@mutagent/sdk 0.3.37 → 0.3.38

package/dist/commonjs/models/session-id-line.js

@@ -0,0 +1,50 @@
+"use strict";
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionIdLine$outboundSchema = void 0;
+exports.sessionIdLineToJSON = sessionIdLineToJSON;
+const z = __importStar(require("zod/v4-mini"));
+/** @internal */
+exports.SessionIdLine$outboundSchema = z.object({
+    sessionId: z.string(),
+    line: z.string(),
+});
+function sessionIdLineToJSON(sessionIdLine) {
+    return JSON.stringify(exports.SessionIdLine$outboundSchema.parse(sessionIdLine));
+}
+//# sourceMappingURL=session-id-line.js.map

package/dist/commonjs/models/session-id-line.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-id-line.js","sourceRoot":"","sources":["../../../src/models/session-id-line.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BH,kDAEC;AA9BD,+CAAiC;AAmBjC,gBAAgB;AACH,QAAA,4BAA4B,GAGrC,CAAC,CAAC,MAAM,CAAC;IACX,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;CACjB,CAAC,CAAC;AAEH,SAAgB,mBAAmB,CAAC,aAA4B;IAC9D,OAAO,IAAI,CAAC,SAAS,CAAC,oCAA4B,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;AAC3E,CAAC"}

package/dist/commonjs/models/session-id-signal.d.ts

@@ -0,0 +1,23 @@
+import * as z from "zod/v4-mini";
+export declare enum Signal {
+    Sigint = "SIGINT",
+    Sigterm = "SIGTERM"
+}
+export type SessionIdSignal = {
+    /**
+     * The Helix session to signal — from the `start` that created it.
+     */
+    sessionId: string;
+    signal: Signal;
+};
+/** @internal */
+export declare const Signal$outboundSchema: z.ZodMiniEnum<typeof Signal>;
+/** @internal */
+export type SessionIdSignal$Outbound = {
+    sessionId: string;
+    signal: string;
+};
+/** @internal */
+export declare const SessionIdSignal$outboundSchema: z.ZodMiniType<SessionIdSignal$Outbound, SessionIdSignal>;
+export declare function sessionIdSignalToJSON(sessionIdSignal: SessionIdSignal): string;
+//# sourceMappingURL=session-id-signal.d.ts.map

package/dist/commonjs/models/session-id-signal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-id-signal.d.ts","sourceRoot":"","sources":["../../../src/models/session-id-signal.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC,oBAAY,MAAM;IAChB,MAAM,WAAW;IACjB,OAAO,YAAY;CACpB;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,qBAAqB,EAAE,CAAC,CAAC,WAAW,CAAC,OAAO,MAAM,CAE9D,CAAC;AAEF,gBAAgB;AAChB,MAAM,MAAM,wBAAwB,GAAG;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,8BAA8B,EAAE,CAAC,CAAC,WAAW,CACxD,wBAAwB,EACxB,eAAe,CAIf,CAAC;AAEH,wBAAgB,qBAAqB,CACnC,eAAe,EAAE,eAAe,GAC/B,MAAM,CAER"}

package/dist/commonjs/models/session-id-signal.js

@@ -0,0 +1,57 @@
+"use strict";
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionIdSignal$outboundSchema = exports.Signal$outboundSchema = exports.Signal = void 0;
+exports.sessionIdSignalToJSON = sessionIdSignalToJSON;
+const z = __importStar(require("zod/v4-mini"));
+var Signal;
+(function (Signal) {
+    Signal["Sigint"] = "SIGINT";
+    Signal["Sigterm"] = "SIGTERM";
+})(Signal || (exports.Signal = Signal = {}));
+/** @internal */
+exports.Signal$outboundSchema = z.enum(Signal);
+/** @internal */
+exports.SessionIdSignal$outboundSchema = z.object({
+    sessionId: z.string(),
+    signal: exports.Signal$outboundSchema,
+});
+function sessionIdSignalToJSON(sessionIdSignal) {
+    return JSON.stringify(exports.SessionIdSignal$outboundSchema.parse(sessionIdSignal));
+}
+//# sourceMappingURL=session-id-signal.js.map

package/dist/commonjs/models/session-id-signal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-id-signal.js","sourceRoot":"","sources":["../../../src/models/session-id-signal.ts"],"names":[],"mappings":";AAAA;;GAEG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqCH,sDAIC;AAvCD,+CAAiC;AAEjC,IAAY,MAGX;AAHD,WAAY,MAAM;IAChB,2BAAiB,CAAA;IACjB,6BAAmB,CAAA;AACrB,CAAC,EAHW,MAAM,sBAAN,MAAM,QAGjB;AAUD,gBAAgB;AACH,QAAA,qBAAqB,GAAiC,CAAC,CAAC,IAAI,CACvE,MAAM,CACP,CAAC;AAQF,gBAAgB;AACH,QAAA,8BAA8B,GAGvC,CAAC,CAAC,MAAM,CAAC;IACX,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,MAAM,EAAE,6BAAqB;CAC9B,CAAC,CAAC;AAEH,SAAgB,qBAAqB,CACnC,eAAgC;IAEhC,OAAO,IAAI,CAAC,SAAS,CAAC,sCAA8B,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;AAC/E,CAAC"}

package/dist/commonjs/sdk/provider-configs.d.ts

@@ -34,7 +34,7 @@ export declare class ProviderConfigs extends ClientSDK {
      * Update provider config
      *
      * @remarks
-     * Update an existing provider configuration. If API key is provided, it will be re-encrypted.
+     * Update an existing provider configuration. When the patch replaces the SECRET — the apiKey field, or the catalog-named secret inside credentialFields — the new credential is connection-tested BEFORE it is written, the same guarantee POST /providers makes on create. A failed test writes nothing: the existing configuration, including fields elsewhere in the same request, is left exactly as it was. Non-secret changes (baseUrl, hostedFamily, apiVersion, other credentialFields entries) are applied without a live probe.
      */
     updateProvider(request: operations.UpdateProviderRequest, options?: RequestOptions): Promise<models.ProviderConfig>;
     /**
@@ -48,14 +48,14 @@ export declare class ProviderConfigs extends ClientSDK {
      * Get models catalog
      *
      * @remarks
-     * Returns the union of static known models and declared provider models for a workspace. Used by the optimizer dropdown.
+     * Returns the union of static known models and declared provider models for a workspace.
      */
     getModelsCatalog(options?: RequestOptions): Promise<operations.GetModelsCatalogResponse>;
     /**
      * List a provider configuration models
      *
      * @remarks
-     * The models this provider configuration offers, listed live from the provider and narrowed to the catalog's allow-list policy, with this workspace's per-model enablement applied. When the provider cannot be reached the stored allow-list is returned with `degraded: true` and the reason — an empty list is never presented as 'no models'.
+     * The models this provider configuration offers, listed live from the provider and narrowed to the catalog's allow-list policy, with this workspace's per-model enablement applied. When the provider cannot be reached the stored allow-list is returned with `degraded: true` and the reason — an empty list is never presented as 'no models'. Responses are cached for 60s per (workspace, configuration) and the route is additionally rate-limited, since a cache miss decrypts a credential and calls the live provider.
      */
     listProviderModels(request: operations.ListProviderModelsRequest, options?: RequestOptions): Promise<models.WorkspaceModelListing>;
     /**

package/dist/commonjs/sdk/provider-configs.js

@@ -56,7 +56,7 @@ class ProviderConfigs extends sdks_js_1.ClientSDK {
      * Update provider config
      *
      * @remarks
-     * Update an existing provider configuration. If API key is provided, it will be re-encrypted.
+     * Update an existing provider configuration. When the patch replaces the SECRET — the apiKey field, or the catalog-named secret inside credentialFields — the new credential is connection-tested BEFORE it is written, the same guarantee POST /providers makes on create. A failed test writes nothing: the existing configuration, including fields elsewhere in the same request, is left exactly as it was. Non-secret changes (baseUrl, hostedFamily, apiVersion, other credentialFields entries) are applied without a live probe.
      */
     async updateProvider(request, options) {
         return (0, fp_js_1.unwrapAsync)((0, provider_configs_update_provider_js_1.providerConfigsUpdateProvider)(this, request, options));
@@ -74,7 +74,7 @@ class ProviderConfigs extends sdks_js_1.ClientSDK {
      * Get models catalog
      *
      * @remarks
-     * Returns the union of static known models and declared provider models for a workspace. Used by the optimizer dropdown.
+     * Returns the union of static known models and declared provider models for a workspace.
      */
     async getModelsCatalog(options) {
         return (0, fp_js_1.unwrapAsync)((0, provider_configs_get_models_catalog_js_1.providerConfigsGetModelsCatalog)(this, options));
@@ -83,7 +83,7 @@ class ProviderConfigs extends sdks_js_1.ClientSDK {
      * List a provider configuration models
      *
      * @remarks
-     * The models this provider configuration offers, listed live from the provider and narrowed to the catalog's allow-list policy, with this workspace's per-model enablement applied. When the provider cannot be reached the stored allow-list is returned with `degraded: true` and the reason — an empty list is never presented as 'no models'.
+     * The models this provider configuration offers, listed live from the provider and narrowed to the catalog's allow-list policy, with this workspace's per-model enablement applied. When the provider cannot be reached the stored allow-list is returned with `degraded: true` and the reason — an empty list is never presented as 'no models'. Responses are cached for 60s per (workspace, configuration) and the route is additionally rate-limited, since a cache miss decrypts a credential and calls the live provider.
      */
     async listProviderModels(request, options) {
         return (0, fp_js_1.unwrapAsync)((0, provider_configs_list_provider_models_js_1.providerConfigsListProviderModels)(this, request, options));

package/dist/commonjs/sdk/sandbox.d.ts

@@ -1,27 +1,35 @@
 import { ClientSDK, RequestOptions } from "../lib/sdks.js";
+import * as models from "../models/index.js";
 import * as operations from "../models/operations/index.js";
 export declare class Sandbox extends ClientSDK {
     /**
-     * Spawn a sandbox
+     * List sandbox providers
      *
      * @remarks
-     * Requires an operator token. A session or task token is rejected with 403.
+     * Providers this backend can reach and which is the default. A CLI that has no provider configured uses the default.
      */
-    postApiSandbox(request: operations.PostApiSandboxRequest, options?: RequestOptions): Promise<operations.PostApiSandboxResponse>;
+    getApiSandboxProviders(options?: RequestOptions): Promise<operations.GetApiSandboxProvidersResponse>;
     /**
-     * List sandboxes
+     * Preflight a sandbox definition
      *
      * @remarks
-     * Always tenant-scoped. There is no unscoped listing path.
+     * Validate a definition against a provider without creating anything. Returns every violation, not just the first.
      */
-    getApiSandbox(options?: RequestOptions): Promise<Array<operations.GetApiSandboxResponse>>;
+    postApiSandboxPreflight(request: models.DefinitionProvider, options?: RequestOptions): Promise<operations.PostApiSandboxPreflightResponse>;
+    /**
+     * List sandbox presets
+     *
+     * @remarks
+     * Named definitions a one-shot run can name. A preset is what lets a caller run something without knowing our registry, region or image tag. Image references are deliberately not returned.
+     */
+    getApiSandboxPresets(options?: RequestOptions): Promise<operations.GetApiSandboxPresetsResponse>;
     /**
      * Run one command in a fresh sandbox
      *
      * @remarks
      * Spawns from a preset, runs the command, tears the sandbox down. Requires an operator token — a one-shot run creates a sandbox. 200, not 201: the durable outcome is a result, and the sandbox it names is already gone unless `keep` was set. Blocking, and therefore bounded by the provider invocation timeout — long or interactive runs belong on POST /api/sandbox + /:id/exec.
      */
-    postApiSandboxRun(request: operations.PostApiSandboxRunRequest, options?: RequestOptions): Promise<operations.PostApiSandboxRunResponse>;
+    postApiSandboxRun(request: models.PresetTimeoutMsKeep, options?: RequestOptions): Promise<operations.PostApiSandboxRunResponse>;
     /**
      * Run one agent turn in a fresh sandbox
      *
@@ -30,68 +38,89 @@ export declare class Sandbox extends ClientSDK {
      */
     postApiSandboxAgentRun(request: operations.PostApiSandboxAgentRunRequest, options?: RequestOptions): Promise<operations.PostApiSandboxAgentRunResponse>;
     /**
-     * List sandbox presets
+     * Spawn a sandbox
      *
      * @remarks
-     * Named definitions a one-shot run can name. A preset is what lets a caller run something without knowing our registry, region or image tag. Image references are deliberately not returned.
+     * Requires an operator token. A session or task token is rejected with 403.
      */
-    getApiSandboxPresets(options?: RequestOptions): Promise<operations.GetApiSandboxPresetsResponse>;
+    postApiSandbox(request: models.DefinitionRunId, options?: RequestOptions): Promise<operations.PostApiSandboxResponse>;
     /**
-     * List sandbox providers
+     * List sandboxes
      *
      * @remarks
-     * Providers this backend can reach and which is the default. A CLI that has no provider configured uses the default.
+     * Always tenant-scoped. There is no unscoped listing path.
      */
-    getApiSandboxProviders(options?: RequestOptions): Promise<operations.GetApiSandboxProvidersResponse>;
+    getApiSandbox(options?: RequestOptions): Promise<Array<operations.GetApiSandboxResponse>>;
     /**
-     * Preflight a sandbox definition
+     * Get sandbox status
+     */
+    getApiSandboxById(request: operations.GetApiSandboxByIdRequest, options?: RequestOptions): Promise<operations.GetApiSandboxByIdResponse>;
+    /**
+     * Tear down a sandbox
      *
      * @remarks
-     * Validate a definition against a provider without creating anything. Returns every violation, not just the first.
+     * Idempotent. The record is forgotten even if the provider teardown fails.
      */
-    postApiSandboxPreflight(request: operations.PostApiSandboxPreflightRequest, options?: RequestOptions): Promise<operations.PostApiSandboxPreflightResponse>;
+    deleteApiSandboxById(request: operations.DeleteApiSandboxByIdRequest, options?: RequestOptions): Promise<operations.DeleteApiSandboxByIdResponse>;
     /**
-     * Exchange a platform API key for a sandbox operator token
+     * Watch a sandbox's output live
      *
      * @remarks
-     * Trades a platform API key (`x-api-key: mg_live_…`) for a short-lived operator token scoped to one workspace. The caller must be able to create resources in that workspace.
+     * Server-sent events: `stdout`, `stderr`, `rpc`, `unrecognised`, `status`, `ping` (every 15s), `error`. `rpc` carries one complete NDJSON frame from a Helix session running in RPC mode, verbatim — parse it client-side. `unrecognised` carries a line the backend could not classify; receiving one means this server and the sandbox image disagree about the protocol, and it is forwarded rather than dropped so that drift is visible instead of silent. All four output events share the `{seq, ts, text}` shape and one sequence counter, so their interleaving is the order the box produced them. `seq` is monotonic per sandbox and starts at 1; pass the last one seen as `?since=` to resume. If the buffer has already rolled past `since`, an `error` event names the lost range rather than skipping it silently. Disconnecting tears down the upstream.
      */
-    postApiSandboxToken(request: operations.PostApiSandboxTokenRequest, options?: RequestOptions): Promise<operations.PostApiSandboxTokenResponse>;
+    getApiSandboxByIdStream(request: operations.GetApiSandboxByIdStreamRequest, options?: RequestOptions): Promise<operations.GetApiSandboxByIdStreamResponse>;
     /**
-     * Ingest OTLP spans from inside a sandbox
+     * Run a command in a sandbox
      *
      * @remarks
-     * OTLP/HTTP JSON. Requires a task token; spans are attributed to the sandbox the token is bound to, never to the sandbox named in the payload.
+     * Returns the command's real exit code. A task token is rejected — in-sandbox code reports on itself, it does not drive the box. With `?stream=1` the same result comes back as the event stream of `GET /:id/stream`, scoped to this one invocation and terminated by a `status` event carrying the exit code.
      */
-    postApiSandboxTelemetryV1Traces(options?: RequestOptions): Promise<operations.PostApiSandboxTelemetryV1TracesResponse>;
+    postApiSandboxByIdExec(request: operations.PostApiSandboxByIdExecRequest, options?: RequestOptions): Promise<operations.PostApiSandboxByIdExecResponse>;
     /**
-     * Get sandbox status
+     * Start a Helix session in a sandbox
+     *
+     * @remarks
+     * Returns as soon as the session is running — the run continues in the background and its output arrives on `GET /:id/stream`, not in this response. With `mode: "rpc"` the session is duplex: it emits `rpc` events on the stream and accepts `POST /:id/input`. `mode` defaults to `oneshot`, which is the pre-existing behaviour and has no stdin. A task token is rejected: starting an agent is driving the box.
      */
-    getApiSandboxById(request: operations.GetApiSandboxByIdRequest, options?: RequestOptions): Promise<operations.GetApiSandboxByIdResponse>;
+    postApiSandboxByIdSession(request: operations.PostApiSandboxByIdSessionRequest, options?: RequestOptions): Promise<operations.PostApiSandboxByIdSessionResponse>;
     /**
-     * Tear down a sandbox
+     * List the Helix sessions a sandbox is hosting
      *
      * @remarks
-     * Idempotent. The record is forgotten even if the provider teardown fails.
+     * Ids only — attach to one for detail. `sandbox:read`, unlike the other two session routes: asking which sessions exist is not driving the box.
      */
-    deleteApiSandboxById(request: operations.DeleteApiSandboxByIdRequest, options?: RequestOptions): Promise<operations.DeleteApiSandboxByIdResponse>;
+    getApiSandboxByIdSessions(request: operations.GetApiSandboxByIdSessionsRequest, options?: RequestOptions): Promise<operations.GetApiSandboxByIdSessionsResponse>;
     /**
-     * Run a command in a sandbox
+     * Write one line to a Helix session's stdin
      *
      * @remarks
-     * Returns the command's real exit code. A task token is rejected — in-sandbox code reports on itself, it does not drive the box. With `?stream=1` the same result comes back as the event stream of `GET /:id/stream`, scoped to this one invocation and terminated by a `status` event carrying the exit code.
+     * The write half of the duplex session channel — the read half is the `rpc` events on `GET /:id/stream`. Use it to answer a HITL request or send a follow-up turn to a session started in RPC mode. `line` must be exactly one JSON object with no newline in it: the channel is newline-delimited, so one call carries one command. A 200 means the line reached the session, nothing more — whether the agent accepted it comes back on the stream, asynchronously. 400 if the line is not a single JSON object, 409 if the session is not running.
      */
-    postApiSandboxByIdExec(request: operations.PostApiSandboxByIdExecRequest, options?: RequestOptions): Promise<operations.PostApiSandboxByIdExecResponse>;
+    postApiSandboxByIdInput(request: operations.PostApiSandboxByIdInputRequest, options?: RequestOptions): Promise<operations.PostApiSandboxByIdInputResponse>;
     /**
-     * Watch a sandbox's output live
+     * Stop a running Helix session without destroying its sandbox
+     *
+     * @remarks
+     * The remote equivalent of Ctrl-C on a local agent: the SESSION stops and the box — its filesystem, its other sessions, its event log — stays up. `DELETE /:id` remains the only thing that destroys a sandbox. Distinct from sending an `abort` command via `POST /:id/input`, which politely asks a cooperating agent to end its turn and only works while it is still reading stdin; a signal reaches a process that has stopped listening. 200 means the signal was delivered to a LIVE process, never merely that the request was well-formed. 409 if the session has already ended, 404 if the box has never heard of it.
+     */
+    postApiSandboxByIdSignal(request: operations.PostApiSandboxByIdSignalRequest, options?: RequestOptions): Promise<operations.PostApiSandboxByIdSignalResponse>;
+    /**
+     * Ingest OTLP spans from inside a sandbox
      *
      * @remarks
-     * Server-sent events: `stdout`, `stderr`, `status`, `ping` (every 15s), `error`. `seq` is monotonic per sandbox and starts at 1; pass the last one seen as `?since=` to resume. If the buffer has already rolled past `since`, an `error` event names the lost range rather than skipping it silently. Disconnecting tears down the upstream.
+     * OTLP/HTTP JSON. Requires a task token; spans are attributed to the sandbox the token is bound to, never to the sandbox named in the payload.
      */
-    getApiSandboxByIdStream(request: operations.GetApiSandboxByIdStreamRequest, options?: RequestOptions): Promise<void>;
+    postApiSandboxTelemetryV1Traces(options?: RequestOptions): Promise<operations.PostApiSandboxTelemetryV1TracesResponse>;
     /**
      * Read a sandbox's captured spans
      */
     getApiSandboxByIdTraces(request: operations.GetApiSandboxByIdTracesRequest, options?: RequestOptions): Promise<operations.GetApiSandboxByIdTracesResponse>;
+    /**
+     * Exchange a platform API key for a sandbox operator token
+     *
+     * @remarks
+     * Trades a platform API key (`x-api-key: mg_live_…`) for a short-lived operator token scoped to one workspace. The caller must be able to create resources in that workspace.
+     */
+    postApiSandboxToken(request: operations.PostApiSandboxTokenRequest, options?: RequestOptions): Promise<operations.PostApiSandboxTokenResponse>;
 }
 //# sourceMappingURL=sandbox.d.ts.map

package/dist/commonjs/sdk/sandbox.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../src/sdk/sandbox.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAG5D,qBAAa,OAAQ,SAAQ,SAAS;IACpC;;;;;OAKG;IACG,cAAc,CAClB,OAAO,EAAE,UAAU,CAAC,qBAAqB,EACzC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC;IAQ7C;;;;;OAKG;IACG,aAAa,CACjB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAOnD;;;;;OAKG;IACG,iBAAiB,CACrB,OAAO,EAAE,UAAU,CAAC,wBAAwB,EAC5C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC;IAQhD;;;;;OAKG;IACG,sBAAsB,CAC1B,OAAO,EAAE,UAAU,CAAC,6BAA6B,EACjD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC;IAQrD;;;;;OAKG;IACG,oBAAoB,CACxB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,4BAA4B,CAAC;IAOnD;;;;;OAKG;IACG,sBAAsB,CAC1B,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC;IAOrD;;;;;OAKG;IACG,uBAAuB,CAC3B,OAAO,EAAE,UAAU,CAAC,8BAA8B,EAClD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,+BAA+B,CAAC;IAQtD;;;;;OAKG;IACG,mBAAmB,CACvB,OAAO,EAAE,UAAU,CAAC,0BAA0B,EAC9C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC;IAQlD;;;;;OAKG;IACG,+BAA+B,CACnC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,uCAAuC,CAAC;IAO9D;;OAEG;IACG,iBAAiB,CACrB,OAAO,EAAE,UAAU,CAAC,wBAAwB,EAC5C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC;IAQhD;;;;;OAKG;IACG,oBAAoB,CACxB,OAAO,EAAE,UAAU,CAAC,2BAA2B,EAC/C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,4BAA4B,CAAC;IAQnD;;;;;OAKG;IACG,sBAAsB,CAC1B,OAAO,EAAE,UAAU,CAAC,6BAA6B,EACjD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC;IAQrD;;;;;OAKG;IACG,uBAAuB,CAC3B,OAAO,EAAE,UAAU,CAAC,8BAA8B,EAClD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,IAAI,CAAC;IAQhB;;OAEG;IACG,uBAAuB,CAC3B,OAAO,EAAE,UAAU,CAAC,8BAA8B,EAClD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,+BAA+B,CAAC;CAOvD"}
+{"version":3,"file":"sandbox.d.ts","sourceRoot":"","sources":["../../../src/sdk/sandbox.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,KAAK,MAAM,MAAM,oBAAoB,CAAC;AAC7C,OAAO,KAAK,UAAU,MAAM,+BAA+B,CAAC;AAG5D,qBAAa,OAAQ,SAAQ,SAAS;IACpC;;;;;OAKG;IACG,sBAAsB,CAC1B,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC;IAOrD;;;;;OAKG;IACG,uBAAuB,CAC3B,OAAO,EAAE,MAAM,CAAC,kBAAkB,EAClC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,+BAA+B,CAAC;IAQtD;;;;;OAKG;IACG,oBAAoB,CACxB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,4BAA4B,CAAC;IAOnD;;;;;OAKG;IACG,iBAAiB,CACrB,OAAO,EAAE,MAAM,CAAC,mBAAmB,EACnC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC;IAQhD;;;;;OAKG;IACG,sBAAsB,CAC1B,OAAO,EAAE,UAAU,CAAC,6BAA6B,EACjD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC;IAQrD;;;;;OAKG;IACG,cAAc,CAClB,OAAO,EAAE,MAAM,CAAC,eAAe,EAC/B,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,sBAAsB,CAAC;IAQ7C;;;;;OAKG;IACG,aAAa,CACjB,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC;IAOnD;;OAEG;IACG,iBAAiB,CACrB,OAAO,EAAE,UAAU,CAAC,wBAAwB,EAC5C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,yBAAyB,CAAC;IAQhD;;;;;OAKG;IACG,oBAAoB,CACxB,OAAO,EAAE,UAAU,CAAC,2BAA2B,EAC/C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,4BAA4B,CAAC;IAQnD;;;;;OAKG;IACG,uBAAuB,CAC3B,OAAO,EAAE,UAAU,CAAC,8BAA8B,EAClD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,+BAA+B,CAAC;IAQtD;;;;;OAKG;IACG,sBAAsB,CAC1B,OAAO,EAAE,UAAU,CAAC,6BAA6B,EACjD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,8BAA8B,CAAC;IAQrD;;;;;OAKG;IACG,yBAAyB,CAC7B,OAAO,EAAE,UAAU,CAAC,gCAAgC,EACpD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,iCAAiC,CAAC;IAQxD;;;;;OAKG;IACG,yBAAyB,CAC7B,OAAO,EAAE,UAAU,CAAC,gCAAgC,EACpD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,iCAAiC,CAAC;IAQxD;;;;;OAKG;IACG,uBAAuB,CAC3B,OAAO,EAAE,UAAU,CAAC,8BAA8B,EAClD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,+BAA+B,CAAC;IAQtD;;;;;OAKG;IACG,wBAAwB,CAC5B,OAAO,EAAE,UAAU,CAAC,+BAA+B,EACnD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,gCAAgC,CAAC;IAQvD;;;;;OAKG;IACG,+BAA+B,CACnC,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,uCAAuC,CAAC;IAO9D;;OAEG;IACG,uBAAuB,CAC3B,OAAO,EAAE,UAAU,CAAC,8BAA8B,EAClD,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,+BAA+B,CAAC;IAQtD;;;;;OAKG;IACG,mBAAmB,CACvB,OAAO,EAAE,UAAU,CAAC,0BAA0B,EAC9C,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,UAAU,CAAC,2BAA2B,CAAC;CAOnD"}

package/dist/commonjs/sdk/sandbox.js

@@ -5,6 +5,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Sandbox = void 0;
 const sandbox_delete_api_sandbox_by_id_js_1 = require("../funcs/sandbox-delete-api-sandbox-by-id.js");
+const sandbox_get_api_sandbox_by_id_sessions_js_1 = require("../funcs/sandbox-get-api-sandbox-by-id-sessions.js");
 const sandbox_get_api_sandbox_by_id_stream_js_1 = require("../funcs/sandbox-get-api-sandbox-by-id-stream.js");
 const sandbox_get_api_sandbox_by_id_traces_js_1 = require("../funcs/sandbox-get-api-sandbox-by-id-traces.js");
 const sandbox_get_api_sandbox_by_id_js_1 = require("../funcs/sandbox-get-api-sandbox-by-id.js");
@@ -13,6 +14,9 @@ const sandbox_get_api_sandbox_providers_js_1 = require("../funcs/sandbox-get-api
 const sandbox_get_api_sandbox_js_1 = require("../funcs/sandbox-get-api-sandbox.js");
 const sandbox_post_api_sandbox_agent_run_js_1 = require("../funcs/sandbox-post-api-sandbox-agent-run.js");
 const sandbox_post_api_sandbox_by_id_exec_js_1 = require("../funcs/sandbox-post-api-sandbox-by-id-exec.js");
+const sandbox_post_api_sandbox_by_id_input_js_1 = require("../funcs/sandbox-post-api-sandbox-by-id-input.js");
+const sandbox_post_api_sandbox_by_id_session_js_1 = require("../funcs/sandbox-post-api-sandbox-by-id-session.js");
+const sandbox_post_api_sandbox_by_id_signal_js_1 = require("../funcs/sandbox-post-api-sandbox-by-id-signal.js");
 const sandbox_post_api_sandbox_preflight_js_1 = require("../funcs/sandbox-post-api-sandbox-preflight.js");
 const sandbox_post_api_sandbox_run_js_1 = require("../funcs/sandbox-post-api-sandbox-run.js");
 const sandbox_post_api_sandbox_telemetry_v1_traces_js_1 = require("../funcs/sandbox-post-api-sandbox-telemetry-v1-traces.js");
@@ -22,22 +26,31 @@ const sdks_js_1 = require("../lib/sdks.js");
 const fp_js_1 = require("../types/fp.js");
 class Sandbox extends sdks_js_1.ClientSDK {
     /**
-     * Spawn a sandbox
+     * List sandbox providers
      *
      * @remarks
-     * Requires an operator token. A session or task token is rejected with 403.
+     * Providers this backend can reach and which is the default. A CLI that has no provider configured uses the default.
      */
-    async postApiSandbox(request, options) {
-        return (0, fp_js_1.unwrapAsync)((0, sandbox_post_api_sandbox_js_1.sandboxPostApiSandbox)(this, request, options));
+    async getApiSandboxProviders(options) {
+        return (0, fp_js_1.unwrapAsync)((0, sandbox_get_api_sandbox_providers_js_1.sandboxGetApiSandboxProviders)(this, options));
     }
     /**
-     * List sandboxes
+     * Preflight a sandbox definition
      *
      * @remarks
-     * Always tenant-scoped. There is no unscoped listing path.
+     * Validate a definition against a provider without creating anything. Returns every violation, not just the first.
      */
-    async getApiSandbox(options) {
-        return (0, fp_js_1.unwrapAsync)((0, sandbox_get_api_sandbox_js_1.sandboxGetApiSandbox)(this, options));
+    async postApiSandboxPreflight(request, options) {
+        return (0, fp_js_1.unwrapAsync)((0, sandbox_post_api_sandbox_preflight_js_1.sandboxPostApiSandboxPreflight)(this, request, options));
+    }
+    /**
+     * List sandbox presets
+     *
+     * @remarks
+     * Named definitions a one-shot run can name. A preset is what lets a caller run something without knowing our registry, region or image tag. Image references are deliberately not returned.
+     */
+    async getApiSandboxPresets(options) {
+        return (0, fp_js_1.unwrapAsync)((0, sandbox_get_api_sandbox_presets_js_1.sandboxGetApiSandboxPresets)(this, options));
     }
     /**
      * Run one command in a fresh sandbox
@@ -58,82 +71,100 @@ class Sandbox extends sdks_js_1.ClientSDK {
         return (0, fp_js_1.unwrapAsync)((0, sandbox_post_api_sandbox_agent_run_js_1.sandboxPostApiSandboxAgentRun)(this, request, options));
     }
     /**
-     * List sandbox presets
+     * Spawn a sandbox
      *
      * @remarks
-     * Named definitions a one-shot run can name. A preset is what lets a caller run something without knowing our registry, region or image tag. Image references are deliberately not returned.
+     * Requires an operator token. A session or task token is rejected with 403.
      */
-    async getApiSandboxPresets(options) {
-        return (0, fp_js_1.unwrapAsync)((0, sandbox_get_api_sandbox_presets_js_1.sandboxGetApiSandboxPresets)(this, options));
+    async postApiSandbox(request, options) {
+        return (0, fp_js_1.unwrapAsync)((0, sandbox_post_api_sandbox_js_1.sandboxPostApiSandbox)(this, request, options));
     }
     /**
-     * List sandbox providers
+     * List sandboxes
      *
      * @remarks
-     * Providers this backend can reach and which is the default. A CLI that has no provider configured uses the default.
+     * Always tenant-scoped. There is no unscoped listing path.
      */
-    async getApiSandboxProviders(options) {
-        return (0, fp_js_1.unwrapAsync)((0, sandbox_get_api_sandbox_providers_js_1.sandboxGetApiSandboxProviders)(this, options));
+    async getApiSandbox(options) {
+        return (0, fp_js_1.unwrapAsync)((0, sandbox_get_api_sandbox_js_1.sandboxGetApiSandbox)(this, options));
     }
     /**
-     * Preflight a sandbox definition
+     * Get sandbox status
+     */
+    async getApiSandboxById(request, options) {
+        return (0, fp_js_1.unwrapAsync)((0, sandbox_get_api_sandbox_by_id_js_1.sandboxGetApiSandboxById)(this, request, options));
+    }
+    /**
+     * Tear down a sandbox
      *
      * @remarks
-     * Validate a definition against a provider without creating anything. Returns every violation, not just the first.
+     * Idempotent. The record is forgotten even if the provider teardown fails.
      */
-    async postApiSandboxPreflight(request, options) {
-        return (0, fp_js_1.unwrapAsync)((0, sandbox_post_api_sandbox_preflight_js_1.sandboxPostApiSandboxPreflight)(this, request, options));
+    async deleteApiSandboxById(request, options) {
+        return (0, fp_js_1.unwrapAsync)((0, sandbox_delete_api_sandbox_by_id_js_1.sandboxDeleteApiSandboxById)(this, request, options));
     }
     /**
-     * Exchange a platform API key for a sandbox operator token
+     * Watch a sandbox's output live
      *
      * @remarks
-     * Trades a platform API key (`x-api-key: mg_live_…`) for a short-lived operator token scoped to one workspace. The caller must be able to create resources in that workspace.
+     * Server-sent events: `stdout`, `stderr`, `rpc`, `unrecognised`, `status`, `ping` (every 15s), `error`. `rpc` carries one complete NDJSON frame from a Helix session running in RPC mode, verbatim — parse it client-side. `unrecognised` carries a line the backend could not classify; receiving one means this server and the sandbox image disagree about the protocol, and it is forwarded rather than dropped so that drift is visible instead of silent. All four output events share the `{seq, ts, text}` shape and one sequence counter, so their interleaving is the order the box produced them. `seq` is monotonic per sandbox and starts at 1; pass the last one seen as `?since=` to resume. If the buffer has already rolled past `since`, an `error` event names the lost range rather than skipping it silently. Disconnecting tears down the upstream.
      */
-    async postApiSandboxToken(request, options) {
-        return (0, fp_js_1.unwrapAsync)((0, sandbox_post_api_sandbox_token_js_1.sandboxPostApiSandboxToken)(this, request, options));
+    async getApiSandboxByIdStream(request, options) {
+        return (0, fp_js_1.unwrapAsync)((0, sandbox_get_api_sandbox_by_id_stream_js_1.sandboxGetApiSandboxByIdStream)(this, request, options));
     }
     /**
-     * Ingest OTLP spans from inside a sandbox
+     * Run a command in a sandbox
      *
      * @remarks
-     * OTLP/HTTP JSON. Requires a task token; spans are attributed to the sandbox the token is bound to, never to the sandbox named in the payload.
+     * Returns the command's real exit code. A task token is rejected — in-sandbox code reports on itself, it does not drive the box. With `?stream=1` the same result comes back as the event stream of `GET /:id/stream`, scoped to this one invocation and terminated by a `status` event carrying the exit code.
      */
-    async postApiSandboxTelemetryV1Traces(options) {
-        return (0, fp_js_1.unwrapAsync)((0, sandbox_post_api_sandbox_telemetry_v1_traces_js_1.sandboxPostApiSandboxTelemetryV1Traces)(this, options));
+    async postApiSandboxByIdExec(request, options) {
+        return (0, fp_js_1.unwrapAsync)((0, sandbox_post_api_sandbox_by_id_exec_js_1.sandboxPostApiSandboxByIdExec)(this, request, options));
     }
     /**
-     * Get sandbox status
+     * Start a Helix session in a sandbox
+     *
+     * @remarks
+     * Returns as soon as the session is running — the run continues in the background and its output arrives on `GET /:id/stream`, not in this response. With `mode: "rpc"` the session is duplex: it emits `rpc` events on the stream and accepts `POST /:id/input`. `mode` defaults to `oneshot`, which is the pre-existing behaviour and has no stdin. A task token is rejected: starting an agent is driving the box.
      */
-    async getApiSandboxById(request, options) {
-        return (0, fp_js_1.unwrapAsync)((0, sandbox_get_api_sandbox_by_id_js_1.sandboxGetApiSandboxById)(this, request, options));
+    async postApiSandboxByIdSession(request, options) {
+        return (0, fp_js_1.unwrapAsync)((0, sandbox_post_api_sandbox_by_id_session_js_1.sandboxPostApiSandboxByIdSession)(this, request, options));
     }
     /**
-     * Tear down a sandbox
+     * List the Helix sessions a sandbox is hosting
      *
      * @remarks
-     * Idempotent. The record is forgotten even if the provider teardown fails.
+     * Ids only — attach to one for detail. `sandbox:read`, unlike the other two session routes: asking which sessions exist is not driving the box.
      */
-    async deleteApiSandboxById(request, options) {
-        return (0, fp_js_1.unwrapAsync)((0, sandbox_delete_api_sandbox_by_id_js_1.sandboxDeleteApiSandboxById)(this, request, options));
+    async getApiSandboxByIdSessions(request, options) {
+        return (0, fp_js_1.unwrapAsync)((0, sandbox_get_api_sandbox_by_id_sessions_js_1.sandboxGetApiSandboxByIdSessions)(this, request, options));
     }
     /**
-     * Run a command in a sandbox
+     * Write one line to a Helix session's stdin
      *
      * @remarks
-     * Returns the command's real exit code. A task token is rejected — in-sandbox code reports on itself, it does not drive the box. With `?stream=1` the same result comes back as the event stream of `GET /:id/stream`, scoped to this one invocation and terminated by a `status` event carrying the exit code.
+     * The write half of the duplex session channel — the read half is the `rpc` events on `GET /:id/stream`. Use it to answer a HITL request or send a follow-up turn to a session started in RPC mode. `line` must be exactly one JSON object with no newline in it: the channel is newline-delimited, so one call carries one command. A 200 means the line reached the session, nothing more — whether the agent accepted it comes back on the stream, asynchronously. 400 if the line is not a single JSON object, 409 if the session is not running.
      */
-    async postApiSandboxByIdExec(request, options) {
-        return (0, fp_js_1.unwrapAsync)((0, sandbox_post_api_sandbox_by_id_exec_js_1.sandboxPostApiSandboxByIdExec)(this, request, options));
+    async postApiSandboxByIdInput(request, options) {
+        return (0, fp_js_1.unwrapAsync)((0, sandbox_post_api_sandbox_by_id_input_js_1.sandboxPostApiSandboxByIdInput)(this, request, options));
     }
     /**
-     * Watch a sandbox's output live
+     * Stop a running Helix session without destroying its sandbox
      *
      * @remarks
-     * Server-sent events: `stdout`, `stderr`, `status`, `ping` (every 15s), `error`. `seq` is monotonic per sandbox and starts at 1; pass the last one seen as `?since=` to resume. If the buffer has already rolled past `since`, an `error` event names the lost range rather than skipping it silently. Disconnecting tears down the upstream.
+     * The remote equivalent of Ctrl-C on a local agent: the SESSION stops and the box — its filesystem, its other sessions, its event log — stays up. `DELETE /:id` remains the only thing that destroys a sandbox. Distinct from sending an `abort` command via `POST /:id/input`, which politely asks a cooperating agent to end its turn and only works while it is still reading stdin; a signal reaches a process that has stopped listening. 200 means the signal was delivered to a LIVE process, never merely that the request was well-formed. 409 if the session has already ended, 404 if the box has never heard of it.
      */
-    async getApiSandboxByIdStream(request, options) {
-        return (0, fp_js_1.unwrapAsync)((0, sandbox_get_api_sandbox_by_id_stream_js_1.sandboxGetApiSandboxByIdStream)(this, request, options));
+    async postApiSandboxByIdSignal(request, options) {
+        return (0, fp_js_1.unwrapAsync)((0, sandbox_post_api_sandbox_by_id_signal_js_1.sandboxPostApiSandboxByIdSignal)(this, request, options));
+    }
+    /**
+     * Ingest OTLP spans from inside a sandbox
+     *
+     * @remarks
+     * OTLP/HTTP JSON. Requires a task token; spans are attributed to the sandbox the token is bound to, never to the sandbox named in the payload.
+     */
+    async postApiSandboxTelemetryV1Traces(options) {
+        return (0, fp_js_1.unwrapAsync)((0, sandbox_post_api_sandbox_telemetry_v1_traces_js_1.sandboxPostApiSandboxTelemetryV1Traces)(this, options));
     }
     /**
      * Read a sandbox's captured spans
@@ -141,6 +172,15 @@ class Sandbox extends sdks_js_1.ClientSDK {
     async getApiSandboxByIdTraces(request, options) {
         return (0, fp_js_1.unwrapAsync)((0, sandbox_get_api_sandbox_by_id_traces_js_1.sandboxGetApiSandboxByIdTraces)(this, request, options));
     }
+    /**
+     * Exchange a platform API key for a sandbox operator token
+     *
+     * @remarks
+     * Trades a platform API key (`x-api-key: mg_live_…`) for a short-lived operator token scoped to one workspace. The caller must be able to create resources in that workspace.
+     */
+    async postApiSandboxToken(request, options) {
+        return (0, fp_js_1.unwrapAsync)((0, sandbox_post_api_sandbox_token_js_1.sandboxPostApiSandboxToken)(this, request, options));
+    }
 }
 exports.Sandbox = Sandbox;
 //# sourceMappingURL=sandbox.js.map