@aexhq/sdk 0.52.0 → 0.53.1

package/dist/generated/models.d.ts

@@ -6,6 +6,7 @@
  */
 export declare const ID_PREFIXES: {
     readonly user: "usr";
+    readonly account: "acc";
     readonly organization: "org";
     readonly membership: "mem";
     readonly invitation: "inv";
@@ -22,16 +23,15 @@ export declare const ID_PREFIXES: {
     readonly file_upload: "ful";
     readonly file_download: "fdl";
     readonly observation: "obs";
-    readonly telemetry_batch: "bch";
-    readonly telemetry_gap: "gap";
-    readonly export: "exp";
     readonly upload: "upl";
     readonly measurement: "msr";
     readonly statement: "stm";
+    readonly payment_method: "pmt";
+    readonly billing_transaction: "txn";
 };
 export type IdKind = keyof typeof ID_PREFIXES;
 export type Id<K extends IdKind = IdKind> = `${(typeof ID_PREFIXES)[K]}_${string}`;
-export declare const ID_KINDS: readonly ("message" | "user" | "organization" | "membership" | "invitation" | "workspace" | "api_key" | "provider_credential" | "session" | "agent" | "tool_call" | "operation" | "approval" | "generation" | "file_upload" | "file_download" | "observation" | "telemetry_batch" | "telemetry_gap" | "export" | "upload" | "measurement" | "statement")[];
+export declare const ID_KINDS: readonly ("message" | "user" | "account" | "organization" | "membership" | "invitation" | "workspace" | "api_key" | "provider_credential" | "session" | "agent" | "tool_call" | "operation" | "approval" | "generation" | "file_upload" | "file_download" | "observation" | "upload" | "measurement" | "statement" | "payment_method" | "billing_transaction")[];
 export declare function idPatternSource(kind: IdKind): string;
 export declare function idPattern(kind: IdKind): RegExp;
 export declare function isId<K extends IdKind>(kind: K, value: unknown): value is Id<K>;
@@ -51,15 +51,13 @@ export type AccountOperationalState = (AccountActiveState & {
 }) | (AccountPausedState & {
     readonly status: "paused";
 });
-/** Why an account is paused, and therefore which remedy exists. One value per durable `finance.billing_account.state` hold: collapsing all four onto `top_up_required` told a customer under a dispute hold to make a payment that would not restore service. */
+/** Why the personal prepaid account cannot admit paid work. */
 export type AccountPauseReason = "top_up_required" | "payment_hold" | "dispute_hold" | "account_closed";
-/** A paused account and what it takes to restore it. */
+/** A paused account and its customer-visible remedy. */
 export interface AccountPausedState {
     readonly changedAt: string;
-    readonly deletionScheduledAt?: string;
     readonly minimumRestoreCents?: string;
     readonly reason: AccountPauseReason;
-    readonly retentionFundedUntil?: string;
     readonly revision: number;
 }
 /** The one error envelope every failing request returns. */
@@ -68,59 +66,93 @@ export interface ApiError {
 }
 /** The failure itself. */
 export interface ApiErrorBody {
-    readonly code: "unauthenticated" | "forbidden" | "insufficient_scope" | "token_invalid" | "token_revoked" | "token_expired" | "malformed_token" | "authorization_pending" | "slow_down" | "not_found" | "gone" | "idempotency_conflict" | "idempotency_in_flight" | "api_key_secret_unavailable" | "operation_idempotency_conflict" | "invalid_request" | "invalid_scope" | "invalid_cursor" | "invalid_file_selection" | "invalid_range" | "unsupported_media_type" | "payload_too_large" | "limit_exceeded" | "session_not_idle" | "session_terminated" | "workspace_activation_required" | "workspace_not_live" | "session_deleting" | "session_deleted" | "deletion_in_progress" | "resource_conflict" | "last_owner_required" | "operation_not_cancelable" | "approval_not_found" | "approval_already_resolved" | "approval_binding_changed" | "file_not_found" | "content_missing" | "export_not_found" | "export_not_ready" | "export_expired" | "export_revoked" | "export_capacity" | "download_grant_expired" | "telemetry_payload_too_large" | "invalid_telemetry" | "telemetry_quota_exceeded" | "telemetry_incomplete" | "unsupported_export_signal" | "invalid_query" | "telemetry_query_budget_exhausted" | "invalid_metric_aggregation" | "invalid_network_policy" | "unsupported_package_ecosystem" | "package_resolution_failed" | "package_artifact_unavailable" | "package_integrity_mismatch" | "unknown_provider" | "unknown_model" | "provider_credential_not_found" | "provider_credential_revoked" | "invalid_auto_topup_policy" | "payment_method_required" | "authentication_unavailable" | "account_paused" | "account_state_unavailable" | "precondition_failed" | "wrong_workspace_region" | "observability_unavailable" | "usage_unavailable" | "rate_limited" | "upstream_error" | "workspace_provision_pending" | "commit_outcome_unknown" | "not_implemented" | "internal_error";
+    readonly code: "unauthenticated" | "forbidden" | "insufficient_scope" | "token_invalid" | "token_revoked" | "token_expired" | "malformed_token" | "slow_down" | "not_found" | "gone" | "idempotency_conflict" | "idempotency_in_flight" | "api_key_secret_unavailable" | "operation_idempotency_conflict" | "invalid_request" | "invalid_scope" | "invalid_cursor" | "invalid_file_selection" | "invalid_range" | "unsupported_media_type" | "payload_too_large" | "limit_exceeded" | "session_not_idle" | "session_terminated" | "workspace_activation_required" | "workspace_not_live" | "session_deleting" | "session_deleted" | "deletion_in_progress" | "resource_conflict" | "last_owner_required" | "operation_not_cancelable" | "approval_not_found" | "approval_already_resolved" | "approval_binding_changed" | "file_not_found" | "content_missing" | "download_grant_expired" | "invalid_query" | "invalid_network_policy" | "unsupported_package_ecosystem" | "package_resolution_failed" | "package_artifact_unavailable" | "package_integrity_mismatch" | "unknown_provider" | "unknown_model" | "invalid_auto_topup_policy" | "payment_method_required" | "authentication_unavailable" | "account_paused" | "account_state_unavailable" | "precondition_failed" | "wrong_workspace_region" | "usage_unavailable" | "usage_coverage_gap" | "rate_limited" | "upstream_error" | "workspace_provision_pending" | "commit_outcome_unknown" | "not_implemented" | "internal_error";
     readonly details?: ErrorDetails;
     readonly message: string;
     readonly operationId?: Id<"operation">;
     readonly requestId: string;
     readonly retryable: boolean;
 }
-/** Workspace API key metadata. There is no public last-used timestamp. */
+/** Workspace API key metadata. Secret material is never returned by reads. */
 export interface ApiKey {
     readonly createdAt: string;
     readonly id: Id<"api_key">;
     readonly name: string;
     readonly revokedAt?: string;
-    readonly scopes: ReadonlyArray<"account:read" | "account:write" | "organizations:read" | "organizations:write" | "memberships:read" | "memberships:write" | "memberships:accept" | "workspaces:read" | "workspaces:write" | "workspaces:delete" | "api_keys:read" | "api_keys:write" | "billing:read" | "billing:write" | "operations:read" | "operations:write" | "workspace:read" | "sessions:read" | "sessions:write" | "sessions:delete" | "files:live" | "resources:read" | "resources:write" | "provider_credentials:read" | "provider_credentials:write" | "telemetry:read" | "telemetry:write">;
+    readonly scopes: ReadonlyArray<"account:read" | "account:write" | "api_keys:read" | "api_keys:write" | "billing:read" | "billing:write" | "sessions:read" | "sessions:write" | "sessions:delete" | "resources:read" | "resources:write">;
     readonly workspaceId: Id<"workspace">;
 }
-/** Mint a workspace API key. */
+/** Mint a key for the account's fixed workspace. */
 export interface ApiKeyCreateRequest {
     readonly name: string;
-    readonly scopes: ReadonlyArray<"account:read" | "account:write" | "organizations:read" | "organizations:write" | "memberships:read" | "memberships:write" | "memberships:accept" | "workspaces:read" | "workspaces:write" | "workspaces:delete" | "api_keys:read" | "api_keys:write" | "billing:read" | "billing:write" | "operations:read" | "operations:write" | "workspace:read" | "sessions:read" | "sessions:write" | "sessions:delete" | "files:live" | "resources:read" | "resources:write" | "provider_credentials:read" | "provider_credentials:write" | "telemetry:read" | "telemetry:write">;
+    readonly scopes: ReadonlyArray<"account:read" | "account:write" | "api_keys:read" | "api_keys:write" | "billing:read" | "billing:write" | "sessions:read" | "sessions:write" | "sessions:delete" | "resources:read" | "resources:write">;
     readonly workspaceId: Id<"workspace">;
 }
-/** One page of API key metadata. */
+/** One bounded page of API key metadata. */
 export interface ApiKeyPage {
     readonly items: ReadonlyArray<ApiKey>;
     readonly nextCursor?: string;
 }
-/** The complete automatic top-up policy. */
-export interface AutoTopupPolicy {
-    readonly amountCents: string;
-    readonly enabled: boolean;
-    readonly organizationId: Id<"organization">;
-    readonly revision: number;
-    readonly thresholdCents: string;
-    readonly updatedAt: string;
-}
-/** Replace the automatic top-up policy; every field is required. */
-export interface AutoTopupPolicyRequest {
-    readonly amountCents: string;
-    readonly enabled: boolean;
-    readonly thresholdCents: string;
-}
-/** The prepaid balance of one organization. */
+/** The current prepaid position of the caller's personal account. */
 export interface BillingBalance {
+    readonly accountId: Id<"account">;
     readonly availableCents: string;
     readonly currency: Currency;
-    readonly operationalState: AccountOperationalState;
-    readonly organizationId: Id<"organization">;
     readonly pendingCents: string;
     readonly reservedCents: string;
-    readonly revision: number;
     readonly updatedAt: string;
 }
+/** One immutable customer-visible ledger transaction. */
+export interface BillingTransaction {
+    readonly amountCents: string;
+    readonly balanceAfterCents: string;
+    readonly currency: Currency;
+    readonly direction: BillingTransactionDirection;
+    readonly id: Id<"billing_transaction">;
+    readonly kind: BillingTransactionKind;
+    readonly occurredAt: string;
+    readonly reversesTransactionId?: Id<"billing_transaction">;
+    readonly sessionId?: Id<"session">;
+}
+/** Whether the transaction increases or decreases available prepaid value. */
+export type BillingTransactionDirection = "credit" | "debit";
+/** The customer-visible reason for an immutable balanced ledger transaction. */
+export type BillingTransactionKind = "top_up" | "usage" | "refund" | "reversal" | "reservation" | "reservation_release";
+/** One newest-first page of immutable ledger transactions. */
+export interface BillingTransactionPage {
+    readonly items: ReadonlyArray<BillingTransaction>;
+    readonly nextCursor?: string;
+}
+/** The independently measured and rated launch categories. */
+export type BillingUsageCategory = "model" | "runtime" | "storage" | "transfer";
+/** The trustworthy completeness boundary for one usage answer. */
+export interface BillingUsageCoverage {
+    readonly completeThrough: string;
+    readonly hasGap: boolean;
+    readonly includesThrough: string;
+}
+/** One bounded rated-usage aggregate with exact charge evidence. */
+export interface BillingUsageItem {
+    readonly amountCents: string;
+    readonly category: BillingUsageCategory;
+    readonly chargedQuantity: string;
+    readonly currency: Currency;
+    readonly model?: string;
+    readonly provider?: ProviderId;
+    readonly quantity: string;
+    readonly serviceTime: TimeRange;
+    readonly sessionId?: Id<"session">;
+    readonly settlement: BillingUsageSettlement;
+    readonly unit: string;
+}
+/** One bounded page of rated usage and its explicit completeness boundary. */
+export interface BillingUsagePage {
+    readonly coverage: BillingUsageCoverage;
+    readonly items: ReadonlyArray<BillingUsageItem>;
+    readonly nextCursor?: string;
+}
+/** Whether this rated row has been posted to the money ledger. */
+export type BillingUsageSettlement = "pending" | "settled";
 /** How inline blob bytes are encoded. */
 export type BlobEncoding = "utf8" | "base64";
 /** A small value carried in the request. */
@@ -134,6 +166,8 @@ export type BlobInput = (BlobInline & {
     readonly type: "inline";
 }) | (BlobUpload & {
     readonly type: "upload";
+}) | (BlobUrl & {
+    readonly type: "url";
 });
 /** A large value staged through the upload surface. */
 export interface BlobUpload {
@@ -141,12 +175,18 @@ export interface BlobUpload {
     readonly sizeBytes: string;
     readonly uploadId: Id<"upload">;
 }
+/** An HTTPS source fetched asynchronously under the platform SSRF, redirect, time and size policy. */
+export interface BlobUrl {
+    readonly url: string;
+}
 /** An explicit inclusive byte range over an immutable object. */
 export interface ByteRange {
     readonly endInclusive: string;
     readonly start: string;
 }
-/** One resolved compute dimension. */
+/** Customer-safe card-network display metadata reported by Stripe. */
+export type CardBrand = "visa" | "mastercard" | "amex" | "discover" | "diners" | "jcb" | "unionpay" | "unknown";
+/** One resolved sandbox compute dimension. */
 export interface ComputeShape {
     readonly memoryMiB: number;
     readonly vcpus: number;
@@ -156,74 +196,34 @@ export interface ContentRef {
     readonly sha256: string;
     readonly sizeBytes: string;
 }
-/** The only supported currency. */
+/** The only launch currency. */
 export type Currency = "USD";
-/** The one bounded read that fills the dashboard shell. */
+/** The single bounded read that fills the launch dashboard shell. */
 export interface DashboardBootstrap {
-    readonly accounts: ReadonlyArray<OrganizationAccount>;
+    readonly accountId: Id<"account">;
+    readonly accountState: AccountOperationalState;
     readonly email: string;
     readonly generatedAt: string;
-    readonly organizations: ReadonlyArray<Organization>;
     readonly userId: Id<"user">;
-    readonly workspaces: ReadonlyArray<Workspace>;
+    readonly workspace: Workspace;
 }
-/** A minted browser session, returned exactly once. */
+/** A rotated browser session returned exactly once. */
 export interface DashboardSessionCredential {
     readonly expiresAt: string;
     readonly session: string;
     readonly userId: Id<"user">;
 }
-/** Complete a browser sign-in by handing this plane the authorization code a provider redirect returned. `central-identity-api` performs the token exchange with the provider itself, so nothing the caller asserts about who they are is believed: the person is whoever the provider answers with. */
+/** Complete a Google OAuth browser sign-in using PKCE-bound state. */
 export interface DashboardSessionRequest {
     readonly code: string;
     readonly codeVerifier: string;
-    readonly provider: IdentityProvider;
     readonly state: string;
 }
-/** A session whose irreversible deletion is running; rendered at 410. */
+/** Minimal deletion marker returned while content cleanup runs. */
 export interface DeletingSession {
     readonly id: Id<"session">;
     readonly operationId: Id<"operation">;
     readonly startedAt: string;
-    readonly workspaceId: Id<"workspace">;
-}
-/** A pending device authorization the user must approve in a browser. */
-export interface DeviceAuthorization {
-    readonly deviceCode: string;
-    readonly expiresAt: string;
-    readonly intervalSeconds: number;
-    readonly userCode: string;
-    readonly verificationUri: string;
-    readonly verificationUriComplete: string;
-}
-/** Begin the CLI device-authorization flow. */
-export interface DeviceAuthorizationRequest {
-    readonly clientId: string;
-    readonly scopes: ReadonlyArray<"account:read" | "account:write" | "organizations:read" | "organizations:write" | "memberships:read" | "memberships:write" | "memberships:accept" | "workspaces:read" | "workspaces:write" | "workspaces:delete" | "api_keys:read" | "api_keys:write" | "billing:read" | "billing:write" | "operations:read" | "operations:write" | "workspace:read" | "sessions:read" | "sessions:write" | "sessions:delete" | "files:live" | "resources:read" | "resources:write" | "provider_credentials:read" | "provider_credentials:write" | "telemetry:read" | "telemetry:write">;
-}
-/** What a person chose about a device authorization. */
-export type DeviceDecision = "approve" | "deny";
-/** Approve or deny a pending device authorization by its user code. */
-export interface DeviceDecisionRequest {
-    readonly decision: DeviceDecision;
-    readonly userCode: string;
-}
-/** The recorded outcome of a device decision. */
-export interface DeviceDecisionResult {
-    readonly decidedAt: string;
-    readonly decision: DeviceDecision;
-    readonly scopes: ReadonlyArray<"account:read" | "account:write" | "organizations:read" | "organizations:write" | "memberships:read" | "memberships:write" | "memberships:accept" | "workspaces:read" | "workspaces:write" | "workspaces:delete" | "api_keys:read" | "api_keys:write" | "billing:read" | "billing:write" | "operations:read" | "operations:write" | "workspace:read" | "sessions:read" | "sessions:write" | "sessions:delete" | "files:live" | "resources:read" | "resources:write" | "provider_credentials:read" | "provider_credentials:write" | "telemetry:read" | "telemetry:write">;
-}
-/** An issued account token. */
-export interface DeviceToken {
-    readonly accountToken: string;
-    readonly expiresAt: string;
-    readonly scopes: ReadonlyArray<"account:read" | "account:write" | "organizations:read" | "organizations:write" | "memberships:read" | "memberships:write" | "memberships:accept" | "workspaces:read" | "workspaces:write" | "workspaces:delete" | "api_keys:read" | "api_keys:write" | "billing:read" | "billing:write" | "operations:read" | "operations:write" | "workspace:read" | "sessions:read" | "sessions:write" | "sessions:delete" | "files:live" | "resources:read" | "resources:write" | "provider_credentials:read" | "provider_credentials:write" | "telemetry:read" | "telemetry:write">;
-}
-/** Exchange an approved device code for an account token. */
-export interface DeviceTokenRequest {
-    readonly clientId: string;
-    readonly deviceCode: string;
 }
 /** A short-lived signed grant for exactly one object and range. */
 export interface DownloadGrant {
@@ -239,7 +239,7 @@ export interface DownloadGrant {
 export interface EffectiveWorkspaceLimit {
     readonly changedAt: string;
     readonly effectiveValue: LimitValue;
-    readonly id: "context.tool_result_bytes" | "session.materialized_agents" | "session.initial_files_bytes" | "session.initial_files_count" | "session.agent_execution" | "session.run_budget" | "api.json_body" | "telemetry.batch" | "telemetry.ingest_rate" | "telemetry.metric_series" | "query.filter" | "query.page" | "stream.frame" | "metric.aggregate" | "registry.entries" | "registry.value_bytes" | "telemetry.export";
+    readonly id: "context.tool_result_bytes" | "session.materialized_agents" | "session.initial_files_bytes" | "session.initial_files_count" | "session.agent_execution" | "session.run_budget" | "api.json_body" | "query.page" | "registry.entries" | "registry.value_bytes";
     readonly revision: number;
     readonly source: LimitSource;
 }
@@ -265,17 +265,11 @@ export type ErrorDetails = (ErrorDetailsRequiredScope & {
     readonly type: "operation";
 }) | (ErrorDetailsValidation & {
     readonly type: "validation";
-}) | (ErrorDetailsGap & {
-    readonly type: "gap";
 });
-/** The telemetry gaps that blocked a completeness requirement. */
-export interface ErrorDetailsGap {
-    readonly gapIds: ReadonlyArray<Id<"telemetry_gap">>;
-}
 /** The effective limit that was exceeded. */
 export interface ErrorDetailsLimit {
     readonly effective: string;
-    readonly limit: "context.tool_result_bytes" | "session.materialized_agents" | "session.initial_files_bytes" | "session.initial_files_count" | "session.agent_execution" | "session.run_budget" | "api.json_body" | "telemetry.batch" | "telemetry.ingest_rate" | "telemetry.metric_series" | "query.filter" | "query.page" | "stream.frame" | "metric.aggregate" | "registry.entries" | "registry.value_bytes" | "telemetry.export";
+    readonly limit: "context.tool_result_bytes" | "session.materialized_agents" | "session.initial_files_bytes" | "session.initial_files_count" | "session.agent_execution" | "session.run_budget" | "api.json_body" | "query.page" | "registry.entries" | "registry.value_bytes";
     readonly measured: string;
 }
 /** The original operation the replay resolved to. */
@@ -285,7 +279,7 @@ export interface ErrorDetailsOperation {
 /** The quota dimension that was exhausted. */
 export interface ErrorDetailsQuota {
     readonly attempted: string;
-    readonly dimension: "context.tool_result_bytes" | "session.materialized_agents" | "session.initial_files_bytes" | "session.initial_files_count" | "session.agent_execution" | "session.run_budget" | "api.json_body" | "telemetry.batch" | "telemetry.ingest_rate" | "telemetry.metric_series" | "query.filter" | "query.page" | "stream.frame" | "metric.aggregate" | "registry.entries" | "registry.value_bytes" | "telemetry.export";
+    readonly dimension: "context.tool_result_bytes" | "session.materialized_agents" | "session.initial_files_bytes" | "session.initial_files_count" | "session.agent_execution" | "session.run_budget" | "api.json_body" | "query.page" | "registry.entries" | "registry.value_bytes";
     readonly used: string;
 }
 /** The authoritative placement of the workspace. */
@@ -295,7 +289,7 @@ export interface ErrorDetailsRegion {
 }
 /** The scope the credential lacks. */
 export interface ErrorDetailsRequiredScope {
-    readonly scope: "account:read" | "account:write" | "organizations:read" | "organizations:write" | "memberships:read" | "memberships:write" | "memberships:accept" | "workspaces:read" | "workspaces:write" | "workspaces:delete" | "api_keys:read" | "api_keys:write" | "billing:read" | "billing:write" | "operations:read" | "operations:write" | "workspace:read" | "sessions:read" | "sessions:write" | "sessions:delete" | "files:live" | "resources:read" | "resources:write" | "provider_credentials:read" | "provider_credentials:write" | "telemetry:read" | "telemetry:write";
+    readonly scope: "account:read" | "account:write" | "api_keys:read" | "api_keys:write" | "billing:read" | "billing:write" | "sessions:read" | "sessions:write" | "sessions:delete" | "resources:read" | "resources:write";
 }
 /** How long to wait before retrying. */
 export interface ErrorDetailsRetry {
@@ -306,46 +300,7 @@ export interface ErrorDetailsValidation {
     readonly pointer: string;
     readonly reason: string;
 }
-/** What an export does when the window has recorded gaps. */
-export type ExportCompleteness = "require" | "allow_gaps";
-/** The two export formats. Parquet is deliberately absent: its encoder is a
-typed refusal pending a writer that can be pinned to byte-identical
-output, and admitting an operation guaranteed to fail is worse than
-refusing the request. Re-adding it is a wire change.
- */
-export type ExportFormat = "ndjson" | "otlp_json";
-/** What one export walks. Deliberately not an `ObservationQuery`: an export
-has no caller-visible pagination, so a cursor, a limit and a walk
-direction are meaningless states rather than states to refuse at runtime.
-The partition list and the snapshot position are pinned at admission and
-live on the export row, which is the only channel the task has.
- */
-export interface ExportQuery {
-    readonly consistency?: ObservationConsistency;
-    readonly filter?: ObservationFilter;
-    readonly signal: ObservationSignal;
-    readonly timeRange: TimeRange;
-}
-/** Where an export is in its lifecycle. */
-export type ExportStatus = "preparing" | "ready" | "failed" | "expired" | "revoked";
-/** One file entry, identified by its normalized POSIX path. */
-export interface FileEntry {
-    readonly mode: string;
-    readonly mtime: string;
-    readonly path: string;
-    readonly sha256?: string;
-    readonly sizeBytes: string;
-    readonly target?: string;
-    readonly type: FileEntryType;
-}
-/** One page of file entries. */
-export interface FileEntryPage {
-    readonly items: ReadonlyArray<FileEntry>;
-    readonly nextCursor?: string;
-}
-/** What a file entry is. */
-export type FileEntryType = "file" | "directory" | "symlink";
-/** The guest network policy. */
+/** The sandbox network policy. */
 export interface HandsNetworkRequest {
     readonly mode: NetworkMode;
 }
@@ -359,32 +314,6 @@ export interface HttpHeader {
     readonly name: string;
     readonly value: string;
 }
-/** An external sign-in provider AEX links a person to. */
-export type IdentityProvider = "google";
-/** A pending invitation to join an organization. */
-export interface Invitation {
-    readonly createdAt: string;
-    readonly email: string;
-    readonly expiresAt: string;
-    readonly id: Id<"invitation">;
-    readonly organizationId: Id<"organization">;
-    readonly resolvedAt?: string;
-    readonly role: InvitationRole;
-    readonly status: InvitationStatus;
-}
-/** What one acceptance redeemed. An invitation carries no secret, so acceptance names nothing: every pending invitation addressed to the caller's verified email is redeemed in one transaction. The list is empty when nothing was pending, which is what a repeated call answers. */
-export interface InvitationAcceptResult {
-    readonly memberships: ReadonlyArray<Membership>;
-}
-/** Invite a person to an organization. */
-export interface InvitationCreateRequest {
-    readonly email: string;
-    readonly role: InvitationRole;
-}
-/** The role an invitation grants; ownership is never invited. */
-export type InvitationRole = "admin" | "member";
-/** Where an invitation is in its lifecycle. */
-export type InvitationStatus = "pending" | "accepted" | "revoked" | "expired";
 /** A limit whose effective value is a map of named dimensions. */
 export interface LimitMapValue {
     readonly values: Readonly<Record<string, string>>;
@@ -401,116 +330,18 @@ export type LimitValue = (LimitScalarValue & {
 }) | (LimitMapValue & {
     readonly shape: "map";
 });
-/** One exact-generation descriptor-pinned multipart download. It carries no object-store URL: every part is read directly from the retained `MicroVM`. */
-export interface LiveFileDownload {
-    readonly expiresAt: string;
-    readonly generationId: Id<"generation">;
-    readonly id: Id<"file_download">;
-    readonly partCount: number;
-    readonly partSizeBytes: number;
-    readonly parts: ReadonlyArray<LiveFileDownloadPart>;
-    readonly path: string;
-    readonly sessionId: Id<"session">;
-    readonly sha256: string;
-    readonly sizeBytes: string;
-    readonly state: LiveFileDownloadState;
-    readonly version: string;
-    readonly workspaceAccess: WorkspaceAccess;
-}
-/** Close an exact live-file descriptor after the SDK verified every part and the whole hash. */
-export interface LiveFileDownloadCompleteRequest {
-    readonly sha256: string;
-    readonly version: string;
-}
-/** One fixed range and its expected digest in an exact live-file version. */
-export interface LiveFileDownloadPart {
-    readonly offset: string;
-    readonly partNumber: number;
-    readonly sha256: string;
-    readonly sizeBytes: number;
-}
-/** Open one regular file without following a symlink, auto-resuming the same generation. */
-export interface LiveFileDownloadRequest {
-    readonly ifGenerationId?: Id<"generation">;
-    readonly path: string;
-}
-/** Whether an exact-version live download is still open or fully verified. */
-export type LiveFileDownloadState = "open" | "verified";
-/** One live file entry plus what the read did to the workspace. */
-export interface LiveFileEntry {
-    readonly entry: FileEntry;
-    readonly workspaceAccess: WorkspaceAccess;
-}
-/** One page of live file entries plus what the read did. */
-export interface LiveFileEntryPage {
-    readonly items: ReadonlyArray<FileEntry>;
-    readonly nextCursor?: string;
-    readonly workspaceAccess: WorkspaceAccess;
-}
-/** List live workspace files, auto-resuming the same retained generation if suspended. */
-export interface LiveFileListRequest {
-    readonly cursor?: string;
-    readonly ifGenerationId?: Id<"generation">;
-    readonly limit?: number;
-    readonly path?: string;
-    readonly recursive?: boolean;
-}
-/** Stat one live workspace file, auto-resuming the same retained generation if suspended. */
-export interface LiveFileStatRequest {
-    readonly ifGenerationId?: Id<"generation">;
-    readonly path: string;
-}
-/** One resumable upload held only by the session's exact `MicroVM` generation. Suspension retains it; termination or runtime loss destroys it. */
-export interface LiveFileUpload {
-    readonly expiresAt: string;
-    readonly generationId: Id<"generation">;
-    readonly id: Id<"file_upload">;
-    readonly mode: RegisteredFileMode;
-    readonly partCount: number;
-    readonly partSizeBytes: number;
-    readonly parts: ReadonlyArray<LiveFileUploadPart>;
-    readonly path: string;
-    readonly sessionId: Id<"session">;
-    readonly sha256: string;
-    readonly sizeBytes: string;
-    readonly state: LiveFileUploadState;
-    readonly workspaceAccess: WorkspaceAccess;
-}
-/** Create or exactly replay a resumable upload in the session's retained generation. */
-export interface LiveFileUploadCreateRequest {
-    readonly ifGenerationId?: Id<"generation">;
-    readonly mode?: RegisteredFileMode;
-    readonly path: string;
-    readonly sha256: string;
-    readonly sizeBytes: string;
-}
-/** One verified logical part retained by the exact `MicroVM` generation. */
-export interface LiveFileUploadPart {
-    readonly offset: string;
-    readonly partNumber: number;
-    readonly sha256: string;
-    readonly sizeBytes: number;
-}
-/** The generation-local position of one ephemeral upload. */
-export type LiveFileUploadState = "staging" | "complete";
-/** A person's role inside one organization. */
-export interface Membership {
-    readonly createdAt: string;
-    readonly email: string;
-    readonly id: Id<"membership">;
-    readonly organizationId: Id<"organization">;
-    readonly role: OrganizationRole;
-    readonly status: MembershipStatus;
-    readonly userId: Id<"user">;
-}
-/** One page of memberships. */
-export interface MembershipPage {
-    readonly items: ReadonlyArray<Membership>;
-    readonly nextCursor?: string;
+/** One frozen MCP definition and its bounded tool namespace. */
+export interface McpServer {
+    readonly name: string;
+    readonly transport: McpTransport;
 }
-/** Whether a membership is usable. */
-export type MembershipStatus = "active";
-/** One complete, sealed message in a session. `createdAt` is display metadata; collection order is the immutable seal-visibility order and is not derived from this field. */
+/** The two admitted MCP transports. */
+export type McpTransport = (RemoteMcpServer & {
+    readonly kind: "remote_http";
+}) | (SandboxMcpServer & {
+    readonly kind: "sandbox_process";
+});
+/** One complete sealed message in immutable visibility order. */
 export interface Message {
     readonly content: ReadonlyArray<MessagePart>;
     readonly createdAt: string;
@@ -518,12 +349,12 @@ export interface Message {
     readonly role: MessageRole;
     readonly sessionId: Id<"session">;
 }
-/** One page of complete sealed messages, ordered by the immutable seal-visibility tuple `(sealedAt, messageId)`. Open partial messages are never visible. */
+/** One page of complete messages. */
 export interface MessagePage {
     readonly items: ReadonlyArray<Message>;
     readonly nextCursor?: string;
 }
-/** One part of a complete message. Admission is text-only; assistant and tool messages may contain canonical built-in tool records. */
+/** One part of a complete committed message. */
 export type MessagePart = (MessagePartText & {
     readonly type: "text";
 }) | (MessagePartToolCall & {
@@ -531,356 +362,103 @@ export type MessagePart = (MessagePartText & {
 }) | (MessagePartToolResult & {
     readonly type: "tool_result";
 });
-/** A text part. */
+/** Text content. */
 export interface MessagePartText {
     readonly text: string;
 }
-/** A built-in tool call emitted by the model. */
+/** Canonical provider-independent tool call. */
 export interface MessagePartToolCall {
-    readonly argumentsDigest: string;
+    readonly arguments: JsonValue;
     readonly id: Id<"tool_call">;
+    readonly name: string;
 }
-/** The canonical result of a built-in tool call. */
+/** Bounded tool result; large/full bytes remain at its sandbox path unless storage.persist explicitly registers them as a workspace file. */
 export interface MessagePartToolResult {
     readonly id: Id<"tool_call">;
-    readonly resultDigest: string;
+    readonly preview: string;
+    readonly sandboxPath?: string;
+    readonly sha256?: string;
+    readonly sizeBytes?: string;
+    readonly truncated: boolean;
 }
-/** Who produced a message. */
+/** Who produced a committed message. */
 export type MessageRole = "user" | "assistant" | "tool";
-/** Admit one text message of at most 24,576 UTF-8 bytes. Omitting `maxSpendCents` selects the 1000-cent default; an explicit positive value may be higher or lower. Omitting `deadline` uses the session's remaining lifetime/drain fence; an explicit deadline may only shorten it. */
+/** Text-only user message; arbitrary files are referenced by mounted paths in this text. */
 export interface MessageSendRequest {
     readonly deadline?: string;
     readonly maxSpendCents?: string;
+    readonly responseFormat?: ResponseFormat;
     readonly text: string;
 }
-/** The admitted user message and the session now processing it. */
+/** The admitted user message and session now processing it. */
 export interface MessageSendResult {
     readonly message: Message;
     readonly session: Session;
 }
-/** The calculations a metric aggregation may request. */
-export type MetricAggregationCalculation = "sum" | "count" | "min" | "max" | "avg";
-/** One aggregated group. */
-export interface MetricAggregationGroup {
-    readonly key: Readonly<Record<string, string>>;
-    readonly sampleCount: string;
-    readonly value: number;
-}
-/** One page of aggregated groups plus the coverage they are complete over. */
-export interface MetricAggregationPage {
-    readonly coverage: ObservationCoverage;
-    readonly items: ReadonlyArray<MetricAggregationGroup>;
-    readonly nextCursor?: string;
-}
-/** A bounded metric aggregation. */
-export interface MetricAggregationRequest {
-    readonly calculation: MetricAggregationCalculation;
-    readonly cursor?: string;
-    readonly filter?: ObservationFilter;
-    readonly groupBy?: ReadonlyArray<string>;
-    readonly limit?: number;
-    readonly metric: string;
-    readonly timeRange: TimeRange;
-}
-/** A known hole in the ordered series. */
-export interface MissingInterval {
-    readonly gapId: Id<"telemetry_gap">;
-    readonly range: TimeRange;
+/** One bounded NDJSON assistant-stream frame. */
+export interface MessageStreamFrame {
+    readonly kind: MessageStreamKind;
+    readonly message?: Message;
+    readonly messageId?: Id<"message">;
+    readonly sequence: string;
+    readonly text?: string;
 }
+/** Preview/commit reconciliation protocol. */
+export type MessageStreamKind = "preview" | "committed" | "reconcile" | "gap" | "heartbeat";
 /** An explicit provider and model pair; a model-only override is rejected. */
 export interface ModelSelection {
-    readonly credentialId?: Id<"provider_credential">;
     readonly model: string;
     readonly provider: ProviderId;
 }
-/** What the guest may reach. */
+/** What the sandbox may reach. */
 export type NetworkMode = "none" | "public_internet";
-/** A freshly minted key. The value never appears in a later read. */
+/** A freshly minted key; its value is returned once and never stored. */
 export interface NewApiKey {
     readonly createdAt: string;
     readonly id: Id<"api_key">;
     readonly name: string;
-    readonly scopes: ReadonlyArray<"account:read" | "account:write" | "organizations:read" | "organizations:write" | "memberships:read" | "memberships:write" | "memberships:accept" | "workspaces:read" | "workspaces:write" | "workspaces:delete" | "api_keys:read" | "api_keys:write" | "billing:read" | "billing:write" | "operations:read" | "operations:write" | "workspace:read" | "sessions:read" | "sessions:write" | "sessions:delete" | "files:live" | "resources:read" | "resources:write" | "provider_credentials:read" | "provider_credentials:write" | "telemetry:read" | "telemetry:write">;
+    readonly scopes: ReadonlyArray<"account:read" | "account:write" | "api_keys:read" | "api_keys:write" | "billing:read" | "billing:write" | "sessions:read" | "sessions:write" | "sessions:delete" | "resources:read" | "resources:write">;
     readonly value: string;
     readonly workspaceId: Id<"workspace">;
 }
-/** One admitted observation, in the canonical envelope. */
-export interface Observation {
-    readonly acceptedAt: string;
-    readonly body: JsonValue;
-    readonly id: Id<"observation">;
-    readonly observedAt: string;
-    readonly sequence: string;
-    readonly sessionId?: Id<"session">;
-    readonly signal: ObservationSignal;
-    readonly spanId?: string;
-    readonly traceId?: string;
-    readonly workspaceId: Id<"workspace">;
-}
-/** How much of the accepted series a read must observe. */
-export type ObservationConsistency = "indexed" | "accepted";
-/** What the answer is actually complete over. Never omitted. All four watermarks are accepted-time positions in epoch milliseconds (O-04). */
-export interface ObservationCoverage {
-    readonly accepted: string;
-    readonly caughtUp: boolean;
-    readonly complete: boolean;
-    readonly earliestReplay: string;
-    readonly indexed: string;
-    readonly missingIntervals: ReadonlyArray<MissingInterval>;
-    readonly snapshot: string;
-    readonly unboundedGaps: ReadonlyArray<Id<"telemetry_gap">>;
-}
-/** A bounded filter AST. Structural bounds are enforced before construction. */
-export type ObservationFilter = (ObservationFilterAll & {
-    readonly op: "all";
-}) | (ObservationFilterAny & {
-    readonly op: "any";
-}) | (ObservationFilterNot & {
-    readonly op: "not";
-}) | (ObservationFilterCompare & {
-    readonly op: "compare";
-}) | (ObservationFilterIn & {
-    readonly op: "in";
-}) | (ObservationFilterExists & {
-    readonly op: "exists";
-});
-/** Every child must match. */
-export interface ObservationFilterAll {
-    readonly filters: ReadonlyArray<ObservationFilter>;
-}
-/** At least one child must match. */
-export interface ObservationFilterAny {
-    readonly filters: ReadonlyArray<ObservationFilter>;
-}
-/** A comparison against one field. */
-export interface ObservationFilterCompare {
-    readonly field: string;
-    readonly operator: ObservationOperator;
-    readonly value: string;
-}
-/** Presence of a field. */
-export interface ObservationFilterExists {
-    readonly field: string;
-}
-/** Membership of a bounded value set. */
-export interface ObservationFilterIn {
-    readonly field: string;
-    readonly values: ReadonlyArray<string>;
-}
-/** The child must not match. */
-export interface ObservationFilterNot {
-    readonly filters: ReadonlyArray<ObservationFilter>;
-}
-/** One NDJSON frame. `stream` and `listen` emit nothing else. */
-export type ObservationFrame = (ObservationFrameRecords & {
-    readonly type: "records";
-}) | (ObservationFrameGap & {
-    readonly type: "gap";
-}) | (ObservationFrameCursor & {
-    readonly type: "cursor";
-}) | (ObservationFrameRotate & {
-    readonly type: "rotate";
-});
-/** A resumable position. */
-export interface ObservationFrameCursor {
-    readonly coverage: ObservationCoverage;
-    readonly cursor: string;
-}
-/** A gap surfaced inline; it is never silently skipped. */
-export interface ObservationFrameGap {
-    readonly gap: TelemetryGap;
-}
-/** A batch of observations. The server splits before the effective frame bound. */
-export interface ObservationFrameRecords {
-    readonly items: ReadonlyArray<Observation>;
-}
-/** The terminal condition after a 200. A stream always ends with a reason. */
-export interface ObservationFrameRotate {
-    readonly cursor?: string;
-    readonly error?: ApiErrorBody;
-    readonly reason: RotateReason;
-    readonly retryable: boolean;
-}
-/** Capture the current accepted position and follow it. Origins are rejected. */
-export interface ObservationListenRequest {
-    readonly filter?: ObservationFilter;
-    readonly signal: ObservationSignal;
-}
-/** The comparison operators a filter leaf may use. */
-export type ObservationOperator = "eq" | "ne" | "lt" | "lte" | "gt" | "gte" | "prefix";
-/** Which direction a read walks the ordered series. */
-export type ObservationOrder = "ascending" | "descending";
-/** Exactly one origin. A stream that declares none or two is rejected. */
-export type ObservationOrigin = (ObservationOriginCursor & {
-    readonly from: "cursor";
-}) | (ObservationOriginTime & {
-    readonly from: "time";
-}) | (ObservationOriginEarliest & {
-    readonly from: "earliest";
-});
-/** Resume from an exact prior position. */
-export interface ObservationOriginCursor {
-    readonly cursor: string;
-}
-/** Start from the earliest replayable position. */
-export type ObservationOriginEarliest = Readonly<Record<string, never>>;
-/** Start from an instant. */
-export interface ObservationOriginTime {
-    readonly at: string;
-}
-/** One page of observations plus the coverage it is complete over. */
-export interface ObservationPage {
-    readonly coverage: ObservationCoverage;
-    readonly items: ReadonlyArray<Observation>;
-    readonly nextCursor?: string;
-}
-/** A bounded, paged observation read. */
-export interface ObservationQuery {
-    readonly consistency?: ObservationConsistency;
-    readonly cursor?: string;
-    readonly filter?: ObservationFilter;
-    readonly limit?: number;
-    readonly order?: ObservationOrder;
-    readonly signal: ObservationSignal;
-    readonly timeRange: TimeRange;
-}
-/** The six observable signals. */
-export type ObservationSignal = "events" | "logs" | "spans" | "metrics" | "traces" | "telemetry";
-/** Replay from exactly one declared origin as NDJSON. */
-export interface ObservationStreamRequest {
-    readonly filter?: ObservationFilter;
-    readonly origin: ObservationOrigin;
-    readonly signal: ObservationSignal;
-}
-/** A durable operation record. */
-export interface Operation {
-    readonly cancelable: boolean;
-    readonly committedAt?: string;
-    readonly createdAt: string;
-    readonly error?: OperationFailure;
-    readonly id: Id<"operation">;
-    readonly kind: OperationKind;
-    readonly progress?: OperationProgress;
-    readonly result?: OperationResult;
-    readonly sessionId?: Id<"session">;
-    readonly startedAt?: string;
-    readonly status: OperationStatus;
-    readonly terminalAt?: string;
-    readonly updatedAt: string;
-    readonly workspaceId: Id<"workspace">;
-}
-/** A durable operation failure. It carries no synthetic request identity. */
-export interface OperationFailure {
-    readonly code: "unauthenticated" | "forbidden" | "insufficient_scope" | "token_invalid" | "token_revoked" | "token_expired" | "malformed_token" | "authorization_pending" | "slow_down" | "not_found" | "gone" | "idempotency_conflict" | "idempotency_in_flight" | "api_key_secret_unavailable" | "operation_idempotency_conflict" | "invalid_request" | "invalid_scope" | "invalid_cursor" | "invalid_file_selection" | "invalid_range" | "unsupported_media_type" | "payload_too_large" | "limit_exceeded" | "session_not_idle" | "session_terminated" | "workspace_activation_required" | "workspace_not_live" | "session_deleting" | "session_deleted" | "deletion_in_progress" | "resource_conflict" | "last_owner_required" | "operation_not_cancelable" | "approval_not_found" | "approval_already_resolved" | "approval_binding_changed" | "file_not_found" | "content_missing" | "export_not_found" | "export_not_ready" | "export_expired" | "export_revoked" | "export_capacity" | "download_grant_expired" | "telemetry_payload_too_large" | "invalid_telemetry" | "telemetry_quota_exceeded" | "telemetry_incomplete" | "unsupported_export_signal" | "invalid_query" | "telemetry_query_budget_exhausted" | "invalid_metric_aggregation" | "invalid_network_policy" | "unsupported_package_ecosystem" | "package_resolution_failed" | "package_artifact_unavailable" | "package_integrity_mismatch" | "unknown_provider" | "unknown_model" | "provider_credential_not_found" | "provider_credential_revoked" | "invalid_auto_topup_policy" | "payment_method_required" | "authentication_unavailable" | "account_paused" | "account_state_unavailable" | "precondition_failed" | "wrong_workspace_region" | "observability_unavailable" | "usage_unavailable" | "rate_limited" | "upstream_error" | "workspace_provision_pending" | "commit_outcome_unknown" | "not_implemented" | "internal_error";
-    readonly detail?: JsonValue;
-    readonly retryable: boolean;
-}
-/** Every durable operation the platform admits. */
-export type OperationKind = "session_cancel" | "session_suspend" | "session_resume" | "session_terminate" | "session_delete" | "telemetry_export" | "workspace_delete";
-/** One page of durable operations. */
-export interface OperationPage {
-    readonly items: ReadonlyArray<Operation>;
-    readonly nextCursor?: string;
-}
-/** Coarse progress; never a completion promise. */
-export interface OperationProgress {
-    readonly completed?: string;
-    readonly phase: string;
-    readonly total?: string;
-}
-/** The typed successful result of a durable operation. */
-export type OperationResult = (SessionCancelResult & {
-    readonly kind: "session_cancel";
-}) | (SessionSuspendResult & {
-    readonly kind: "session_suspend";
-}) | (SessionResumeResult & {
-    readonly kind: "session_resume";
-}) | (SessionTerminateResult & {
-    readonly kind: "session_terminate";
-}) | (SessionTombstone & {
-    readonly kind: "session_delete";
-}) | (TelemetryExportResult & {
-    readonly kind: "telemetry_export";
-}) | (WorkspaceTombstone & {
-    readonly kind: "workspace_delete";
-});
-/** Where a durable operation is in its lifecycle. */
-export type OperationStatus = "queued" | "running" | "succeeded" | "failed" | "cancelled";
-/** Where a workspace operational state comes from. */
-export type OperationalStateSource = "account";
-/** The billing and ownership boundary. */
-export interface Organization {
-    readonly callerRole: OrganizationRole;
-    readonly createdAt: string;
-    readonly id: Id<"organization">;
-    readonly name: string;
-    readonly slug: string;
-}
-/** One organization's operational state in a multi-organization dashboard snapshot. */
-export interface OrganizationAccount {
-    readonly organizationId: Id<"organization">;
-    readonly state: AccountOperationalState;
-}
-/** Create an organization. */
-export interface OrganizationCreateRequest {
-    readonly name: string;
-}
-/** One page of organizations. */
-export interface OrganizationPage {
-    readonly items: ReadonlyArray<Organization>;
-    readonly nextCursor?: string;
-}
-/** The caller role inside one organization. */
-export type OrganizationRole = "owner" | "admin" | "member";
-/** The package ecosystems a session may pre-install from. */
+/** Supported setup package ecosystems. */
 export type PackageEcosystem = "apt" | "pip" | "npm";
-/** One exactly-pinned package to pre-install. */
+/** One exactly pinned setup package. */
 export interface PackageRequest {
     readonly ecosystem: PackageEcosystem;
     readonly name: string;
     readonly version: string;
 }
-/** Create a hosted billing portal session. */
-export interface PortalSessionRequest {
-    readonly returnUrl?: string;
-}
-/** A BYOK provider-credential binding. The key material never appears here. */
-export interface ProviderCredential {
+/** Display-only metadata for one Stripe card; never PAN, CVC, or a client secret. */
+export interface PaymentMethod {
+    readonly brand: CardBrand;
     readonly createdAt: string;
-    readonly fingerprint: string;
-    readonly id: Id<"provider_credential">;
-    readonly name: string;
-    readonly provider: ProviderId;
-    readonly revision: number;
-    readonly revokedAt?: string;
-    readonly state: ProviderCredentialState;
-    readonly updatedAt: string;
-}
-/** One page of provider-credential bindings. */
-export interface ProviderCredentialPage {
-    readonly items: ReadonlyArray<ProviderCredential>;
-    readonly nextCursor?: string;
-}
-/** Register a BYOK provider credential. This request carries plaintext. */
-export interface ProviderCredentialRegisterRequest {
-    readonly apiKey: string;
-    readonly name: string;
-    readonly provider: ProviderId;
+    readonly expiryMonth: number;
+    readonly expiryYear: number;
+    readonly id: Id<"payment_method">;
+    readonly isDefault: boolean;
+    readonly last4: string;
+}
+/** The bounded set of cards attached to the caller's account. */
+export interface PaymentMethodPage {
+    readonly items: ReadonlyArray<PaymentMethod>;
+}
+/** Request a Stripe-hosted card setup session. */
+export interface PaymentMethodSessionRequest {
+    readonly cancelUrl?: string;
+    readonly consent: boolean;
+    readonly successUrl?: string;
 }
-/** Whether a BYOK binding may still be selected. */
-export type ProviderCredentialState = "ready" | "revoked";
-/** The eight customer-owned BYOK authorities. Gateway authorities use fixed endpoints; arbitrary base URLs are not accepted. */
-export type ProviderId = "openai" | "anthropic" | "deepseek" | "zai" | "moonshotai" | "google" | "openrouter" | "vercel_ai_gateway";
+/** The candidate official BYOK authorities. Only models admitted by the current Rig-backed catalog are selectable; arbitrary base URLs are not accepted. */
+export type ProviderId = "openai" | "anthropic" | "deepseek" | "xai" | "meta" | "moonshotai" | "alibaba";
 /** A registered file entry, complete. */
 export interface RegisteredFile {
     readonly createdAt: string;
+    readonly failureCode?: string;
     readonly name: string;
-    readonly revision: number;
-    readonly sha256: string;
-    readonly sizeBytes: string;
     readonly state: RegisteredState;
     readonly updatedAt: string;
-    readonly value: RegisteredFileRead;
+    readonly value?: RegisteredFileRead;
 }
 /** The two permitted registered-file modes. */
 export type RegisteredFileMode = "0644" | "0755";
@@ -894,32 +472,33 @@ export interface RegisteredFileRead {
     readonly content: ContentRef;
     readonly mediaType: string;
     readonly mode: RegisteredFileMode;
-    readonly mountPath: string;
 }
 /** One registered file as a collection row. A listing carries no value document; read the entry itself to get one. */
 export interface RegisteredFileRow {
     readonly createdAt: string;
+    readonly failureCode?: string;
     readonly name: string;
-    readonly revision: number;
-    readonly sha256: string;
-    readonly sizeBytes: string;
     readonly state: RegisteredState;
     readonly updatedAt: string;
 }
-/** A registered file. */
+/** A latest-only registered file replacement. */
 export interface RegisteredFileValue {
     readonly content: BlobInput;
     readonly mediaType: string;
     readonly mode: RegisteredFileMode;
-    readonly mountPath: string;
 }
-/** The only state a registered entry has; there is no version history. */
-export type RegisteredState = "current";
+/** State of the single current value; prior values are never addressable. */
+export type RegisteredState = "pending" | "ready" | "failed";
 /** Mint a download grant for a registered file. */
 export interface RegistryDownloadRequest {
     readonly range?: ByteRange;
 }
-/** The complete provider-derived capacity of the selected shape. */
+/** A remote Streamable HTTP MCP server frozen at session setup and invoked on demand inside the sandbox. */
+export interface RemoteMcpServer {
+    readonly headers?: Readonly<Record<string, string>>;
+    readonly url: string;
+}
+/** Complete provider-derived capacity of the frozen shape. */
 export interface ResolvedCompute {
     readonly baseline: ComputeShape;
     readonly endpointBandwidthMBps: number;
@@ -928,74 +507,82 @@ export interface ResolvedCompute {
     readonly peak: ComputeShape;
     readonly size: "512mb" | "1gb" | "2gb" | "4gb" | "8gb";
 }
-/** Everything the platform resolved for this session. */
+/** Customer-safe frozen session configuration; all plaintext secrets are omitted. */
 export interface ResolvedConfig {
-    readonly catalogRevision: string;
-    readonly compute: ResolvedCompute;
+    readonly compute?: ResolvedCompute;
     readonly lifecycle: SessionLifecyclePolicy;
+    readonly mcpServerNames: ReadonlyArray<string>;
     readonly model: string;
-    readonly network: ResolvedNetwork;
+    readonly network?: ResolvedNetwork;
     readonly packages: ReadonlyArray<PackageRequest>;
     readonly provider: ProviderId;
-    readonly providerCredentialId: Id<"provider_credential">;
     readonly registered: SessionRegisteredSelection;
+    readonly sandboxEnabled: boolean;
 }
-/** The resolved guest network policy. */
+/** Resolved sandbox network policy. */
 export interface ResolvedNetwork {
     readonly hands: HandsNetworkRequest;
 }
-/** Why a stream ended after its 200. */
-export type RotateReason = "budget_exhausted" | "server_rotating" | "client_idle" | "upstream_unavailable" | "failed";
-/** A multi-turn conversation backed by at most one retained provider generation. Termination destroys compute and live files but preserves this metadata and sealed messages until deletion. */
+/** Optional native structured-output request; prompt emulation is never presented as strict. */
+export interface ResponseFormat {
+    readonly kind: ResponseFormatKind;
+    readonly schema?: JsonValue;
+}
+/** Requested final response format. */
+export type ResponseFormatKind = "text" | "json_schema";
+/** An MCP process launched inside the sandbox after workspace materialization. */
+export interface SandboxMcpServer {
+    readonly args?: ReadonlyArray<string>;
+    readonly command: string;
+    readonly environment?: Readonly<Record<string, string>>;
+    readonly workingDirectory?: string;
+}
+/** Observable preparation state of the session's single default-on sandbox. */
+export type SandboxStatus = "disabled" | "requested" | "ready" | "suspending" | "suspended" | "resuming" | "lost";
+/** The only public execution resource; sandbox loss never terminates agent state. */
 export interface Session {
-    readonly activeDeadline?: string;
-    readonly activeMaxSpendCents?: string;
     readonly activeMessageId?: Id<"message">;
     readonly createdAt: string;
     readonly expiresAt: string;
     readonly id: Id<"session">;
-    readonly idleSince?: string;
-    readonly launchedAt: string;
     readonly metadata?: Readonly<Record<string, string | number | boolean | null>>;
     readonly resolvedConfig: ResolvedConfig;
     readonly revision: number;
+    readonly sandboxStatus: SandboxStatus;
     readonly status: SessionStatus;
-    readonly suspendAt?: string;
-    readonly suspendedAt?: string;
     readonly terminatedAt?: string;
-    readonly terminationReason?: SessionTerminationReason;
     readonly updatedAt: string;
     readonly workspaceId: Id<"workspace">;
 }
-/** The result of cancelling the session's current work. The session is idle afterward and accepts another message. */
-export interface SessionCancelResult {
-    readonly changed: boolean;
+/** Admission receipt for an asynchronous session command; there is no generic operations resource. */
+export interface SessionCommandReceipt {
+    readonly acceptedAt: string;
+    readonly operationId: Id<"operation">;
     readonly sessionId: Id<"session">;
-    readonly sessionRevision: number;
 }
-/** The only customer compute selector. */
+/** The single sandbox's bounded compute selector. */
 export interface SessionComputeRequest {
     readonly size?: "512mb" | "1gb" | "2gb" | "4gb" | "8gb";
 }
-/** Create an eight-hour multi-turn session with one explicitly pinned BYOK provider credential. */
+/** Create a durable session with a write-only BYOK key, frozen file/MCP config and a default-on eager sandbox. */
 export interface SessionCreateRequest {
-    readonly compute?: SessionComputeRequest;
+    readonly expiresAt?: string;
+    readonly maxSpendCents?: string;
+    readonly mcpServers?: ReadonlyArray<McpServer>;
     readonly metadata?: Readonly<Record<string, string | number | boolean | null>>;
     readonly model: string;
-    readonly network?: SessionNetworkRequest;
-    readonly packages?: ReadonlyArray<PackageRequest>;
     readonly provider: ProviderId;
-    readonly providerCredentialId: Id<"provider_credential">;
+    readonly providerApiKey: string;
     readonly registered?: SessionRegisteredSelection;
+    readonly sandbox?: SessionSandboxRequest;
 }
-/** The immutable automatic lifecycle behavior applied to this session. */
+/** Immutable public session bounds; sandbox suspension is an internal lifecycle. */
 export interface SessionLifecyclePolicy {
-    readonly idleSuspendAfterSeconds: number;
     readonly maximumLifetimeSeconds: number;
-    readonly resumeOnLiveFileAccess: boolean;
-    readonly resumeOnMessage: boolean;
+    readonly maximumSubagentDepth: number;
+    readonly maximumSubagents: number;
 }
-/** The collection projection of a session; `resolvedConfig` is omitted. */
+/** Bounded collection projection. */
 export interface SessionListItem {
     readonly activeMessageId?: Id<"message">;
     readonly createdAt: string;
@@ -1003,7 +590,7 @@ export interface SessionListItem {
     readonly id: Id<"session">;
     readonly model: string;
     readonly provider: ProviderId;
-    readonly revision: number;
+    readonly sandboxStatus: SandboxStatus;
     readonly status: SessionStatus;
     readonly updatedAt: string;
     readonly workspaceId: Id<"workspace">;
@@ -1013,174 +600,65 @@ export interface SessionListPage {
     readonly items: ReadonlyArray<SessionListItem>;
     readonly nextCursor?: string;
 }
-/** Network policy for the session. */
+/** Network policy for the one sandbox. */
 export interface SessionNetworkRequest {
     readonly hands: HandsNetworkRequest;
 }
-/** Opaque workspace files mounted into the session. Conventional files such as `AGENTS.md` may carry guidance, skills, tool bundles, MCP configuration or custom instructions; the built-in model tools are `read_file`, `edit_file`, `write_file`, and Bash. */
+/** Files resolved once at session admission; later workspace overwrites cannot mutate this manifest. */
 export interface SessionRegisteredSelection {
-    readonly files?: ReadonlyArray<string>;
-}
-/** The result of manually resuming the same retained generation to idle. */
-export interface SessionResumeResult {
-    readonly changed: boolean;
-    readonly resumedAt: string;
-    readonly sessionId: Id<"session">;
-    readonly sessionRevision: number;
-    readonly status: SessionStatus;
-}
-/** What a session is doing right now. */
-export type SessionStatus = "idle" | "running" | "suspending" | "suspended" | "resuming" | "terminating" | "terminated" | "deleting";
-/** The result of manually suspending an idle session's exact retained generation. Active work must be cancelled first. */
-export interface SessionSuspendResult {
-    readonly changed: boolean;
-    readonly sessionId: Id<"session">;
-    readonly sessionRevision: number;
-    readonly suspendedAt: string;
+    readonly mounts: ReadonlyArray<WorkspaceFileMount>;
 }
-/** The result of permanently destroying compute and live files while preserving session metadata and sealed messages. */
-export interface SessionTerminateResult {
-    readonly changed: boolean;
-    readonly sessionId: Id<"session">;
-    readonly sessionRevision: number;
-    readonly terminatedAt: string;
+/** Default-on sandbox configuration; enabled=false creates no Hand. */
+export interface SessionSandboxRequest {
+    readonly compute?: SessionComputeRequest;
+    readonly enabled?: boolean;
+    readonly network?: SessionNetworkRequest;
+    readonly packages?: ReadonlyArray<PackageRequest>;
 }
-/** Why a session permanently lost its compute and live files. */
-export type SessionTerminationReason = "user" | "lifetime_expired" | "provider_credential_revoked" | "runtime_lost";
-/** The minimal marker left after irreversible deletion. Compute and live files are terminated first; session, message, Brain user-content, observation, telemetry and export payloads are removed. Independent registered workspace files and aggregate billing/audit facts remain. */
+/** Customer-visible session lifecycle, independent of sandbox suspension. */
+export type SessionStatus = "idle" | "running" | "terminating" | "terminated" | "deleting";
+/** Minimal marker after irreversible deletion. */
 export interface SessionTombstone {
     readonly deletedAt: string;
     readonly id: Id<"session">;
-    readonly operationId: Id<"operation">;
-    readonly workspaceId: Id<"workspace">;
-}
-/** One immutable issued statement. The platform never rerenders history. */
-export interface Statement {
-    readonly artifactHash: string;
-    readonly currency: Currency;
-    readonly id: Id<"statement">;
-    readonly issuedAt: string;
-    readonly lines: ReadonlyArray<StatementLine>;
-    readonly organizationId: Id<"organization">;
-    readonly period: TimeRange;
-    readonly totalCents: string;
-}
-/** One priced category line. Lines sum exactly to the statement total. */
-export interface StatementLine {
-    readonly category: UsageCategory;
-    readonly totalCents: string;
-}
-/** The header of one immutable issued statement. */
-export interface StatementSummary {
-    readonly artifactHash: string;
-    readonly currency: Currency;
-    readonly id: Id<"statement">;
-    readonly issuedAt: string;
-    readonly organizationId: Id<"organization">;
-    readonly period: TimeRange;
-    readonly totalCents: string;
-}
-/** One page of statement headers, newest first. */
-export interface StatementSummaryPage {
-    readonly items: ReadonlyArray<StatementSummary>;
-    readonly nextCursor?: string;
-}
-/** The AEX receipt returned alongside the standard OTLP response. */
-export interface TelemetryAdmissionReceipt {
-    readonly accepted: string;
-    readonly acceptedAt: string;
-    readonly batchId: Id<"telemetry_batch">;
-    readonly bytes: string;
-    readonly rejected: string;
 }
-/** One telemetry export record. Session exports remain workspace-owned. */
-export interface TelemetryExport {
-    readonly completeness: ExportCompleteness;
-    readonly createdAt: string;
-    readonly expiresAt?: string;
-    readonly format: ExportFormat;
-    readonly gapIds?: ReadonlyArray<Id<"telemetry_gap">>;
-    readonly id: Id<"export">;
-    readonly manifestHash?: string;
-    readonly readyAt?: string;
-    readonly revokedAt?: string;
-    readonly sessionId?: Id<"session">;
-    readonly sizeBytes?: string;
-    readonly status: ExportStatus;
-    readonly workspaceId: Id<"workspace">;
-}
-/** Admit a durable telemetry-export operation. */
-export interface TelemetryExportRequest {
-    readonly completeness: ExportCompleteness;
-    readonly format: ExportFormat;
-    readonly query: ExportQuery;
-}
-/** The result of a telemetry-export operation. */
-export interface TelemetryExportResult {
+/** Short-lived signed download for one immutable compressed telemetry export. */
+export interface TelemetryDownloadGrant {
     readonly expiresAt: string;
-    readonly exportId: Id<"export">;
-    readonly format: ExportFormat;
-    readonly manifestHash: string;
-}
-/** A recorded hole in the observation series. There is no public repair route. */
-export interface TelemetryGap {
-    readonly byteCount?: string;
-    readonly detectedAt: string;
+    readonly mediaType: string;
+    readonly sha256: string;
+    readonly sizeBytes: string;
+    readonly url: string;
+}
+/** Select a bounded half-open telemetry export. */
+export interface TelemetryDownloadRequest {
     readonly fromSequence?: string;
-    readonly id: Id<"telemetry_gap">;
-    readonly observationCount?: string;
-    readonly reason: TelemetryGapReason;
-    readonly recoverable: boolean;
-    readonly repairSource?: string;
-    readonly repairedAt?: string;
-    readonly revision: number;
-    readonly sessionId?: Id<"session">;
-    readonly signals: ReadonlyArray<ObservationSignal>;
-    readonly timeRange?: TimeRange;
     readonly toSequence?: string;
-    readonly workspaceId: Id<"workspace">;
-}
-/** One page of recorded gaps. */
-export interface TelemetryGapPage {
-    readonly items: ReadonlyArray<TelemetryGap>;
-    readonly nextCursor?: string;
 }
-/** A bounded query over recorded gaps. */
-export interface TelemetryGapQuery {
-    readonly cursor?: string;
-    readonly limit?: number;
-    readonly recoverable?: boolean;
-    readonly signals?: ReadonlyArray<ObservationSignal>;
-    readonly timeRange: TimeRange;
+/** One bounded normalized telemetry frame transmitted live and persisted in compressed S3 segments. */
+export interface TelemetryFrame {
+    readonly body?: JsonValue;
+    readonly kind: TelemetryKind;
+    readonly occurredAt: string;
+    readonly preview?: string;
+    readonly sequence: string;
+    readonly spanId?: string;
+    readonly traceId?: string;
+    readonly truncated: boolean;
 }
-/** Why a gap exists. */
-export type TelemetryGapReason = "admission_rejected" | "spool_lost" | "producer_dropped" | "replay_expired" | "authority_unavailable";
+/** Trusted live and retained session signals. */
+export type TelemetryKind = "assistant" | "tool" | "runtime" | "log" | "span" | "usage" | "gap" | "heartbeat";
 /** A half-open instant range, `gte` inclusive and `lt` exclusive. */
 export interface TimeRange {
     readonly gte: string;
     readonly lt: string;
 }
-/** Create a hosted top-up checkout. */
+/** Request a one-time Stripe-hosted prepaid top-up. */
 export interface TopUpCheckoutRequest {
     readonly amountCents: string;
     readonly cancelUrl?: string;
     readonly successUrl?: string;
 }
-/** One assembled trace and the observations it was assembled from. */
-export interface TraceDetail {
-    readonly coverage: ObservationCoverage;
-    readonly spans: ReadonlyArray<Observation>;
-    readonly summary: TraceSummary;
-}
-/** The header of one assembled trace. */
-export interface TraceSummary {
-    readonly endedAt: string;
-    readonly rootName: string;
-    readonly spanCount: string;
-    readonly startedAt: string;
-    readonly traceId: string;
-    readonly workspaceId?: Id<"workspace">;
-}
 /** One staged multipart upload. Uploads are transport plumbing, not assets. */
 export interface Upload {
     readonly contentType: string;
@@ -1193,13 +671,20 @@ export interface Upload {
     readonly sizeBytes: string;
     readonly state: UploadState;
 }
+/** One pending current-file overwrite and every bounded part grant needed to upload it; no extra public grant route exists. */
+export interface UploadAdmission {
+    readonly grants: ReadonlyArray<UploadPartGrant>;
+    readonly upload: Upload;
+}
 /** Complete a staged upload. */
 export interface UploadCompleteRequest {
     readonly parts: ReadonlyArray<UploadPart>;
 }
-/** Stage a large registered-resource value. */
+/** Stage a large current workspace-file replacement. */
 export interface UploadCreateRequest {
     readonly contentType: string;
+    readonly name: string;
+    readonly parts: ReadonlyArray<UploadPartRequest>;
     readonly sha256: string;
     readonly sizeBytes: string;
 }
@@ -1215,21 +700,12 @@ export interface UploadPartGrant {
     readonly partNumber: number;
     readonly url: string;
 }
-/** The presigned grants for the requested parts. */
-export interface UploadPartGrants {
-    readonly grants: ReadonlyArray<UploadPartGrant>;
-    readonly uploadId: Id<"upload">;
-}
 /** One part to presign. The part's own SHA-256 is required because S3 verifies it on the way up and the completion manifest checks it again; the server never sees the bytes, so it cannot compute it. */
 export interface UploadPartRequest {
     readonly partNumber: number;
     readonly sha256: string;
     readonly sizeBytes: string;
 }
-/** Mint presigned PUT grants for the named parts. At most 1000 parts per call against the 10000-part ceiling, so a maximal upload needs at least ten calls. */
-export interface UploadPartsRequest {
-    readonly parts: ReadonlyArray<UploadPartRequest>;
-}
 /** Where a staged upload is in its lifecycle. */
 export type UploadState = "staging" | "ready";
 /** One resource aggregate, discriminated by category. */
@@ -1342,51 +818,27 @@ export interface UsageStorageAggregate {
     readonly byteMinutes: string;
     readonly settlement: UsageSettlement;
 }
-/** A region-pinned execution and content boundary. */
+/** The account's fixed eu-west-1 execution and content boundary. */
 export interface Workspace {
     readonly apiUrl: string;
     readonly createdAt: string;
-    readonly deletionOperationId?: Id<"operation">;
     readonly id: Id<"workspace">;
     readonly name: string;
     readonly operationalState: WorkspaceOperationalState;
-    readonly organizationId: Id<"organization">;
     readonly region: "us-east-1" | "us-east-2" | "us-west-2" | "ap-northeast-1" | "eu-west-1";
-    readonly slug: string;
-    readonly status: WorkspaceStatus;
 }
 /** Which retained session generation answered a live workspace call. */
 export interface WorkspaceAccess {
     readonly generationId: Id<"generation">;
     readonly resumed: boolean;
 }
-/** Create a region-pinned workspace. Region is required and immutable. */
-export interface WorkspaceCreateRequest {
+/** Resolve one current workspace-file name to a private immutable hash and mount path at admission. */
+export interface WorkspaceFileMount {
     readonly name: string;
-    readonly organizationId: Id<"organization">;
-    readonly region: "us-east-1" | "us-east-2" | "us-west-2" | "ap-northeast-1" | "eu-west-1";
-}
-/** Admit the global workspace-deletion operation. */
-export interface WorkspaceDeleteRequest {
-    readonly confirmation: Id<"workspace">;
+    readonly path: string;
 }
-/** The workspace view of the account operational state it inherits. */
+/** The fixed workspace's inherited personal-account state. */
 export interface WorkspaceOperationalState {
-    readonly inheritedFrom: OperationalStateSource;
-    readonly organizationId: Id<"organization">;
+    readonly accountId: Id<"account">;
     readonly state: AccountOperationalState;
 }
-/** One page of workspaces. */
-export interface WorkspacePage {
-    readonly items: ReadonlyArray<Workspace>;
-    readonly nextCursor?: string;
-}
-/** Whether a workspace admits work. */
-export type WorkspaceStatus = "active" | "deleting";
-/** What remains of a deleted workspace. */
-export interface WorkspaceTombstone {
-    readonly deletedAt: string;
-    readonly operationId: Id<"operation">;
-    readonly organizationId: Id<"organization">;
-    readonly workspaceId: Id<"workspace">;
-}