55,6 +61,7 @@ __export(schema_exports, {
   sessionEvents: () => sessionEvents,
   sessionGoals: () => sessionGoals,
   sessionHistoryItems: () => sessionHistoryItems,
+  sessionHumanInputRequests: () => sessionHumanInputRequests,
   sessionListSnapshots: () => sessionListSnapshots,
   sessionMcpServers: () => sessionMcpServers,
   sessionPendingToolCalls: () => sessionPendingToolCalls,
@@ -79,6 +86,7 @@ __export(schema_exports, {
   workspaceMemberships: () => workspaceMemberships,
   workspaceModelPolicies: () => workspaceModelPolicies,
   workspacePacks: () => workspacePacks,
+  workspaceSessionActivityRevisions: () => workspaceSessionActivityRevisions,
   workspaceVariableSetVariables: () => workspaceVariableSetVariables,
   workspaceVariableSets: () => workspaceVariableSets,
   workspaces: () => workspaces
@@ -162,7 +170,9 @@ var workspaceInferenceControls = pgTable(
     accountId: uuid("account_id").notNull(),
     revision: bigint("revision", { mode: "number" }).notNull().default(0),
     workspaceState: text("workspace_state").notNull().default("active"),
-    workspacePauseRevision: bigint("workspace_pause_revision", { mode: "number" }),
+    workspacePauseRevision: bigint("workspace_pause_revision", {
+      mode: "number"
+    }),
     reason: text("reason"),
     changedBy: text("changed_by"),
     changedAt: timestamp("changed_at", { withTimezone: true }),
@@ -194,6 +204,25 @@ var workspaceInferenceControls = pgTable(
     )
   })
 );
+var workspaceSessionActivityRevisions = pgTable(
+  "workspace_session_activity_revisions",
+  {
+    workspaceId: uuid("workspace_id").primaryKey(),
+    accountId: uuid("account_id").notNull(),
+    revision: bigint("revision", { mode: "number" }).notNull().default(0)
+  },
+  (table) => ({
+    workspaceAccount: foreignKey({
+      name: "workspace_session_activity_revisions_workspace_account_fk",
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId]
+    }).onDelete("cascade"),
+    revisionValid: check(
+      "workspace_session_activity_revisions_revision_check",
+      sql`${table.revision} >= 0`
+    )
+  })
+);
 var workspaceMemberships = pgTable(
   "workspace_memberships",
   {
@@ -221,7 +250,9 @@ var apiKeys = pgTable(
   {
     id: uuid("id").primaryKey().defaultRandom(),
     accountId: uuid("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
-    workspaceId: uuid("workspace_id").references(() => workspaces.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id").references(() => workspaces.id, {
+      onDelete: "cascade"
+    }),
     name: text("name").notNull(),
     prefix: text("prefix").notNull(),
     keyHash: text("key_hash").notNull(),
@@ -332,13 +363,15 @@ var codexSubscriptionCredentials = pgTable(
     // excluded). The writer only ever sets a NON-empty set, so a flaky empty turn
     // can't false-drop coverage. connectorsCheckedAt is the freshness clock.
     connectorNamespaces: text("connector_namespaces").array(),
-    connectorsCheckedAt: timestamp("connectors_checked_at", { withTimezone: true }),
+    connectorsCheckedAt: timestamp("connectors_checked_at", {
+      withTimezone: true
+    }),
     // Workspace-local, server-held fairness cursor. Provider usage headers are
     // capacity hints, never the sole allocator: live lease count is ranked first
     // and this cursor deterministically breaks equal-load/equal-capacity ties.
     // This flag controls NEW automatic allocations only. Credential health,
     // refresh, encrypted material, and already-frozen/in-flight turns are
-    // intentionally independent. OPE-24 owns toggle OCC/audit and product UI.
+    // intentionally independent. account eligibility policy owns toggle OCC/audit and product UI.
     allocatorEnabled: boolean("allocator_enabled").notNull().default(true),
     selectionCount: integer("selection_count").notNull().default(0),
     lastSelectedAt: timestamp("last_selected_at", { withTimezone: true }),
@@ -450,8 +483,8 @@ var codexRotationSettings = pgTable(
     // code reads this bit; old binaries safely ignore it and keep the legacy
     // pin/rotation policy.
     leaseRotationEnabled: boolean("lease_rotation_enabled").notNull().default(false),
-    rotationStrategy: text("rotation_strategy").notNull().default("most_remaining"),
-    // P3, inert
+    rotationStrategy: text("rotation_strategy").notNull().default("sharded"),
+    // sharded-rotation policy: legacy residue; behavior is always sharded
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
@@ -512,6 +545,10 @@ var sessions = pgTable(
     workspaceId: uuid("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
     status: text("status").notNull().default("queued"),
     initialMessage: text("initial_message").notNull(),
+    // Invisible host context frozen with the winning session create. The
+    // initial turn copies this value so an idempotent repair can never adopt a
+    // retrying caller's different instructions.
+    initialTurnInstructions: text("initial_turn_instructions"),
     title: text("title"),
     titleSource: text("title_source"),
     // Per-session agent persona/system instructions supplied at create (the
@@ -524,6 +561,11 @@ var sessions = pgTable(
     resources: jsonb("resources").$type().notNull().default([]),
     tools: jsonb("tools").$type().notNull().default([]),
     metadata: jsonb("metadata").$type().notNull().default({}),
+    // Frozen creator fact. This is used for creation attribution and for the
+    // idempotent first-turn repair only; later turns capture their own actor.
+    createdByKind: text("created_by_kind").notNull().default("service"),
+    createdBySubjectId: text("created_by_subject_id").notNull().default("unattributed-legacy"),
+    createdByContext: jsonb("created_by_context").$type().notNull().default({ backfill: true }),
     model: text("model").notNull(),
     sandboxBackend: text("sandbox_backend").notNull(),
     // The OS this session's box runs. Defaults to 'linux' (today's only OS, so
@@ -539,8 +581,8 @@ var sessions = pgTable(
     // The app generates the uuid and uses it for both id and sandbox_group_id in
     // one insert — it cannot SQL-default to id (id is defaultRandom()).
     sandboxGroupId: uuid("sandbox_group_id").notNull(),
-    // The first-class swappable-sandbox POINTER (bring-your-own-compute M2,
-    // dossier §10.3). NULL == "use the session's own group sandbox" (the
+    // The first-class swappable-sandbox POINTER (bring-your-own-compute M2).
+    // NULL == "use the session's own group sandbox" (the
     // backward-compat default — every existing/new row is a behavior-preserving
     // no-op). The routing proxy re-reads (active_sandbox_id, active_epoch) PER
     // TOOL CALL to make a Modal<->selfhosted hot-swap seamless. The FK
@@ -605,11 +647,15 @@ var sessions = pgTable(
     queueTailPosition: bigint("queue_tail_position", { mode: "number" }).notNull().default(0),
     directControlState: text("direct_control_state").notNull().default("active"),
     directPauseRevision: bigint("direct_pause_revision", { mode: "number" }),
-    subtreeRunOverrideRevision: bigint("subtree_run_override_revision", { mode: "number" }),
+    subtreeRunOverrideRevision: bigint("subtree_run_override_revision", {
+      mode: "number"
+    }),
     controlVersion: bigint("control_version", { mode: "number" }).notNull().default(0),
     directControlReason: text("direct_control_reason"),
     directControlChangedBy: text("direct_control_changed_by"),
-    directControlChangedAt: timestamp("direct_control_changed_at", { withTimezone: true }),
+    directControlChangedAt: timestamp("direct_control_changed_at", {
+      withTimezone: true
+    }),
     lastSequence: integer("last_sequence").notNull().default(0),
     // The session's PINNED Codex account (manual override from the in-session
     // switcher). NULL ⇒ follow the workspace active pointer. FK declared in the
@@ -629,7 +675,11 @@ var sessions = pgTable(
     // account).
     codexPinSource: text("codex_pin_source"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
-    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+    // Assigned by the database trigger whenever canonical updated_at activity
+    // advances. Legacy rows remain zero until touched; raw delta-only writers
+    // intentionally omit updated_at and therefore do not allocate revisions.
+    activityRevision: bigint("activity_revision", { mode: "number" }).notNull().default(0)
   },
   (table) => ({
     workspaceIdentity: uniqueIndex("sessions_workspace_id_idx").on(table.workspaceId, table.id),
@@ -637,6 +687,25 @@ var sessions = pgTable(
       table.workspaceId,
       table.createdAt
     ),
+    // Model-facing monitoring pages use exact (timestamp,id) keysets. Keep the
+    // older prefix index during rolling deploys; these composites serve both
+    // deterministic traversal and updatedAfter change scans.
+    workspaceCreatedId: index("sessions_workspace_created_id_idx").on(
+      table.workspaceId,
+      table.createdAt.desc(),
+      table.id.desc()
+    ),
+    workspaceUpdatedId: index("sessions_workspace_updated_id_idx").on(
+      table.workspaceId,
+      table.updatedAt.desc(),
+      table.id.desc()
+    ),
+    workspaceActivityRevision: index("sessions_workspace_activity_revision_idx").on(
+      table.workspaceId,
+      table.activityRevision.desc(),
+      table.updatedAt.desc(),
+      table.id.desc()
+    ),
     variableSet: index("sessions_variable_set_idx").on(table.workspaceId, table.variableSetId),
     parent: index("sessions_parent_idx").on(table.workspaceId, table.parentSessionId),
     // Routing index: resolve session_id -> sandbox_group_id at every lease entry
@@ -754,6 +823,9 @@ var sessionMcpServers = pgTable(
     // Human-approval policy: `true` = every tool requires approval, a string[] of
     // UNPREFIXED tool names = only those require it, null/absent = auto-run.
     requireApproval: jsonb("require_approval").$type(),
+    // Non-secret pointer resolved at request time by the standalone broker or
+    // an embedding host. Unlike headersEncrypted, this is safe to project.
+    connectionRef: jsonb("connection_ref").$type(),
     // Map of header name -> AES-GCM ciphertext. Values are decrypted only by the
     // worker's run-preparation path and never returned by API helpers.
     headersEncrypted: jsonb("headers_encrypted").$type().notNull().default({}),
@@ -974,6 +1046,9 @@ var sessionTurns = pgTable(
     source: text("source").notNull().default("user"),
     position: bigint("position", { mode: "number" }).notNull(),
     prompt: text("prompt").notNull(),
+    // Host context for this exact turn. System-level at runtime and deliberately
+    // separate from the visible prompt/event payload.
+    turnInstructions: text("turn_instructions"),
     resources: jsonb("resources").$type().notNull().default([]),
     tools: jsonb("tools").$type().notNull().default([]),
     model: text("model").notNull(),
@@ -991,6 +1066,11 @@ var sessionTurns = pgTable(
     // the SQL constraint is therefore DEFERRABLE INITIALLY DEFERRED.
     activeAttemptId: uuid("active_attempt_id"),
     lineage: jsonb("lineage").$type().notNull().default({}),
+    // Required immutable authority captured when the turn is accepted. These
+    // columns are deliberately outside mutable metadata/lineage.
+    initiatorKind: text("initiator_kind").notNull().default("service"),
+    initiatorSubjectId: text("initiator_subject_id").notNull().default("unattributed-legacy"),
+    initiatorContext: jsonb("initiator_context").$type().notNull().default({ backfill: true }),
     cancelledBy: text("cancelled_by"),
     cancelReason: text("cancel_reason"),
     // Atomic per-turn toolspace call budget counter (migration 0043). Incremented
@@ -1033,10 +1113,18 @@ var sessionTurnAttempts = pgTable(
     workerId: text("worker_id"),
     leaseId: text("lease_id"),
     leaseExpiresAt: timestamp("lease_expires_at", { withTimezone: true }),
-    verifiedControlRevision: bigint("verified_control_revision", { mode: "number" }).notNull(),
+    verifiedControlRevision: bigint("verified_control_revision", {
+      mode: "number"
+    }).notNull(),
     startedAt: timestamp("started_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
-    closedAt: timestamp("closed_at", { withTimezone: true })
+    closedAt: timestamp("closed_at", { withTimezone: true }),
+    // The cancelled activity writes this after losing inference, user-visible
+    // output, and workspace-persistence authority. Fenced/idempotent cleanup
+    // and telemetry may still finish. Temporal activity cancellation or
+    // terminalization is transport state only; queue admission and clients use
+    // this durable receipt as the physical-quiescence authority.
+    quiescedAt: timestamp("quiesced_at", { withTimezone: true })
   },
   (table) => ({
     workspaceAccount: foreignKey({
@@ -1058,8 +1146,21 @@ var sessionTurnAttempts = pgTable(
       table.workspaceId,
       table.id
     ),
+    ownershipIdentity: uniqueIndex("session_turn_attempts_human_input_owner_uq").on(
+      table.accountId,
+      table.workspaceId,
+      table.sessionId,
+      table.turnId,
+      table.id
+    ),
     liveTurn: uniqueIndex("session_turn_attempts_live_turn_uq").on(table.workspaceId, table.turnId).where(sql`${table.state} in ('claimed', 'running')`),
     liveSession: uniqueIndex("session_turn_attempts_live_session_uq").on(table.workspaceId, table.sessionId).where(sql`${table.state} in ('claimed', 'running')`),
+    latestSessionAttempt: index("session_turn_attempts_latest_session_idx").on(
+      table.workspaceId,
+      table.sessionId,
+      table.startedAt.desc(),
+      table.id.desc()
+    ),
     dispatch: uniqueIndex("session_turn_attempts_dispatch_uq").on(
       table.workspaceId,
       table.temporalWorkflowRunId,
@@ -1098,7 +1199,9 @@ var sessionCommandReceipts = pgTable(
     targetTurnId: uuid("target_turn_id"),
     operationKey: text("operation_key").notNull(),
     canonicalRequestHash: text("canonical_request_hash").notNull(),
-    appliedControlRevision: bigint("applied_control_revision", { mode: "number" }),
+    appliedControlRevision: bigint("applied_control_revision", {
+      mode: "number"
+    }),
     appliedQueueVersion: integer("applied_queue_version"),
     appliedTurnVersion: integer("applied_turn_version"),
     appliedDraftRevision: bigint("applied_draft_revision", { mode: "number" }),
@@ -1143,7 +1246,7 @@ var sessionCommandReceipts = pgTable(
         and ${table.actorAttemptId} is not null
         and ${table.actorSubjectId} is null
       ) or (
-        ${table.actorType} in ('human', 'operator')
+        ${table.actorType} in ('human', 'operator', 'service')
         and ${table.actorSubjectId} is not null
         and ${table.actorAttemptId} is null
       )`
@@ -1162,7 +1265,11 @@ var workspaceControlEvents = pgTable(
     action: text("action").notNull(),
     automatic: boolean("automatic").notNull().default(false),
     reason: text("reason"),
+    reasonOriginalBytes: integer("reason_original_bytes"),
     actor: text("actor").notNull(),
+    // Null is the rolling-upgrade shape for untouched, already-bounded legacy
+    // rows. New writes and rewritten poison rows carry exact source byte facts.
+    actorOriginalBytes: integer("actor_original_bytes"),
     occurredAt: timestamp("occurred_at", { withTimezone: true }).notNull().defaultNow()
   },
   (table) => ({
@@ -1553,6 +1660,39 @@ var sessionEvents = pgTable(
       table.workspaceId,
       table.sessionId,
       table.createdAt
+    ),
+    sessionTypeSequence: index("session_events_workspace_session_type_sequence_idx").on(
+      table.workspaceId,
+      table.sessionId,
+      table.type,
+      table.sequence
+    ),
+    monitoringTail: index("session_events_workspace_session_monitoring_tail_idx").on(table.workspaceId, table.sessionId, table.sequence).where(
+      sql`${table.type} not in ('agent.message.delta', 'agent.reasoning.delta', 'sandbox.command.output.delta', 'terminal.pty.output.delta')`
+    ),
+    payloadBytes: check(
+      "session_events_payload_bytes_check",
+      sql`octet_length(${table.payload}::text) <= 65536`
+    ),
+    typeBytes: check(
+      "session_events_type_bytes_check",
+      sql`octet_length(${table.type}) <= 256 and position(E'\n' in ${table.type}) = 0 and position(E'\r' in ${table.type}) = 0`
+    ),
+    clientEventIdBytes: check(
+      "session_events_client_event_id_bytes_check",
+      sql`${table.clientEventId} is null or octet_length(${table.clientEventId}) <= 1024`
+    ),
+    producerIdBytes: check(
+      "session_events_producer_id_bytes_check",
+      sql`${table.producerId} is null or octet_length(${table.producerId}) <= 1024`
+    ),
+    turnAssociationBytes: check(
+      "session_events_turn_association_bytes_check",
+      sql`${table.turnAssociation} is null or octet_length(${table.turnAssociation}) <= 64`
+    ),
+    duplicateReasonBytes: check(
+      "session_events_duplicate_reason_bytes_check",
+      sql`${table.duplicateReason} is null or octet_length(${table.duplicateReason}) <= 4096`
     )
   })
 );
@@ -1561,7 +1701,9 @@ var agentRunStates = pgTable("agent_run_states", {
   accountId: uuid("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
   workspaceId: uuid("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
   sessionId: uuid("session_id").notNull().references(() => sessions.id, { onDelete: "cascade" }),
-  turnId: uuid("turn_id").references(() => sessionTurns.id, { onDelete: "set null" }),
+  turnId: uuid("turn_id").references(() => sessionTurns.id, {
+    onDelete: "set null"
+  }),
   stateVersion: integer("state_version").notNull(),
   serializedRunState: text("serialized_run_state").notNull(),
   pendingApprovals: jsonb("pending_approvals").$type().notNull().default([]),
@@ -1583,6 +1725,79 @@ var agentRunStates = pgTable("agent_run_states", {
   frozenCodexCredentialId: uuid("frozen_codex_credential_id"),
   createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
 });
+var sessionHumanInputRequests = pgTable(
+  "session_human_input_requests",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    sessionId: uuid("session_id").notNull(),
+    turnId: uuid("turn_id").notNull(),
+    turnGeneration: integer("turn_generation").notNull(),
+    creationAttemptId: uuid("creation_attempt_id").notNull(),
+    toolCallId: text("tool_call_id").notNull(),
+    status: text("status").notNull().default("pending"),
+    questions: jsonb("questions").$type().notNull(),
+    allowSkip: boolean("allow_skip").notNull().default(false),
+    response: jsonb("response").$type(),
+    respondedBy: text("responded_by"),
+    respondedAt: timestamp("responded_at", { withTimezone: true }),
+    expiresAt: timestamp("expires_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    creationAttemptOwner: foreignKey({
+      name: "session_human_input_requests_creation_attempt_fk",
+      columns: [
+        table.accountId,
+        table.workspaceId,
+        table.sessionId,
+        table.turnId,
+        table.creationAttemptId
+      ],
+      foreignColumns: [
+        sessionTurnAttempts.accountId,
+        sessionTurnAttempts.workspaceId,
+        sessionTurnAttempts.sessionId,
+        sessionTurnAttempts.turnId,
+        sessionTurnAttempts.id
+      ]
+    }).onDelete("cascade"),
+    toolCall: uniqueIndex("session_human_input_requests_tool_call_uq").on(
+      table.workspaceId,
+      table.sessionId,
+      table.turnId,
+      table.toolCallId
+    ),
+    pendingSession: index("session_human_input_requests_pending_session_idx").on(table.workspaceId, table.sessionId, table.createdAt, table.id).where(sql`${table.status} = 'pending'`),
+    pendingExpiry: index("session_human_input_requests_pending_expiry_idx").on(table.expiresAt, table.id).where(sql`${table.status} = 'pending' and ${table.expiresAt} is not null`),
+    status: check(
+      "session_human_input_requests_status_check",
+      sql`${table.status} in ('pending','answered','skipped','expired','cancelled')`
+    ),
+    generation: check(
+      "session_human_input_requests_generation_check",
+      sql`${table.turnGeneration} > 0`
+    ),
+    toolCallBytes: check(
+      "session_human_input_requests_tool_call_bytes_check",
+      sql`octet_length(${table.toolCallId}) between 1 and 1024`
+    ),
+    questionsBytes: check(
+      "session_human_input_requests_questions_bytes_check",
+      sql`octet_length(${table.questions}::text) <= 49152`
+    ),
+    responseBytes: check(
+      "session_human_input_requests_response_bytes_check",
+      sql`${table.response} is null or octet_length(${table.response}::text) <= 49152`
+    ),
+    actorBytes: check(
+      "session_human_input_requests_actor_bytes_check",
+      sql`${table.respondedBy} is null or octet_length(${table.respondedBy}) <= 1024`
+    )
+  })
+);
 var sessionHistoryItems = pgTable(
   "session_history_items",
   {
@@ -1590,7 +1805,9 @@ var sessionHistoryItems = pgTable(
     accountId: uuid("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
     workspaceId: uuid("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
     sessionId: uuid("session_id").notNull().references(() => sessions.id, { onDelete: "cascade" }),
-    turnId: uuid("turn_id").references(() => sessionTurns.id, { onDelete: "set null" }),
+    turnId: uuid("turn_id").references(() => sessionTurns.id, {
+      onDelete: "set null"
+    }),
     // Numeric (not integer) so the synthetic compaction-summary row can be
     // inserted at a FRACTIONAL position (boundaryPosition - 0.5) that sorts ahead
     // of the kept tail without colliding with — and thus overwriting — the real
@@ -1778,7 +1995,9 @@ var sessionRecordings = pgTable(
     accountId: uuid("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
     workspaceId: uuid("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
     sessionId: uuid("session_id").notNull().references(() => sessions.id, { onDelete: "cascade" }),
-    turnId: uuid("turn_id").references(() => sessionTurns.id, { onDelete: "set null" }),
+    turnId: uuid("turn_id").references(() => sessionTurns.id, {
+      onDelete: "set null"
+    }),
     state: text("state", { enum: sessionRecordingStateValues }).notNull(),
     mode: text("mode", { enum: sessionRecordingModeValues }).notNull(),
     codec: text("codec", { enum: sessionRecordingCodecValues }).notNull(),
@@ -1806,7 +2025,9 @@ var workspaceCaptures = pgTable(
     accountId: uuid("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
     workspaceId: uuid("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
     sessionId: uuid("session_id").notNull().references(() => sessions.id, { onDelete: "cascade" }),
-    turnId: uuid("turn_id").references(() => sessionTurns.id, { onDelete: "set null" }),
+    turnId: uuid("turn_id").references(() => sessionTurns.id, {
+      onDelete: "set null"
+    }),
     revision: bigint("revision", { mode: "number" }).notNull(),
     leaseEpoch: integer("lease_epoch").notNull(),
     // 'available' on a committed capture. 'failed' reserved for a future two-phase
@@ -1941,7 +2162,9 @@ var deviceEnrollmentRequests = pgTable(
     machineName: text("machine_name"),
     // The exposure the agent REQUESTED (whole-machine in v1; loudly consented at
     // approve). Mirrors the enrollment column domain.
-    requestedExposure: text("requested_exposure", { enum: enrollmentExposureValues }).notNull().default("whole-machine"),
+    requestedExposure: text("requested_exposure", {
+      enum: enrollmentExposureValues
+    }).notNull().default("whole-machine"),
     // The agent CAN offer a display (a real screen / Xvfb is available) — gates
     // whether screen-control consent is even meaningful. has_display on the
     // resulting enrollment is derived from this.
@@ -1959,8 +2182,12 @@ var deviceEnrollmentRequests = pgTable(
     approvedAt: timestamp("approved_at", { withTimezone: true }),
     // The enrollment + sandbox the approve produced (acceptance #2: an enrollment
     // row AND a sandbox row appear). Null until approved.
-    enrollmentId: uuid("enrollment_id").references(() => enrollments.id, { onDelete: "set null" }),
-    sandboxId: uuid("sandbox_id").references(() => sandboxes.id, { onDelete: "set null" }),
+    enrollmentId: uuid("enrollment_id").references(() => enrollments.id, {
+      onDelete: "set null"
+    }),
+    sandboxId: uuid("sandbox_id").references(() => sandboxes.id, {
+      onDelete: "set null"
+    }),
     // The short-TTL expiry; a pending row past this is EXPIRED on poll.
     expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
@@ -1987,7 +2214,9 @@ var sandboxes = pgTable(
     workspaceId: uuid("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
     kind: text("kind", { enum: sandboxKindValues }).notNull(),
     name: text("name").notNull(),
-    enrollmentId: uuid("enrollment_id").references(() => enrollments.id, { onDelete: "set null" }),
+    enrollmentId: uuid("enrollment_id").references(() => enrollments.id, {
+      onDelete: "set null"
+    }),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
@@ -2104,7 +2333,9 @@ var scheduledTaskRuns = pgTable(
     triggerType: text("trigger_type").notNull(),
     scheduledAt: timestamp("scheduled_at", { withTimezone: true }),
     firedAt: timestamp("fired_at", { withTimezone: true }).notNull().defaultNow(),
-    sessionId: uuid("session_id").references(() => sessions.id, { onDelete: "set null" }),
+    sessionId: uuid("session_id").references(() => sessions.id, {
+      onDelete: "set null"
+    }),
     triggerEventId: uuid("trigger_event_id"),
     // Stable Temporal producer identity. Activity replay/re-dispatch returns
     // the exact run instead of allocating a second schedule source row.
@@ -2135,6 +2366,8 @@ var githubInstallations = pgTable(
     installationId: integer("installation_id").notNull(),
     accountLogin: text("account_login"),
     accountType: text("account_type"),
+    repositoryScope: text("repository_scope").notNull().default("all"),
+    linkedBySubjectId: text("linked_by_subject_id"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
   },
@@ -2144,7 +2377,43 @@ var githubInstallations = pgTable(
       table.installationId
     ),
     installation: index("github_installations_installation_idx").on(table.installationId),
-    workspace: index("github_installations_workspace_idx").on(table.workspaceId)
+    workspace: index("github_installations_workspace_idx").on(table.workspaceId),
+    repositoryScopeCheck: check(
+      "github_installations_repository_scope_check",
+      sql`${table.repositoryScope} in ('all', 'selected')`
+    )
+  })
+);
+var githubInstallationRepositories = pgTable(
+  "github_installation_repositories",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    accountId: uuid("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    installationId: integer("installation_id").notNull(),
+    repositoryId: bigint("repository_id", { mode: "number" }).notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    installationRepository: uniqueIndex("github_install_repo_workspace_installation_repo_idx").on(
+      table.workspaceId,
+      table.installationId,
+      table.repositoryId
+    ),
+    workspaceInstallation: index("github_install_repo_workspace_installation_idx").on(
+      table.workspaceId,
+      table.installationId
+    ),
+    workspaceAccount: foreignKey({
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId],
+      name: "github_installation_repositories_workspace_account_fk"
+    }).onDelete("cascade"),
+    installationBinding: foreignKey({
+      columns: [table.workspaceId, table.installationId],
+      foreignColumns: [githubInstallations.workspaceId, githubInstallations.installationId],
+      name: "github_installation_repositories_installation_fk"
+    }).onDelete("cascade")
   })
 );
 var usageEvents = pgTable(
@@ -2159,10 +2428,23 @@ var usageEvents = pgTable(
     unit: text("unit").notNull(),
     sourceResourceType: text("source_resource_type"),
     sourceResourceId: text("source_resource_id"),
+    // Exact execution source for host usage export. These are deliberately
+    // validated soft references rather than cascading foreign keys: usage is
+    // an immutable billing/audit fact and must retain its source identity after
+    // a session or turn is deleted.
+    sessionId: uuid("session_id"),
+    turnId: uuid("turn_id"),
+    turnAttemptId: uuid("turn_attempt_id"),
+    initiatorKind: text("initiator_kind"),
+    initiatorSubjectId: text("initiator_subject_id"),
+    initiatorContext: jsonb("initiator_context").$type().notNull().default({}),
+    origin: text("origin"),
     idempotencyKey: text("idempotency_key").notNull(),
     occurredAt: timestamp("occurred_at", { withTimezone: true }).notNull(),
     recordedAt: timestamp("recorded_at", { withTimezone: true }).notNull().defaultNow(),
-    exportedToBillingAt: timestamp("exported_to_billing_at", { withTimezone: true }),
+    exportedToBillingAt: timestamp("exported_to_billing_at", {
+      withTimezone: true
+    }),
     billingProviderEventId: text("billing_provider_event_id")
   },
   (table) => ({
@@ -2176,6 +2458,186 @@ var usageEvents = pgTable(
       table.accountId,
       table.eventType,
       table.occurredAt
+    ),
+    workspaceSession: index("usage_events_workspace_session_idx").on(
+      table.workspaceId,
+      table.sessionId,
+      table.occurredAt
+    ),
+    contextHierarchy: check(
+      "usage_events_context_hierarchy_check",
+      sql`(${table.turnId} is null or ${table.sessionId} is not null)
+        and (${table.turnAttemptId} is null or ${table.turnId} is not null)`
+    ),
+    initiatorConsistent: check(
+      "usage_events_initiator_check",
+      sql`(${table.initiatorKind} is null and ${table.initiatorSubjectId} is null)
+        or (${table.initiatorKind} in ('subject', 'service')
+          and ${table.initiatorSubjectId} is not null
+          and octet_length(${table.initiatorSubjectId}) between 1 and 1024)`
+    ),
+    attributionContextBytes: check(
+      "usage_events_initiator_context_bytes_check",
+      sql`octet_length(${table.initiatorContext}::text) <= 4096`
+    ),
+    originValid: check(
+      "usage_events_origin_check",
+      sql`${table.origin} is null or ${table.origin} in (
+        'user', 'scheduled_task', 'api', 'goal', 'system', 'compaction'
+      )`
+    )
+  })
+);
+var hostExportConfig = pgTable(
+  "host_export_config",
+  {
+    id: integer("id").primaryKey().default(1),
+    sessionEventsEnabled: boolean("session_events_enabled").notNull().default(false),
+    usageEventsEnabled: boolean("usage_events_enabled").notNull().default(false),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    singleton: check("host_export_config_singleton_check", sql`${table.id} = 1`)
+  })
+);
+var hostExportOutbox = pgTable(
+  "host_export_outbox",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    exportKind: text("export_kind").notNull(),
+    exportCursor: bigint("export_cursor", { mode: "bigint" }),
+    sourceId: uuid("source_id").notNull(),
+    accountId: uuid("account_id").notNull(),
+    workspaceId: uuid("workspace_id").notNull(),
+    sessionId: uuid("session_id"),
+    rootSessionId: uuid("root_session_id"),
+    turnId: uuid("turn_id"),
+    turnGeneration: integer("turn_generation"),
+    turnAttemptId: uuid("turn_attempt_id"),
+    sessionSequence: integer("session_sequence"),
+    clientEventId: text("client_event_id"),
+    turnAssociation: text("turn_association"),
+    duplicateOfEventId: uuid("duplicate_of_event_id"),
+    duplicateReason: text("duplicate_reason"),
+    eventType: text("event_type").notNull(),
+    idempotencyKey: text("idempotency_key").notNull(),
+    initiator: jsonb("initiator").$type(),
+    initiatorContext: jsonb("initiator_context").$type().notNull().default({}),
+    origin: text("origin"),
+    payload: jsonb("payload").$type().notNull(),
+    envelopeBytes: integer("envelope_bytes").notNull(),
+    occurredAt: timestamp("occurred_at", { withTimezone: true }).notNull(),
+    sourceRecordedAt: timestamp("source_recorded_at", { withTimezone: true }).notNull(),
+    enqueuedAt: timestamp("enqueued_at", { withTimezone: true }).notNull()
+  },
+  (table) => ({
+    kindValid: check(
+      "host_export_outbox_kind_check",
+      sql`${table.exportKind} in ('session_event', 'usage_event')`
+    ),
+    sourceUnique: uniqueIndex("host_export_outbox_source_uq").on(table.exportKind, table.sourceId),
+    cursorUnique: uniqueIndex("host_export_outbox_cursor_uq").on(table.exportKind, table.exportCursor).where(sql`${table.exportCursor} is not null`),
+    unassigned: index("host_export_outbox_unassigned_idx").on(table.exportKind, table.enqueuedAt, table.id).where(sql`${table.exportCursor} is null`),
+    unassignedSession: index("host_export_outbox_unassigned_session_idx").on(table.exportKind, table.sessionId, table.sessionSequence).where(sql`${table.exportCursor} is null and ${table.sessionId} is not null`),
+    contextBytes: check(
+      "host_export_outbox_context_bytes_check",
+      sql`octet_length(${table.initiatorContext}::text) <= 4096`
+    ),
+    originValid: check(
+      "host_export_outbox_origin_check",
+      sql`${table.origin} is null or ${table.origin} in (
+        'user', 'scheduled_task', 'api', 'goal', 'system', 'compaction'
+      )`
+    )
+  })
+);
+var hostExportCursorState = pgTable(
+  "host_export_cursor_state",
+  {
+    exportKind: text("export_kind").primaryKey(),
+    nextCursor: bigint("next_cursor", { mode: "bigint" }).notNull().default(1n),
+    prunedThrough: bigint("pruned_through", { mode: "bigint" }).notNull().default(0n),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    kindValid: check(
+      "host_export_cursor_state_kind_check",
+      sql`${table.exportKind} in ('session_event', 'usage_event')`
+    ),
+    cursorValid: check(
+      "host_export_cursor_state_next_check",
+      sql`${table.nextCursor} > 0 and ${table.prunedThrough} >= 0
+        and ${table.prunedThrough} < ${table.nextCursor}`
+    )
+  })
+);
+var hostExportConsumers = pgTable(
+  "host_export_consumers",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    consumerId: text("consumer_id").notNull(),
+    exportKind: text("export_kind").notNull(),
+    checkpoint: bigint("checkpoint", { mode: "bigint" }).notNull().default(0n),
+    enabled: boolean("enabled").notNull().default(true),
+    leaseToken: uuid("lease_token"),
+    leaseHolderId: text("lease_holder_id"),
+    leaseExpiresAt: timestamp("lease_expires_at", { withTimezone: true }),
+    leaseFrom: bigint("lease_from", { mode: "bigint" }),
+    leaseThrough: bigint("lease_through", { mode: "bigint" }),
+    consecutiveFailures: integer("consecutive_failures").notNull().default(0),
+    nextAttemptAt: timestamp("next_attempt_at", { withTimezone: true }).notNull().defaultNow(),
+    lastError: text("last_error"),
+    lastErrorAt: timestamp("last_error_at", { withTimezone: true }),
+    blockedAt: timestamp("blocked_at", { withTimezone: true }),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    consumerKind: uniqueIndex("host_export_consumers_kind_id_uq").on(
+      table.exportKind,
+      table.consumerId
+    ),
+    kindValid: check(
+      "host_export_consumers_kind_check",
+      sql`${table.exportKind} in ('session_event', 'usage_event')`
+    ),
+    checkpointValid: check("host_export_consumers_checkpoint_check", sql`${table.checkpoint} >= 0`),
+    due: index("host_export_consumers_due_idx").on(
+      table.enabled,
+      table.blockedAt,
+      table.nextAttemptAt
+    )
+  })
+);
+var hostExportDeadLetters = pgTable(
+  "host_export_dead_letters",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    consumerId: text("consumer_id").notNull(),
+    exportKind: text("export_kind").notNull(),
+    exportCursor: bigint("export_cursor", { mode: "bigint" }).notNull(),
+    sourceId: uuid("source_id").notNull(),
+    reason: text("reason").notNull(),
+    envelope: jsonb("envelope").$type().notNull(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    consumerCursor: uniqueIndex("host_export_dead_letters_consumer_cursor_uq").on(
+      table.exportKind,
+      table.consumerId,
+      table.exportCursor
+    ),
+    kindValid: check(
+      "host_export_dead_letters_kind_check",
+      sql`${table.exportKind} in ('session_event', 'usage_event')`
+    ),
+    reasonValid: check(
+      "host_export_dead_letters_reason_check",
+      sql`length(${table.reason}) between 1 and 500`
+    ),
+    envelopeBytes: check(
+      "host_export_dead_letters_envelope_bytes_check",
+      sql`pg_column_size(${table.envelope}) <= 114688`
     )
   })
 );
@@ -2184,7 +2646,9 @@ var creditLedgerEntries = pgTable(
   {
     id: uuid("id").primaryKey().defaultRandom(),
     accountId: uuid("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
-    workspaceId: uuid("workspace_id").references(() => workspaces.id, { onDelete: "set null" }),
+    workspaceId: uuid("workspace_id").references(() => workspaces.id, {
+      onDelete: "set null"
+    }),
     type: text("type").notNull(),
     amountMicros: bigint("amount_micros", { mode: "number" }).notNull(),
     currency: text("currency").notNull().default("usd"),
@@ -2237,8 +2701,12 @@ var auditEvents = pgTable(
   "audit_events",
   {
     id: uuid("id").primaryKey().defaultRandom(),
-    accountId: uuid("account_id").references(() => managedAccounts.id, { onDelete: "set null" }),
-    workspaceId: uuid("workspace_id").references(() => workspaces.id, { onDelete: "set null" }),
+    accountId: uuid("account_id").references(() => managedAccounts.id, {
+      onDelete: "set null"
+    }),
+    workspaceId: uuid("workspace_id").references(() => workspaces.id, {
+      onDelete: "set null"
+    }),
     subjectId: text("subject_id"),
     action: text("action").notNull(),
     targetType: text("target_type"),
@@ -2321,8 +2789,12 @@ var capabilityCatalogItems = pgTable(
   "capability_catalog_items",
   {
     id: text("id").notNull(),
-    accountId: uuid("account_id").references(() => managedAccounts.id, { onDelete: "cascade" }),
-    workspaceId: uuid("workspace_id").references(() => workspaces.id, { onDelete: "cascade" }),
+    accountId: uuid("account_id").references(() => managedAccounts.id, {
+      onDelete: "cascade"
+    }),
+    workspaceId: uuid("workspace_id").references(() => workspaces.id, {
+      onDelete: "cascade"
+    }),
     kind: text("kind").notNull(),
     source: text("source").notNull().default("manual"),
     name: text("name").notNull(),
@@ -2555,6 +3027,7 @@ export {
   managedAccounts,
   workspaces,
   workspaceInferenceControls,
+  workspaceSessionActivityRevisions,
   workspaceMemberships,
   apiKeys,
   workspaceVariableSets,
@@ -2589,6 +3062,7 @@ export {
   codexCapacityWaiters,
   sessionEvents,
   agentRunStates,
+  sessionHumanInputRequests,
   sessionHistoryItems,
   sessionPendingToolCalls,
   sandboxSessionEnvelopes,
@@ -2614,7 +3088,13 @@ export {
   scheduledTasks,
   scheduledTaskRuns,
   githubInstallations,
+  githubInstallationRepositories,
   usageEvents,
+  hostExportConfig,
+  hostExportOutbox,
+  hostExportCursorState,
+  hostExportConsumers,
+  hostExportDeadLetters,
   creditLedgerEntries,
   billingCustomers,
   stripeWebhookEvents,
@@ -2631,4 +3111,4 @@ export {
   rigChanges,
   schema_exports
 };
-//# sourceMappingURL=chunk-B22X3IEZ.js.map
+//# sourceMappingURL=chunk-4LG5NBTC.js.map