@distilled.cloud/archil 0.0.0 → 1.0.0-rc.10

package/src/services/archil.ts

@@ -0,0 +1,1784 @@
+// AUTO-GENERATED by scripts/generate.ts from .generated-specs (specs/spec-mirror-archil). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import * as Redacted from "effect/Redacted";
+import * as API from "@distilled.cloud/core/api";
+import * as C from "@distilled.cloud/core/category";
+import * as T from "../traits.ts";
+import {
+  ArchilProtocol,
+  type ArchilOpError,
+  type ArchilOpContext,
+} from "../protocol.ts";
+import { UnknownArchilError } from "../errors.ts";
+import * as Retry from "../retry.ts";
+
+export type { ArchilOpError, ArchilOpContext };
+
+export class BadRequest
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<BadRequest>()("BadRequest", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withBadRequestError),
+    [{ status: 400 }],
+  ) {}
+
+export class Conflict
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<Conflict>()("Conflict", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withConflictError),
+    [{ status: 409 }],
+  ) {}
+
+export class Forbidden
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<Forbidden>()("Forbidden", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withAuthError),
+    [{ status: 403 }],
+  ) {}
+
+export class NotFound
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<NotFound>()("NotFound", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withBadRequestError),
+    [{ status: 404 }],
+  ) {}
+
+export type TokenUserType = "token";
+export const TokenUserType = S.String;
+
+export interface TokenUser {
+  type: TokenUserType;
+  /** Deprecated. Client-provided token. If omitted, the server generates a cryptographically secure token and returns it in the response. */
+  principal?: string;
+  nickname: string;
+  /** Deprecated. Last 4 characters of the token. Required when principal is provided; ignored when the server generates the token. */
+  tokenSuffix?: string;
+}
+export const TokenUser = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    type: TokenUserType,
+    principal: S.optional(S.String),
+    nickname: S.String,
+    tokenSuffix: S.optional(S.String),
+  }),
+).annotate({ identifier: "TokenUser" }) as any as S.Schema<TokenUser>;
+
+export type AwsStsUserType = "awssts";
+export const AwsStsUserType = S.String;
+
+export interface AwsStsUser {
+  type: AwsStsUserType;
+  /** IAM principal ARN */
+  principal: string;
+}
+export const AwsStsUser = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    type: AwsStsUserType,
+    principal: S.String,
+  }),
+).annotate({ identifier: "AwsStsUser" }) as any as S.Schema<AwsStsUser>;
+
+export type DiskUser = TokenUser | AwsStsUser;
+export const DiskUser = S.Unknown as any as S.Schema<DiskUser>;
+
+export interface AddDiskUserRequest {
+  /** Disk ID (format `dsk-{16 hex chars}`) */
+  id: string;
+  body: DiskUser;
+}
+export const AddDiskUserRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    id: S.String.pipe(T.Label()),
+    body: DiskUser.pipe(T.HttpBody()),
+  }).pipe(T.Http({ method: "POST", uri: "/api/disks/{id}/users", code: 200 })),
+).annotate({
+  identifier: "AddDiskUserRequest",
+}) as any as S.Schema<AddDiskUserRequest>;
+
+export type AuthorizedUserType = "token" | "awssts";
+export const AuthorizedUserType = S.String;
+
+export interface AuthorizedUser {
+  type?: AuthorizedUserType;
+  /** Use identifier instead. Only populated for awssts type (the IAM ARN). */
+  principal?: string;
+  nickname?: string;
+  tokenSuffix?: string;
+  /** The generated disk token (used by clients when mounting the disk). Only present in the response when the server generates the token (i.e. principal was not provided). This value is shown exactly once and cannot be retrieved again. */
+  token?: string;
+  /** Stable identifier for this user, returned in creation and list responses. Use this value with DELETE /api/disks/{id}/users/{type}?identifier={identifier} to remove the user. For awssts users, this is the IAM ARN. */
+  identifier?: string;
+  createdAt?: string;
+}
+export const AuthorizedUser = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    type: S.optional(AuthorizedUserType),
+    principal: S.optional(S.String),
+    nickname: S.optional(S.String),
+    tokenSuffix: S.optional(S.String),
+    token: S.optional(S.String),
+    identifier: S.optional(S.String),
+    createdAt: S.optional(S.String),
+  }),
+).annotate({ identifier: "AuthorizedUser" }) as any as S.Schema<AuthorizedUser>;
+
+export interface ApiResponseAuthorizedUser {
+  success: boolean;
+  data: AuthorizedUser;
+}
+export const ApiResponseAuthorizedUser = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    success: S.Boolean,
+    data: AuthorizedUser,
+  }),
+).annotate({
+  identifier: "ApiResponseAuthorizedUser",
+}) as any as S.Schema<ApiResponseAuthorizedUser>;
+
+export interface CreateApiTokenRequest {
+  /** Token name */
+  name: string;
+  /** Token description */
+  description?: string;
+}
+export const CreateApiTokenRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String,
+    description: S.optional(S.String),
+  }).pipe(T.Http({ method: "POST", uri: "/api/tokens", code: 200 })),
+).annotate({
+  identifier: "CreateApiTokenRequest",
+}) as any as S.Schema<CreateApiTokenRequest>;
+
+export interface ApiResponseTokenCreatedData {
+  /** Token hash/ID */
+  id?: string;
+  name?: string;
+  description?: string;
+  /** Last 4 characters of the token */
+  tokenSuffix?: string;
+  createdAt?: string;
+  lastUsedAt?: string;
+  /** Full token value (only shown at creation) */
+  token?: string;
+}
+export const ApiResponseTokenCreatedData = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    id: S.optional(S.String),
+    name: S.optional(S.String),
+    description: S.optional(S.String),
+    tokenSuffix: S.optional(S.String),
+    createdAt: S.optional(S.String),
+    lastUsedAt: S.optional(S.String),
+    token: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "ApiResponseTokenCreatedData",
+}) as any as S.Schema<ApiResponseTokenCreatedData>;
+
+export interface ApiResponseTokenCreated {
+  success: boolean;
+  data: ApiResponseTokenCreatedData;
+}
+export const ApiResponseTokenCreated = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    success: S.Boolean,
+    data: ApiResponseTokenCreatedData,
+  }),
+).annotate({
+  identifier: "ApiResponseTokenCreated",
+}) as any as S.Schema<ApiResponseTokenCreated>;
+
+/** Mount type identifier */
+export type S3MountType = "s3";
+export const S3MountType = S.String;
+
+/** Mount configuration for Amazon S3 buckets */
+export interface S3Mount {
+  /** Mount type identifier */
+  type: S3MountType;
+  /** S3 bucket name */
+  bucketName: string;
+  /** AWS access key ID (optional for public buckets or IAM role auth) */
+  accessKeyId?: string | Redacted.Redacted<string>;
+  /** AWS secret access key */
+  secretAccessKey?: string | Redacted.Redacted<string>;
+  /** Session token for temporary credentials */
+  sessionToken?: string | Redacted.Redacted<string>;
+  /** Prefix within the bucket */
+  bucketPrefix?: string;
+}
+export const S3Mount = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    type: S3MountType,
+    bucketName: S.String,
+    accessKeyId: S.optional(S.String.pipe(T.SensitiveValue({}))),
+    secretAccessKey: S.optional(S.String.pipe(T.SensitiveValue({}))),
+    sessionToken: S.optional(S.String.pipe(T.SensitiveValue({}))),
+    bucketPrefix: S.optional(S.String),
+  }),
+).annotate({ identifier: "S3Mount" }) as any as S.Schema<S3Mount>;
+
+/** Mount type identifier */
+export type GCSMountType = "gcs";
+export const GCSMountType = S.String;
+
+/** Mount configuration for Google Cloud Storage buckets */
+export interface GCSMount {
+  /** Mount type identifier */
+  type: GCSMountType;
+  /** GCS bucket name */
+  bucketName: string;
+  /** HMAC access key ID */
+  accessKeyId: string | Redacted.Redacted<string>;
+  /** HMAC secret access key */
+  secretAccessKey: string | Redacted.Redacted<string>;
+  /** Prefix within the bucket (optional) */
+  bucketPrefix?: string;
+}
+export const GCSMount = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    type: GCSMountType,
+    bucketName: S.String,
+    accessKeyId: S.String.pipe(T.SensitiveValue({})),
+    secretAccessKey: S.String.pipe(T.SensitiveValue({})),
+    bucketPrefix: S.optional(S.String),
+  }),
+).annotate({ identifier: "GCSMount" }) as any as S.Schema<GCSMount>;
+
+/** Mount type identifier */
+export type R2MountType = "r2";
+export const R2MountType = S.String;
+
+/** Mount configuration for Cloudflare R2 buckets */
+export interface R2Mount {
+  /** Mount type identifier */
+  type: R2MountType;
+  /** R2 bucket name */
+  bucketName: string;
+  /** R2 endpoint URL */
+  bucketEndpoint: string;
+  /** R2 access key ID */
+  accessKeyId: string | Redacted.Redacted<string>;
+  /** R2 secret access key */
+  secretAccessKey: string | Redacted.Redacted<string>;
+  /** Prefix within the bucket (optional) */
+  bucketPrefix?: string;
+}
+export const R2Mount = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    type: R2MountType,
+    bucketName: S.String,
+    bucketEndpoint: S.String,
+    accessKeyId: S.String.pipe(T.SensitiveValue({})),
+    secretAccessKey: S.String.pipe(T.SensitiveValue({})),
+    bucketPrefix: S.optional(S.String),
+  }),
+).annotate({ identifier: "R2Mount" }) as any as S.Schema<R2Mount>;
+
+/** Mount type identifier */
+export type S3CompatibleMountType = "s3-compatible";
+export const S3CompatibleMountType = S.String;
+
+/** Mount configuration for S3-compatible storage (MinIO, Backblaze B2, etc.) */
+export interface S3CompatibleMount {
+  /** Mount type identifier */
+  type: S3CompatibleMountType;
+  /** Bucket name */
+  bucketName: string;
+  /** S3-compatible endpoint URL */
+  bucketEndpoint: string;
+  /** Access key ID */
+  accessKeyId: string | Redacted.Redacted<string>;
+  /** Secret access key */
+  secretAccessKey: string | Redacted.Redacted<string>;
+  /** Prefix within the bucket (optional) */
+  bucketPrefix?: string;
+}
+export const S3CompatibleMount = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    type: S3CompatibleMountType,
+    bucketName: S.String,
+    bucketEndpoint: S.String,
+    accessKeyId: S.String.pipe(T.SensitiveValue({})),
+    secretAccessKey: S.String.pipe(T.SensitiveValue({})),
+    bucketPrefix: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "S3CompatibleMount",
+}) as any as S.Schema<S3CompatibleMount>;
+
+/** Mount type identifier */
+export type AzureBlobMountType = "azure-blob";
+export const AzureBlobMountType = S.String;
+
+/** Mount configuration for Azure Blob Storage containers */
+export interface AzureBlobMount {
+  /** Mount type identifier */
+  type: AzureBlobMountType;
+  /** Azure blob container name */
+  containerName: string;
+  /** Azure blob endpoint URL (optional if storageAccountName provided) */
+  endpoint?: string;
+  /** Azure storage account name (used to derive endpoint if not provided) */
+  storageAccountName?: string;
+  /** Azure AD tenant ID */
+  tenantId: string;
+  /** Azure AD application client ID */
+  clientId: string;
+  /** Azure AD application client secret */
+  clientSecret: string | Redacted.Redacted<string>;
+  /** Prefix within the container */
+  bucketPrefix?: string;
+}
+export const AzureBlobMount = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    type: AzureBlobMountType,
+    containerName: S.String,
+    endpoint: S.optional(S.String),
+    storageAccountName: S.optional(S.String),
+    tenantId: S.String,
+    clientId: S.String,
+    clientSecret: S.String.pipe(T.SensitiveValue({})),
+    bucketPrefix: S.optional(S.String),
+  }),
+).annotate({ identifier: "AzureBlobMount" }) as any as S.Schema<AzureBlobMount>;
+
+export type MountConfig =
+  | S3Mount
+  | GCSMount
+  | R2Mount
+  | S3CompatibleMount
+  | AzureBlobMount;
+export const MountConfig = S.Unknown as any as S.Schema<MountConfig>;
+
+/** Storage mount to attach. Omit for archil-managed storage. */
+export type CreateDiskRequestMountsList = Array<MountConfig>;
+export const CreateDiskRequestMountsList = /*@__PURE__*/ S.Array(
+  MountConfig,
+) as any as S.Schema<CreateDiskRequestMountsList>;
+
+/** Deprecated. Use AddDiskUser after creation instead. When provided, suppresses the default auto-generated token user. */
+export type CreateDiskRequestAuthMethodsList = Array<DiskUser>;
+export const CreateDiskRequestAuthMethodsList = /*@__PURE__*/ S.Array(
+  DiskUser,
+) as any as S.Schema<CreateDiskRequestAuthMethodsList>;
+
+export interface CreateDiskRequest {
+  /** Disk name (alphanumeric, dashes, underscores) */
+  name: string;
+  /** Storage mount to attach. Omit for archil-managed storage. */
+  mounts?: CreateDiskRequestMountsList;
+  /** Deprecated. Use AddDiskUser after creation instead. When provided, suppresses the default auto-generated token user. */
+  authMethods?: CreateDiskRequestAuthMethodsList;
+}
+export const CreateDiskRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String,
+    mounts: S.optional(CreateDiskRequestMountsList),
+    authMethods: S.optional(CreateDiskRequestAuthMethodsList),
+  }).pipe(T.Http({ method: "POST", uri: "/api/disks", code: 200 })),
+).annotate({
+  identifier: "CreateDiskRequest",
+}) as any as S.Schema<CreateDiskRequest>;
+
+export type ApiResponseCreateDiskDataAuthorizedUsersList =
+  Array<AuthorizedUser>;
+export const ApiResponseCreateDiskDataAuthorizedUsersList =
+  /*@__PURE__*/ S.Array(
+    AuthorizedUser,
+  ) as any as S.Schema<ApiResponseCreateDiskDataAuthorizedUsersList>;
+
+export interface ApiResponseCreateDiskData {
+  diskId?: string;
+  authorizedUsers?: ApiResponseCreateDiskDataAuthorizedUsersList;
+}
+export const ApiResponseCreateDiskData = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    diskId: S.optional(S.String),
+    authorizedUsers: S.optional(ApiResponseCreateDiskDataAuthorizedUsersList),
+  }),
+).annotate({
+  identifier: "ApiResponseCreateDiskData",
+}) as any as S.Schema<ApiResponseCreateDiskData>;
+
+export interface ApiResponseCreateDisk {
+  success: boolean;
+  data: ApiResponseCreateDiskData;
+}
+export const ApiResponseCreateDisk = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    success: S.Boolean,
+    data: ApiResponseCreateDiskData,
+  }),
+).annotate({
+  identifier: "ApiResponseCreateDisk",
+}) as any as S.Schema<ApiResponseCreateDisk>;
+
+/** Environment variables applied to every process */
+export type CreateSandboxRequestEnvMap = { [key: string]: string | undefined };
+export const CreateSandboxRequestEnvMap = /*@__PURE__*/ S.Record(
+  S.String,
+  S.String,
+) as any as S.Schema<CreateSandboxRequestEnvMap>;
+
+export interface CreateSandboxRequest {
+  /** Hold the request for a completed sandbox lifecycle transition */
+  wait?: boolean;
+  /** Sandbox name, unique within the account. A random word-list name is generated when omitted. */
+  name?: string;
+  vcpu_count?: number;
+  mem_size_mib?: number;
+  /** Public Linux OCI image reference. Docker shorthand and tags are accepted. */
+  base_image?: string;
+  /** Environment variables applied to every process */
+  env?: CreateSandboxRequestEnvMap;
+  /** Lifetime budget for each powered-on session. Activity does not extend the deadline; starting or resuming the sandbox begins a fresh session. */
+  max_ttl_seconds?: number;
+  /** Maximum concurrently attached process sessions */
+  max_concurrent_execs?: number;
+}
+export const CreateSandboxRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    wait: S.optional(S.Boolean.pipe(T.Query())),
+    name: S.optional(S.String),
+    vcpu_count: S.optional(S.Number),
+    mem_size_mib: S.optional(S.Number),
+    base_image: S.optional(S.String),
+    env: S.optional(CreateSandboxRequestEnvMap),
+    max_ttl_seconds: S.optional(S.Number),
+    max_concurrent_execs: S.optional(S.Number),
+  }).pipe(T.Http({ method: "POST", uri: "/api/sandboxes", code: 200 })),
+).annotate({
+  identifier: "CreateSandboxRequest",
+}) as any as S.Schema<CreateSandboxRequest>;
+
+export interface CreateSandboxResponse {}
+export const CreateSandboxResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "CreateSandboxResponse",
+}) as any as S.Schema<CreateSandboxResponse>;
+
+export interface CreateSandboxConnectionRequest {
+  /** Sandbox UUID */
+  sid: string;
+}
+export const CreateSandboxConnectionRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    sid: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/api/sandboxes/{sid}/connections",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "CreateSandboxConnectionRequest",
+}) as any as S.Schema<CreateSandboxConnectionRequest>;
+
+export interface SandboxConnection {
+  url: string;
+  expires_at: string;
+}
+export const SandboxConnection = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    url: S.String,
+    expires_at: S.String,
+  }),
+).annotate({
+  identifier: "SandboxConnection",
+}) as any as S.Schema<SandboxConnection>;
+
+export interface ApiResponseSandboxConnection {
+  success: boolean;
+  data: SandboxConnection;
+}
+export const ApiResponseSandboxConnection = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    success: S.Boolean,
+    data: SandboxConnection,
+  }),
+).annotate({
+  identifier: "ApiResponseSandboxConnection",
+}) as any as S.Schema<ApiResponseSandboxConnection>;
+
+export interface CreateShareUrlRequest {
+  /** Disk ID (format `dsk-{16 hex chars}`) */
+  id: string;
+  /** File key (path) within the disk. */
+  key: string;
+  /** URL lifetime in seconds. Any integer from 1 to 604800 (7 days). Defaults to 86400 (24 hours). */
+  expiresIn?: number;
+}
+export const CreateShareUrlRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    id: S.String.pipe(T.Label()),
+    key: S.String,
+    expiresIn: S.optional(S.Number),
+  }).pipe(T.Http({ method: "POST", uri: "/api/disks/{id}/share", code: 200 })),
+).annotate({
+  identifier: "CreateShareUrlRequest",
+}) as any as S.Schema<CreateShareUrlRequest>;
+
+export interface ApiResponseShareUrlData {
+  /** The signed, public download URL. */
+  url: string;
+  /** URL lifetime in seconds. */
+  expiresIn: number;
+}
+export const ApiResponseShareUrlData = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    url: S.String,
+    expiresIn: S.Number,
+  }),
+).annotate({
+  identifier: "ApiResponseShareUrlData",
+}) as any as S.Schema<ApiResponseShareUrlData>;
+
+export interface ApiResponseShareUrl {
+  success: boolean;
+  data: ApiResponseShareUrlData;
+}
+export const ApiResponseShareUrl = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    success: S.Boolean,
+    data: ApiResponseShareUrlData,
+  }),
+).annotate({
+  identifier: "ApiResponseShareUrl",
+}) as any as S.Schema<ApiResponseShareUrl>;
+
+export interface DeleteDiskRequest {
+  /** Disk ID (format `dsk-{16 hex chars}`) */
+  id: string;
+}
+export const DeleteDiskRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    id: S.String.pipe(T.Label()),
+  }).pipe(T.Http({ method: "DELETE", uri: "/api/disks/{id}", code: 200 })),
+).annotate({
+  identifier: "DeleteDiskRequest",
+}) as any as S.Schema<DeleteDiskRequest>;
+
+export interface ApiResponseEmpty {
+  success: boolean;
+}
+export const ApiResponseEmpty = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    success: S.Boolean,
+  }),
+).annotate({
+  identifier: "ApiResponseEmpty",
+}) as any as S.Schema<ApiResponseEmpty>;
+
+export interface DeleteSandboxRequest {
+  /** Sandbox UUID */
+  sid: string;
+}
+export const DeleteSandboxRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    sid: S.String.pipe(T.Label()),
+  }).pipe(T.Http({ method: "DELETE", uri: "/api/sandboxes/{sid}", code: 200 })),
+).annotate({
+  identifier: "DeleteSandboxRequest",
+}) as any as S.Schema<DeleteSandboxRequest>;
+
+export interface DeleteSandboxResponse {}
+export const DeleteSandboxResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "DeleteSandboxResponse",
+}) as any as S.Schema<DeleteSandboxResponse>;
+
+export interface DeleteTokenRequest {
+  /** The token ID (hash) */
+  id: string;
+}
+export const DeleteTokenRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    id: S.String.pipe(T.Label()),
+  }).pipe(T.Http({ method: "DELETE", uri: "/api/tokens/{id}", code: 200 })),
+).annotate({
+  identifier: "DeleteTokenRequest",
+}) as any as S.Schema<DeleteTokenRequest>;
+
+export interface ApiResponseMessageData {
+  message?: string;
+}
+export const ApiResponseMessageData = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    message: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "ApiResponseMessageData",
+}) as any as S.Schema<ApiResponseMessageData>;
+
+export interface ApiResponseMessage {
+  success: boolean;
+  data: ApiResponseMessageData;
+}
+export const ApiResponseMessage = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    success: S.Boolean,
+    data: ApiResponseMessageData,
+  }),
+).annotate({
+  identifier: "ApiResponseMessage",
+}) as any as S.Schema<ApiResponseMessage>;
+
+export interface ExecMount {
+  /** Disk ID to mount at this relative path */
+  disk: string;
+  /** Subdirectory of the disk to expose at the mountpoint. Must be a relative path with no `.` or `..` segments. When omitted, the disk's root is exposed. */
+  subdirectory?: string;
+  /** When true, the disk is mounted read-only inside the container. Writes against the mount fail with EROFS. */
+  readOnly?: boolean;
+}
+export const ExecMount = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    disk: S.String,
+    subdirectory: S.optional(S.String),
+    readOnly: S.optional(S.Boolean),
+  }),
+).annotate({ identifier: "ExecMount" }) as any as S.Schema<ExecMount>;
+
+export type ExecRequestDisksValue = string | ExecMount;
+export const ExecRequestDisksValue =
+  S.Unknown as any as S.Schema<ExecRequestDisksValue>;
+
+/** Map of relative path under `/mnt/archil` to the disk to mount there. At least one entry is required. Relative paths must be non-empty, non-absolute, and contain no `.` or `..` segments. Each value is either a plain disk ID string (mounts the disk's root, read-write) or an object that additionally selects a subdirectory of the disk and/or marks the mount as read-only. */
+export type ExecRequestDisksMap = {
+  [key: string]: ExecRequestDisksValue | undefined;
+};
+export const ExecRequestDisksMap = /*@__PURE__*/ S.Record(
+  S.String,
+  ExecRequestDisksValue,
+) as any as S.Schema<ExecRequestDisksMap>;
+
+export interface ExecRequest {
+  /** Map of relative path under `/mnt/archil` to the disk to mount there. At least one entry is required. Relative paths must be non-empty, non-absolute, and contain no `.` or `..` segments. Each value is either a plain disk ID string (mounts the disk's root, read-write) or an object that additionally selects a subdirectory of the disk and/or marks the mount as read-only. */
+  disks: ExecRequestDisksMap;
+  /** Shell command to execute inside the container */
+  command: string;
+}
+export const ExecRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    disks: ExecRequestDisksMap,
+    command: S.String,
+  }).pipe(T.Http({ method: "POST", uri: "/api/exec", code: 200 })),
+).annotate({ identifier: "ExecRequest" }) as any as S.Schema<ExecRequest>;
+
+/** Server-measured timings for an exec request. */
+export interface ExecTiming {
+  /** End-to-end wall clock measured on the server, from request arrival to response. */
+  totalMs: number;
+  /** Time spent queueing, scheduling, booting/claiming a VM, and mounting the filesystem before the command started running. */
+  queueMs: number;
+  /** Time the user's command itself ran, measured by the runtime. */
+  executeMs: number;
+}
+export const ExecTiming = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    totalMs: S.Number,
+    queueMs: S.Number,
+    executeMs: S.Number,
+  }),
+).annotate({ identifier: "ExecTiming" }) as any as S.Schema<ExecTiming>;
+
+export interface ExecDiskResult {
+  /** Exit code of the command (0 = success) */
+  exitCode: number;
+  /** Standard output from the command */
+  stdout: string;
+  /** Standard error from the command */
+  stderr: string;
+  timing: ExecTiming;
+}
+export const ExecDiskResult = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    exitCode: S.Number,
+    stdout: S.String,
+    stderr: S.String,
+    timing: ExecTiming,
+  }),
+).annotate({ identifier: "ExecDiskResult" }) as any as S.Schema<ExecDiskResult>;
+
+export interface ApiResponseExec {
+  success: boolean;
+  data: ExecDiskResult;
+}
+export const ApiResponseExec = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    success: S.Boolean,
+    data: ExecDiskResult,
+  }),
+).annotate({
+  identifier: "ApiResponseExec",
+}) as any as S.Schema<ApiResponseExec>;
+
+export interface ExecDiskRequest {
+  /** Disk ID (format `dsk-{16 hex chars}`) */
+  id: string;
+  /** Shell command to execute inside the container */
+  command: string;
+}
+export const ExecDiskRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    id: S.String.pipe(T.Label()),
+    command: S.String,
+  }).pipe(T.Http({ method: "POST", uri: "/api/disks/{id}/exec", code: 200 })),
+).annotate({
+  identifier: "ExecDiskRequest",
+}) as any as S.Schema<ExecDiskRequest>;
+
+export interface ApiResponseExecDisk {
+  success: boolean;
+  data: ExecDiskResult;
+}
+export const ApiResponseExecDisk = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    success: S.Boolean,
+    data: ExecDiskResult,
+  }),
+).annotate({
+  identifier: "ApiResponseExecDisk",
+}) as any as S.Schema<ApiResponseExecDisk>;
+
+export interface ForkSandboxRequest {
+  /** Sandbox UUID */
+  sid: string;
+  /** Hold the request for a completed sandbox lifecycle transition */
+  wait?: boolean;
+  /** Name for the fork. A random word-list name is generated when omitted. */
+  name?: string;
+}
+export const ForkSandboxRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    sid: S.String.pipe(T.Label()),
+    wait: S.optional(S.Boolean.pipe(T.Query())),
+    name: S.optional(S.String),
+  }).pipe(
+    T.Http({ method: "POST", uri: "/api/sandboxes/{sid}/fork", code: 200 }),
+  ),
+).annotate({
+  identifier: "ForkSandboxRequest",
+}) as any as S.Schema<ForkSandboxRequest>;
+
+export interface ForkSandboxResponse {}
+export const ForkSandboxResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "ForkSandboxResponse",
+}) as any as S.Schema<ForkSandboxResponse>;
+
+export interface GetDiskRequest {
+  /** Disk ID (format `dsk-{16 hex chars}`) */
+  id: string;
+}
+export const GetDiskRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    id: S.String.pipe(T.Label()),
+  }).pipe(T.Http({ method: "GET", uri: "/api/disks/{id}", code: 200 })),
+).annotate({ identifier: "GetDiskRequest" }) as any as S.Schema<GetDiskRequest>;
+
+/** Disk status */
+export type DiskResponseStatus =
+  | "available"
+  | "creating"
+  | "deleting"
+  | "deleted"
+  | "failed";
+export const DiskResponseStatus = S.String;
+
+/** Storage backend type */
+export type MountResponseType =
+  | "s3"
+  | "gcs"
+  | "r2"
+  | "s3-compatible"
+  | "azure-blob";
+export const MountResponseType = S.String;
+
+/** Access mode */
+export type MountResponseAccessMode = "rw" | "ro";
+export const MountResponseAccessMode = S.String;
+
+/** Mount configuration details (secrets omitted) */
+export interface MountConfigResponse {
+  /** Bucket name */
+  bucketName?: string;
+  /** Storage endpoint URL */
+  bucketEndpoint?: string;
+  /** Prefix within the bucket */
+  bucketPrefix?: string;
+  /** Session identifier for IAM-authorized mounts */
+  sessionId?: string;
+}
+export const MountConfigResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    bucketName: S.optional(S.String),
+    bucketEndpoint: S.optional(S.String),
+    bucketPrefix: S.optional(S.String),
+    sessionId: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "MountConfigResponse",
+}) as any as S.Schema<MountConfigResponse>;
+
+/** Current connection status */
+export type MountResponseConnectionStatus = "connected" | "disconnected";
+export const MountResponseConnectionStatus = S.String;
+
+/** How the mount authenticates to the storage backend */
+export type MountResponseAuthorizationType = "iam" | "accessKeys" | "oauth";
+export const MountResponseAuthorizationType = S.String;
+
+export interface MountResponse {
+  /** Mount identifier */
+  id?: string;
+  /** Storage backend type */
+  type?: MountResponseType;
+  /** Mount path */
+  path?: string;
+  /** Bucket/container name */
+  name?: string;
+  /** Access mode */
+  accessMode?: MountResponseAccessMode;
+  config?: MountConfigResponse;
+  /** Current connection status */
+  connectionStatus?: MountResponseConnectionStatus;
+  /** Authentication error message (if disconnected) */
+  authError?: string;
+  /** How the mount authenticates to the storage backend */
+  authorizationType?: MountResponseAuthorizationType;
+}
+export const MountResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    id: S.optional(S.String),
+    type: S.optional(MountResponseType),
+    path: S.optional(S.String),
+    name: S.optional(S.String),
+    accessMode: S.optional(MountResponseAccessMode),
+    config: S.optional(MountConfigResponse),
+    connectionStatus: S.optional(MountResponseConnectionStatus),
+    authError: S.optional(S.String),
+    authorizationType: S.optional(MountResponseAuthorizationType),
+  }),
+).annotate({ identifier: "MountResponse" }) as any as S.Schema<MountResponse>;
+
+export type DiskResponseMountsList = Array<MountResponse>;
+export const DiskResponseMountsList = /*@__PURE__*/ S.Array(
+  MountResponse,
+) as any as S.Schema<DiskResponseMountsList>;
+
+export interface DiskMetrics {
+  /** Data transfer amount with unit (e.g., "1.5 GB") */
+  dataTransfer?: string;
+  /** Total request count as a formatted string (e.g., "1,234") */
+  requests?: string;
+  /** Average response time with unit (e.g., "45ms") */
+  avgResponseTime?: string;
+}
+export const DiskMetrics = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    dataTransfer: S.optional(S.String),
+    requests: S.optional(S.String),
+    avgResponseTime: S.optional(S.String),
+  }),
+).annotate({ identifier: "DiskMetrics" }) as any as S.Schema<DiskMetrics>;
+
+export interface ConnectedClient {
+  id?: string;
+  ipAddress?: string;
+  connectedAt?: string;
+}
+export const ConnectedClient = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    id: S.optional(S.String),
+    ipAddress: S.optional(S.String),
+    connectedAt: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "ConnectedClient",
+}) as any as S.Schema<ConnectedClient>;
+
+export type DiskResponseConnectedClientsList = Array<ConnectedClient>;
+export const DiskResponseConnectedClientsList = /*@__PURE__*/ S.Array(
+  ConnectedClient,
+) as any as S.Schema<DiskResponseConnectedClientsList>;
+
+export type DiskResponseAuthorizedUsersList = Array<AuthorizedUser>;
+export const DiskResponseAuthorizedUsersList = /*@__PURE__*/ S.Array(
+  AuthorizedUser,
+) as any as S.Schema<DiskResponseAuthorizedUsersList>;
+
+export interface DiskResponse {
+  /** Disk ID */
+  id: string;
+  /** Disk name */
+  name: string;
+  /** Owning organization ID */
+  organization: string;
+  /** Disk status */
+  status: DiskResponseStatus;
+  /** Filesystem handler status */
+  fsHandlerStatus?: string;
+  /** Cloud provider */
+  provider: string;
+  /** Disk region (e.g., aws-us-east-1, gcp-us-central1) */
+  region: string;
+  /** Creation timestamp */
+  createdAt: string;
+  /** Last access timestamp */
+  lastAccessed?: string;
+  /** Total data size in bytes */
+  dataSize?: number;
+  /** Monthly usage amount formatted as a currency string (e.g., "$1.23") */
+  monthlyUsage?: string;
+  mounts?: DiskResponseMountsList;
+  metrics?: DiskMetrics;
+  connectedClients?: DiskResponseConnectedClientsList;
+  authorizedUsers?: DiskResponseAuthorizedUsersList;
+}
+export const DiskResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    id: S.String,
+    name: S.String,
+    organization: S.String,
+    status: DiskResponseStatus,
+    fsHandlerStatus: S.optional(S.String),
+    provider: S.String,
+    region: S.String,
+    createdAt: S.String,
+    lastAccessed: S.optional(S.String),
+    dataSize: S.optional(S.Number),
+    monthlyUsage: S.optional(S.String),
+    mounts: S.optional(DiskResponseMountsList),
+    metrics: S.optional(DiskMetrics),
+    connectedClients: S.optional(DiskResponseConnectedClientsList),
+    authorizedUsers: S.optional(DiskResponseAuthorizedUsersList),
+  }),
+).annotate({ identifier: "DiskResponse" }) as any as S.Schema<DiskResponse>;
+
+export interface ApiResponseDisk {
+  success: boolean;
+  data: DiskResponse;
+}
+export const ApiResponseDisk = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    success: S.Boolean,
+    data: DiskResponse,
+  }),
+).annotate({
+  identifier: "ApiResponseDisk",
+}) as any as S.Schema<ApiResponseDisk>;
+
+export interface GetSandboxRequest {
+  /** Sandbox UUID */
+  sid: string;
+}
+export const GetSandboxRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    sid: S.String.pipe(T.Label()),
+  }).pipe(T.Http({ method: "GET", uri: "/api/sandboxes/{sid}", code: 200 })),
+).annotate({
+  identifier: "GetSandboxRequest",
+}) as any as S.Schema<GetSandboxRequest>;
+
+export type SandboxState =
+  | "pending"
+  | "running"
+  | "pausing"
+  | "paused"
+  | "stopping"
+  | "stopped"
+  | "exited"
+  | "failed"
+  | "deleting"
+  | "deleted";
+export const SandboxState = S.String;
+
+/** Sandbox CPU architecture. */
+export type SandboxPlatform = "arm64" | "amd64";
+export const SandboxPlatform = S.String;
+
+export interface SandboxEndpoint {
+  port: number;
+  hostname: string;
+}
+export const SandboxEndpoint = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    port: S.Number,
+    hostname: S.String,
+  }),
+).annotate({
+  identifier: "SandboxEndpoint",
+}) as any as S.Schema<SandboxEndpoint>;
+
+export type SandboxEndpointsList = Array<SandboxEndpoint>;
+export const SandboxEndpointsList = /*@__PURE__*/ S.Array(
+  SandboxEndpoint,
+) as any as S.Schema<SandboxEndpointsList>;
+
+export interface Sandbox {
+  sandbox_id: string;
+  /** Sandbox name. */
+  name: string;
+  status: SandboxState;
+  vcpu_count: number;
+  mem_size_mib: number;
+  /** Lifetime budget for each powered-on session. Activity does not extend the deadline; starting or resuming the sandbox begins a fresh session. */
+  max_ttl_seconds: number;
+  /** Maximum concurrently attached process sessions */
+  max_concurrent_execs: number;
+  /** OCI reference requested when the sandbox was created. */
+  base_image: string;
+  /** Sandbox CPU architecture. */
+  platform?: SandboxPlatform;
+  endpoints?: SandboxEndpointsList;
+  created_at: string;
+  running_at?: string;
+  finished_at?: string;
+  last_active_at: string;
+  /** Current powered-on session deadline; absent while inactive. */
+  expires_at?: string;
+  exit_reason?: string;
+}
+export const Sandbox = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    sandbox_id: S.String,
+    name: S.String,
+    status: SandboxState,
+    vcpu_count: S.Number,
+    mem_size_mib: S.Number,
+    max_ttl_seconds: S.Number,
+    max_concurrent_execs: S.Number,
+    base_image: S.String,
+    platform: S.optional(SandboxPlatform),
+    endpoints: S.optional(SandboxEndpointsList),
+    created_at: S.String,
+    running_at: S.optional(S.String),
+    finished_at: S.optional(S.String),
+    last_active_at: S.String,
+    expires_at: S.optional(S.String),
+    exit_reason: S.optional(S.String),
+  }),
+).annotate({ identifier: "Sandbox" }) as any as S.Schema<Sandbox>;
+
+export interface ApiResponseSandbox {
+  success: boolean;
+  data: Sandbox;
+}
+export const ApiResponseSandbox = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    success: S.Boolean,
+    data: Sandbox,
+  }),
+).annotate({
+  identifier: "ApiResponseSandbox",
+}) as any as S.Schema<ApiResponseSandbox>;
+
+export interface GrepDiskRequest {
+  /** Disk ID (format `dsk-{16 hex chars}`) */
+  id: string;
+  /** Directory on the disk to search, relative to the disk root. An empty string or "/" means the disk root. */
+  directory: string;
+  /** Extended regular expression (passed to `grep -E`) */
+  pattern: string;
+  /** When true, walks subdirectories breadth-first. */
+  recursive?: boolean;
+  /** Wall-clock deadline for the entire request. Capped at 30 seconds because the runtime exec container itself is bounded at ~30s; longer requests would have their workers killed mid-scan. */
+  maxDurationSeconds?: number;
+  /** Maximum number of parallel grep workers. Higher values finish larger datasets within the deadline but consume proportionally more runtime capacity. */
+  concurrency?: number;
+  /** Stop scanning once the aggregator has this many matches. Returned matches are a sample of whichever workers reported first, not the lexicographically first N. */
+  maxResults?: number;
+}
+export const GrepDiskRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    id: S.String.pipe(T.Label()),
+    directory: S.String,
+    pattern: S.String,
+    recursive: S.optional(S.Boolean),
+    maxDurationSeconds: S.optional(S.Number),
+    concurrency: S.optional(S.Number),
+    maxResults: S.optional(S.Number),
+  }).pipe(T.Http({ method: "POST", uri: "/api/disks/{id}/grep", code: 200 })),
+).annotate({
+  identifier: "GrepDiskRequest",
+}) as any as S.Schema<GrepDiskRequest>;
+
+export interface GrepMatch {
+  /** Path to the file (relative to the disk root). */
+  file: string;
+  /** 1-based line number where the match occurred. */
+  line: number;
+  /** The matching line. */
+  text: string;
+}
+export const GrepMatch = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    file: S.String,
+    line: S.Number,
+    text: S.String,
+  }),
+).annotate({ identifier: "GrepMatch" }) as any as S.Schema<GrepMatch>;
+
+export type GrepDiskResultMatchesList = Array<GrepMatch>;
+export const GrepDiskResultMatchesList = /*@__PURE__*/ S.Array(
+  GrepMatch,
+) as any as S.Schema<GrepDiskResultMatchesList>;
+
+/** Why the search stopped. - `completed`: every file under the directory was scanned successfully. - `incomplete`: pipeline ran to its natural end but one or more batches errored (invalid regex, unreadable file, runtime issue). Results may be partial or wrong; do not rely on completeness. - `max_results`: hit `maxResults` before scanning everything. - `deadline`: hit `maxDurationSeconds`. - `list_failed`: directory listing failed; partial results may be present. */
+export type GrepStoppedReason =
+  | "completed"
+  | "incomplete"
+  | "max_results"
+  | "deadline"
+  | "list_failed";
+export const GrepStoppedReason = S.String;
+
+export interface GrepDiskResult {
+  matches: GrepDiskResultMatchesList;
+  stoppedReason: GrepStoppedReason;
+  /** Files actually fed to a grep container. */
+  filesScanned: number;
+  /** Number of grep containers started for this request. */
+  containersDispatched: number;
+  /** Sum of per-container execution time in seconds, measured by the runtime. Approximates billable container-seconds. */
+  computeSecondsUsed: number;
+  /** End-to-end wall clock measured by the server. */
+  durationMs: number;
+  /** Wall-clock time spent enumerating files via listObjects, from the request's start to the moment listing fully drained (or was canceled). Listing and matching overlap, so listingMs + grepMs typically exceeds durationMs. */
+  listingMs: number;
+  /** Wall-clock time spent matching, from the first grep container being dispatched to the last container reporting results. 0 if no batches ran. */
+  grepMs: number;
+}
+export const GrepDiskResult = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    matches: GrepDiskResultMatchesList,
+    stoppedReason: GrepStoppedReason,
+    filesScanned: S.Number,
+    containersDispatched: S.Number,
+    computeSecondsUsed: S.Number,
+    durationMs: S.Number,
+    listingMs: S.Number,
+    grepMs: S.Number,
+  }),
+).annotate({ identifier: "GrepDiskResult" }) as any as S.Schema<GrepDiskResult>;
+
+export interface ApiResponseGrepDisk {
+  success: boolean;
+  data: GrepDiskResult;
+}
+export const ApiResponseGrepDisk = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    success: S.Boolean,
+    data: GrepDiskResult,
+  }),
+).annotate({
+  identifier: "ApiResponseGrepDisk",
+}) as any as S.Schema<ApiResponseGrepDisk>;
+
+export interface ListApiTokensRequest {
+  /** Maximum number of items to return */
+  limit?: number;
+  /** Pagination cursor from a previous response */
+  cursor?: string;
+}
+export const ListApiTokensRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    limit: S.optional(S.Number.pipe(T.Query())),
+    cursor: S.optional(S.String.pipe(T.Query())),
+  }).pipe(T.Http({ method: "GET", uri: "/api/tokens", code: 200 })),
+).annotate({
+  identifier: "ListApiTokensRequest",
+}) as any as S.Schema<ListApiTokensRequest>;
+
+export interface ApiTokenResponse {
+  /** Token hash/ID */
+  id?: string;
+  name?: string;
+  description?: string;
+  /** Last 4 characters of the token */
+  tokenSuffix?: string;
+  createdAt?: string;
+  lastUsedAt?: string;
+}
+export const ApiTokenResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    id: S.optional(S.String),
+    name: S.optional(S.String),
+    description: S.optional(S.String),
+    tokenSuffix: S.optional(S.String),
+    createdAt: S.optional(S.String),
+    lastUsedAt: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "ApiTokenResponse",
+}) as any as S.Schema<ApiTokenResponse>;
+
+export type ApiResponseTokenListDataTokensList = Array<ApiTokenResponse>;
+export const ApiResponseTokenListDataTokensList = /*@__PURE__*/ S.Array(
+  ApiTokenResponse,
+) as any as S.Schema<ApiResponseTokenListDataTokensList>;
+
+export interface ApiResponseTokenListData {
+  tokens?: ApiResponseTokenListDataTokensList;
+}
+export const ApiResponseTokenListData = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    tokens: S.optional(ApiResponseTokenListDataTokensList),
+  }),
+).annotate({
+  identifier: "ApiResponseTokenListData",
+}) as any as S.Schema<ApiResponseTokenListData>;
+
+export interface ApiResponseTokenList {
+  success: boolean;
+  data: ApiResponseTokenListData;
+}
+export const ApiResponseTokenList = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    success: S.Boolean,
+    data: ApiResponseTokenListData,
+  }),
+).annotate({
+  identifier: "ApiResponseTokenList",
+}) as any as S.Schema<ApiResponseTokenList>;
+
+export interface ListDisksRequest {
+  /** Maximum number of items to return */
+  limit?: number;
+  /** Pagination cursor from a previous response */
+  cursor?: string;
+  /** Filter disks by exact name match. */
+  name?: string;
+}
+export const ListDisksRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    limit: S.optional(S.Number.pipe(T.Query())),
+    cursor: S.optional(S.String.pipe(T.Query())),
+    name: S.optional(S.String.pipe(T.Query())),
+  }).pipe(T.Http({ method: "GET", uri: "/api/disks", code: 200 })),
+).annotate({
+  identifier: "ListDisksRequest",
+}) as any as S.Schema<ListDisksRequest>;
+
+export type ApiResponseDiskListDataList = Array<DiskResponse>;
+export const ApiResponseDiskListDataList = /*@__PURE__*/ S.Array(
+  DiskResponse,
+) as any as S.Schema<ApiResponseDiskListDataList>;
+
+/** All API responses use a standard envelope with `success: boolean` and `data` (on success) or `error: string` (on failure). The ApiResponse_* schemas each define the specific `data` shape for their endpoint. */
+export interface ApiResponseDiskList {
+  success: boolean;
+  data: ApiResponseDiskListDataList;
+}
+export const ApiResponseDiskList = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    success: S.Boolean,
+    data: ApiResponseDiskListDataList,
+  }),
+).annotate({
+  identifier: "ApiResponseDiskList",
+}) as any as S.Schema<ApiResponseDiskList>;
+
+export interface ListSandboxesRequest {
+  /** Only sandboxes that mount this disk */
+  filesystem?: string;
+}
+export const ListSandboxesRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    filesystem: S.optional(S.String.pipe(T.Query())),
+  }).pipe(T.Http({ method: "GET", uri: "/api/sandboxes", code: 200 })),
+).annotate({
+  identifier: "ListSandboxesRequest",
+}) as any as S.Schema<ListSandboxesRequest>;
+
+export type ApiResponseSandboxListDataSandboxesList = Array<Sandbox>;
+export const ApiResponseSandboxListDataSandboxesList = /*@__PURE__*/ S.Array(
+  Sandbox,
+) as any as S.Schema<ApiResponseSandboxListDataSandboxesList>;
+
+export interface ApiResponseSandboxListData {
+  sandboxes?: ApiResponseSandboxListDataSandboxesList;
+}
+export const ApiResponseSandboxListData = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    sandboxes: S.optional(ApiResponseSandboxListDataSandboxesList),
+  }),
+).annotate({
+  identifier: "ApiResponseSandboxListData",
+}) as any as S.Schema<ApiResponseSandboxListData>;
+
+export interface ApiResponseSandboxList {
+  success: boolean;
+  data: ApiResponseSandboxListData;
+}
+export const ApiResponseSandboxList = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    success: S.Boolean,
+    data: ApiResponseSandboxListData,
+  }),
+).annotate({
+  identifier: "ApiResponseSandboxList",
+}) as any as S.Schema<ApiResponseSandboxList>;
+
+export interface PauseSandboxRequest {
+  /** Sandbox UUID */
+  sid: string;
+}
+export const PauseSandboxRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    sid: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "POST", uri: "/api/sandboxes/{sid}/pause", code: 200 }),
+  ),
+).annotate({
+  identifier: "PauseSandboxRequest",
+}) as any as S.Schema<PauseSandboxRequest>;
+
+export type RemoveDiskUserRequestUserType = "token" | "awssts";
+export const RemoveDiskUserRequestUserType = S.String;
+
+export interface RemoveDiskUserRequest {
+  /** Disk ID (format `dsk-{16 hex chars}`) */
+  id: string;
+  /** The type of user authentication */
+  userType: RemoveDiskUserRequestUserType | (string & {});
+  /** Identifier of the user to remove, as returned in the creation or list response. For awssts users, this is the IAM ARN. */
+  identifier?: string;
+  /** Use identifier instead. */
+  principal?: string;
+}
+export const RemoveDiskUserRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    id: S.String.pipe(T.Label()),
+    userType: RemoveDiskUserRequestUserType.pipe(T.Label()),
+    identifier: S.optional(S.String.pipe(T.Query())),
+    principal: S.optional(S.String.pipe(T.Query())),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/api/disks/{id}/users/{userType}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "RemoveDiskUserRequest",
+}) as any as S.Schema<RemoveDiskUserRequest>;
+
+export interface ResumeSandboxRequest {
+  /** Sandbox UUID */
+  sid: string;
+  /** Hold the request for a completed sandbox lifecycle transition */
+  wait?: boolean;
+}
+export const ResumeSandboxRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    sid: S.String.pipe(T.Label()),
+    wait: S.optional(S.Boolean.pipe(T.Query())),
+  }).pipe(
+    T.Http({ method: "POST", uri: "/api/sandboxes/{sid}/resume", code: 200 }),
+  ),
+).annotate({
+  identifier: "ResumeSandboxRequest",
+}) as any as S.Schema<ResumeSandboxRequest>;
+
+export interface StartSandboxRequest {
+  /** Sandbox UUID */
+  sid: string;
+  /** Hold the request for a completed sandbox lifecycle transition */
+  wait?: boolean;
+}
+export const StartSandboxRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    sid: S.String.pipe(T.Label()),
+    wait: S.optional(S.Boolean.pipe(T.Query())),
+  }).pipe(
+    T.Http({ method: "POST", uri: "/api/sandboxes/{sid}/start", code: 200 }),
+  ),
+).annotate({
+  identifier: "StartSandboxRequest",
+}) as any as S.Schema<StartSandboxRequest>;
+
+export interface StopSandboxRequest {
+  /** Sandbox UUID */
+  sid: string;
+}
+export const StopSandboxRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    sid: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "POST", uri: "/api/sandboxes/{sid}/stop", code: 200 }),
+  ),
+).annotate({
+  identifier: "StopSandboxRequest",
+}) as any as S.Schema<StopSandboxRequest>;
+
+export type AddDiskUserError = BadRequest | ArchilOpError;
+/** Add user to disk Adds an authorized user to a disk. Users can authenticate via: - **token**: A shared token with a nickname and 4-character suffix - **awssts**: AWS STS role assumption with an IAM principal ARN */
+export const addDiskUser: API.OperationMethod<
+  AddDiskUserRequest,
+  ApiResponseAuthorizedUser,
+  AddDiskUserError,
+  ArchilOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AddDiskUserRequest,
+  output: ApiResponseAuthorizedUser,
+  errors: [BadRequest, UnknownArchilError],
+  protocol: ArchilProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CreateApiTokenError = BadRequest | ArchilOpError;
+/** Create API token Creates a new API token for programmatic access. The full token value is only returned once at creation time. */
+export const createApiToken: API.OperationMethod<
+  CreateApiTokenRequest,
+  ApiResponseTokenCreated,
+  CreateApiTokenError,
+  ArchilOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateApiTokenRequest,
+  output: ApiResponseTokenCreated,
+  errors: [BadRequest, UnknownArchilError],
+  protocol: ArchilProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CreateDiskError = BadRequest | Forbidden | Conflict | ArchilOpError;
+/** Create a new disk Creates a new disk with the specified configuration. A default disk token user is automatically generated and returned in the response, so the disk is immediately mountable. The one-time disk token appears in `authorizedUsers[].token` and cannot be retrieved again. (This disk token is scoped to the new disk and is separate from the API key you used to make this request.) To provide your own users instead, pass the deprecated `authMethods` field or call AddDiskUser after creation. */
+export const createDisk: API.OperationMethod<
+  CreateDiskRequest,
+  ApiResponseCreateDisk,
+  CreateDiskError,
+  ArchilOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateDiskRequest,
+  output: ApiResponseCreateDisk,
+  errors: [BadRequest, Forbidden, Conflict, UnknownArchilError],
+  protocol: ArchilProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CreateSandboxError = BadRequest | Conflict | ArchilOpError;
+/** Create a sandbox Provisions a sandbox VM with the requested shape and a dedicated, persistent Archil disk. By default the response reports `pending` after the runtime accepts the start. Set `wait=true` to hold for `running`; if the wait budget expires, the response remains `pending` and startup continues. */
+export const createSandbox: API.OperationMethod<
+  CreateSandboxRequest,
+  CreateSandboxResponse,
+  CreateSandboxError,
+  ArchilOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateSandboxRequest,
+  output: CreateSandboxResponse,
+  errors: [BadRequest, Conflict, UnknownArchilError],
+  protocol: ArchilProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CreateSandboxConnectionError = NotFound | Conflict | ArchilOpError;
+/** Create a sandbox process connection Returns a short-lived WebSocket URL for the process API in a running sandbox. The URL contains a signed token that expires at `expires_at`. */
+export const createSandboxConnection: API.OperationMethod<
+  CreateSandboxConnectionRequest,
+  ApiResponseSandboxConnection,
+  CreateSandboxConnectionError,
+  ArchilOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateSandboxConnectionRequest,
+  output: ApiResponseSandboxConnection,
+  errors: [NotFound, Conflict, UnknownArchilError],
+  protocol: ArchilProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CreateShareUrlError = BadRequest | NotFound | ArchilOpError;
+/** Create a share URL for a file Creates a signed, time-limited URL for downloading a file without authentication. The URL expires after 24 hours by default; pass `expiresIn` to set a custom lifetime up to 7 days. The returned URL points to a public endpoint (`GET /api/shared/{token}`) that verifies the signature, checks expiry, and streams the file with a sensible `Content-Type` and `Content-Disposition`. Range requests are supported. No credentials are needed to open the URL. */
+export const createShareUrl: API.OperationMethod<
+  CreateShareUrlRequest,
+  ApiResponseShareUrl,
+  CreateShareUrlError,
+  ArchilOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateShareUrlRequest,
+  output: ApiResponseShareUrl,
+  errors: [BadRequest, NotFound, UnknownArchilError],
+  protocol: ArchilProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteDiskError = BadRequest | NotFound | ArchilOpError;
+/** Delete a disk Deletes a disk and all associated resources. */
+export const deleteDisk: API.OperationMethod<
+  DeleteDiskRequest,
+  ApiResponseEmpty,
+  DeleteDiskError,
+  ArchilOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteDiskRequest,
+  output: ApiResponseEmpty,
+  errors: [BadRequest, NotFound, UnknownArchilError],
+  protocol: ArchilProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteSandboxError = NotFound | Conflict | ArchilOpError;
+/** Delete a sandbox Permanently deletes a stopped, exited, or failed sandbox and its backing disk. A sandbox with child forks cannot be deleted until those children are deleted, starting with the deepest ones. */
+export const deleteSandbox: API.OperationMethod<
+  DeleteSandboxRequest,
+  DeleteSandboxResponse,
+  DeleteSandboxError,
+  ArchilOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteSandboxRequest,
+  output: DeleteSandboxResponse,
+  errors: [NotFound, Conflict, UnknownArchilError],
+  protocol: ArchilProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteTokenError = NotFound | ArchilOpError;
+/** Delete API token Revokes and deletes an API token. */
+export const deleteToken: API.OperationMethod<
+  DeleteTokenRequest,
+  ApiResponseMessage,
+  DeleteTokenError,
+  ArchilOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteTokenRequest,
+  output: ApiResponseMessage,
+  errors: [NotFound, UnknownArchilError],
+  protocol: ArchilProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ExecError = BadRequest | NotFound | ArchilOpError;
+/** Execute a command with multiple disks mounted Launches a container with the supplied set of disks each mounted at its own relative path under `/mnt/archil`, runs the command to completion, and shuts down the container. Activation is atomic: every disk mounts or none of them do. Relative paths must be non-empty, non-absolute, and contain no `.` / `..` segments. Mounting two disks at the same relative path is an error. */
+export const exec: API.OperationMethod<
+  ExecRequest,
+  ApiResponseExec,
+  ExecError,
+  ArchilOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ExecRequest,
+  output: ApiResponseExec,
+  errors: [BadRequest, NotFound, UnknownArchilError],
+  protocol: ArchilProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ExecDiskError = BadRequest | NotFound | ArchilOpError;
+/** Execute a command on a disk Launches a container with the specified disk mounted, runs the given command to completion, shuts down the container, and returns the command result. */
+export const execDisk: API.OperationMethod<
+  ExecDiskRequest,
+  ApiResponseExecDisk,
+  ExecDiskError,
+  ArchilOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ExecDiskRequest,
+  output: ApiResponseExecDisk,
+  errors: [BadRequest, NotFound, UnknownArchilError],
+  protocol: ArchilProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ForkSandboxError = BadRequest | NotFound | Conflict | ArchilOpError;
+/** Fork a sandbox Checkpoints a running source sandbox and creates an isolated writable disk branch. Forks from running or paused sources resume from the source's CPU, memory, and disk state. Forks from stopped sources cold-boot from the saved disk checkpoint. A running source is resumed after its checkpoint; paused and stopped sources remain inactive. Forked sandboxes may themselves be forked. */
+export const forkSandbox: API.OperationMethod<
+  ForkSandboxRequest,
+  ForkSandboxResponse,
+  ForkSandboxError,
+  ArchilOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ForkSandboxRequest,
+  output: ForkSandboxResponse,
+  errors: [BadRequest, NotFound, Conflict, UnknownArchilError],
+  protocol: ArchilProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetDiskError = BadRequest | NotFound | ArchilOpError;
+/** Get disk details Returns detailed information about a specific disk. */
+export const getDisk: API.OperationMethod<
+  GetDiskRequest,
+  ApiResponseDisk,
+  GetDiskError,
+  ArchilOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetDiskRequest,
+  output: ApiResponseDisk,
+  errors: [BadRequest, NotFound, UnknownArchilError],
+  protocol: ArchilProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetSandboxError = NotFound | ArchilOpError;
+/** Get a sandbox */
+export const getSandbox: API.OperationMethod<
+  GetSandboxRequest,
+  ApiResponseSandbox,
+  GetSandboxError,
+  ArchilOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetSandboxRequest,
+  output: ApiResponseSandbox,
+  errors: [NotFound, UnknownArchilError],
+  protocol: ArchilProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GrepDiskError = BadRequest | NotFound | ArchilOpError;
+/** Parallel grep over a directory on a disk Searches files under a directory on the disk for lines matching a regular expression. Listing and matching are fanned out across ephemeral exec containers, so the request finishes within the user's time budget regardless of the size of the directory. The user controls cost and latency with three knobs: - `maxDurationSeconds` is the wall-clock deadline (capped at 30s). - `concurrency` is the maximum number of parallel grep workers. Higher concurrency finishes larger datasets within the deadline, at proportionally more compute. - `maxResults` causes the search to short-circuit after the aggregator has collected this many matches. With `recursive: false` only files directly under `directory` are searched. With `recursive: true` subdirectories are walked breadth-first and grep workers are dispatched as soon as each level finishes listing — listing and matching overlap. The matches returned when stopping early on `maxResults` are a sample of whichever workers reported first, not the lexicographically first N. The response surfaces `stoppedReason` so callers can distinguish completion from early termination. */
+export const grepDisk: API.OperationMethod<
+  GrepDiskRequest,
+  ApiResponseGrepDisk,
+  GrepDiskError,
+  ArchilOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GrepDiskRequest,
+  output: ApiResponseGrepDisk,
+  errors: [BadRequest, NotFound, UnknownArchilError],
+  protocol: ArchilProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListApiTokensError = ArchilOpError;
+/** List API tokens Returns all API tokens for the authenticated account. */
+export const listApiTokens: API.OperationMethod<
+  ListApiTokensRequest,
+  ApiResponseTokenList,
+  ListApiTokensError,
+  ArchilOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListApiTokensRequest,
+  output: ApiResponseTokenList,
+  errors: [UnknownArchilError],
+  protocol: ArchilProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListDisksError = ArchilOpError;
+/** List all disks Returns all disks owned by the authenticated account. */
+export const listDisks: API.OperationMethod<
+  ListDisksRequest,
+  ApiResponseDiskList,
+  ListDisksError,
+  ArchilOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListDisksRequest,
+  output: ApiResponseDiskList,
+  errors: [UnknownArchilError],
+  protocol: ArchilProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListSandboxesError = BadRequest | ArchilOpError;
+/** List sandboxes All the account's sandboxes, oldest first. */
+export const listSandboxes: API.OperationMethod<
+  ListSandboxesRequest,
+  ApiResponseSandboxList,
+  ListSandboxesError,
+  ArchilOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListSandboxesRequest,
+  output: ApiResponseSandboxList,
+  errors: [BadRequest, UnknownArchilError],
+  protocol: ArchilProtocol,
+  retry: Retry.Retry,
+}));
+
+export type PauseSandboxError =
+  | BadRequest
+  | NotFound
+  | Conflict
+  | ArchilOpError;
+/** Pause a sandbox Snapshot the CPU & memory state, then stop the VM. The sandbox reports `pausing` until the snapshot commit marker is durable and the VM exits, then reports `paused`. Attached process connections close, while agent-owned processes remain available for reattachment after resume. A sandbox that is still `pending` must reach `running` before it can be paused. To restore the snapshot, call `/resume`. */
+export const pauseSandbox: API.OperationMethod<
+  PauseSandboxRequest,
+  ApiResponseSandbox,
+  PauseSandboxError,
+  ArchilOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: PauseSandboxRequest,
+  output: ApiResponseSandbox,
+  errors: [BadRequest, NotFound, Conflict, UnknownArchilError],
+  protocol: ArchilProtocol,
+  retry: Retry.Retry,
+}));
+
+export type RemoveDiskUserError = BadRequest | ArchilOpError;
+/** Remove user from disk Removes an authorized user from a disk. */
+export const removeDiskUser: API.OperationMethod<
+  RemoveDiskUserRequest,
+  ApiResponseMessage,
+  RemoveDiskUserError,
+  ArchilOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: RemoveDiskUserRequest,
+  output: ApiResponseMessage,
+  errors: [BadRequest, UnknownArchilError],
+  protocol: ArchilProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ResumeSandboxError =
+  | BadRequest
+  | NotFound
+  | Conflict
+  | ArchilOpError;
+/** Resume a sandbox Restores a paused sandbox's committed CPU and memory snapshot. Resuming a running sandbox or a pending resume is idempotent. Only a `paused` sandbox can begin a new resume; `stopped`, `exited`, `failed`, `stopping`, `pausing`, or a pending cold start returns 409. */
+export const resumeSandbox: API.OperationMethod<
+  ResumeSandboxRequest,
+  ApiResponseSandbox,
+  ResumeSandboxError,
+  ArchilOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ResumeSandboxRequest,
+  output: ApiResponseSandbox,
+  errors: [BadRequest, NotFound, Conflict, UnknownArchilError],
+  protocol: ArchilProtocol,
+  retry: Retry.Retry,
+}));
+
+export type StartSandboxError =
+  | BadRequest
+  | NotFound
+  | Conflict
+  | ArchilOpError;
+/** Cold-start a sandbox Cold-boots from the persisted configuration and disks. If the sandbox was paused, its memory snapshot is consumed and discarded before the new VM runs; disk state remains. Starting a running sandbox or a pending cold start is idempotent. A sandbox that is stopping, pausing, or pending a resume returns 409. */
+export const startSandbox: API.OperationMethod<
+  StartSandboxRequest,
+  ApiResponseSandbox,
+  StartSandboxError,
+  ArchilOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: StartSandboxRequest,
+  output: ApiResponseSandbox,
+  errors: [BadRequest, NotFound, Conflict, UnknownArchilError],
+  protocol: ArchilProtocol,
+  retry: Retry.Retry,
+}));
+
+export type StopSandboxError = BadRequest | NotFound | Conflict | ArchilOpError;
+/** Stop a sandbox Gracefully shuts down the guest, then checkpoints its disk before entering `stopped`. The sandbox and any forks from it cold-boot from disk state. Stopping a paused sandbox reuses its existing disk checkpoint. In-flight processes receive the guest shutdown signal. */
+export const stopSandbox: API.OperationMethod<
+  StopSandboxRequest,
+  ApiResponseSandbox,
+  StopSandboxError,
+  ArchilOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: StopSandboxRequest,
+  output: ApiResponseSandbox,
+  errors: [BadRequest, NotFound, Conflict, UnknownArchilError],
+  protocol: ArchilProtocol,
+  retry: Retry.Retry,
+}));