@ellipsis-dev/sdk 0.28.0 → 0.31.0

package/dist/index.js

@@ -29,58 +29,67 @@ var Page = class {
 };
 
 // src/core/sessionHandle.ts
-var TERMINAL_STATUSES = /* @__PURE__ */ new Set([
+var FINAL_TURN_STATUSES = /* @__PURE__ */ new Set([
   "completed",
-  "error",
-  "cancelled",
-  "stopped"
+  "failed",
+  "stopped",
+  "cancelled"
 ]);
-var DEFAULT_POLL_INTERVAL_MS = 3e3;
-function isSettled(session) {
-  if (TERMINAL_STATUSES.has(session.status)) return true;
-  return session.session_state === "idle" || session.session_state === "closed";
+function isTurnFinal(status) {
+  return FINAL_TURN_STATUSES.has(status);
 }
+var DEFAULT_POLL_INTERVAL_MS = 3e3;
 var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 var SessionHandle = class {
   constructor(sessions, session) {
     this.sessions = sessions;
     this.id = session.id;
     this.session = session;
+    this.turnId = session.turn?.id ?? null;
   }
   sessions;
   id;
   // The latest session snapshot this handle saw.
   session;
+  // The turn `wait()` waits on: the session's turn after `run()`, then the
+  // turn each `send()` creates. Null until the session has a message.
+  turnId;
   async refresh() {
     this.session = (await this.sessions.get(this.id)).session;
     return this.session;
   }
-  // Poll until the session settles (terminal status, or a parked
-  // conversation: state idle/closed).
+  // Poll until the awaited turn reaches a final status (completed, failed,
+  // stopped, cancelled) or the conversation closes, and return that turn.
+  // Returns null at once when the session has no turn to wait on.
   async wait(options = {}) {
     const pollIntervalMs = options.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
     const deadline = options.timeoutMs == null ? null : Date.now() + options.timeoutMs;
     for (; ; ) {
       const session = await this.refresh();
-      if (isSettled(session)) return session;
+      const turnId = this.turnId;
+      if (turnId == null) return null;
+      const turn = session.turn?.id === turnId ? session.turn : (await this.sessions.turns.get(this.id, turnId)).turn;
+      if (isTurnFinal(turn.status) || session.conversation.state === "closed")
+        return turn;
       if (deadline != null && Date.now() >= deadline) {
         throw new Error(
-          `session ${this.id} not terminal after ${options.timeoutMs}ms`
+          `turn ${turnId} of session ${this.id} not final after ${options.timeoutMs}ms`
         );
       }
       await sleep(pollIntervalMs);
     }
   }
-  // Post into the session's inbox (delivered at the next turn boundary;
-  // wakes a parked session). `images` ride the message as content blocks the
-  // model sees on that turn — a paste into Claude Code.
+  // Post a message into the session. The returned turn is the one that will
+  // answer it, and the one `wait()` waits on from now. `images` ride the
+  // message as content blocks the model sees on that turn.
   async send(message, options = {}) {
     const response = await this.sessions.sendMessage(this.id, {
       message,
       images: options.images,
       idempotency_key: options.idempotencyKey
     });
-    return response.message;
+    this.turnId = response.turn.id;
+    return response;
   }
   async stop() {
     this.session = (await this.sessions.stop(this.id)).session;
@@ -255,6 +264,12 @@ var EllipsisAccountApiKeys = class {
    *
    * Authenticate as a dashboard user or with a user token. An organization
    * API key cannot create other keys. The secret is returned only once.
+   *
+   * Required permissions: write:tokens.
+   * API key: Requires a CLI user token belonging to an account administrator.
+   * CLI user token: Requires an account administrator.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async create(options) {
     const path = "/v1/account/api-keys";
@@ -263,6 +278,12 @@ var EllipsisAccountApiKeys = class {
   }
   /**
    * List Api Keys
+   *
+   * Required permissions: read:tokens.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async list() {
     const path = "/v1/account/api-keys";
@@ -272,6 +293,12 @@ var EllipsisAccountApiKeys = class {
    * Revoke Api Key
    *
    * Revoke an organization key as a verified GitHub administrator.
+   *
+   * Required permissions: delete:tokens.
+   * API key: Requires a CLI user token belonging to an account administrator.
+   * CLI user token: Requires an account administrator.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async revoke(api_key_id) {
     const path = `/v1/account/api-keys/${enc(api_key_id)}`;
@@ -290,6 +317,12 @@ var EllipsisAccountBillingAutoRecharge = class {
    *
    * An account without saved settings returns disabled defaults and no
    * card. No payment-method identifier or card details are exposed.
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async get() {
     const path = "/v1/account/billing/auto-recharge";
@@ -300,11 +333,17 @@ var EllipsisAccountBillingAutoRecharge = class {
    *
    * Set your automatic credit recharge policy.
    *
-   * Requires a human account administrator; API keys and sandbox tokens
+   * Requires a human account administrator; API keys and session tokens
    * cannot change this policy. Supply enabled explicitly. Saving amounts
    * with enabled=false keeps recharge off; enabling requires a saved card.
    * A recharge buys amount_cents of credit and charges the platform fee
    * in addition. Amounts and thresholds preserve exact cents.
+   *
+   * Required permissions: write:account.
+   * API key: Requires a CLI user token belonging to an account administrator.
+   * CLI user token: Requires an account administrator.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async set(options) {
     const path = "/v1/account/billing/auto-recharge";
@@ -327,6 +366,12 @@ var EllipsisAccountBilling = class {
    * Requires a human account administrator. Open the returned URL to
    * finish setup and return to Billing. Saving a card does not enable
    * auto-recharge or buy credit.
+   *
+   * Required permissions: write:account.
+   * API key: Requires a CLI user token belonging to an account administrator.
+   * CLI user token: Requires an account administrator.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async cardSetup() {
     const path = "/v1/account/billing/card-setup";
@@ -341,6 +386,12 @@ var EllipsisAccountBilling = class {
    * complete payment. Credit is granted only after payment succeeds;
    * the platform fee is charged in addition to amount_cents. Returning
    * to Billing carries the checkout session ID for receipt lookup.
+   *
+   * Required permissions: write:account.
+   * API key: Requires a CLI user token belonging to an account administrator.
+   * CLI user token: Requires an account administrator.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async checkout(options) {
     const path = "/v1/account/billing/checkout";
@@ -354,6 +405,12 @@ var EllipsisAccountBilling = class {
    * bootstrap that otherwise fires lazily at the first session (Stripe
    * customer + usage subscription + the signup grant). A repeat call is
    * a no-op that returns the current state.
+   *
+   * Required permissions: write:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async claimSignupCredit() {
     const path = "/v1/account/billing/claim-signup-credit";
@@ -363,6 +420,12 @@ var EllipsisAccountBilling = class {
    * Get Fee Schedule
    *
    * Get the account's rate card, in US dollars.
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async feeSchedule() {
     const path = "/v1/account/billing/fee-schedule";
@@ -375,6 +438,12 @@ var EllipsisAccountBilling = class {
    *
    * Returns only your account's grants. The total is before usage;
    * /v1/account/budget reports the available balance.
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async grants() {
     const path = "/v1/account/billing/credit-grants";
@@ -387,6 +456,12 @@ var EllipsisAccountBilling = class {
    *
    * The amount includes the platform fee and comes from Stripe. An
    * incomplete, missing, or other-account purchase returns 404.
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async purchase(checkout_id) {
     const path = `/v1/account/billing/purchases/${enc(checkout_id)}`;
@@ -399,6 +474,12 @@ var EllipsisAccountBilling = class {
    *
    * All amounts are integer US cents. The fee is added to the credit
    * amount; it does not reduce the credit granted.
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async purchaseOptions() {
     const path = "/v1/account/billing/purchase-options";
@@ -412,6 +493,12 @@ var EllipsisAccountBilling = class {
    * Uses the same account gate as session admission, including credit,
    * contact email, and personal Claude subscription eligibility. Scoped
    * spend limits are reported separately by /v1/account/budget.
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async status() {
     const path = "/v1/account/billing";
@@ -436,6 +523,12 @@ var EllipsisAccountModels = class {
    * Reads the same registry as the dashboard's rate table, so a
    * client's model picker can never drift from what's offered. The
    * selectable set is global; only the flag is account-scoped.
+   *
+   * Required permissions: read:templates.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async list() {
     const path = "/v1/account/models";
@@ -453,6 +546,12 @@ var EllipsisAccountNotifications = class {
    * Send the alert email template to one address with sample data,
    * so a typo'd finance alias is caught by a human instead of failing
    * silently when a real alert fires.
+   *
+   * Required permissions: write:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async testEmail(options) {
     const path = "/v1/account/notifications/test-email";
@@ -460,73 +559,107 @@ var EllipsisAccountNotifications = class {
     return await this.transport.request("POST", path, { body });
   }
 };
-var EllipsisAccountProvidersAnthropic = class {
+var EllipsisAccountOnboarding = class {
   constructor(transport) {
     this.transport = transport;
   }
   transport;
   /**
-   * Delete Anthropic Config
-   */
-  async delete() {
-    const path = "/v1/account/providers/anthropic";
-    await this.transport.request("DELETE", path);
-  }
-  /**
-   * Get Anthropic Config
+   * Get Account Onboarding
+   *
+   * Read the account's saved onboarding answers, or null before setup.
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async get() {
-    const path = "/v1/account/providers/anthropic";
+    const path = "/v1/account/onboarding";
     return await this.transport.request("GET", path);
   }
   /**
-   * Put Anthropic Config
-   */
-  async set(options) {
-    const path = "/v1/account/providers/anthropic";
-    const body = buildBody({ api_key: options.api_key });
-    return await this.transport.request("PUT", path, { body });
-  }
-  /**
-   * Validate Anthropic Config
+   * Update Account Onboarding
+   *
+   * Save supplied onboarding answers, preserving omitted answers.
+   *
+   * Organizations can save their work email before selecting use cases.
+   * Saving use cases requires a valid organization work email and at
+   * least one choice. When Other is the only choice, describe it.
+   * Personal accounts save a null work email. This does not change the
+   * billing contact email. Session tokens cannot update answers.
+   * Supplying an organization work email requires a human user and sends
+   * a Slack Connect invitation. Slack failures do not undo saved answers.
+   *
+   * Required permissions: write:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
-  async validate() {
-    const path = "/v1/account/providers/anthropic/validate";
-    return await this.transport.request("POST", path);
+  async update(options = {}) {
+    const path = "/v1/account/onboarding";
+    const body = buildBody({ other_use_case: options.other_use_case, use_cases: options.use_cases, work_email: options.work_email });
+    return await this.transport.request("PATCH", path, { body });
   }
 };
-var EllipsisAccountProvidersBedrock = class {
+var EllipsisAccountProvidersAnthropic = class {
   constructor(transport) {
     this.transport = transport;
   }
   transport;
   /**
-   * Delete Bedrock Config
+   * Delete Anthropic Config
+   *
+   * Required permissions: delete:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async delete() {
-    const path = "/v1/account/providers/bedrock";
+    const path = "/v1/account/providers/anthropic";
     await this.transport.request("DELETE", path);
   }
   /**
-   * Get Bedrock Config
+   * Get Anthropic Config
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async get() {
-    const path = "/v1/account/providers/bedrock";
+    const path = "/v1/account/providers/anthropic";
     return await this.transport.request("GET", path);
   }
   /**
-   * Put Bedrock Config
+   * Put Anthropic Config
+   *
+   * Required permissions: write:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async set(options) {
-    const path = "/v1/account/providers/bedrock";
-    const body = buildBody({ model_map: options.model_map, region: options.region, role_arn: options.role_arn });
+    const path = "/v1/account/providers/anthropic";
+    const body = buildBody({ api_key: options.api_key });
     return await this.transport.request("PUT", path, { body });
   }
   /**
-   * Validate Bedrock Config
+   * Validate Anthropic Config
+   *
+   * Required permissions: write:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async validate() {
-    const path = "/v1/account/providers/bedrock/validate";
+    const path = "/v1/account/providers/anthropic/validate";
     return await this.transport.request("POST", path);
   }
 };
@@ -534,11 +667,9 @@ var EllipsisAccountProviders = class {
   constructor(transport) {
     this.transport = transport;
     this.anthropic = new EllipsisAccountProvidersAnthropic(transport);
-    this.bedrock = new EllipsisAccountProvidersBedrock(transport);
   }
   transport;
   anthropic;
-  bedrock;
 };
 var EllipsisAccountSettings = class {
   constructor(transport) {
@@ -553,6 +684,12 @@ var EllipsisAccountSettings = class {
    * Session model and budget defaults, code review and mention behavior,
    * analytics, retention, and notification contacts. PATCH replaces
    * supplied sections; PUT preserves its model-and-budget-only behavior.
+   *
+   * Required permissions: read:defaults.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async get() {
     const path = "/v1/account/settings";
@@ -568,8 +705,14 @@ var EllipsisAccountSettings = class {
    * default a session's model resolves against);
    * `budget_ceiling.session` is in US dollars, at most the platform
    * ceiling, and null clears it.
-   * Refused for sandbox tokens (potentially prompt-injected code must
+   * Refused for session tokens (potentially prompt-injected code must
    * not repoint the organization's defaults).
+   *
+   * Required permissions: write:defaults.
+   * API key: Requires a CLI user token belonging to an account administrator.
+   * CLI user token: Requires an account administrator.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async set(options) {
     const path = "/v1/account/settings";
@@ -582,10 +725,16 @@ var EllipsisAccountSettings = class {
    * Replace supplied settings sections without changing omitted sections.
    *
    * Changes to model or budget defaults require a GitHub administrator.
+   *
+   * Required permissions: write:defaults.
+   * API key: Cannot set budget_ceiling, default_model to a non-null value; those changes require a CLI user token belonging to an account administrator.
+   * CLI user token: Requires an account administrator when setting budget_ceiling, default_model to a non-null value.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async update(options = {}) {
     const path = "/v1/account/settings";
-    const body = buildBody({ analytics: options.analytics, budget_ceiling: options.budget_ceiling, code_review: options.code_review, data_retention: options.data_retention, default_model: options.default_model, mention: options.mention, notifications: options.notifications });
+    const body = buildBody({ analytics: options.analytics, budget_ceiling: options.budget_ceiling, code_review: options.code_review, data_retention: options.data_retention, default_model: options.default_model, notifications: options.notifications });
     return await this.transport.request("PATCH", path, { body });
   }
 };
@@ -596,6 +745,7 @@ var EllipsisAccount = class {
     this.billing = new EllipsisAccountBilling(transport);
     this.models = new EllipsisAccountModels(transport);
     this.notifications = new EllipsisAccountNotifications(transport);
+    this.onboarding = new EllipsisAccountOnboarding(transport);
     this.providers = new EllipsisAccountProviders(transport);
     this.settings = new EllipsisAccountSettings(transport);
   }
@@ -604,6 +754,7 @@ var EllipsisAccount = class {
   billing;
   models;
   notifications;
+  onboarding;
   providers;
   settings;
   /**
@@ -612,6 +763,12 @@ var EllipsisAccount = class {
    * All-time per-surface activity flags: the dashboards' demo-data
    * fallback reads these instead of inferring "no history" from a
    * windowed, filtered response.
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async activity() {
     const path = "/v1/account/activity";
@@ -619,6 +776,12 @@ var EllipsisAccount = class {
   }
   /**
    * Get Customer Audit Log
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async auditLog() {
     const path = "/v1/account/audit-log";
@@ -632,8 +795,14 @@ var EllipsisAccount = class {
    * Budgets cover the trailing 1, 7 and 28 days; they do not replenish
    * prepaid credit. Amounts include measured usage from active sessions.
    * Each paid LLM request requires positive credit and budget headroom.
-   * An admitted request can overshoot; concurrency is limited to five
-   * paid requests per account and one per session.
+   * An admitted request can overshoot; concurrent paid requests are limited
+   * by your account and per-session allowances.
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async budget() {
     const path = "/v1/account/budget";
@@ -641,10 +810,16 @@ var EllipsisAccount = class {
   }
   /**
    * Update Customer
+   *
+   * Required permissions: write:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async update(options = {}) {
     const path = "/v1/account";
-    const body = buildBody({ can_start_job_runs: options.can_start_job_runs, contact_email: options.contact_email });
+    const body = buildBody({ can_start_sessions: options.can_start_sessions, contact_email: options.contact_email });
     return await this.transport.request("PATCH", path, { body });
   }
   /**
@@ -656,9 +831,15 @@ var EllipsisAccount = class {
    * preserved. Set policy.developer_defaults to null to disable developer
    * limits. Null override windows inherit their default. API keys use
    * their stable ID, not their secret. Changes apply to the next paid
-   * request, including sessions already running. API keys and sandbox
-   * credentials cannot edit budgets. The session ceiling remains at
+   * request, including sessions already running. API keys and session
+   * tokens cannot edit budgets. The session ceiling remains at
    * /account/settings; purchasing credits is separate from budget policy.
+   *
+   * Required permissions: write:defaults.
+   * API key: Requires a CLI user token belonging to an account administrator.
+   * CLI user token: Requires an account administrator.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async updateBudget(options = {}) {
     const path = "/v1/account/budget";
@@ -672,9 +853,15 @@ var EllipsisAccount = class {
    *
    * Omit period_start for the current UTC month; select a period returned
    * in billing_periods to view history. Credit debits are distinct from
-   * rated token usage through BYOK, customer Bedrock, or a developer's
-   * Claude subscription. Rated usage estimates are not provider invoices.
+   * rated token usage through BYOK or a developer's Claude or Codex
+   * subscription. Rated usage estimates are not provider invoices.
    * Pending and unresolved requests identify missing measurements.
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async usage(options = {}) {
     const path = "/v1/account/usage";
@@ -682,6 +869,212 @@ var EllipsisAccount = class {
     return await this.transport.request("GET", path, { query });
   }
 };
+var EllipsisAgents = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  transport;
+  /**
+   * Create Agent
+   *
+   * Create an agent, managed through the API: no file, live
+   * immediately. To put its definition in a repository instead, create
+   * it here and then POST /v1/agents/{agent_id}/link.
+   *
+   * 409 when another live agent already holds the name.
+   *
+   * Required permissions: write:configs.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async create(options) {
+    const path = "/v1/agents";
+    const body = buildBody({ agent: options.agent });
+    return await this.transport.request("POST", path, { body });
+  }
+  /**
+   * Delete Agent
+   *
+   * Delete an agent, by id or by name.
+   *
+   * It stops running and its name is freed immediately; its past
+   * sessions remain readable. Only for agents managed through
+   * this API — delete the file to remove one defined by a repository.
+   *
+   * Required permissions: write:configs.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async delete(agent_id) {
+    const path = `/v1/agents/${enc(agent_id)}`;
+    await this.transport.request("DELETE", path);
+  }
+  /**
+   * Get Agent
+   *
+   * Return one agent, by id or by name.
+   *
+   * Required permissions: read:configs.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async get(agent_id) {
+    const path = `/v1/agents/${enc(agent_id)}`;
+    return await this.transport.request("GET", path);
+  }
+  /**
+   * Link Agent
+   *
+   * Move an agent into a repository, by id or by name.
+   *
+   * Opens a pull request adding its definition file. The agent
+   * keeps running unchanged meanwhile; merging hands it over to the
+   * file, after which the file is what changes it. Nothing happens
+   * if the pull request is never merged.
+   *
+   * Required permissions: write:configs.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async link(agent_id, options) {
+    const path = `/v1/agents/${enc(agent_id)}/link`;
+    const body = buildBody({ path: options.path, repository: options.repository });
+    return await this.transport.request("POST", path, { body });
+  }
+  /**
+   * List Agents
+   *
+   * List agents.
+   *
+   * Required permissions: read:configs.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async list() {
+    const path = "/v1/agents";
+    return await this.transport.request("GET", path);
+  }
+  /**
+   * Get Agent Metrics
+   *
+   * Return an agent's session distribution and trailing spend,
+   * by id or by name.
+   *
+   * `samples` carries one entry per finished session (duration, cost,
+   * tokens) for distributions; `spend_windows` carries what the
+   * agent's sessions cost over the last 1, 7, and 28 days against
+   * its budget for each window.
+   *
+   * Required permissions: read:configs.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async metrics(agent_id) {
+    const path = `/v1/agents/${enc(agent_id)}/metrics`;
+    return await this.transport.request("GET", path);
+  }
+  /**
+   * Start Agent Session
+   *
+   * Invoke an agent.
+   *
+   * Runs a certified agent with its configured instructions, model,
+   * environment, permissions, skills, and budget, and returns
+   * the session it started. The session runs once and does not accept
+   * follow-up messages. If the agent declares input.json_schema,
+   * send only `input` for its initial message. Otherwise send a non-empty
+   * `prompt`, which becomes the initial message verbatim. Both fields
+   * together, neither field, and input that renders an empty message are
+   * rejected with 422. An optional `budget` lowers the session cap;
+   * `metadata` tags the session. Codex invocations are not supported.
+   *
+   * Required permissions: write:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async run(agent_id, options = {}) {
+    const path = `/v1/agents/${enc(agent_id)}/sessions`;
+    const body = buildBody({ budget: options.budget, input: options.input, metadata: options.metadata, prompt: options.prompt });
+    return await this.transport.request("POST", path, { body });
+  }
+  /**
+   * Get Agents Stream Ticket
+   *
+   * Required permissions: read:configs.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async streamTicket() {
+    const path = "/v1/agents/stream-ticket";
+    return await this.transport.request("GET", path);
+  }
+  /**
+   * Unlink Agent
+   *
+   * Take over an agent from its file, by id or by name.
+   *
+   * The file stops governing it immediately and further changes go
+   * through this API. The file is left in place, inert — delete it
+   * whenever you like.
+   *
+   * Required permissions: write:configs.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async unlink(agent_id) {
+    const path = `/v1/agents/${enc(agent_id)}/unlink`;
+    return await this.transport.request("POST", path);
+  }
+  /**
+   * Update Agent
+   *
+   * Replace an agent's definition, by id or by name.
+   *
+   * The whole definition is replaced, and the change is live at
+   * once. Only for agents managed through this API: one defined
+   * by a repository file is a 409, since the next push to that file
+   * would revert the change — unlink it first to take ownership.
+   *
+   * Required permissions: write:configs.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async update(agent_id, options) {
+    const path = `/v1/agents/${enc(agent_id)}`;
+    const body = buildBody({ agent: options.agent });
+    return await this.transport.request("PUT", path, { body });
+  }
+};
 var EllipsisAlerts = class {
   constructor(transport) {
     this.transport = transport;
@@ -693,6 +1086,12 @@ var EllipsisAlerts = class {
    * Dismiss an open alert and return it.
    *
    * 409 when the alert is not open; 404 when it doesn't exist.
+   *
+   * Required permissions: write:alerts.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async dismiss(alert_id) {
     const path = `/v1/alerts/${enc(alert_id)}/dismiss`;
@@ -704,6 +1103,12 @@ var EllipsisAlerts = class {
    * Return one alert by id.
    *
    * 404 if it doesn't exist or belongs to another organization.
+   *
+   * Required permissions: read:alerts.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async get(alert_id) {
     const path = `/v1/alerts/${enc(alert_id)}`;
@@ -718,6 +1123,12 @@ var EllipsisAlerts = class {
    *
    * Available to all credential types, so an agent can check "is
    * this org near budget?" mid-task.
+   *
+   * Required permissions: read:alerts.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async list(options = {}) {
     const path = "/v1/alerts";
@@ -747,6 +1158,12 @@ var EllipsisAnalytics = class {
    * the apps/agents). Available to all credential types: the
    * responses expose the organization's own GitHub PR/review activity,
    * no secrets.
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async metrics(options = {}) {
     const path = "/v1/analytics/metrics";
@@ -760,6 +1177,12 @@ var EllipsisAnalytics = class {
    *
    * Windowing: pass explicit start/end, or days (default: the last
    * 30 days). account_type in all|user|bot scopes the authors.
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async pullRequests(options = {}) {
     const path = "/v1/analytics/pull-requests";
@@ -775,6 +1198,12 @@ var EllipsisAnalytics = class {
    * review the most PRs?" is the reviewer facets here with
    * account_type=bot. Windowing: pass explicit start/end, or days
    * (default: the last 30 days).
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async reviews(options = {}) {
     const path = "/v1/analytics/reviews";
@@ -793,6 +1222,8 @@ var EllipsisAuthCli = class {
    * Poll a device-code auth flow for its token.
    *
    * Unauthenticated; the device code identifies the flow.
+   *
+   * Authentication: No token required.
    */
   async poll(options) {
     const path = "/v1/auth/cli/poll";
@@ -807,6 +1238,8 @@ var EllipsisAuthCli = class {
    * Unauthenticated: the CLI has no credential yet — that's what
    * it's obtaining. The human authorizes out-of-band in the
    * dashboard.
+   *
+   * Authentication: No token required.
    */
   async start() {
     const path = "/v1/auth/cli/start";
@@ -821,142 +1254,6 @@ var EllipsisAuth = class {
   transport;
   cli;
 };
-var EllipsisAutomations = class {
-  constructor(transport) {
-    this.transport = transport;
-  }
-  transport;
-  /**
-   * Create Automation
-   *
-   * Create an automation, managed through the API: no file, live
-   * immediately. To put its definition in a repository instead, create
-   * it here and then POST /v1/automations/{automation_id}/link.
-   *
-   * 409 when another live automation already holds the name.
-   */
-  async create(options) {
-    const path = "/v1/automations";
-    const body = buildBody({ automation: options.automation });
-    return await this.transport.request("POST", path, { body });
-  }
-  /**
-   * Delete Automation
-   *
-   * Delete an automation, by id or by name.
-   *
-   * It stops running and its name is freed immediately; its past
-   * sessions remain readable. Only for automations managed through
-   * this API — delete the file to remove one defined by a repository.
-   */
-  async delete(automation_id) {
-    const path = `/v1/automations/${enc(automation_id)}`;
-    await this.transport.request("DELETE", path);
-  }
-  /**
-   * Get Automation
-   *
-   * Return one automation, by id or by name.
-   */
-  async get(automation_id) {
-    const path = `/v1/automations/${enc(automation_id)}`;
-    return await this.transport.request("GET", path);
-  }
-  /**
-   * Link Automation
-   *
-   * Move an automation into a repository, by id or by name.
-   *
-   * Opens a pull request adding its definition file. The automation
-   * keeps running unchanged meanwhile; merging hands it over to the
-   * file, after which the file is what changes it. Nothing happens
-   * if the pull request is never merged.
-   */
-  async link(automation_id, options) {
-    const path = `/v1/automations/${enc(automation_id)}/link`;
-    const body = buildBody({ path: options.path, repository: options.repository });
-    return await this.transport.request("POST", path, { body });
-  }
-  /**
-   * List Automations
-   *
-   * List automations.
-   */
-  async list() {
-    const path = "/v1/automations";
-    return await this.transport.request("GET", path);
-  }
-  /**
-   * Get Automation Metrics
-   *
-   * Return an automation's session distribution and trailing spend,
-   * by id or by name.
-   *
-   * `samples` carries one entry per finished session (duration, cost,
-   * tokens) for distributions; `spend_windows` carries what the
-   * automation's sessions cost over the last 1, 7, and 28 days against
-   * its budget for each window.
-   */
-  async metrics(automation_id) {
-    const path = `/v1/automations/${enc(automation_id)}/metrics`;
-    return await this.transport.request("GET", path);
-  }
-  /**
-   * Start Automation Session
-   *
-   * Invoke an automation.
-   *
-   * Runs a certified automation with its configured instructions, model,
-   * environment, permissions, skills, and budget, and returns
-   * the session it started. The session runs once and does not accept
-   * follow-up messages. If the automation declares input.json_schema,
-   * send only `input` for its initial message. Otherwise send a non-empty
-   * `prompt`, which becomes the initial message verbatim. Both fields
-   * together, neither field, and input that renders an empty message are
-   * rejected with 422. An optional `budget` lowers the session cap;
-   * `metadata` tags the session. Codex invocations are not supported.
-   */
-  async run(automation_id, options = {}) {
-    const path = `/v1/automations/${enc(automation_id)}/sessions`;
-    const body = buildBody({ budget: options.budget, input: options.input, metadata: options.metadata, prompt: options.prompt });
-    return await this.transport.request("POST", path, { body });
-  }
-  /**
-   * Get Automations Stream Ticket
-   */
-  async streamTicket() {
-    const path = "/v1/automations/stream-ticket";
-    return await this.transport.request("GET", path);
-  }
-  /**
-   * Unlink Automation
-   *
-   * Take over an automation from its file, by id or by name.
-   *
-   * The file stops governing it immediately and further changes go
-   * through this API. The file is left in place, inert — delete it
-   * whenever you like.
-   */
-  async unlink(automation_id) {
-    const path = `/v1/automations/${enc(automation_id)}/unlink`;
-    return await this.transport.request("POST", path);
-  }
-  /**
-   * Update Automation
-   *
-   * Replace an automation's definition, by id or by name.
-   *
-   * The whole definition is replaced, and the change is live at
-   * once. Only for automations managed through this API: one defined
-   * by a repository file is a 409, since the next push to that file
-   * would revert the change — unlink it first to take ownership.
-   */
-  async update(automation_id, options) {
-    const path = `/v1/automations/${enc(automation_id)}`;
-    const body = buildBody({ automation: options.automation });
-    return await this.transport.request("PUT", path, { body });
-  }
-};
 var EllipsisEnvironments = class {
   constructor(transport) {
     this.transport = transport;
@@ -970,6 +1267,12 @@ var EllipsisEnvironments = class {
    * `kind: environment` YAML under an agents directory.
    *
    * 409 when another live environment already holds the name.
+   *
+   * Required permissions: write:environments.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async create(options) {
     const path = "/v1/environments";
@@ -986,6 +1289,12 @@ var EllipsisEnvironments = class {
    * environment. Past sessions remain readable. Only for environments
    * managed through this API — delete the file to remove one defined
    * by a repository.
+   *
+   * Required permissions: delete:environments.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async delete(environment_id) {
     const path = `/v1/environments/${enc(environment_id)}`;
@@ -995,6 +1304,12 @@ var EllipsisEnvironments = class {
    * Get Environment
    *
    * Return one saved environment, by id or by name.
+   *
+   * Required permissions: read:environments.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async get(environment_id) {
     const path = `/v1/environments/${enc(environment_id)}`;
@@ -1004,6 +1319,12 @@ var EllipsisEnvironments = class {
    * List Environments
    *
    * List saved environments.
+   *
+   * Required permissions: read:environments.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async list() {
     const path = "/v1/environments";
@@ -1018,6 +1339,12 @@ var EllipsisEnvironments = class {
    * resolve the new body; running sessions keep the one frozen at
    * their start. Only for environments managed through this API: one
    * defined by a repository file is a 409.
+   *
+   * Required permissions: write:environments.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async update(environment_id, options) {
     const path = `/v1/environments/${enc(environment_id)}`;
@@ -1025,83 +1352,65 @@ var EllipsisEnvironments = class {
     return await this.transport.request("PUT", path, { body });
   }
 };
-var EllipsisFiles = class {
+var EllipsisHandlers = class {
   constructor(transport) {
     this.transport = transport;
   }
   transport;
   /**
-   * Create File
+   * List Handlers
    *
-   * Upload a file that outlives the sandbox.
+   * List the account's Slack, GitHub, Linear, and Sentry handlers.
    *
-   * v1: PNG images only, base64 in the JSON body, 10 MiB cap. The
-   * primary caller is the in-sandbox `agent file upload` CLI (an
-   * agent persisting a screenshot to link on a PR), but all
-   * credential types work. Returns the org-membership-gated
-   * dashboard URL so callers never hard-code URL shapes.
-   */
-  async create(options) {
-    const path = "/v1/files";
-    const body = buildBody({ content_type: options.content_type, data_b64: options.data_b64, filename: options.filename });
-    return await this.transport.request("POST", path, { body });
-  }
-  /**
-   * Delete File
+   * Returns at most one handler per service, from the current .ellipsis
+   * repository. Disabled handlers and last valid definitions with sync
+   * errors are included. Missing handlers are omitted. This reads saved
+   * state without fetching GitHub or triggering synchronization.
    *
-   * Delete a file.
+   * Requires configs:read; scoped grants match handlers/{service}.
+   * Session tokens with that grant may read handlers.
    *
-   * A foreign, missing, or already-deleted id is an
-   * indistinguishable 404, so ids can't be enumerated. Sandbox
-   * tokens get a 403 (a sandbox token sits next to
-   * potentially-untrusted code and must not be able to destroy the
-   * account's files — uploading is fine, destruction is not); API
-   * keys and user tokens may delete.
+   * Required permissions: read:configs.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
-  async delete(file_id) {
-    const path = `/v1/files/${enc(file_id)}`;
-    await this.transport.request("DELETE", path);
+  async list() {
+    const path = "/v1/handlers";
+    return await this.transport.request("GET", path);
   }
   /**
-   * Get File
+   * Get Handler Metrics
    *
-   * Return one file's metadata and download link.
+   * Return session counts and accumulated spend for a saved handler.
    *
-   * Includes the gated dashboard URL and a short-lived presigned
-   * `download_url`, plus the owning account's GitHub login.
+   * Filters only by session creation time. Omitted bounds include all
+   * history. Counts use the current turn and conversation state, so an open
+   * conversation awaiting another message remains active. Spend includes the selected sessions' full
+   * accumulated cost, including activity after the creation-time window.
+   * Only sessions carrying this exact saved handler id are counted;
+   * legacy sessions without handler provenance are excluded.
    *
-   * Signed-in dashboard users are checked against the file's owning
-   * account, regardless of their selected organization. API keys,
-   * CLI user tokens, and sandbox tokens remain restricted to their
-   * own account. Missing, deleted, and inaccessible files return 404.
+   * spend_windows reports current trailing 1-, 7-, and 28-day credit
+   * debits and effective handler budgets across all attributed sessions.
+   * Those windows use usage timestamps and are independent of start/end.
    *
-   * To fetch the bytes locally, call this and then GET download_url
-   * immediately — the JSON API never carries the file. The CLI's
-   * `agent file get` wraps exactly that two-step.
-   */
-  async get(file_id) {
-    const path = `/v1/files/${enc(file_id)}`;
-    return await this.transport.request("GET", path);
-  }
-  /**
-   * List Files
-   *
-   * List uploaded files, newest first.
+   * Requires configs:read matching handlers/{service} and unrestricted
+   * sessions:read. Session tokens with both grants may read metrics.
    *
-   * Metadata only by default. Set include_download_urls=true to get
-   * a download_urls map keyed by file id for thumbnails or batch
-   * downloads. URLs expire within about a minute. session_id scopes
-   * the list to one session's uploads.
+   * Required permissions: read:sessions, read:configs.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
-  async list(options = {}) {
-    const path = "/v1/files";
-    const query = buildQuery({ session_id: options.session_id, limit: options.limit, cursor: options.cursor, include_download_urls: options.include_download_urls });
-    const response = await this.transport.request("GET", path, { query });
-    return new Page(
-      response,
-      "files",
-      (cursor) => this.list({ ...options, cursor })
-    );
+  async metrics(handler_id, options = {}) {
+    const path = `/v1/handlers/${enc(handler_id)}/metrics`;
+    const query = buildQuery({ start: options.start, end: options.end });
+    return await this.transport.request("GET", path, { query });
   }
 };
 var EllipsisIntegrationsGithub = class {
@@ -1119,6 +1428,12 @@ var EllipsisIntegrationsGithub = class {
    *
    * Members carry their linked Slack identity when a Slack-GitHub
    * link exists, and /slack/members carries the reverse link.
+   *
+   * Required permissions: read:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async members() {
     const path = "/v1/integrations/github/members";
@@ -1128,6 +1443,12 @@ var EllipsisIntegrationsGithub = class {
    * List Github Repositories
    *
    * List GitHub repositories connected to the installation.
+   *
+   * Required permissions: read:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async repos() {
     const path = "/v1/integrations/github/repos";
@@ -1135,6 +1456,12 @@ var EllipsisIntegrationsGithub = class {
   }
   /**
    * Uninstall Github App
+   *
+   * Required permissions: write:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async uninstall(options) {
     const path = "/v1/integrations/github/uninstall";
@@ -1149,6 +1476,12 @@ var EllipsisIntegrationsLinear = class {
   transport;
   /**
    * Delete Linear Integration
+   *
+   * Required permissions: delete:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async delete() {
     const path = "/v1/integrations/linear";
@@ -1158,6 +1491,12 @@ var EllipsisIntegrationsLinear = class {
    * List Linear Teams
    *
    * List the teams of the connected Linear workspace.
+   *
+   * Required permissions: read:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async teams() {
     const path = "/v1/integrations/linear/teams";
@@ -1165,6 +1504,12 @@ var EllipsisIntegrationsLinear = class {
   }
   /**
    * Update Linear Teams
+   *
+   * Required permissions: write:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async updateSettings(options) {
     const path = "/v1/integrations/linear/settings";
@@ -1179,6 +1524,12 @@ var EllipsisIntegrationsSentry = class {
   transport;
   /**
    * Delete Sentry Integration
+   *
+   * Required permissions: delete:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async delete(integration_id) {
     const path = `/v1/integrations/sentry/${enc(integration_id)}`;
@@ -1188,6 +1539,12 @@ var EllipsisIntegrationsSentry = class {
    * List Sentry Organizations
    *
    * List the connected Sentry organizations.
+   *
+   * Required permissions: read:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async organizations() {
     const path = "/v1/integrations/sentry/organizations";
@@ -1204,6 +1561,12 @@ var EllipsisIntegrationsSlack = class {
    *
    * List the channels of the connected Slack workspace, fetched
    * live from the Slack API.
+   *
+   * Required permissions: read:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async channels() {
     const path = "/v1/integrations/slack/channels";
@@ -1211,6 +1574,12 @@ var EllipsisIntegrationsSlack = class {
   }
   /**
    * Create Operations Channel
+   *
+   * Required permissions: write:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async createOperationsChannel() {
     const path = "/v1/integrations/slack/operations-channel";
@@ -1218,6 +1587,12 @@ var EllipsisIntegrationsSlack = class {
   }
   /**
    * Delete Slack Integration
+   *
+   * Required permissions: delete:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async delete() {
     const path = "/v1/integrations/slack";
@@ -1228,6 +1603,12 @@ var EllipsisIntegrationsSlack = class {
    *
    * List the members of the connected Slack workspace, fetched
    * live from the Slack API.
+   *
+   * Required permissions: read:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async members() {
     const path = "/v1/integrations/slack/members";
@@ -1235,6 +1616,12 @@ var EllipsisIntegrationsSlack = class {
   }
   /**
    * Update Slack Settings
+   *
+   * Required permissions: write:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async updateSettings(options) {
     const path = "/v1/integrations/slack/settings";
@@ -1262,10 +1649,16 @@ var EllipsisIntegrations = class {
    *
    * A read-only view, so an agent authoring another agent's
    * config can learn which repositories, channels, teams, and
-   * organizations it may name before POST /automations.
+   * organizations it may name before POST /agents.
    *
-   * Available to all credential types including sandbox tokens: the
+   * Available to all credential types including session tokens: the
    * responses never include OAuth tokens or any other secret.
+   *
+   * Required permissions: read:integrations.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async list() {
     const path = "/v1/integrations";
@@ -1289,6 +1682,13 @@ var EllipsisMemories = class {
    *
    * Creating never overwrites: a path that already exists is a 409, so
    * correcting an existing memory is an explicit edit.
+   *
+   * Required permissions: write:memories.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async create(options) {
     const path = "/v1/memories";
@@ -1303,6 +1703,13 @@ var EllipsisMemories = class {
    * Available to every credential type, agents included — a wrong
    * memory is worse than a missing one. The deleted content is kept in
    * the memory's history for forensics, not for an undo API.
+   *
+   * Required permissions: delete:memories.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async delete(memory_id, options = {}) {
     const path = `/v1/memories/${enc(memory_id)}`;
@@ -1320,6 +1727,13 @@ var EllipsisMemories = class {
    *
    * Pass `if_sha256` (from a previous read) to make a concurrent write
    * a 409 instead of silently overwriting it.
+   *
+   * Required permissions: write:memories.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async edit(memory_id, options = {}) {
     const path = `/v1/memories/${enc(memory_id)}`;
@@ -1332,6 +1746,13 @@ var EllipsisMemories = class {
    * Read one memory's full content.
    *
    * The id comes from the index returned by listing memories.
+   *
+   * Required permissions: read:memories.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async get(memory_id) {
     const path = `/v1/memories/${enc(memory_id)}`;
@@ -1346,6 +1767,13 @@ var EllipsisMemories = class {
    * memory, carrying its id, path, and description) plus the same
    * entries structured, each with every field except `content`. Read
    * the index, then fetch the ids whose content you want.
+   *
+   * Required permissions: read:memories.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async list(options = {}) {
     const path = "/v1/memories";
@@ -1360,6 +1788,12 @@ var EllipsisReviews = class {
   transport;
   /**
    * List Review Configs
+   *
+   * Required permissions: read:reviews.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async configs() {
     const path = "/v1/reviews/configs";
@@ -1376,10 +1810,16 @@ var EllipsisReviews = class {
    * the automatic one.
    *
    * A review is one pipeline run over one commit range, with one
-   * agent session per stage: `review.id` is the run id, and
+   * agent session per stage: `review.id` is the review id, and
    * `stages[].session_id` is where a client streams
    * (/sessions/{id}/stream on a stage session), since the review
    * itself is a pipeline rather than one process.
+   *
+   * Required permissions: write:reviews.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async create(options) {
     const path = "/v1/reviews";
@@ -1397,6 +1837,12 @@ var EllipsisReviews = class {
    * Findings only exist after a stage session finalizes — a running
    * review honestly reports [] / null, which is why a client
    * streams a stage session and then re-fetches the review.
+   *
+   * Required permissions: read:reviews.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async get(review_id) {
     const path = `/v1/reviews/${enc(review_id)}`;
@@ -1414,6 +1860,12 @@ var EllipsisReviews = class {
    *
    * Webhook-created reviews appear here too, so this answers "show
    * me every review on this PR".
+   *
+   * Required permissions: read:reviews.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async list(options = {}) {
     const path = "/v1/reviews";
@@ -1426,33 +1878,6 @@ var EllipsisReviews = class {
     );
   }
 };
-var EllipsisSandboxes = class {
-  constructor(transport) {
-    this.transport = transport;
-  }
-  transport;
-  /**
-   * Get Single Sandbox
-   */
-  async get(sandbox_id) {
-    const path = `/v1/sandboxes/${enc(sandbox_id)}`;
-    return await this.transport.request("GET", path);
-  }
-  /**
-   * Get Sandboxes
-   */
-  async list() {
-    const path = "/v1/sandboxes";
-    await this.transport.request("GET", path);
-  }
-  /**
-   * Get Sandbox Stream Ticket
-   */
-  async streamTicket(sandbox_id) {
-    const path = `/v1/sandboxes/${enc(sandbox_id)}/stream-ticket`;
-    return await this.transport.request("GET", path);
-  }
-};
 var EllipsisSecrets = class {
   constructor(transport) {
     this.transport = transport;
@@ -1463,8 +1888,15 @@ var EllipsisSecrets = class {
    *
    * Delete a secret by name.
    *
-   * Refused for sandbox tokens; mutations require an API key or
+   * Refused for session tokens; mutations require an API key or
    * user token.
+   *
+   * Required permissions: delete:secrets.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async delete(name) {
     const path = `/v1/secrets/${enc(name)}`;
@@ -1477,6 +1909,13 @@ var EllipsisSecrets = class {
    *
    * Values are write-only: the response carries only names and
    * timestamps, never the stored value.
+   *
+   * Required permissions: read:secrets.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async list() {
     const path = "/v1/secrets";
@@ -1488,9 +1927,16 @@ var EllipsisSecrets = class {
    * Upsert secrets.
    *
    * Returns only the secrets this call wrote, names and timestamps
-   * only — values are write-only. Refused for sandbox tokens (held by
-   * potentially-untrusted in-sandbox code); mutations require an
-   * API key or user token.
+   * only — values are write-only. Refused for session tokens (held by
+   * potentially-untrusted code running inside a session); mutations
+   * require an API key or user token.
+   *
+   * Required permissions: write:secrets.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async set(options) {
     const path = "/v1/secrets";
@@ -1498,112 +1944,188 @@ var EllipsisSecrets = class {
     return await this.transport.request("PUT", path, { body });
   }
 };
+var EllipsisSessionsTurns = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  transport;
+  /**
+   * Get Session Turn
+   *
+   * Return one turn.
+   *
+   * Poll this after sending a message: the message is answered when
+   * the turn's status is completed, failed, stopped, or cancelled.
+   *
+   * Required permissions: read:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async get(session_id, turn_id) {
+    const path = `/v1/sessions/${enc(session_id)}/turns/${enc(turn_id)}`;
+    return await this.transport.request("GET", path);
+  }
+  /**
+   * Get Session Turns
+   *
+   * Return the session's turns and messages, oldest first.
+   *
+   * One turn per message: pending until the agent starts on it,
+   * running while it works, then completed, failed, stopped, or
+   * cancelled.
+   *
+   * Required permissions: read:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async list(session_id) {
+    const path = `/v1/sessions/${enc(session_id)}/turns`;
+    return await this.transport.request("GET", path);
+  }
+};
 var EllipsisSessions = class {
   constructor(transport) {
     this.transport = transport;
+    this.turns = new EllipsisSessionsTurns(transport);
   }
   transport;
+  turns;
   /**
-   * Get Agent Session Analytics
+   * Get Session Analytics
    *
    * Measured tokens and spend over time, plus estimated content cost.
    *
    * Token lanes use the request's saved rates. Content attribution
    * apportions input/cache spend by text size, counting carried context
-   * on every request. It is an estimate, not a tool execution fee.
+   * on every request. It is an estimate, not a tool call fee.
    * Only the latest 200 retained request bodies are inspected; missing
    * or unsupported context remains explicitly unattributed. No raw
-   * prompts or tool results are returned. Sandbox tokens may read only
+   * prompts or tool results are returned. Session tokens may read only
    * their own session's analytics.
+   *
+   * Required permissions: read:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own session.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async analytics(session_id) {
     const path = `/v1/sessions/${enc(session_id)}/analytics`;
     return await this.transport.request("GET", path);
   }
   /**
-   * Get Agent Session Diff
+   * Get Session Diff
    *
    * Return the session's uncommitted changes as a patch.
    *
    * One unified-diff section per changed file, captured from the
-   * sandbox's working tree when the session ended. The per-file
+   * environment's working tree when the session ended. The per-file
    * counts ride on the session itself (`git.repos[].files`); this
    * is the text behind them. Empty when the tree was clean. A
-   * sandbox token may read only its own session's diff.
+   * session token may read only its own session's diff.
+   *
+   * Required permissions: read:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own session.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async diff(session_id) {
     const path = `/v1/sessions/${enc(session_id)}/diff`;
     return await this.transport.request("GET", path);
   }
   /**
-   * List Session Executions
+   * Download Session
    *
-   * Return the session's execution attempts, oldest first.
-   *
-   * Includes the selected harness, model, resolved instructions, initial
-   * query, and common result summary. Complete native outputs remain in
-   * the session's records. Internal launch options and checkpoint storage
-   * references are excluded.
-   */
-  async executions(session_id) {
-    const path = `/v1/sessions/${enc(session_id)}/executions`;
-    return await this.transport.request("GET", path);
-  }
-  /**
-   * Export Agent Session
-   *
-   * Export the complete session history.
+   * Download the complete session history.
    *
    * The complete, ordered history of the session (agent output, tool calls, thinking,
-   * lifecycle events, sandbox output, message events) as an ordered
+   * lifecycle events, environment output, message events) as an ordered
    * manifest of presigned segment URLs.
    *
    * Segments are gzip members: download in order and concatenate
    * for one file. The JSON API never carries the bytes (same
    * two-step as files). /records is the paged live view of the
    * same data.
+   *
+   * Required permissions: read:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
-  async export(session_id) {
-    const path = `/v1/sessions/${enc(session_id)}/export`;
+  async download(session_id) {
+    const path = `/v1/sessions/${enc(session_id)}/download`;
     return await this.transport.request("GET", path);
   }
   /**
-   * Get Agent Session
+   * Get Session
    *
    * Return one session.
    *
-   * The public wire shape — the same shape the stream's session
-   * frames carry, with attributed_user and stopped_by_user resolved
-   * at read time.
+   * The public wire shape, the same shape the stream's session frames
+   * carry, with attribution, stop, and archive actors resolved at read
+   * time. `turn` is the turn in progress or the latest one.
    *
    * The heavy near-static blobs (config snapshot, input/output)
    * live on the detail endpoints, not here.
+   *
+   * Required permissions: read:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async get(session_id) {
     const path = `/v1/sessions/${enc(session_id)}`;
     return await this.transport.request("GET", path);
   }
   /**
-   * Get Agent Session Git
+   * Get Session Git
    *
    * The session's GitHub-side git view: its commits, and each PR it
    * opened joined to the live gh_prs row and reviews. The identity list
    * (output_git) rides the session itself over the WebSocket; this is
    * the join a "run" notify tells an open pane to refetch.
+   *
+   * Required permissions: read:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async git(session_id) {
     const path = `/v1/sessions/${enc(session_id)}/git`;
     return await this.transport.request("GET", path);
   }
   /**
-   * Ingest Agent Session Transcript
+   * Ingest Session Transcript
    *
    * Append transcript lines to a session's record.
    *
-   * The in-sandbox tailer for interactive sessions.
+   *             The transcript tailer running inside the session's environment, for
+   * interactive sessions.
    *
-   * A sandbox token may only push its own session's transcript.
-   * Idempotent by transcript line uuid; tolerant of malformed lines.
+   *             A session token may only push its own session's transcript.
+   *             Idempotent by transcript line uuid; tolerant of malformed lines.
+   *
+   * Required permissions: write:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own session.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async ingestTranscript(session_id, options) {
     const path = `/v1/sessions/${enc(session_id)}/transcript`;
@@ -1611,17 +2133,24 @@ var EllipsisSessions = class {
     return await this.transport.request("POST", path, { body });
   }
   /**
-   * List Agent Sessions
+   * List Sessions
    *
    * List cloud agent sessions, newest first.
    *
-   * Optionally filtered by automation (id or name), source, time
+   * Optionally filtered by agent (id or name), source, service, handler, time
    * window, attributed author, repository, and whether the session is
    * still going.
+   *
+   * Required permissions: read:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async list(options = {}) {
     const path = "/v1/sessions";
-    const query = buildQuery({ automation: options.automation, source: options.source, days: options.days, start: options.start, end: options.end, limit: options.limit, cursor: options.cursor, author_id: options.author_id, repo: options.repo, unfinished: options.unfinished, exclude_code_review: options.exclude_code_review });
+    const query = buildQuery({ agent: options.agent, source: options.source, service: options.service, handler: options.handler, days: options.days, start: options.start, end: options.end, limit: options.limit, cursor: options.cursor, author_id: options.author_id, repo: options.repo, unfinished: options.unfinished, exclude_code_review: options.exclude_code_review });
     const response = await this.transport.request("GET", path, { query });
     return new Page(
       response,
@@ -1630,30 +2159,44 @@ var EllipsisSessions = class {
     );
   }
   /**
-   * Get Agent Session Output
+   * Get Session Output
    *
    * Return the session's typed output.
    *
    * The payload the agent submitted through its config-declared
    * output.json_schema, as the raw JSON body with no envelope. 404
    * while the session is still running (poll GET /v1/sessions/{id}),
-   * when the agent declares no output block, or when no execution
+   * when the agent declares no output block, or when no turn
    * produced output.
+   *
+   * Required permissions: read:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async output(session_id) {
     const path = `/v1/sessions/${enc(session_id)}/output`;
     return await this.transport.request("GET", path);
   }
   /**
-   * Get Agent Session Records
+   * Get Session Records
    *
    * Return the session's stored transcript records, oldest first.
    *
    * Pagination is opt-in (cursor/limit); a bare call returns the
-   * full retained transcript. Available to sandbox tokens too: an
+   * full retained transcript. Available to session tokens too: an
    * agent answering "did X look into Y?" needs to read the sessions
    * it finds, and any org member sees the same transcript in the
    * dashboard.
+   *
+   * Required permissions: read:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async records(session_id, options = {}) {
     const path = `/v1/sessions/${enc(session_id)}/records`;
@@ -1666,22 +2209,35 @@ var EllipsisSessions = class {
     );
   }
   /**
-   * Search Agent Sessions
+   * Search Sessions
+   *
+   * Required permissions: read:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async search(options = {}) {
     const path = "/v1/sessions/search";
-    const query = buildQuery({ q: options.q, scope: options.scope, source: options.source, author_id: options.author_id, automation_id: options.automation_id, session_ids: options.session_ids, repo: options.repo, status: options.status, start: options.start, end: options.end, limit: options.limit });
+    const query = buildQuery({ q: options.q, scope: options.scope, source: options.source, service: options.service, handler: options.handler, author_id: options.author_id, agent_id: options.agent_id, session_ids: options.session_ids, repo: options.repo, status: options.status, start: options.start, end: options.end, limit: options.limit });
     return await this.transport.request("GET", path, { query });
   }
   /**
-   * Send Agent Session Message
+   * Send Session Message
    *
    * Send a message to a session.
    *
-   * 409 for react/cron, non-interactive, and closed sessions.
-   * Returns the created message so the caller can track it by id; a
-   * retried send with the same idempotency_key returns the original
-   * message.
+   * 409 for react/cron, non-interactive, closed, and out-of-budget
+   * sessions. Returns the created message and its turn; a retried send
+   * with the same idempotency_key returns the original ones.
+   *
+   * Required permissions: write:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async sendMessage(session_id, options) {
     const path = `/v1/sessions/${enc(session_id)}/messages`;
@@ -1690,39 +2246,63 @@ var EllipsisSessions = class {
   }
   /**
    * Get Session Stream Ticket
+   *
+   * Required permissions: read:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async sessionStreamTicket(session_id) {
     const path = `/v1/sessions/${enc(session_id)}/stream-ticket`;
     return await this.transport.request("GET", path);
   }
   /**
-   * Start Agent Session
+   * Start Session
    *
    * Start a cloud agent session.
    *
    * The daily driver: a prompt, optionally where to run it
-   * (`environment`) and the run's own settings, in the AutomationConfig
+   * (`environment`) and the session's own settings, in the AgentConfig
    * vocabulary. What you send is what runs: omit `environment` and the
-   * session runs in the built-in basic sandbox. A missing model or
+   * session runs in the built-in basic environment. A missing model or
    * budget comes from the organization's settings, so
-   * `{"prompt": "..."}` alone is a complete request. `prompt` is the
-   * first message; omit it and the session starts idle, waiting for
-   * one. 400 when `interactive` is false and there is no prompt, or
-   * when `budget` exceeds the organization's per-session ceiling. To
-   * run a saved automation, use POST /v1/automations/{automation_id}/sessions.
-   */
-  async start(options) {
+   * `{"claude_code": {"prompt": "..."}}` is a complete request.
+   * Set exactly one of `claude_code` or `codex`. Its `prompt` is the
+   * first message; omit the prompt and the session starts with no
+   * turn, waiting for one. 400 when `conversation.interactive` is false
+   * and there is no prompt, or when `budget` exceeds the organization's
+   * per-session ceiling. To run a saved agent, use
+   * POST /v1/agents/{agent_id}/sessions.
+   *
+   * Required permissions: write:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async start(options = {}) {
     const path = "/v1/sessions";
-    const body = buildBody({ budget: options.budget, environment: options.environment, force_rebuild: options.force_rebuild, harness: options.harness, images: options.images, instructions: options.instructions, interactive: options.interactive, metadata: options.metadata, output: options.output, permissions: options.permissions, prompt: options.prompt, repositories: options.repositories, skills: options.skills });
+    const body = buildBody({ budget: options.budget, claude_code: options.claude_code, codex: options.codex, conversation: options.conversation, environment: options.environment, force_rebuild: options.force_rebuild, images: options.images, metadata: options.metadata, output: options.output, permissions: options.permissions, repositories: options.repositories, skills: options.skills });
     return await this.transport.request("POST", path, { body });
   }
   /**
-   * Stop Agent Session
+   * Stop Session
    *
-   * Stop an in-flight session and return it.
+   * Stop the turn in progress and return the session.
    *
-   * stopped_by is recorded only when the caller's credential maps
-   * to a GitHub account.
+   * The turn ends `stopped`; the conversation stays open. 409 when no
+   * turn is pending or running. The stopping user is recorded only
+   * when the caller's credential maps to a GitHub account.
+   *
+   * Required permissions: write:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async stop(session_id) {
     const path = `/v1/sessions/${enc(session_id)}/stop`;
@@ -1730,11 +2310,43 @@ var EllipsisSessions = class {
   }
   /**
    * Get Sessions Stream Ticket
+   *
+   * Required permissions: read:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
    */
   async streamTicket() {
     const path = "/v1/sessions/stream-ticket";
     return await this.transport.request("GET", path);
   }
+  /**
+   * Update Session
+   *
+   * Archive or unarchive a session and return it.
+   *
+   * Set archived to true to record the current server time and the
+   * authenticated GitHub user. API-key requests record no user.
+   * Repeated archive requests preserve the original time and user.
+   * Set archived to false to clear both fields. Archiving is available
+   * in any session state and does not stop a running session.
+   *
+   * Changes are delivered to session and session-list streams.
+   *
+   * Required permissions: write:sessions.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
+   * Grant match patterns can further restrict access to individual resources.
+   */
+  async update(session_id, options) {
+    const path = `/v1/sessions/${enc(session_id)}`;
+    const body = buildBody({ archived: options.archived });
+    return await this.transport.request("PUT", path, { body });
+  }
   // ---- lifecycle sugar (hand-written layer over the generated core) ----
   /** Start a session and return a handle over it. */
   async run(options) {
@@ -1754,6 +2366,12 @@ var EllipsisSupportSlack = class {
   transport;
   /**
    * Request Slack Help
+   *
+   * Required permissions: write:account.
+   * API key: Requires a CLI user token.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async create(options) {
     const path = "/v1/support/slack";
@@ -1762,6 +2380,12 @@ var EllipsisSupportSlack = class {
   }
   /**
    * Get Slack Help
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async get() {
     const path = "/v1/support/slack";
@@ -1769,6 +2393,12 @@ var EllipsisSupportSlack = class {
   }
   /**
    * Invite To Slack Help
+   *
+   * Required permissions: write:account.
+   * API key: Requires a CLI user token.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async invite(options) {
     const path = "/v1/support/slack/invites";
@@ -1793,6 +2423,12 @@ var EllipsisTemplates = class {
    * Get Agent Template
    *
    * Return one built-in agent template by slug.
+   *
+   * Required permissions: read:templates.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async get(template_id) {
     const path = `/v1/templates/${enc(template_id)}`;
@@ -1805,6 +2441,12 @@ var EllipsisTemplates = class {
    *
    * Behind auth but not account-scoped — the data is static
    * product content shared by the dashboard, landing site, and CLI.
+   *
+   * Required permissions: read:templates.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async list() {
     const path = "/v1/templates";
@@ -1823,6 +2465,12 @@ var EllipsisUserSubscriptionTokens = class {
    *
    * Your sessions stop billing your subscription immediately, and the
    * usage reading goes with it — it described that token's plan.
+   *
+   * Required permissions: delete:user.
+   * API key: Requires a CLI user token.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async delete(provider) {
     const path = `/v1/user/subscription_tokens/${enc(String(provider))}`;
@@ -1835,6 +2483,12 @@ var EllipsisUserSubscriptionTokens = class {
    *
    * `configured` is false when nothing is saved. The token itself is
    * never returned, only `token_last4`.
+   *
+   * Required permissions: read:user.
+   * API key: Requires a CLI user token.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async get(provider) {
     const path = `/v1/user/subscription_tokens/${enc(String(provider))}`;
@@ -1848,6 +2502,12 @@ var EllipsisUserSubscriptionTokens = class {
    * One entry per supported provider, whether or not you have saved a
    * token for it. Tokens are write-only: the response carries only
    * `token_last4`, never the token.
+   *
+   * Required permissions: read:user.
+   * API key: Requires a CLI user token.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async list() {
     const path = "/v1/user/subscription_tokens";
@@ -1863,6 +2523,12 @@ var EllipsisUserSubscriptionTokens = class {
    * succeeds. For Claude, use `claude setup-token`. For Codex, paste
    * the auth.json credentials from a ChatGPT login. Each subscription
    * pays only for models from its corresponding provider.
+   *
+   * Required permissions: write:user.
+   * API key: Requires a CLI user token.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async set(provider, options) {
     const path = `/v1/user/subscription_tokens/${enc(String(provider))}`;
@@ -1879,6 +2545,12 @@ var EllipsisUserSubscriptionTokens = class {
    * real windows without us seeing them. Null unless a token is
    * enabled for the provider: a disabled token routes nothing, so any
    * reading behind it is stale by construction.
+   *
+   * Required permissions: read:user.
+   * API key: Requires a CLI user token.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async usage(provider) {
     const path = `/v1/user/subscription_tokens/${enc(String(provider))}/usage`;
@@ -1895,6 +2567,12 @@ var EllipsisUserSubscriptionTokens = class {
    * token is how you stop it routing. A 200 with `ok: false` is the
    * normal way a bad token is reported — it is an answer, not a
    * transport failure.
+   *
+   * Required permissions: write:user.
+   * API key: Requires a CLI user token.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async verify(provider) {
     const path = `/v1/user/subscription_tokens/${enc(String(provider))}/verify`;
@@ -1908,6 +2586,12 @@ var EllipsisUserTokens = class {
   transport;
   /**
    * List User Tokens
+   *
+   * Required permissions: read:user.
+   * API key: Requires a CLI user token.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async list() {
     const path = "/v1/user/tokens";
@@ -1915,6 +2599,12 @@ var EllipsisUserTokens = class {
   }
   /**
    * Revoke User Token
+   *
+   * Required permissions: delete:user.
+   * API key: Requires a CLI user token.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async revoke(token_id) {
     const path = `/v1/user/tokens/${enc(token_id)}`;
@@ -1931,6 +2621,129 @@ var EllipsisUser = class {
   subscriptionTokens;
   tokens;
 };
+var EllipsisVmExecutions = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  transport;
+  /**
+   * Get Single Vm Execution
+   *
+   * Required permissions: read:environments.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own sandbox.
+   * Higher permission levels include lower levels: read < write < delete.
+   */
+  async get(vm_execution_id) {
+    const path = `/v1/vm-executions/${enc(vm_execution_id)}`;
+    return await this.transport.request("GET", path);
+  }
+  /**
+   * Get Vm Executions
+   *
+   * Required permissions: read:environments.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own sandbox.
+   * Higher permission levels include lower levels: read < write < delete.
+   */
+  async list() {
+    const path = "/v1/vm-executions";
+    await this.transport.request("GET", path);
+  }
+  /**
+   * Get Vm Execution Stream Ticket
+   *
+   * Required permissions: read:environments.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own sandbox.
+   * Higher permission levels include lower levels: read < write < delete.
+   */
+  async streamTicket(vm_execution_id) {
+    const path = `/v1/vm-executions/${enc(vm_execution_id)}/stream-ticket`;
+    return await this.transport.request("GET", path);
+  }
+};
+var EllipsisVmImages = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  transport;
+  /**
+   * Get Vm Image
+   *
+   * Get metadata for a reusable VM image.
+   *
+   * Required permissions: read:environments.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
+   */
+  async get(image_id) {
+    const path = `/v1/vm-images/${enc(image_id)}`;
+    return await this.transport.request("GET", path);
+  }
+  /**
+   * List Vm Images
+   *
+   * List reusable VM images.
+   *
+   * Includes expiration, repository revisions, and build identity.
+   *
+   * Required permissions: read:environments.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
+   */
+  async list(options = {}) {
+    const path = "/v1/vm-images";
+    const query = buildQuery({ limit: options.limit, offset: options.offset });
+    return await this.transport.request("GET", path, { query });
+  }
+};
+var EllipsisVms = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  transport;
+  /**
+   * Get Vm
+   *
+   * Get a VM and its most recent execution.
+   *
+   * Required permissions: read:environments.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own VM.
+   * Higher permission levels include lower levels: read < write < delete.
+   */
+  async get(vm_id) {
+    const path = `/v1/vms/${enc(vm_id)}`;
+    return await this.transport.request("GET", path);
+  }
+  /**
+   * List Vms
+   *
+   * List VMs and their last recorded state.
+   *
+   * Each machine appears once, including paused and deleted VMs, newest execution first.
+   *
+   * Required permissions: read:environments.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own VM.
+   * Higher permission levels include lower levels: read < write < delete.
+   */
+  async list(options = {}) {
+    const path = "/v1/vms";
+    const query = buildQuery({ limit: options.limit, offset: options.offset });
+    return await this.transport.request("GET", path, { query });
+  }
+};
 var EllipsisWebhooksDeliveries = class {
   constructor(transport) {
     this.transport = transport;
@@ -1943,6 +2756,12 @@ var EllipsisWebhooksDeliveries = class {
    *
    * Payloads are immutable across retries. Attempt details include HTTP
    * status, timing, and errors. Response bodies are not retained.
+   *
+   * Required permissions: read:webhooks.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async get(delivery_id) {
     const path = `/v1/webhooks/deliveries/${enc(delivery_id)}`;
@@ -1955,6 +2774,12 @@ var EllipsisWebhooksDeliveries = class {
    *
    * Includes verification pings and deliveries for deleted webhooks.
    * History is retained for 30 days. Retries belong to the same delivery.
+   *
+   * Required permissions: read:webhooks.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async list(options = {}) {
     const path = "/v1/webhooks/deliveries";
@@ -1980,9 +2805,15 @@ var EllipsisWebhooks = class {
    * Create a webhook and send a verification ping.
    *
    * Save the signing secret from this response; it is returned once.
-   * Accounts can have three webhooks, including unverified and pending
-   * ones. A ping returning HTTP 200 moves unverified to pending. Contact
+   * Accounts default to three webhook slots, including unverified and
+   * pending ones; your account may have a custom allowance. A ping returning HTTP 200 moves unverified to pending. Contact
    * Ellipsis to activate it and receive session.create events.
+   *
+   * Required permissions: write:webhooks.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async create(options) {
     const path = "/v1/webhooks";
@@ -1995,7 +2826,13 @@ var EllipsisWebhooks = class {
    * Delete a webhook and cancel outstanding deliveries.
    *
    * An HTTP request already in flight may finish. Delivery history remains
-   * available for 30 days. Deletion frees one of the account's three slots.
+   * available for 30 days. Deletion frees a webhook slot.
+   *
+   * Required permissions: delete:webhooks.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async delete(webhook_id) {
     const path = `/v1/webhooks/${enc(webhook_id)}`;
@@ -2005,6 +2842,12 @@ var EllipsisWebhooks = class {
    * Get Webhook
    *
    * Get a webhook's configuration and approval state.
+   *
+   * Required permissions: read:webhooks.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async get(webhook_id) {
     const path = `/v1/webhooks/${enc(webhook_id)}`;
@@ -2014,6 +2857,12 @@ var EllipsisWebhooks = class {
    * List Webhooks
    *
    * List your webhooks and their delivery summaries.
+   *
+   * Required permissions: read:webhooks.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async list() {
     const path = "/v1/webhooks";
@@ -2025,8 +2874,15 @@ var EllipsisWebhooks = class {
    * Send a signed verification or test ping.
    *
    * Available in every state. Only HTTP 200 verifies a destination;
-   * successful pings never activate it. At most five pings per account
-   * per minute, including pings from creation and URL changes.
+   * successful pings never activate it. The default limit is five pings per
+   * account per minute, including creation and URL changes. Custom
+   * account allowances apply.
+   *
+   * Required permissions: write:webhooks.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async ping(webhook_id) {
     const path = `/v1/webhooks/${enc(webhook_id)}/ping`;
@@ -2040,6 +2896,12 @@ var EllipsisWebhooks = class {
    * Changing the URL cancels outstanding deliveries, clears verification
    * and approval, and sends another ping. State and signing secret cannot
    * be set here. Updating description or subscriptions preserves approval.
+   *
+   * Required permissions: write:webhooks.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async update(webhook_id, options) {
     const path = `/v1/webhooks/${enc(webhook_id)}`;
@@ -2050,46 +2912,56 @@ var EllipsisWebhooks = class {
 var Ellipsis = class {
   transport;
   account;
+  agents;
   alerts;
   analytics;
   auth;
-  automations;
   environments;
-  files;
+  handlers;
   integrations;
   memories;
   reviews;
-  sandboxes;
   secrets;
   sessions;
   support;
   templates;
   user;
+  vmExecutions;
+  vmImages;
+  vms;
   webhooks;
   constructor(options) {
     this.transport = new Transport(options);
     this.account = new EllipsisAccount(this.transport);
+    this.agents = new EllipsisAgents(this.transport);
     this.alerts = new EllipsisAlerts(this.transport);
     this.analytics = new EllipsisAnalytics(this.transport);
     this.auth = new EllipsisAuth(this.transport);
-    this.automations = new EllipsisAutomations(this.transport);
     this.environments = new EllipsisEnvironments(this.transport);
-    this.files = new EllipsisFiles(this.transport);
+    this.handlers = new EllipsisHandlers(this.transport);
     this.integrations = new EllipsisIntegrations(this.transport);
     this.memories = new EllipsisMemories(this.transport);
     this.reviews = new EllipsisReviews(this.transport);
-    this.sandboxes = new EllipsisSandboxes(this.transport);
     this.secrets = new EllipsisSecrets(this.transport);
     this.sessions = new EllipsisSessions(this.transport);
     this.support = new EllipsisSupport(this.transport);
     this.templates = new EllipsisTemplates(this.transport);
     this.user = new EllipsisUser(this.transport);
+    this.vmExecutions = new EllipsisVmExecutions(this.transport);
+    this.vmImages = new EllipsisVmImages(this.transport);
+    this.vms = new EllipsisVms(this.transport);
     this.webhooks = new EllipsisWebhooks(this.transport);
   }
   /**
    * Current Identity
    *
    * Return the identity behind the caller's credential.
+   *
+   * Required permissions: read:account.
+   * API key: Supported.
+   * CLI user token: Supported.
+   * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+   * Higher permission levels include lower levels: read < write < delete.
    */
   async identity() {
     const path = "/v1/identity";
@@ -2109,9 +2981,8 @@ export {
   RateLimitError,
   ServerError,
   SessionHandle,
-  TERMINAL_STATUSES,
   Transport,
   TransportError,
   UnprocessableError,
-  isSettled
+  isTurnFinal
 };