@boxrouter/sdk 0.0.0-stage → 0.12.190

package/dist/launch-input.gen.js

@@ -0,0 +1,83 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.launchInputOptions = launchInputOptions;
+exports.normalizeLaunchInputs = normalizeLaunchInputs;
+exports.validateLaunchInputs = validateLaunchInputs;
+exports.legacySecretMissing = legacySecretMissing;
+const commandValidators_cjs_1 = __importDefault(require("./core/commandValidators.cjs"));
+const POLICY = JSON.parse("{\"secret_names\":{\"option\":\"secret_names\",\"flag\":\"secret\",\"format\":\"name\",\"declared_field\":\"legacy_secret_names\",\"extra_field\":\"additional_secret_refs\",\"reference_field\":\"secret_name\",\"help\":\"Declared legacy names use the existing resolver; other names select saved custom secrets.\"},\"provider\":{\"option\":\"provider\",\"flag\":\"provider\",\"format\":\"name\",\"request_path\":[\"overrides\",\"placement\",\"preferences\",\"only\"],\"help\":\"Pin the launch to one provider.\"},\"credential_delivery\":{\"option\":\"credential_delivery\",\"flag\":\"credential-delivery\",\"format\":\"enum\",\"schema\":\"CredentialDeliveryPolicy\",\"request_field\":\"credential_delivery\",\"help\":\"Choose whether environment fallback is allowed.\"},\"retry\":{\"condition\":\"legacySecretMissing\",\"error_code\":\"secret_missing\",\"name_source\":\"manifest.secrets\",\"exclude_referenced_names\":true}}");
+const DELIVERY_VALUES = ["prefer_native", "require_native"];
+function launchInputOptions(options) {
+    return {
+        secret_names: options.secretNames,
+        provider: options.provider,
+        credential_delivery: options.credentialDelivery,
+    };
+}
+function normalizeLaunchInputs(options, declaredSecrets) {
+    if (declaredSecrets.some(name => typeof name !== 'string' || !name))
+        throw new TypeError('Invalid launch input');
+    const declared = [...new Set(declaredSecrets)];
+    const extra = Object.create(null);
+    const secretPolicy = POLICY.secret_names;
+    const names = options[secretPolicy.option];
+    if (names != null) {
+        if (!Array.isArray(names) || names.some(name => typeof name !== 'string' || !name))
+            throw new TypeError('Invalid launch input');
+        for (const name of names)
+            if (!declared.includes(name))
+                extra[name] = { [secretPolicy.reference_field]: name };
+    }
+    const result = { [secretPolicy.declared_field]: declared };
+    if (Object.keys(extra).length)
+        result[secretPolicy.extra_field] = extra;
+    const providerPolicy = POLICY.provider;
+    const provider = options[providerPolicy.option];
+    if (provider != null) {
+        if (typeof provider !== 'string' || !provider)
+            throw new TypeError('Invalid launch input');
+        const path = providerPolicy.request_path;
+        if (!Array.isArray(path) || path.length === 0)
+            throw new TypeError('Invalid launch input');
+        const target = path.slice(0, -1).reduce((node, segment) => {
+            const child = node[segment];
+            if (!child || typeof child !== 'object' || Array.isArray(child))
+                node[segment] = {};
+            return node[segment];
+        }, result);
+        target[path[path.length - 1]] = [provider];
+    }
+    const deliveryPolicy = POLICY.credential_delivery;
+    const delivery = options[deliveryPolicy.option];
+    if (delivery != null) {
+        if (typeof delivery !== 'string' || !DELIVERY_VALUES.includes(delivery))
+            throw new TypeError('Invalid launch input');
+        result[deliveryPolicy.request_field] = delivery;
+    }
+    return result;
+}
+function validateLaunchInputs(value) {
+    if (!commandValidators_cjs_1.default.launch_inputs(value))
+        throw new TypeError('Invalid launch input');
+}
+function legacySecretMissing(error, request) {
+    if (!error || typeof error !== 'object')
+        return false;
+    const body = 'error' in error && error.error && typeof error.error === 'object' ? error.error : error;
+    const code = 'code' in body ? body.code : undefined;
+    const details = 'details' in body ? body.details : undefined;
+    if (code !== 'secret_missing' || !Array.isArray(request.legacy_secret_names) || !details || typeof details !== 'object' || !('names' in details) || !Array.isArray(details.names) || !details.names.length)
+        return false;
+    const declared = new Set(request.legacy_secret_names);
+    const refs = request.additional_secret_refs;
+    if (refs != null && (typeof refs !== 'object' || Array.isArray(refs)))
+        return false;
+    const saved = new Set(Object.keys(refs ?? {}));
+    for (const ref of Object.values(refs ?? {}))
+        if (ref && typeof ref === 'object' && 'secret_name' in ref)
+            saved.add(ref.secret_name);
+    return details.names.every(name => typeof name === 'string' && declared.has(name) && !saved.has(name));
+}

package/dist/launch.d.ts

@@ -0,0 +1,28 @@
+import type { BoxRouterApi } from './sdk.gen';
+import type { AgentManifest, Launch, LaunchOperation, LaunchSourceManifest } from './types.gen';
+import { type LaunchInputOptions } from './launch-input.gen';
+import type { PrivateImage } from './images';
+export interface LaunchOptions extends LaunchInputOptions {
+    signal?: AbortSignal;
+    idempotencyKey?: string;
+    repo?: string;
+    /** An OCI reference, or the `image` of `privateImage()`; spread `privateImage()` to add its login. */
+    image?: string | PrivateImage['image'];
+    /** The login for a private `image`; request-only, used once for the setup and never stored. */
+    registry_credentials?: PrivateImage['registry_credentials'];
+    manifest?: AgentManifest | LaunchSourceManifest;
+    name?: string;
+    command?: string;
+    lifetime?: number;
+    onProgress?: (operation: LaunchOperation) => void;
+    resolveSecret?: (name: string) => Promise<string> | string;
+}
+/**
+ * Resolve an agent and wait until its launch operation settles. Returns the launch result, with
+ * `interactive` resolved, and the command its terminal starts (none when the launch runs unattended).
+ * Rejects with a TimeoutError when the launch is still pending after its bound.
+ */
+export declare function launchAgent(api: BoxRouterApi, agent: string | undefined, options?: LaunchOptions): Promise<{
+    launch: Launch;
+    terminalCommand: string | undefined;
+}>;

package/dist/launch.js

@@ -0,0 +1,222 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.launchAgent = launchAgent;
+const api_error_1 = require("./api-error");
+const launch_input_gen_1 = require("./launch-input.gen");
+const workflow_policy_gen_1 = require("./workflow-policy.gen");
+const waits_1 = require("./waits");
+function _launch_pending(operation) {
+    return workflow_policy_gen_1.LAUNCH_PENDING.includes(operation.status);
+}
+/** Whether the launch runs attended: the launch's own answer, else the manifest's, else yes. */
+function _launch_interactive(launch, manifest) {
+    return (launch.interactive ?? manifest.interactive ?? true) !== false;
+}
+/** The command a launched sandbox's terminal starts; none for an unattended launch. */
+function _launch_terminal_command(manifest, launch) {
+    if (!_launch_interactive(launch, manifest))
+        return undefined;
+    const resolvedSourceCommand = launch.phases.find(phase => phase.name === 'source')?.command;
+    return resolvedSourceCommand || ('command' in manifest ? manifest.command : undefined) || undefined;
+}
+function _launch_code(repo) {
+    if (repo === undefined)
+        return undefined;
+    if (!repo || /\s|\0/.test(repo))
+        throw new TypeError('Repository override must use owner/repo@ref');
+    const separator = repo.indexOf('@');
+    const name = repo.slice(0, separator);
+    const ref = repo.slice(separator + 1);
+    if (separator < 0 || name.split('/').length !== 2 || name.split('/').some(part => !part) || !ref) {
+        throw new TypeError('Repository override must use owner/repo@ref');
+    }
+    return { repo: name, ref };
+}
+function _launch_source(repo) {
+    if (!repo || /\s|\0/.test(repo))
+        throw new TypeError('Repository source must use owner/repo[@ref]');
+    const separator = repo.indexOf('@');
+    const name = repo.slice(0, separator < 0 ? undefined : separator);
+    const ref = separator < 0 ? workflow_policy_gen_1.LAUNCH_SOURCE_DEFAULT_REF : repo.slice(separator + 1);
+    const parts = name.split('/');
+    if (parts.length !== 2 || parts.some(part => !part) || !ref) {
+        throw new TypeError('Repository source must use owner/repo[@ref]');
+    }
+    return { repo: name, ref, path: workflow_policy_gen_1.LAUNCH_SOURCE_MANIFEST_PATH };
+}
+function _launch_name(value) {
+    let candidate = value.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+    if (!candidate || !/^[a-z]/.test(candidate))
+        candidate = `agent-${candidate}`;
+    candidate = candidate.slice(0, 63).replace(/-+$/g, '');
+    return new RegExp(workflow_policy_gen_1.LAUNCH_CUSTOM_NAME_PATTERN).test(candidate) ? candidate : 'agent';
+}
+function _launch_failure(operation, idempotencyKey) {
+    if (!operation.error)
+        throw new TypeError('Failed launch operation did not include its API error');
+    const response = new Response(JSON.stringify(operation.error), {
+        status: Number(operation.failure_status ?? 409),
+        headers: { 'Content-Type': 'application/json' },
+    });
+    return new api_error_1.APIError(operation.error, response, undefined, undefined, idempotencyKey);
+}
+function _missing_secret_names(error) {
+    const details = error.error.details;
+    if (details === null || typeof details !== 'object' || !('names' in details) ||
+        !Array.isArray(details.names) || !details.names.every(name => typeof name === 'string')) {
+        throw new TypeError('The missing-secret response did not include valid secret names');
+    }
+    return details.names;
+}
+/**
+ * Resolve an agent and wait until its launch operation settles. Returns the launch result, with
+ * `interactive` resolved, and the command its terminal starts (none when the launch runs unattended).
+ * Rejects with a TimeoutError when the launch is still pending after its bound.
+ */
+async function launchAgent(api, agent, options = {}) {
+    const { signal, idempotencyKey, resolveSecret } = options;
+    const { repo, image, registry_credentials: registryCredentials, manifest: inputManifest, name, command, secretNames = [], lifetime, onProgress } = options;
+    if (agent !== undefined && !agent)
+        throw new TypeError('Agent name must be nonempty');
+    if (name !== undefined && !new RegExp(workflow_policy_gen_1.LAUNCH_CUSTOM_NAME_PATTERN).test(name)) {
+        throw new TypeError('Custom agent name must be a valid slug');
+    }
+    if (secretNames.some(secret => typeof secret !== 'string' || !secret)) {
+        throw new TypeError('Secret names must be nonempty strings');
+    }
+    const inputOptions = (0, launch_input_gen_1.launchInputOptions)(options);
+    (0, launch_input_gen_1.normalizeLaunchInputs)(inputOptions, []);
+    if (agent !== undefined && (image !== undefined || inputManifest !== undefined || name !== undefined ||
+        command !== undefined)) {
+        throw new TypeError('Choose a catalog agent or one custom launch source');
+    }
+    if (agent === undefined && [image, repo, inputManifest].filter(value => value !== undefined).length !== 1) {
+        throw new TypeError('Choose exactly one of image, repository or manifest');
+    }
+    if ((typeof image === 'object' && registryCredentials === undefined) ||
+        (registryCredentials !== undefined && typeof image !== 'object' && inputManifest === undefined)) {
+        throw new TypeError('A private image needs its registry_credentials, and registry_credentials need a private image');
+    }
+    if (lifetime !== undefined && (!Number.isSafeInteger(lifetime) || lifetime < 1)) {
+        throw new TypeError('Lifetime must be a positive integer number of seconds');
+    }
+    let manifest;
+    if (agent !== undefined) {
+        manifest = (await api.agents.get({ path: { name: agent }, signal })).manifest;
+    }
+    else if (repo !== undefined) {
+        const source = _launch_source(repo);
+        manifest = {
+            name: name ?? _launch_name(source.repo.split('/').pop() ?? source.repo),
+            source,
+            ...(command ? { command } : {}),
+        };
+    }
+    else if (image !== undefined) {
+        const reference = typeof image === 'string' ? image : image.private_oci;
+        const imageName = reference.split('/').pop()?.split('@', 1)[0]?.split(':', 1)[0] ?? reference;
+        manifest = {
+            name: name ?? _launch_name(imageName),
+            image,
+            command: command || workflow_policy_gen_1.LAUNCH_DEFAULT_SHELL_COMMAND,
+        };
+    }
+    else {
+        const supplied = inputManifest;
+        manifest = {
+            ...supplied,
+            ...(name === undefined ? {} : { name }),
+            ...(command ? { command } : {}),
+        };
+    }
+    let operation;
+    let launchPollDeadline;
+    const secretValues = {};
+    const code = agent !== undefined ? _launch_code(repo) : undefined;
+    const overrides = code || lifetime !== undefined
+        ? { ...(code ? { code } : {}), ...(lifetime === undefined ? {} : { lifetime_seconds: lifetime }) }
+        : undefined;
+    const launchInputs = (0, launch_input_gen_1.normalizeLaunchInputs)(inputOptions, 'secrets' in manifest ? manifest.secrets ?? [] : []);
+    const selectionInputs = Object.fromEntries(Object.entries(launchInputs).filter(([key]) => key !== 'legacy_secret_names'));
+    (0, launch_input_gen_1.validateLaunchInputs)(selectionInputs);
+    const requestInputs = {
+        ...selectionInputs,
+        ...(registryCredentials === undefined ? {} : { registry_credentials: registryCredentials }),
+    };
+    const selectedOverrides = requestInputs.overrides;
+    const combinedOverrides = overrides || selectedOverrides
+        ? { ...(overrides ?? {}), ...(selectedOverrides ?? {}) }
+        : undefined;
+    const key = idempotencyKey ?? globalThis.crypto.randomUUID();
+    try {
+        const body = agent !== undefined
+            ? { agent, ...requestInputs, ...(combinedOverrides ? { overrides: combinedOverrides } : {}) }
+            : { manifest, ...requestInputs, ...(combinedOverrides ? { overrides: combinedOverrides } : {}) };
+        operation = await api.launches.create({
+            body,
+            headers: { 'Idempotency-Key': key },
+            signal,
+        });
+    }
+    catch (error) {
+        if (!(error instanceof api_error_1.APIError))
+            throw error;
+        if ((0, launch_input_gen_1.legacySecretMissing)(error, launchInputs)) {
+            for (const secret_name of _missing_secret_names(error)) {
+                if (resolveSecret === undefined) {
+                    throw new Error(`Launch is missing secret ${secret_name}; set it in the environment or provide a resolver`);
+                }
+                const value = await resolveSecret(secret_name);
+                if (typeof value !== 'string')
+                    throw new TypeError(`Secret resolver did not return text for ${secret_name}`);
+                secretValues[secret_name] = value;
+            }
+            operation = await api.launches.create({
+                body: agent !== undefined
+                    ? { agent, ...requestInputs, secret_values: secretValues,
+                        ...(combinedOverrides ? { overrides: combinedOverrides } : {}) }
+                    : { manifest, ...requestInputs, secret_values: secretValues,
+                        ...(combinedOverrides ? { overrides: combinedOverrides } : {}) },
+                headers: { 'Idempotency-Key': key },
+                signal,
+            });
+        }
+        else {
+            throw error;
+        }
+    }
+    const launchTiming = waits_1.waitHooks.timing({ intervalSeconds: workflow_policy_gen_1.LAUNCH_POLL_INTERVAL_SECONDS, boundSeconds: workflow_policy_gen_1.LAUNCH_BOUND_SECONDS });
+    const launchDeadline = waits_1.waitHooks.now() + launchTiming.boundSeconds;
+    launchPollDeadline = performance.now() + workflow_policy_gen_1.LAUNCH_OPERATION_NOT_FOUND_GRACE_SECONDS * 1000;
+    onProgress?.(operation);
+    while (_launch_pending(operation)) {
+        if (waits_1.waitHooks.now() + launchTiming.intervalSeconds > launchDeadline) {
+            throw new waits_1.WaitTimeoutError(operation.id, `Launch ${operation.id} is still ${operation.status} after ${workflow_policy_gen_1.LAUNCH_BOUND_SECONDS} s; ` +
+                'read the operation before launching again');
+        }
+        await waits_1.waitHooks.sleep(launchTiming.intervalSeconds);
+        while (true) {
+            signal?.throwIfAborted();
+            try {
+                operation = await api.launches.getOperation({ path: { operation_id: operation.id }, signal });
+                break;
+            }
+            catch (error) {
+                const remaining = launchPollDeadline - performance.now();
+                if (!(error instanceof api_error_1.APIError) || error.response.status !== 404 || remaining <= 0)
+                    throw error;
+                await new Promise(resolve => setTimeout(resolve, Math.min(workflow_policy_gen_1.LAUNCH_OPERATION_POLL_RETRY_INTERVAL_SECONDS * 1000, remaining)));
+            }
+        }
+        launchPollDeadline = performance.now() + workflow_policy_gen_1.LAUNCH_OPERATION_NOT_FOUND_GRACE_SECONDS * 1000;
+        onProgress?.(operation);
+    }
+    if (operation.status === 'failed')
+        throw _launch_failure(operation, key);
+    if (operation.status !== 'succeeded' || !operation.result) {
+        throw new TypeError('Launch polling stopped before a terminal result');
+    }
+    const launch = operation.result;
+    return { launch: { ...launch, interactive: _launch_interactive(launch, manifest) },
+        terminalCommand: _launch_terminal_command(manifest, launch) };
+}

package/dist/namespace-actions.d.mts

@@ -0,0 +1,307 @@
+import type { Client, ClientMeta, Options as Options2, RequestResult, TDataShape } from './client/index.js';
+import { HeyApiClient } from './namespace-base.mjs';
+import type { ActionsJobsGetData, ActionsJobsGetErrors, ActionsJobsGetLogsData, ActionsJobsGetLogsErrors, ActionsJobsGetLogsResponses, ActionsJobsGetResponses, ActionsJobsGetStepLogsData, ActionsJobsGetStepLogsErrors, ActionsJobsGetStepLogsResponses, ActionsJobsGetStepsData, ActionsJobsGetStepsErrors, ActionsJobsGetStepsResponses, ActionsJobsListEventsData, ActionsJobsListEventsErrors, ActionsJobsListEventsResponses, ActionsPlacementsGetData, ActionsPlacementsGetErrors, ActionsPlacementsGetResponses, ActionsPoliciesCreateData, ActionsPoliciesCreateErrors, ActionsPoliciesCreateResponses, ActionsPoliciesDeleteData, ActionsPoliciesDeleteErrors, ActionsPoliciesDeleteResponses, ActionsPoliciesGetData, ActionsPoliciesGetErrors, ActionsPoliciesGetResponses, ActionsPoliciesListData, ActionsPoliciesListErrors, ActionsPoliciesListResponses, ActionsPoliciesUpdateData, ActionsPoliciesUpdateErrors, ActionsPoliciesUpdateResponses, ActionsPoolIdleTimeGetData, ActionsPoolIdleTimeGetErrors, ActionsPoolIdleTimeGetResponses, ActionsPreviewData, ActionsPreviewErrors, ActionsPreviewResponses, ActionsReadinessData, ActionsReadinessErrors, ActionsReadinessResponses, ActionsRepositoriesGetData, ActionsRepositoriesGetErrors, ActionsRepositoriesGetResponses, ActionsRepositoriesUpdateData, ActionsRepositoriesUpdateErrors, ActionsRepositoriesUpdateResponses, ActionsRunnerCatalogData, ActionsRunnerCatalogErrors, ActionsRunnerCatalogResponses, ActionsRunsCancelData, ActionsRunsCancelErrors, ActionsRunsCancelResponses, ActionsRunsGetData, ActionsRunsGetErrors, ActionsRunsGetResponses, ActionsRunsListData, ActionsRunsListErrors, ActionsRunsListFacetsData, ActionsRunsListFacetsErrors, ActionsRunsListFacetsResponses, ActionsRunsListJobsData, ActionsRunsListJobsErrors, ActionsRunsListJobsResponses, ActionsRunsListPlacementsData, ActionsRunsListPlacementsErrors, ActionsRunsListPlacementsResponses, ActionsRunsListResponses, ActionsRunsRerunData, ActionsRunsRerunErrors, ActionsRunsRerunFailedJobsData, ActionsRunsRerunFailedJobsErrors, ActionsRunsRerunFailedJobsResponses, ActionsRunsRerunResponses } from './types.gen.js';
+export type Options<TData extends TDataShape = TDataShape, ThrowOnError extends boolean = boolean, TResponse = unknown> = Options2<TData, ThrowOnError, TResponse> & {
+    /**
+     * You can provide a client instance returned by `createClient()` instead of
+     * individual options. This might be also useful if you want to implement a
+     * custom client.
+     */
+    client?: Client;
+    /**
+     * You can pass arbitrary values through the `meta` object. This can be
+     * used to access values that aren't defined as part of the SDK function.
+     */
+    meta?: keyof ClientMeta extends never ? Record<string, unknown> : ClientMeta;
+};
+export declare class Actions extends HeyApiClient {
+    /**
+     * Read Actions runner and workspace funding readiness
+     *
+     * Requires workspace read authority. This read-only view uses the workspace's
+     * existing provider accounts and credits. Unknown source facts remain unknown;
+     * link targets appear only when an existing page can address the reported issue.
+     * When `repository_id` is supplied, readiness is scoped to that repository's saved
+     * software profile. The profile is resolved from workspace-owned settings; callers
+     * cannot select a profile through this parameter.
+     *
+     */
+    readiness<ThrowOnError extends boolean = true>(options?: Options<ActionsReadinessData, ThrowOnError>): RequestResult<ActionsReadinessResponses, ActionsReadinessErrors, ThrowOnError, 'data'>;
+    /**
+     * Read the recommended Actions runner labels and resource floors
+     *
+     * Requires workspace read authority. The catalog is fixed for a server release and does not
+     * depend on the workspace, so clients and caches may reuse it until its ETag changes. It does not assert live route availability or
+     * verified software; use readiness for that. Readiness still carries `runner_catalog` for
+     * older clients, but new clients should read this operation instead.
+     *
+     */
+    runnerCatalog<ThrowOnError extends boolean = true>(options?: Options<ActionsRunnerCatalogData, ThrowOnError>): RequestResult<ActionsRunnerCatalogResponses, ActionsRunnerCatalogErrors, ThrowOnError, 'data'>;
+    /**
+     * Preview Actions label and policy eligibility
+     *
+     * Requires read authority for the linked repository in the authenticated workspace.
+     * This is a read-only evaluation of the same resolved policy and route matcher used
+     * for dispatch. It creates no runner, sandbox, reservation or billing hold. Refused
+     * and unknown results remain explicit; the preview never relaxes a requirement or
+     * claims an unverified route is eligible. It does not verify runner images. Runner image readiness is checked separately before dispatch.
+     *
+     */
+    preview<ThrowOnError extends boolean = true>(options: Options<ActionsPreviewData, ThrowOnError>): RequestResult<ActionsPreviewResponses, ActionsPreviewErrors, ThrowOnError, 'data'>;
+    private _repositories?;
+    get repositories(): Repositories;
+    private _policies?;
+    get policies(): Policies;
+    private _runs?;
+    get runs(): Runs;
+    private _poolIdleTime?;
+    get poolIdleTime(): PoolIdleTime;
+    private _jobs?;
+    get jobs(): Jobs;
+    private _placements?;
+    get placements(): Placements;
+}
+export declare class Repositories extends HeyApiClient {
+    /**
+     * Get Actions enablement and defaults for a repository
+     *
+     * Requires read authority in the authenticated workspace. The repository must have
+     * a currently linked, verified GitHub installation. The returned ETag identifies
+     * this settings revision. A missing settings record is represented as `exists: false`,
+     * disabled with no required policy; it is not silently enabled by reading it. For
+     * `exists: false`, omit If-Match on the first write; for `exists: true`, send the
+     * returned ETag to update the existing record safely.
+     *
+     */
+    get<ThrowOnError extends boolean = true>(options: Options<ActionsRepositoriesGetData, ThrowOnError>): RequestResult<ActionsRepositoriesGetResponses, ActionsRepositoriesGetErrors, ThrowOnError, 'data'>;
+    /**
+     * Enable or update Actions defaults for a repository
+     *
+     * Requires workspace administrator authority. Browser-session calls require the CSRF
+     * token and configured Origin. The minimal enable request is `{"enabled":true}`;
+     * Actions creates its safe default settings and begins automatic image preparation
+     * without requiring a named policy, provider key, runner registration or YAML change.
+     * `policy_id` is optional and, when null, selects the workspace's current safe
+     * defaults. When the preceding read returned `exists: false`, omit If-Match to create
+     * the settings record; when it returned `exists: true`, send its ETag to update. The
+     * server rejects a write if that existence state changed after the read. An
+     * Idempotency-Key records
+     * the logical mutation: identical uncertain retries return the recorded outcome,
+     * changed input under the same key conflicts, and unknown effects are reconciled
+     * without automatic redispatch. Disabling stops new admission; it does not cancel
+     * accepted GitHub workflow runs or change their funding binding.
+     *
+     */
+    update<ThrowOnError extends boolean = true>(options: Options<ActionsRepositoriesUpdateData, ThrowOnError>): RequestResult<ActionsRepositoriesUpdateResponses, ActionsRepositoriesUpdateErrors, ThrowOnError, 'data'>;
+}
+export declare class Policies extends HeyApiClient {
+    /**
+     * List workspace Actions policies
+     *
+     * Requires workspace read authority. Stable ID-ordered pages may be empty; listing never changes policy or starts compute.
+     */
+    list<ThrowOnError extends boolean = true>(options?: Options<ActionsPoliciesListData, ThrowOnError>): RequestResult<ActionsPoliciesListResponses, ActionsPoliciesListErrors, ThrowOnError, 'data'>;
+    /**
+     * Create a named workspace Actions policy
+     *
+     * Requires workspace administrator authority. Browser-session calls require the CSRF
+     * token and configured Origin. Policy settings can only narrow workspace and
+     * repository guardrails. The workspace funding choice decides the logical authority
+     * (workspace BYOK or platform managed); the actual provider, account and payer binding
+     * is confirmed separately for each attempt and is never taken from a policy. A policy
+     * cannot change supply or add accounts. Idempotency-Key replays the recorded
+     * outcome for identical input; changed input conflicts. An unknown outcome is
+     * reconciled without creating a second policy.
+     *
+     */
+    create<ThrowOnError extends boolean = true>(options: Options<ActionsPoliciesCreateData, ThrowOnError>): RequestResult<ActionsPoliciesCreateResponses, ActionsPoliciesCreateErrors, ThrowOnError, 'data'>;
+    /**
+     * Delete an unused workspace Actions policy
+     *
+     * Requires workspace administrator authority. Browser-session calls require CSRF and
+     * the configured Origin. If-Match is required. A policy referenced by repository
+     * defaults or accepted work cannot be deleted and returns 409. Idempotency-Key
+     * returns the recorded delete result for identical retries; changed input conflicts. Unknown outcomes are
+     * reconciled without repeating the deletion.
+     *
+     */
+    delete<ThrowOnError extends boolean = true>(options: Options<ActionsPoliciesDeleteData, ThrowOnError>): RequestResult<ActionsPoliciesDeleteResponses, ActionsPoliciesDeleteErrors, ThrowOnError, 'data'>;
+    /**
+     * Get a workspace Actions policy
+     *
+     * Requires workspace read authority. The policy ID is workspace-scoped; foreign and unknown IDs both return 404.
+     */
+    get<ThrowOnError extends boolean = true>(options: Options<ActionsPoliciesGetData, ThrowOnError>): RequestResult<ActionsPoliciesGetResponses, ActionsPoliciesGetErrors, ThrowOnError, 'data'>;
+    /**
+     * Replace a workspace Actions policy
+     *
+     * Requires workspace administrator authority. Browser-session calls require CSRF and
+     * the configured Origin. If-Match is required and must equal the latest ETag. Policy
+     * changes only narrow workspace/repository guardrails and do not mutate accepted jobs
+     * or change their supply, accounts or logical funding authority. Idempotency-Key replays an identical recorded update;
+     * changed input conflicts. A stale ETag returns 409 without writing. Unknown outcomes
+     * are reconciled, never automatically redispatched.
+     *
+     */
+    update<ThrowOnError extends boolean = true>(options: Options<ActionsPoliciesUpdateData, ThrowOnError>): RequestResult<ActionsPoliciesUpdateResponses, ActionsPoliciesUpdateErrors, ThrowOnError, 'data'>;
+}
+export declare class Runs extends HeyApiClient {
+    /**
+     * List workspace Actions workflow-run projections
+     *
+     * Requires workspace read authority. Pages may be empty and default to newest-first
+     * by creation time; `sort` also supports oldest-first by creation time and longest
+     * first by duration. Equal sort values retain a stable run ID order, including
+     * across pages. A run's status and cost are BoxRouter's latest recorded evidence;
+     * this read does not poll GitHub, change a run, start a job or retry an uncertain
+     * effect.
+     *
+     */
+    list<ThrowOnError extends boolean = true>(options?: Options<ActionsRunsListData, ThrowOnError>): RequestResult<ActionsRunsListResponses, ActionsRunsListErrors, ThrowOnError, 'data'>;
+    /**
+     * Count the values each run filter offers
+     *
+     * For each filter of `listActionsRuns`, its values with the number of runs in the whole
+     * workspace that have the value, ignoring any active filters. A run counts once for each
+     * value it has. Requires workspace read authority; it does not poll GitHub.
+     *
+     */
+    listFacets<ThrowOnError extends boolean = true>(options?: Options<ActionsRunsListFacetsData, ThrowOnError>): RequestResult<ActionsRunsListFacetsResponses, ActionsRunsListFacetsErrors, ThrowOnError, 'data'>;
+    /**
+     * Get a workflow-run projection and aggregate billing evidence
+     *
+     * Requires workspace read authority. Foreign and unknown run IDs both return 404; state and costs are not inferred from missing observations.
+     */
+    get<ThrowOnError extends boolean = true>(options: Options<ActionsRunsGetData, ThrowOnError>): RequestResult<ActionsRunsGetResponses, ActionsRunsGetErrors, ThrowOnError, 'data'>;
+    /**
+     * List GitHub jobs projected for a workflow run
+     *
+     * Requires workspace read authority. Job assignment is tied to the runner GitHub actually assigns, not the job a JIT label initially requested.
+     */
+    listJobs<ThrowOnError extends boolean = true>(options: Options<ActionsRunsListJobsData, ThrowOnError>): RequestResult<ActionsRunsListJobsResponses, ActionsRunsListJobsErrors, ThrowOnError, 'data'>;
+    /**
+     * List placements attempted for a workflow run
+     *
+     * Requires workspace read authority. Placement state, outcome, cleanup and billing evidence remain separate; uncertain effects are never replayed by this read.
+     */
+    listPlacements<ThrowOnError extends boolean = true>(options: Options<ActionsRunsListPlacementsData, ThrowOnError>): RequestResult<ActionsRunsListPlacementsResponses, ActionsRunsListPlacementsErrors, ThrowOnError, 'data'>;
+    /**
+     * Ask GitHub to cancel the entire workflow run
+     *
+     * Requires workspace execute authority. This explicitly cancels the whole GitHub
+     * workflow run, including its other jobs; it cannot cancel only one job. GitHub
+     * remains authoritative for cancellation. A 202 means GitHub acknowledged the
+     * request, not that every job or sandbox has ended. Idempotency-Key identifies this
+     * user-authorized mutation. An identical replay returns the recorded result; changed
+     * input conflicts. Unknown outcomes are reconciled against GitHub without repeating
+     * the cancellation automatically. BoxRouter never cancels as a side effect of a
+     * read, timeout or cleanup failure.
+     *
+     */
+    cancel<ThrowOnError extends boolean = true>(options: Options<ActionsRunsCancelData, ThrowOnError>): RequestResult<ActionsRunsCancelResponses, ActionsRunsCancelErrors, ThrowOnError, 'data'>;
+    /**
+     * Ask GitHub to rerun the entire workflow
+     *
+     * Requires workspace execute authority. This explicitly asks GitHub to rerun the
+     * entire workflow run, not one job or only failed jobs. GitHub creates and owns the
+     * new attempt. A 202 means GitHub acknowledged the request; it does not mean the new
+     * jobs have started. Idempotency-Key identifies this user-authorized mutation. An
+     * identical replay returns the recorded result; changed input conflicts. An unknown
+     * outcome is reconciled against GitHub and never automatically submitted again.
+     * Actions admission still rechecks repository binding, policy, trust and the
+     * immutable workspace/account/payer before creating any new placement.
+     *
+     */
+    rerun<ThrowOnError extends boolean = true>(options: Options<ActionsRunsRerunData, ThrowOnError>): RequestResult<ActionsRunsRerunResponses, ActionsRunsRerunErrors, ThrowOnError, 'data'>;
+    /**
+     * Ask GitHub to rerun failed jobs and their dependents
+     *
+     * Requires workspace execute authority. This explicitly asks GitHub to rerun the failed
+     * jobs of the entire workflow run and the jobs that depend on them in a new attempt.
+     * Passed jobs rerun only when they depend on a failed job. GitHub creates and owns the new attempt. A 202 means
+     * GitHub acknowledged the request; it does not mean the new jobs have started.
+     * Idempotency-Key identifies this user-authorized mutation. An identical replay returns
+     * the recorded result; changed input conflicts. An unknown outcome is reconciled against
+     * GitHub and never automatically submitted again. A run with no failed job is refused
+     * with 409. Actions admission still rechecks repository binding, policy, trust and the
+     * immutable workspace/account/payer before creating any new placement.
+     *
+     */
+    rerunFailedJobs<ThrowOnError extends boolean = true>(options: Options<ActionsRunsRerunFailedJobsData, ThrowOnError>): RequestResult<ActionsRunsRerunFailedJobsResponses, ActionsRunsRerunFailedJobsErrors, ThrowOnError, 'data'>;
+}
+export declare class PoolIdleTime extends HeyApiClient {
+    /**
+     * Get the billed time of runners that served no job
+     *
+     * Requires workspace read authority. A pooled runner can cost money while no GitHub job
+     * shows it: it sat idle until the pool drained it, or its pickup was foreign or revoked,
+     * or it failed after its sandbox existed. That time is charged to the payer and shown
+     * here, apart from every run and job. The read counts the runners that started in
+     * `[since, until)`, in total and per pool, with the same `billing` object a run carries.
+     * `idle_seconds` is each runner's lifetime from creation to its end (to now for a runner
+     * that is still alive). `until` defaults to now, `since` to 30 days before `until`, and the
+     * range may not exceed 92 days; a longer or empty range returns 400. It does not poll
+     * GitHub or a provider and does not change a runner.
+     *
+     */
+    get<ThrowOnError extends boolean = true>(options?: Options<ActionsPoolIdleTimeGetData, ThrowOnError>): RequestResult<ActionsPoolIdleTimeGetResponses, ActionsPoolIdleTimeGetErrors, ThrowOnError, 'data'>;
+}
+export declare class Jobs extends HeyApiClient {
+    /**
+     * Get an Actions job projection
+     *
+     * Requires workspace read authority. The GitHub assignment is authoritative; a requested job ID is not treated as runner reservation.
+     */
+    get<ThrowOnError extends boolean = true>(options: Options<ActionsJobsGetData, ThrowOnError>): RequestResult<ActionsJobsGetResponses, ActionsJobsGetErrors, ThrowOnError, 'data'>;
+    /**
+     * Get GitHub workflow steps for an Actions job
+     *
+     * Requires workspace execute authority. Resolves the selected workspace-owned
+     * job and its exact historical run attempt before reading the assigned GitHub
+     * workflow job. Steps preserve GitHub source order and original step numbers;
+     * position is the zero-based display order. Pending, unavailable, forbidden and
+     * removed are explicit source states. Step output is not included.
+     *
+     */
+    getSteps<ThrowOnError extends boolean = true>(options: Options<ActionsJobsGetStepsData, ThrowOnError>): RequestResult<ActionsJobsGetStepsResponses, ActionsJobsGetStepsErrors, ThrowOnError, 'data'>;
+    /**
+     * Read a bounded prefix of the selected GitHub job log
+     *
+     * Requires workspace execute authority. Resolves the workspace-owned job,
+     * current repository binding, assigned GitHub job and exact historical attempt
+     * before fetching only that native whole-job log. At most 1 MiB is returned;
+     * partial indicates a bounded prefix. Output is transient and is not retained.
+     * Individual step log availability depends on the GitHub App/repository source.
+     *
+     */
+    getLogs<ThrowOnError extends boolean = true>(options: Options<ActionsJobsGetLogsData, ThrowOnError>): RequestResult<ActionsJobsGetLogsResponses, ActionsJobsGetLogsErrors, ThrowOnError, 'data'>;
+    /**
+     * Read a bounded prefix of one GitHub step log
+     *
+     * Requires workspace execute authority. step_position is zero-based and is
+     * verified against the selected fresh GitHub job before this endpoint is read.
+     * GitHub may report individual step logs unavailable for an App/repository;
+     * this is returned explicitly without synthesizing output from the whole-job log.
+     * At most 1 MiB is returned and partial indicates a bounded prefix.
+     *
+     */
+    getStepLogs<ThrowOnError extends boolean = true>(options: Options<ActionsJobsGetStepLogsData, ThrowOnError>): RequestResult<ActionsJobsGetStepLogsResponses, ActionsJobsGetStepLogsErrors, ThrowOnError, 'data'>;
+    /**
+     * List Actions step events for a job
+     *
+     * Requires workspace execute authority. Returns durable step events recorded for
+     * this workspace-owned Actions job, ordered by event time and ID. Use the
+     * continuation cursor to retrieve the next page; the list is empty when no
+     * events are available.
+     *
+     */
+    listEvents<ThrowOnError extends boolean = true>(options: Options<ActionsJobsListEventsData, ThrowOnError>): RequestResult<ActionsJobsListEventsResponses, ActionsJobsListEventsErrors, ThrowOnError, 'data'>;
+}
+export declare class Placements extends HeyApiClient {
+    /**
+     * Get an Actions placement and its cost and cleanup evidence
+     *
+     * Requires workspace read authority. A completed workflow job does not prove sandbox cleanup or final charge; pending and unknown remain explicit.
+     */
+    get<ThrowOnError extends boolean = true>(options: Options<ActionsPlacementsGetData, ThrowOnError>): RequestResult<ActionsPlacementsGetResponses, ActionsPlacementsGetErrors, ThrowOnError, 'data'>;
+}