@opengeni/db 3.8.2-canary.0 → 4.0.0-canary.0

package/dist/{chunk-53A2PEHT.js → chunk-QM6YOWHZ.js}

@@ -161,6 +161,11 @@ __export(schema_exports, {
   managedAuthLoginTransactions: () => managedAuthLoginTransactions,
   managedAuthSessionSetOperations: () => managedAuthSessionSetOperations,
   managedAuthSessionSets: () => managedAuthSessionSets,
+  mcpOauthAccessTokens: () => mcpOauthAccessTokens,
+  mcpOauthAuthorizationCodes: () => mcpOauthAuthorizationCodes,
+  mcpOauthAuthorizationRequests: () => mcpOauthAuthorizationRequests,
+  mcpOauthClients: () => mcpOauthClients,
+  mcpOauthRefreshTokens: () => mcpOauthRefreshTokens,
   memorySlackPublicationConfigurations: () => memorySlackPublicationConfigurations,
   memorySlackPublicationReceipts: () => memorySlackPublicationReceipts,
   memorySlackPublications: () => memorySlackPublications,
@@ -235,6 +240,7 @@ __export(schema_exports, {
   scheduledTasks: () => scheduledTasks,
   sessionAttemptCodemodeCalls: () => sessionAttemptCodemodeCalls,
   sessionAttemptInterruptions: () => sessionAttemptInterruptions,
+  sessionAttemptModelContextSnapshots: () => sessionAttemptModelContextSnapshots,
   sessionAttemptToolCatalogs: () => sessionAttemptToolCatalogs,
   sessionBackgroundCommands: () => sessionBackgroundCommands,
   sessionCommandReceipts: () => sessionCommandReceipts,
@@ -299,6 +305,7 @@ __export(schema_exports, {
   taskNoteWriteCapabilities: () => taskNoteWriteCapabilities,
   taskNotes: () => taskNotes,
   temporalScheduleCleanupOutbox: () => temporalScheduleCleanupOutbox,
+  toolGatewayApprovalCapabilities: () => toolGatewayApprovalCapabilities,
   transcriptionRecordingChunkStateValues: () => transcriptionRecordingChunkStateValues,
   transcriptionRecordingChunks: () => transcriptionRecordingChunks,
   transcriptionRecordingObjectKindValues: () => transcriptionRecordingObjectKindValues,
@@ -6460,7 +6467,12 @@ var workspaceArtifacts = pgTable19(
       table.slug
     ),
     workspaceId: uniqueIndex19("workspace_artifacts_workspace_id_uq").on(table.workspaceId, table.id),
-    list: index19("workspace_artifacts_list_idx").on(table.workspaceId, table.updatedAt)
+    list: index19("workspace_artifacts_list_idx").on(table.workspaceId, table.updatedAt),
+    statusList: index19("workspace_artifacts_status_list_idx").on(
+      table.workspaceId,
+      table.status,
+      table.updatedAt
+    )
   })
 );
 var workspaceArtifactVersions = pgTable19(
@@ -6475,6 +6487,10 @@ var workspaceArtifactVersions = pgTable19(
     contentType: text19("content_type").$type().notNull().default("text/html"),
     contentSha256: text19("content_sha256").notNull(),
     sizeBytes: integer18("size_bytes").notNull(),
+    sourceKey: text19("source_key"),
+    sourceSha256: text19("source_sha256"),
+    sourceSizeBytes: integer18("source_size_bytes"),
+    requestedTools: jsonb15("requested_tools").$type().notNull().default([]),
     operationKey: text19("operation_key").notNull(),
     sourceSessionId: uuid19("source_session_id"),
     sourceTurnId: uuid19("source_turn_id"),
@@ -6534,6 +6550,7 @@ var workspaceArtifactEvents = pgTable19(
     fromVersionId: uuid19("from_version_id"),
     toVersionId: uuid19("to_version_id").notNull(),
     operationKey: text19("operation_key").notNull(),
+    requestDigest: text19("request_digest"),
     sourceSessionId: uuid19("source_session_id"),
     sourceTurnId: uuid19("source_turn_id"),
     sourceAttemptId: uuid19("source_attempt_id"),
@@ -7563,7 +7580,6 @@ var organizationCodexRotationSettings = pgTable19(
     accountId: uuid19("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
     activeCredentialId: uuid19("active_credential_id"),
     rotationEnabled: boolean11("rotation_enabled").notNull().default(false),
-    leaseRotationEnabled: boolean11("lease_rotation_enabled").notNull().default(false),
     rotationStrategy: text19("rotation_strategy").notNull().default("sharded"),
     createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp19("updated_at", { withTimezone: true }).notNull().defaultNow()
@@ -9245,6 +9261,192 @@ var integrationOauthStateNonces = pgTable19(
     expires: index19("integration_oauth_state_nonces_expires_idx").on(table.expiresAt)
   })
 );
+var mcpOauthClients = pgTable19(
+  "mcp_oauth_clients",
+  {
+    clientId: text19("client_id").primaryKey(),
+    redirectUris: jsonb15("redirect_uris").$type().notNull(),
+    clientName: text19("client_name"),
+    tokenEndpointAuthMethod: text19("token_endpoint_auth_method").notNull().default("none"),
+    grantTypes: jsonb15("grant_types").$type().notNull(),
+    responseTypes: jsonb15("response_types").$type().notNull(),
+    registrationScopeHash: text19("registration_scope_hash").notNull(),
+    createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow(),
+    expiresAt: timestamp19("expires_at", { withTimezone: true }).notNull()
+  },
+  (table) => ({
+    created: index19("mcp_oauth_clients_created_idx").on(table.createdAt),
+    scopeCreated: index19("mcp_oauth_clients_scope_created_idx").on(
+      table.registrationScopeHash,
+      table.createdAt
+    ),
+    expires: index19("mcp_oauth_clients_expires_idx").on(table.expiresAt, table.clientId)
+  })
+);
+var mcpOauthGrantColumns = () => ({
+  accountId: uuid19("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
+  workspaceId: uuid19("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+  subjectId: text19("subject_id").notNull(),
+  resource: text19("resource").notNull(),
+  permissions: jsonb15("permissions").$type().notNull(),
+  toolIdentities: jsonb15("tool_identities").$type().notNull()
+});
+var mcpOauthAuthorizationRequests = pgTable19(
+  "mcp_oauth_authorization_requests",
+  {
+    requestHash: text19("request_hash").primaryKey(),
+    clientId: text19("client_id").notNull().references(() => mcpOauthClients.clientId, { onDelete: "cascade" }),
+    ...mcpOauthGrantColumns(),
+    redirectUri: text19("redirect_uri").notNull(),
+    codeChallenge: text19("code_challenge").notNull(),
+    state: text19("state"),
+    expiresAt: timestamp19("expires_at", { withTimezone: true }).notNull(),
+    createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    workspaceAccount: foreignKey({
+      name: "mcp_oauth_authorization_requests_workspace_account_fk",
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId]
+    }).onDelete("cascade"),
+    expires: index19("mcp_oauth_authorization_requests_expires_idx").on(table.expiresAt)
+  })
+);
+var mcpOauthAuthorizationCodes = pgTable19(
+  "mcp_oauth_authorization_codes",
+  {
+    codeHash: text19("code_hash").primaryKey(),
+    clientId: text19("client_id").notNull().references(() => mcpOauthClients.clientId, { onDelete: "cascade" }),
+    ...mcpOauthGrantColumns(),
+    redirectUri: text19("redirect_uri").notNull(),
+    codeChallenge: text19("code_challenge").notNull(),
+    expiresAt: timestamp19("expires_at", { withTimezone: true }).notNull(),
+    createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    workspaceAccount: foreignKey({
+      name: "mcp_oauth_authorization_codes_workspace_account_fk",
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId]
+    }).onDelete("cascade"),
+    expires: index19("mcp_oauth_authorization_codes_expires_idx").on(table.expiresAt)
+  })
+);
+var mcpOauthRefreshTokens = pgTable19(
+  "mcp_oauth_refresh_tokens",
+  {
+    tokenHash: text19("token_hash").primaryKey(),
+    familyId: uuid19("family_id").notNull(),
+    generation: integer18("generation").notNull(),
+    clientId: text19("client_id").notNull().references(() => mcpOauthClients.clientId, { onDelete: "cascade" }),
+    ...mcpOauthGrantColumns(),
+    expiresAt: timestamp19("expires_at", { withTimezone: true }).notNull(),
+    revokedAt: timestamp19("revoked_at", { withTimezone: true }),
+    createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    workspaceAccount: foreignKey({
+      name: "mcp_oauth_refresh_tokens_workspace_account_fk",
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId]
+    }).onDelete("cascade"),
+    familyGeneration: uniqueIndex19("mcp_oauth_refresh_tokens_family_generation_uq").on(
+      table.familyId,
+      table.generation
+    ),
+    expires: index19("mcp_oauth_refresh_tokens_expires_idx").on(table.expiresAt)
+  })
+);
+var mcpOauthAccessTokens = pgTable19(
+  "mcp_oauth_access_tokens",
+  {
+    tokenHash: text19("token_hash").primaryKey(),
+    refreshFamilyId: uuid19("refresh_family_id").notNull(),
+    refreshGeneration: integer18("refresh_generation").notNull(),
+    clientId: text19("client_id").notNull().references(() => mcpOauthClients.clientId, { onDelete: "cascade" }),
+    ...mcpOauthGrantColumns(),
+    expiresAt: timestamp19("expires_at", { withTimezone: true }).notNull(),
+    revokedAt: timestamp19("revoked_at", { withTimezone: true }),
+    createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    workspaceAccount: foreignKey({
+      name: "mcp_oauth_access_tokens_workspace_account_fk",
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId]
+    }).onDelete("cascade"),
+    family: index19("mcp_oauth_access_tokens_family_idx").on(
+      table.refreshFamilyId,
+      table.refreshGeneration
+    ),
+    expires: index19("mcp_oauth_access_tokens_expires_idx").on(table.expiresAt)
+  })
+);
+var toolGatewayApprovalCapabilities = pgTable19(
+  "tool_gateway_approval_capabilities",
+  {
+    tokenHash: text19("token_hash").primaryKey(),
+    accountId: uuid19("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
+    workspaceId: uuid19("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
+    subjectId: text19("subject_id").notNull(),
+    operationId: uuid19("operation_id").notNull(),
+    catalogDigest: text19("catalog_digest").notNull(),
+    serverId: text19("server_id").notNull(),
+    toolName: text19("tool_name").notNull(),
+    argumentsDigest: text19("arguments_digest").notNull(),
+    authorityDigest: text19("authority_digest").notNull(),
+    expiresAt: timestamp19("expires_at", { withTimezone: true }).notNull(),
+    consumedAt: timestamp19("consumed_at", { withTimezone: true }),
+    createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow()
+  },
+  (table) => ({
+    workspaceAccount: foreignKey({
+      name: "tool_gateway_approval_capabilities_workspace_account_fk",
+      columns: [table.workspaceId, table.accountId],
+      foreignColumns: [workspaces.id, workspaces.accountId]
+    }).onDelete("cascade"),
+    operation: uniqueIndex19("tool_gateway_approval_capabilities_operation_uq").on(
+      table.workspaceId,
+      table.subjectId,
+      table.operationId
+    ),
+    expires: index19("tool_gateway_approval_capabilities_expires_idx").on(
+      table.expiresAt,
+      table.tokenHash
+    ),
+    liveSubjectExpiry: index19("tool_gateway_approval_capabilities_live_subject_expiry_idx").on(table.workspaceId, table.subjectId, table.expiresAt, table.tokenHash).where(sql16`${table.consumedAt} is null`),
+    tokenHashValid: check11(
+      "tool_gateway_approval_capabilities_token_hash_chk",
+      sql16`${table.tokenHash} ~ '^[0-9a-f]{64}$'`
+    ),
+    catalogDigestValid: check11(
+      "tool_gateway_approval_capabilities_catalog_digest_chk",
+      sql16`${table.catalogDigest} ~ '^[0-9a-f]{64}$'`
+    ),
+    argumentsDigestValid: check11(
+      "tool_gateway_approval_capabilities_arguments_digest_chk",
+      sql16`${table.argumentsDigest} ~ '^[0-9a-f]{64}$'`
+    ),
+    authorityDigestValid: check11(
+      "tool_gateway_approval_capabilities_authority_digest_chk",
+      sql16`${table.authorityDigest} ~ '^[0-9a-f]{64}$'`
+    ),
+    subjectValid: check11(
+      "tool_gateway_approval_capabilities_subject_chk",
+      sql16`length(btrim(${table.subjectId})) between 1 and 1024`
+    ),
+    identityValid: check11(
+      "tool_gateway_approval_capabilities_identity_chk",
+      sql16`length(${table.serverId}) between 1 and 256
+        and length(${table.toolName}) between 1 and 512`
+    ),
+    expiryValid: check11(
+      "tool_gateway_approval_capabilities_expiry_chk",
+      sql16`${table.expiresAt} > ${table.createdAt}
+        and ${table.expiresAt} <= ${table.createdAt} + interval '10 minutes'`
+    )
+  })
+);
 var codexRotationSettings = pgTable19(
   "codex_rotation_settings",
   {
@@ -9252,14 +9454,10 @@ var codexRotationSettings = pgTable19(
     accountId: uuid19("account_id").notNull().references(() => managedAccounts.id, { onDelete: "cascade" }),
     workspaceId: uuid19("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
     activeCredentialId: uuid19("active_credential_id"),
-    // Legacy selector bit. Keep false as the DB default forever: an old worker
-    // only understands this column, so a schema-first rollout or binary
-    // rollback must never make it enter the non-atomic rotation path.
+    // User-owned account-selection policy. When false, every new turn may lease
+    // only the active credential and waits if that credential is unavailable.
+    // When true, the allocator may choose another eligible account.
     rotationEnabled: boolean11("rotation_enabled").notNull().default(false),
-    // Revision-aware allocator cutover. Only migration-compatible API/worker
-    // code reads this bit; old binaries safely ignore it and keep the legacy
-    // pin/rotation policy.
-    leaseRotationEnabled: boolean11("lease_rotation_enabled").notNull().default(false),
     rotationStrategy: text19("rotation_strategy").notNull().default("sharded"),
     // sharded-rotation policy: legacy residue; behavior is always sharded
     createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow(),
@@ -9292,9 +9490,12 @@ var codexCredentialLeases = pgTable19(
     workspaceId: uuid19("workspace_id").notNull().references(() => workspaces.id, { onDelete: "cascade" }),
     credentialId: uuid19("credential_id").notNull(),
     turnId: uuid19("turn_id").notNull(),
-    // Temporal activity execution fence. A successor dispatch for the same
-    // durable turn replaces holderId and increments generation atomically;
-    // stale/zombie heartbeats and releases must match both values.
+    // Durable turn-attempt fence. The worker holder includes the
+    // durable workflow turn-attempt identity; dispatchId remains a separate
+    // attempt/audit identity. A successor dispatch for the same durable turn
+    // replaces holderId and increments generation atomically; stale/zombie
+    // heartbeats and releases must match both values. Generation may restart
+    // at 1 after an expired row is reaped, so holder identity cannot be reused.
     holderId: text19("holder_id").notNull(),
     generation: integer18("generation").notNull().default(1),
     leasedUntil: timestamp19("leased_until", { withTimezone: true }).notNull(),
@@ -9307,7 +9508,6 @@ var codexCredentialLeases = pgTable19(
       table.turnId
     ),
     activeCredential: index19("codex_credential_leases_active_credential_idx").on(
-      table.workspaceId,
       table.credentialId,
       table.leasedUntil
     ),
@@ -9662,6 +9862,14 @@ var sessions = pgTable19(
     nestedAgentDepthPolicySessionId: uuid19("nested_agent_depth_policy_session_id"),
     temporalWorkflowId: text19("temporal_workflow_id"),
     activeTurnId: uuid19("active_turn_id"),
+    // Session-scoped out-of-turn wait (`wait_for_input`). The exact declaring
+    // turn and absolute deadline are durable PostgreSQL authority; workflow
+    // signals and timers only nudge reevaluation. A newer finished turn or a
+    // terminal timeout input retires all four fields together.
+    inputWaitTurnId: uuid19("input_wait_turn_id"),
+    inputWaitUntil: timestamp19("input_wait_until", { withTimezone: true }),
+    inputWaitReason: text19("input_wait_reason"),
+    inputWaitSetAt: timestamp19("input_wait_set_at", { withTimezone: true }),
     // Actual input tokens reported for the latest authoritative ordinary model
     // call. Compaction/context clearing invalidates it to null; local history
     // estimates must never be stored here.
@@ -9814,6 +10022,21 @@ var sessions = pgTable19(
       "sessions_initial_model_context_check",
       sql16`${table.initialModelContext} is null
         or opengeni_private.model_context_value_valid(${table.initialModelContext})`
+    ),
+    inputWaitValid: check11(
+      "sessions_input_wait_check",
+      sql16`(
+          ${table.inputWaitTurnId} is null
+          and ${table.inputWaitUntil} is null
+          and ${table.inputWaitReason} is null
+          and ${table.inputWaitSetAt} is null
+        ) or (
+          ${table.inputWaitTurnId} is not null
+          and ${table.inputWaitUntil} is not null
+          and ${table.inputWaitReason} is not null
+          and octet_length(btrim(${table.inputWaitReason})) between 1 and 2048
+          and ${table.inputWaitSetAt} is not null
+        )`
     )
   })
 );
@@ -12151,6 +12374,58 @@ var sessionAttemptToolCatalogs = pgTable19(
     )
   })
 );
+var sessionAttemptModelContextSnapshots = pgTable19(
+  "session_attempt_model_context_snapshots",
+  {
+    attemptId: uuid19("attempt_id").primaryKey(),
+    accountId: uuid19("account_id").notNull(),
+    workspaceId: uuid19("workspace_id").notNull(),
+    sessionId: uuid19("session_id").notNull(),
+    turnId: uuid19("turn_id").notNull(),
+    executionGeneration: integer18("execution_generation").notNull(),
+    requestIndex: integer18("request_index").notNull(),
+    capturedAt: timestamp19("captured_at", { withTimezone: true }).notNull(),
+    snapshot: jsonb15("snapshot").$type().notNull(),
+    createdAt: timestamp19("created_at", { withTimezone: true }).notNull(),
+    updatedAt: timestamp19("updated_at", { withTimezone: true }).notNull()
+  },
+  (table) => ({
+    attemptOwner: foreignKey({
+      name: "session_attempt_model_context_snapshots_attempt_owner_fk",
+      columns: [table.accountId, table.workspaceId, table.sessionId, table.turnId, table.attemptId],
+      foreignColumns: [
+        sessionTurnAttempts.accountId,
+        sessionTurnAttempts.workspaceId,
+        sessionTurnAttempts.sessionId,
+        sessionTurnAttempts.turnId,
+        sessionTurnAttempts.id
+      ]
+    }).onDelete("cascade"),
+    sessionLatest: index19("session_attempt_model_context_snapshots_session_idx").on(
+      table.workspaceId,
+      table.sessionId,
+      table.capturedAt.desc()
+    ),
+    requestIndexValid: check11(
+      "session_attempt_model_context_snapshots_request_index_check",
+      sql16`${table.requestIndex} > 0 and ${table.executionGeneration} > 0`
+    ),
+    snapshotSize: check11(
+      "session_attempt_model_context_snapshots_size_check",
+      sql16`octet_length(${table.snapshot}::text) between 2 and 16777216`
+    ),
+    snapshotIdentity: check11(
+      "session_attempt_model_context_snapshots_identity_check",
+      sql16`jsonb_typeof(${table.snapshot}) = 'object'
+        and ${table.snapshot} ?& array['version', 'capturedAt', 'source', 'requestIndex', 'instructions', 'layers', 'tools', 'skills', 'tokens']::text[]
+        and (${table.snapshot}->>'version')::integer = 1
+        and ${table.snapshot}->>'source' = 'model_request'
+        and jsonb_typeof(${table.snapshot}->'layers') = 'array'
+        and jsonb_typeof(${table.snapshot}->'tools') = 'array'
+        and jsonb_typeof(${table.snapshot}->'skills') = 'array'`
+    )
+  })
+);
 var sessionAttemptCodemodeCalls = pgTable19(
   "session_attempt_codemode_calls",
   {
@@ -12470,6 +12745,7 @@ var sessionCommandReceipts = pgTable19(
       table.operationKey
     ).where(sql16`${table.action} in ('prompt.send', 'prompt.steer')`),
     goalUpdateOperation: uniqueIndex19("session_command_receipts_goal_update_operation_uq").on(table.workspaceId, table.action, table.targetSessionId, table.operationKey).where(sql16`${table.action} = 'goal.update'`),
+    waitForInputOperation: uniqueIndex19("session_command_receipts_wait_for_input_operation_uq").on(table.workspaceId, table.action, table.targetSessionId, table.operationKey).where(sql16`${table.action} = 'session.wait_for_input'`),
     actorValid: check11(
       "session_command_receipts_actor_check",
       sql16`(
@@ -12714,7 +12990,7 @@ var sessionSystemUpdates = pgTable19(
   (table) => ({
     kindValid: check11(
       "system_updates_kind_check",
-      sql16`${table.kind} in ('scheduled_occurrence', 'goal_continuation', 'agent_message', 'agent_steer_instruction', 'child_terminal_result', 'media_generation_result', 'child_requires_action', 'child_requires_action_resolved', 'child_paused', 'child_waiting_capacity', 'child_progress')`
+      sql16`${table.kind} in ('scheduled_occurrence', 'goal_continuation', 'agent_message', 'agent_steer_instruction', 'session_wait_timeout', 'background_command_result', 'child_terminal_result', 'media_generation_result', 'child_requires_action', 'child_requires_action_resolved', 'child_paused', 'child_waiting_capacity', 'child_progress')`
     ),
     payloadKindValid: check11(
       "system_updates_payload_kind_check",
@@ -12885,19 +13161,10 @@ var sessionGoals = pgTable19(
     continuationObservedRevision: bigint14("continuation_observed_revision", {
       mode: "number"
     }).notNull().default(0),
-    // Agent-declared continuation hold (`goal_wait`, migration 0317). Honored
-    // only while `continuationHoldTurnId` is still the latest finished turn and
-    // the deadline has not passed; it never consumes the wake/observed ledger.
-    // Any newer finished turn, a passed deadline, or a goal mutation clears all
-    // four columns together.
-    continuationHoldTurnId: uuid19("continuation_hold_turn_id"),
-    continuationHoldUntil: timestamp19("continuation_hold_until", {
-      withTimezone: true
-    }),
-    continuationHoldReason: text19("continuation_hold_reason"),
-    continuationHoldSetAt: timestamp19("continuation_hold_set_at", {
-      withTimezone: true
-    }),
+    // A terminal condition can keep the goal active while making unchanged
+    // autonomous input unsafe. The fence is honored only while this remains
+    // the newest finished turn; newer work or a goal mutation clears it.
+    continuationSuppressedTurnId: uuid19("continuation_suppressed_turn_id"),
     metadata: jsonb15("metadata").$type().notNull().default({}),
     createdAt: timestamp19("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp19("updated_at", { withTimezone: true }).notNull().defaultNow()
@@ -12915,10 +13182,6 @@ var sessionGoals = pgTable19(
     continuationRevisionValid: check11(
       "session_goals_continuation_revision_check",
       sql16`${table.continuationWakeRevision} >= 0 and ${table.continuationObservedRevision} >= 0 and ${table.continuationObservedRevision} <= ${table.continuationWakeRevision} and ${table.continuationWakeRevision} <= 9007199254740991 and ${table.continuationObservedRevision} <= 9007199254740991`
-    ),
-    continuationHoldValid: check11(
-      "session_goals_continuation_hold_check",
-      sql16`(${table.continuationHoldTurnId} is null and ${table.continuationHoldUntil} is null and ${table.continuationHoldReason} is null and ${table.continuationHoldSetAt} is null) or (${table.continuationHoldTurnId} is not null and ${table.continuationHoldUntil} is not null and ${table.continuationHoldSetAt} is not null and (${table.continuationHoldReason} is null or octet_length(${table.continuationHoldReason}) <= 2048))`
     )
   })
 );
@@ -13032,7 +13295,7 @@ var codexCapacityWaiters = pgTable19(
     earliestResetAt: timestamp19("earliest_reset_at", { withTimezone: true }),
     nextCheckAt: timestamp19("next_check_at", { withTimezone: true }).notNull(),
     resetKind: text19("reset_kind").notNull(),
-    // authoritative | bounded_refresh
+    // authoritative | bounded_refresh | mutation_only
     refreshAttempt: integer18("refresh_attempt").notNull().default(0),
     // Coalescing outbox generation. Every eligibility-affecting mutation bumps
     // wakeRevision. Duplicate/lost Temporal signals are harmless because only
@@ -17664,6 +17927,12 @@ export {
   slackBotDeleteOperations,
   integrationOauthClients,
   integrationOauthStateNonces,
+  mcpOauthClients,
+  mcpOauthAuthorizationRequests,
+  mcpOauthAuthorizationCodes,
+  mcpOauthRefreshTokens,
+  mcpOauthAccessTokens,
+  toolGatewayApprovalCapabilities,
   codexRotationSettings,
   workspaceModelPolicies,
   codexCredentialLeases,
@@ -17706,6 +17975,7 @@ export {
   turnConnectionAuthoritySnapshots,
   connectionUseAuditFacts,
   sessionAttemptToolCatalogs,
+  sessionAttemptModelContextSnapshots,
   sessionAttemptCodemodeCalls,
   connectorActionRequests,
   sessionCommandReceipts,
@@ -17822,4 +18092,4 @@ export {
   organizationModelProviderCustomModels,
   schema_exports
 };
-//# sourceMappingURL=chunk-53A2PEHT.js.map
+//# sourceMappingURL=chunk-QM6YOWHZ.js.map