@ellipsis-dev/sdk 0.28.0 → 0.30.0

package/dist/index.js

@@ -30,15 +30,15 @@ var Page = class {
 
 // src/core/sessionHandle.ts
 var TERMINAL_STATUSES = /* @__PURE__ */ new Set([
-  "completed",
-  "error",
+  "closed",
+  "idle",
+  "failed",
   "cancelled",
   "stopped"
 ]);
 var DEFAULT_POLL_INTERVAL_MS = 3e3;
 function isSettled(session) {
-  if (TERMINAL_STATUSES.has(session.status)) return true;
-  return session.session_state === "idle" || session.session_state === "closed";
+  return session.lifecycle.conversation === "closed" || TERMINAL_STATUSES.has(session.lifecycle.status);
 }
 var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 var SessionHandle = class {
@@ -255,6 +255,12 @@ var EllipsisAccountApiKeys = class {
    *
    * Authenticate as a dashboard user or with a user token. An organization
    * API key cannot create other keys. The secret is returned only once.
+   *
+   * Required permissions: write:tokens.
+   * API key: Requires a CLI user token belonging to an account administrator.
+   * CLI user token: Requires an account administrator.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async create(options) {
     const path = "/v1/account/api-keys";
@@ -263,6 +269,12 @@ var EllipsisAccountApiKeys = class {
   }
   /**
    * List Api Keys
+   *
+   * Required permissions: read:tokens.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async list() {
     const path = "/v1/account/api-keys";
@@ -272,6 +284,12 @@ var EllipsisAccountApiKeys = class {
    * Revoke Api Key
    *
    * Revoke an organization key as a verified GitHub administrator.
+   *
+   * Required permissions: delete:tokens.
+   * API key: Requires a CLI user token belonging to an account administrator.
+   * CLI user token: Requires an account administrator.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async revoke(api_key_id) {
     const path = `/v1/account/api-keys/${enc(api_key_id)}`;
@@ -290,6 +308,12 @@ var EllipsisAccountBillingAutoRecharge = class {
    *
    * An account without saved settings returns disabled defaults and no
    * card. No payment-method identifier or card details are exposed.
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async get() {
     const path = "/v1/account/billing/auto-recharge";
@@ -305,6 +329,12 @@ var EllipsisAccountBillingAutoRecharge = class {
    * with enabled=false keeps recharge off; enabling requires a saved card.
    * A recharge buys amount_cents of credit and charges the platform fee
    * in addition. Amounts and thresholds preserve exact cents.
+   *
+   * Required permissions: write:account.
+   * API key: Requires a CLI user token belonging to an account administrator.
+   * CLI user token: Requires an account administrator.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async set(options) {
     const path = "/v1/account/billing/auto-recharge";
@@ -327,6 +357,12 @@ var EllipsisAccountBilling = class {
    * Requires a human account administrator. Open the returned URL to
    * finish setup and return to Billing. Saving a card does not enable
    * auto-recharge or buy credit.
+   *
+   * Required permissions: write:account.
+   * API key: Requires a CLI user token belonging to an account administrator.
+   * CLI user token: Requires an account administrator.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async cardSetup() {
     const path = "/v1/account/billing/card-setup";
@@ -341,6 +377,12 @@ var EllipsisAccountBilling = class {
    * complete payment. Credit is granted only after payment succeeds;
    * the platform fee is charged in addition to amount_cents. Returning
    * to Billing carries the checkout session ID for receipt lookup.
+   *
+   * Required permissions: write:account.
+   * API key: Requires a CLI user token belonging to an account administrator.
+   * CLI user token: Requires an account administrator.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async checkout(options) {
     const path = "/v1/account/billing/checkout";
@@ -354,6 +396,12 @@ var EllipsisAccountBilling = class {
    * bootstrap that otherwise fires lazily at the first session (Stripe
    * customer + usage subscription + the signup grant). A repeat call is
    * a no-op that returns the current state.
+   *
+   * Required permissions: write:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async claimSignupCredit() {
     const path = "/v1/account/billing/claim-signup-credit";
@@ -363,6 +411,12 @@ var EllipsisAccountBilling = class {
    * Get Fee Schedule
    *
    * Get the account's rate card, in US dollars.
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async feeSchedule() {
     const path = "/v1/account/billing/fee-schedule";
@@ -375,6 +429,12 @@ var EllipsisAccountBilling = class {
    *
    * Returns only your account's grants. The total is before usage;
    * /v1/account/budget reports the available balance.
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async grants() {
     const path = "/v1/account/billing/credit-grants";
@@ -387,6 +447,12 @@ var EllipsisAccountBilling = class {
    *
    * The amount includes the platform fee and comes from Stripe. An
    * incomplete, missing, or other-account purchase returns 404.
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async purchase(checkout_id) {
     const path = `/v1/account/billing/purchases/${enc(checkout_id)}`;
@@ -399,6 +465,12 @@ var EllipsisAccountBilling = class {
    *
    * All amounts are integer US cents. The fee is added to the credit
    * amount; it does not reduce the credit granted.
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async purchaseOptions() {
     const path = "/v1/account/billing/purchase-options";
@@ -412,6 +484,12 @@ var EllipsisAccountBilling = class {
    * Uses the same account gate as session admission, including credit,
    * contact email, and personal Claude subscription eligibility. Scoped
    * spend limits are reported separately by /v1/account/budget.
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async status() {
     const path = "/v1/account/billing";
@@ -436,6 +514,12 @@ var EllipsisAccountModels = class {
    * Reads the same registry as the dashboard's rate table, so a
    * client's model picker can never drift from what's offered. The
    * selectable set is global; only the flag is account-scoped.
+   *
+   * Required permissions: read:templates.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async list() {
     const path = "/v1/account/models";
@@ -453,6 +537,12 @@ var EllipsisAccountNotifications = class {
    * Send the alert email template to one address with sample data,
    * so a typo'd finance alias is caught by a human instead of failing
    * silently when a real alert fires.
+   *
+   * Required permissions: write:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async testEmail(options) {
     const path = "/v1/account/notifications/test-email";
@@ -460,6 +550,51 @@ var EllipsisAccountNotifications = class {
     return await this.transport.request("POST", path, { body });
   }
 };
+var EllipsisAccountOnboarding = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  transport;
+  /**
+   * Get Account Onboarding
+   *
+   * Read the account's saved onboarding answers, or null before setup.
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   */
+  async get() {
+    const path = "/v1/account/onboarding";
+    return await this.transport.request("GET", path);
+  }
+  /**
+   * Update Account Onboarding
+   *
+   * Save supplied onboarding answers, preserving omitted answers.
+   *
+   * Organizations can save their work email before selecting use cases.
+   * Saving use cases requires a valid organization work email and at
+   * least one choice. When Other is the only choice, describe it.
+   * Personal accounts save a null work email. This does not change the
+   * billing contact email. Sandbox credentials cannot update answers.
+   * Supplying an organization work email requires a human user and sends
+   * a Slack Connect invitation. Slack failures do not undo saved answers.
+   *
+   * Required permissions: write:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
+   */
+  async update(options = {}) {
+    const path = "/v1/account/onboarding";
+    const body = buildBody({ other_use_case: options.other_use_case, use_cases: options.use_cases, work_email: options.work_email });
+    return await this.transport.request("PATCH", path, { body });
+  }
+};
 var EllipsisAccountProvidersAnthropic = class {
   constructor(transport) {
     this.transport = transport;
@@ -467,6 +602,12 @@ var EllipsisAccountProvidersAnthropic = class {
   transport;
   /**
    * Delete Anthropic Config
+   *
+   * Required permissions: delete:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async delete() {
     const path = "/v1/account/providers/anthropic";
@@ -474,6 +615,12 @@ var EllipsisAccountProvidersAnthropic = class {
   }
   /**
    * Get Anthropic Config
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async get() {
     const path = "/v1/account/providers/anthropic";
@@ -481,6 +628,12 @@ var EllipsisAccountProvidersAnthropic = class {
   }
   /**
    * Put Anthropic Config
+   *
+   * Required permissions: write:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async set(options) {
     const path = "/v1/account/providers/anthropic";
@@ -489,6 +642,12 @@ var EllipsisAccountProvidersAnthropic = class {
   }
   /**
    * Validate Anthropic Config
+   *
+   * Required permissions: write:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async validate() {
     const path = "/v1/account/providers/anthropic/validate";
@@ -502,6 +661,12 @@ var EllipsisAccountProvidersBedrock = class {
   transport;
   /**
    * Delete Bedrock Config
+   *
+   * Required permissions: delete:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async delete() {
     const path = "/v1/account/providers/bedrock";
@@ -509,6 +674,12 @@ var EllipsisAccountProvidersBedrock = class {
   }
   /**
    * Get Bedrock Config
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async get() {
     const path = "/v1/account/providers/bedrock";
@@ -516,6 +687,12 @@ var EllipsisAccountProvidersBedrock = class {
   }
   /**
    * Put Bedrock Config
+   *
+   * Required permissions: write:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async set(options) {
     const path = "/v1/account/providers/bedrock";
@@ -524,6 +701,12 @@ var EllipsisAccountProvidersBedrock = class {
   }
   /**
    * Validate Bedrock Config
+   *
+   * Required permissions: write:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async validate() {
     const path = "/v1/account/providers/bedrock/validate";
@@ -553,6 +736,12 @@ var EllipsisAccountSettings = class {
    * Session model and budget defaults, code review and mention behavior,
    * analytics, retention, and notification contacts. PATCH replaces
    * supplied sections; PUT preserves its model-and-budget-only behavior.
+   *
+   * Required permissions: read:defaults.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async get() {
     const path = "/v1/account/settings";
@@ -570,6 +759,12 @@ var EllipsisAccountSettings = class {
    * ceiling, and null clears it.
    * Refused for sandbox tokens (potentially prompt-injected code must
    * not repoint the organization's defaults).
+   *
+   * Required permissions: write:defaults.
+   * API key: Requires a CLI user token belonging to an account administrator.
+   * CLI user token: Requires an account administrator.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async set(options) {
     const path = "/v1/account/settings";
@@ -582,10 +777,16 @@ var EllipsisAccountSettings = class {
    * Replace supplied settings sections without changing omitted sections.
    *
    * Changes to model or budget defaults require a GitHub administrator.
+   *
+   * Required permissions: write:defaults.
+   * API key: Cannot set budget_ceiling, default_model to a non-null value; those changes require a CLI user token belonging to an account administrator.
+   * CLI user token: Requires an account administrator when setting budget_ceiling, default_model to a non-null value.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async update(options = {}) {
     const path = "/v1/account/settings";
-    const body = buildBody({ analytics: options.analytics, budget_ceiling: options.budget_ceiling, code_review: options.code_review, data_retention: options.data_retention, default_model: options.default_model, mention: options.mention, notifications: options.notifications });
+    const body = buildBody({ analytics: options.analytics, budget_ceiling: options.budget_ceiling, code_review: options.code_review, data_retention: options.data_retention, default_model: options.default_model, notifications: options.notifications });
     return await this.transport.request("PATCH", path, { body });
   }
 };
@@ -596,6 +797,7 @@ var EllipsisAccount = class {
     this.billing = new EllipsisAccountBilling(transport);
     this.models = new EllipsisAccountModels(transport);
     this.notifications = new EllipsisAccountNotifications(transport);
+    this.onboarding = new EllipsisAccountOnboarding(transport);
     this.providers = new EllipsisAccountProviders(transport);
     this.settings = new EllipsisAccountSettings(transport);
   }
@@ -604,6 +806,7 @@ var EllipsisAccount = class {
   billing;
   models;
   notifications;
+  onboarding;
   providers;
   settings;
   /**
@@ -612,6 +815,12 @@ var EllipsisAccount = class {
    * All-time per-surface activity flags: the dashboards' demo-data
    * fallback reads these instead of inferring "no history" from a
    * windowed, filtered response.
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async activity() {
     const path = "/v1/account/activity";
@@ -619,6 +828,12 @@ var EllipsisAccount = class {
   }
   /**
    * Get Customer Audit Log
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async auditLog() {
     const path = "/v1/account/audit-log";
@@ -632,8 +847,14 @@ var EllipsisAccount = class {
    * Budgets cover the trailing 1, 7 and 28 days; they do not replenish
    * prepaid credit. Amounts include measured usage from active sessions.
    * Each paid LLM request requires positive credit and budget headroom.
-   * An admitted request can overshoot; concurrency is limited to five
-   * paid requests per account and one per session.
+   * An admitted request can overshoot; concurrent paid requests are limited
+   * by your account and per-session allowances.
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async budget() {
     const path = "/v1/account/budget";
@@ -641,6 +862,12 @@ var EllipsisAccount = class {
   }
   /**
    * Update Customer
+   *
+   * Required permissions: write:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async update(options = {}) {
     const path = "/v1/account";
@@ -659,6 +886,12 @@ var EllipsisAccount = class {
    * request, including sessions already running. API keys and sandbox
    * credentials cannot edit budgets. The session ceiling remains at
    * /account/settings; purchasing credits is separate from budget policy.
+   *
+   * Required permissions: write:defaults.
+   * API key: Requires a CLI user token belonging to an account administrator.
+   * CLI user token: Requires an account administrator.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async updateBudget(options = {}) {
     const path = "/v1/account/budget";
@@ -675,6 +908,12 @@ var EllipsisAccount = class {
    * rated token usage through BYOK, customer Bedrock, or a developer's
    * Claude subscription. Rated usage estimates are not provider invoices.
    * Pending and unresolved requests identify missing measurements.
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async usage(options = {}) {
     const path = "/v1/account/usage";
@@ -682,6 +921,212 @@ var EllipsisAccount = class {
     return await this.transport.request("GET", path, { query });
   }
 };
+var EllipsisAgents = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  transport;
+  /**
+   * Create Agent
+   *
+   * Create an agent, managed through the API: no file, live
+   * immediately. To put its definition in a repository instead, create
+   * it here and then POST /v1/agents/{agent_id}/link.
+   *
+   * 409 when another live agent already holds the name.
+   *
+   * Required permissions: write:configs.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async create(options) {
+    const path = "/v1/agents";
+    const body = buildBody({ agent: options.agent });
+    return await this.transport.request("POST", path, { body });
+  }
+  /**
+   * Delete Agent
+   *
+   * Delete an agent, by id or by name.
+   *
+   * It stops running and its name is freed immediately; its past
+   * sessions remain readable. Only for agents managed through
+   * this API — delete the file to remove one defined by a repository.
+   *
+   * Required permissions: write:configs.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async delete(agent_id) {
+    const path = `/v1/agents/${enc(agent_id)}`;
+    await this.transport.request("DELETE", path);
+  }
+  /**
+   * Get Agent
+   *
+   * Return one agent, by id or by name.
+   *
+   * Required permissions: read:configs.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async get(agent_id) {
+    const path = `/v1/agents/${enc(agent_id)}`;
+    return await this.transport.request("GET", path);
+  }
+  /**
+   * Link Agent
+   *
+   * Move an agent into a repository, by id or by name.
+   *
+   * Opens a pull request adding its definition file. The agent
+   * keeps running unchanged meanwhile; merging hands it over to the
+   * file, after which the file is what changes it. Nothing happens
+   * if the pull request is never merged.
+   *
+   * Required permissions: write:configs.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async link(agent_id, options) {
+    const path = `/v1/agents/${enc(agent_id)}/link`;
+    const body = buildBody({ path: options.path, repository: options.repository });
+    return await this.transport.request("POST", path, { body });
+  }
+  /**
+   * List Agents
+   *
+   * List agents.
+   *
+   * Required permissions: read:configs.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async list() {
+    const path = "/v1/agents";
+    return await this.transport.request("GET", path);
+  }
+  /**
+   * Get Agent Metrics
+   *
+   * Return an agent's session distribution and trailing spend,
+   * by id or by name.
+   *
+   * `samples` carries one entry per finished session (duration, cost,
+   * tokens) for distributions; `spend_windows` carries what the
+   * agent's sessions cost over the last 1, 7, and 28 days against
+   * its budget for each window.
+   *
+   * Required permissions: read:configs.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async metrics(agent_id) {
+    const path = `/v1/agents/${enc(agent_id)}/metrics`;
+    return await this.transport.request("GET", path);
+  }
+  /**
+   * Start Agent Session
+   *
+   * Invoke an agent.
+   *
+   * Runs a certified agent with its configured instructions, model,
+   * environment, permissions, skills, and budget, and returns
+   * the session it started. The session runs once and does not accept
+   * follow-up messages. If the agent declares input.json_schema,
+   * send only `input` for its initial message. Otherwise send a non-empty
+   * `prompt`, which becomes the initial message verbatim. Both fields
+   * together, neither field, and input that renders an empty message are
+   * rejected with 422. An optional `budget` lowers the session cap;
+   * `metadata` tags the session. Codex invocations are not supported.
+   *
+   * Required permissions: write:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async run(agent_id, options = {}) {
+    const path = `/v1/agents/${enc(agent_id)}/sessions`;
+    const body = buildBody({ budget: options.budget, input: options.input, metadata: options.metadata, prompt: options.prompt });
+    return await this.transport.request("POST", path, { body });
+  }
+  /**
+   * Get Agents Stream Ticket
+   *
+   * Required permissions: read:configs.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async streamTicket() {
+    const path = "/v1/agents/stream-ticket";
+    return await this.transport.request("GET", path);
+  }
+  /**
+   * Unlink Agent
+   *
+   * Take over an agent from its file, by id or by name.
+   *
+   * The file stops governing it immediately and further changes go
+   * through this API. The file is left in place, inert — delete it
+   * whenever you like.
+   *
+   * Required permissions: write:configs.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async unlink(agent_id) {
+    const path = `/v1/agents/${enc(agent_id)}/unlink`;
+    return await this.transport.request("POST", path);
+  }
+  /**
+   * Update Agent
+   *
+   * Replace an agent's definition, by id or by name.
+   *
+   * The whole definition is replaced, and the change is live at
+   * once. Only for agents managed through this API: one defined
+   * by a repository file is a 409, since the next push to that file
+   * would revert the change — unlink it first to take ownership.
+   *
+   * Required permissions: write:configs.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async update(agent_id, options) {
+    const path = `/v1/agents/${enc(agent_id)}`;
+    const body = buildBody({ agent: options.agent });
+    return await this.transport.request("PUT", path, { body });
+  }
+};
 var EllipsisAlerts = class {
   constructor(transport) {
     this.transport = transport;
@@ -693,6 +1138,12 @@ var EllipsisAlerts = class {
    * Dismiss an open alert and return it.
    *
    * 409 when the alert is not open; 404 when it doesn't exist.
+   *
+   * Required permissions: write:alerts.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async dismiss(alert_id) {
     const path = `/v1/alerts/${enc(alert_id)}/dismiss`;
@@ -704,6 +1155,12 @@ var EllipsisAlerts = class {
    * Return one alert by id.
    *
    * 404 if it doesn't exist or belongs to another organization.
+   *
+   * Required permissions: read:alerts.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async get(alert_id) {
     const path = `/v1/alerts/${enc(alert_id)}`;
@@ -718,6 +1175,12 @@ var EllipsisAlerts = class {
    *
    * Available to all credential types, so an agent can check "is
    * this org near budget?" mid-task.
+   *
+   * Required permissions: read:alerts.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async list(options = {}) {
     const path = "/v1/alerts";
@@ -747,6 +1210,12 @@ var EllipsisAnalytics = class {
    * the apps/agents). Available to all credential types: the
    * responses expose the organization's own GitHub PR/review activity,
    * no secrets.
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async metrics(options = {}) {
     const path = "/v1/analytics/metrics";
@@ -760,6 +1229,12 @@ var EllipsisAnalytics = class {
    *
    * Windowing: pass explicit start/end, or days (default: the last
    * 30 days). account_type in all|user|bot scopes the authors.
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async pullRequests(options = {}) {
     const path = "/v1/analytics/pull-requests";
@@ -775,6 +1250,12 @@ var EllipsisAnalytics = class {
    * review the most PRs?" is the reviewer facets here with
    * account_type=bot. Windowing: pass explicit start/end, or days
    * (default: the last 30 days).
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async reviews(options = {}) {
     const path = "/v1/analytics/reviews";
@@ -793,6 +1274,8 @@ var EllipsisAuthCli = class {
    * Poll a device-code auth flow for its token.
    *
    * Unauthenticated; the device code identifies the flow.
+   *
+   * Authentication: No token required.
    */
   async poll(options) {
     const path = "/v1/auth/cli/poll";
@@ -807,6 +1290,8 @@ var EllipsisAuthCli = class {
    * Unauthenticated: the CLI has no credential yet — that's what
    * it's obtaining. The human authorizes out-of-band in the
    * dashboard.
+   *
+   * Authentication: No token required.
    */
   async start() {
     const path = "/v1/auth/cli/start";
@@ -821,142 +1306,6 @@ var EllipsisAuth = class {
   transport;
   cli;
 };
-var EllipsisAutomations = class {
-  constructor(transport) {
-    this.transport = transport;
-  }
-  transport;
-  /**
-   * Create Automation
-   *
-   * Create an automation, managed through the API: no file, live
-   * immediately. To put its definition in a repository instead, create
-   * it here and then POST /v1/automations/{automation_id}/link.
-   *
-   * 409 when another live automation already holds the name.
-   */
-  async create(options) {
-    const path = "/v1/automations";
-    const body = buildBody({ automation: options.automation });
-    return await this.transport.request("POST", path, { body });
-  }
-  /**
-   * Delete Automation
-   *
-   * Delete an automation, by id or by name.
-   *
-   * It stops running and its name is freed immediately; its past
-   * sessions remain readable. Only for automations managed through
-   * this API — delete the file to remove one defined by a repository.
-   */
-  async delete(automation_id) {
-    const path = `/v1/automations/${enc(automation_id)}`;
-    await this.transport.request("DELETE", path);
-  }
-  /**
-   * Get Automation
-   *
-   * Return one automation, by id or by name.
-   */
-  async get(automation_id) {
-    const path = `/v1/automations/${enc(automation_id)}`;
-    return await this.transport.request("GET", path);
-  }
-  /**
-   * Link Automation
-   *
-   * Move an automation into a repository, by id or by name.
-   *
-   * Opens a pull request adding its definition file. The automation
-   * keeps running unchanged meanwhile; merging hands it over to the
-   * file, after which the file is what changes it. Nothing happens
-   * if the pull request is never merged.
-   */
-  async link(automation_id, options) {
-    const path = `/v1/automations/${enc(automation_id)}/link`;
-    const body = buildBody({ path: options.path, repository: options.repository });
-    return await this.transport.request("POST", path, { body });
-  }
-  /**
-   * List Automations
-   *
-   * List automations.
-   */
-  async list() {
-    const path = "/v1/automations";
-    return await this.transport.request("GET", path);
-  }
-  /**
-   * Get Automation Metrics
-   *
-   * Return an automation's session distribution and trailing spend,
-   * by id or by name.
-   *
-   * `samples` carries one entry per finished session (duration, cost,
-   * tokens) for distributions; `spend_windows` carries what the
-   * automation's sessions cost over the last 1, 7, and 28 days against
-   * its budget for each window.
-   */
-  async metrics(automation_id) {
-    const path = `/v1/automations/${enc(automation_id)}/metrics`;
-    return await this.transport.request("GET", path);
-  }
-  /**
-   * Start Automation Session
-   *
-   * Invoke an automation.
-   *
-   * Runs a certified automation with its configured instructions, model,
-   * environment, permissions, skills, and budget, and returns
-   * the session it started. The session runs once and does not accept
-   * follow-up messages. If the automation declares input.json_schema,
-   * send only `input` for its initial message. Otherwise send a non-empty
-   * `prompt`, which becomes the initial message verbatim. Both fields
-   * together, neither field, and input that renders an empty message are
-   * rejected with 422. An optional `budget` lowers the session cap;
-   * `metadata` tags the session. Codex invocations are not supported.
-   */
-  async run(automation_id, options = {}) {
-    const path = `/v1/automations/${enc(automation_id)}/sessions`;
-    const body = buildBody({ budget: options.budget, input: options.input, metadata: options.metadata, prompt: options.prompt });
-    return await this.transport.request("POST", path, { body });
-  }
-  /**
-   * Get Automations Stream Ticket
-   */
-  async streamTicket() {
-    const path = "/v1/automations/stream-ticket";
-    return await this.transport.request("GET", path);
-  }
-  /**
-   * Unlink Automation
-   *
-   * Take over an automation from its file, by id or by name.
-   *
-   * The file stops governing it immediately and further changes go
-   * through this API. The file is left in place, inert — delete it
-   * whenever you like.
-   */
-  async unlink(automation_id) {
-    const path = `/v1/automations/${enc(automation_id)}/unlink`;
-    return await this.transport.request("POST", path);
-  }
-  /**
-   * Update Automation
-   *
-   * Replace an automation's definition, by id or by name.
-   *
-   * The whole definition is replaced, and the change is live at
-   * once. Only for automations managed through this API: one defined
-   * by a repository file is a 409, since the next push to that file
-   * would revert the change — unlink it first to take ownership.
-   */
-  async update(automation_id, options) {
-    const path = `/v1/automations/${enc(automation_id)}`;
-    const body = buildBody({ automation: options.automation });
-    return await this.transport.request("PUT", path, { body });
-  }
-};
 var EllipsisEnvironments = class {
   constructor(transport) {
     this.transport = transport;
@@ -970,6 +1319,12 @@ var EllipsisEnvironments = class {
    * `kind: environment` YAML under an agents directory.
    *
    * 409 when another live environment already holds the name.
+   *
+   * Required permissions: write:environments.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async create(options) {
     const path = "/v1/environments";
@@ -986,6 +1341,12 @@ var EllipsisEnvironments = class {
    * environment. Past sessions remain readable. Only for environments
    * managed through this API — delete the file to remove one defined
    * by a repository.
+   *
+   * Required permissions: delete:environments.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async delete(environment_id) {
     const path = `/v1/environments/${enc(environment_id)}`;
@@ -995,6 +1356,12 @@ var EllipsisEnvironments = class {
    * Get Environment
    *
    * Return one saved environment, by id or by name.
+   *
+   * Required permissions: read:environments.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async get(environment_id) {
     const path = `/v1/environments/${enc(environment_id)}`;
@@ -1004,6 +1371,12 @@ var EllipsisEnvironments = class {
    * List Environments
    *
    * List saved environments.
+   *
+   * Required permissions: read:environments.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async list() {
     const path = "/v1/environments";
@@ -1018,6 +1391,12 @@ var EllipsisEnvironments = class {
    * resolve the new body; running sessions keep the one frozen at
    * their start. Only for environments managed through this API: one
    * defined by a repository file is a 409.
+   *
+   * Required permissions: write:environments.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async update(environment_id, options) {
     const path = `/v1/environments/${enc(environment_id)}`;
@@ -1040,6 +1419,13 @@ var EllipsisFiles = class {
    * agent persisting a screenshot to link on a PR), but all
    * credential types work. Returns the org-membership-gated
    * dashboard URL so callers never hard-code URL shapes.
+   *
+   * Required permissions: write:files.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async create(options) {
     const path = "/v1/files";
@@ -1057,6 +1443,13 @@ var EllipsisFiles = class {
    * potentially-untrusted code and must not be able to destroy the
    * account's files — uploading is fine, destruction is not); API
    * keys and user tokens may delete.
+   *
+   * Required permissions: delete:files.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async delete(file_id) {
     const path = `/v1/files/${enc(file_id)}`;
@@ -1078,6 +1471,13 @@ var EllipsisFiles = class {
    * To fetch the bytes locally, call this and then GET download_url
    * immediately — the JSON API never carries the file. The CLI's
    * `agent file get` wraps exactly that two-step.
+   *
+   * Required permissions: read:files.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async get(file_id) {
     const path = `/v1/files/${enc(file_id)}`;
@@ -1092,6 +1492,13 @@ var EllipsisFiles = class {
    * a download_urls map keyed by file id for thumbnails or batch
    * downloads. URLs expire within about a minute. session_id scopes
    * the list to one session's uploads.
+   *
+   * Required permissions: read:files.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async list(options = {}) {
     const path = "/v1/files";
@@ -1104,6 +1511,67 @@ var EllipsisFiles = class {
     );
   }
 };
+var EllipsisHandlers = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  transport;
+  /**
+   * List Handlers
+   *
+   * List the account's Slack, GitHub, Linear, and Sentry handlers.
+   *
+   * Returns at most one handler per service, from the current .ellipsis
+   * repository. Disabled handlers and last valid definitions with sync
+   * errors are included. Missing handlers are omitted. This reads saved
+   * state without fetching GitHub or triggering synchronization.
+   *
+   * Requires configs:read; scoped grants match handlers/{service}.
+   * Sandbox credentials with that grant may read handlers.
+   *
+   * Required permissions: read:configs.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async list() {
+    const path = "/v1/handlers";
+    return await this.transport.request("GET", path);
+  }
+  /**
+   * Get Handler Metrics
+   *
+   * Return session counts and accumulated spend for a saved handler.
+   *
+   * Filters only by session creation time. Omitted bounds include all
+   * history. Counts use the current conversation outcome, so an idle
+   * session remains active. Spend includes the selected sessions' full
+   * accumulated cost, including activity after the creation-time window.
+   * Only sessions carrying this exact saved handler id are counted;
+   * legacy sessions without handler provenance are excluded.
+   *
+   * spend_windows reports current trailing 1-, 7-, and 28-day credit
+   * debits and effective handler budgets across all attributed sessions.
+   * Those windows use usage timestamps and are independent of start/end.
+   *
+   * Requires configs:read matching handlers/{service} and unrestricted
+   * sessions:read. Sandbox tokens with both grants may read metrics.
+   *
+   * Required permissions: read:sessions, read:configs.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async metrics(handler_id, options = {}) {
+    const path = `/v1/handlers/${enc(handler_id)}/metrics`;
+    const query = buildQuery({ start: options.start, end: options.end });
+    return await this.transport.request("GET", path, { query });
+  }
+};
 var EllipsisIntegrationsGithub = class {
   constructor(transport) {
     this.transport = transport;
@@ -1119,6 +1587,12 @@ var EllipsisIntegrationsGithub = class {
    *
    * Members carry their linked Slack identity when a Slack-GitHub
    * link exists, and /slack/members carries the reverse link.
+   *
+   * Required permissions: read:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async members() {
     const path = "/v1/integrations/github/members";
@@ -1128,6 +1602,12 @@ var EllipsisIntegrationsGithub = class {
    * List Github Repositories
    *
    * List GitHub repositories connected to the installation.
+   *
+   * Required permissions: read:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async repos() {
     const path = "/v1/integrations/github/repos";
@@ -1135,6 +1615,12 @@ var EllipsisIntegrationsGithub = class {
   }
   /**
    * Uninstall Github App
+   *
+   * Required permissions: write:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async uninstall(options) {
     const path = "/v1/integrations/github/uninstall";
@@ -1149,6 +1635,12 @@ var EllipsisIntegrationsLinear = class {
   transport;
   /**
    * Delete Linear Integration
+   *
+   * Required permissions: delete:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async delete() {
     const path = "/v1/integrations/linear";
@@ -1158,6 +1650,12 @@ var EllipsisIntegrationsLinear = class {
    * List Linear Teams
    *
    * List the teams of the connected Linear workspace.
+   *
+   * Required permissions: read:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async teams() {
     const path = "/v1/integrations/linear/teams";
@@ -1165,6 +1663,12 @@ var EllipsisIntegrationsLinear = class {
   }
   /**
    * Update Linear Teams
+   *
+   * Required permissions: write:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async updateSettings(options) {
     const path = "/v1/integrations/linear/settings";
@@ -1179,6 +1683,12 @@ var EllipsisIntegrationsSentry = class {
   transport;
   /**
    * Delete Sentry Integration
+   *
+   * Required permissions: delete:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async delete(integration_id) {
     const path = `/v1/integrations/sentry/${enc(integration_id)}`;
@@ -1188,6 +1698,12 @@ var EllipsisIntegrationsSentry = class {
    * List Sentry Organizations
    *
    * List the connected Sentry organizations.
+   *
+   * Required permissions: read:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async organizations() {
     const path = "/v1/integrations/sentry/organizations";
@@ -1204,6 +1720,12 @@ var EllipsisIntegrationsSlack = class {
    *
    * List the channels of the connected Slack workspace, fetched
    * live from the Slack API.
+   *
+   * Required permissions: read:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async channels() {
     const path = "/v1/integrations/slack/channels";
@@ -1211,6 +1733,12 @@ var EllipsisIntegrationsSlack = class {
   }
   /**
    * Create Operations Channel
+   *
+   * Required permissions: write:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async createOperationsChannel() {
     const path = "/v1/integrations/slack/operations-channel";
@@ -1218,6 +1746,12 @@ var EllipsisIntegrationsSlack = class {
   }
   /**
    * Delete Slack Integration
+   *
+   * Required permissions: delete:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async delete() {
     const path = "/v1/integrations/slack";
@@ -1228,6 +1762,12 @@ var EllipsisIntegrationsSlack = class {
    *
    * List the members of the connected Slack workspace, fetched
    * live from the Slack API.
+   *
+   * Required permissions: read:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async members() {
     const path = "/v1/integrations/slack/members";
@@ -1235,6 +1775,12 @@ var EllipsisIntegrationsSlack = class {
   }
   /**
    * Update Slack Settings
+   *
+   * Required permissions: write:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async updateSettings(options) {
     const path = "/v1/integrations/slack/settings";
@@ -1262,10 +1808,16 @@ var EllipsisIntegrations = class {
    *
    * A read-only view, so an agent authoring another agent's
    * config can learn which repositories, channels, teams, and
-   * organizations it may name before POST /automations.
+   * organizations it may name before POST /agents.
    *
    * Available to all credential types including sandbox tokens: the
    * responses never include OAuth tokens or any other secret.
+   *
+   * Required permissions: read:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async list() {
     const path = "/v1/integrations";
@@ -1289,6 +1841,13 @@ var EllipsisMemories = class {
    *
    * Creating never overwrites: a path that already exists is a 409, so
    * correcting an existing memory is an explicit edit.
+   *
+   * Required permissions: write:memories.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async create(options) {
     const path = "/v1/memories";
@@ -1303,6 +1862,13 @@ var EllipsisMemories = class {
    * Available to every credential type, agents included — a wrong
    * memory is worse than a missing one. The deleted content is kept in
    * the memory's history for forensics, not for an undo API.
+   *
+   * Required permissions: delete:memories.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async delete(memory_id, options = {}) {
     const path = `/v1/memories/${enc(memory_id)}`;
@@ -1320,6 +1886,13 @@ var EllipsisMemories = class {
    *
    * Pass `if_sha256` (from a previous read) to make a concurrent write
    * a 409 instead of silently overwriting it.
+   *
+   * Required permissions: write:memories.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async edit(memory_id, options = {}) {
     const path = `/v1/memories/${enc(memory_id)}`;
@@ -1332,6 +1905,13 @@ var EllipsisMemories = class {
    * Read one memory's full content.
    *
    * The id comes from the index returned by listing memories.
+   *
+   * Required permissions: read:memories.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async get(memory_id) {
     const path = `/v1/memories/${enc(memory_id)}`;
@@ -1346,6 +1926,13 @@ var EllipsisMemories = class {
    * memory, carrying its id, path, and description) plus the same
    * entries structured, each with every field except `content`. Read
    * the index, then fetch the ids whose content you want.
+   *
+   * Required permissions: read:memories.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async list(options = {}) {
     const path = "/v1/memories";
@@ -1360,6 +1947,12 @@ var EllipsisReviews = class {
   transport;
   /**
    * List Review Configs
+   *
+   * Required permissions: read:reviews.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async configs() {
     const path = "/v1/reviews/configs";
@@ -1380,6 +1973,12 @@ var EllipsisReviews = class {
    * `stages[].session_id` is where a client streams
    * (/sessions/{id}/stream on a stage session), since the review
    * itself is a pipeline rather than one process.
+   *
+   * Required permissions: write:reviews.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async create(options) {
     const path = "/v1/reviews";
@@ -1397,6 +1996,12 @@ var EllipsisReviews = class {
    * Findings only exist after a stage session finalizes — a running
    * review honestly reports [] / null, which is why a client
    * streams a stage session and then re-fetches the review.
+   *
+   * Required permissions: read:reviews.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async get(review_id) {
     const path = `/v1/reviews/${enc(review_id)}`;
@@ -1414,6 +2019,12 @@ var EllipsisReviews = class {
    *
    * Webhook-created reviews appear here too, so this answers "show
    * me every review on this PR".
+   *
+   * Required permissions: read:reviews.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async list(options = {}) {
     const path = "/v1/reviews";
@@ -1426,33 +2037,6 @@ var EllipsisReviews = class {
     );
   }
 };
-var EllipsisSandboxes = class {
-  constructor(transport) {
-    this.transport = transport;
-  }
-  transport;
-  /**
-   * Get Single Sandbox
-   */
-  async get(sandbox_id) {
-    const path = `/v1/sandboxes/${enc(sandbox_id)}`;
-    return await this.transport.request("GET", path);
-  }
-  /**
-   * Get Sandboxes
-   */
-  async list() {
-    const path = "/v1/sandboxes";
-    await this.transport.request("GET", path);
-  }
-  /**
-   * Get Sandbox Stream Ticket
-   */
-  async streamTicket(sandbox_id) {
-    const path = `/v1/sandboxes/${enc(sandbox_id)}/stream-ticket`;
-    return await this.transport.request("GET", path);
-  }
-};
 var EllipsisSecrets = class {
   constructor(transport) {
     this.transport = transport;
@@ -1465,6 +2049,13 @@ var EllipsisSecrets = class {
    *
    * Refused for sandbox tokens; mutations require an API key or
    * user token.
+   *
+   * Required permissions: delete:secrets.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async delete(name) {
     const path = `/v1/secrets/${enc(name)}`;
@@ -1477,6 +2068,13 @@ var EllipsisSecrets = class {
    *
    * Values are write-only: the response carries only names and
    * timestamps, never the stored value.
+   *
+   * Required permissions: read:secrets.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async list() {
     const path = "/v1/secrets";
@@ -1491,6 +2089,13 @@ var EllipsisSecrets = class {
    * only — values are write-only. Refused for sandbox tokens (held by
    * potentially-untrusted in-sandbox code); mutations require an
    * API key or user token.
+   *
+   * Required permissions: write:secrets.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async set(options) {
     const path = "/v1/secrets";
@@ -1504,7 +2109,7 @@ var EllipsisSessions = class {
   }
   transport;
   /**
-   * Get Agent Session Analytics
+   * Get Session Analytics
    *
    * Measured tokens and spend over time, plus estimated content cost.
    *
@@ -1515,13 +2120,20 @@ var EllipsisSessions = class {
    * or unsupported context remains explicitly unattributed. No raw
    * prompts or tool results are returned. Sandbox tokens may read only
    * their own session's analytics.
+   *
+   * Required permissions: read:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own session.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async analytics(session_id) {
     const path = `/v1/sessions/${enc(session_id)}/analytics`;
     return await this.transport.request("GET", path);
   }
   /**
-   * Get Agent Session Diff
+   * Get Session Diff
    *
    * Return the session's uncommitted changes as a patch.
    *
@@ -1530,29 +2142,22 @@ var EllipsisSessions = class {
    * counts ride on the session itself (`git.repos[].files`); this
    * is the text behind them. Empty when the tree was clean. A
    * sandbox token may read only its own session's diff.
+   *
+   * Required permissions: read:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own session.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async diff(session_id) {
     const path = `/v1/sessions/${enc(session_id)}/diff`;
     return await this.transport.request("GET", path);
   }
   /**
-   * List Session Executions
-   *
-   * Return the session's execution attempts, oldest first.
-   *
-   * Includes the selected harness, model, resolved instructions, initial
-   * query, and common result summary. Complete native outputs remain in
-   * the session's records. Internal launch options and checkpoint storage
-   * references are excluded.
-   */
-  async executions(session_id) {
-    const path = `/v1/sessions/${enc(session_id)}/executions`;
-    return await this.transport.request("GET", path);
-  }
-  /**
-   * Export Agent Session
+   * Download Session
    *
-   * Export the complete session history.
+   * Download the complete session history.
    *
    * The complete, ordered history of the session (agent output, tool calls, thinking,
    * lifecycle events, sandbox output, message events) as an ordered
@@ -1562,41 +2167,83 @@ var EllipsisSessions = class {
    * for one file. The JSON API never carries the bytes (same
    * two-step as files). /records is the paged live view of the
    * same data.
+   *
+   * Required permissions: read:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async download(session_id) {
+    const path = `/v1/sessions/${enc(session_id)}/download`;
+    return await this.transport.request("GET", path);
+  }
+  /**
+   * List Session Executions
+   *
+   * Return the session's execution attempts, oldest first.
+   *
+   * Includes the selected harness, model, resolved instructions, initial
+   * query, and common result summary. Complete native outputs remain in
+   * the session's records. Internal launch options and checkpoint storage
+   * references are excluded.
+   *
+   * Required permissions: read:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
-  async export(session_id) {
-    const path = `/v1/sessions/${enc(session_id)}/export`;
+  async executions(session_id) {
+    const path = `/v1/sessions/${enc(session_id)}/executions`;
     return await this.transport.request("GET", path);
   }
   /**
-   * Get Agent Session
+   * Get Session
    *
    * Return one session.
    *
    * The public wire shape — the same shape the stream's session
-   * frames carry, with attributed_user and stopped_by_user resolved
+   * frames carry, with attribution, stop, and archive actors resolved
    * at read time.
    *
    * The heavy near-static blobs (config snapshot, input/output)
    * live on the detail endpoints, not here.
+   *
+   * Required permissions: read:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async get(session_id) {
     const path = `/v1/sessions/${enc(session_id)}`;
     return await this.transport.request("GET", path);
   }
   /**
-   * Get Agent Session Git
+   * Get Session Git
    *
    * The session's GitHub-side git view: its commits, and each PR it
    * opened joined to the live gh_prs row and reviews. The identity list
    * (output_git) rides the session itself over the WebSocket; this is
    * the join a "run" notify tells an open pane to refetch.
+   *
+   * Required permissions: read:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async git(session_id) {
     const path = `/v1/sessions/${enc(session_id)}/git`;
     return await this.transport.request("GET", path);
   }
   /**
-   * Ingest Agent Session Transcript
+   * Ingest Session Transcript
    *
    * Append transcript lines to a session's record.
    *
@@ -1604,6 +2251,13 @@ var EllipsisSessions = class {
    *
    * A sandbox token may only push its own session's transcript.
    * Idempotent by transcript line uuid; tolerant of malformed lines.
+   *
+   * Required permissions: write:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own session.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async ingestTranscript(session_id, options) {
     const path = `/v1/sessions/${enc(session_id)}/transcript`;
@@ -1611,17 +2265,24 @@ var EllipsisSessions = class {
     return await this.transport.request("POST", path, { body });
   }
   /**
-   * List Agent Sessions
+   * List Sessions
    *
    * List cloud agent sessions, newest first.
    *
-   * Optionally filtered by automation (id or name), source, time
+   * Optionally filtered by agent (id or name), source, service, handler, time
    * window, attributed author, repository, and whether the session is
    * still going.
+   *
+   * Required permissions: read:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async list(options = {}) {
     const path = "/v1/sessions";
-    const query = buildQuery({ automation: options.automation, source: options.source, days: options.days, start: options.start, end: options.end, limit: options.limit, cursor: options.cursor, author_id: options.author_id, repo: options.repo, unfinished: options.unfinished, exclude_code_review: options.exclude_code_review });
+    const query = buildQuery({ agent: options.agent, source: options.source, service: options.service, handler: options.handler, days: options.days, start: options.start, end: options.end, limit: options.limit, cursor: options.cursor, author_id: options.author_id, repo: options.repo, unfinished: options.unfinished, exclude_code_review: options.exclude_code_review });
     const response = await this.transport.request("GET", path, { query });
     return new Page(
       response,
@@ -1630,7 +2291,7 @@ var EllipsisSessions = class {
     );
   }
   /**
-   * Get Agent Session Output
+   * Get Session Output
    *
    * Return the session's typed output.
    *
@@ -1639,13 +2300,20 @@ var EllipsisSessions = class {
    * while the session is still running (poll GET /v1/sessions/{id}),
    * when the agent declares no output block, or when no execution
    * produced output.
+   *
+   * Required permissions: read:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async output(session_id) {
     const path = `/v1/sessions/${enc(session_id)}/output`;
     return await this.transport.request("GET", path);
   }
   /**
-   * Get Agent Session Records
+   * Get Session Records
    *
    * Return the session's stored transcript records, oldest first.
    *
@@ -1654,6 +2322,13 @@ var EllipsisSessions = class {
    * agent answering "did X look into Y?" needs to read the sessions
    * it finds, and any org member sees the same transcript in the
    * dashboard.
+   *
+   * Required permissions: read:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async records(session_id, options = {}) {
     const path = `/v1/sessions/${enc(session_id)}/records`;
@@ -1666,15 +2341,22 @@ var EllipsisSessions = class {
     );
   }
   /**
-   * Search Agent Sessions
+   * Search Sessions
+   *
+   * Required permissions: read:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async search(options = {}) {
     const path = "/v1/sessions/search";
-    const query = buildQuery({ q: options.q, scope: options.scope, source: options.source, author_id: options.author_id, automation_id: options.automation_id, session_ids: options.session_ids, repo: options.repo, status: options.status, start: options.start, end: options.end, limit: options.limit });
+    const query = buildQuery({ q: options.q, scope: options.scope, source: options.source, service: options.service, handler: options.handler, author_id: options.author_id, agent_id: options.agent_id, session_ids: options.session_ids, repo: options.repo, status: options.status, start: options.start, end: options.end, limit: options.limit });
     return await this.transport.request("GET", path, { query });
   }
   /**
-   * Send Agent Session Message
+   * Send Session Message
    *
    * Send a message to a session.
    *
@@ -1682,6 +2364,13 @@ var EllipsisSessions = class {
    * Returns the created message so the caller can track it by id; a
    * retried send with the same idempotency_key returns the original
    * message.
+   *
+   * Required permissions: write:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async sendMessage(session_id, options) {
     const path = `/v1/sessions/${enc(session_id)}/messages`;
@@ -1690,39 +2379,61 @@ var EllipsisSessions = class {
   }
   /**
    * Get Session Stream Ticket
+   *
+   * Required permissions: read:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async sessionStreamTicket(session_id) {
     const path = `/v1/sessions/${enc(session_id)}/stream-ticket`;
     return await this.transport.request("GET", path);
   }
   /**
-   * Start Agent Session
+   * Start Session
    *
    * Start a cloud agent session.
    *
    * The daily driver: a prompt, optionally where to run it
-   * (`environment`) and the run's own settings, in the AutomationConfig
+   * (`environment`) and the run's own settings, in the AgentConfig
    * vocabulary. What you send is what runs: omit `environment` and the
    * session runs in the built-in basic sandbox. A missing model or
    * budget comes from the organization's settings, so
-   * `{"prompt": "..."}` alone is a complete request. `prompt` is the
-   * first message; omit it and the session starts idle, waiting for
-   * one. 400 when `interactive` is false and there is no prompt, or
+   * `{"claude_code": {"prompt": "..."}}` is a complete request.
+   * Set exactly one of `claude_code` or `codex`. Its `prompt` is the
+   * first message; omit the prompt and the session starts idle, waiting for
+   * one. 400 when `lifecycle.interactive` is false and there is no prompt, or
    * when `budget` exceeds the organization's per-session ceiling. To
-   * run a saved automation, use POST /v1/automations/{automation_id}/sessions.
+   * run a saved agent, use POST /v1/agents/{agent_id}/sessions.
+   *
+   * Required permissions: write:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
-  async start(options) {
+  async start(options = {}) {
     const path = "/v1/sessions";
-    const body = buildBody({ budget: options.budget, environment: options.environment, force_rebuild: options.force_rebuild, harness: options.harness, images: options.images, instructions: options.instructions, interactive: options.interactive, metadata: options.metadata, output: options.output, permissions: options.permissions, prompt: options.prompt, repositories: options.repositories, skills: options.skills });
+    const body = buildBody({ budget: options.budget, claude_code: options.claude_code, codex: options.codex, environment: options.environment, force_rebuild: options.force_rebuild, images: options.images, lifecycle: options.lifecycle, metadata: options.metadata, output: options.output, permissions: options.permissions, repositories: options.repositories, skills: options.skills });
     return await this.transport.request("POST", path, { body });
   }
   /**
-   * Stop Agent Session
+   * Stop Session
    *
    * Stop an in-flight session and return it.
    *
    * stopped_by is recorded only when the caller's credential maps
    * to a GitHub account.
+   *
+   * Required permissions: write:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async stop(session_id) {
     const path = `/v1/sessions/${enc(session_id)}/stop`;
@@ -1730,11 +2441,43 @@ var EllipsisSessions = class {
   }
   /**
    * Get Sessions Stream Ticket
+   *
+   * Required permissions: read:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async streamTicket() {
     const path = "/v1/sessions/stream-ticket";
     return await this.transport.request("GET", path);
   }
+  /**
+   * Update Session
+   *
+   * Archive or unarchive a session and return it.
+   *
+   * Set archived to true to record the current server time and the
+   * authenticated GitHub user. API-key requests record no user.
+   * Repeated archive requests preserve the original time and user.
+   * Set archived to false to clear both fields. Archiving is available
+   * in any session state and does not stop a running session.
+   *
+   * Changes are delivered to session and session-list streams.
+   *
+   * Required permissions: write:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async update(session_id, options) {
+    const path = `/v1/sessions/${enc(session_id)}`;
+    const body = buildBody({ archived: options.archived });
+    return await this.transport.request("PUT", path, { body });
+  }
   // ---- lifecycle sugar (hand-written layer over the generated core) ----
   /** Start a session and return a handle over it. */
   async run(options) {
@@ -1754,6 +2497,12 @@ var EllipsisSupportSlack = class {
   transport;
   /**
    * Request Slack Help
+   *
+   * Required permissions: write:account.
+   * API key: Requires a CLI user token.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async create(options) {
     const path = "/v1/support/slack";
@@ -1762,6 +2511,12 @@ var EllipsisSupportSlack = class {
   }
   /**
    * Get Slack Help
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async get() {
     const path = "/v1/support/slack";
@@ -1769,6 +2524,12 @@ var EllipsisSupportSlack = class {
   }
   /**
    * Invite To Slack Help
+   *
+   * Required permissions: write:account.
+   * API key: Requires a CLI user token.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async invite(options) {
     const path = "/v1/support/slack/invites";
@@ -1793,6 +2554,12 @@ var EllipsisTemplates = class {
    * Get Agent Template
    *
    * Return one built-in agent template by slug.
+   *
+   * Required permissions: read:templates.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async get(template_id) {
     const path = `/v1/templates/${enc(template_id)}`;
@@ -1805,6 +2572,12 @@ var EllipsisTemplates = class {
    *
    * Behind auth but not account-scoped — the data is static
    * product content shared by the dashboard, landing site, and CLI.
+   *
+   * Required permissions: read:templates.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async list() {
     const path = "/v1/templates";
@@ -1823,6 +2596,12 @@ var EllipsisUserSubscriptionTokens = class {
    *
    * Your sessions stop billing your subscription immediately, and the
    * usage reading goes with it — it described that token's plan.
+   *
+   * Required permissions: delete:user.
+   * API key: Requires a CLI user token.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async delete(provider) {
     const path = `/v1/user/subscription_tokens/${enc(String(provider))}`;
@@ -1835,6 +2614,12 @@ var EllipsisUserSubscriptionTokens = class {
    *
    * `configured` is false when nothing is saved. The token itself is
    * never returned, only `token_last4`.
+   *
+   * Required permissions: read:user.
+   * API key: Requires a CLI user token.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async get(provider) {
     const path = `/v1/user/subscription_tokens/${enc(String(provider))}`;
@@ -1848,6 +2633,12 @@ var EllipsisUserSubscriptionTokens = class {
    * One entry per supported provider, whether or not you have saved a
    * token for it. Tokens are write-only: the response carries only
    * `token_last4`, never the token.
+   *
+   * Required permissions: read:user.
+   * API key: Requires a CLI user token.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async list() {
     const path = "/v1/user/subscription_tokens";
@@ -1863,6 +2654,12 @@ var EllipsisUserSubscriptionTokens = class {
    * succeeds. For Claude, use `claude setup-token`. For Codex, paste
    * the auth.json credentials from a ChatGPT login. Each subscription
    * pays only for models from its corresponding provider.
+   *
+   * Required permissions: write:user.
+   * API key: Requires a CLI user token.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async set(provider, options) {
     const path = `/v1/user/subscription_tokens/${enc(String(provider))}`;
@@ -1879,6 +2676,12 @@ var EllipsisUserSubscriptionTokens = class {
    * real windows without us seeing them. Null unless a token is
    * enabled for the provider: a disabled token routes nothing, so any
    * reading behind it is stale by construction.
+   *
+   * Required permissions: read:user.
+   * API key: Requires a CLI user token.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async usage(provider) {
     const path = `/v1/user/subscription_tokens/${enc(String(provider))}/usage`;
@@ -1895,6 +2698,12 @@ var EllipsisUserSubscriptionTokens = class {
    * token is how you stop it routing. A 200 with `ok: false` is the
    * normal way a bad token is reported — it is an answer, not a
    * transport failure.
+   *
+   * Required permissions: write:user.
+   * API key: Requires a CLI user token.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async verify(provider) {
     const path = `/v1/user/subscription_tokens/${enc(String(provider))}/verify`;
@@ -1908,6 +2717,12 @@ var EllipsisUserTokens = class {
   transport;
   /**
    * List User Tokens
+   *
+   * Required permissions: read:user.
+   * API key: Requires a CLI user token.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async list() {
     const path = "/v1/user/tokens";
@@ -1915,6 +2730,12 @@ var EllipsisUserTokens = class {
   }
   /**
    * Revoke User Token
+   *
+   * Required permissions: delete:user.
+   * API key: Requires a CLI user token.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async revoke(token_id) {
     const path = `/v1/user/tokens/${enc(token_id)}`;
@@ -1931,6 +2752,129 @@ var EllipsisUser = class {
   subscriptionTokens;
   tokens;
 };
+var EllipsisVmExecutions = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  transport;
+  /**
+   * Get Single Vm Execution
+   *
+   * Required permissions: read:environments.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own sandbox.
+   * Higher permission levels include lower levels: read < write < delete.
+   */
+  async get(vm_execution_id) {
+    const path = `/v1/vm-executions/${enc(vm_execution_id)}`;
+    return await this.transport.request("GET", path);
+  }
+  /**
+   * Get Vm Executions
+   *
+   * Required permissions: read:environments.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own sandbox.
+   * Higher permission levels include lower levels: read < write < delete.
+   */
+  async list() {
+    const path = "/v1/vm-executions";
+    await this.transport.request("GET", path);
+  }
+  /**
+   * Get Vm Execution Stream Ticket
+   *
+   * Required permissions: read:environments.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own sandbox.
+   * Higher permission levels include lower levels: read < write < delete.
+   */
+  async streamTicket(vm_execution_id) {
+    const path = `/v1/vm-executions/${enc(vm_execution_id)}/stream-ticket`;
+    return await this.transport.request("GET", path);
+  }
+};
+var EllipsisVmImages = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  transport;
+  /**
+   * Get Vm Image
+   *
+   * Get metadata for a reusable VM image.
+   *
+   * Required permissions: read:environments.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
+   */
+  async get(image_id) {
+    const path = `/v1/vm-images/${enc(image_id)}`;
+    return await this.transport.request("GET", path);
+  }
+  /**
+   * List Vm Images
+   *
+   * List reusable VM images.
+   *
+   * Includes expiration, repository revisions, and build identity.
+   *
+   * Required permissions: read:environments.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
+   */
+  async list(options = {}) {
+    const path = "/v1/vm-images";
+    const query = buildQuery({ limit: options.limit, offset: options.offset });
+    return await this.transport.request("GET", path, { query });
+  }
+};
+var EllipsisVms = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  transport;
+  /**
+   * Get Vm
+   *
+   * Get a VM and its most recent execution.
+   *
+   * Required permissions: read:environments.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own VM.
+   * Higher permission levels include lower levels: read < write < delete.
+   */
+  async get(vm_id) {
+    const path = `/v1/vms/${enc(vm_id)}`;
+    return await this.transport.request("GET", path);
+  }
+  /**
+   * List Vms
+   *
+   * List VMs and their last recorded state.
+   *
+   * Each machine appears once, including paused and deleted VMs, newest execution first.
+   *
+   * Required permissions: read:environments.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own VM.
+   * Higher permission levels include lower levels: read < write < delete.
+   */
+  async list(options = {}) {
+    const path = "/v1/vms";
+    const query = buildQuery({ limit: options.limit, offset: options.offset });
+    return await this.transport.request("GET", path, { query });
+  }
+};
 var EllipsisWebhooksDeliveries = class {
   constructor(transport) {
     this.transport = transport;
@@ -1943,6 +2887,12 @@ var EllipsisWebhooksDeliveries = class {
    *
    * Payloads are immutable across retries. Attempt details include HTTP
    * status, timing, and errors. Response bodies are not retained.
+   *
+   * Required permissions: read:webhooks.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async get(delivery_id) {
     const path = `/v1/webhooks/deliveries/${enc(delivery_id)}`;
@@ -1955,6 +2905,12 @@ var EllipsisWebhooksDeliveries = class {
    *
    * Includes verification pings and deliveries for deleted webhooks.
    * History is retained for 30 days. Retries belong to the same delivery.
+   *
+   * Required permissions: read:webhooks.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async list(options = {}) {
     const path = "/v1/webhooks/deliveries";
@@ -1980,9 +2936,15 @@ var EllipsisWebhooks = class {
    * Create a webhook and send a verification ping.
    *
    * Save the signing secret from this response; it is returned once.
-   * Accounts can have three webhooks, including unverified and pending
-   * ones. A ping returning HTTP 200 moves unverified to pending. Contact
+   * Accounts default to three webhook slots, including unverified and
+   * pending ones; your account may have a custom allowance. A ping returning HTTP 200 moves unverified to pending. Contact
    * Ellipsis to activate it and receive session.create events.
+   *
+   * Required permissions: write:webhooks.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async create(options) {
     const path = "/v1/webhooks";
@@ -1995,7 +2957,13 @@ var EllipsisWebhooks = class {
    * Delete a webhook and cancel outstanding deliveries.
    *
    * An HTTP request already in flight may finish. Delivery history remains
-   * available for 30 days. Deletion frees one of the account's three slots.
+   * available for 30 days. Deletion frees a webhook slot.
+   *
+   * Required permissions: delete:webhooks.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async delete(webhook_id) {
     const path = `/v1/webhooks/${enc(webhook_id)}`;
@@ -2005,6 +2973,12 @@ var EllipsisWebhooks = class {
    * Get Webhook
    *
    * Get a webhook's configuration and approval state.
+   *
+   * Required permissions: read:webhooks.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async get(webhook_id) {
     const path = `/v1/webhooks/${enc(webhook_id)}`;
@@ -2014,6 +2988,12 @@ var EllipsisWebhooks = class {
    * List Webhooks
    *
    * List your webhooks and their delivery summaries.
+   *
+   * Required permissions: read:webhooks.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async list() {
     const path = "/v1/webhooks";
@@ -2025,8 +3005,15 @@ var EllipsisWebhooks = class {
    * Send a signed verification or test ping.
    *
    * Available in every state. Only HTTP 200 verifies a destination;
-   * successful pings never activate it. At most five pings per account
-   * per minute, including pings from creation and URL changes.
+   * successful pings never activate it. The default limit is five pings per
+   * account per minute, including creation and URL changes. Custom
+   * account allowances apply.
+   *
+   * Required permissions: write:webhooks.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async ping(webhook_id) {
     const path = `/v1/webhooks/${enc(webhook_id)}/ping`;
@@ -2040,6 +3027,12 @@ var EllipsisWebhooks = class {
    * Changing the URL cancels outstanding deliveries, clears verification
    * and approval, and sends another ping. State and signing secret cannot
    * be set here. Updating description or subscriptions preserves approval.
+   *
+   * Required permissions: write:webhooks.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async update(webhook_id, options) {
     const path = `/v1/webhooks/${enc(webhook_id)}`;
@@ -2050,46 +3043,58 @@ var EllipsisWebhooks = class {
 var Ellipsis = class {
   transport;
   account;
+  agents;
   alerts;
   analytics;
   auth;
-  automations;
   environments;
   files;
+  handlers;
   integrations;
   memories;
   reviews;
-  sandboxes;
   secrets;
   sessions;
   support;
   templates;
   user;
+  vmExecutions;
+  vmImages;
+  vms;
   webhooks;
   constructor(options) {
     this.transport = new Transport(options);
     this.account = new EllipsisAccount(this.transport);
+    this.agents = new EllipsisAgents(this.transport);
     this.alerts = new EllipsisAlerts(this.transport);
     this.analytics = new EllipsisAnalytics(this.transport);
     this.auth = new EllipsisAuth(this.transport);
-    this.automations = new EllipsisAutomations(this.transport);
     this.environments = new EllipsisEnvironments(this.transport);
     this.files = new EllipsisFiles(this.transport);
+    this.handlers = new EllipsisHandlers(this.transport);
     this.integrations = new EllipsisIntegrations(this.transport);
     this.memories = new EllipsisMemories(this.transport);
     this.reviews = new EllipsisReviews(this.transport);
-    this.sandboxes = new EllipsisSandboxes(this.transport);
     this.secrets = new EllipsisSecrets(this.transport);
     this.sessions = new EllipsisSessions(this.transport);
     this.support = new EllipsisSupport(this.transport);
     this.templates = new EllipsisTemplates(this.transport);
     this.user = new EllipsisUser(this.transport);
+    this.vmExecutions = new EllipsisVmExecutions(this.transport);
+    this.vmImages = new EllipsisVmImages(this.transport);
+    this.vms = new EllipsisVms(this.transport);
     this.webhooks = new EllipsisWebhooks(this.transport);
   }
   /**
    * Current Identity
    *
    * Return the identity behind the caller's credential.
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async identity() {
     const path = "/v1/identity";