@deepnoodle/mobius 0.0.7 → 0.0.9

package/dist/api/schema.d.ts

@@ -156,7 +156,7 @@ export interface paths {
         };
         /**
          * List audit log entries
-         * @description Returns an immutable, append-only log of create/update/delete actions performed against org resources. Entries record both the durable actor identity (service account or user) and the credential used, enabling attribution even when keys are later revoked.
+         * @description Returns an immutable, append-only log of create/update/delete/archive/restore actions performed against org resources. Entries record both the durable actor identity (service account or user) and the credential used, enabling attribution even when keys are later revoked.
          *
          *     Combine `actor_id` + `resource_type` to audit a specific identity's writes to a resource class. Use `created_after` / `created_before` for time-bounded compliance exports.
          */
@@ -384,9 +384,28 @@ export interface paths {
         };
         /**
          * Subscribe to a project-wide stream of run events (SSE)
-         * @description Opens a Server-Sent Events connection. Each frame carries a JSON envelope `{type, run_id, seq, timestamp, data}` where `type` is one of `run_updated`, `job_updated`, or `action_appended`, and `seq` is a monotonic durable cursor.
+         * @description Opens a Server-Sent Events connection. Each frame carries a JSON envelope `{type, run_id, seq, timestamp, data}` where `seq` is a monotonic durable cursor and `type` is one of:
+         *
+         *     - `run_updated` — the run row's status, heartbeat, or
+         *     timestamps changed; `data` is a full WorkflowRun.
+         *     - `job_updated` — a single job's status or attempt
+         *     advanced; `data` is a full Job.
+         *     - `action_appended` — one entry was appended to the run
+         *     timeline (worker job completed or platform action ran);
+         *     `data` is a WorkflowActionLog row.
+         *     - `interaction_created` / `interaction_completed` /
+         *     `interaction_group_claimed` /
+         *     `interaction_group_released` — interaction lifecycle;
+         *     `data` is a full Interaction.
+         *     - `custom` — a worker emitted a domain-specific event via
+         *     `POST /v1/projects/{project}/jobs/{id}/events`. `data`
+         *     carries `{kind: "custom", type, job_id, data}` where
+         *     `type` is the worker-supplied name and inner `data` is
+         *     the worker payload.
          *
          *     Pass `?since=<seq>` on reconnect to replay any durable events the server has recorded past that cursor before switching back to live updates; clients should record the largest `seq` they have observed. Comment frames (`:keepalive`) are emitted every ~15s to keep intermediaries from closing the connection.
+         *
+         *     Unknown future event types may appear; clients should ignore types they don't recognize rather than treat the stream as malformed.
          */
         get: operations["streamProjectRunEvents"];
         put?: never;
@@ -408,7 +427,7 @@ export interface paths {
         put?: never;
         /**
          * Request cancellation of an in-flight run
-         * @description Sets the cancel_requested flag on the run. The next heartbeat response includes `directives.should_cancel: true`, and the worker is expected to drop the run cooperatively.
+         * @description Records `cancel_requested_at`, terminalizes the run as failed with `error_type=run_cancelled`, and closes any non-terminal jobs created by the run. During migration, `cancel_requested` remains populated as an audit/compatibility field.
          */
         post: operations["cancelRun"];
         delete?: never;
@@ -427,8 +446,8 @@ export interface paths {
         get?: never;
         put?: never;
         /**
-         * Resume a suspended run
-         * @description Transitions the run from `suspended` back to `queued` so the next worker poll picks it up.
+         * Resume waiting run paths
+         * @description Re-enters any resumable waiting paths, such as paused paths or due timer waits.
          */
         post: operations["resumeRun"];
         delete?: never;
@@ -447,8 +466,8 @@ export interface paths {
         get?: never;
         put?: never;
         /**
-         * Deliver a signal to a suspended run
-         * @description Durably enqueues a signal keyed by (run_id, name). If the run is currently suspended waiting on that topic it is flipped back to queued so the next poll picks it up. Otherwise the signal sits in the store until a future suspended branch receives it.
+         * Deliver a run-scoped signal
+         * @description Durably enqueues a signal keyed by (run_id, name). If any path in the run is waiting on that topic, the server re-enters that path so it can consume the signal. Otherwise the signal remains in the store until a future path waits for it.
          */
         post: operations["sendRunSignal"];
         delete?: never;
@@ -466,7 +485,7 @@ export interface paths {
         };
         /**
          * Subscribe to a stream of events for a single run (SSE)
-         * @description Same envelope as `/v1/projects/{project}/runs/events` but filtered to a single run. The server writes one seed `run_updated` frame on connection so reconnects do not miss the latest state, and supports `?since=<seq>` replay for durable events recorded since the given seq cursor.
+         * @description Same envelope and event-type set as `/v1/projects/{project}/runs/events` (see that endpoint for the full vocabulary of `type` values), filtered to a single run. The server writes one seed `run_updated` frame on connection so reconnects do not miss the latest state, and supports `?since=<seq>` replay for durable events recorded since the given seq cursor.
          */
         get: operations["streamRunEvents"];
         put?: never;
@@ -714,7 +733,7 @@ export interface paths {
          * Emit one or more custom events from a claimed workflow job
          * @description Publishes a batch of custom run events on behalf of the worker holding the job's current lease. Events are appended to the durable run event store (so they replay via `?since=<seq>`) and fanned out to any live SSE subscribers on the run.
          *
-         *     Authorization requires `mobius.job.emit_event`. Each event must present the active lease fence (`worker_id` + `attempt`); stale fences are rejected with 409.
+         *     Authorization requires `mobius.work.execute`. Each event must present the active lease fence (`worker_id` + `attempt`); stale fences are rejected with 409.
          *
          *     `type` is a caller-chosen identifier. The `mobius.` prefix is reserved for future server-emitted well-known kinds and is rejected with 400.
          *
@@ -924,7 +943,7 @@ export interface paths {
         };
         /**
          * List projects
-         * @description Returns up to 100 projects. Use `search` for prefix-match filtering by name or handle.
+         * @description Returns up to 100 projects. Use `search` for prefix-match filtering by name or handle. By default returns active (non-archived) projects; pass `status=archived` to see archived projects, or `status=all` to see both.
          */
         get: operations["listProjects"];
         put?: never;
@@ -948,7 +967,7 @@ export interface paths {
         };
         /**
          * Get a project
-         * @description Requires the `project.read` permission for the project.
+         * @description Requires the `mobius.project.view` permission for the project.
          */
         get: operations["getProject"];
         put?: never;
@@ -956,6 +975,8 @@ export interface paths {
         /**
          * Delete a project
          * @description Permanently deletes the project and all child resources (workflows, runs, jobs, triggers, webhooks, groups, interactions, actions, agents, service accounts). This operation is irreversible.
+         *
+         *     The project must be archived first; calling delete on an active project returns `409 project_not_archived`. Archive via `POST /v1/projects/{id}/archive`.
          */
         delete: operations["deleteProject"];
         options?: never;
@@ -967,6 +988,46 @@ export interface paths {
         patch: operations["updateProject"];
         trace?: never;
     };
+    "/v1/projects/{id}/archive": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Archive a project
+         * @description Soft-retires the project: triggers and scheduled runs stop firing, edits are blocked, and the project is hidden from the default listing. In-flight runs are allowed to drain. The project can be restored at any time. Idempotent — archiving an already-archived project returns the current state.
+         */
+        post: operations["archiveProject"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/projects/{id}/restore": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Restore an archived project
+         * @description Clears the archived state and returns the project to active operation. Triggers and scheduled runs resume on their next natural fire — there is no catch-up backfill of missed fires during the archive window. Idempotent — restoring an active project returns the current state.
+         */
+        post: operations["restoreProject"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/projects/{id}/config": {
         parameters: {
             query?: never;
@@ -1168,7 +1229,7 @@ export interface paths {
         put?: never;
         /**
          * Create an interaction
-         * @description Creates a standalone or run-backed interaction. When `run_id` is provided, `signal_name` is also required and completing the interaction automatically delivers a signal that resumes the suspended run. Omit both for a standalone interaction that completes with no workflow side effect. Workers creating interactions from within a job should use the job-scoped route (`POST /v1/projects/{project}/jobs/{id}/interactions`) instead, which derives the run and signal name automatically.
+         * @description Creates a standalone or run-backed interaction. When `run_id` is provided, `signal_name` is also required and completing the interaction automatically delivers a signal that resumes the waiting run path. Omit both for a standalone interaction that completes with no workflow side effect. Workers creating interactions from within a job should use the job-scoped route (`POST /v1/projects/{project}/jobs/{id}/interactions`) instead, which derives the run and signal name automatically.
          */
         post: operations["createInteraction"];
         delete?: never;
@@ -1390,7 +1451,7 @@ export interface paths {
          * Create an agent
          * @description Creates an agent bound to a service account. A service account can back multiple agents. The service account can be changed after creation via the PATCH endpoint.
          *
-         *     If `service_account_id` is omitted, a new service account is auto-created with the same name as the agent and assigned to back it. Auto-creation requires the caller to hold `mobius.service_account.manage` in addition to `mobius.agent.manage`. Auto-creation fails if a service account with that name already exists in the project; to bind an existing service account to a new agent, pass `service_account_id` explicitly.
+         *     If `service_account_id` is omitted, a new service account is auto-created with the same name as the agent and assigned to back it. Auto-creation requires the caller to hold `mobius.access.manage`. Auto-creation fails if a service account with that name already exists in the project; to bind an existing service account to a new agent, pass `service_account_id` explicitly.
          */
         post: operations["createAgent"];
         delete?: never;
@@ -1542,7 +1603,7 @@ export interface paths {
         put?: never;
         /**
          * Invoke a workflow tool
-         * @description Starts a workflow run for the named tool (workflow handle) and waits for it to complete up to `timeout_seconds` (default 30s, max 120s). Returns the run output directly when the workflow completes within the timeout. On timeout the response includes the run ID and `status: pending` so the caller can switch to polling via `GET /v1/projects/{project}/tools/{handle}/runs/{run_id}`.
+         * @description Starts a workflow run for the named tool (workflow handle) and waits for it to complete up to `timeout_seconds` (default 30s, max 120s). Returns the run output directly when the workflow completes within the timeout. On timeout the response includes the run ID and `status: active` so the caller can switch to polling via `GET /v1/projects/{project}/tools/{handle}/runs/{run_id}`.
          */
         post: operations["runTool"];
         delete?: never;
@@ -1585,17 +1646,23 @@ export interface components {
                 message: string;
             };
         };
-        /** @description Health-check response for load balancers and uptime probes. */
-        HealthResponse: {
-            /** @description Current server status. `ok` when all dependencies are reachable. */
-            status: string;
-        };
         /** @description Project ID. */
         ProjectID: string;
         /** @description Free-form JSON object for caller-defined metadata. */
         Metadata: {
             [key: string]: unknown;
         };
+        /**
+         * @description Key/value tag map. Keys 1–128 chars, values 0–256 chars. Keys with the `mobius:` prefix are system-managed and cannot be set by callers. Maximum 8 tags per resource. Use tags to organize resources by environment, team, cost-center, or any other dimension meaningful to your organization; tags can be filtered on most list endpoints.
+         * @example {
+         *       "Environment": "Production",
+         *       "Department": "Finance",
+         *       "Owner": "team@example.com"
+         *     }
+         */
+        TagMap: {
+            [key: string]: string;
+        };
         /**
          * @description Declarative UI/input primitive for collecting the response. This is a portable rendering contract, not executable code. Values are `confirm`, `select`, `multi_select`, and `input`.
          * @enum {string}
@@ -1664,6 +1731,8 @@ export interface components {
              * @description Set when the channel is archived. Archived channels are hidden in the UI but their message history remains accessible.
              */
             archived_at?: string | null;
+            /** @description Resource tags applied to this channel. */
+            tags?: components["schemas"]["TagMap"];
             /**
              * Format: date-time
              * @description Timestamp when this channel was created.
@@ -1787,6 +1856,8 @@ export interface components {
             private: boolean;
             /** @description Optional list of user or agent IDs to add as members at creation time. All receive the `member` role; the creator is added as `admin` separately. */
             member_ids?: string[];
+            /** @description Initial tag set. */
+            tags?: components["schemas"]["TagMap"];
         };
         /** @description Mutable channel fields. */
         UpdateChannelRequest: {
@@ -1796,6 +1867,8 @@ export interface components {
             topic?: string;
             /** @description Toggle invite-only visibility. */
             private?: boolean;
+            /** @description When supplied, replaces the user tag set on the channel. System tags (`mobius:*`) are preserved. */
+            tags?: components["schemas"]["TagMap"];
         };
         /** @description Member identity and role to add to a channel. */
         AddChannelMemberRequest: {
@@ -1858,10 +1931,10 @@ export interface components {
             /** @description Credential ID used for the request, when applicable */
             credential_id?: string;
             /**
-             * @description Type of action performed: `create`, `update`, or `delete`.
+             * @description Type of action performed: `create`, `update`, `delete`, `archive`, or `restore`.
              * @enum {string}
              */
-            action: "create" | "update" | "delete";
+            action: "create" | "update" | "delete" | "archive" | "restore";
             /** @description Type of resource affected (e.g., job, channel, document) */
             resource_type: string;
             /** @description ID of the affected resource */
@@ -1890,207 +1963,6 @@ export interface components {
             /** @description Whether more results are available */
             has_more: boolean;
         };
-        /** @description Set for project-pinned keys; omitted for org-scoped keys. */
-        APIKeyProjectID: components["schemas"]["ProjectID"];
-        /** @description Stored API credential metadata for automation and service access. The raw secret is never returned here; use this object to list, audit, expire, or identify keys by prefix without exposing tokens. */
-        APIKey: {
-            /** @description Unique identifier for this API key. */
-            id: string;
-            /** @description Human-readable label, unique within the org (or org+project for project-pinned keys). */
-            name: string;
-            /** @description First 8 characters of the key, used to identify it without exposing the secret. */
-            key_prefix: string;
-            /**
-             * @description `org` is the standard API key scope; `system` is reserved for platform-level access. Project-pinned versus org-level behavior is determined by `project_id`.
-             * @enum {string}
-             */
-            scope: "org" | "system";
-            /** @description Explicit permission set granted to this key (e.g. "mobius.job.claim"). */
-            permissions?: string[];
-            /** @description Project this key is pinned to; null or omitted for org-scoped and system keys. */
-            project_id?: components["schemas"]["APIKeyProjectID"];
-            /** @description Optional service account for attribution and quota tracking. */
-            service_account_id?: string;
-            /**
-             * Format: date-time
-             * @description Hard expiry timestamp. Requests using an expired key receive 401.
-             */
-            expires_at?: string;
-            /**
-             * Format: date-time
-             * @description Timestamp of the most recent authenticated request using this key.
-             */
-            last_used_at?: string;
-            /**
-             * Format: date-time
-             * @description Timestamp when this key was created.
-             */
-            created_at: string;
-            /**
-             * Format: date-time
-             * @description Timestamp when this key was last updated.
-             */
-            updated_at: string;
-        };
-        /** @description Returned only on key creation. Contains the raw `key` value which is not retrievable after this response. */
-        APIKeyCreateResult: {
-            /** @description Unique identifier for the created API key. */
-            id: string;
-            /** @description Human-readable name for the key. */
-            name: string;
-            /** @description First 8 characters of the key for identification. */
-            key_prefix: string;
-            /**
-             * @description Scope of the key. `org` is the standard API key scope, and `system` is reserved for platform-only keys. Project-pinned versus org-level behavior is determined by `project_id`.
-             * @enum {string}
-             */
-            scope: "org" | "system";
-            /** @description List of permissions granted to this key. */
-            permissions?: string[];
-            /** @description Project this key is pinned to; null or omitted for org-scoped and system keys. */
-            project_id?: components["schemas"]["APIKeyProjectID"];
-            /** @description ID of the service account this key belongs to. */
-            service_account_id?: string;
-            /**
-             * Format: date-time
-             * @description Timestamp when this key expires. Null if it does not expire.
-             */
-            expires_at?: string;
-            /**
-             * Format: date-time
-             * @description Timestamp of the most recent authenticated request using this key.
-             */
-            last_used_at?: string;
-            /**
-             * Format: date-time
-             * @description Timestamp when this key was created.
-             */
-            created_at: string;
-            /**
-             * Format: date-time
-             * @description Timestamp when this key was last updated.
-             */
-            updated_at: string;
-            /** @description The raw API key. Returned only once at creation — store it securely immediately. */
-            key: string;
-        };
-        APIKeyListResponse: {
-            /** @description The list of results for this page. */
-            items: components["schemas"]["APIKey"][];
-        };
-        /** @description Request shape for creating either a project-pinned key or an org-level key. Choose the project-pinned variant when automation should be unable to cross project boundaries. */
-        CreateAPIKeyRequest: components["schemas"]["CreateProjectPinnedAPIKeyRequest"] | components["schemas"]["CreateOrgOrSystemAPIKeyRequest"];
-        CreateProjectPinnedAPIKeyRequest: {
-            /** @description Human-readable label, unique within the org (or project for project-pinned keys). */
-            name: string;
-            /** @description Set `project_id` to pin this key to exactly one project. When `project_id` is omitted, the request creates an org-level key instead. */
-            project_id: components["schemas"]["ProjectID"];
-            /**
-             * @description Standard API key scope for project-pinned keys; value is always `org`.
-             * @default org
-             * @enum {string}
-             */
-            scope: "org";
-            /** @description Permissions to grant. Each permission must be held by the creating caller — you cannot grant more than you have. */
-            permissions?: string[];
-            /** @description Associate this key with a service account for attribution. */
-            service_account_id?: string;
-            /**
-             * Format: date-time
-             * @description Optional hard expiry. Omit for a non-expiring key.
-             */
-            expires_at?: string;
-        };
-        CreateOrgOrSystemAPIKeyRequest: {
-            /** @description Human-readable label, unique within the org (or project for project-pinned keys). */
-            name: string;
-            /**
-             * @description Standard API key scope: `org` for organization keys or `system` for platform-only keys. Project-pinned versus org-level behavior is determined separately by `project_id`.
-             * @default org
-             * @enum {string}
-             */
-            scope: "org" | "system";
-            /** @description Permissions to grant. Each permission must be held by the creating caller — you cannot grant more than you have. */
-            permissions?: string[];
-            /** @description Associate this key with a service account for attribution. */
-            service_account_id?: string;
-            /**
-             * Format: date-time
-             * @description Optional hard expiry. Omit for a non-expiring key.
-             */
-            expires_at?: string;
-        };
-        /** @description Server-resolved identity context for the current request. Use this to confirm which org, actor, and auth mechanism the API associated with the supplied credential. */
-        AuthContext: {
-            /** @description Resolved user ID for this request (may be a service account ID for API-key auth). */
-            user_id: string;
-            /** @description Org ID resolved from the authentication credential. */
-            org_id?: string;
-            /** @description Org member role (owner, admin, member) — empty for API-key auth. */
-            role?: string;
-            /** @description How the caller authenticated: `clerk` (browser JWT), `api_key`, or `cli_token`. */
-            auth_type: string;
-            /** @description True when the caller is an owner or admin of the active organization. */
-            is_org_admin: boolean;
-        };
-        ConfirmDeviceCodeRequest: {
-            /** @description The user code displayed in the CLI during the device authorization flow. */
-            user_code: string;
-            /** @description Optional label to identify this credential in the CLI credentials list. */
-            label?: string;
-            /** @description Optional project ID to pin the issued CLI credential to. When set, the resulting token is usable only for that project and must carry the project's handle as a trailing `.<handle>` suffix. */
-            project_id?: string;
-        };
-        ConfirmDeviceCodeResult: {
-            /** @description True when the device code was successfully confirmed and a CLI credential has been issued. */
-            confirmed: boolean;
-        };
-        /**
-         * @description Lifecycle state for a CLI credential. `active` credentials can authenticate requests; `revoked` credentials are retained for audit history but no longer work.
-         * @enum {string}
-         */
-        CLICredentialStatus: "active" | "revoked";
-        /** @description User-authorized CLI credential metadata. Use it to show local login sessions, identify project-pinned tokens, and revoke stale command-line access without revealing the token itself. */
-        CLICredential: {
-            /** @description Unique identifier for this credential. */
-            id: string;
-            /** @description ID of the user who authorized this credential. */
-            user_id: string;
-            /** @description Project ID the credential is pinned to. Empty when the credential is org-scoped (usable across every project the user can access). */
-            project_id?: string;
-            /** @description Handle of the pinned project, echoed here so clients can format the trailing `.<handle>` suffix on every request. Empty when the credential is not pinned. */
-            project_handle?: string;
-            /** @description Human-readable label identifying this credential. */
-            label: string;
-            /** @description First few characters of the token, shown for identification without exposing the secret. */
-            token_prefix: string;
-            /** @description Credential lifecycle state: `active` or `revoked`. */
-            status: components["schemas"]["CLICredentialStatus"];
-            /**
-             * Format: date-time
-             * @description Timestamp when this credential was created.
-             */
-            created_at: string;
-            /**
-             * Format: date-time
-             * @description Timestamp when this credential was last updated.
-             */
-            updated_at: string;
-            /**
-             * Format: date-time
-             * @description Timestamp of the most recent authenticated request using this credential.
-             */
-            last_used_at?: string;
-            /**
-             * Format: date-time
-             * @description Timestamp when this credential expires. Null if it does not expire.
-             */
-            expires_at?: string | null;
-        };
-        CLICredentialListResponse: {
-            /** @description The list of credentials issued to the current user. */
-            items: components["schemas"]["CLICredential"][];
-        };
         /**
          * @description Workflow definition shaped like `workflow.Options`.
          *
@@ -2373,17 +2245,7 @@ export interface components {
             /** @description Go duration string. */
             timeout: string;
             /** @description User, group, or agent that should receive the interaction. */
-            target: components["schemas"]["WorkflowInteractionTarget"];
-        };
-        /** @description Recipient definition used by workflow interaction steps. */
-        WorkflowInteractionTarget: {
-            /**
-             * @description Whether the target is an individual user, a group, or an agent.
-             * @enum {string}
-             */
-            type: "user" | "group" | "agent";
-            /** @description ID of the target user, group, or agent. */
-            id: string;
+            target: components["schemas"]["InteractionTarget"];
             /** @description When true, all group members must respond before the interaction completes. Only meaningful when type is `group`. */
             require_all?: boolean;
         };
@@ -2403,6 +2265,8 @@ export interface components {
             published_as_tool?: boolean;
             /** @description User ID of the org member who created this workflow definition. */
             created_by: string;
+            /** @description Resource tags applied to this workflow. Inherited by runs at start time; see `WorkflowRun.tags`. */
+            tags?: components["schemas"]["TagMap"];
             /**
              * Format: date-time
              * @description Timestamp when this workflow definition was created.
@@ -2442,6 +2306,8 @@ export interface components {
             published_as_tool?: boolean;
             /** @description Executable workflow spec to persist as version 1. */
             spec: components["schemas"]["WorkflowSpec"];
+            /** @description Initial tag set. */
+            tags?: components["schemas"]["TagMap"];
         };
         /** @description Updates workflow metadata and optionally creates a new immutable version when `spec` changes. */
         UpdateWorkflowRequest: {
@@ -2453,6 +2319,8 @@ export interface components {
             published_as_tool?: boolean;
             /** @description Replacement executable workflow spec. Supplying this creates a new version. */
             spec?: components["schemas"]["WorkflowSpec"];
+            /** @description When supplied, replaces the workflow's tag set. Omit to leave tags unchanged. */
+            tags?: components["schemas"]["TagMap"];
         };
         /** @description Workflow version metadata without the executable `spec`. Returned by `listWorkflowVersions`. */
         WorkflowVersionSummary: {
@@ -2481,10 +2349,90 @@ export interface components {
             items: components["schemas"]["WorkflowVersionSummary"][];
         };
         /**
-         * @description Run lifecycle: `queued` → `running` → `completed` | `failed` | `suspended`. A `suspended` run is waiting on a signal or interaction; it resumes automatically when the signal is delivered or the interaction is responded to.
+         * @description Public run lifecycle. Path-level fields explain why an active run is working, waiting, sleeping, retrying, paused, or blocked at a join.
+         * @enum {string}
+         */
+        WorkflowRunStatus: "active" | "completed" | "failed";
+        /**
+         * @description Current state of one execution path.
+         * @enum {string}
+         */
+        WorkflowRunPathState: "working" | "waiting" | "completed" | "failed";
+        /**
+         * @description What a waiting path is blocked on.
          * @enum {string}
          */
-        WorkflowRunStatus: "queued" | "running" | "completed" | "failed" | "suspended";
+        WorkflowRunWaitKind: "sleep" | "signal" | "interaction" | "pause" | "join" | "retry";
+        WorkflowRunWaitDetail: {
+            kind: components["schemas"]["WorkflowRunWaitKind"];
+            /**
+             * Format: date-time
+             * @description Earliest time the runtime should inspect or resume this path.
+             */
+            wake_at?: string;
+            /** @description Signal name this path is waiting for. */
+            signal_name?: string;
+            /** @description Pending interaction linked to this wait. */
+            interaction_id?: string;
+            /** @description Interaction target, when kind is `interaction`. */
+            target?: components["schemas"]["InteractionTarget"];
+            /** @description Human-readable pause or wait reason. */
+            reason?: string;
+            /** @description Join step this path is waiting at. */
+            join_step?: string;
+            /** @description Path IDs still required before a join can proceed. */
+            waiting_for_paths?: string[];
+            /** @description Retry attempt number for `retry` waits. */
+            attempt?: number;
+            /** @description Maximum attempts for `retry` waits. */
+            max_attempts?: number;
+        };
+        WorkflowRunPath: {
+            /** @description Stable execution path identifier, e.g. `main` or `main/each/0`. */
+            path_id: string;
+            state: components["schemas"]["WorkflowRunPathState"];
+            /** @description Present when `state` is `waiting`. */
+            waiting_on?: components["schemas"]["WorkflowRunWaitDetail"];
+            /** @description Path-local failure type when state is `failed`. */
+            error_type?: string;
+            /** @description Path-local failure message when state is `failed`. */
+            error_message?: string;
+        };
+        /** @description Current path counts. Invariants: `total = working + waiting + completed + failed`; `active = working + waiting`. */
+        WorkflowRunPathCounts: {
+            total: number;
+            active: number;
+            working: number;
+            waiting: number;
+            completed: number;
+            failed: number;
+        };
+        /** @description Always-present aggregate of waiting paths. */
+        WorkflowRunWaitSummary: {
+            waiting_paths: number;
+            /** @description Count of waiting paths by `waiting_on.kind`. */
+            kind_counts: {
+                [key: string]: number;
+            };
+            /**
+             * Format: date-time
+             * @description Earliest wake time among waiting paths, or null.
+             */
+            next_wake_at: string | null;
+            waiting_on_signal_names: string[];
+            interaction_ids: string[];
+        };
+        /** @description Current job-claim summary for this run. `ready` counts pending jobs whose `scheduled_at` has arrived and can be claimed now; `scheduled` counts pending jobs intentionally waiting for a future retry/backoff; `claimed` counts jobs currently held by workers. */
+        WorkflowRunJobCounts: {
+            ready: number;
+            scheduled: number;
+            claimed: number;
+        };
+        WorkflowRunError: {
+            path_id?: string;
+            error_type: string;
+            error_message: string;
+        };
         /** @description Runtime record for one workflow execution. */
         WorkflowRun: {
             /** @description Unique identifier for this run. */
@@ -2501,8 +2449,16 @@ export interface components {
             ephemeral: boolean;
             /** @description Name of the workflow as recorded at run creation time. */
             workflow_name: string;
-            /** @description Current run lifecycle state: `queued`, `running`, `completed`, `failed`, or `suspended`. */
+            /** @description Public lifecycle for this run. */
             status: components["schemas"]["WorkflowRunStatus"];
+            /** @description Current path counts derived from the run projection. */
+            path_counts: components["schemas"]["WorkflowRunPathCounts"];
+            /** @description Current job claim summary derived from the run projection. */
+            job_counts: components["schemas"]["WorkflowRunJobCounts"];
+            /** @description Always-present aggregate of waiting paths. */
+            wait_summary: components["schemas"]["WorkflowRunWaitSummary"];
+            /** @description Run-level errors that caused a failed lifecycle. */
+            errors: components["schemas"]["WorkflowRunError"][];
             /** @description Retry attempt number (1-based). Increments each time the run is retried. */
             attempt: number;
             /** @description Input values provided when the run was started. */
@@ -2513,6 +2469,8 @@ export interface components {
             metadata?: {
                 [key: string]: string;
             };
+            /** @description Resource tags applied to this run. Inherited from the parent workflow at start time, with caller-supplied overrides merged on top. System tags (`mobius:*`) are read-only. */
+            tags?: components["schemas"]["TagMap"];
             /** @description Error message from the most recent failure. Present when status is failed. */
             error_message?: string;
             /** @description Type of the actor that started this run (user, service_account, system). */
@@ -2523,8 +2481,13 @@ export interface components {
             initiated_by?: string;
             /** @description Caller-supplied idempotency key or correlation ID. */
             external_id?: string;
-            /** @description True when a cancel has been requested on this run but the run has not yet reached a terminal state. Workers observe this on their next heartbeat and stop work. */
+            /** @description Compatibility boolean set when cancellation was requested. Use `cancel_requested_at` for audit detail and `status` for terminal checks. */
             cancel_requested?: boolean;
+            /**
+             * Format: date-time
+             * @description Timestamp when cancellation was requested.
+             */
+            cancel_requested_at?: string;
             /**
              * Format: date-time
              * @description Timestamp when this run was created.
@@ -2551,10 +2514,10 @@ export interface components {
              */
             wall_clock_deadline_at?: string;
             /**
-             * @description Typed run-level failure cause: `run_timeout`, `run_cancelled`, or `job_failed`. Its own vocabulary, not a superset of the job-level `error_type`. Present when `status=failed`.
+             * @description Typed run-level failure cause: `run_timeout`, `run_cancelled`, `job_failed`, or `run_failed`. Its own vocabulary, not a superset of the job-level `error_type`. Present when `status=failed`.
              * @enum {string}
              */
-            error_type?: "run_timeout" | "run_cancelled" | "job_failed";
+            error_type?: "run_timeout" | "run_cancelled" | "job_failed" | "run_failed";
             /** @description Run-level cascade config frozen when the run was started. */
             resolved_config?: components["schemas"]["ResolvedConfig"];
             /** @description Default job-level cascade config inherited by jobs unless a step overrides it. */
@@ -2573,6 +2536,8 @@ export interface components {
         };
         /** @description Detailed workflow run including its spec snapshot, terminal result, and jobs. */
         WorkflowRunDetail: components["schemas"]["WorkflowRun"] & {
+            /** @description Current path-level execution projection for this run. */
+            paths: components["schemas"]["WorkflowRunPath"][];
             /** @description Spec snapshot used to execute this run. */
             spec?: components["schemas"]["WorkflowSpec"];
             /** @description Base64-encoded terminal result blob */
@@ -2580,7 +2545,7 @@ export interface components {
             /** @description Jobs spawned by this run. */
             jobs?: components["schemas"]["Job"][];
         };
-        /** @description Run a previously-created workflow definition. Selected by `mode: saved` on `POST /v1/projects/{project}/runs`. */
+        /** @description Run a previously-created workflow definition. Selected by `mode: saved` on `POST /v1/projects/{project}/runs`. The run inherits the workflow definition's tags at start time; see the `tags` field below for the override rules. */
         StartSavedRunRequest: {
             /**
              * @description Discriminator value — must be `saved`. (enum property replaced by openapi-typescript)
@@ -2599,6 +2564,8 @@ export interface components {
             metadata?: {
                 [key: string]: string;
             };
+            /** @description Tags applied on top of the workflow definition's inherited tags. Caller keys override on conflict; an entry whose value is the empty string opts the inherited key out entirely (so the run does not carry it). Setting a tag value to "" is therefore reserved as the opt-out signal — use a placeholder value if you actually want a stored empty value. */
+            tags?: components["schemas"]["TagMap"];
             /** @description Caller-supplied idempotency key or correlation ID attached to the run. */
             external_id?: string;
             /** @description Run-level cascade config overrides applied when starting the run. */
@@ -2623,6 +2590,8 @@ export interface components {
             metadata?: {
                 [key: string]: string;
             };
+            /** @description Initial tags for this inline run. Inline runs have no parent workflow definition, so there is nothing to inherit from — every tag on the run comes from this map. */
+            tags?: components["schemas"]["TagMap"];
             /** @description Caller-supplied idempotency key or correlation ID attached to the run. */
             external_id?: string;
             /** @description Run-level cascade config overrides applied when starting the run. */
@@ -2647,6 +2616,8 @@ export interface components {
             metadata?: {
                 [key: string]: string;
             };
+            /** @description Tags applied on top of the bound workflow definition's inherited tags. Caller keys override on conflict; an entry whose value is the empty string opts the inherited key out entirely (so the run does not carry it). Setting a tag value to "" is therefore reserved as the opt-out signal — use a placeholder value if you actually want a stored empty value. */
+            tags?: components["schemas"]["TagMap"];
             /** @description Caller-supplied idempotency key or correlation ID attached to the run. */
             external_id?: string;
             /** @description Run-level cascade config overrides applied when starting the bound workflow. */
@@ -2785,7 +2756,7 @@ export interface components {
              * @description Deadline at which the reaper will fail this job with `error_type=execution_timeout` if it has not completed. Present only when `resolved_config` contains an entry with `category="timeouts"` and `key="execution"` whose value resolves to a finite duration.
              */
             execution_deadline_at?: string;
-            /** @description Failure cause. Server-produced timeout and cancellation failures use stable tokens such as `claim_timeout`, `liveness_timeout`, `execution_timeout`, and `run_cancelled`; worker-reported failures may use caller-defined class names. Present when `status=failed`. */
+            /** @description Failure cause. Server-produced timeout and cancellation failures use stable tokens such as `claim_timeout`, `liveness_timeout`, `execution_timeout`, `run_cancelled`, `run_timeout`, and `run_failed`; worker-reported failures may use caller-defined class names. Present when `status=failed`. */
             error_type?: string;
             /** @description Job-level cascade config resolved for this job. */
             resolved_config?: components["schemas"]["ResolvedConfig"];
@@ -2805,7 +2776,7 @@ export interface components {
             /** @description The list of jobs for this run. */
             items: components["schemas"]["Job"][];
         };
-        /** @description Delivers an external signal to a suspended workflow run. */
+        /** @description Delivers an external signal to a workflow run. */
         SendRunSignalRequest: {
             /** @description Signal topic (e.g. "approval", "webhook"). */
             name: string;
@@ -2823,6 +2794,16 @@ export interface components {
             /** @description Signal topic name matching the wait_signal step's topic. */
             name: string;
         };
+        /** @description Identifies who should receive an interaction request. Note: distinct from the caller/audit `Actor` vocabulary — a target is a *recipient*, not someone who has acted yet. */
+        InteractionTarget: {
+            /**
+             * @description Target kind: a specific user, an agent queue, or a group.
+             * @enum {string}
+             */
+            type: "user" | "agent" | "group";
+            /** @description User ID for user; queue name for agent; group ID or handle for group. */
+            id: string;
+        };
         /** @description Request hints that describe the safe-use properties of the action. Used by the engine and tooling to decide retry behavior, dry-run eligibility, etc. Unknown request properties are rejected. */
         ActionAnnotationsRequest: {
             /** @description The action produces the same result when called with the same inputs; safe to retry automatically. */
@@ -3141,16 +3122,6 @@ export interface components {
                 [key: string]: unknown;
             };
         };
-        /** @description Identifies who should receive an interaction request. Note: distinct from the caller/audit `Actor` vocabulary — a target is a *recipient*, not someone who has acted yet. */
-        InteractionTarget: {
-            /**
-             * @description Target kind: a specific user, an agent queue, or a group.
-             * @enum {string}
-             */
-            type: "user" | "agent" | "group";
-            /** @description User ID for user; queue name for agent; group ID or handle for group. */
-            id: string;
-        };
         /**
          * @description Interaction kind: `approval` captures a decision, `review` captures acknowledgement or notes, and `input` collects free-form data.
          * @enum {string}
@@ -3438,6 +3409,8 @@ export interface components {
             next_fire_at?: string;
             /** @description User ID of the org member who created this trigger. */
             created_by?: string;
+            /** @description Resource tags applied to this trigger. */
+            tags?: components["schemas"]["TagMap"];
             /**
              * Format: date-time
              * @description Timestamp when this trigger was created.
@@ -3516,6 +3489,8 @@ export interface components {
             concurrency_policy?: components["schemas"]["ConcurrencyPolicy"];
             /** @description Whether the trigger starts enabled. Defaults to true when omitted. */
             enabled?: boolean;
+            /** @description Initial tag set. */
+            tags?: components["schemas"]["TagMap"];
         };
         /** @description Creates a webhook trigger with an inbound receive URL. */
         CreateWebhookTriggerRequest: {
@@ -3534,6 +3509,8 @@ export interface components {
             concurrency_policy?: components["schemas"]["ConcurrencyPolicy"];
             /** @description Whether the trigger starts enabled. Defaults to true when omitted. */
             enabled?: boolean;
+            /** @description Initial tag set. */
+            tags?: components["schemas"]["TagMap"];
         };
         /** @description Creates an event trigger for platform-originated events. */
         CreateEventTriggerRequest: {
@@ -3552,16 +3529,22 @@ export interface components {
             concurrency_policy?: components["schemas"]["ConcurrencyPolicy"];
             /** @description Whether the trigger starts enabled. Defaults to true when omitted. */
             enabled?: boolean;
+            /** @description Initial tag set. */
+            tags?: components["schemas"]["TagMap"];
         };
         UpdateTriggerRequest: {
             /** @description Replacement human-readable name. */
             name?: string;
             /** @description Replacement source configuration; its shape must match the trigger kind. */
             source_config?: components["schemas"]["TriggerSourceConfig"];
+            /** @description Replacement target set for this trigger. Omit to leave targets unchanged; send an empty array to remove all targets. */
+            targets?: components["schemas"]["CreateTriggerTargetRequest"][];
             /** @description Replacement policy for overlapping runs started by this trigger. */
             concurrency_policy?: components["schemas"]["ConcurrencyPolicy"];
             /** @description Set to false to pause the trigger without deleting it. */
             enabled?: boolean;
+            /** @description When supplied, replaces the user tag set on the trigger. System tags (`mobius:*`) are preserved. */
+            tags?: components["schemas"]["TagMap"];
         };
         /** @description Recently observed worker process for a project. Use sessions to see which machines, users, service accounts, or agents are polling for work and whether they appear stale. */
         WorkerSession: {
@@ -3582,6 +3565,8 @@ export interface components {
             service_account_id?: string;
             /** @description User this session authenticated as on register/heartbeat. Set when a human is polling via the CLI; mutually exclusive with `service_account_id`. */
             user_id?: string;
+            /** @description Embedded profile for `user_id` when this is a CLI-backed human worker session. Absent when the user record is unavailable or the session is service-account-backed. */
+            user?: components["schemas"]["User"];
             /** @description ID of the specific API key this session presented on its most recent register/heartbeat. Only set for service-account-backed sessions; changes across credential rotations. Use together with `service_account_id` to see rotation progress across a fleet. */
             api_key_id?: string;
             /** @description Agent this session represents, when the polling process declared itself as a registered agent (via `agent_id` on the claim request or via inference from the service account). Absent for ad-hoc worker processes that are not tied to a declared agent. */
@@ -3593,6 +3578,29 @@ export interface components {
             /** @description The list of recently seen worker sessions. */
             items: components["schemas"]["WorkerSession"][];
         };
+        /** @description Human identity known to the organization. User records are useful for membership lists, role assignment UIs, attribution, and displaying profile information next to actions. */
+        User: {
+            /** @description Clerk user ID. Stable and globally unique across all orgs. */
+            id: string;
+            /** @description Primary email address from Clerk. */
+            email: string;
+            /** @description User's first name from their Clerk profile. */
+            first_name?: string;
+            /** @description User's last name from their Clerk profile. */
+            last_name?: string;
+            /** @description Profile avatar URL from Clerk (may be a Gravatar or uploaded image). */
+            avatar_url?: string;
+            /**
+             * Format: date-time
+             * @description When the user record was first mirrored into Mobius.
+             */
+            created_at: string;
+            /**
+             * Format: date-time
+             * @description Timestamp when this user record was last synced from Clerk.
+             */
+            updated_at: string;
+        };
         /**
          * @description `org_open`: every org member can see and use the project, subject to role assignments. `restricted`: only listed project members (and org owners/admins) can see or use the project.
          * @enum {string}
@@ -3612,6 +3620,13 @@ export interface components {
             access_mode: components["schemas"]["ProjectAccessMode"];
             /** @description User ID of the org member who created this project. */
             created_by?: string;
+            /**
+             * Format: date-time
+             * @description Timestamp when this project was archived. `null` for active projects. Archived projects are read-only and excluded from the default project listing.
+             */
+            archived_at?: string | null;
+            /** @description Resource tags applied to this project. */
+            tags?: components["schemas"]["TagMap"];
             /**
              * Format: date-time
              * @description Timestamp when this project was created.
@@ -3636,6 +3651,8 @@ export interface components {
             description?: string;
             /** @description Initial project access policy: `org_open` or `restricted`. */
             access_mode?: components["schemas"]["ProjectAccessMode"];
+            /** @description Initial tag set. */
+            tags?: components["schemas"]["TagMap"];
         };
         UpdateProjectRequest: {
             /** @description Replacement human-readable name. */
@@ -3646,6 +3663,8 @@ export interface components {
             access_mode?: components["schemas"]["ProjectAccessMode"];
             /** @description When transitioning from `org_open` to `restricted`, set true to insert all current org members as project members so nobody loses visibility on the flip. Ignored on other transitions. */
             seed_existing_members?: boolean;
+            /** @description When supplied, replaces the user tag set on the project. */
+            tags?: components["schemas"]["TagMap"];
         };
         /** @description Explicit project membership used when a project is restricted. Use this record to decide who can see or operate on a project outside the default org-wide access model. */
         ProjectMember: {
@@ -3655,6 +3674,8 @@ export interface components {
             project_id: string;
             /** @description ID of the user who is a member. */
             user_id: string;
+            /** @description Profile of the member. Embedded by `listProjectMembers` so UIs can render names, emails, and avatars without a separate user lookup. Absent on the `addProjectMember` response. */
+            user?: components["schemas"]["User"];
             /** @description Actor type of whoever added this member, if recorded. */
             added_by_actor_type?: string;
             /** @description Actor ID of whoever added this member, if recorded. */
@@ -3691,713 +3712,152 @@ export interface components {
             /** @description The customer endpoint Mobius POSTs event payloads to. */
             url: string;
             /** @description Subscribed event types. Use dot notation (`run.completed`, `run.failed`) or wildcards (`run.*` for all run events). */
-            events: string[];
-            /** @description When false, matching events are not delivered. */
-            enabled: boolean;
-            /** @description User ID of the org member who created this webhook. */
-            created_by?: string;
-            /**
-             * Format: date-time
-             * @description Timestamp when this webhook was created.
-             */
-            created_at: string;
-            /**
-             * Format: date-time
-             * @description Timestamp when this webhook was last updated.
-             */
-            updated_at: string;
-        };
-        WebhookListResponse: {
-            /** @description The list of results for this page. */
-            items?: components["schemas"]["Webhook"][];
-            /** @description Opaque cursor to pass as `cursor` on the next request. Absent when `has_more` is false. */
-            next_cursor?: string;
-            /** @description Whether additional pages are available. */
-            has_more: boolean;
-        };
-        /** @description One delivery record for a webhook event. The daemon claims pending rows, POSTs the payload, and transitions to `delivered` or retries on failure. A delivery reaches `failed` only after exhausting all 10 retry attempts. */
-        WebhookDelivery: {
-            /** @description Unique identifier for this delivery record. */
-            id: string;
-            /** @description ID of the webhook this delivery belongs to. */
-            webhook_id: string;
-            /** @description Run that triggered the event, when applicable. */
-            run_id?: string;
-            /** @description The event type that triggered this delivery (e.g. `run.completed`). */
-            event_type: string;
-            /** @description Current delivery status: `pending`, `delivered`, or `failed`. */
-            status: components["schemas"]["WebhookDeliveryStatus"];
-            /** @description Number of delivery attempts made so far. Max 10. */
-            attempts: number;
-            /** @description Error message from the most recent failed attempt. */
-            last_error?: string;
-            /**
-             * Format: date-time
-             * @description Timestamp when this delivery was first attempted.
-             */
-            created_at: string;
-            /**
-             * Format: date-time
-             * @description Timestamp of the successful delivery. Absent until delivered.
-             */
-            delivered_at?: string;
-        };
-        WebhookDeliveryListResponse: {
-            /** @description The list of results for this page. */
-            items?: components["schemas"]["WebhookDelivery"][];
-            /** @description Opaque cursor to pass as `cursor` on the next request. Absent when `has_more` is false. */
-            next_cursor?: string;
-            /** @description Whether additional pages are available. */
-            has_more: boolean;
-        };
-        CreateWebhookRequest: {
-            /** @description Human-readable name, unique within the project. */
-            name: string;
-            /** @description The endpoint Mobius will POST event payloads to. May be left empty at creation time so a candidate URL can be tested via the ping endpoint before it is saved; events do not fire for webhooks with an empty URL. */
-            url?: string;
-            /** @description Optional HMAC-SHA256 secret. When set, Mobius signs each POST body and includes `X-Mobius-Signature: sha256=<hex>` in the request headers. */
-            signing_secret?: string;
-            /** @description Event types to subscribe to. Use wildcards for broad subscriptions, e.g. `["run.*"]` for all run events. */
-            events: string[];
-            /** @description Whether the webhook starts enabled. Defaults to true when omitted. */
-            enabled?: boolean;
-        };
-        UpdateWebhookRequest: {
-            /** @description Replacement human-readable name. */
-            name?: string;
-            /** @description Replacement endpoint URL. */
-            url?: string;
-            /** @description Replace the current signing secret. Set to empty string to disable signing. Omit to leave the current secret unchanged. */
-            signing_secret?: string;
-            /** @description Replacement event subscriptions. Replaces the entire current list. */
-            events?: string[];
-            /** @description Set to false to disable delivery without deleting the webhook. */
-            enabled?: boolean;
-        };
-        PingWebhookRequest: {
-            /** @description URL to test. When supplied, the ping is sent to this URL instead of the webhook's saved URL — use this to validate a candidate URL before saving it. When omitted, the webhook's current saved URL is used. */
-            url?: string;
-        };
-        PingWebhookResult: {
-            /** @description True if the target responded with a 2xx status code. */
-            success: boolean;
-            /** @description HTTP status code returned by the target. Absent on network error. */
-            status_code?: number;
-            /** @description Error message if the request could not be completed. */
-            error?: string;
-            /** @description Round-trip latency in milliseconds. */
-            latency_ms?: number;
-        };
-        /**
-         * @description `active` — integration is enabled and usable by workflows. `inactive` — manually disabled; no automatic expiry behavior. `expired` — token/credential has expired (e.g., OAuth token not refreshed).
-         * @enum {string}
-         */
-        IntegrationStatus: "active" | "inactive" | "expired";
-        /** @description Project-scoped connection to an external provider such as Slack, GitHub, or a model service. Workflows and actions use integrations to find provider configuration without embedding secrets in definitions. */
-        Integration: {
-            /** @description Unique identifier for this integration. */
-            id: string;
-            /** @description Human-readable name, unique per `(project, provider)` tuple. */
-            name: string;
-            /** @description Free-form provider identifier (e.g. `openai`, `slack`, `github`). Immutable after creation. */
-            provider: string;
-            /** @description Provider-specific credential and configuration blob stored as JSON. The shape is provider-defined. */
-            config?: {
-                [key: string]: unknown;
-            };
-            /** @description Current integration state: `connected`, `disconnected`, or `error`. */
-            status: components["schemas"]["IntegrationStatus"];
-            /** @description User ID of the org member who created this integration. */
-            created_by?: string;
-            /**
-             * Format: date-time
-             * @description Timestamp when this integration was created.
-             */
-            created_at: string;
-            /**
-             * Format: date-time
-             * @description Timestamp when this integration was last updated.
-             */
-            updated_at: string;
-        };
-        IntegrationListResponse: {
-            /** @description The list of results for this page. */
-            items: components["schemas"]["Integration"][];
-            /** @description Opaque cursor to pass as `cursor` on the next request. Absent when `has_more` is false. */
-            next_cursor?: string;
-            /** @description Whether additional pages are available. */
-            has_more: boolean;
-        };
-        CreateIntegrationRequest: {
-            /** @description Human-readable name. Must be unique per `(project, provider)` tuple. */
-            name: string;
-            /** @description Provider identifier string (e.g. `openai`, `github`). Immutable after creation. */
-            provider: string;
-            /** @description Sensitive credentials (API keys, tokens, secrets). Stored encrypted and never returned in API responses. */
-            credentials?: {
-                [key: string]: unknown;
-            };
-            /** @description Non-sensitive provider-specific settings (e.g. default bucket, from address). */
-            config?: {
-                [key: string]: unknown;
-            };
-        };
-        UpdateIntegrationRequest: {
-            /** @description Updated display name. */
-            name?: string;
-            /** @description Replacement credentials blob (full replace). Stored encrypted and never returned in API responses. */
-            credentials?: {
-                [key: string]: unknown;
-            };
-            /** @description Replacement config blob (full replace, not merge). */
-            config?: {
-                [key: string]: unknown;
-            };
-            /** @description Replacement integration state: `connected`, `disconnected`, or `error`. */
-            status?: components["schemas"]["IntegrationStatus"];
-        };
-        CopyIntegrationRequest: {
-            /** @description ID of the source project. Must be in the same org. */
-            source_project_id: string;
-            /** @description ID of the integration to copy from the source project. */
-            source_integration_id: string;
-            /** @description Name for the copied integration in the destination project. Defaults to the source integration's name. Required if the source name conflicts with an existing `(provider, name)` in this project. */
-            name?: string;
-        };
-        /** @description Current billing entitlement for an organization. Use it to show plan status, trial/grace timing, renewal behavior, and usage caps that may block workflow execution. */
-        BillingSubscription: {
-            /** @description Unique identifier for this subscription. */
-            id: string;
-            /** @description Active plan: `trial`, `free`, `pro`, or `business`. New orgs start on `trial`; the plan downgrades to `free` when the trial expires. */
-            plan_type: string;
-            /** @description Stripe subscription status: `active`, `trialing`, `past_due`, `canceled`, `unpaid`, or `incomplete`. */
-            status: string;
-            /** @description Number of licensed seats included in the subscription. */
-            seat_count: number;
-            /**
-             * Format: date-time
-             * @description Start of the current billing period.
-             */
-            current_period_start: string;
-            /**
-             * Format: date-time
-             * @description End of the current billing period. Usage resets at this timestamp.
-             */
-            current_period_end: string;
-            /**
-             * Format: date-time
-             * @description When the trial period expires. Only set for `trial` plan.
-             */
-            trial_ends_at?: string;
-            /**
-             * Format: date-time
-             * @description When the post-expiry grace period ends. During grace, the org retains access but is prompted to upgrade.
-             */
-            grace_ends_at?: string;
-            /** @description Days remaining in the trial. 0 when the trial has ended. */
-            trial_days_remaining: number;
-            /** @description True when fewer than 7 days remain in the trial period. */
-            trial_warning: boolean;
-            /**
-             * Format: int64
-             * @description Maximum usage credits allowed per billing period. Workflow execution is blocked when this cap is reached.
-             */
-            monthly_credit_cap: number;
-            /** @description Maximum number of job steps allowed per individual workflow run. Default: 10,000 (pro/trial), 50,000 (business). */
-            per_run_step_cap: number;
-            /** @description Percentage levels (1–100) of `monthly_credit_cap` at which usage alert notifications are sent. Up to `max_alert_thresholds` from the plan. */
-            alert_thresholds_percent: number[];
-            /** @description When true, the subscription will not renew at `current_period_end`. */
-            cancel_at_period_end: boolean;
-            /**
-             * Format: date-time
-             * @description Timestamp when this subscription was created.
-             */
-            created_at: string;
-            /**
-             * Format: date-time
-             * @description Timestamp when this subscription was last updated.
-             */
-            updated_at: string;
-        };
-        /** @description Purchasable plan configuration exposed to clients before checkout. It explains price, included usage, seat limits, and operational caps so users can compare plans before upgrading. */
-        BillingPlan: {
-            /** @description Plan name — `trial`, `pro`, or `business`. */
-            plan_type: string;
-            /** @description Monthly price in cents (USD). */
-            price_cents: number;
-            /**
-             * Format: int64
-             * @description Usage credits included in the base price.
-             */
-            included_credits: number;
-            /** @description Maximum org members on this plan. 0 means unlimited. */
-            seat_limit: number;
-            /**
-             * Format: int64
-             * @description Default `monthly_credit_cap` applied to new subscriptions on this plan.
-             */
-            default_monthly_credit_cap: number;
-            /** @description Default `per_run_step_cap` applied to new subscriptions on this plan. */
-            default_per_run_step_cap: number;
-            /** @description Maximum number of alert thresholds configurable on this plan. */
-            max_alert_thresholds: number;
-            /** @description Trial period length in days. 0 for plans without a trial. */
-            trial_days: number;
-            /** @description When true, a payment method is required to start this plan. */
-            credit_card_required: boolean;
-        };
-        BillingPlanListResponse: {
-            /** @description The list of available plans. */
-            items: components["schemas"]["BillingPlan"][];
-        };
-        /** @description Attribution row for usage generated by a single API key. Useful for identifying which automation or service account is driving billing consumption within the current period. */
-        BillingUsageKeySummary: {
-            /** @description The API key responsible for this usage. */
-            api_key_id: string;
-            /** @description Number of usage records attributed to this key in the current period. */
-            count: number;
-        };
-        /** @description Billing-period usage snapshot for an organization. Use it to show remaining capacity, estimated overage, and which categories or API keys are contributing to spend. */
-        BillingUsageSummary: {
-            /**
-             * Format: date-time
-             * @description Start of the current billing period.
-             */
-            current_period_start: string;
-            /**
-             * Format: date-time
-             * @description End of the current billing period.
-             */
-            current_period_end: string;
-            /** @description Total usage credits consumed in the current billing period. */
-            current_usage: number;
-            /** @description Included credits from the plan before overage applies. */
-            included_limit: number;
-            /** @description Number of usage records that exceed the included limit. */
-            overage_calls: number;
-            /** @description Estimated overage cost in cents for the current period. */
-            overage_cost: number;
-            /** @description Usage breakdown by resource category (e.g. `run`, `job`). */
-            by_category: {
-                [key: string]: number;
-            };
-            /** @description Per-API-key usage breakdown for cost attribution. */
-            by_api_key: components["schemas"]["BillingUsageKeySummary"][];
-        };
-        /** @description Customer-facing invoice metadata from Stripe. Clients use invoices to display payment status and link users to hosted invoice or PDF views. */
-        Invoice: {
-            /** @description Stripe invoice ID. */
-            id: string;
-            /** @description Stripe invoice status (`draft`, `open`, `paid`, `void`, `uncollectible`). */
-            status: string;
-            /** @description ISO 4217 currency code (e.g. `usd`). */
-            currency: string;
-            /** @description Total amount due in the smallest currency unit (e.g. cents). */
-            amount_due: number;
-            /** @description Amount already paid against this invoice. */
-            amount_paid: number;
-            /**
-             * Format: uri
-             * @description Stripe-hosted invoice page URL for the customer.
-             */
-            hosted_invoice_url?: string;
-            /**
-             * Format: uri
-             * @description Direct link to the invoice PDF.
-             */
-            invoice_pdf?: string;
-            /**
-             * Format: date-time
-             * @description Timestamp when this invoice was created by Stripe.
-             */
-            created_at: string;
-        };
-        InvoiceListResponse: {
-            /** @description The list of recent invoices, newest first. */
-            items: components["schemas"]["Invoice"][];
-        };
-        CreateCheckoutRequest: {
-            /**
-             * Format: uri
-             * @description URL Stripe redirects to after a successful checkout.
-             */
-            success_url: string;
-            /**
-             * Format: uri
-             * @description URL Stripe redirects to when the user cancels checkout.
-             */
-            cancel_url: string;
-        };
-        CreatePortalRequest: {
-            /**
-             * Format: uri
-             * @description URL Stripe redirects to after the user exits the customer portal.
-             */
-            return_url: string;
-        };
-        BillingURLResult: {
-            /**
-             * Format: uri
-             * @description Stripe-hosted URL to redirect the user's browser to.
-             */
-            url: string;
-        };
-        UpdateBillingLimitsRequest: {
-            /**
-             * Format: int64
-             * @description New monthly credit ceiling. When reached, workflow execution is blocked until the next billing period.
-             */
-            monthly_credit_cap?: number;
-            /** @description Maximum job steps per workflow run. Prevents runaway runs from consuming unbounded credits. */
-            per_run_step_cap?: number;
-            /** @description Replacement list of alert threshold percentages (1–100). Replaces the full existing list. Must not exceed the plan's `max_alert_thresholds`. */
-            alert_thresholds_percent?: number[];
-        };
-        /** @description Whether the current user has completed initial organization setup. Use this at app startup to decide whether to route the user into onboarding or the normal workspace experience. */
-        OnboardingStatus: {
-            /** @description Whether the user has completed onboarding and has an org */
-            completed: boolean;
-            /** @description The user's org ID (present only when completed is true) */
-            org_id?: string;
-            /** @description The user's org display name (present only when completed is true) */
-            org_name?: string;
-        };
-        OnboardingResult: {
-            /** @description ID of the newly created (or existing) org */
-            org_id: string;
-            /** @description Display name of the org */
-            org_name: string;
-        };
-        /** @description Operational health snapshot for a project. Use it to power dashboards, detect stuck queues or stale workers, and summarize run throughput and failure rates over a recent window. */
-        ProjectMetrics: {
-            /**
-             * Format: date-time
-             * @description Timestamp when this metrics snapshot was computed.
-             */
-            generated_at: string;
-            /** @description Rolling window width used for rate and failure metrics. Default is 60 minutes. */
-            window_minutes: number;
-            /**
-             * Format: double
-             * @description Average number of new workflow runs started per minute within the window.
-             */
-            runs_per_minute: number;
-            /** @description Total number of workflow runs started within the window. */
-            total_runs_window: number;
-            /**
-             * Format: double
-             * @description Fraction of completed runs that ended in `failed` status within the window. Range 0.0–1.0.
-             */
-            failure_rate: number;
-            /**
-             * Format: double
-             * @description Mean wall-clock duration of completed runs within the window, in seconds.
-             */
-            avg_run_seconds: number;
-            /**
-             * Format: double
-             * @description 95th-percentile job duration (claim time to terminal state) computed across the 40 most recent completed jobs, in seconds. Use this to detect slow or stuck steps.
-             */
-            p95_step_seconds: number;
-            /** @description Number of jobs currently in `pending` state waiting to be claimed. */
-            queue_depth: number;
-            /** @description Number of workflow runs currently in `running` or `suspended` state. */
-            running_count: number;
-            /** @description Number of workers whose `last_seen_at` is within the 2-minute staleness threshold. */
-            active_workers: number;
-            /** @description Number of workers whose `last_seen_at` has exceeded the 2-minute staleness threshold. */
-            stale_workers: number;
-            /** @description Map of workflow run status → count across all runs in the project (not windowed). Includes all terminal and in-progress statuses. */
-            status_breakdown: {
-                [key: string]: number;
-            };
-        };
-        PreviewPermissionsRequest: {
-            /** @description Role name assigned as a fallback to service accounts that have no explicit assignment at the time of preview. */
-            service_account_default_role?: string;
-        };
-        EnablePermissionsRequest: {
-            /** @description Fallback role name for service accounts with no existing assignment. Applied only to service accounts not covered by the `assignments` list. */
-            service_account_default_role?: string;
-            /** @description Explicit role assignments to create as part of the enable operation. */
-            assignments?: components["schemas"]["PermissionsAssignmentInput"][];
-        };
-        /** @description Desired role assignment supplied while enabling permissions. Use this to make the initial rollout explicit instead of relying only on default roles for users and service accounts. */
-        PermissionsAssignmentInput: {
-            /**
-             * @description Actor type: `user` or `service_account`.
-             * @enum {string}
-             */
-            actor_type: "user" | "service_account";
-            /** @description ID of the user or service account. */
-            actor_id: string;
-            /** @description Mutually exclusive with `role_name`. */
-            role_id?: string;
-            /** @description Resolved to a role ID server-side. Mutually exclusive with `role_id`. */
-            role_name?: string;
-            /** @description Scope this assignment to a project. Omit for org-wide. */
-            project_id?: string;
-        } & (unknown | unknown);
-        /** @description Role assignment the server would create during a permissions preview or enable operation. Clients can show these proposals before enforcing permissions so admins understand the blast radius. */
-        PermissionsAssignmentProposal: {
-            /**
-             * @description Actor type: `user` or `service_account`.
-             * @enum {string}
-             */
-            actor_type: "user" | "service_account";
-            /** @description ID of the user or service account. */
-            actor_id: string;
-            /** @description ID of the role that would be assigned. */
-            role_id: string;
-            /** @description Name of the role that would be assigned. */
-            role_name: string;
-            /** @description Project scope for the assignment. Null for org-wide assignments. */
-            project_id?: string | null;
-        };
-        /** @description Current or proposed permissions state, including the full set of role assignments. */
-        PermissionsPlan: {
-            /** @description Whether enforcement is currently (or will be after enable) active. */
-            permissions_enabled: boolean;
-            /** @description The set of role assignments that will be created on enable. */
-            assignments: components["schemas"]["PermissionsAssignmentProposal"][];
-        };
-        /** @description Lightweight org-level switch showing whether permission enforcement is active. Use it to decide whether role assignments are informational or actually gate API access. */
-        PermissionsState: {
-            /** @description Whether enforcement is currently active for the org. */
-            permissions_enabled: boolean;
-        };
-        /** @description Named bundle of permissions assignable to users or service accounts. Roles let admins grant workflow, project, and automation capabilities consistently without editing every actor individually. */
-        Role: {
-            /** @description Unique identifier for this role. */
-            id: string;
-            /** @description Scoping project. Empty for org-wide roles. */
-            project_id?: string;
-            /** @description Human-readable role name, unique within org+project scope. */
-            name: string;
-            /** @description Optional human-readable description of what this role grants. */
-            description: string;
-            /** @description Permission strings granted by this role (e.g. "mobius.job.claim"). */
-            permissions: string[];
-            /** @description True for built-in platform roles that cannot be modified or deleted. */
-            system_defined: boolean;
-            /**
-             * Format: date-time
-             * @description Timestamp when this role was created.
-             */
-            created_at: string;
-            /**
-             * Format: date-time
-             * @description Timestamp when this role was last updated.
-             */
-            updated_at: string;
-        };
-        /** @description Binding between an actor and a role, optionally scoped to a project. Use assignments to explain why a user or service account has access and to audit who granted it. */
-        RoleAssignment: {
-            /** @description Unique identifier for this role assignment. */
-            id: string;
-            /**
-             * @description Type of actor this assignment applies to: `user` or `service_account`.
-             * @enum {string}
-             */
-            actor_type: "user" | "service_account";
-            /** @description User ID or service account ID receiving the role. */
-            actor_id: string;
-            /** @description ID of the assigned role. */
-            role_id: string;
-            /** @description Name of the assigned role. */
-            role_name: string;
-            /** @description Set for project-scoped assignments; empty for org-wide. */
-            project_id?: string;
-            /** @description Actor type of the caller who created this assignment. */
-            granted_by_actor_type?: string;
-            /** @description Actor ID of the caller who created this assignment. */
-            granted_by_actor_id?: string;
-            /**
-             * Format: date-time
-             * @description Timestamp when this assignment was created.
-             */
-            created_at: string;
-        };
-        RoleListResponse: {
-            /** @description The list of results for this page. */
-            items: components["schemas"]["Role"][];
-        };
-        RoleAssignmentListResponse: {
-            /** @description The list of results for this page. */
-            items: components["schemas"]["RoleAssignment"][];
-        };
-        CreateRoleRequest: {
-            /** @description Project this role belongs to. Custom roles are always project-scoped. */
-            project_id: string;
-            /** @description Unique name within the project. */
-            name: string;
-            /** @description Optional human-readable description of what this role grants. */
-            description?: string;
-            /** @description Permission strings to include (e.g. "mobius.workflow.create"). */
-            permissions: string[];
-        };
-        UpdateRoleRequest: {
-            /** @description Replacement description. */
-            description?: string;
-            /** @description Replaces the existing permissions array entirely. */
-            permissions?: string[];
-        };
-        CreateRoleAssignmentRequest: {
-            /**
-             * @description Type of actor to assign the role to: `user` or `service_account`.
-             * @enum {string}
-             */
-            actor_type: "user" | "service_account";
-            /** @description User ID or service account ID to assign the role to. */
-            actor_id: string;
-            /** @description Mutually exclusive with `role_name`. */
-            role_id?: string;
-            /** @description Resolved to a role ID server-side. Mutually exclusive with `role_id`. */
-            role_name?: string;
-            /** @description Scope this assignment to a project. Omit for org-wide assignment. */
-            project_id?: string;
-        } & (unknown | unknown);
-        /** @description Human identity known to the organization. User records are useful for membership lists, role assignment UIs, attribution, and displaying profile information next to actions. */
-        User: {
-            /** @description Clerk user ID. Stable and globally unique across all orgs. */
-            id: string;
-            /** @description Primary email address from Clerk. */
-            email: string;
-            /** @description User's first name from their Clerk profile. */
-            first_name?: string;
-            /** @description User's last name from their Clerk profile. */
-            last_name?: string;
-            /** @description Profile avatar URL from Clerk (may be a Gravatar or uploaded image). */
-            avatar_url?: string;
-            /**
-             * Format: date-time
-             * @description When the user record was first mirrored into Mobius.
-             */
-            created_at: string;
-            /**
-             * Format: date-time
-             * @description Timestamp when this user record was last synced from Clerk.
-             */
-            updated_at: string;
-        };
-        /**
-         * @description One of the built-in system roles: `Owner`, `Admin`, `Operator`, `Worker`, or `Viewer`. These are seeded at startup and cannot be deleted. `Owner` and `Admin` bypass project-member visibility for restricted projects.
-         * @enum {string}
-         */
-        SystemRoleName: "Owner" | "Admin" | "Operator" | "Worker" | "Viewer";
-        /** @description Top-level account boundary for users, projects, billing, roles, and shared settings. Use the org to understand default access policy and the handle/name shown across the workspace. */
-        Org: {
-            /** @description Unique identifier for this organization. */
-            id: string;
-            /** @description Human-readable org name. */
-            name: string;
-            /** @description URL-safe slug used in API routes and display. Unique across all orgs. */
-            handle: string;
-            /** @description Arbitrary key-value metadata stored alongside the org. */
-            metadata?: {
-                [key: string]: unknown;
-            };
-            /** @description System-role name assigned at org scope to new org members. Defaults to `Operator`. */
-            default_member_role?: components["schemas"]["SystemRoleName"];
-            /**
-             * @description Access mode applied to newly-created projects when the caller does not pass one explicitly: `org_open` or `restricted`. Changing this only affects future projects.
-             * @enum {string}
-             */
-            default_project_access_mode?: "org_open" | "restricted";
+            events: string[];
+            /** @description When false, matching events are not delivered. */
+            enabled: boolean;
+            /** @description User ID of the org member who created this webhook. */
+            created_by?: string;
+            /** @description Resource tags applied to this webhook. */
+            tags?: components["schemas"]["TagMap"];
             /**
              * Format: date-time
-             * @description Timestamp when this organization was created.
+             * @description Timestamp when this webhook was created.
              */
             created_at: string;
             /**
              * Format: date-time
-             * @description Timestamp when this organization was last updated.
+             * @description Timestamp when this webhook was last updated.
              */
             updated_at: string;
         };
-        OrgListResponse: {
+        WebhookListResponse: {
             /** @description The list of results for this page. */
-            items: components["schemas"]["Org"][];
-            /** @description Whether additional pages are available. */
-            has_more?: boolean;
+            items?: components["schemas"]["Webhook"][];
             /** @description Opaque cursor to pass as `cursor` on the next request. Absent when `has_more` is false. */
             next_cursor?: string;
+            /** @description Whether additional pages are available. */
+            has_more: boolean;
         };
-        CreateOrgRequest: {
-            /** @description Human-readable organization name. */
-            name: string;
-            /** @description URL-safe slug. Must be globally unique across all orgs. */
-            handle: string;
-            /** @description Arbitrary metadata to attach to the organization. */
-            metadata?: {
-                [key: string]: unknown;
-            };
-        };
-        UpdateOrgRequest: {
-            /** @description Must be non-empty if provided. */
-            name?: string;
-            /** @description Must be non-empty if provided. Changing the handle affects all API route URLs for this org. */
-            handle?: string;
-            /** @description Replacement metadata. */
-            metadata?: {
-                [key: string]: unknown;
-            };
-            /** @description System-role name assigned to new org members at org scope. */
-            default_member_role?: components["schemas"]["SystemRoleName"];
-            /**
-             * @description Access mode applied to newly-created projects: `org_open` or `restricted`.
-             * @enum {string}
-             */
-            default_project_access_mode?: "org_open" | "restricted";
-        };
-        /** @description User's membership in an organization. Use this record to show who belongs to the org, what their broad org role is, and any embedded user profile needed for member management. */
-        OrgMember: {
-            /** @description Unique identifier for this membership record. */
+        /** @description One delivery record for a webhook event. The daemon claims pending rows, POSTs the payload, and transitions to `delivered` or retries on failure. A delivery reaches `failed` only after exhausting all 10 retry attempts. */
+        WebhookDelivery: {
+            /** @description Unique identifier for this delivery record. */
             id: string;
-            /** @description ID of the user who is a member. */
-            user_id: string;
-            /**
-             * @description `Owner` has full control including org deletion; `Admin` can manage members and settings; `Member` has read-only org access.
-             * @enum {string}
-             */
-            role: "Owner" | "Admin" | "Member";
+            /** @description ID of the webhook this delivery belongs to. */
+            webhook_id: string;
+            /** @description Run that triggered the event, when applicable. */
+            run_id?: string;
+            /** @description The event type that triggered this delivery (e.g. `run.completed`). */
+            event_type: string;
+            /** @description Current delivery status: `pending`, `delivered`, or `failed`. */
+            status: components["schemas"]["WebhookDeliveryStatus"];
+            /** @description Number of delivery attempts made so far. Max 10. */
+            attempts: number;
+            /** @description Error message from the most recent failed attempt. */
+            last_error?: string;
             /**
              * Format: date-time
-             * @description Timestamp when this member joined.
+             * @description Timestamp when this delivery was first attempted.
              */
             created_at: string;
             /**
              * Format: date-time
-             * @description Timestamp when this membership was last updated.
+             * @description Timestamp of the successful delivery. Absent until delivered.
              */
-            updated_at: string;
-            /** @description Embedded user profile for this organization member. */
-            user?: components["schemas"]["User"];
+            delivered_at?: string;
         };
-        OrgMemberListResponse: {
+        WebhookDeliveryListResponse: {
             /** @description The list of results for this page. */
-            items: components["schemas"]["OrgMember"][];
-            /** @description Whether additional pages are available. */
-            has_more?: boolean;
+            items?: components["schemas"]["WebhookDelivery"][];
             /** @description Opaque cursor to pass as `cursor` on the next request. Absent when `has_more` is false. */
             next_cursor?: string;
+            /** @description Whether additional pages are available. */
+            has_more: boolean;
         };
-        AddOrgMemberRequest: {
-            /** @description Clerk user ID of the user to add. */
-            user_id: string;
+        CreateWebhookRequest: {
+            /** @description Human-readable name, unique within the project. */
+            name: string;
+            /** @description The endpoint Mobius will POST event payloads to. May be left empty at creation time so a candidate URL can be tested via the ping endpoint before it is saved; events do not fire for webhooks with an empty URL. */
+            url?: string;
+            /** @description Optional HMAC-SHA256 secret. When set, Mobius signs each POST body and includes `X-Mobius-Signature: sha256=<hex>` in the request headers. */
+            signing_secret?: string;
+            /** @description Event types to subscribe to. Use wildcards for broad subscriptions, e.g. `["run.*"]` for all run events. */
+            events: string[];
+            /** @description Whether the webhook starts enabled. Defaults to true when omitted. */
+            enabled?: boolean;
+            /** @description Initial tag set. */
+            tags?: components["schemas"]["TagMap"];
+        };
+        UpdateWebhookRequest: {
+            /** @description Replacement human-readable name. */
+            name?: string;
+            /** @description Replacement endpoint URL. */
+            url?: string;
+            /** @description Replace the current signing secret. Set to empty string to disable signing. Omit to leave the current secret unchanged. */
+            signing_secret?: string;
+            /** @description Replacement event subscriptions. Replaces the entire current list. */
+            events?: string[];
+            /** @description Set to false to disable delivery without deleting the webhook. */
+            enabled?: boolean;
+            /** @description When supplied, replaces the user tag set on the webhook. System tags (`mobius:*`) are preserved. */
+            tags?: components["schemas"]["TagMap"];
+        };
+        PingWebhookRequest: {
+            /** @description URL to test. When supplied, the ping is sent to this URL instead of the webhook's saved URL — use this to validate a candidate URL before saving it. When omitted, the webhook's current saved URL is used. */
+            url?: string;
+        };
+        PingWebhookResult: {
+            /** @description True if the target responded with a 2xx status code. */
+            success: boolean;
+            /** @description HTTP status code returned by the target. Absent on network error. */
+            status_code?: number;
+            /** @description Error message if the request could not be completed. */
+            error?: string;
+            /** @description Round-trip latency in milliseconds. */
+            latency_ms?: number;
+        };
+        /** @description Operational health snapshot for a project. Use it to power dashboards, detect stuck queues or stale workers, and summarize run throughput and failure rates over a recent window. */
+        ProjectMetrics: {
             /**
-             * @description Role to assign the new member: `Owner`, `Admin`, or `Member`.
-             * @enum {string}
+             * Format: date-time
+             * @description Timestamp when this metrics snapshot was computed.
              */
-            role: "Owner" | "Admin" | "Member";
-        };
-        UpdateOrgMemberRoleRequest: {
+            generated_at: string;
+            /** @description Rolling window width used for rate and failure metrics. Default is 60 minutes. */
+            window_minutes: number;
             /**
-             * @description New role to assign: `Owner`, `Admin`, or `Member`.
-             * @enum {string}
+             * Format: double
+             * @description Average number of new workflow runs started per minute within the window.
+             */
+            runs_per_minute: number;
+            /** @description Total number of workflow runs started within the window. */
+            total_runs_window: number;
+            /**
+             * Format: double
+             * @description Fraction of completed runs that ended in `failed` status within the window. Range 0.0–1.0.
+             */
+            failure_rate: number;
+            /**
+             * Format: double
+             * @description Mean wall-clock duration of completed runs within the window, in seconds.
+             */
+            avg_run_seconds: number;
+            /**
+             * Format: double
+             * @description 95th-percentile job duration (claim time to terminal state) computed across the 40 most recent completed jobs, in seconds. Use this to detect slow or stuck steps.
              */
-            role: "Owner" | "Admin" | "Member";
+            p95_step_seconds: number;
+            /** @description Number of jobs currently in `pending` state waiting to be claimed. */
+            queue_depth: number;
+            /** @description Number of workflow runs currently in the `active` lifecycle. */
+            running_count: number;
+            /** @description Number of workers whose `last_seen_at` is within the 2-minute staleness threshold. */
+            active_workers: number;
+            /** @description Number of workers whose `last_seen_at` has exceeded the 2-minute staleness threshold. */
+            stale_workers: number;
+            /** @description Map of workflow run status → count across all runs in the project (not windowed). Includes all terminal and in-progress statuses. */
+            status_breakdown: {
+                [key: string]: number;
+            };
         };
         InteractionListResponse: {
             /** @description The list of results for this page. */
@@ -4431,7 +3891,7 @@ export interface components {
              */
             expires_at?: string;
         };
-        /** @description Creates a run-backed interaction. Completion delivers `signal_name` to `run_id` so a suspended workflow branch can resume. */
+        /** @description Creates a run-backed interaction. Completion delivers `signal_name` to `run_id` so a waiting run path can resume. */
         CreateRunBackedInteractionRequest: {
             /** @description ID of the workflow run to resume when this interaction is completed. */
             run_id: string;
@@ -4463,11 +3923,6 @@ export interface components {
             /** @description Optional free-text comment accompanying the response. */
             comment?: string;
         };
-        /** @description Start of the Slack OAuth installation flow. Redirect users to the authorize URL when they want to connect a Slack workspace to a project. */
-        SlackInstall: {
-            /** @description The Slack OAuth authorize URL to redirect the user to. */
-            authorize_url: string;
-        };
         /** @description Project-scoped collection of users used as an interaction target. Groups let workflows route approvals, reviews, and input requests to a team by handle rather than hard-coding individual users. */
         Group: {
             /** @description Unique identifier for this group. */
@@ -4605,6 +4060,8 @@ export interface components {
             status: components["schemas"]["AgentStatus"];
             /** @description Current agent presence: `online`, `offline`, or `unknown`. */
             presence: components["schemas"]["AgentPresence"];
+            /** @description Resource tags applied to this agent. */
+            tags?: components["schemas"]["TagMap"];
             /**
              * Format: date-time
              * @description Timestamp when this agent was created.
@@ -4681,6 +4138,8 @@ export interface components {
             config?: {
                 [key: string]: unknown;
             };
+            /** @description Initial tag set. */
+            tags?: components["schemas"]["TagMap"];
         };
         UpdateAgentRequest: {
             /** @description Replacement service account. Must be active and belong to the same project. */
@@ -4701,6 +4160,8 @@ export interface components {
             };
             /** @description Replacement agent status: `active` or `disabled`. */
             status?: components["schemas"]["AgentStatus"];
+            /** @description When supplied, replaces the user tag set on the agent. System tags (`mobius:*`) are preserved. */
+            tags?: components["schemas"]["TagMap"];
         };
         CreateAgentSessionRequest: {
             /** @description Connection mechanism identifier (e.g. "sse", "polling"). */
@@ -4710,68 +4171,6 @@ export interface components {
                 [key: string]: unknown;
             };
         };
-        /**
-         * @description `active` allows authentication and job claims; `disabled` blocks them but preserves the record and its assignments.
-         * @enum {string}
-         */
-        ServiceAccountStatus: "active" | "disabled";
-        /** @description Non-human identity used by automation, agents, and API keys. Service accounts make ownership, permissions, and credential rotation explicit without tying machine access to a human user. */
-        ServiceAccount: {
-            /** @description Unique identifier for this service account. */
-            id: string;
-            /** @description Human-readable name for this service account. Immutable after creation. */
-            name: string;
-            /** @description Optional human-readable description. */
-            description?: string;
-            /** @description Current service account status: `active` or `disabled`. */
-            status: components["schemas"]["ServiceAccountStatus"];
-            /** @description Optional org member responsible for this service account. */
-            owner_user_id?: string;
-            /** @description Arbitrary key-value metadata. Subject to size and nesting depth limits. */
-            metadata?: {
-                [key: string]: unknown;
-            };
-            /**
-             * Format: date-time
-             * @description Timestamp when this service account was created.
-             */
-            created_at: string;
-            /**
-             * Format: date-time
-             * @description Timestamp when this service account was last updated.
-             */
-            updated_at: string;
-        };
-        ServiceAccountListResponse: {
-            /** @description The list of results for this page. */
-            items: components["schemas"]["ServiceAccount"][];
-        };
-        CreateServiceAccountRequest: {
-            /** @description Human-readable name for this service account. Immutable after creation. */
-            name: string;
-            /** @description Optional human-readable description. */
-            description?: string;
-            /** @description Org member responsible for this service account. */
-            owner_user_id?: string;
-            /** @description Arbitrary metadata to attach to the service account. */
-            metadata?: {
-                [key: string]: unknown;
-            };
-            /** @description One or more role IDs to assign at creation time. All assignments are created atomically with the service account. Requires `mobius.permission.manage`. Each role must belong to this project or be org-scoped (project_id empty). */
-            role_ids?: string[];
-        };
-        UpdateServiceAccountRequest: {
-            /** @description Replacement description. */
-            description?: string;
-            /** @description Replacement service account status: `active` or `disabled`. */
-            status?: components["schemas"]["ServiceAccountStatus"];
-            /** @description ID of the org member responsible for this service account. */
-            owner_user_id?: string;
-            /** @description Replacement metadata. */
-            metadata?: {
-                [key: string]: unknown;
-            };
-        };
         /** @description Published workflow exposed as an invokable tool. Clients can use this definition to list available tools and render input forms from the JSON Schema before starting a run. */
         ToolDefinition: {
             /** @description Tool name (workflow handle). Stable across publish/unpublish cycles. */
@@ -4792,7 +4191,7 @@ export interface components {
             input?: {
                 [key: string]: unknown;
             };
-            /** @description How long (in seconds) to wait for synchronous completion. Default 30, max 120. If the run does not complete within this window the response is 202 with status pending. */
+            /** @description How long (in seconds) to wait for synchronous completion. Default 30, max 120. If the run does not complete within this window the response is 202 with status active. */
             timeout_seconds?: number;
         };
         /** @description Status envelope for a tool invocation backed by a workflow run. Use it to poll asynchronous work, read completed output, or surface failure details to the caller. */
@@ -4800,10 +4199,10 @@ export interface components {
             /** @description Unique run identifier for polling. */
             run_id: string;
             /**
-             * @description Run status: `pending`, `running`, `completed`, `failed`, or `suspended`.
+             * @description Workflow run lifecycle: `active`, `completed`, or `failed`.
              * @enum {string}
              */
-            status: "pending" | "running" | "completed" | "failed" | "suspended";
+            status: "active" | "completed" | "failed";
             /** @description Run output. Present when status is "completed". */
             output?: {
                 [key: string]: unknown;
@@ -4917,12 +4316,22 @@ export interface components {
         CursorParam: string;
         /** @description Maximum number of items to return */
         LimitParam: number;
+        /**
+         * @description Filter results by tag. Repeatable; multiple values combine with AND. Format: `Key:Value`, `Key:*` for any value, `Key:a,b,c` for IN.
+         *
+         *     Tag values containing `:` or `,` cannot be filtered with this grammar — the parser splits on those literally. Constrain values to plain identifiers when you intend to filter on them.
+         *
+         *     Not supported on the runs list — runs are too high-cardinality for ad-hoc tag filtering. To narrow runs by parent workflow, use the workflow-scoped endpoint `GET /v1/projects/{project}/workflows/{id}/runs` and inspect `tags` on each run client-side.
+         */
+        TagFilterParam: string[];
         /** @description Optional project scope for this request. When `project_id` is provided, the API key operation is resolved in that project's permission context. When `project_id` is omitted, the request is treated as org-level and project-pinned keys are excluded. */
         APIKeyProjectIDParam: components["schemas"]["ProjectID"];
         /** @description Trigger target ID. */
         TriggerTargetIDParam: string;
         /** @description Group ID or handle. */
         GroupParam: string;
+        /** @description Widget ID within the dashboard. */
+        widget_id: string;
     };
     requestBodies: never;
     headers: never;
@@ -4937,6 +4346,14 @@ export interface operations {
                 kind?: "dm" | "channel";
                 /** @description Filter by private flag. */
                 private?: boolean;
+                /**
+                 * @description Filter results by tag. Repeatable; multiple values combine with AND. Format: `Key:Value`, `Key:*` for any value, `Key:a,b,c` for IN.
+                 *
+                 *     Tag values containing `:` or `,` cannot be filtered with this grammar — the parser splits on those literally. Constrain values to plain identifiers when you intend to filter on them.
+                 *
+                 *     Not supported on the runs list — runs are too high-cardinality for ad-hoc tag filtering. To narrow runs by parent workflow, use the workflow-scoped endpoint `GET /v1/projects/{project}/workflows/{id}/runs` and inspect `tags` on each run client-side.
+                 */
+                tag?: components["parameters"]["TagFilterParam"];
                 /** @description Cursor for pagination (opaque string from previous response) */
                 cursor?: components["parameters"]["CursorParam"];
                 /** @description Maximum number of items to return */
@@ -5317,7 +4734,7 @@ export interface operations {
                 actor_type?: string;
                 /** @description Filter by actor ID */
                 actor_id?: string;
-                /** @description Filter by action (create, update, delete) */
+                /** @description Filter by action (create, update, delete, archive, restore) */
                 action?: string;
                 /** @description Filter to entries created after this timestamp */
                 created_after?: string;
@@ -5349,6 +4766,14 @@ export interface operations {
     listWorkflows: {
         parameters: {
             query?: {
+                /**
+                 * @description Filter results by tag. Repeatable; multiple values combine with AND. Format: `Key:Value`, `Key:*` for any value, `Key:a,b,c` for IN.
+                 *
+                 *     Tag values containing `:` or `,` cannot be filtered with this grammar — the parser splits on those literally. Constrain values to plain identifiers when you intend to filter on them.
+                 *
+                 *     Not supported on the runs list — runs are too high-cardinality for ad-hoc tag filtering. To narrow runs by parent workflow, use the workflow-scoped endpoint `GET /v1/projects/{project}/workflows/{id}/runs` and inspect `tags` on each run client-side.
+                 */
+                tag?: components["parameters"]["TagFilterParam"];
                 /** @description Opaque pagination cursor returned from the previous response. */
                 cursor?: string;
                 /** @description Maximum number of results to return per page. */
@@ -5654,6 +5079,15 @@ export interface operations {
             400: components["responses"]["BadRequest"];
             401: components["responses"]["Unauthorized"];
             404: components["responses"]["NotFound"];
+            /** @description Conflict — the target project is archived. Code `project_archived`. Restore the project before starting new runs; in-flight runs continue regardless. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
             429: components["responses"]["TooManyRequests"];
         };
     };
@@ -5728,7 +5162,23 @@ export interface operations {
                      *       "definition_version": 3,
                      *       "ephemeral": false,
                      *       "workflow_name": "document-review",
-                     *       "status": "queued",
+                     *       "status": "active",
+                     *       "path_counts": {
+                     *         "total": 1,
+                     *         "active": 1,
+                     *         "working": 1,
+                     *         "waiting": 0,
+                     *         "completed": 0,
+                     *         "failed": 0
+                     *       },
+                     *       "wait_summary": {
+                     *         "waiting_paths": 0,
+                     *         "kind_counts": {},
+                     *         "next_wake_at": null,
+                     *         "waiting_on_signal_names": [],
+                     *         "interaction_ids": []
+                     *       },
+                     *       "errors": [],
                      *       "attempt": 1,
                      *       "inputs": {
                      *         "document_id": "doc_01hw1m9z8y7x6w5v4u3t2s1r0q"
@@ -5752,6 +5202,15 @@ export interface operations {
             400: components["responses"]["BadRequest"];
             401: components["responses"]["Unauthorized"];
             404: components["responses"]["NotFound"];
+            /** @description Conflict — the target project is archived. Code `project_archived`. Restore the project before starting new runs; in-flight runs continue regardless. */
+            409: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorResponse"];
+                };
+            };
             429: components["responses"]["TooManyRequests"];
         };
     };
@@ -5860,7 +5319,7 @@ export interface operations {
                     /**
                      * @example event: run_updated
                      *     id: 42
-                     *     data: {"type":"run_updated","run_id":"run_01hw1n1a2b3c4d5e6f7g8h9j0k","seq":42,"timestamp":"2026-04-24T14:45:00Z","data":{"status":"running"}}
+                     *     data: {"type":"run_updated","run_id":"run_01hw1n1a2b3c4d5e6f7g8h9j0k","seq":42,"timestamp":"2026-04-24T14:45:00Z","data":{"status":"active"}}
                      *
                      *     :keepalive
                      */
@@ -6560,6 +6019,14 @@ export interface operations {
                 kind?: components["schemas"]["TriggerKind"];
                 /** @description Filter to enabled or disabled triggers. */
                 enabled?: boolean;
+                /**
+                 * @description Filter results by tag. Repeatable; multiple values combine with AND. Format: `Key:Value`, `Key:*` for any value, `Key:a,b,c` for IN.
+                 *
+                 *     Tag values containing `:` or `,` cannot be filtered with this grammar — the parser splits on those literally. Constrain values to plain identifiers when you intend to filter on them.
+                 *
+                 *     Not supported on the runs list — runs are too high-cardinality for ad-hoc tag filtering. To narrow runs by parent workflow, use the workflow-scoped endpoint `GET /v1/projects/{project}/workflows/{id}/runs` and inspect `tags` on each run client-side.
+                 */
+                tag?: components["parameters"]["TagFilterParam"];
                 /** @description Opaque pagination cursor returned from the previous response. */
                 cursor?: string;
                 /** @description Maximum number of results to return per page. */
@@ -6997,6 +6464,16 @@ export interface operations {
             query?: {
                 /** @description Prefix-match filter applied to project name and handle. */
                 search?: string;
+                /** @description Lifecycle filter. `active` (default) returns non-archived projects; `archived` returns archived projects only; `all` returns both. */
+                status?: "active" | "archived" | "all";
+                /**
+                 * @description Filter results by tag. Repeatable; multiple values combine with AND. Format: `Key:Value`, `Key:*` for any value, `Key:a,b,c` for IN.
+                 *
+                 *     Tag values containing `:` or `,` cannot be filtered with this grammar — the parser splits on those literally. Constrain values to plain identifiers when you intend to filter on them.
+                 *
+                 *     Not supported on the runs list — runs are too high-cardinality for ad-hoc tag filtering. To narrow runs by parent workflow, use the workflow-scoped endpoint `GET /v1/projects/{project}/workflows/{id}/runs` and inspect `tags` on each run client-side.
+                 */
+                tag?: components["parameters"]["TagFilterParam"];
             };
             header?: never;
             path?: never;
@@ -7089,6 +6566,7 @@ export interface operations {
             };
             401: components["responses"]["Unauthorized"];
             404: components["responses"]["NotFound"];
+            409: components["responses"]["Conflict"];
         };
     };
     updateProject: {
@@ -7122,6 +6600,56 @@ export interface operations {
             409: components["responses"]["Conflict"];
         };
     };
+    archiveProject: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Resource ID. */
+                id: components["parameters"]["IDParam"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Project"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            404: components["responses"]["NotFound"];
+        };
+    };
+    restoreProject: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description Resource ID. */
+                id: components["parameters"]["IDParam"];
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description OK */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Project"];
+                };
+            };
+            401: components["responses"]["Unauthorized"];
+            404: components["responses"]["NotFound"];
+        };
+    };
     getProjectConfig: {
         parameters: {
             query?: never;
@@ -7306,6 +6834,14 @@ export interface operations {
             query?: {
                 /** @description Filter by enabled/disabled state. */
                 enabled?: boolean;
+                /**
+                 * @description Filter results by tag. Repeatable; multiple values combine with AND. Format: `Key:Value`, `Key:*` for any value, `Key:a,b,c` for IN.
+                 *
+                 *     Tag values containing `:` or `,` cannot be filtered with this grammar — the parser splits on those literally. Constrain values to plain identifiers when you intend to filter on them.
+                 *
+                 *     Not supported on the runs list — runs are too high-cardinality for ad-hoc tag filtering. To narrow runs by parent workflow, use the workflow-scoped endpoint `GET /v1/projects/{project}/workflows/{id}/runs` and inspect `tags` on each run client-side.
+                 */
+                tag?: components["parameters"]["TagFilterParam"];
                 /** @description Opaque pagination cursor returned from the previous response. */
                 cursor?: string;
                 /** @description Maximum number of results to return per page. */
@@ -8152,6 +7688,14 @@ export interface operations {
                 service_account_id?: string;
                 /** @description Filter by administrative status (active/inactive), independent of presence. */
                 status?: components["schemas"]["AgentStatus"];
+                /**
+                 * @description Filter results by tag. Repeatable; multiple values combine with AND. Format: `Key:Value`, `Key:*` for any value, `Key:a,b,c` for IN.
+                 *
+                 *     Tag values containing `:` or `,` cannot be filtered with this grammar — the parser splits on those literally. Constrain values to plain identifiers when you intend to filter on them.
+                 *
+                 *     Not supported on the runs list — runs are too high-cardinality for ad-hoc tag filtering. To narrow runs by parent workflow, use the workflow-scoped endpoint `GET /v1/projects/{project}/workflows/{id}/runs` and inspect `tags` on each run client-side.
+                 */
+                tag?: components["parameters"]["TagFilterParam"];
                 /** @description Maximum number of items to return */
                 limit?: components["parameters"]["LimitParam"];
             };
@@ -8537,7 +8081,7 @@ export interface operations {
                     "application/json": components["schemas"]["ToolRun"];
                 };
             };
-            /** @description Accepted — run is pending; poll for result */
+            /** @description Accepted — run is active; poll for result */
             202: {
                 headers: {
                     [name: string]: unknown;
@@ -8546,7 +8090,7 @@ export interface operations {
                     /**
                      * @example {
                      *       "run_id": "run_01hw1n1a2b3c4d5e6f7g8h9j0k",
-                     *       "status": "pending"
+                     *       "status": "active"
                      *     }
                      */
                     "application/json": components["schemas"]["ToolRun"];