@aexhq/sdk 0.50.0 → 0.51.0

package/dist/generated/models.d.ts

@@ -0,0 +1,1392 @@
+/**
+ * The public wire model types used by the generated SDK resources.
+ *
+ * These declarations and identifier utilities are projected from the same
+ * authored contract as `@aexhq/wire`, but carry no runtime validator dependency.
+ */
+export declare const ID_PREFIXES: {
+    readonly user: "usr";
+    readonly organization: "org";
+    readonly membership: "mem";
+    readonly invitation: "inv";
+    readonly workspace: "wsp";
+    readonly api_key: "key";
+    readonly provider_credential: "pcr";
+    readonly session: "ses";
+    readonly message: "msg";
+    readonly agent: "agt";
+    readonly tool_call: "tcl";
+    readonly operation: "op";
+    readonly approval: "apr";
+    readonly generation: "gen";
+    readonly file_upload: "ful";
+    readonly file_download: "fdl";
+    readonly observation: "obs";
+    readonly telemetry_batch: "bch";
+    readonly telemetry_gap: "gap";
+    readonly export: "exp";
+    readonly upload: "upl";
+    readonly measurement: "msr";
+    readonly statement: "stm";
+};
+export type IdKind = keyof typeof ID_PREFIXES;
+export type Id<K extends IdKind = IdKind> = `${(typeof ID_PREFIXES)[K]}_${string}`;
+export declare const ID_KINDS: readonly ("message" | "user" | "organization" | "membership" | "invitation" | "workspace" | "api_key" | "provider_credential" | "session" | "agent" | "tool_call" | "operation" | "approval" | "generation" | "file_upload" | "file_download" | "observation" | "telemetry_batch" | "telemetry_gap" | "export" | "upload" | "measurement" | "statement")[];
+export declare function idPatternSource(kind: IdKind): string;
+export declare function idPattern(kind: IdKind): RegExp;
+export declare function isId<K extends IdKind>(kind: K, value: unknown): value is Id<K>;
+export declare function assertId<K extends IdKind>(kind: K, value: unknown, label?: string): Id<K>;
+export declare function newId<K extends IdKind>(kind: K): Id<K>;
+export type JsonValue = null | boolean | number | string | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+/** An account in good standing. */
+export interface AccountActiveState {
+    readonly changedAt: string;
+    readonly revision: number;
+}
+/** Whether the account may consume paid capacity. */
+export type AccountOperationalState = (AccountActiveState & {
+    readonly status: "active";
+}) | (AccountPausedState & {
+    readonly status: "paused";
+});
+/** Why an account is paused, and therefore which remedy exists. One value per durable `finance.billing_account.state` hold: collapsing all four onto `top_up_required` told a customer under a dispute hold to make a payment that would not restore service. */
+export type AccountPauseReason = "top_up_required" | "payment_hold" | "dispute_hold" | "account_closed";
+/** A paused account and what it takes to restore it. */
+export interface AccountPausedState {
+    readonly changedAt: string;
+    readonly deletionScheduledAt?: string;
+    readonly minimumRestoreCents?: string;
+    readonly reason: AccountPauseReason;
+    readonly retentionFundedUntil?: string;
+    readonly revision: number;
+}
+/** The one error envelope every failing request returns. */
+export interface ApiError {
+    readonly error: ApiErrorBody;
+}
+/** The failure itself. */
+export interface ApiErrorBody {
+    readonly code: "unauthenticated" | "forbidden" | "insufficient_scope" | "token_invalid" | "token_revoked" | "token_expired" | "malformed_token" | "authorization_pending" | "slow_down" | "not_found" | "gone" | "idempotency_conflict" | "idempotency_in_flight" | "api_key_secret_unavailable" | "operation_idempotency_conflict" | "invalid_request" | "invalid_scope" | "invalid_cursor" | "invalid_file_selection" | "invalid_range" | "unsupported_media_type" | "payload_too_large" | "limit_exceeded" | "session_not_idle" | "session_terminated" | "workspace_activation_required" | "workspace_not_live" | "session_deleting" | "session_deleted" | "deletion_in_progress" | "resource_conflict" | "last_owner_required" | "operation_not_cancelable" | "approval_not_found" | "approval_already_resolved" | "approval_binding_changed" | "file_not_found" | "content_missing" | "export_not_found" | "export_not_ready" | "export_expired" | "export_revoked" | "export_capacity" | "download_grant_expired" | "telemetry_payload_too_large" | "invalid_telemetry" | "telemetry_quota_exceeded" | "telemetry_incomplete" | "unsupported_export_signal" | "invalid_query" | "telemetry_query_budget_exhausted" | "invalid_metric_aggregation" | "invalid_network_policy" | "unsupported_package_ecosystem" | "package_resolution_failed" | "package_artifact_unavailable" | "package_integrity_mismatch" | "unknown_provider" | "unknown_model" | "unqualified_provider_model" | "provider_credential_not_found" | "provider_credential_revoked" | "invalid_auto_topup_policy" | "payment_method_required" | "authentication_unavailable" | "account_paused" | "account_state_unavailable" | "precondition_failed" | "wrong_workspace_region" | "observability_unavailable" | "usage_unavailable" | "rate_limited" | "upstream_error" | "workspace_provision_pending" | "commit_outcome_unknown" | "not_implemented" | "internal_error";
+    readonly details?: ErrorDetails;
+    readonly message: string;
+    readonly operationId?: Id<"operation">;
+    readonly requestId: string;
+    readonly retryable: boolean;
+}
+/** Workspace API key metadata. There is no public last-used timestamp. */
+export interface ApiKey {
+    readonly createdAt: string;
+    readonly id: Id<"api_key">;
+    readonly name: string;
+    readonly revokedAt?: string;
+    readonly scopes: ReadonlyArray<"account:read" | "account:write" | "organizations:read" | "organizations:write" | "memberships:read" | "memberships:write" | "memberships:accept" | "workspaces:read" | "workspaces:write" | "workspaces:delete" | "api_keys:read" | "api_keys:write" | "billing:read" | "billing:write" | "operations:read" | "operations:write" | "workspace:read" | "sessions:read" | "sessions:write" | "sessions:delete" | "files:live" | "resources:read" | "resources:write" | "provider_credentials:read" | "provider_credentials:write" | "telemetry:read" | "telemetry:write">;
+    readonly workspaceId: Id<"workspace">;
+}
+/** Mint a workspace API key. */
+export interface ApiKeyCreateRequest {
+    readonly name: string;
+    readonly scopes: ReadonlyArray<"account:read" | "account:write" | "organizations:read" | "organizations:write" | "memberships:read" | "memberships:write" | "memberships:accept" | "workspaces:read" | "workspaces:write" | "workspaces:delete" | "api_keys:read" | "api_keys:write" | "billing:read" | "billing:write" | "operations:read" | "operations:write" | "workspace:read" | "sessions:read" | "sessions:write" | "sessions:delete" | "files:live" | "resources:read" | "resources:write" | "provider_credentials:read" | "provider_credentials:write" | "telemetry:read" | "telemetry:write">;
+    readonly workspaceId: Id<"workspace">;
+}
+/** One page of API key metadata. */
+export interface ApiKeyPage {
+    readonly items: ReadonlyArray<ApiKey>;
+    readonly nextCursor?: string;
+}
+/** The complete automatic top-up policy. */
+export interface AutoTopupPolicy {
+    readonly amountCents: string;
+    readonly enabled: boolean;
+    readonly organizationId: Id<"organization">;
+    readonly revision: number;
+    readonly thresholdCents: string;
+    readonly updatedAt: string;
+}
+/** Replace the automatic top-up policy; every field is required. */
+export interface AutoTopupPolicyRequest {
+    readonly amountCents: string;
+    readonly enabled: boolean;
+    readonly thresholdCents: string;
+}
+/** The prepaid balance of one organization. */
+export interface BillingBalance {
+    readonly availableCents: string;
+    readonly currency: Currency;
+    readonly operationalState: AccountOperationalState;
+    readonly organizationId: Id<"organization">;
+    readonly pendingCents: string;
+    readonly reservedCents: string;
+    readonly revision: number;
+    readonly updatedAt: string;
+}
+/** How inline blob bytes are encoded. */
+export type BlobEncoding = "utf8" | "base64";
+/** A small value carried in the request. */
+export interface BlobInline {
+    readonly data: string;
+    readonly encoding: BlobEncoding;
+    readonly sha256: string;
+}
+/** Where a registered value's bytes come from. */
+export type BlobInput = (BlobInline & {
+    readonly type: "inline";
+}) | (BlobUpload & {
+    readonly type: "upload";
+});
+/** A large value staged through the upload surface. */
+export interface BlobUpload {
+    readonly sha256: string;
+    readonly sizeBytes: string;
+    readonly uploadId: Id<"upload">;
+}
+/** An explicit inclusive byte range over an immutable object. */
+export interface ByteRange {
+    readonly endInclusive: string;
+    readonly start: string;
+}
+/** One resolved compute dimension. */
+export interface ComputeShape {
+    readonly memoryMiB: number;
+    readonly vcpus: number;
+}
+/** A reference to a stored payload. The bytes are never published in a registry response; they are reached through a download grant. */
+export interface ContentRef {
+    readonly sha256: string;
+    readonly sizeBytes: string;
+}
+/** The only supported currency. */
+export type Currency = "USD";
+/** The one bounded read that fills the dashboard shell. */
+export interface DashboardBootstrap {
+    readonly accounts: ReadonlyArray<OrganizationAccount>;
+    readonly email: string;
+    readonly generatedAt: string;
+    readonly organizations: ReadonlyArray<Organization>;
+    readonly userId: Id<"user">;
+    readonly workspaces: ReadonlyArray<Workspace>;
+}
+/** A minted browser session, returned exactly once. */
+export interface DashboardSessionCredential {
+    readonly expiresAt: string;
+    readonly session: string;
+    readonly userId: Id<"user">;
+}
+/** Complete a browser sign-in by handing this plane the authorization code a provider redirect returned. `central-identity-api` performs the token exchange with the provider itself, so nothing the caller asserts about who they are is believed: the person is whoever the provider answers with. */
+export interface DashboardSessionRequest {
+    readonly code: string;
+    readonly codeVerifier: string;
+    readonly provider: IdentityProvider;
+    readonly state: string;
+}
+/** A session whose irreversible deletion is running; rendered at 410. */
+export interface DeletingSession {
+    readonly id: Id<"session">;
+    readonly operationId: Id<"operation">;
+    readonly startedAt: string;
+    readonly workspaceId: Id<"workspace">;
+}
+/** A pending device authorization the user must approve in a browser. */
+export interface DeviceAuthorization {
+    readonly deviceCode: string;
+    readonly expiresAt: string;
+    readonly intervalSeconds: number;
+    readonly userCode: string;
+    readonly verificationUri: string;
+    readonly verificationUriComplete: string;
+}
+/** Begin the CLI device-authorization flow. */
+export interface DeviceAuthorizationRequest {
+    readonly clientId: string;
+    readonly scopes: ReadonlyArray<"account:read" | "account:write" | "organizations:read" | "organizations:write" | "memberships:read" | "memberships:write" | "memberships:accept" | "workspaces:read" | "workspaces:write" | "workspaces:delete" | "api_keys:read" | "api_keys:write" | "billing:read" | "billing:write" | "operations:read" | "operations:write" | "workspace:read" | "sessions:read" | "sessions:write" | "sessions:delete" | "files:live" | "resources:read" | "resources:write" | "provider_credentials:read" | "provider_credentials:write" | "telemetry:read" | "telemetry:write">;
+}
+/** What a person chose about a device authorization. */
+export type DeviceDecision = "approve" | "deny";
+/** Approve or deny a pending device authorization by its user code. */
+export interface DeviceDecisionRequest {
+    readonly decision: DeviceDecision;
+    readonly userCode: string;
+}
+/** The recorded outcome of a device decision. */
+export interface DeviceDecisionResult {
+    readonly decidedAt: string;
+    readonly decision: DeviceDecision;
+    readonly scopes: ReadonlyArray<"account:read" | "account:write" | "organizations:read" | "organizations:write" | "memberships:read" | "memberships:write" | "memberships:accept" | "workspaces:read" | "workspaces:write" | "workspaces:delete" | "api_keys:read" | "api_keys:write" | "billing:read" | "billing:write" | "operations:read" | "operations:write" | "workspace:read" | "sessions:read" | "sessions:write" | "sessions:delete" | "files:live" | "resources:read" | "resources:write" | "provider_credentials:read" | "provider_credentials:write" | "telemetry:read" | "telemetry:write">;
+}
+/** An issued account token. */
+export interface DeviceToken {
+    readonly accountToken: string;
+    readonly expiresAt: string;
+    readonly scopes: ReadonlyArray<"account:read" | "account:write" | "organizations:read" | "organizations:write" | "memberships:read" | "memberships:write" | "memberships:accept" | "workspaces:read" | "workspaces:write" | "workspaces:delete" | "api_keys:read" | "api_keys:write" | "billing:read" | "billing:write" | "operations:read" | "operations:write" | "workspace:read" | "sessions:read" | "sessions:write" | "sessions:delete" | "files:live" | "resources:read" | "resources:write" | "provider_credentials:read" | "provider_credentials:write" | "telemetry:read" | "telemetry:write">;
+}
+/** Exchange an approved device code for an account token. */
+export interface DeviceTokenRequest {
+    readonly clientId: string;
+    readonly deviceCode: string;
+}
+/** A short-lived signed grant for exactly one object and range. */
+export interface DownloadGrant {
+    readonly authorizedBytes: string;
+    readonly expiresAt: string;
+    readonly measurementId: Id<"measurement">;
+    readonly range?: ByteRange;
+    readonly sha256: string;
+    readonly sizeBytes: string;
+    readonly url: string;
+}
+/** One effective workspace safety limit. There is no public mutation route. */
+export interface EffectiveWorkspaceLimit {
+    readonly changedAt: string;
+    readonly effectiveValue: LimitValue;
+    readonly id: "context.tool_result_bytes" | "session.materialized_agents" | "session.initial_files_bytes" | "session.initial_files_count" | "session.agent_execution" | "session.run_budget" | "api.json_body" | "telemetry.batch" | "telemetry.ingest_rate" | "telemetry.metric_series" | "query.filter" | "query.page" | "stream.frame" | "metric.aggregate" | "registry.entries" | "registry.value_bytes" | "telemetry.export";
+    readonly revision: number;
+    readonly source: LimitSource;
+}
+/** One page of effective workspace limits. */
+export interface EffectiveWorkspaceLimitPage {
+    readonly items: ReadonlyArray<EffectiveWorkspaceLimit>;
+    readonly nextCursor?: string;
+}
+/** A body that carries no fields; still strict, so an extra member is rejected. */
+export type EmptyRequest = Readonly<Record<string, never>>;
+/** Closed, typed remediation detail; never an untyped bag. */
+export type ErrorDetails = (ErrorDetailsRequiredScope & {
+    readonly type: "required_scope";
+}) | (ErrorDetailsLimit & {
+    readonly type: "limit";
+}) | (ErrorDetailsQuota & {
+    readonly type: "quota";
+}) | (ErrorDetailsRegion & {
+    readonly type: "region";
+}) | (ErrorDetailsRetry & {
+    readonly type: "retry";
+}) | (ErrorDetailsOperation & {
+    readonly type: "operation";
+}) | (ErrorDetailsValidation & {
+    readonly type: "validation";
+}) | (ErrorDetailsGap & {
+    readonly type: "gap";
+});
+/** The telemetry gaps that blocked a completeness requirement. */
+export interface ErrorDetailsGap {
+    readonly gapIds: ReadonlyArray<Id<"telemetry_gap">>;
+}
+/** The effective limit that was exceeded. */
+export interface ErrorDetailsLimit {
+    readonly effective: string;
+    readonly limit: "context.tool_result_bytes" | "session.materialized_agents" | "session.initial_files_bytes" | "session.initial_files_count" | "session.agent_execution" | "session.run_budget" | "api.json_body" | "telemetry.batch" | "telemetry.ingest_rate" | "telemetry.metric_series" | "query.filter" | "query.page" | "stream.frame" | "metric.aggregate" | "registry.entries" | "registry.value_bytes" | "telemetry.export";
+    readonly measured: string;
+}
+/** The original operation the replay resolved to. */
+export interface ErrorDetailsOperation {
+    readonly operationId: Id<"operation">;
+}
+/** The quota dimension that was exhausted. */
+export interface ErrorDetailsQuota {
+    readonly attempted: string;
+    readonly dimension: "context.tool_result_bytes" | "session.materialized_agents" | "session.initial_files_bytes" | "session.initial_files_count" | "session.agent_execution" | "session.run_budget" | "api.json_body" | "telemetry.batch" | "telemetry.ingest_rate" | "telemetry.metric_series" | "query.filter" | "query.page" | "stream.frame" | "metric.aggregate" | "registry.entries" | "registry.value_bytes" | "telemetry.export";
+    readonly used: string;
+}
+/** The authoritative placement of the workspace. */
+export interface ErrorDetailsRegion {
+    readonly apiUrl: string;
+    readonly expected: "us-east-1" | "us-east-2" | "us-west-2" | "ap-northeast-1" | "eu-west-1";
+}
+/** The scope the credential lacks. */
+export interface ErrorDetailsRequiredScope {
+    readonly scope: "account:read" | "account:write" | "organizations:read" | "organizations:write" | "memberships:read" | "memberships:write" | "memberships:accept" | "workspaces:read" | "workspaces:write" | "workspaces:delete" | "api_keys:read" | "api_keys:write" | "billing:read" | "billing:write" | "operations:read" | "operations:write" | "workspace:read" | "sessions:read" | "sessions:write" | "sessions:delete" | "files:live" | "resources:read" | "resources:write" | "provider_credentials:read" | "provider_credentials:write" | "telemetry:read" | "telemetry:write";
+}
+/** How long to wait before retrying. */
+export interface ErrorDetailsRetry {
+    readonly retryAfterMs: number;
+}
+/** Exactly where the body failed validation. */
+export interface ErrorDetailsValidation {
+    readonly pointer: string;
+    readonly reason: string;
+}
+/** What an export does when the window has recorded gaps. */
+export type ExportCompleteness = "require" | "allow_gaps";
+/** The two export formats. Parquet is deliberately absent: its encoder is a
+typed refusal pending a writer that can be pinned to byte-identical
+output, and admitting an operation guaranteed to fail is worse than
+refusing the request. Re-adding it is a wire change.
+ */
+export type ExportFormat = "ndjson" | "otlp_json";
+/** What one export walks. Deliberately not an `ObservationQuery`: an export
+has no caller-visible pagination, so a cursor, a limit and a walk
+direction are meaningless states rather than states to refuse at runtime.
+The partition list and the snapshot position are pinned at admission and
+live on the export row, which is the only channel the task has.
+ */
+export interface ExportQuery {
+    readonly consistency?: ObservationConsistency;
+    readonly filter?: ObservationFilter;
+    readonly signal: ObservationSignal;
+    readonly timeRange: TimeRange;
+}
+/** Where an export is in its lifecycle. */
+export type ExportStatus = "preparing" | "ready" | "failed" | "expired" | "revoked";
+/** One file entry, identified by its normalized POSIX path. */
+export interface FileEntry {
+    readonly mode: string;
+    readonly mtime: string;
+    readonly path: string;
+    readonly sha256?: string;
+    readonly sizeBytes: string;
+    readonly target?: string;
+    readonly type: FileEntryType;
+}
+/** One page of file entries. */
+export interface FileEntryPage {
+    readonly items: ReadonlyArray<FileEntry>;
+    readonly nextCursor?: string;
+}
+/** What a file entry is. */
+export type FileEntryType = "file" | "directory" | "symlink";
+/** The guest network policy. */
+export interface HandsNetworkRequest {
+    readonly mode: NetworkMode;
+}
+/** A short-lived hosted provider page. */
+export interface HostedSession {
+    readonly expiresAt: string;
+    readonly url: string;
+}
+/** One request header a signed grant requires the caller to send verbatim. */
+export interface HttpHeader {
+    readonly name: string;
+    readonly value: string;
+}
+/** An external sign-in provider AEX links a person to. */
+export type IdentityProvider = "google";
+/** A pending invitation to join an organization. */
+export interface Invitation {
+    readonly createdAt: string;
+    readonly email: string;
+    readonly expiresAt: string;
+    readonly id: Id<"invitation">;
+    readonly organizationId: Id<"organization">;
+    readonly resolvedAt?: string;
+    readonly role: InvitationRole;
+    readonly status: InvitationStatus;
+}
+/** What one acceptance redeemed. An invitation carries no secret, so acceptance names nothing: every pending invitation addressed to the caller's verified email is redeemed in one transaction. The list is empty when nothing was pending, which is what a repeated call answers. */
+export interface InvitationAcceptResult {
+    readonly memberships: ReadonlyArray<Membership>;
+}
+/** Invite a person to an organization. */
+export interface InvitationCreateRequest {
+    readonly email: string;
+    readonly role: InvitationRole;
+}
+/** The role an invitation grants; ownership is never invited. */
+export type InvitationRole = "admin" | "member";
+/** Where an invitation is in its lifecycle. */
+export type InvitationStatus = "pending" | "accepted" | "revoked" | "expired";
+/** A limit whose effective value is a map of named dimensions. */
+export interface LimitMapValue {
+    readonly values: Readonly<Record<string, string>>;
+}
+/** A single non-negative integer limit. */
+export interface LimitScalarValue {
+    readonly value: string;
+}
+/** Where an effective limit value came from. */
+export type LimitSource = "default" | "workspace_override";
+/** The effective value of a limit, discriminated by shape. */
+export type LimitValue = (LimitScalarValue & {
+    readonly shape: "scalar";
+}) | (LimitMapValue & {
+    readonly shape: "map";
+});
+/** One exact-generation descriptor-pinned multipart download. It carries no object-store URL: every part is read directly from the retained `MicroVM`. */
+export interface LiveFileDownload {
+    readonly expiresAt: string;
+    readonly generationId: Id<"generation">;
+    readonly id: Id<"file_download">;
+    readonly partCount: number;
+    readonly partSizeBytes: number;
+    readonly parts: ReadonlyArray<LiveFileDownloadPart>;
+    readonly path: string;
+    readonly sessionId: Id<"session">;
+    readonly sha256: string;
+    readonly sizeBytes: string;
+    readonly state: LiveFileDownloadState;
+    readonly version: string;
+    readonly workspaceAccess: WorkspaceAccess;
+}
+/** Close an exact live-file descriptor after the SDK verified every part and the whole hash. */
+export interface LiveFileDownloadCompleteRequest {
+    readonly sha256: string;
+    readonly version: string;
+}
+/** One fixed range and its expected digest in an exact live-file version. */
+export interface LiveFileDownloadPart {
+    readonly offset: string;
+    readonly partNumber: number;
+    readonly sha256: string;
+    readonly sizeBytes: number;
+}
+/** Open one regular file without following a symlink, auto-resuming the same generation. */
+export interface LiveFileDownloadRequest {
+    readonly ifGenerationId?: Id<"generation">;
+    readonly path: string;
+}
+/** Whether an exact-version live download is still open or fully verified. */
+export type LiveFileDownloadState = "open" | "verified";
+/** One live file entry plus what the read did to the workspace. */
+export interface LiveFileEntry {
+    readonly entry: FileEntry;
+    readonly workspaceAccess: WorkspaceAccess;
+}
+/** One page of live file entries plus what the read did. */
+export interface LiveFileEntryPage {
+    readonly items: ReadonlyArray<FileEntry>;
+    readonly nextCursor?: string;
+    readonly workspaceAccess: WorkspaceAccess;
+}
+/** List live workspace files, auto-resuming the same retained generation if suspended. */
+export interface LiveFileListRequest {
+    readonly cursor?: string;
+    readonly ifGenerationId?: Id<"generation">;
+    readonly limit?: number;
+    readonly path?: string;
+    readonly recursive?: boolean;
+}
+/** Stat one live workspace file, auto-resuming the same retained generation if suspended. */
+export interface LiveFileStatRequest {
+    readonly ifGenerationId?: Id<"generation">;
+    readonly path: string;
+}
+/** One resumable upload held only by the session's exact `MicroVM` generation. Suspension retains it; termination or runtime loss destroys it. */
+export interface LiveFileUpload {
+    readonly expiresAt: string;
+    readonly generationId: Id<"generation">;
+    readonly id: Id<"file_upload">;
+    readonly mode: RegisteredFileMode;
+    readonly partCount: number;
+    readonly partSizeBytes: number;
+    readonly parts: ReadonlyArray<LiveFileUploadPart>;
+    readonly path: string;
+    readonly sessionId: Id<"session">;
+    readonly sha256: string;
+    readonly sizeBytes: string;
+    readonly state: LiveFileUploadState;
+    readonly workspaceAccess: WorkspaceAccess;
+}
+/** Create or exactly replay a resumable upload in the session's retained generation. */
+export interface LiveFileUploadCreateRequest {
+    readonly ifGenerationId?: Id<"generation">;
+    readonly mode?: RegisteredFileMode;
+    readonly path: string;
+    readonly sha256: string;
+    readonly sizeBytes: string;
+}
+/** One verified logical part retained by the exact `MicroVM` generation. */
+export interface LiveFileUploadPart {
+    readonly offset: string;
+    readonly partNumber: number;
+    readonly sha256: string;
+    readonly sizeBytes: number;
+}
+/** The generation-local position of one ephemeral upload. */
+export type LiveFileUploadState = "staging" | "complete";
+/** A person's role inside one organization. */
+export interface Membership {
+    readonly createdAt: string;
+    readonly email: string;
+    readonly id: Id<"membership">;
+    readonly organizationId: Id<"organization">;
+    readonly role: OrganizationRole;
+    readonly status: MembershipStatus;
+    readonly userId: Id<"user">;
+}
+/** One page of memberships. */
+export interface MembershipPage {
+    readonly items: ReadonlyArray<Membership>;
+    readonly nextCursor?: string;
+}
+/** Whether a membership is usable. */
+export type MembershipStatus = "active";
+/** One complete, sealed message in a session. `createdAt` is display metadata; collection order is the immutable seal-visibility order and is not derived from this field. */
+export interface Message {
+    readonly content: ReadonlyArray<MessagePart>;
+    readonly createdAt: string;
+    readonly id: Id<"message">;
+    readonly role: MessageRole;
+    readonly sessionId: Id<"session">;
+}
+/** One page of complete sealed messages, ordered by the immutable seal-visibility tuple `(sealedAt, messageId)`. Open partial messages are never visible. */
+export interface MessagePage {
+    readonly items: ReadonlyArray<Message>;
+    readonly nextCursor?: string;
+}
+/** One part of a complete message. Admission is text-only; assistant and tool messages may contain canonical built-in tool records. */
+export type MessagePart = (MessagePartText & {
+    readonly type: "text";
+}) | (MessagePartToolCall & {
+    readonly type: "tool_call";
+}) | (MessagePartToolResult & {
+    readonly type: "tool_result";
+});
+/** A text part. */
+export interface MessagePartText {
+    readonly text: string;
+}
+/** A built-in tool call emitted by the model. */
+export interface MessagePartToolCall {
+    readonly argumentsDigest: string;
+    readonly id: Id<"tool_call">;
+}
+/** The canonical result of a built-in tool call. */
+export interface MessagePartToolResult {
+    readonly id: Id<"tool_call">;
+    readonly resultDigest: string;
+}
+/** Who produced a message. */
+export type MessageRole = "user" | "assistant" | "tool";
+/** Admit one text message of at most 24,576 UTF-8 bytes. Omitting `maxSpendCents` selects the 1000-cent default; an explicit positive value may be higher or lower. Omitting `deadline` uses the session's remaining lifetime/drain fence; an explicit deadline may only shorten it. */
+export interface MessageSendRequest {
+    readonly deadline?: string;
+    readonly maxSpendCents?: string;
+    readonly text: string;
+}
+/** The admitted user message and the session now processing it. */
+export interface MessageSendResult {
+    readonly message: Message;
+    readonly session: Session;
+}
+/** The calculations a metric aggregation may request. */
+export type MetricAggregationCalculation = "sum" | "count" | "min" | "max" | "avg";
+/** One aggregated group. */
+export interface MetricAggregationGroup {
+    readonly key: Readonly<Record<string, string>>;
+    readonly sampleCount: string;
+    readonly value: number;
+}
+/** One page of aggregated groups plus the coverage they are complete over. */
+export interface MetricAggregationPage {
+    readonly coverage: ObservationCoverage;
+    readonly items: ReadonlyArray<MetricAggregationGroup>;
+    readonly nextCursor?: string;
+}
+/** A bounded metric aggregation. */
+export interface MetricAggregationRequest {
+    readonly calculation: MetricAggregationCalculation;
+    readonly cursor?: string;
+    readonly filter?: ObservationFilter;
+    readonly groupBy?: ReadonlyArray<string>;
+    readonly limit?: number;
+    readonly metric: string;
+    readonly timeRange: TimeRange;
+}
+/** A known hole in the ordered series. */
+export interface MissingInterval {
+    readonly gapId: Id<"telemetry_gap">;
+    readonly range: TimeRange;
+}
+/** An explicit provider and model pair; a model-only override is rejected. */
+export interface ModelSelection {
+    readonly credentialId?: Id<"provider_credential">;
+    readonly model: string;
+    readonly provider: ProviderId;
+}
+/** What the guest may reach. */
+export type NetworkMode = "none" | "public_internet";
+/** A freshly minted key. The value never appears in a later read. */
+export interface NewApiKey {
+    readonly createdAt: string;
+    readonly id: Id<"api_key">;
+    readonly name: string;
+    readonly scopes: ReadonlyArray<"account:read" | "account:write" | "organizations:read" | "organizations:write" | "memberships:read" | "memberships:write" | "memberships:accept" | "workspaces:read" | "workspaces:write" | "workspaces:delete" | "api_keys:read" | "api_keys:write" | "billing:read" | "billing:write" | "operations:read" | "operations:write" | "workspace:read" | "sessions:read" | "sessions:write" | "sessions:delete" | "files:live" | "resources:read" | "resources:write" | "provider_credentials:read" | "provider_credentials:write" | "telemetry:read" | "telemetry:write">;
+    readonly value: string;
+    readonly workspaceId: Id<"workspace">;
+}
+/** One admitted observation, in the canonical envelope. */
+export interface Observation {
+    readonly acceptedAt: string;
+    readonly body: JsonValue;
+    readonly id: Id<"observation">;
+    readonly observedAt: string;
+    readonly sequence: string;
+    readonly sessionId?: Id<"session">;
+    readonly signal: ObservationSignal;
+    readonly spanId?: string;
+    readonly traceId?: string;
+    readonly workspaceId: Id<"workspace">;
+}
+/** How much of the accepted series a read must observe. */
+export type ObservationConsistency = "indexed" | "accepted";
+/** What the answer is actually complete over. Never omitted. All four watermarks are accepted-time positions in epoch milliseconds (O-04). */
+export interface ObservationCoverage {
+    readonly accepted: string;
+    readonly caughtUp: boolean;
+    readonly complete: boolean;
+    readonly earliestReplay: string;
+    readonly indexed: string;
+    readonly missingIntervals: ReadonlyArray<MissingInterval>;
+    readonly snapshot: string;
+    readonly unboundedGaps: ReadonlyArray<Id<"telemetry_gap">>;
+}
+/** A bounded filter AST. Structural bounds are enforced before construction. */
+export type ObservationFilter = (ObservationFilterAll & {
+    readonly op: "all";
+}) | (ObservationFilterAny & {
+    readonly op: "any";
+}) | (ObservationFilterNot & {
+    readonly op: "not";
+}) | (ObservationFilterCompare & {
+    readonly op: "compare";
+}) | (ObservationFilterIn & {
+    readonly op: "in";
+}) | (ObservationFilterExists & {
+    readonly op: "exists";
+});
+/** Every child must match. */
+export interface ObservationFilterAll {
+    readonly filters: ReadonlyArray<ObservationFilter>;
+}
+/** At least one child must match. */
+export interface ObservationFilterAny {
+    readonly filters: ReadonlyArray<ObservationFilter>;
+}
+/** A comparison against one field. */
+export interface ObservationFilterCompare {
+    readonly field: string;
+    readonly operator: ObservationOperator;
+    readonly value: string;
+}
+/** Presence of a field. */
+export interface ObservationFilterExists {
+    readonly field: string;
+}
+/** Membership of a bounded value set. */
+export interface ObservationFilterIn {
+    readonly field: string;
+    readonly values: ReadonlyArray<string>;
+}
+/** The child must not match. */
+export interface ObservationFilterNot {
+    readonly filters: ReadonlyArray<ObservationFilter>;
+}
+/** One NDJSON frame. `stream` and `listen` emit nothing else. */
+export type ObservationFrame = (ObservationFrameRecords & {
+    readonly type: "records";
+}) | (ObservationFrameGap & {
+    readonly type: "gap";
+}) | (ObservationFrameCursor & {
+    readonly type: "cursor";
+}) | (ObservationFrameRotate & {
+    readonly type: "rotate";
+});
+/** A resumable position. */
+export interface ObservationFrameCursor {
+    readonly coverage: ObservationCoverage;
+    readonly cursor: string;
+}
+/** A gap surfaced inline; it is never silently skipped. */
+export interface ObservationFrameGap {
+    readonly gap: TelemetryGap;
+}
+/** A batch of observations. The server splits before the effective frame bound. */
+export interface ObservationFrameRecords {
+    readonly items: ReadonlyArray<Observation>;
+}
+/** The terminal condition after a 200. A stream always ends with a reason. */
+export interface ObservationFrameRotate {
+    readonly cursor?: string;
+    readonly error?: ApiErrorBody;
+    readonly reason: RotateReason;
+    readonly retryable: boolean;
+}
+/** Capture the current accepted position and follow it. Origins are rejected. */
+export interface ObservationListenRequest {
+    readonly filter?: ObservationFilter;
+    readonly signal: ObservationSignal;
+}
+/** The comparison operators a filter leaf may use. */
+export type ObservationOperator = "eq" | "ne" | "lt" | "lte" | "gt" | "gte" | "prefix";
+/** Which direction a read walks the ordered series. */
+export type ObservationOrder = "ascending" | "descending";
+/** Exactly one origin. A stream that declares none or two is rejected. */
+export type ObservationOrigin = (ObservationOriginCursor & {
+    readonly from: "cursor";
+}) | (ObservationOriginTime & {
+    readonly from: "time";
+}) | (ObservationOriginEarliest & {
+    readonly from: "earliest";
+});
+/** Resume from an exact prior position. */
+export interface ObservationOriginCursor {
+    readonly cursor: string;
+}
+/** Start from the earliest replayable position. */
+export type ObservationOriginEarliest = Readonly<Record<string, never>>;
+/** Start from an instant. */
+export interface ObservationOriginTime {
+    readonly at: string;
+}
+/** One page of observations plus the coverage it is complete over. */
+export interface ObservationPage {
+    readonly coverage: ObservationCoverage;
+    readonly items: ReadonlyArray<Observation>;
+    readonly nextCursor?: string;
+}
+/** A bounded, paged observation read. */
+export interface ObservationQuery {
+    readonly consistency?: ObservationConsistency;
+    readonly cursor?: string;
+    readonly filter?: ObservationFilter;
+    readonly limit?: number;
+    readonly order?: ObservationOrder;
+    readonly signal: ObservationSignal;
+    readonly timeRange: TimeRange;
+}
+/** The six observable signals. */
+export type ObservationSignal = "events" | "logs" | "spans" | "metrics" | "traces" | "telemetry";
+/** Replay from exactly one declared origin as NDJSON. */
+export interface ObservationStreamRequest {
+    readonly filter?: ObservationFilter;
+    readonly origin: ObservationOrigin;
+    readonly signal: ObservationSignal;
+}
+/** A durable operation record. */
+export interface Operation {
+    readonly cancelable: boolean;
+    readonly committedAt?: string;
+    readonly createdAt: string;
+    readonly error?: OperationFailure;
+    readonly id: Id<"operation">;
+    readonly kind: OperationKind;
+    readonly progress?: OperationProgress;
+    readonly result?: OperationResult;
+    readonly sessionId?: Id<"session">;
+    readonly startedAt?: string;
+    readonly status: OperationStatus;
+    readonly terminalAt?: string;
+    readonly updatedAt: string;
+    readonly workspaceId: Id<"workspace">;
+}
+/** A durable operation failure. It carries no synthetic request identity. */
+export interface OperationFailure {
+    readonly code: "unauthenticated" | "forbidden" | "insufficient_scope" | "token_invalid" | "token_revoked" | "token_expired" | "malformed_token" | "authorization_pending" | "slow_down" | "not_found" | "gone" | "idempotency_conflict" | "idempotency_in_flight" | "api_key_secret_unavailable" | "operation_idempotency_conflict" | "invalid_request" | "invalid_scope" | "invalid_cursor" | "invalid_file_selection" | "invalid_range" | "unsupported_media_type" | "payload_too_large" | "limit_exceeded" | "session_not_idle" | "session_terminated" | "workspace_activation_required" | "workspace_not_live" | "session_deleting" | "session_deleted" | "deletion_in_progress" | "resource_conflict" | "last_owner_required" | "operation_not_cancelable" | "approval_not_found" | "approval_already_resolved" | "approval_binding_changed" | "file_not_found" | "content_missing" | "export_not_found" | "export_not_ready" | "export_expired" | "export_revoked" | "export_capacity" | "download_grant_expired" | "telemetry_payload_too_large" | "invalid_telemetry" | "telemetry_quota_exceeded" | "telemetry_incomplete" | "unsupported_export_signal" | "invalid_query" | "telemetry_query_budget_exhausted" | "invalid_metric_aggregation" | "invalid_network_policy" | "unsupported_package_ecosystem" | "package_resolution_failed" | "package_artifact_unavailable" | "package_integrity_mismatch" | "unknown_provider" | "unknown_model" | "unqualified_provider_model" | "provider_credential_not_found" | "provider_credential_revoked" | "invalid_auto_topup_policy" | "payment_method_required" | "authentication_unavailable" | "account_paused" | "account_state_unavailable" | "precondition_failed" | "wrong_workspace_region" | "observability_unavailable" | "usage_unavailable" | "rate_limited" | "upstream_error" | "workspace_provision_pending" | "commit_outcome_unknown" | "not_implemented" | "internal_error";
+    readonly detail?: JsonValue;
+    readonly retryable: boolean;
+}
+/** Every durable operation the platform admits. */
+export type OperationKind = "session_cancel" | "session_suspend" | "session_resume" | "session_terminate" | "session_delete" | "telemetry_export" | "workspace_delete";
+/** One page of durable operations. */
+export interface OperationPage {
+    readonly items: ReadonlyArray<Operation>;
+    readonly nextCursor?: string;
+}
+/** Coarse progress; never a completion promise. */
+export interface OperationProgress {
+    readonly completed?: string;
+    readonly phase: string;
+    readonly total?: string;
+}
+/** The typed successful result of a durable operation. */
+export type OperationResult = (SessionCancelResult & {
+    readonly kind: "session_cancel";
+}) | (SessionSuspendResult & {
+    readonly kind: "session_suspend";
+}) | (SessionResumeResult & {
+    readonly kind: "session_resume";
+}) | (SessionTerminateResult & {
+    readonly kind: "session_terminate";
+}) | (SessionTombstone & {
+    readonly kind: "session_delete";
+}) | (TelemetryExportResult & {
+    readonly kind: "telemetry_export";
+}) | (WorkspaceTombstone & {
+    readonly kind: "workspace_delete";
+});
+/** Where a durable operation is in its lifecycle. */
+export type OperationStatus = "queued" | "running" | "succeeded" | "failed" | "cancelled";
+/** Where a workspace operational state comes from. */
+export type OperationalStateSource = "account";
+/** The billing and ownership boundary. */
+export interface Organization {
+    readonly callerRole: OrganizationRole;
+    readonly createdAt: string;
+    readonly id: Id<"organization">;
+    readonly name: string;
+    readonly slug: string;
+}
+/** One organization's operational state in a multi-organization dashboard snapshot. */
+export interface OrganizationAccount {
+    readonly organizationId: Id<"organization">;
+    readonly state: AccountOperationalState;
+}
+/** Create an organization. */
+export interface OrganizationCreateRequest {
+    readonly name: string;
+}
+/** One page of organizations. */
+export interface OrganizationPage {
+    readonly items: ReadonlyArray<Organization>;
+    readonly nextCursor?: string;
+}
+/** The caller role inside one organization. */
+export type OrganizationRole = "owner" | "admin" | "member";
+/** The package ecosystems a session may pre-install from. */
+export type PackageEcosystem = "apt" | "pip" | "npm";
+/** One exactly-pinned package to pre-install. */
+export interface PackageRequest {
+    readonly ecosystem: PackageEcosystem;
+    readonly name: string;
+    readonly version: string;
+}
+/** Create a hosted billing portal session. */
+export interface PortalSessionRequest {
+    readonly returnUrl?: string;
+}
+/** A BYOK provider-credential binding. The key material never appears here. */
+export interface ProviderCredential {
+    readonly createdAt: string;
+    readonly fingerprint: string;
+    readonly id: Id<"provider_credential">;
+    readonly name: string;
+    readonly provider: ProviderId;
+    readonly revision: number;
+    readonly revokedAt?: string;
+    readonly state: ProviderCredentialState;
+    readonly updatedAt: string;
+}
+/** One page of provider-credential bindings. */
+export interface ProviderCredentialPage {
+    readonly items: ReadonlyArray<ProviderCredential>;
+    readonly nextCursor?: string;
+}
+/** Register a BYOK provider credential. This request carries plaintext. */
+export interface ProviderCredentialRegisterRequest {
+    readonly apiKey: string;
+    readonly name: string;
+    readonly provider: ProviderId;
+}
+/** Whether a BYOK binding may still be selected. */
+export type ProviderCredentialState = "ready" | "revoked";
+/** The eight customer-owned BYOK authorities. Gateway authorities use fixed endpoints; arbitrary base URLs are not accepted. */
+export type ProviderId = "openai" | "anthropic" | "deepseek" | "zai" | "moonshotai" | "google" | "openrouter" | "vercel_ai_gateway";
+/** A registered file entry, complete. */
+export interface RegisteredFile {
+    readonly createdAt: string;
+    readonly name: string;
+    readonly revision: number;
+    readonly sha256: string;
+    readonly sizeBytes: string;
+    readonly state: RegisteredState;
+    readonly updatedAt: string;
+    readonly value: RegisteredFileRead;
+}
+/** The two permitted registered-file modes. */
+export type RegisteredFileMode = "0644" | "0755";
+/** One page of registered files. */
+export interface RegisteredFilePage {
+    readonly items: ReadonlyArray<RegisteredFileRow>;
+    readonly nextCursor?: string;
+}
+/** What a registered file is, as published. The payload bytes are referenced, never inlined; fetch them with a download grant. */
+export interface RegisteredFileRead {
+    readonly content: ContentRef;
+    readonly mediaType: string;
+    readonly mode: RegisteredFileMode;
+    readonly mountPath: string;
+}
+/** One registered file as a collection row. A listing carries no value document; read the entry itself to get one. */
+export interface RegisteredFileRow {
+    readonly createdAt: string;
+    readonly name: string;
+    readonly revision: number;
+    readonly sha256: string;
+    readonly sizeBytes: string;
+    readonly state: RegisteredState;
+    readonly updatedAt: string;
+}
+/** A registered file. */
+export interface RegisteredFileValue {
+    readonly content: BlobInput;
+    readonly mediaType: string;
+    readonly mode: RegisteredFileMode;
+    readonly mountPath: string;
+}
+/** The only state a registered entry has; there is no version history. */
+export type RegisteredState = "current";
+/** Mint a download grant for a registered file. */
+export interface RegistryDownloadRequest {
+    readonly range?: ByteRange;
+}
+/** The complete provider-derived capacity of the selected shape. */
+export interface ResolvedCompute {
+    readonly baseline: ComputeShape;
+    readonly endpointBandwidthMBps: number;
+    readonly maxConcurrentConnections: number;
+    readonly maxDiskGiB: number;
+    readonly peak: ComputeShape;
+    readonly size: "512mb" | "1gb" | "2gb" | "4gb" | "8gb";
+}
+/** Everything the platform resolved for this session. */
+export interface ResolvedConfig {
+    readonly catalogRevision: string;
+    readonly compute: ResolvedCompute;
+    readonly lifecycle: SessionLifecyclePolicy;
+    readonly model: string;
+    readonly network: ResolvedNetwork;
+    readonly packages: ReadonlyArray<PackageRequest>;
+    readonly provider: ProviderId;
+    readonly providerCredentialId: Id<"provider_credential">;
+    readonly registered: SessionRegisteredSelection;
+}
+/** The resolved guest network policy. */
+export interface ResolvedNetwork {
+    readonly hands: HandsNetworkRequest;
+}
+/** Why a stream ended after its 200. */
+export type RotateReason = "budget_exhausted" | "server_rotating" | "client_idle" | "upstream_unavailable" | "failed";
+/** A multi-turn conversation backed by at most one retained provider generation. Termination destroys compute and live files but preserves this metadata and sealed messages until deletion. */
+export interface Session {
+    readonly activeDeadline?: string;
+    readonly activeMaxSpendCents?: string;
+    readonly activeMessageId?: Id<"message">;
+    readonly createdAt: string;
+    readonly expiresAt: string;
+    readonly id: Id<"session">;
+    readonly idleSince?: string;
+    readonly launchedAt: string;
+    readonly metadata?: Readonly<Record<string, string | number | boolean | null>>;
+    readonly resolvedConfig: ResolvedConfig;
+    readonly revision: number;
+    readonly status: SessionStatus;
+    readonly suspendAt?: string;
+    readonly suspendedAt?: string;
+    readonly terminatedAt?: string;
+    readonly terminationReason?: SessionTerminationReason;
+    readonly updatedAt: string;
+    readonly workspaceId: Id<"workspace">;
+}
+/** The result of cancelling the session's current work. The session is idle afterward and accepts another message. */
+export interface SessionCancelResult {
+    readonly changed: boolean;
+    readonly sessionId: Id<"session">;
+    readonly sessionRevision: number;
+}
+/** The only customer compute selector. */
+export interface SessionComputeRequest {
+    readonly size?: "512mb" | "1gb" | "2gb" | "4gb" | "8gb";
+}
+/** Create an eight-hour multi-turn session with one explicitly pinned BYOK provider credential. */
+export interface SessionCreateRequest {
+    readonly compute?: SessionComputeRequest;
+    readonly metadata?: Readonly<Record<string, string | number | boolean | null>>;
+    readonly model: string;
+    readonly network?: SessionNetworkRequest;
+    readonly packages?: ReadonlyArray<PackageRequest>;
+    readonly provider: ProviderId;
+    readonly providerCredentialId: Id<"provider_credential">;
+    readonly registered?: SessionRegisteredSelection;
+}
+/** The immutable automatic lifecycle behavior applied to this session. */
+export interface SessionLifecyclePolicy {
+    readonly idleSuspendAfterSeconds: number;
+    readonly maximumLifetimeSeconds: number;
+    readonly resumeOnLiveFileAccess: boolean;
+    readonly resumeOnMessage: boolean;
+}
+/** The collection projection of a session; `resolvedConfig` is omitted. */
+export interface SessionListItem {
+    readonly activeMessageId?: Id<"message">;
+    readonly createdAt: string;
+    readonly expiresAt: string;
+    readonly id: Id<"session">;
+    readonly model: string;
+    readonly provider: ProviderId;
+    readonly revision: number;
+    readonly status: SessionStatus;
+    readonly updatedAt: string;
+    readonly workspaceId: Id<"workspace">;
+}
+/** One page of sessions. */
+export interface SessionListPage {
+    readonly items: ReadonlyArray<SessionListItem>;
+    readonly nextCursor?: string;
+}
+/** Network policy for the session. */
+export interface SessionNetworkRequest {
+    readonly hands: HandsNetworkRequest;
+}
+/** Opaque workspace files mounted into the session. Conventional files such as `AGENTS.md` may carry guidance, skills, tool bundles, MCP configuration or custom instructions; the built-in model tools are `read_file`, `edit_file`, `write_file`, and Bash. */
+export interface SessionRegisteredSelection {
+    readonly files?: ReadonlyArray<string>;
+}
+/** The result of manually resuming the same retained generation to idle. */
+export interface SessionResumeResult {
+    readonly changed: boolean;
+    readonly resumedAt: string;
+    readonly sessionId: Id<"session">;
+    readonly sessionRevision: number;
+    readonly status: SessionStatus;
+}
+/** What a session is doing right now. */
+export type SessionStatus = "idle" | "running" | "suspending" | "suspended" | "resuming" | "terminating" | "terminated" | "deleting";
+/** The result of manually suspending an idle session's exact retained generation. Active work must be cancelled first. */
+export interface SessionSuspendResult {
+    readonly changed: boolean;
+    readonly sessionId: Id<"session">;
+    readonly sessionRevision: number;
+    readonly suspendedAt: string;
+}
+/** The result of permanently destroying compute and live files while preserving session metadata and sealed messages. */
+export interface SessionTerminateResult {
+    readonly changed: boolean;
+    readonly sessionId: Id<"session">;
+    readonly sessionRevision: number;
+    readonly terminatedAt: string;
+}
+/** Why a session permanently lost its compute and live files. */
+export type SessionTerminationReason = "user" | "lifetime_expired" | "provider_credential_revoked" | "runtime_lost";
+/** The minimal marker left after irreversible deletion. Compute and live files are terminated first; session, message, Brain user-content, observation, telemetry and export payloads are removed. Independent registered workspace files and aggregate billing/audit facts remain. */
+export interface SessionTombstone {
+    readonly deletedAt: string;
+    readonly id: Id<"session">;
+    readonly operationId: Id<"operation">;
+    readonly workspaceId: Id<"workspace">;
+}
+/** One immutable issued statement. The platform never rerenders history. */
+export interface Statement {
+    readonly artifactHash: string;
+    readonly currency: Currency;
+    readonly id: Id<"statement">;
+    readonly issuedAt: string;
+    readonly lines: ReadonlyArray<StatementLine>;
+    readonly organizationId: Id<"organization">;
+    readonly period: TimeRange;
+    readonly totalCents: string;
+}
+/** One priced category line. Lines sum exactly to the statement total. */
+export interface StatementLine {
+    readonly category: UsageCategory;
+    readonly totalCents: string;
+}
+/** The header of one immutable issued statement. */
+export interface StatementSummary {
+    readonly artifactHash: string;
+    readonly currency: Currency;
+    readonly id: Id<"statement">;
+    readonly issuedAt: string;
+    readonly organizationId: Id<"organization">;
+    readonly period: TimeRange;
+    readonly totalCents: string;
+}
+/** One page of statement headers, newest first. */
+export interface StatementSummaryPage {
+    readonly items: ReadonlyArray<StatementSummary>;
+    readonly nextCursor?: string;
+}
+/** The AEX receipt returned alongside the standard OTLP response. */
+export interface TelemetryAdmissionReceipt {
+    readonly accepted: string;
+    readonly acceptedAt: string;
+    readonly batchId: Id<"telemetry_batch">;
+    readonly bytes: string;
+    readonly rejected: string;
+}
+/** One telemetry export record. Session exports remain workspace-owned. */
+export interface TelemetryExport {
+    readonly completeness: ExportCompleteness;
+    readonly createdAt: string;
+    readonly expiresAt?: string;
+    readonly format: ExportFormat;
+    readonly gapIds?: ReadonlyArray<Id<"telemetry_gap">>;
+    readonly id: Id<"export">;
+    readonly manifestHash?: string;
+    readonly readyAt?: string;
+    readonly revokedAt?: string;
+    readonly sessionId?: Id<"session">;
+    readonly sizeBytes?: string;
+    readonly status: ExportStatus;
+    readonly workspaceId: Id<"workspace">;
+}
+/** Admit a durable telemetry-export operation. */
+export interface TelemetryExportRequest {
+    readonly completeness: ExportCompleteness;
+    readonly format: ExportFormat;
+    readonly query: ExportQuery;
+}
+/** The result of a telemetry-export operation. */
+export interface TelemetryExportResult {
+    readonly expiresAt: string;
+    readonly exportId: Id<"export">;
+    readonly format: ExportFormat;
+    readonly manifestHash: string;
+}
+/** A recorded hole in the observation series. There is no public repair route. */
+export interface TelemetryGap {
+    readonly byteCount?: string;
+    readonly detectedAt: string;
+    readonly fromSequence?: string;
+    readonly id: Id<"telemetry_gap">;
+    readonly observationCount?: string;
+    readonly reason: TelemetryGapReason;
+    readonly recoverable: boolean;
+    readonly repairSource?: string;
+    readonly repairedAt?: string;
+    readonly revision: number;
+    readonly sessionId?: Id<"session">;
+    readonly signals: ReadonlyArray<ObservationSignal>;
+    readonly timeRange?: TimeRange;
+    readonly toSequence?: string;
+    readonly workspaceId: Id<"workspace">;
+}
+/** One page of recorded gaps. */
+export interface TelemetryGapPage {
+    readonly items: ReadonlyArray<TelemetryGap>;
+    readonly nextCursor?: string;
+}
+/** A bounded query over recorded gaps. */
+export interface TelemetryGapQuery {
+    readonly cursor?: string;
+    readonly limit?: number;
+    readonly recoverable?: boolean;
+    readonly signals?: ReadonlyArray<ObservationSignal>;
+    readonly timeRange: TimeRange;
+}
+/** Why a gap exists. */
+export type TelemetryGapReason = "admission_rejected" | "spool_lost" | "producer_dropped" | "replay_expired" | "authority_unavailable";
+/** A half-open instant range, `gte` inclusive and `lt` exclusive. */
+export interface TimeRange {
+    readonly gte: string;
+    readonly lt: string;
+}
+/** Create a hosted top-up checkout. */
+export interface TopUpCheckoutRequest {
+    readonly amountCents: string;
+    readonly cancelUrl?: string;
+    readonly successUrl?: string;
+}
+/** One assembled trace and the observations it was assembled from. */
+export interface TraceDetail {
+    readonly coverage: ObservationCoverage;
+    readonly spans: ReadonlyArray<Observation>;
+    readonly summary: TraceSummary;
+}
+/** The header of one assembled trace. */
+export interface TraceSummary {
+    readonly endedAt: string;
+    readonly rootName: string;
+    readonly spanCount: string;
+    readonly startedAt: string;
+    readonly traceId: string;
+    readonly workspaceId?: Id<"workspace">;
+}
+/** One staged multipart upload. Uploads are transport plumbing, not assets. */
+export interface Upload {
+    readonly contentType: string;
+    readonly createdAt: string;
+    readonly expiresAt: string;
+    readonly id: Id<"upload">;
+    readonly partCount: number;
+    readonly partSizeBytes: string;
+    readonly sha256: string;
+    readonly sizeBytes: string;
+    readonly state: UploadState;
+}
+/** Complete a staged upload. */
+export interface UploadCompleteRequest {
+    readonly parts: ReadonlyArray<UploadPart>;
+}
+/** Stage a large registered-resource value. */
+export interface UploadCreateRequest {
+    readonly contentType: string;
+    readonly sha256: string;
+    readonly sizeBytes: string;
+}
+/** One written part and the entity tag the store returned. */
+export interface UploadPart {
+    readonly etag: string;
+    readonly partNumber: number;
+}
+/** One presigned PUT grant. The headers must be sent verbatim: they carry the part checksum and length the signature covers, and a PUT without them is rejected by the object store. */
+export interface UploadPartGrant {
+    readonly expiresAt: string;
+    readonly headers: ReadonlyArray<HttpHeader>;
+    readonly partNumber: number;
+    readonly url: string;
+}
+/** The presigned grants for the requested parts. */
+export interface UploadPartGrants {
+    readonly grants: ReadonlyArray<UploadPartGrant>;
+    readonly uploadId: Id<"upload">;
+}
+/** One part to presign. The part's own SHA-256 is required because S3 verifies it on the way up and the completion manifest checks it again; the server never sees the bytes, so it cannot compute it. */
+export interface UploadPartRequest {
+    readonly partNumber: number;
+    readonly sha256: string;
+    readonly sizeBytes: string;
+}
+/** Mint presigned PUT grants for the named parts. At most 1000 parts per call against the 10000-part ceiling, so a maximal upload needs at least ten calls. */
+export interface UploadPartsRequest {
+    readonly parts: ReadonlyArray<UploadPartRequest>;
+}
+/** Where a staged upload is in its lifecycle. */
+export type UploadState = "staging" | "ready";
+/** One resource aggregate, discriminated by category. */
+export type UsageAggregate = (UsageStorageAggregate & {
+    readonly category: "storage";
+}) | (UsageComputeAggregate & {
+    readonly category: "compute";
+}) | (UsageMemoryAggregate & {
+    readonly category: "memory";
+}) | (UsageDataTransferAggregate & {
+    readonly category: "data_transfer";
+});
+/** What a regional aggregate is attributed to. */
+export interface UsageAttribution {
+    readonly operationId?: Id<"operation">;
+    readonly region: "us-east-1" | "us-east-2" | "us-west-2" | "ap-northeast-1" | "eu-west-1";
+    readonly serviceTime: TimeRange;
+    readonly sessionId?: Id<"session">;
+    readonly source: string;
+    readonly workspaceId: Id<"workspace">;
+}
+/** The three authorities that admit usage facts. There are three rather than
+four because memory and compute are one contiguous fact sequence behind
+one authority, so they share one frontier; publishing four frontiers with
+two of them always identical would claim an independence that does not
+exist.
+ */
+export type UsageAuthority = "storage" | "compute" | "transfer";
+/** The time grain one usage query answers at. All bucketing is UTC and there
+is no timezone parameter; a range must be aligned to whole buckets of the
+requested grain and a misaligned range is refused rather than widened to
+the enclosing buckets.
+ */
+export type UsageBucket = "hour" | "day" | "total";
+/** The four priced categories. */
+export type UsageCategory = "storage" | "compute" | "memory" | "data_transfer";
+/** Millicpu-milliseconds of guest compute. */
+export interface UsageComputeAggregate {
+    readonly attribution: UsageAttribution;
+    readonly millicpuMilliseconds: string;
+    readonly settlement: UsageSettlement;
+}
+/** Measured outbound bytes. */
+export interface UsageDataTransferAggregate {
+    readonly attribution: UsageAttribution;
+    readonly egressBytes: string;
+    readonly settlement: UsageSettlement;
+}
+/** How far the pipeline has advanced for one workspace and authority. The
+answer is exact at or below `completeThrough` and contains nothing above
+`includesThrough`; between the two it is partial, and saying so is the
+point. Both are monotone across repeated queries.
+ */
+export interface UsageFrontier {
+    readonly acceptedSequence: string;
+    readonly category: UsageAuthority;
+    readonly completeThrough: string;
+    readonly includesThrough: string;
+    readonly projectedSequence: string;
+    readonly publishedSequence: string;
+    readonly region: "us-east-1" | "us-east-2" | "us-west-2" | "ap-northeast-1" | "eu-west-1";
+    readonly serviceThrough?: string;
+    readonly settledSequence: string;
+    readonly stallReason?: string;
+    readonly stalledAt?: string;
+    readonly state: UsageFrontierState;
+    readonly workspaceId: Id<"workspace">;
+}
+/** Whether a fold is advancing or parked. */
+export type UsageFrontierState = "advancing" | "stalled";
+/** The axes a usage query may group by. Session, run and operation are
+deliberately absent: every stored aggregate row is keyed by a hash of a
+seven-member dimension tuple that includes the session, so grouping by one
+of them would read hundreds of thousands of rows for a single monthly
+total. "How much did session X cost?" is not answerable by any route in
+v1, and publishing an axis that is always refused would be a false
+capability.
+ */
+export type UsageGrouping = "category" | "region" | "workspace";
+/** Byte-milliseconds of guest memory. */
+export interface UsageMemoryAggregate {
+    readonly attribution: UsageAttribution;
+    readonly byteMilliseconds: string;
+    readonly settlement: UsageSettlement;
+}
+/** One page of usage quantities plus the frontiers that bound its completeness. Monetary statements remain a central finance read. */
+export interface UsagePage {
+    readonly frontiers: ReadonlyArray<UsageFrontier>;
+    readonly items: ReadonlyArray<UsageAggregate>;
+    readonly nextCursor?: string;
+}
+/** A bounded query over authoritative regional usage quantities. */
+export interface UsageQuery {
+    readonly bucket: UsageBucket;
+    readonly categories?: ReadonlyArray<UsageCategory>;
+    readonly cursor?: string;
+    readonly groupBy?: ReadonlyArray<UsageGrouping>;
+    readonly limit?: number;
+    readonly timeRange: TimeRange;
+}
+/** Whether an item is covered by a committed settlement receipt as of
+`completeThrough`. Not permanently terminal: a correction or a void
+arrives as a new fact at a higher sequence and re-opens its bucket to
+`provisional`.
+ */
+export type UsageSettlement = "settled" | "provisional";
+/** Retained bytes over time. */
+export interface UsageStorageAggregate {
+    readonly attribution: UsageAttribution;
+    readonly byteMinutes: string;
+    readonly settlement: UsageSettlement;
+}
+/** A region-pinned execution and content boundary. */
+export interface Workspace {
+    readonly apiUrl: string;
+    readonly createdAt: string;
+    readonly deletionOperationId?: Id<"operation">;
+    readonly id: Id<"workspace">;
+    readonly name: string;
+    readonly operationalState: WorkspaceOperationalState;
+    readonly organizationId: Id<"organization">;
+    readonly region: "us-east-1" | "us-east-2" | "us-west-2" | "ap-northeast-1" | "eu-west-1";
+    readonly slug: string;
+    readonly status: WorkspaceStatus;
+}
+/** Which retained session generation answered a live workspace call. */
+export interface WorkspaceAccess {
+    readonly generationId: Id<"generation">;
+    readonly resumed: boolean;
+}
+/** Create a region-pinned workspace. Region is required and immutable. */
+export interface WorkspaceCreateRequest {
+    readonly name: string;
+    readonly organizationId: Id<"organization">;
+    readonly region: "us-east-1" | "us-east-2" | "us-west-2" | "ap-northeast-1" | "eu-west-1";
+}
+/** Admit the global workspace-deletion operation. */
+export interface WorkspaceDeleteRequest {
+    readonly confirmation: Id<"workspace">;
+}
+/** The workspace view of the account operational state it inherits. */
+export interface WorkspaceOperationalState {
+    readonly inheritedFrom: OperationalStateSource;
+    readonly organizationId: Id<"organization">;
+    readonly state: AccountOperationalState;
+}
+/** One page of workspaces. */
+export interface WorkspacePage {
+    readonly items: ReadonlyArray<Workspace>;
+    readonly nextCursor?: string;
+}
+/** Whether a workspace admits work. */
+export type WorkspaceStatus = "active" | "deleting";
+/** What remains of a deleted workspace. */
+export interface WorkspaceTombstone {
+    readonly deletedAt: string;
+    readonly operationId: Id<"operation">;
+    readonly organizationId: Id<"organization">;
+    readonly workspaceId: Id<"workspace">;
+}