@mutagent/sdk 0.3.36 → 0.3.38

package/dist/esm/models/schemadefaul6.js

@@ -0,0 +1,14 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+import * as z from "zod/v4-mini";
+export var Schemadefaul6;
+(function (Schemadefaul6) {
+    Schemadefaul6["Owner"] = "owner";
+    Schemadefaul6["Admin"] = "admin";
+    Schemadefaul6["Editor"] = "editor";
+    Schemadefaul6["Viewer"] = "viewer";
+})(Schemadefaul6 || (Schemadefaul6 = {}));
+/** @internal */
+export const Schemadefaul6$outboundSchema = z.enum(Schemadefaul6);
+//# sourceMappingURL=schemadefaul6.js.map

package/dist/esm/models/schemadefaul6.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemadefaul6.js","sourceRoot":"","sources":["../../../src/models/schemadefaul6.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC,MAAM,CAAN,IAAY,aAKX;AALD,WAAY,aAAa;IACvB,gCAAe,CAAA;IACf,gCAAe,CAAA;IACf,kCAAiB,CAAA;IACjB,kCAAiB,CAAA;AACnB,CAAC,EALW,aAAa,KAAb,aAAa,QAKxB;AAED,gBAAgB;AAChB,MAAM,CAAC,MAAM,4BAA4B,GACvC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC"}

package/dist/esm/models/schemadefaul8.d.ts

@@ -0,0 +1,9 @@
+import * as z from "zod/v4-mini";
+export declare enum Schemadefaul8 {
+    Admin = "admin",
+    Editor = "editor",
+    Viewer = "viewer"
+}
+/** @internal */
+export declare const Schemadefaul8$outboundSchema: z.ZodMiniEnum<typeof Schemadefaul8>;
+//# sourceMappingURL=schemadefaul8.d.ts.map

package/dist/esm/models/schemadefaul8.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemadefaul8.d.ts","sourceRoot":"","sources":["../../../src/models/schemadefaul8.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC,oBAAY,aAAa;IACvB,KAAK,UAAU;IACf,MAAM,WAAW;IACjB,MAAM,WAAW;CAClB;AAED,gBAAgB;AAChB,eAAO,MAAM,4BAA4B,EAAE,CAAC,CAAC,WAAW,CAAC,OAAO,aAAa,CACtD,CAAC"}

package/dist/esm/models/schemadefaul8.js

@@ -0,0 +1,13 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+import * as z from "zod/v4-mini";
+export var Schemadefaul8;
+(function (Schemadefaul8) {
+    Schemadefaul8["Admin"] = "admin";
+    Schemadefaul8["Editor"] = "editor";
+    Schemadefaul8["Viewer"] = "viewer";
+})(Schemadefaul8 || (Schemadefaul8 = {}));
+/** @internal */
+export const Schemadefaul8$outboundSchema = z.enum(Schemadefaul8);
+//# sourceMappingURL=schemadefaul8.js.map

package/dist/esm/models/{schemadefaul3.js.map → schemadefaul8.js.map}

@@ -1 +1 @@
-{"version":3,"file":"schemadefaul3.js","sourceRoot":"","sources":["../../../src/models/schemadefaul3.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC,MAAM,CAAN,IAAY,aAIX;AAJD,WAAY,aAAa;IACvB,gCAAe,CAAA;IACf,kCAAiB,CAAA;IACjB,kCAAiB,CAAA;AACnB,CAAC,EAJW,aAAa,KAAb,aAAa,QAIxB;AAED,gBAAgB;AAChB,MAAM,CAAC,MAAM,4BAA4B,GACvC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC"}
+{"version":3,"file":"schemadefaul8.js","sourceRoot":"","sources":["../../../src/models/schemadefaul8.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC,MAAM,CAAN,IAAY,aAIX;AAJD,WAAY,aAAa;IACvB,gCAAe,CAAA;IACf,kCAAiB,CAAA;IACjB,kCAAiB,CAAA;AACnB,CAAC,EAJW,aAAa,KAAb,aAAa,QAIxB;AAED,gBAAgB;AAChB,MAAM,CAAC,MAAM,4BAA4B,GACvC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC"}

package/dist/esm/models/session-id-line.d.ts

@@ -0,0 +1,20 @@
+import * as z from "zod/v4-mini";
+export type SessionIdLine = {
+    /**
+     * The Helix session to write to — from the `start` that created it.
+     */
+    sessionId: string;
+    /**
+     * Exactly one JSON object, serialised. No trailing newline — the box appends it, so one call cannot smuggle two commands. A value that is not a single JSON object is a 400.
+     */
+    line: string;
+};
+/** @internal */
+export type SessionIdLine$Outbound = {
+    sessionId: string;
+    line: string;
+};
+/** @internal */
+export declare const SessionIdLine$outboundSchema: z.ZodMiniType<SessionIdLine$Outbound, SessionIdLine>;
+export declare function sessionIdLineToJSON(sessionIdLine: SessionIdLine): string;
+//# sourceMappingURL=session-id-line.d.ts.map

package/dist/esm/models/session-id-line.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-id-line.d.ts","sourceRoot":"","sources":["../../../src/models/session-id-line.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC,MAAM,MAAM,aAAa,GAAG;IAC1B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,gBAAgB;AAChB,MAAM,MAAM,sBAAsB,GAAG;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,4BAA4B,EAAE,CAAC,CAAC,WAAW,CACtD,sBAAsB,EACtB,aAAa,CAIb,CAAC;AAEH,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,aAAa,GAAG,MAAM,CAExE"}

package/dist/esm/models/session-id-line.js

@@ -0,0 +1,13 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+import * as z from "zod/v4-mini";
+/** @internal */
+export const SessionIdLine$outboundSchema = z.object({
+    sessionId: z.string(),
+    line: z.string(),
+});
+export function sessionIdLineToJSON(sessionIdLine) {
+    return JSON.stringify(SessionIdLine$outboundSchema.parse(sessionIdLine));
+}
+//# sourceMappingURL=session-id-line.js.map

package/dist/esm/models/session-id-line.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-id-line.js","sourceRoot":"","sources":["../../../src/models/session-id-line.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAmBjC,gBAAgB;AAChB,MAAM,CAAC,MAAM,4BAA4B,GAGrC,CAAC,CAAC,MAAM,CAAC;IACX,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAEH,MAAM,UAAU,mBAAmB,CAAC,aAA4B;IAC9D,OAAO,IAAI,CAAC,SAAS,CAAC,4BAA4B,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;AAC3E,CAAC"}

package/dist/esm/models/session-id-signal.d.ts

@@ -0,0 +1,23 @@
+import * as z from "zod/v4-mini";
+export declare enum Signal {
+    Sigint = "SIGINT",
+    Sigterm = "SIGTERM"
+}
+export type SessionIdSignal = {
+    /**
+     * The Helix session to signal — from the `start` that created it.
+     */
+    sessionId: string;
+    signal: Signal;
+};
+/** @internal */
+export declare const Signal$outboundSchema: z.ZodMiniEnum<typeof Signal>;
+/** @internal */
+export type SessionIdSignal$Outbound = {
+    sessionId: string;
+    signal: string;
+};
+/** @internal */
+export declare const SessionIdSignal$outboundSchema: z.ZodMiniType<SessionIdSignal$Outbound, SessionIdSignal>;
+export declare function sessionIdSignalToJSON(sessionIdSignal: SessionIdSignal): string;
+//# sourceMappingURL=session-id-signal.d.ts.map

package/dist/esm/models/session-id-signal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-id-signal.d.ts","sourceRoot":"","sources":["../../../src/models/session-id-signal.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC,oBAAY,MAAM;IAChB,MAAM,WAAW;IACjB,OAAO,YAAY;CACpB;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,qBAAqB,EAAE,CAAC,CAAC,WAAW,CAAC,OAAO,MAAM,CAE9D,CAAC;AAEF,gBAAgB;AAChB,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,8BAA8B,EAAE,CAAC,CAAC,WAAW,CACxD,wBAAwB,EACxB,eAAe,CAIf,CAAC;AAEH,wBAAgB,qBAAqB,CACnC,eAAe,EAAE,eAAe,GAC/B,MAAM,CAER"}

package/dist/esm/models/session-id-signal.js

@@ -0,0 +1,20 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+import * as z from "zod/v4-mini";
+export var Signal;
+(function (Signal) {
+    Signal["Sigint"] = "SIGINT";
+    Signal["Sigterm"] = "SIGTERM";
+})(Signal || (Signal = {}));
+/** @internal */
+export const Signal$outboundSchema = z.enum(Signal);
+/** @internal */
+export const SessionIdSignal$outboundSchema = z.object({
+    sessionId: z.string(),
+    signal: Signal$outboundSchema,
+});
+export function sessionIdSignalToJSON(sessionIdSignal) {
+    return JSON.stringify(SessionIdSignal$outboundSchema.parse(sessionIdSignal));
+}
+//# sourceMappingURL=session-id-signal.js.map

package/dist/esm/models/session-id-signal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-id-signal.js","sourceRoot":"","sources":["../../../src/models/session-id-signal.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC,MAAM,CAAN,IAAY,MAGX;AAHD,WAAY,MAAM;IAChB,2BAAiB,CAAA;IACjB,6BAAmB,CAAA;AACrB,CAAC,EAHW,MAAM,KAAN,MAAM,QAGjB;AAUD,gBAAgB;AAChB,MAAM,CAAC,MAAM,qBAAqB,GAAiC,CAAC,CAAC,IAAI,CACvE,MAAM,CACP,CAAC;AAQF,gBAAgB;AAChB,MAAM,CAAC,MAAM,8BAA8B,GAGvC,CAAC,CAAC,MAAM,CAAC;IACX,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,qBAAqB;CAC9B,CAAC,CAAC;AAEH,MAAM,UAAU,qBAAqB,CACnC,eAAgC;IAEhC,OAAO,IAAI,CAAC,SAAS,CAAC,8BAA8B,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;AAC/E,CAAC"}

package/dist/esm/sdk/provider-configs.d.ts

@@ -34,7 +34,7 @@ export declare class ProviderConfigs extends ClientSDK {
      * Update provider config
      *
      * @remarks
-     * Update an existing provider configuration. If API key is provided, it will be re-encrypted.
+     * Update an existing provider configuration. When the patch replaces the SECRET — the apiKey field, or the catalog-named secret inside credentialFields — the new credential is connection-tested BEFORE it is written, the same guarantee POST /providers makes on create. A failed test writes nothing: the existing configuration, including fields elsewhere in the same request, is left exactly as it was. Non-secret changes (baseUrl, hostedFamily, apiVersion, other credentialFields entries) are applied without a live probe.
      */
     updateProvider(request: operations.UpdateProviderRequest, options?: RequestOptions): Promise<models.ProviderConfig>;
     /**
@@ -48,14 +48,14 @@ export declare class ProviderConfigs extends ClientSDK {
      * Get models catalog
      *
      * @remarks
-     * Returns the union of static known models and declared provider models for a workspace. Used by the optimizer dropdown.
+     * Returns the union of static known models and declared provider models for a workspace.
      */
     getModelsCatalog(options?: RequestOptions): Promise<operations.GetModelsCatalogResponse>;
     /**
      * List a provider configuration models
      *
      * @remarks
-     * The models this provider configuration offers, listed live from the provider and narrowed to the catalog's allow-list policy, with this workspace's per-model enablement applied. When the provider cannot be reached the stored allow-list is returned with `degraded: true` and the reason — an empty list is never presented as 'no models'.
+     * The models this provider configuration offers, listed live from the provider and narrowed to the catalog's allow-list policy, with this workspace's per-model enablement applied. When the provider cannot be reached the stored allow-list is returned with `degraded: true` and the reason — an empty list is never presented as 'no models'. Responses are cached for 60s per (workspace, configuration) and the route is additionally rate-limited, since a cache miss decrypts a credential and calls the live provider.
      */
     listProviderModels(request: operations.ListProviderModelsRequest, options?: RequestOptions): Promise<models.WorkspaceModelListing>;
     /**

package/dist/esm/sdk/provider-configs.js

@@ -53,7 +53,7 @@ export class ProviderConfigs extends ClientSDK {
      * Update provider config
      *
      * @remarks
-     * Update an existing provider configuration. If API key is provided, it will be re-encrypted.
+     * Update an existing provider configuration. When the patch replaces the SECRET — the apiKey field, or the catalog-named secret inside credentialFields — the new credential is connection-tested BEFORE it is written, the same guarantee POST /providers makes on create. A failed test writes nothing: the existing configuration, including fields elsewhere in the same request, is left exactly as it was. Non-secret changes (baseUrl, hostedFamily, apiVersion, other credentialFields entries) are applied without a live probe.
      */
     async updateProvider(request, options) {
         return unwrapAsync(providerConfigsUpdateProvider(this, request, options));
@@ -71,7 +71,7 @@ export class ProviderConfigs extends ClientSDK {
      * Get models catalog
      *
      * @remarks
-     * Returns the union of static known models and declared provider models for a workspace. Used by the optimizer dropdown.
+     * Returns the union of static known models and declared provider models for a workspace.
      */
     async getModelsCatalog(options) {
         return unwrapAsync(providerConfigsGetModelsCatalog(this, options));
@@ -80,7 +80,7 @@ export class ProviderConfigs extends ClientSDK {
      * List a provider configuration models
      *
      * @remarks
-     * The models this provider configuration offers, listed live from the provider and narrowed to the catalog's allow-list policy, with this workspace's per-model enablement applied. When the provider cannot be reached the stored allow-list is returned with `degraded: true` and the reason — an empty list is never presented as 'no models'.
+     * The models this provider configuration offers, listed live from the provider and narrowed to the catalog's allow-list policy, with this workspace's per-model enablement applied. When the provider cannot be reached the stored allow-list is returned with `degraded: true` and the reason — an empty list is never presented as 'no models'. Responses are cached for 60s per (workspace, configuration) and the route is additionally rate-limited, since a cache miss decrypts a credential and calls the live provider.
      */
     async listProviderModels(request, options) {
         return unwrapAsync(providerConfigsListProviderModels(this, request, options));

package/dist/esm/sdk/sandbox.d.ts

@@ -1,27 +1,35 @@
 import { ClientSDK, RequestOptions } from "../lib/sdks.js";
+import * as models from "../models/index.js";
 import * as operations from "../models/operations/index.js";
 export declare class Sandbox extends ClientSDK {
     /**
-     * Spawn a sandbox
+     * List sandbox providers
      *
      * @remarks
-     * Requires an operator token. A session or task token is rejected with 403.
+     * Providers this backend can reach and which is the default. A CLI that has no provider configured uses the default.
      */
-    postApiSandbox(request: operations.PostApiSandboxRequest, options?: RequestOptions): Promise<operations.PostApiSandboxResponse>;
+    getApiSandboxProviders(options?: RequestOptions): Promise<operations.GetApiSandboxProvidersResponse>;
     /**
-     * List sandboxes
+     * Preflight a sandbox definition
      *
      * @remarks
-     * Always tenant-scoped. There is no unscoped listing path.
+     * Validate a definition against a provider without creating anything. Returns every violation, not just the first.
      */
-    getApiSandbox(options?: RequestOptions): Promise<Array<operations.GetApiSandboxResponse>>;
+    postApiSandboxPreflight(request: models.DefinitionProvider, options?: RequestOptions): Promise<operations.PostApiSandboxPreflightResponse>;
+    /**
+     * List sandbox presets
+     *
+     * @remarks
+     * Named definitions a one-shot run can name. A preset is what lets a caller run something without knowing our registry, region or image tag. Image references are deliberately not returned.
+     */
+    getApiSandboxPresets(options?: RequestOptions): Promise<operations.GetApiSandboxPresetsResponse>;
     /**
      * Run one command in a fresh sandbox
      *
      * @remarks
      * Spawns from a preset, runs the command, tears the sandbox down. Requires an operator token — a one-shot run creates a sandbox. 200, not 201: the durable outcome is a result, and the sandbox it names is already gone unless `keep` was set. Blocking, and therefore bounded by the provider invocation timeout — long or interactive runs belong on POST /api/sandbox + /:id/exec.
      */
-    postApiSandboxRun(request: operations.PostApiSandboxRunRequest, options?: RequestOptions): Promise<operations.PostApiSandboxRunResponse>;
+    postApiSandboxRun(request: models.PresetTimeoutMsKeep, options?: RequestOptions): Promise<operations.PostApiSandboxRunResponse>;
     /**
      * Run one agent turn in a fresh sandbox
      *
@@ -30,68 +38,89 @@ export declare class Sandbox extends ClientSDK {
      */
     postApiSandboxAgentRun(request: operations.PostApiSandboxAgentRunRequest, options?: RequestOptions): Promise<operations.PostApiSandboxAgentRunResponse>;
     /**
-     * List sandbox presets
+     * Spawn a sandbox
      *
      * @remarks
-     * Named definitions a one-shot run can name. A preset is what lets a caller run something without knowing our registry, region or image tag. Image references are deliberately not returned.
+     * Requires an operator token. A session or task token is rejected with 403.
      */
-    getApiSandboxPresets(options?: RequestOptions): Promise<operations.GetApiSandboxPresetsResponse>;
+    postApiSandbox(request: models.DefinitionRunId, options?: RequestOptions): Promise<operations.PostApiSandboxResponse>;
     /**
-     * List sandbox providers
+     * List sandboxes
      *
      * @remarks
-     * Providers this backend can reach and which is the default. A CLI that has no provider configured uses the default.
+     * Always tenant-scoped. There is no unscoped listing path.
      */
-    getApiSandboxProviders(options?: RequestOptions): Promise<operations.GetApiSandboxProvidersResponse>;
+    getApiSandbox(options?: RequestOptions): Promise<Array<operations.GetApiSandboxResponse>>;
     /**
-     * Preflight a sandbox definition
+     * Get sandbox status
+     */
+    getApiSandboxById(request: operations.GetApiSandboxByIdRequest, options?: RequestOptions): Promise<operations.GetApiSandboxByIdResponse>;
+    /**
+     * Tear down a sandbox
      *
      * @remarks
-     * Validate a definition against a provider without creating anything. Returns every violation, not just the first.
+     * Idempotent. The record is forgotten even if the provider teardown fails.
      */
-    postApiSandboxPreflight(request: operations.PostApiSandboxPreflightRequest, options?: RequestOptions): Promise<operations.PostApiSandboxPreflightResponse>;
+    deleteApiSandboxById(request: operations.DeleteApiSandboxByIdRequest, options?: RequestOptions): Promise<operations.DeleteApiSandboxByIdResponse>;
     /**
-     * Exchange a platform API key for a sandbox operator token
+     * Watch a sandbox's output live
      *
      * @remarks
-     * Trades a platform API key (`x-api-key: mg_live_…`) for a short-lived operator token scoped to one workspace. The caller must be able to create resources in that workspace.
+     * Server-sent events: `stdout`, `stderr`, `rpc`, `unrecognised`, `status`, `ping` (every 15s), `error`. `rpc` carries one complete NDJSON frame from a Helix session running in RPC mode, verbatim — parse it client-side. `unrecognised` carries a line the backend could not classify; receiving one means this server and the sandbox image disagree about the protocol, and it is forwarded rather than dropped so that drift is visible instead of silent. All four output events share the `{seq, ts, text}` shape and one sequence counter, so their interleaving is the order the box produced them. `seq` is monotonic per sandbox and starts at 1; pass the last one seen as `?since=` to resume. If the buffer has already rolled past `since`, an `error` event names the lost range rather than skipping it silently. Disconnecting tears down the upstream.
      */
-    postApiSandboxToken(request: operations.PostApiSandboxTokenRequest, options?: RequestOptions): Promise<operations.PostApiSandboxTokenResponse>;
+    getApiSandboxByIdStream(request: operations.GetApiSandboxByIdStreamRequest, options?: RequestOptions): Promise<operations.GetApiSandboxByIdStreamResponse>;
     /**
-     * Ingest OTLP spans from inside a sandbox
+     * Run a command in a sandbox
      *
      * @remarks
-     * OTLP/HTTP JSON. Requires a task token; spans are attributed to the sandbox the token is bound to, never to the sandbox named in the payload.
+     * Returns the command's real exit code. A task token is rejected — in-sandbox code reports on itself, it does not drive the box. With `?stream=1` the same result comes back as the event stream of `GET /:id/stream`, scoped to this one invocation and terminated by a `status` event carrying the exit code.
      */
-    postApiSandboxTelemetryV1Traces(options?: RequestOptions): Promise<operations.PostApiSandboxTelemetryV1TracesResponse>;
+    postApiSandboxByIdExec(request: operations.PostApiSandboxByIdExecRequest, options?: RequestOptions): Promise<operations.PostApiSandboxByIdExecResponse>;
     /**
-     * Get sandbox status
+     * Start a Helix session in a sandbox
+     *
+     * @remarks
+     * Returns as soon as the session is running — the run continues in the background and its output arrives on `GET /:id/stream`, not in this response. With `mode: "rpc"` the session is duplex: it emits `rpc` events on the stream and accepts `POST /:id/input`. `mode` defaults to `oneshot`, which is the pre-existing behaviour and has no stdin. A task token is rejected: starting an agent is driving the box.
      */
-    getApiSandboxById(request: operations.GetApiSandboxByIdRequest, options?: RequestOptions): Promise<operations.GetApiSandboxByIdResponse>;
+    postApiSandboxByIdSession(request: operations.PostApiSandboxByIdSessionRequest, options?: RequestOptions): Promise<operations.PostApiSandboxByIdSessionResponse>;
     /**
-     * Tear down a sandbox
+     * List the Helix sessions a sandbox is hosting
      *
      * @remarks
-     * Idempotent. The record is forgotten even if the provider teardown fails.
+     * Ids only — attach to one for detail. `sandbox:read`, unlike the other two session routes: asking which sessions exist is not driving the box.
      */
-    deleteApiSandboxById(request: operations.DeleteApiSandboxByIdRequest, options?: RequestOptions): Promise<operations.DeleteApiSandboxByIdResponse>;
+    getApiSandboxByIdSessions(request: operations.GetApiSandboxByIdSessionsRequest, options?: RequestOptions): Promise<operations.GetApiSandboxByIdSessionsResponse>;
     /**
-     * Run a command in a sandbox
+     * Write one line to a Helix session's stdin
      *
      * @remarks
-     * Returns the command's real exit code. A task token is rejected — in-sandbox code reports on itself, it does not drive the box. With `?stream=1` the same result comes back as the event stream of `GET /:id/stream`, scoped to this one invocation and terminated by a `status` event carrying the exit code.
+     * The write half of the duplex session channel — the read half is the `rpc` events on `GET /:id/stream`. Use it to answer a HITL request or send a follow-up turn to a session started in RPC mode. `line` must be exactly one JSON object with no newline in it: the channel is newline-delimited, so one call carries one command. A 200 means the line reached the session, nothing more — whether the agent accepted it comes back on the stream, asynchronously. 400 if the line is not a single JSON object, 409 if the session is not running.
      */
-    postApiSandboxByIdExec(request: operations.PostApiSandboxByIdExecRequest, options?: RequestOptions): Promise<operations.PostApiSandboxByIdExecResponse>;
+    postApiSandboxByIdInput(request: operations.PostApiSandboxByIdInputRequest, options?: RequestOptions): Promise<operations.PostApiSandboxByIdInputResponse>;
     /**
-     * Watch a sandbox's output live
+     * Stop a running Helix session without destroying its sandbox
+     *
+     * @remarks
+     * The remote equivalent of Ctrl-C on a local agent: the SESSION stops and the box — its filesystem, its other sessions, its event log — stays up. `DELETE /:id` remains the only thing that destroys a sandbox. Distinct from sending an `abort` command via `POST /:id/input`, which politely asks a cooperating agent to end its turn and only works while it is still reading stdin; a signal reaches a process that has stopped listening. 200 means the signal was delivered to a LIVE process, never merely that the request was well-formed. 409 if the session has already ended, 404 if the box has never heard of it.
+     */
+    postApiSandboxByIdSignal(request: operations.PostApiSandboxByIdSignalRequest, options?: RequestOptions): Promise<operations.PostApiSandboxByIdSignalResponse>;
+    /**
+     * Ingest OTLP spans from inside a sandbox
      *
      * @remarks
-     * Server-sent events: `stdout`, `stderr`, `status`, `ping` (every 15s), `error`. `seq` is monotonic per sandbox and starts at 1; pass the last one seen as `?since=` to resume. If the buffer has already rolled past `since`, an `error` event names the lost range rather than skipping it silently. Disconnecting tears down the upstream.
+     * OTLP/HTTP JSON. Requires a task token; spans are attributed to the sandbox the token is bound to, never to the sandbox named in the payload.
      */
-    getApiSandboxByIdStream(request: operations.GetApiSandboxByIdStreamRequest, options?: RequestOptions): Promise<void>;
+    postApiSandboxTelemetryV1Traces(options?: RequestOptions): Promise<operations.PostApiSandboxTelemetryV1TracesResponse>;
     /**
      * Read a sandbox's captured spans
      */
     getApiSandboxByIdTraces(request: operations.GetApiSandboxByIdTracesRequest, options?: RequestOptions): Promise<operations.GetApiSandboxByIdTracesResponse>;
+    /**
+     * Exchange a platform API key for a sandbox operator token
+     *
+     * @remarks
+     * Trades a platform API key (`x-api-key: mg_live_…`) for a short-lived operator token scoped to one workspace. The caller must be able to create resources in that workspace.
+     */
+    postApiSandboxToken(request: operations.PostApiSandboxTokenRequest, options?: RequestOptions): Promise<operations.PostApiSandboxTokenResponse>;
 }
 //# sourceMappingURL=sandbox.d.ts.map

package/dist/esm/sdk/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../src/sdk/sandbox.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAG5D,qBAAa,OAAQ,SAAQ,SAAS;IACpC;;;;;OAKG;IACG,cAAc,CAClB,OAAO,EAAE,UAAU,CAAC,qBAAqB,EACzC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC;IAQ7C;;;;;OAKG;IACG,aAAa,CACjB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAOnD;;;;;OAKG;IACG,iBAAiB,CACrB,OAAO,EAAE,UAAU,CAAC,wBAAwB,EAC5C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC;IAQhD;;;;;OAKG;IACG,sBAAsB,CAC1B,OAAO,EAAE,UAAU,CAAC,6BAA6B,EACjD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC;IAQrD;;;;;OAKG;IACG,oBAAoB,CACxB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,4BAA4B,CAAC;IAOnD;;;;;OAKG;IACG,sBAAsB,CAC1B,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC;IAOrD;;;;;OAKG;IACG,uBAAuB,CAC3B,OAAO,EAAE,UAAU,CAAC,8BAA8B,EAClD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,+BAA+B,CAAC;IAQtD;;;;;OAKG;IACG,mBAAmB,CACvB,OAAO,EAAE,UAAU,CAAC,0BAA0B,EAC9C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC;IAQlD;;;;;OAKG;IACG,+BAA+B,CACnC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,uCAAuC,CAAC;IAO9D;;OAEG;IACG,iBAAiB,CACrB,OAAO,EAAE,UAAU,CAAC,wBAAwB,EAC5C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC;IAQhD;;;;;OAKG;IACG,oBAAoB,CACxB,OAAO,EAAE,UAAU,CAAC,2BAA2B,EAC/C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,4BAA4B,CAAC;IAQnD;;;;;OAKG;IACG,sBAAsB,CAC1B,OAAO,EAAE,UAAU,CAAC,6BAA6B,EACjD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC;IAQrD;;;;;OAKG;IACG,uBAAuB,CAC3B,OAAO,EAAE,UAAU,CAAC,8BAA8B,EAClD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,IAAI,CAAC;IAQhB;;OAEG;IACG,uBAAuB,CAC3B,OAAO,EAAE,UAAU,CAAC,8BAA8B,EAClD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,+BAA+B,CAAC;CAOvD"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../src/sdk/sandbox.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,MAAM,MAAM,oBAAoB,CAAC;AAC7C,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAG5D,qBAAa,OAAQ,SAAQ,SAAS;IACpC;;;;;OAKG;IACG,sBAAsB,CAC1B,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC;IAOrD;;;;;OAKG;IACG,uBAAuB,CAC3B,OAAO,EAAE,MAAM,CAAC,kBAAkB,EAClC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,+BAA+B,CAAC;IAQtD;;;;;OAKG;IACG,oBAAoB,CACxB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,4BAA4B,CAAC;IAOnD;;;;;OAKG;IACG,iBAAiB,CACrB,OAAO,EAAE,MAAM,CAAC,mBAAmB,EACnC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC;IAQhD;;;;;OAKG;IACG,sBAAsB,CAC1B,OAAO,EAAE,UAAU,CAAC,6BAA6B,EACjD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC;IAQrD;;;;;OAKG;IACG,cAAc,CAClB,OAAO,EAAE,MAAM,CAAC,eAAe,EAC/B,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC;IAQ7C;;;;;OAKG;IACG,aAAa,CACjB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAOnD;;OAEG;IACG,iBAAiB,CACrB,OAAO,EAAE,UAAU,CAAC,wBAAwB,EAC5C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC;IAQhD;;;;;OAKG;IACG,oBAAoB,CACxB,OAAO,EAAE,UAAU,CAAC,2BAA2B,EAC/C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,4BAA4B,CAAC;IAQnD;;;;;OAKG;IACG,uBAAuB,CAC3B,OAAO,EAAE,UAAU,CAAC,8BAA8B,EAClD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,+BAA+B,CAAC;IAQtD;;;;;OAKG;IACG,sBAAsB,CAC1B,OAAO,EAAE,UAAU,CAAC,6BAA6B,EACjD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC;IAQrD;;;;;OAKG;IACG,yBAAyB,CAC7B,OAAO,EAAE,UAAU,CAAC,gCAAgC,EACpD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,iCAAiC,CAAC;IAQxD;;;;;OAKG;IACG,yBAAyB,CAC7B,OAAO,EAAE,UAAU,CAAC,gCAAgC,EACpD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,iCAAiC,CAAC;IAQxD;;;;;OAKG;IACG,uBAAuB,CAC3B,OAAO,EAAE,UAAU,CAAC,8BAA8B,EAClD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,+BAA+B,CAAC;IAQtD;;;;;OAKG;IACG,wBAAwB,CAC5B,OAAO,EAAE,UAAU,CAAC,+BAA+B,EACnD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,gCAAgC,CAAC;IAQvD;;;;;OAKG;IACG,+BAA+B,CACnC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,uCAAuC,CAAC;IAO9D;;OAEG;IACG,uBAAuB,CAC3B,OAAO,EAAE,UAAU,CAAC,8BAA8B,EAClD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,+BAA+B,CAAC;IAQtD;;;;;OAKG;IACG,mBAAmB,CACvB,OAAO,EAAE,UAAU,CAAC,0BAA0B,EAC9C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC;CAOnD"}

package/dist/esm/sdk/sandbox.js

@@ -2,6 +2,7 @@
  * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
  */
 import { sandboxDeleteApiSandboxById } from "../funcs/sandbox-delete-api-sandbox-by-id.js";
+import { sandboxGetApiSandboxByIdSessions } from "../funcs/sandbox-get-api-sandbox-by-id-sessions.js";
 import { sandboxGetApiSandboxByIdStream } from "../funcs/sandbox-get-api-sandbox-by-id-stream.js";
 import { sandboxGetApiSandboxByIdTraces } from "../funcs/sandbox-get-api-sandbox-by-id-traces.js";
 import { sandboxGetApiSandboxById } from "../funcs/sandbox-get-api-sandbox-by-id.js";
@@ -10,6 +11,9 @@ import { sandboxGetApiSandboxProviders } from "../funcs/sandbox-get-api-sandbox-
 import { sandboxGetApiSandbox } from "../funcs/sandbox-get-api-sandbox.js";
 import { sandboxPostApiSandboxAgentRun } from "../funcs/sandbox-post-api-sandbox-agent-run.js";
 import { sandboxPostApiSandboxByIdExec } from "../funcs/sandbox-post-api-sandbox-by-id-exec.js";
+import { sandboxPostApiSandboxByIdInput } from "../funcs/sandbox-post-api-sandbox-by-id-input.js";
+import { sandboxPostApiSandboxByIdSession } from "../funcs/sandbox-post-api-sandbox-by-id-session.js";
+import { sandboxPostApiSandboxByIdSignal } from "../funcs/sandbox-post-api-sandbox-by-id-signal.js";
 import { sandboxPostApiSandboxPreflight } from "../funcs/sandbox-post-api-sandbox-preflight.js";
 import { sandboxPostApiSandboxRun } from "../funcs/sandbox-post-api-sandbox-run.js";
 import { sandboxPostApiSandboxTelemetryV1Traces } from "../funcs/sandbox-post-api-sandbox-telemetry-v1-traces.js";
@@ -19,22 +23,31 @@ import { ClientSDK } from "../lib/sdks.js";
 import { unwrapAsync } from "../types/fp.js";
 export class Sandbox extends ClientSDK {
     /**
-     * Spawn a sandbox
+     * List sandbox providers
      *
      * @remarks
-     * Requires an operator token. A session or task token is rejected with 403.
+     * Providers this backend can reach and which is the default. A CLI that has no provider configured uses the default.
      */
-    async postApiSandbox(request, options) {
-        return unwrapAsync(sandboxPostApiSandbox(this, request, options));
+    async getApiSandboxProviders(options) {
+        return unwrapAsync(sandboxGetApiSandboxProviders(this, options));
     }
     /**
-     * List sandboxes
+     * Preflight a sandbox definition
      *
      * @remarks
-     * Always tenant-scoped. There is no unscoped listing path.
+     * Validate a definition against a provider without creating anything. Returns every violation, not just the first.
      */
-    async getApiSandbox(options) {
-        return unwrapAsync(sandboxGetApiSandbox(this, options));
+    async postApiSandboxPreflight(request, options) {
+        return unwrapAsync(sandboxPostApiSandboxPreflight(this, request, options));
+    }
+    /**
+     * List sandbox presets
+     *
+     * @remarks
+     * Named definitions a one-shot run can name. A preset is what lets a caller run something without knowing our registry, region or image tag. Image references are deliberately not returned.
+     */
+    async getApiSandboxPresets(options) {
+        return unwrapAsync(sandboxGetApiSandboxPresets(this, options));
     }
     /**
      * Run one command in a fresh sandbox
@@ -55,82 +68,100 @@ export class Sandbox extends ClientSDK {
         return unwrapAsync(sandboxPostApiSandboxAgentRun(this, request, options));
     }
     /**
-     * List sandbox presets
+     * Spawn a sandbox
      *
      * @remarks
-     * Named definitions a one-shot run can name. A preset is what lets a caller run something without knowing our registry, region or image tag. Image references are deliberately not returned.
+     * Requires an operator token. A session or task token is rejected with 403.
      */
-    async getApiSandboxPresets(options) {
-        return unwrapAsync(sandboxGetApiSandboxPresets(this, options));
+    async postApiSandbox(request, options) {
+        return unwrapAsync(sandboxPostApiSandbox(this, request, options));
     }
     /**
-     * List sandbox providers
+     * List sandboxes
      *
      * @remarks
-     * Providers this backend can reach and which is the default. A CLI that has no provider configured uses the default.
+     * Always tenant-scoped. There is no unscoped listing path.
      */
-    async getApiSandboxProviders(options) {
-        return unwrapAsync(sandboxGetApiSandboxProviders(this, options));
+    async getApiSandbox(options) {
+        return unwrapAsync(sandboxGetApiSandbox(this, options));
     }
     /**
-     * Preflight a sandbox definition
+     * Get sandbox status
+     */
+    async getApiSandboxById(request, options) {
+        return unwrapAsync(sandboxGetApiSandboxById(this, request, options));
+    }
+    /**
+     * Tear down a sandbox
      *
      * @remarks
-     * Validate a definition against a provider without creating anything. Returns every violation, not just the first.
+     * Idempotent. The record is forgotten even if the provider teardown fails.
      */
-    async postApiSandboxPreflight(request, options) {
-        return unwrapAsync(sandboxPostApiSandboxPreflight(this, request, options));
+    async deleteApiSandboxById(request, options) {
+        return unwrapAsync(sandboxDeleteApiSandboxById(this, request, options));
     }
     /**
-     * Exchange a platform API key for a sandbox operator token
+     * Watch a sandbox's output live
      *
      * @remarks
-     * Trades a platform API key (`x-api-key: mg_live_…`) for a short-lived operator token scoped to one workspace. The caller must be able to create resources in that workspace.
+     * Server-sent events: `stdout`, `stderr`, `rpc`, `unrecognised`, `status`, `ping` (every 15s), `error`. `rpc` carries one complete NDJSON frame from a Helix session running in RPC mode, verbatim — parse it client-side. `unrecognised` carries a line the backend could not classify; receiving one means this server and the sandbox image disagree about the protocol, and it is forwarded rather than dropped so that drift is visible instead of silent. All four output events share the `{seq, ts, text}` shape and one sequence counter, so their interleaving is the order the box produced them. `seq` is monotonic per sandbox and starts at 1; pass the last one seen as `?since=` to resume. If the buffer has already rolled past `since`, an `error` event names the lost range rather than skipping it silently. Disconnecting tears down the upstream.
      */
-    async postApiSandboxToken(request, options) {
-        return unwrapAsync(sandboxPostApiSandboxToken(this, request, options));
+    async getApiSandboxByIdStream(request, options) {
+        return unwrapAsync(sandboxGetApiSandboxByIdStream(this, request, options));
     }
     /**
-     * Ingest OTLP spans from inside a sandbox
+     * Run a command in a sandbox
      *
      * @remarks
-     * OTLP/HTTP JSON. Requires a task token; spans are attributed to the sandbox the token is bound to, never to the sandbox named in the payload.
+     * Returns the command's real exit code. A task token is rejected — in-sandbox code reports on itself, it does not drive the box. With `?stream=1` the same result comes back as the event stream of `GET /:id/stream`, scoped to this one invocation and terminated by a `status` event carrying the exit code.
      */
-    async postApiSandboxTelemetryV1Traces(options) {
-        return unwrapAsync(sandboxPostApiSandboxTelemetryV1Traces(this, options));
+    async postApiSandboxByIdExec(request, options) {
+        return unwrapAsync(sandboxPostApiSandboxByIdExec(this, request, options));
     }
     /**
-     * Get sandbox status
+     * Start a Helix session in a sandbox
+     *
+     * @remarks
+     * Returns as soon as the session is running — the run continues in the background and its output arrives on `GET /:id/stream`, not in this response. With `mode: "rpc"` the session is duplex: it emits `rpc` events on the stream and accepts `POST /:id/input`. `mode` defaults to `oneshot`, which is the pre-existing behaviour and has no stdin. A task token is rejected: starting an agent is driving the box.
      */
-    async getApiSandboxById(request, options) {
-        return unwrapAsync(sandboxGetApiSandboxById(this, request, options));
+    async postApiSandboxByIdSession(request, options) {
+        return unwrapAsync(sandboxPostApiSandboxByIdSession(this, request, options));
     }
     /**
-     * Tear down a sandbox
+     * List the Helix sessions a sandbox is hosting
      *
      * @remarks
-     * Idempotent. The record is forgotten even if the provider teardown fails.
+     * Ids only — attach to one for detail. `sandbox:read`, unlike the other two session routes: asking which sessions exist is not driving the box.
      */
-    async deleteApiSandboxById(request, options) {
-        return unwrapAsync(sandboxDeleteApiSandboxById(this, request, options));
+    async getApiSandboxByIdSessions(request, options) {
+        return unwrapAsync(sandboxGetApiSandboxByIdSessions(this, request, options));
     }
     /**
-     * Run a command in a sandbox
+     * Write one line to a Helix session's stdin
      *
      * @remarks
-     * Returns the command's real exit code. A task token is rejected — in-sandbox code reports on itself, it does not drive the box. With `?stream=1` the same result comes back as the event stream of `GET /:id/stream`, scoped to this one invocation and terminated by a `status` event carrying the exit code.
+     * The write half of the duplex session channel — the read half is the `rpc` events on `GET /:id/stream`. Use it to answer a HITL request or send a follow-up turn to a session started in RPC mode. `line` must be exactly one JSON object with no newline in it: the channel is newline-delimited, so one call carries one command. A 200 means the line reached the session, nothing more — whether the agent accepted it comes back on the stream, asynchronously. 400 if the line is not a single JSON object, 409 if the session is not running.
      */
-    async postApiSandboxByIdExec(request, options) {
-        return unwrapAsync(sandboxPostApiSandboxByIdExec(this, request, options));
+    async postApiSandboxByIdInput(request, options) {
+        return unwrapAsync(sandboxPostApiSandboxByIdInput(this, request, options));
     }
     /**
-     * Watch a sandbox's output live
+     * Stop a running Helix session without destroying its sandbox
      *
      * @remarks
-     * Server-sent events: `stdout`, `stderr`, `status`, `ping` (every 15s), `error`. `seq` is monotonic per sandbox and starts at 1; pass the last one seen as `?since=` to resume. If the buffer has already rolled past `since`, an `error` event names the lost range rather than skipping it silently. Disconnecting tears down the upstream.
+     * The remote equivalent of Ctrl-C on a local agent: the SESSION stops and the box — its filesystem, its other sessions, its event log — stays up. `DELETE /:id` remains the only thing that destroys a sandbox. Distinct from sending an `abort` command via `POST /:id/input`, which politely asks a cooperating agent to end its turn and only works while it is still reading stdin; a signal reaches a process that has stopped listening. 200 means the signal was delivered to a LIVE process, never merely that the request was well-formed. 409 if the session has already ended, 404 if the box has never heard of it.
      */
-    async getApiSandboxByIdStream(request, options) {
-        return unwrapAsync(sandboxGetApiSandboxByIdStream(this, request, options));
+    async postApiSandboxByIdSignal(request, options) {
+        return unwrapAsync(sandboxPostApiSandboxByIdSignal(this, request, options));
+    }
+    /**
+     * Ingest OTLP spans from inside a sandbox
+     *
+     * @remarks
+     * OTLP/HTTP JSON. Requires a task token; spans are attributed to the sandbox the token is bound to, never to the sandbox named in the payload.
+     */
+    async postApiSandboxTelemetryV1Traces(options) {
+        return unwrapAsync(sandboxPostApiSandboxTelemetryV1Traces(this, options));
     }
     /**
      * Read a sandbox's captured spans
@@ -138,5 +169,14 @@ export class Sandbox extends ClientSDK {
     async getApiSandboxByIdTraces(request, options) {
         return unwrapAsync(sandboxGetApiSandboxByIdTraces(this, request, options));
     }
+    /**
+     * Exchange a platform API key for a sandbox operator token
+     *
+     * @remarks
+     * Trades a platform API key (`x-api-key: mg_live_…`) for a short-lived operator token scoped to one workspace. The caller must be able to create resources in that workspace.
+     */
+    async postApiSandboxToken(request, options) {
+        return unwrapAsync(sandboxPostApiSandboxToken(this, request, options));
+    }
 }
 //# sourceMappingURL=sandbox.js.map