@deepnoodle/mobius 0.0.4 → 0.0.6

package/dist/api/schema.d.ts

@@ -173,64 +173,6 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/api-keys": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /**
-         * List API keys
-         * @description Returns API keys for this org. When `project_id` is provided, return
-         *     only keys pinned to that project. When `project_id` is omitted, return
-         *     only org-level keys; project-pinned keys are excluded because the
-         *     request has no project-scoped context.
-         */
-        get: operations["listAPIKeys"];
-        put?: never;
-        /**
-         * Create an API key
-         * @description Creates an API key for this org. Omit `project_id` to create an
-         *     org-scoped key when the caller has org-level authorization, or set
-         *     `project_id` to pin the key to exactly one project. Project-pinned
-         *     keys remain inaccessible through org-level listing and management
-         *     unless the request is explicitly scoped with the same `project_id`.
-         *     The raw key value is returned in `key` and is never retrievable again
-         *     after this response.
-         */
-        post: operations["createAPIKey"];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/v1/api-keys/{id}": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** Get an API key */
-        get: operations["getAPIKey"];
-        put?: never;
-        post?: never;
-        /**
-         * Revoke an API key
-         * @description Permanently revokes the key. In-flight requests using this key will
-         *     immediately start receiving 401. When `project_id` is provided, revoke
-         *     only a key pinned to that project. When `project_id` is omitted,
-         *     project-pinned keys are excluded because the request has no
-         *     project-scoped context.
-         */
-        delete: operations["revokeAPIKey"];
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
     "/v1/projects/{project}/workflows": {
         parameters: {
             query?: never;
@@ -345,8 +287,8 @@ export interface paths {
          * List workflow runs
          * @description Supports cursor-based pagination and keyset filtering by
          *     status, workflow type, queue, parent run, and
-         *     initiator. Returns `{data, next_cursor?}`; pass `next_cursor`
-         *     back in the next call to walk the result set.
+         *     initiator. When `has_more` is true, pass the returned
+         *     `next_cursor` back on the next call to walk the result set.
          */
         get: operations["listRuns"];
         put?: never;
@@ -365,52 +307,6 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/projects/{project}/runs/cancellations": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * Request cancellation for a batch of runs
-         * @description Sets `cancel_requested` on every listed run. Workers receive
-         *     `directives.should_cancel: true` on their next heartbeat and are
-         *     expected to stop cooperatively. Per-run errors are reported inline;
-         *     the response always returns 200 even on partial failures.
-         */
-        post: operations["bulkCancelRuns"];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/v1/projects/{project}/runs/retries": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /**
-         * Re-enqueue a batch of failed runs
-         * @description Flips every listed run from `failed` back to `queued`, clearing
-         *     the error message. Only runs in terminal `failed` status can be
-         *     retried; runs in other states produce per-run errors. Per-run errors
-         *     are reported inline; the response always returns 200 on partial failures.
-         */
-        post: operations["bulkRetryRuns"];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
     "/v1/projects/{project}/runs/{id}": {
         parameters: {
             query?: never;
@@ -436,7 +332,7 @@ export interface paths {
             cookie?: never;
         };
         /** List action log entries for a run */
-        get: operations["getRunActionLog"];
+        get: operations["listRunActionLog"];
         put?: never;
         post?: never;
         delete?: never;
@@ -453,7 +349,7 @@ export interface paths {
             cookie?: never;
         };
         /** List jobs for a run */
-        get: operations["getRunJobs"];
+        get: operations["listRunJobs"];
         put?: never;
         post?: never;
         delete?: never;
@@ -748,8 +644,8 @@ export interface paths {
          *     for up to `wait_seconds` (capped at 30). Returns 204 when the poll
          *     window closes empty.
          *
-         *     Each successful call also registers or refreshes the worker in the
-         *     worker registry (used by `GET /v1/projects/{project}/workers`), so no
+         *     Each successful call also registers or refreshes the caller's worker
+         *     session (used by `GET /v1/projects/{project}/worker-sessions`), so no
          *     separate registration step is needed.
          *
          *     The returned `JobClaim` includes the `heartbeat_interval_seconds`
@@ -878,8 +774,7 @@ export interface paths {
          *     route over `POST /v1/projects/{project}/interactions` from within a
          *     job context. The optional `signal_name` field overrides the
          *     server-derived signal name; when omitted the server derives the
-         *     signal name from `step_name` or uses a default interaction
-         *     signal name.
+         *     signal name from `step_name` or uses a default interaction signal.
          */
         post: operations["createJobInteraction"];
         delete?: never;
@@ -975,7 +870,7 @@ export interface paths {
          * List fire history for a trigger
          * @description Returns a paginated history of trigger fires newest-first. Each entry
          *     records whether the fire succeeded, was skipped (e.g. by `forbid`
-         *     concurrency policy), or failed, along with the resulting run ID.
+         *     concurrency policy), or failed, along with per-target outcomes.
          */
         get: operations["listTriggerFires"];
         put?: never;
@@ -986,7 +881,7 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/projects/{project}/workers": {
+    "/v1/projects/{project}/triggers/{id}/targets": {
         parameters: {
             query?: never;
             header?: never;
@@ -994,14 +889,64 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List workers
-         * @description Returns workers that have polled for jobs within the project. Each
-         *     worker's `stale` flag is computed at read time: if `last_seen_at`
-         *     is older than 2 minutes (or absent), the worker is considered stale.
-         *     Stale workers are retained for display but will not receive new job
+         * List targets for a trigger
+         * @description Returns all targets attached to the given trigger.
+         */
+        get: operations["listTriggerTargets"];
+        put?: never;
+        /**
+         * Add a target to a trigger
+         * @description Attaches a workflow as a new target of the trigger.
+         */
+        post: operations["createTriggerTarget"];
+        /**
+         * Remove all targets from a trigger
+         * @description Detaches every target from the trigger. The trigger itself is not deleted.
+         */
+        delete: operations["deleteAllTriggerTargets"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/projects/{project}/triggers/{id}/targets/{target_id}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get a trigger target */
+        get: operations["getTriggerTarget"];
+        put?: never;
+        post?: never;
+        /** Remove a target from a trigger */
+        delete: operations["deleteTriggerTarget"];
+        options?: never;
+        head?: never;
+        /**
+         * Update a trigger target
+         * @description All fields are optional; omitted fields are unchanged.
+         */
+        patch: operations["updateTriggerTarget"];
+        trace?: never;
+    };
+    "/v1/projects/{project}/worker-sessions": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List worker sessions
+         * @description Returns worker sessions that have polled for jobs within the project.
+         *     Each session's `stale` flag is computed at read time: if `last_seen_at`
+         *     is older than 2 minutes (or absent), the session is considered stale.
+         *     Stale sessions are retained for display but will not receive new job
          *     claims.
          */
-        get: operations["listWorkers"];
+        get: operations["listWorkerSessions"];
         put?: never;
         post?: never;
         delete?: never;
@@ -1067,7 +1012,7 @@ export interface paths {
         patch: operations["updateProject"];
         trace?: never;
     };
-    "/v1/projects/{project}/webhooks": {
+    "/v1/projects/{id}/members": {
         parameters: {
             query?: never;
             header?: never;
@@ -1075,55 +1020,51 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List webhooks
-         * @description Returns all outgoing webhook subscriptions for the project.
+         * List project members
+         * @description Returns the users listed as members of this project. Membership is a
+         *     pure visibility layer: for `restricted` projects only listed members
+         *     (plus org owners/admins) can see or use the project. For `org_open`
+         *     projects, membership has no visibility effect.
          */
-        get: operations["listWebhooks"];
+        get: operations["listProjectMembers"];
         put?: never;
         /**
-         * Create a webhook
-         * @description Creates a new outgoing webhook subscription. Webhook names must be
-         *     unique within the project. Returns 409 if the name already exists.
-         *
-         *     The signing `secret` (if provided) is stored in plaintext — treat
-         *     it as a shared secret and rotate it via `PATCH` if compromised.
+         * Add a project member
+         * @description Adds a user as a project member. The user must already be an org
+         *     member. Add is idempotent — adding an existing member returns the
+         *     existing row with `200 OK`, not `409`. New memberships are returned
+         *     with `201 Created`.
          */
-        post: operations["createWebhook"];
+        post: operations["addProjectMember"];
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/v1/projects/{project}/webhooks/{id}": {
+    "/v1/projects/{id}/members/{uid}": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        /** Get a webhook */
-        get: operations["getWebhook"];
+        get?: never;
         put?: never;
         post?: never;
         /**
-         * Delete a webhook
-         * @description Deletes the webhook and its delivery history.
+         * Remove a project member
+         * @description Removes a user from the project members list. On `restricted`
+         *     projects, removing the last remaining member is rejected — flip the
+         *     project to `org_open` or add another member first.
          */
-        delete: operations["deleteWebhook"];
+        delete: operations["removeProjectMember"];
         options?: never;
         head?: never;
-        /**
-         * Update a webhook
-         * @description Updates the webhook URL, event subscriptions, enabled state, or
-         *     signing secret. Setting `secret` to an empty string clears the
-         *     current secret and disables signing. Omitting `secret` leaves the
-         *     current value unchanged.
-         */
-        patch: operations["updateWebhook"];
+        patch?: never;
         trace?: never;
     };
-    "/v1/projects/{project}/webhooks/{id}/deliveries": {
+    "/v1/projects/{project}/webhooks": {
         parameters: {
             query?: never;
             header?: never;
@@ -1131,74 +1072,55 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List webhook deliveries
-         * @description Lists the delivery history for a webhook, newest first. Each entry
-         *     records the event type, current status, attempt count, and any last
-         *     error message. Deliveries are retried up to 10 times (5xx, 408,
-         *     429 are retryable; other 4xx are not). A delivery transitions to
-         *     `failed` only after exhausting all retry attempts.
+         * List webhooks
+         * @description Returns all outgoing webhook subscriptions for the project.
          */
-        get: operations["listWebhookDeliveries"];
-        put?: never;
-        post?: never;
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/v1/projects/{project}/integrations": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** List integrations */
-        get: operations["listIntegrations"];
+        get: operations["listWebhooks"];
         put?: never;
         /**
-         * Create an integration
-         * @description Creates a new integration record. The `provider` + `name` pair must
-         *     be unique within the project. Returns 400 if validation fails (e.g.,
-         *     missing required fields).
+         * Create a webhook
+         * @description Creates a new outgoing webhook subscription. Webhook names must be
+         *     unique within the project. Returns 409 if the name already exists.
+         *
+         *     Treat the `signing_secret` as a shared secret and rotate it via
+         *     `PATCH` if compromised.
          */
-        post: operations["createIntegration"];
+        post: operations["createWebhook"];
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/v1/projects/{project}/integrations/{id}": {
+    "/v1/projects/{project}/webhooks/{id}": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        /** Get an integration */
-        get: operations["getIntegration"];
-        /**
-         * Update an integration
-         * @description Replaces the integration's `name`, `config`, and/or `status`. Use
-         *     `status: inactive` to disable an integration without deleting it.
-         *     Use `status: active` to re-enable. The `provider` field is
-         *     immutable after creation.
-         */
-        put: operations["updateIntegration"];
+        /** Get a webhook */
+        get: operations["getWebhook"];
+        put?: never;
         post?: never;
         /**
-         * Delete an integration
-         * @description Hard-deletes the integration record and its stored config.
+         * Delete a webhook
+         * @description Deletes the webhook and its delivery history.
          */
-        delete: operations["deleteIntegration"];
+        delete: operations["deleteWebhook"];
         options?: never;
         head?: never;
-        patch?: never;
+        /**
+         * Update a webhook
+         * @description Updates the webhook URL, event subscriptions, enabled state, or
+         *     signing secret. Setting `signing_secret` to an empty string clears
+         *     the current secret and disables signing. Omitting `signing_secret`
+         *     leaves the current value unchanged.
+         */
+        patch: operations["updateWebhook"];
         trace?: never;
     };
-    "/v1/projects/{project}/integrations/copy": {
+    "/v1/projects/{project}/webhooks/{id}/ping": {
         parameters: {
             query?: never;
             header?: never;
@@ -1208,23 +1130,23 @@ export interface paths {
         get?: never;
         put?: never;
         /**
-         * Copy an integration from another project
-         * @description Clones an integration from another project within the same org into
-         *     this project. The full `config` blob is copied as-is. The source
-         *     and destination projects must both belong to the same org.
-         *
-         *     The `(provider, name)` pair must be unique in the destination project;
-         *     supply a different `name` to avoid conflicts with an existing
-         *     integration of the same provider and name.
+         * Test a webhook URL
+         * @description Sends a live test POST request to the webhook's saved URL, or to an
+         *     override URL supplied in the request body, and returns the result.
+         *     Because the webhook URL may be empty at creation time, the typical
+         *     flow is: create the webhook without a URL, ping candidate URLs via
+         *     the override until one succeeds, then persist the chosen URL with
+         *     `PATCH`. The test payload has `type: "ping"` and is signed with the
+         *     webhook's secret if one is set.
          */
-        post: operations["copyIntegration"];
+        post: operations["pingWebhook"];
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/v1/projects/{project}/metrics": {
+    "/v1/projects/{project}/webhooks/{id}/deliveries": {
         parameters: {
             query?: never;
             header?: never;
@@ -1232,13 +1154,14 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Get operational metrics for a project
-         * @description Returns a snapshot of current execution health for the project.
-         *     All rate and duration metrics are computed over a rolling window
-         *     (default: 60 minutes). P95 step duration is computed from the
-         *     40 most recent completed jobs.
+         * List webhook deliveries
+         * @description Lists the delivery history for a webhook, newest first. Each entry
+         *     records the event type, current status, attempt count, and any last
+         *     error message. Deliveries are retried up to 10 times (5xx, 408,
+         *     429 are retryable; other 4xx are not). A delivery transitions to
+         *     `failed` only after exhausting all retry attempts.
          */
-        get: operations["getProjectMetrics"];
+        get: operations["listWebhookDeliveries"];
         put?: never;
         post?: never;
         delete?: never;
@@ -1247,7 +1170,7 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/roles": {
+    "/v1/projects/{project}/metrics": {
         parameters: {
             query?: never;
             header?: never;
@@ -1255,94 +1178,21 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * List roles
-         * @description Returns system-defined roles plus custom roles for the org. Use `project_id` to narrow results to project-scoped roles.
-         */
-        get: operations["listRoles"];
-        put?: never;
-        /**
-         * Create a role
-         * @description Creates a custom role for the org. Supply `project_id` to scope the
-         *     role to a specific project. Roles with an empty `project_id` are
-         *     org-wide and can be assigned across all projects.
+         * Get operational metrics for a project
+         * @description Returns a snapshot of current execution health for the project.
+         *     All rate and duration metrics are computed over a rolling window
+         *     (default: 60 minutes). P95 step duration is computed from the
+         *     40 most recent completed jobs.
          */
-        post: operations["createRole"];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/v1/roles/{id}": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /** Get a role */
-        get: operations["getRole"];
+        get: operations["getProjectMetrics"];
         put?: never;
         post?: never;
-        /**
-         * Delete a role
-         * @description Hard-deletes the role and all its assignments. System-defined roles cannot be deleted.
-         */
-        delete: operations["deleteRole"];
-        options?: never;
-        head?: never;
-        /**
-         * Update a role
-         * @description Updates name, description, or permissions of a custom role. System-defined
-         *     roles (system_defined=true) cannot be updated and return 403.
-         */
-        patch: operations["updateRole"];
-        trace?: never;
-    };
-    "/v1/role-assignments": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        /**
-         * List role assignments
-         * @description Returns assignments optionally filtered by actor, role, or project scope.
-         */
-        get: operations["listRoleAssignments"];
-        put?: never;
-        /**
-         * Assign a role to an actor
-         * @description Binds a role to a user or service account. Supply `project_id` to create
-         *     a project-scoped assignment; omit it for an org-wide assignment.
-         *     The assignment records the creating actor in `granted_by_actor_type` /
-         *     `granted_by_actor_id` for audit purposes.
-         */
-        post: operations["createRoleAssignment"];
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/v1/role-assignments/{id}": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        post?: never;
-        /** Remove a role assignment */
-        delete: operations["deleteRoleAssignment"];
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
     "/v1/projects/{project}/interactions": {
         parameters: {
             query?: never;
@@ -1574,9 +1424,17 @@ export interface paths {
         put?: never;
         /**
          * Create an agent
-         * @description Creates an agent bound to `service_account_id`. A service account can
-         *     back multiple agents, but each agent belongs to exactly one service
-         *     account for the lifetime of the agent.
+         * @description Creates an agent bound to a service account. A service account can back
+         *     multiple agents. The service account can be changed after creation via
+         *     the PATCH endpoint.
+         *
+         *     If `service_account_id` is omitted, a new service account is
+         *     auto-created with the same name as the agent and assigned to back it.
+         *     Auto-creation requires the caller to hold `mobius.service_account.manage`
+         *     in addition to `mobius.agent.manage`. Auto-creation fails if a service
+         *     account with that name already exists in the project; to bind an
+         *     existing service account to a new agent, pass `service_account_id`
+         *     explicitly.
          */
         post: operations["createAgent"];
         delete?: never;
@@ -1605,8 +1463,7 @@ export interface paths {
         head?: never;
         /**
          * Update an agent
-         * @description Updates mutable agent fields. The backing `service_account_id` cannot
-         *     be changed after creation. Setting `status` to `inactive` prevents
+         * @description Updates mutable agent fields. Setting `status` to `inactive` prevents
          *     the agent from claiming new jobs but does not terminate active sessions.
          */
         patch: operations["updateAgent"];
@@ -1641,7 +1498,7 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/projects/{project}/agents/sessions/{sessionId}": {
+    "/v1/projects/{project}/agents/{id}/sessions/{sessionId}": {
         parameters: {
             query?: never;
             header?: never;
@@ -1658,7 +1515,7 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/projects/{project}/agents/sessions/{sessionId}/heartbeat": {
+    "/v1/projects/{project}/agents/{id}/sessions/{sessionId}/heartbeat": {
         parameters: {
             query?: never;
             header?: never;
@@ -1680,7 +1537,7 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/v1/projects/{project}/agents/sessions/{sessionId}/disconnect": {
+    "/v1/projects/{project}/agents/{id}/sessions/{sessionId}/disconnect": {
         parameters: {
             query?: never;
             header?: never;
@@ -2014,6 +1871,8 @@ export interface components {
             actor_type?: string;
             /** @description Durable actor ID that performed the action */
             actor_id?: string;
+            /** @description Display name of the actor (email for users, service account name for service accounts) */
+            actor_name?: string;
             /** @description Credential ID used for the request, when applicable */
             credential_id?: string;
             /**
@@ -2043,7 +1902,7 @@ export interface components {
         };
         AuditLogListResponse: {
             /** @description The list of results for this page. */
-            items?: components["schemas"]["AuditLogEntry"][];
+            items: components["schemas"]["AuditLogEntry"][];
             /** @description Cursor for fetching next page of results */
             next_cursor?: string;
             /** @description Whether more results are available */
@@ -2202,6 +2061,12 @@ export interface components {
             user_code: string;
             /** @description Optional label to identify this credential in the CLI credentials list. */
             label?: string;
+            /**
+             * @description Optional project ID to pin the issued CLI credential to. When set,
+             *     the resulting token is usable only for that project and must carry
+             *     the project's handle as a trailing `.<handle>` suffix.
+             */
+            project_id?: string;
         };
         ConfirmDeviceCodeResult: {
             /** @description True when the device code was successfully confirmed and a CLI credential has been issued. */
@@ -2214,6 +2079,17 @@ export interface components {
             id: string;
             /** @description ID of the user who authorized this credential. */
             user_id: string;
+            /**
+             * @description Project ID the credential is pinned to. Empty when the credential
+             *     is org-scoped (usable across every project the user can access).
+             */
+            project_id?: string;
+            /**
+             * @description Handle of the pinned project, echoed here so clients can format
+             *     the trailing `.<handle>` suffix on every request. Empty when the
+             *     credential is not pinned.
+             */
+            project_handle?: string;
             /** @description Human-readable label identifying this credential. */
             label: string;
             /** @description First few characters of the token, shown for identification without exposing the secret. */
@@ -2526,7 +2402,7 @@ export interface components {
         };
         WorkflowDefinitionListResponse: {
             /** @description The list of results for this page. */
-            items?: components["schemas"]["WorkflowDefinition"][];
+            items: components["schemas"]["WorkflowDefinition"][];
             /** @description Opaque cursor to pass as `cursor` on the next request. Absent when `has_more` is false. */
             next_cursor?: string;
             /** @description Whether additional pages are available. */
@@ -2649,7 +2525,7 @@ export interface components {
         };
         WorkflowRunListResponse: {
             /** @description The list of results for this page. */
-            items?: components["schemas"]["WorkflowRun"][];
+            items: components["schemas"]["WorkflowRun"][];
             /** @description True when more pages are available. */
             has_more: boolean;
             /**
@@ -2805,18 +2681,6 @@ export interface components {
             /** @description Signal topic name matching the wait_signal step's topic. */
             name: string;
         };
-        BulkRunRequest: {
-            /** @description IDs of the runs to operate on. */
-            run_ids: string[];
-        };
-        BulkRunResult: {
-            /** @description IDs of runs that were successfully processed. */
-            succeeded: string[];
-            /** @description Map of run_id -> error message for per-run failures. */
-            failures?: {
-                [key: string]: string;
-            };
-        };
         /**
          * @description Hints that describe the safe-use properties of the action. Used by the
          *     engine and tooling to decide retry behavior, dry-run eligibility, etc.
@@ -2918,7 +2782,7 @@ export interface components {
         };
         ActionListResponse: {
             /** @description The list of results for this page. */
-            items?: components["schemas"]["Action"][];
+            items: components["schemas"]["Action"][];
             /** @description Opaque cursor to pass as `cursor` on the next request. Absent when `has_more` is false. */
             next_cursor?: string;
             /** @description Whether additional pages are available. */
@@ -3006,7 +2870,7 @@ export interface components {
         };
         ActionAuditLogListResponse: {
             /** @description The list of results for this page. */
-            items?: components["schemas"]["ActionAuditLogEntry"][];
+            items: components["schemas"]["ActionAuditLogEntry"][];
             /** @description Opaque cursor to pass as `cursor` on the next request. Absent when `has_more` is false. */
             next_cursor?: string;
             /** @description Whether additional pages are available. */
@@ -3051,7 +2915,7 @@ export interface components {
             run_id: string;
             /** @description Handle of the workflow definition that owns this run. */
             workflow_name: string;
-            /** @description Step label from the workflow spec — used for UI and for deriving the interaction signal name when a worker creates a run-backed interaction without an explicit signal_name. */
+            /** @description Step label from the workflow spec — used for UI and interaction signal name derivation. */
             step_name: string;
             /** @description Action name the worker must execute for this step. */
             action: string;
@@ -3249,9 +3113,9 @@ export interface components {
              * @description When target_actor.type is "group", setting require_all=true
              *     means all snapshotted group members must respond before the
              *     interaction is considered complete. Ignored for non-group targets.
-             * @default false
+             *     Defaults to false when omitted.
              */
-            require_all: boolean;
+            require_all?: boolean;
             /**
              * @description Optional duration string (e.g. "24h", "30m") specifying how long
              *     the interaction should remain open before expiring. When absent
@@ -3368,12 +3232,20 @@ export interface components {
          */
         ConcurrencyPolicy: "allow" | "forbid" | "replace";
         /**
-         * @description `skipped` means the fire was suppressed by the concurrency policy or a target condition evaluated to false.
+         * @description Outcome of a trigger activation:
+         *     - `success` — all enabled targets started their runs (or no targets configured).
+         *     - `partial_failure` — at least one target failed while others succeeded.
+         *     - `failed` — all targets failed, or a trigger-level error prevented any target.
+         *     - `skipped` — the concurrency policy suppressed the entire activation.
          * @enum {string}
          */
-        TriggerFireStatus: "success" | "failed" | "skipped";
+        TriggerFireStatus: "success" | "partial_failure" | "failed" | "skipped";
         /** @description A workflow to start when this trigger fires. */
         TriggerTarget: {
+            /** @description Unique identifier for this target. */
+            id: string;
+            /** @description ID of the trigger this target belongs to. */
+            trigger_id: string;
             /** @description ID of the workflow definition to run. */
             workflow_id: string;
             /**
@@ -3388,9 +3260,63 @@ export interface components {
             input_mapping?: {
                 [key: string]: string;
             };
-        };
-        Trigger: {
-            /** @description Unique identifier for this trigger. */
+            /** @description When false, this target is paused and will not start a run when the trigger fires. */
+            enabled: boolean;
+            /**
+             * Format: date-time
+             * @description Timestamp when this target was created.
+             */
+            created_at: string;
+            /**
+             * Format: date-time
+             * @description Timestamp when this target was last updated.
+             */
+            updated_at: string;
+        };
+        TriggerTargetListResponse: {
+            /** @description The list of targets for this trigger. */
+            items: components["schemas"]["TriggerTarget"][];
+        };
+        /** @description Parameters for attaching a workflow target to a trigger. */
+        CreateTriggerTargetRequest: {
+            /** @description ID of the workflow definition to run. */
+            workflow_id: string;
+            /** @description Expression evaluated against the event payload. Omit to always run. */
+            condition?: string;
+            /** @description Maps workflow input names to JSONPath expressions. */
+            input_mapping?: {
+                [key: string]: string;
+            };
+            /** @description Whether this target starts enabled. Defaults to true when omitted. */
+            enabled?: boolean;
+        };
+        /** @description Partial update for a trigger target; omitted fields are unchanged. */
+        UpdateTriggerTargetRequest: {
+            /** @description Replacement workflow definition ID. */
+            workflow_id?: string;
+            /** @description Replacement condition expression. Set to empty string to remove. */
+            condition?: string;
+            /** @description Replacement input mapping. Set to null to clear all mappings. */
+            input_mapping?: {
+                [key: string]: string;
+            } | null;
+            /** @description Set to false to pause this target without removing it. */
+            enabled?: boolean;
+        };
+        /** @description Outcome of a single target within a trigger fire activation. */
+        TriggerFireTargetResult: {
+            /** @description ID of the trigger target that was evaluated. */
+            target_id: string;
+            /** @description ID of the workflow definition that was started (or attempted). */
+            workflow_id: string;
+            /** @description ID of the workflow run that was created. Absent when the target failed or was skipped. */
+            run_id?: string;
+            status: components["schemas"]["TriggerFireStatus"];
+            /** @description Error detail when status is `failed`. */
+            error?: string;
+        };
+        Trigger: {
+            /** @description Unique identifier for this trigger. */
             id: string;
             /** @description Human-readable trigger name, unique within the project. */
             name: string;
@@ -3406,7 +3332,7 @@ export interface components {
             filter_config?: {
                 [key: string]: unknown;
             };
-            /** @description Workflows to start when this trigger fires. */
+            /** @description Targets attached to this trigger, populated via join. */
             targets?: components["schemas"]["TriggerTarget"][];
             concurrency_policy: components["schemas"]["ConcurrencyPolicy"];
             /** @description When false, the trigger is paused and will not fire. */
@@ -3440,7 +3366,7 @@ export interface components {
         };
         TriggerListResponse: {
             /** @description The list of results for this page. */
-            items?: components["schemas"]["Trigger"][];
+            items: components["schemas"]["Trigger"][];
             /** @description Opaque cursor to pass as `cursor` on the next request. Absent when `has_more` is false. */
             next_cursor?: string;
             /** @description Whether additional pages are available. */
@@ -3462,8 +3388,8 @@ export interface components {
              * @description When the fire was actually processed.
              */
             fired_at: string;
-            /** @description Workflow run created by this fire. Absent when status is `skipped` or `failed` before run creation. */
-            run_id?: string;
+            /** @description Per-target outcomes for this activation. */
+            target_results?: components["schemas"]["TriggerFireTargetResult"][];
             status: components["schemas"]["TriggerFireStatus"];
             /** @description Error detail when status is `failed`. */
             error?: string;
@@ -3477,7 +3403,7 @@ export interface components {
         };
         TriggerFireListResponse: {
             /** @description The list of results for this page. */
-            items?: components["schemas"]["TriggerFire"][];
+            items: components["schemas"]["TriggerFire"][];
             /** @description Opaque cursor to pass as `cursor` on the next request. Absent when `has_more` is false. */
             next_cursor?: string;
             /** @description Whether additional pages are available. */
@@ -3499,14 +3425,11 @@ export interface components {
             filter_config?: {
                 [key: string]: unknown;
             };
-            /** @description Workflows to start when this trigger fires. */
-            targets?: components["schemas"]["TriggerTarget"][];
+            /** @description Workflows to start when this trigger fires (inline convenience; stored as sub-resources). */
+            targets?: components["schemas"]["CreateTriggerTargetRequest"][];
             concurrency_policy?: components["schemas"]["ConcurrencyPolicy"];
-            /**
-             * @description Whether the trigger starts enabled. Defaults to true.
-             * @default true
-             */
-            enabled: boolean;
+            /** @description Whether the trigger starts enabled. Defaults to true when omitted. */
+            enabled?: boolean;
             /**
              * @description URL-safe handle that determines the inbound receive URL. Auto-derived
              *     from `name` for `webhook` triggers when omitted. Must be unique
@@ -3518,7 +3441,7 @@ export interface components {
              *     When set, Mobius validates the `X-Mobius-Signature` header on
              *     incoming requests.
              */
-            webhook_secret?: string;
+            signing_secret?: string;
         };
         UpdateTriggerRequest: {
             /** @description Replacement human-readable name. */
@@ -3531,17 +3454,15 @@ export interface components {
             filter_config?: {
                 [key: string]: unknown;
             };
-            /** @description Replaces the entire targets array. */
-            targets?: components["schemas"]["TriggerTarget"][];
             concurrency_policy?: components["schemas"]["ConcurrencyPolicy"];
             /** @description Set to false to pause the trigger without deleting it. */
             enabled?: boolean;
             /** @description Changing this changes the `receive_url`; update any upstream integrations. */
             webhook_handle?: string;
             /** @description Replace or clear the inbound signature verification secret. */
-            webhook_secret?: string;
+            signing_secret?: string;
         };
-        Worker: {
+        WorkerSession: {
             /** @description Caller-assigned stable identifier for this worker process. */
             id: string;
             /** @description Optional human-readable name supplied in the claim request. */
@@ -3550,23 +3471,57 @@ export interface components {
             version?: string;
             /**
              * Format: date-time
-             * @description Timestamp of the worker's most recent job claim poll. Updated on
-             *     every `POST /v1/projects/{project}/jobs/claim` call regardless of whether a job was
-             *     returned. Used to compute `stale`.
+             * @description Timestamp of this session's most recent job claim poll. Updated on
+             *     every `POST /v1/projects/{project}/jobs/claim` call regardless of
+             *     whether a job was returned. Used to compute `stale`.
              */
             last_seen_at?: string;
             /** @description Reserved for future capability-based job routing. Not currently used for filtering. */
             capabilities?: string[];
+            /**
+             * @description Service account this session authenticated as on register/heartbeat.
+             *     Set when a machine identity is polling; mutually exclusive with
+             *     `user_id`. Stable across credential rotation — use this to group
+             *     sessions by identity in the admin UI.
+             */
+            service_account_id?: string;
+            /**
+             * @description User this session authenticated as on register/heartbeat. Set when
+             *     a human is polling via the CLI; mutually exclusive with
+             *     `service_account_id`.
+             */
+            user_id?: string;
+            /**
+             * @description ID of the specific API key this session presented on its most
+             *     recent register/heartbeat. Only set for service-account-backed
+             *     sessions; changes across credential rotations. Use together with
+             *     `service_account_id` to see rotation progress across a fleet.
+             */
+            api_key_id?: string;
+            /**
+             * @description Agent this session represents, when the polling process declared
+             *     itself as a registered agent (via `agent_id` on the claim request
+             *     or via inference from the service account). Absent for ad-hoc
+             *     worker processes that are not tied to a declared agent.
+             */
+            agent_id?: string;
             /**
              * @description True when `last_seen_at` is older than 2 minutes or absent.
              *     Computed at read time, not stored.
              */
             stale: boolean;
         };
-        WorkerListResponse: {
-            /** @description The list of recently seen workers. */
-            items: components["schemas"]["Worker"][];
+        WorkerSessionListResponse: {
+            /** @description The list of recently seen worker sessions. */
+            items: components["schemas"]["WorkerSession"][];
         };
+        /**
+         * @description `org_open`: every org member can see and use the project, subject to
+         *     role assignments. `restricted`: only listed project members (and org
+         *     owners/admins) can see or use the project.
+         * @enum {string}
+         */
+        ProjectAccessMode: "org_open" | "restricted";
         Project: {
             /** @description Unique identifier for this project. */
             id: string;
@@ -3579,6 +3534,7 @@ export interface components {
             handle: string;
             /** @description Optional human-readable description. */
             description?: string;
+            access_mode: components["schemas"]["ProjectAccessMode"];
             /** @description User ID of the org member who created this project. */
             created_by?: string;
             /**
@@ -3606,12 +3562,49 @@ export interface components {
             handle?: string;
             /** @description Optional human-readable description. */
             description?: string;
+            access_mode?: components["schemas"]["ProjectAccessMode"];
         };
         UpdateProjectRequest: {
             /** @description Replacement human-readable name. */
             name?: string;
             /** @description Replacement description. */
             description?: string;
+            access_mode?: components["schemas"]["ProjectAccessMode"];
+            /**
+             * @description When transitioning from `org_open` to `restricted`, set true to
+             *     insert all current org members as project members so nobody
+             *     loses visibility on the flip. Ignored on other transitions.
+             */
+            seed_existing_members?: boolean;
+        };
+        ProjectMember: {
+            /** @description Unique identifier for this membership record. */
+            id: string;
+            /** @description ID of the project this membership belongs to. */
+            project_id: string;
+            /** @description ID of the user who is a member. */
+            user_id: string;
+            /** @description Actor type of whoever added this member, if recorded. */
+            added_by_actor_type?: string;
+            /** @description Actor ID of whoever added this member, if recorded. */
+            added_by_actor_id?: string;
+            /**
+             * Format: date-time
+             * @description Timestamp when the member was added.
+             */
+            added_at: string;
+        };
+        ProjectMemberListResponse: {
+            /** @description The list of members for this project. */
+            items: components["schemas"]["ProjectMember"][];
+            /** @description Whether more results are available. */
+            has_more: boolean;
+            /** @description Opaque cursor to pass as `cursor` on the next request. Absent when `has_more` is false. */
+            next_cursor?: string;
+        };
+        AddProjectMemberRequest: {
+            /** @description User ID of the org member to add to this project. */
+            user_id: string;
         };
         /**
          * @description `pending` — queued, not yet attempted.
@@ -3702,24 +3695,26 @@ export interface components {
         CreateWebhookRequest: {
             /** @description Human-readable name, unique within the project. */
             name: string;
-            /** @description The endpoint Mobius will POST event payloads to. */
-            url: string;
             /**
-             * @description Optional shared secret. When set, Mobius signs each POST body
-             *     with HMAC-SHA256 and includes `X-Mobius-Signature: sha256=<hex>`
-             *     in the request headers.
+             * @description The endpoint Mobius will POST event payloads to. May be left empty
+             *     at creation time so a candidate URL can be tested via the ping
+             *     endpoint before it is saved; events do not fire for webhooks with
+             *     an empty URL.
+             */
+            url?: string;
+            /**
+             * @description Optional HMAC-SHA256 secret. When set, Mobius signs each POST body
+             *     and includes `X-Mobius-Signature: sha256=<hex>` in the request
+             *     headers.
              */
-            secret?: string;
+            signing_secret?: string;
             /**
              * @description Event types to subscribe to. Use wildcards for broad
              *     subscriptions, e.g. `["run.*"]` for all run events.
              */
             events: string[];
-            /**
-             * @description Whether the webhook starts enabled. Defaults to true.
-             * @default true
-             */
-            enabled: boolean;
+            /** @description Whether the webhook starts enabled. Defaults to true when omitted. */
+            enabled?: boolean;
         };
         UpdateWebhookRequest: {
             /** @description Replacement human-readable name. */
@@ -3730,12 +3725,31 @@ export interface components {
              * @description Replace the current signing secret. Set to empty string to
              *     disable signing. Omit to leave the current secret unchanged.
              */
-            secret?: string;
+            signing_secret?: string;
             /** @description Replacement event subscriptions. Replaces the entire current list. */
             events?: string[];
             /** @description Set to false to disable delivery without deleting the webhook. */
             enabled?: boolean;
         };
+        PingWebhookRequest: {
+            /**
+             * @description URL to test. When supplied, the ping is sent to this URL instead
+             *     of the webhook's saved URL — use this to validate a candidate URL
+             *     before saving it. When omitted, the webhook's current saved URL
+             *     is used.
+             */
+            url?: string;
+        };
+        PingWebhookResult: {
+            /** @description True if the target responded with a 2xx status code. */
+            success: boolean;
+            /** @description HTTP status code returned by the target. Absent on network error. */
+            status_code?: number;
+            /** @description Error message if the request could not be completed. */
+            error?: string;
+            /** @description Round-trip latency in milliseconds. */
+            latency_ms?: number;
+        };
         /**
          * @description `active` — integration is enabled and usable by workflows.
          *     `inactive` — manually disabled; no automatic expiry behavior.
@@ -3776,7 +3790,7 @@ export interface components {
         };
         IntegrationListResponse: {
             /** @description The list of results for this page. */
-            items?: components["schemas"]["Integration"][];
+            items: components["schemas"]["Integration"][];
             /** @description Opaque cursor to pass as `cursor` on the next request. Absent when `has_more` is false. */
             next_cursor?: string;
             /** @description Whether additional pages are available. */
@@ -4211,9 +4225,9 @@ export interface components {
             items: components["schemas"]["RoleAssignment"][];
         };
         CreateRoleRequest: {
-            /** @description Scope the role to a project. Omit for an org-wide role. */
-            project_id?: string;
-            /** @description Unique name within the org+project scope. */
+            /** @description Project this role belongs to. Custom roles are always project-scoped. */
+            project_id: string;
+            /** @description Unique name within the project. */
             name: string;
             /** @description Optional human-readable description of what this role grants. */
             description?: string;
@@ -4221,10 +4235,6 @@ export interface components {
             permissions: string[];
         };
         UpdateRoleRequest: {
-            /** @description Scope to change this role to. Cannot change an org-scoped role to project-scoped after creation. */
-            project_id?: string;
-            /** @description Replacement role name. */
-            name?: string;
             /** @description Replacement description. */
             description?: string;
             /** @description Replaces the existing permissions array entirely. */
@@ -4267,6 +4277,13 @@ export interface components {
              */
             updated_at: string;
         };
+        /**
+         * @description One of the built-in system roles. These are seeded at startup and
+         *     cannot be deleted. `Owner` and `Admin` bypass project-member
+         *     visibility for restricted projects.
+         * @enum {string}
+         */
+        SystemRoleName: "Owner" | "Admin" | "Operator" | "Worker" | "Viewer";
         Org: {
             /** @description Unique identifier for this organization. */
             id: string;
@@ -4278,6 +4295,18 @@ export interface components {
             metadata?: {
                 [key: string]: unknown;
             };
+            /**
+             * @description System-role name assigned at org scope to new org members.
+             *     Defaults to `Operator`.
+             */
+            default_member_role?: components["schemas"]["SystemRoleName"];
+            /**
+             * @description Access mode applied to newly-created projects when the caller does
+             *     not pass one explicitly. Changing this only affects future
+             *     projects.
+             * @enum {string}
+             */
+            default_project_access_mode?: "org_open" | "restricted";
             /**
              * Format: date-time
              * @description Timestamp when this organization was created.
@@ -4316,6 +4345,13 @@ export interface components {
             metadata?: {
                 [key: string]: unknown;
             };
+            /** @description System-role name assigned to new org members at org scope. */
+            default_member_role?: components["schemas"]["SystemRoleName"];
+            /**
+             * @description Access mode applied to newly-created projects.
+             * @enum {string}
+             */
+            default_project_access_mode?: "org_open" | "restricted";
         };
         OrgMember: {
             /** @description Unique identifier for this membership record. */
@@ -4323,10 +4359,10 @@ export interface components {
             /** @description ID of the user who is a member. */
             user_id: string;
             /**
-             * @description `owner` has full control including org deletion; `admin` can manage members and settings; `member` has read-only org access.
+             * @description `Owner` has full control including org deletion; `Admin` can manage members and settings; `Member` has read-only org access.
              * @enum {string}
              */
-            role: "owner" | "admin" | "member";
+            role: "Owner" | "Admin" | "Member";
             /**
              * Format: date-time
              * @description Timestamp when this member joined.
@@ -4351,21 +4387,25 @@ export interface components {
             /** @description Clerk user ID of the user to add. */
             user_id: string;
             /**
-             * @description Role to assign the new member: `owner`, `admin`, or `member`.
+             * @description Role to assign the new member: `Owner`, `Admin`, or `Member`.
              * @enum {string}
              */
-            role: "owner" | "admin" | "member";
+            role: "Owner" | "Admin" | "Member";
         };
         UpdateOrgMemberRoleRequest: {
             /**
-             * @description New role to assign: `owner`, `admin`, or `member`.
+             * @description New role to assign: `Owner`, `Admin`, or `Member`.
              * @enum {string}
              */
-            role: "owner" | "admin" | "member";
+            role: "Owner" | "Admin" | "Member";
         };
         InteractionListResponse: {
             /** @description The list of results for this page. */
             items: components["schemas"]["Interaction"][];
+            /** @description Whether additional pages are available. */
+            has_more?: boolean;
+            /** @description Opaque cursor to pass as `cursor` on the next request. Absent when `has_more` is false. */
+            next_cursor?: string;
         };
         /**
          * @description Creates an interaction directly. When `run_id` is provided,
@@ -4393,9 +4433,9 @@ export interface components {
              * @description When target_actor.type is "group", setting require_all=true
              *     means all snapshotted group members must respond before the
              *     interaction is considered complete. Ignored for non-group targets.
-             * @default false
+             *     Defaults to false when omitted.
              */
-            require_all: boolean;
+            require_all?: boolean;
             /**
              * Format: date-time
              * @description Timestamp after which this interaction expires if not responded to.
@@ -4523,12 +4563,10 @@ export interface components {
         Agent: {
             /** @description Unique identifier for this agent. */
             id: string;
-            /** @description The service account whose credentials this agent uses to authenticate. Immutable after creation. */
+            /** @description The service account whose credentials this agent uses to authenticate. Can be changed via PATCH. */
             service_account_id: string;
-            /** @description Unique name within the project, used for targeting in job claims. */
+            /** @description Mutable unique name within the project. Free-form human-readable label; use `id` for stable references and job targeting. */
             name: string;
-            /** @description Human-readable label shown in the UI. */
-            display_name: string;
             /** @description Optional human-readable description. */
             description?: string;
             /** @description Freeform agent classification for tooling and filtering (e.g. "llm", "rpa"). */
@@ -4601,12 +4639,14 @@ export interface components {
             items: components["schemas"]["AgentSession"][];
         };
         CreateAgentRequest: {
-            /** @description Service account that backs this agent. Must belong to the same org. */
-            service_account_id: string;
-            /** @description Project-scoped unique identifier for this agent. */
+            /**
+             * @description Service account that backs this agent. Must be active and belong to
+             *     the same project. If omitted, a new service account is auto-created
+             *     with the same name as the agent.
+             */
+            service_account_id?: string;
+            /** @description Project-scoped unique name for this agent. Free-form human-readable label, 1-63 characters. */
             name: string;
-            /** @description Human-readable label shown in the UI. */
-            display_name?: string;
             /** @description Optional human-readable description. */
             description?: string;
             /** @description Freeform classification (e.g. "llm", "rpa", "integration"). */
@@ -4621,8 +4661,10 @@ export interface components {
             };
         };
         UpdateAgentRequest: {
-            /** @description Replacement human-readable label. */
-            display_name?: string;
+            /** @description Replacement service account. Must be active and belong to the same project. */
+            service_account_id?: string;
+            /** @description Replacement name. Must be unique within the project. */
+            name?: string;
             /** @description Replacement description. */
             description?: string;
             /** @description Replacement freeform agent classification (e.g. `llm`, `rpa`). */
@@ -4653,10 +4695,8 @@ export interface components {
         ServiceAccount: {
             /** @description Unique identifier for this service account. */
             id: string;
-            /** @description Stable machine-readable identifier, unique within the project. Immutable after creation. */
+            /** @description Human-readable name for this service account. Immutable after creation. */
             name: string;
-            /** @description Human-readable label shown in the UI. */
-            display_name: string;
             /** @description Optional human-readable description. */
             description?: string;
             status: components["schemas"]["ServiceAccountStatus"];
@@ -4682,10 +4722,8 @@ export interface components {
             items: components["schemas"]["ServiceAccount"][];
         };
         CreateServiceAccountRequest: {
-            /** @description Stable machine-readable identifier, unique within the project. */
+            /** @description Human-readable name for this service account. Immutable after creation. */
             name: string;
-            /** @description Human-readable label shown in the UI. */
-            display_name?: string;
             /** @description Optional human-readable description. */
             description?: string;
             /** @description Org member responsible for this service account. */
@@ -4695,20 +4733,13 @@ export interface components {
                 [key: string]: unknown;
             };
             /**
-             * @description Role to assign at creation time. Mutually exclusive with `role_name`.
-             *     Requires `permission.manage`. The role must belong to this project
-             *     or be org-scoped (project_id empty).
+             * @description One or more role IDs to assign at creation time. All assignments are
+             *     created atomically with the service account. Requires `mobius.permission.manage`.
+             *     Each role must belong to this project or be org-scoped (project_id empty).
              */
-            role_id?: string;
-            /**
-             * @description Role name to assign at creation time (resolved to a role ID server-side).
-             *     Mutually exclusive with `role_id`. Requires `permission.manage`.
-             */
-            role_name?: string;
+            role_ids?: string[];
         };
         UpdateServiceAccountRequest: {
-            /** @description Replacement human-readable label. */
-            display_name?: string;
             /** @description Replacement description. */
             description?: string;
             status?: components["schemas"]["ServiceAccountStatus"];
@@ -4862,6 +4893,8 @@ export interface components {
          *     treated as org-level and project-pinned keys are excluded.
          */
         APIKeyProjectIDParam: components["schemas"]["ProjectID"];
+        /** @description Trigger target ID. */
+        TriggerTargetIDParam: string;
         /** @description Group ID or handle. */
         GroupIDParam: string;
     };
@@ -5285,127 +5318,6 @@ export interface operations {
             401: components["responses"]["Unauthorized"];
         };
     };
-    listAPIKeys: {
-        parameters: {
-            query?: {
-                /**
-                 * @description Optional project scope for this request. When `project_id` is
-                 *     provided, the API key operation is resolved in that project's
-                 *     permission context. When `project_id` is omitted, the request is
-                 *     treated as org-level and project-pinned keys are excluded.
-                 */
-                project_id?: components["parameters"]["APIKeyProjectIDParam"];
-            };
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description OK */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["APIKeyListResponse"];
-                };
-            };
-            401: components["responses"]["Unauthorized"];
-            404: components["responses"]["NotFound"];
-        };
-    };
-    createAPIKey: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["CreateAPIKeyRequest"];
-            };
-        };
-        responses: {
-            /** @description Created */
-            201: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["APIKeyCreateResult"];
-                };
-            };
-            400: components["responses"]["BadRequest"];
-            401: components["responses"]["Unauthorized"];
-            404: components["responses"]["NotFound"];
-        };
-    };
-    getAPIKey: {
-        parameters: {
-            query?: {
-                /**
-                 * @description Optional project scope for this request. When `project_id` is
-                 *     provided, the API key operation is resolved in that project's
-                 *     permission context. When `project_id` is omitted, the request is
-                 *     treated as org-level and project-pinned keys are excluded.
-                 */
-                project_id?: components["parameters"]["APIKeyProjectIDParam"];
-            };
-            header?: never;
-            path: {
-                /** @description Resource ID. */
-                id: components["parameters"]["IDParam"];
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description OK */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["APIKey"];
-                };
-            };
-            401: components["responses"]["Unauthorized"];
-            404: components["responses"]["NotFound"];
-        };
-    };
-    revokeAPIKey: {
-        parameters: {
-            query?: {
-                /**
-                 * @description Optional project scope for this request. When `project_id` is
-                 *     provided, the API key operation is resolved in that project's
-                 *     permission context. When `project_id` is omitted, the request is
-                 *     treated as org-level and project-pinned keys are excluded.
-                 */
-                project_id?: components["parameters"]["APIKeyProjectIDParam"];
-            };
-            header?: never;
-            path: {
-                /** @description Resource ID. */
-                id: components["parameters"]["IDParam"];
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description No Content */
-            204: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-            401: components["responses"]["Unauthorized"];
-            404: components["responses"]["NotFound"];
-        };
-    };
     listWorkflows: {
         parameters: {
             query?: {
@@ -5712,21 +5624,19 @@ export interface operations {
             429: components["responses"]["TooManyRequests"];
         };
     };
-    bulkCancelRuns: {
+    getRun: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 /** @description Project handle (unique per organization) */
                 project: components["parameters"]["ProjectHandleParam"];
+                /** @description Resource ID. */
+                id: components["parameters"]["IDParam"];
             };
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["BulkRunRequest"];
-            };
-        };
+        requestBody?: never;
         responses: {
             /** @description OK */
             200: {
@@ -5734,28 +5644,26 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["BulkRunResult"];
+                    "application/json": components["schemas"]["WorkflowRunDetail"];
                 };
             };
-            400: components["responses"]["BadRequest"];
             401: components["responses"]["Unauthorized"];
+            404: components["responses"]["NotFound"];
         };
     };
-    bulkRetryRuns: {
+    listRunActionLog: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 /** @description Project handle (unique per organization) */
                 project: components["parameters"]["ProjectHandleParam"];
+                /** @description Resource ID. */
+                id: components["parameters"]["IDParam"];
             };
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["BulkRunRequest"];
-            };
-        };
+        requestBody?: never;
         responses: {
             /** @description OK */
             200: {
@@ -5763,14 +5671,14 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["BulkRunResult"];
+                    "application/json": components["schemas"]["ActionLogListResponse"];
                 };
             };
-            400: components["responses"]["BadRequest"];
             401: components["responses"]["Unauthorized"];
+            404: components["responses"]["NotFound"];
         };
     };
-    getRun: {
+    listRunJobs: {
         parameters: {
             query?: never;
             header?: never;
@@ -5790,95 +5698,41 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["WorkflowRunDetail"];
+                    "application/json": components["schemas"]["JobListResponse"];
                 };
             };
             401: components["responses"]["Unauthorized"];
             404: components["responses"]["NotFound"];
         };
     };
-    getRunActionLog: {
+    streamProjectRunEvents: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Durable event seq cursor to replay from. */
+                since?: number;
+            };
             header?: never;
             path: {
                 /** @description Project handle (unique per organization) */
                 project: components["parameters"]["ProjectHandleParam"];
-                /** @description Resource ID. */
-                id: components["parameters"]["IDParam"];
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description OK */
+            /** @description OK (text/event-stream) */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["ActionLogListResponse"];
+                    "text/event-stream": string;
                 };
             };
             401: components["responses"]["Unauthorized"];
-            404: components["responses"]["NotFound"];
         };
     };
-    getRunJobs: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                /** @description Project handle (unique per organization) */
-                project: components["parameters"]["ProjectHandleParam"];
-                /** @description Resource ID. */
-                id: components["parameters"]["IDParam"];
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description OK */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["JobListResponse"];
-                };
-            };
-            401: components["responses"]["Unauthorized"];
-            404: components["responses"]["NotFound"];
-        };
-    };
-    streamProjectRunEvents: {
-        parameters: {
-            query?: {
-                /** @description Durable event seq cursor to replay from. */
-                since?: number;
-            };
-            header?: never;
-            path: {
-                /** @description Project handle (unique per organization) */
-                project: components["parameters"]["ProjectHandleParam"];
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description OK (text/event-stream) */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "text/event-stream": string;
-                };
-            };
-            401: components["responses"]["Unauthorized"];
-        };
-    };
-    cancelRun: {
+    cancelRun: {
         parameters: {
             query?: never;
             header?: never;
@@ -6626,13 +6480,15 @@ export interface operations {
             404: components["responses"]["NotFound"];
         };
     };
-    listWorkers: {
+    listTriggerTargets: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 /** @description Project handle (unique per organization) */
                 project: components["parameters"]["ProjectHandleParam"];
+                /** @description Resource ID. */
+                id: components["parameters"]["IDParam"];
             };
             cookie?: never;
         };
@@ -6644,47 +6500,28 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["WorkerListResponse"];
+                    "application/json": components["schemas"]["TriggerTargetListResponse"];
                 };
             };
             401: components["responses"]["Unauthorized"];
             404: components["responses"]["NotFound"];
         };
     };
-    listProjects: {
-        parameters: {
-            query?: {
-                /** @description Prefix-match filter applied to project name and handle. */
-                search?: string;
-            };
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description OK */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ProjectListResponse"];
-                };
-            };
-            401: components["responses"]["Unauthorized"];
-        };
-    };
-    createProject: {
+    createTriggerTarget: {
         parameters: {
             query?: never;
             header?: never;
-            path?: never;
+            path: {
+                /** @description Project handle (unique per organization) */
+                project: components["parameters"]["ProjectHandleParam"];
+                /** @description Resource ID. */
+                id: components["parameters"]["IDParam"];
+            };
             cookie?: never;
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["CreateProjectRequest"];
+                "application/json": components["schemas"]["CreateTriggerTargetRequest"];
             };
         };
         responses: {
@@ -6694,44 +6531,21 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["Project"];
+                    "application/json": components["schemas"]["TriggerTarget"];
                 };
             };
             400: components["responses"]["BadRequest"];
             401: components["responses"]["Unauthorized"];
-            409: components["responses"]["Conflict"];
-        };
-    };
-    getProject: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                /** @description Resource ID. */
-                id: components["parameters"]["IDParam"];
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description OK */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["Project"];
-                };
-            };
-            401: components["responses"]["Unauthorized"];
             404: components["responses"]["NotFound"];
         };
     };
-    deleteProject: {
+    deleteAllTriggerTargets: {
         parameters: {
             query?: never;
             header?: never;
             path: {
+                /** @description Project handle (unique per organization) */
+                project: components["parameters"]["ProjectHandleParam"];
                 /** @description Resource ID. */
                 id: components["parameters"]["IDParam"];
             };
@@ -6750,21 +6564,21 @@ export interface operations {
             404: components["responses"]["NotFound"];
         };
     };
-    updateProject: {
+    getTriggerTarget: {
         parameters: {
             query?: never;
             header?: never;
             path: {
+                /** @description Project handle (unique per organization) */
+                project: components["parameters"]["ProjectHandleParam"];
                 /** @description Resource ID. */
                 id: components["parameters"]["IDParam"];
+                /** @description Trigger target ID. */
+                target_id: components["parameters"]["TriggerTargetIDParam"];
             };
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["UpdateProjectRequest"];
-            };
-        };
+        requestBody?: never;
         responses: {
             /** @description OK */
             200: {
@@ -6772,86 +6586,81 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["Project"];
+                    "application/json": components["schemas"]["TriggerTarget"];
                 };
             };
-            400: components["responses"]["BadRequest"];
             401: components["responses"]["Unauthorized"];
             404: components["responses"]["NotFound"];
         };
     };
-    listWebhooks: {
+    deleteTriggerTarget: {
         parameters: {
-            query?: {
-                /** @description Filter by enabled/disabled state. */
-                enabled?: boolean;
-                /** @description Opaque pagination cursor returned from the previous response. */
-                cursor?: string;
-                /** @description Maximum number of results to return per page. */
-                limit?: number;
-            };
+            query?: never;
             header?: never;
             path: {
                 /** @description Project handle (unique per organization) */
                 project: components["parameters"]["ProjectHandleParam"];
+                /** @description Resource ID. */
+                id: components["parameters"]["IDParam"];
+                /** @description Trigger target ID. */
+                target_id: components["parameters"]["TriggerTargetIDParam"];
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description OK */
-            200: {
+            /** @description No Content */
+            204: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content: {
-                    "application/json": components["schemas"]["WebhookListResponse"];
-                };
+                content?: never;
             };
             401: components["responses"]["Unauthorized"];
             404: components["responses"]["NotFound"];
         };
     };
-    createWebhook: {
+    updateTriggerTarget: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 /** @description Project handle (unique per organization) */
                 project: components["parameters"]["ProjectHandleParam"];
+                /** @description Resource ID. */
+                id: components["parameters"]["IDParam"];
+                /** @description Trigger target ID. */
+                target_id: components["parameters"]["TriggerTargetIDParam"];
             };
             cookie?: never;
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["CreateWebhookRequest"];
+                "application/json": components["schemas"]["UpdateTriggerTargetRequest"];
             };
         };
         responses: {
-            /** @description Created */
-            201: {
+            /** @description OK */
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["Webhook"];
+                    "application/json": components["schemas"]["TriggerTarget"];
                 };
             };
             400: components["responses"]["BadRequest"];
             401: components["responses"]["Unauthorized"];
             404: components["responses"]["NotFound"];
-            409: components["responses"]["Conflict"];
         };
     };
-    getWebhook: {
+    listWorkerSessions: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 /** @description Project handle (unique per organization) */
                 project: components["parameters"]["ProjectHandleParam"];
-                /** @description Resource ID. */
-                id: components["parameters"]["IDParam"];
             };
             cookie?: never;
         };
@@ -6863,82 +6672,69 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["Webhook"];
+                    "application/json": components["schemas"]["WorkerSessionListResponse"];
                 };
             };
             401: components["responses"]["Unauthorized"];
             404: components["responses"]["NotFound"];
         };
     };
-    deleteWebhook: {
+    listProjects: {
         parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                /** @description Project handle (unique per organization) */
-                project: components["parameters"]["ProjectHandleParam"];
-                /** @description Resource ID. */
-                id: components["parameters"]["IDParam"];
+            query?: {
+                /** @description Prefix-match filter applied to project name and handle. */
+                search?: string;
             };
+            header?: never;
+            path?: never;
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description No Content */
-            204: {
+            /** @description OK */
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ProjectListResponse"];
+                };
             };
             401: components["responses"]["Unauthorized"];
-            404: components["responses"]["NotFound"];
         };
     };
-    updateWebhook: {
+    createProject: {
         parameters: {
             query?: never;
             header?: never;
-            path: {
-                /** @description Project handle (unique per organization) */
-                project: components["parameters"]["ProjectHandleParam"];
-                /** @description Resource ID. */
-                id: components["parameters"]["IDParam"];
-            };
+            path?: never;
             cookie?: never;
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["UpdateWebhookRequest"];
+                "application/json": components["schemas"]["CreateProjectRequest"];
             };
         };
         responses: {
-            /** @description OK */
-            200: {
+            /** @description Created */
+            201: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["Webhook"];
+                    "application/json": components["schemas"]["Project"];
                 };
             };
             400: components["responses"]["BadRequest"];
             401: components["responses"]["Unauthorized"];
-            404: components["responses"]["NotFound"];
+            409: components["responses"]["Conflict"];
         };
     };
-    listWebhookDeliveries: {
+    getProject: {
         parameters: {
-            query?: {
-                /** @description Opaque pagination cursor returned from the previous response. */
-                cursor?: string;
-                /** @description Maximum number of results to return per page. */
-                limit?: number;
-            };
+            query?: never;
             header?: never;
             path: {
-                /** @description Project handle (unique per organization) */
-                project: components["parameters"]["ProjectHandleParam"];
                 /** @description Resource ID. */
                 id: components["parameters"]["IDParam"];
             };
@@ -6952,82 +6748,76 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["WebhookDeliveryListResponse"];
+                    "application/json": components["schemas"]["Project"];
                 };
             };
             401: components["responses"]["Unauthorized"];
             404: components["responses"]["NotFound"];
         };
     };
-    listIntegrations: {
+    deleteProject: {
         parameters: {
-            query?: {
-                /** @description Filter by provider string (exact match). */
-                provider?: string;
-                /** @description Filter by integration status. */
-                status?: components["schemas"]["IntegrationStatus"];
-                /** @description Opaque pagination cursor returned from the previous response. */
-                cursor?: string;
-                /** @description Maximum number of results to return per page. */
-                limit?: number;
-            };
+            query?: never;
             header?: never;
             path: {
-                /** @description Project handle (unique per organization) */
-                project: components["parameters"]["ProjectHandleParam"];
+                /** @description Resource ID. */
+                id: components["parameters"]["IDParam"];
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description OK */
-            200: {
+            /** @description No Content */
+            204: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content: {
-                    "application/json": components["schemas"]["IntegrationListResponse"];
-                };
+                content?: never;
             };
             401: components["responses"]["Unauthorized"];
+            404: components["responses"]["NotFound"];
         };
     };
-    createIntegration: {
+    updateProject: {
         parameters: {
             query?: never;
             header?: never;
             path: {
-                /** @description Project handle (unique per organization) */
-                project: components["parameters"]["ProjectHandleParam"];
+                /** @description Resource ID. */
+                id: components["parameters"]["IDParam"];
             };
             cookie?: never;
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["CreateIntegrationRequest"];
+                "application/json": components["schemas"]["UpdateProjectRequest"];
             };
         };
         responses: {
-            /** @description Created */
-            201: {
+            /** @description OK */
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["Integration"];
+                    "application/json": components["schemas"]["Project"];
                 };
             };
             400: components["responses"]["BadRequest"];
             401: components["responses"]["Unauthorized"];
+            404: components["responses"]["NotFound"];
         };
     };
-    getIntegration: {
+    listProjectMembers: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Cursor for pagination (opaque string from previous response) */
+                cursor?: components["parameters"]["CursorParam"];
+                /** @description Maximum number of items to return */
+                limit?: components["parameters"]["LimitParam"];
+            };
             header?: never;
             path: {
-                /** @description Project handle (unique per organization) */
-                project: components["parameters"]["ProjectHandleParam"];
                 /** @description Resource ID. */
                 id: components["parameters"]["IDParam"];
             };
@@ -7041,20 +6831,19 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["Integration"];
+                    "application/json": components["schemas"]["ProjectMemberListResponse"];
                 };
             };
             401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
         };
     };
-    updateIntegration: {
+    addProjectMember: {
         parameters: {
             query?: never;
             header?: never;
             path: {
-                /** @description Project handle (unique per organization) */
-                project: components["parameters"]["ProjectHandleParam"];
                 /** @description Resource ID. */
                 id: components["parameters"]["IDParam"];
             };
@@ -7062,114 +6851,76 @@ export interface operations {
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["UpdateIntegrationRequest"];
+                "application/json": components["schemas"]["AddProjectMemberRequest"];
             };
         };
         responses: {
-            /** @description OK */
+            /** @description OK — member already existed */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["Integration"];
+                    "application/json": components["schemas"]["ProjectMember"];
                 };
             };
-            400: components["responses"]["BadRequest"];
-            401: components["responses"]["Unauthorized"];
-            404: components["responses"]["NotFound"];
-        };
-    };
-    deleteIntegration: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                /** @description Project handle (unique per organization) */
-                project: components["parameters"]["ProjectHandleParam"];
-                /** @description Resource ID. */
-                id: components["parameters"]["IDParam"];
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description No Content */
-            204: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
-            401: components["responses"]["Unauthorized"];
-            404: components["responses"]["NotFound"];
-        };
-    };
-    copyIntegration: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                /** @description Project handle (unique per organization) */
-                project: components["parameters"]["ProjectHandleParam"];
-            };
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["CopyIntegrationRequest"];
-            };
-        };
-        responses: {
             /** @description Created */
             201: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["Integration"];
+                    "application/json": components["schemas"]["ProjectMember"];
                 };
             };
             400: components["responses"]["BadRequest"];
             401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
         };
     };
-    getProjectMetrics: {
+    removeProjectMember: {
         parameters: {
             query?: never;
             header?: never;
             path: {
-                /** @description Project handle (unique per organization) */
-                project: components["parameters"]["ProjectHandleParam"];
+                /** @description Resource ID. */
+                id: components["parameters"]["IDParam"];
+                /** @description User ID of the member to remove. */
+                uid: string;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description OK */
-            200: {
+            /** @description No Content */
+            204: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content: {
-                    "application/json": components["schemas"]["ProjectMetrics"];
-                };
+                content?: never;
             };
+            400: components["responses"]["BadRequest"];
             401: components["responses"]["Unauthorized"];
+            403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
         };
     };
-    listRoles: {
+    listWebhooks: {
         parameters: {
             query?: {
+                /** @description Filter by enabled/disabled state. */
+                enabled?: boolean;
+                /** @description Opaque pagination cursor returned from the previous response. */
+                cursor?: string;
                 /** @description Maximum number of results to return per page. */
                 limit?: number;
-                /** @description Filter to roles scoped to a specific project. */
-                project_id?: string;
             };
             header?: never;
-            path?: never;
+            path: {
+                /** @description Project handle (unique per organization) */
+                project: components["parameters"]["ProjectHandleParam"];
+            };
             cookie?: never;
         };
         requestBody?: never;
@@ -7180,23 +6931,26 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["RoleListResponse"];
+                    "application/json": components["schemas"]["WebhookListResponse"];
                 };
             };
             401: components["responses"]["Unauthorized"];
-            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
         };
     };
-    createRole: {
+    createWebhook: {
         parameters: {
             query?: never;
             header?: never;
-            path?: never;
+            path: {
+                /** @description Project handle (unique per organization) */
+                project: components["parameters"]["ProjectHandleParam"];
+            };
             cookie?: never;
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["CreateRoleRequest"];
+                "application/json": components["schemas"]["CreateWebhookRequest"];
             };
         };
         responses: {
@@ -7206,23 +6960,22 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["Role"];
+                    "application/json": components["schemas"]["Webhook"];
                 };
             };
             400: components["responses"]["BadRequest"];
             401: components["responses"]["Unauthorized"];
-            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
             409: components["responses"]["Conflict"];
         };
     };
-    getRole: {
+    getWebhook: {
         parameters: {
-            query?: {
-                /** @description Provide to resolve a project-scoped role. */
-                project_id?: string;
-            };
+            query?: never;
             header?: never;
             path: {
+                /** @description Project handle (unique per organization) */
+                project: components["parameters"]["ProjectHandleParam"];
                 /** @description Resource ID. */
                 id: components["parameters"]["IDParam"];
             };
@@ -7236,22 +6989,20 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["Role"];
+                    "application/json": components["schemas"]["Webhook"];
                 };
             };
             401: components["responses"]["Unauthorized"];
-            403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
         };
     };
-    deleteRole: {
+    deleteWebhook: {
         parameters: {
-            query?: {
-                /** @description Scope to change this role to. Cannot change an org-scoped role to project-scoped after creation. */
-                project_id?: string;
-            };
+            query?: never;
             header?: never;
             path: {
+                /** @description Project handle (unique per organization) */
+                project: components["parameters"]["ProjectHandleParam"];
                 /** @description Resource ID. */
                 id: components["parameters"]["IDParam"];
             };
@@ -7267,18 +7018,16 @@ export interface operations {
                 content?: never;
             };
             401: components["responses"]["Unauthorized"];
-            403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
         };
     };
-    updateRole: {
+    updateWebhook: {
         parameters: {
-            query?: {
-                /** @description Scope to change this role to. Cannot change an org-scoped role to project-scoped after creation. */
-                project_id?: string;
-            };
+            query?: never;
             header?: never;
             path: {
+                /** @description Project handle (unique per organization) */
+                project: components["parameters"]["ProjectHandleParam"];
                 /** @description Resource ID. */
                 id: components["parameters"]["IDParam"];
             };
@@ -7286,7 +7035,7 @@ export interface operations {
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["UpdateRoleRequest"];
+                "application/json": components["schemas"]["UpdateWebhookRequest"];
             };
         };
         responses: {
@@ -7296,33 +7045,31 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["Role"];
+                    "application/json": components["schemas"]["Webhook"];
                 };
             };
             400: components["responses"]["BadRequest"];
             401: components["responses"]["Unauthorized"];
-            403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
-            409: components["responses"]["Conflict"];
         };
     };
-    listRoleAssignments: {
+    pingWebhook: {
         parameters: {
-            query?: {
-                /** @description Filter by the type of actor receiving the assignment. */
-                actor_type?: "user" | "service_account";
-                /** @description Filter to assignments for a specific actor. */
-                actor_id?: string;
-                /** @description Filter to assignments for a specific role. */
-                role_id?: string;
-                /** @description Filter to project-scoped assignments for this project. */
-                project_id?: string;
-            };
+            query?: never;
             header?: never;
-            path?: never;
+            path: {
+                /** @description Project handle (unique per organization) */
+                project: components["parameters"]["ProjectHandleParam"];
+                /** @description Resource ID. */
+                id: components["parameters"]["IDParam"];
+            };
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody?: {
+            content: {
+                "application/json": components["schemas"]["PingWebhookRequest"];
+            };
+        };
         responses: {
             /** @description OK */
             200: {
@@ -7330,63 +7077,68 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["RoleAssignmentListResponse"];
+                    "application/json": components["schemas"]["PingWebhookResult"];
                 };
             };
+            400: components["responses"]["BadRequest"];
             401: components["responses"]["Unauthorized"];
-            403: components["responses"]["Forbidden"];
+            404: components["responses"]["NotFound"];
         };
     };
-    createRoleAssignment: {
+    listWebhookDeliveries: {
         parameters: {
-            query?: never;
+            query?: {
+                /** @description Opaque pagination cursor returned from the previous response. */
+                cursor?: string;
+                /** @description Maximum number of results to return per page. */
+                limit?: number;
+            };
             header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["CreateRoleAssignmentRequest"];
+            path: {
+                /** @description Project handle (unique per organization) */
+                project: components["parameters"]["ProjectHandleParam"];
+                /** @description Resource ID. */
+                id: components["parameters"]["IDParam"];
             };
+            cookie?: never;
         };
+        requestBody?: never;
         responses: {
-            /** @description Created */
-            201: {
+            /** @description OK */
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["RoleAssignment"];
+                    "application/json": components["schemas"]["WebhookDeliveryListResponse"];
                 };
             };
-            400: components["responses"]["BadRequest"];
             401: components["responses"]["Unauthorized"];
-            403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
-            409: components["responses"]["Conflict"];
         };
     };
-    deleteRoleAssignment: {
+    getProjectMetrics: {
         parameters: {
             query?: never;
             header?: never;
             path: {
-                /** @description Resource ID. */
-                id: components["parameters"]["IDParam"];
+                /** @description Project handle (unique per organization) */
+                project: components["parameters"]["ProjectHandleParam"];
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description No Content */
-            204: {
+            /** @description OK */
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": components["schemas"]["ProjectMetrics"];
+                };
             };
             401: components["responses"]["Unauthorized"];
-            403: components["responses"]["Forbidden"];
             404: components["responses"]["NotFound"];
         };
     };
@@ -7982,6 +7734,7 @@ export interface operations {
             400: components["responses"]["BadRequest"];
             401: components["responses"]["Unauthorized"];
             404: components["responses"]["NotFound"];
+            409: components["responses"]["Conflict"];
         };
     };
     listAgentSessions: {
@@ -8057,6 +7810,8 @@ export interface operations {
             path: {
                 /** @description Project handle (unique per organization) */
                 project: components["parameters"]["ProjectHandleParam"];
+                /** @description Resource ID. */
+                id: components["parameters"]["IDParam"];
                 /** @description ID of the agent session. */
                 sessionId: string;
             };
@@ -8084,6 +7839,8 @@ export interface operations {
             path: {
                 /** @description Project handle (unique per organization) */
                 project: components["parameters"]["ProjectHandleParam"];
+                /** @description Resource ID. */
+                id: components["parameters"]["IDParam"];
                 /** @description ID of the agent session. */
                 sessionId: string;
             };
@@ -8111,6 +7868,8 @@ export interface operations {
             path: {
                 /** @description Project handle (unique per organization) */
                 project: components["parameters"]["ProjectHandleParam"];
+                /** @description Resource ID. */
+                id: components["parameters"]["IDParam"];
                 /** @description ID of the agent session. */
                 sessionId: string;
             };