@opengeni/contracts 0.15.0 → 0.18.0

package/dist/index.d.ts

@@ -1,5 +1,210 @@
 import { z } from 'zod';
 
+/** Hard server-side ceiling for one retained-output response body. */
+declare const RETAINED_OUTPUT_MAX_PAGE_BYTES: number;
+/** Default first page when the client does not send a Range header. */
+declare const RETAINED_OUTPUT_DEFAULT_PAGE_BYTES: number;
+/** Receipts are timeline references, never an extensible metadata bag. */
+declare const RETAINED_OUTPUT_RECEIPT_MAX_BYTES: number;
+declare const RetainedOutputKind: z.ZodEnum<{
+    file: "file";
+    tool_result: "tool_result";
+    assistant_completion: "assistant_completion";
+    internal_update: "internal_update";
+    event_media: "event_media";
+}>;
+type RetainedOutputKind = z.infer<typeof RetainedOutputKind>;
+declare const RetainedOutputUnavailableReason: z.ZodEnum<{
+    failed: "failed";
+    expired: "expired";
+    deleted: "deleted";
+    pending: "pending";
+    not_retained: "not_retained";
+    unsupported: "unsupported";
+    missing_storage: "missing_storage";
+    storage_write_failed: "storage_write_failed";
+}>;
+type RetainedOutputUnavailableReason = z.infer<typeof RetainedOutputUnavailableReason>;
+declare const RetainedArtifactReferenceSchema: z.ZodObject<{
+    available: z.ZodLiteral<true>;
+    artifactId: z.ZodString;
+    kind: z.ZodEnum<{
+        file: "file";
+        tool_result: "tool_result";
+        assistant_completion: "assistant_completion";
+        internal_update: "internal_update";
+        event_media: "event_media";
+    }>;
+    contentType: z.ZodString;
+    originalBytes: z.ZodNumber;
+    sha256: z.ZodString;
+    retainedAt: z.ZodString;
+    retention: z.ZodObject<{
+        policy: z.ZodLiteral<"workspace_file">;
+        expiresAt: z.ZodNull;
+    }, z.core.$strict>;
+    retrieval: z.ZodObject<{
+        method: z.ZodLiteral<"GET">;
+        path: z.ZodString;
+        acceptRanges: z.ZodLiteral<"bytes">;
+        maxRangeBytes: z.ZodNumber;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+/**
+ * Canonical evidence fact carried by bounded audit/NATS/SSE/UI previews.
+ *
+ * The available variant is intentionally provider-neutral and closed: no bucket,
+ * object key, signed URL, arbitrary metadata, or producer-controlled labels can
+ * cross this boundary.
+ */
+declare const RetainedOutputEvidenceSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    available: z.ZodLiteral<false>;
+    reason: z.ZodEnum<{
+        failed: "failed";
+        expired: "expired";
+        deleted: "deleted";
+        pending: "pending";
+        not_retained: "not_retained";
+        unsupported: "unsupported";
+        missing_storage: "missing_storage";
+        storage_write_failed: "storage_write_failed";
+    }>;
+}, z.core.$strict>, z.ZodObject<{
+    available: z.ZodLiteral<true>;
+    artifactId: z.ZodString;
+    kind: z.ZodEnum<{
+        file: "file";
+        tool_result: "tool_result";
+        assistant_completion: "assistant_completion";
+        internal_update: "internal_update";
+        event_media: "event_media";
+    }>;
+    contentType: z.ZodString;
+    originalBytes: z.ZodNumber;
+    sha256: z.ZodString;
+    retainedAt: z.ZodString;
+    retention: z.ZodObject<{
+        policy: z.ZodLiteral<"workspace_file">;
+        expiresAt: z.ZodNull;
+    }, z.core.$strict>;
+    retrieval: z.ZodObject<{
+        method: z.ZodLiteral<"GET">;
+        path: z.ZodString;
+        acceptRanges: z.ZodLiteral<"bytes">;
+        maxRangeBytes: z.ZodNumber;
+    }, z.core.$strict>;
+}, z.core.$strict>], "available">;
+type RetainedOutputEvidence = z.infer<typeof RetainedOutputEvidenceSchema>;
+type RetainedArtifactReference = z.infer<typeof RetainedArtifactReferenceSchema>;
+/** @deprecated use RetainedArtifactReference. */
+type RetainedOutputAvailableEvidence = RetainedArtifactReference;
+declare const RetainedArtifactUnavailableSchema: z.ZodObject<{
+    available: z.ZodLiteral<false>;
+    artifactId: z.ZodString;
+    reason: z.ZodEnum<{
+        failed: "failed";
+        expired: "expired";
+        deleted: "deleted";
+        pending: "pending";
+        not_retained: "not_retained";
+        unsupported: "unsupported";
+        missing_storage: "missing_storage";
+        storage_write_failed: "storage_write_failed";
+    }>;
+}, z.core.$strict>;
+type RetainedArtifactUnavailable = z.infer<typeof RetainedArtifactUnavailableSchema>;
+/** Authenticated metadata result for one opaque workspace file identity. */
+declare const RetainedArtifactMetadataSchema: z.ZodUnion<readonly [z.ZodObject<{
+    available: z.ZodLiteral<true>;
+    artifactId: z.ZodString;
+    kind: z.ZodEnum<{
+        file: "file";
+        tool_result: "tool_result";
+        assistant_completion: "assistant_completion";
+        internal_update: "internal_update";
+        event_media: "event_media";
+    }>;
+    contentType: z.ZodString;
+    originalBytes: z.ZodNumber;
+    sha256: z.ZodString;
+    retainedAt: z.ZodString;
+    retention: z.ZodObject<{
+        policy: z.ZodLiteral<"workspace_file">;
+        expiresAt: z.ZodNull;
+    }, z.core.$strict>;
+    retrieval: z.ZodObject<{
+        method: z.ZodLiteral<"GET">;
+        path: z.ZodString;
+        acceptRanges: z.ZodLiteral<"bytes">;
+        maxRangeBytes: z.ZodNumber;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    available: z.ZodLiteral<false>;
+    artifactId: z.ZodString;
+    reason: z.ZodEnum<{
+        failed: "failed";
+        expired: "expired";
+        deleted: "deleted";
+        pending: "pending";
+        not_retained: "not_retained";
+        unsupported: "unsupported";
+        missing_storage: "missing_storage";
+        storage_write_failed: "storage_write_failed";
+    }>;
+}, z.core.$strict>]>;
+type RetainedArtifactMetadata = z.infer<typeof RetainedArtifactMetadataSchema>;
+type RetainedArtifactFileInput = {
+    id: string;
+    workspaceId: string;
+    status: string;
+    contentType: string;
+    sizeBytes: number;
+    sha256: string | null;
+    updatedAt: string;
+};
+/**
+ * Convert a ready, integrity-addressed workspace file into the only available
+ * retained-output receipt shape. Invalid, pending, or checksum-less files fail
+ * closed instead of implying that full evidence is retrievable.
+ */
+declare function retainedArtifactReferenceFromFile(file: RetainedArtifactFileInput, kind?: RetainedOutputKind): RetainedArtifactReference | null;
+/** Parse and clone a trusted server receipt; invalid/untrusted data fails closed. */
+declare function validateRetainedOutputEvidence(value: unknown): RetainedOutputEvidence | null;
+declare function retainedOutputUnavailable(reason?: RetainedOutputUnavailableReason): RetainedOutputEvidence;
+type RetainedOutputResolvedRange = {
+    kind: "range";
+    start: number;
+    end: number;
+    length: number;
+    totalBytes: number;
+    status: 200 | 206;
+    contentRange: string | null;
+    acceptRanges: "bytes";
+};
+type RetainedOutputRangeResolution = RetainedOutputResolvedRange | {
+    kind: "empty";
+    length: 0;
+    totalBytes: 0;
+    status: 200;
+    contentRange: null;
+    acceptRanges: "bytes";
+} | {
+    kind: "invalid";
+    reason: "malformed" | "multipart_not_supported" | "numeric_overflow" | "range_too_large";
+    maxPageBytes: number;
+} | {
+    kind: "unsatisfiable";
+    reason: "empty_artifact" | "start_out_of_bounds" | "end_before_start" | "zero_suffix";
+    totalBytes: number;
+    contentRange: string;
+};
+/**
+ * Resolve one RFC-style bytes range without ever licensing a response larger
+ * than `maxPageBytes`. Multipart ranges and oversized explicit/suffix requests
+ * fail closed. An omitted or open-ended range becomes one resumable bounded page.
+ */
+declare function resolveRetainedOutputRange(rangeHeader: string | null | undefined, totalBytes: number, maxPageBytes?: number): RetainedOutputRangeResolution;
+
 /**
  * Canonical bounded representation for `session_events.payload`.
  *
@@ -8,6 +213,7 @@ import { z } from 'zod';
  * the loss explicit. It deliberately has no server-only dependency so the DB,
  * realtime transports, SDK/React, and tests can share one wire contract.
  */
+
 declare const SESSION_EVENT_PAYLOAD_MAX_BYTES: number;
 type SessionEventBoundarySurface = "durable_audit" | "database_guard" | "database_read_projection" | "http_projection" | "nats_legacy_guard" | "sse_legacy_guard" | "browser_legacy_guard";
 type SessionEventPayloadTruncation = {
@@ -19,10 +225,7 @@ type SessionEventPayloadTruncation = {
     omittedBytes: number | null;
     estimatedOriginalTokens: number | null;
     estimatedDeliveredTokens: number;
-    fullEvidence: {
-        available: false;
-        reason: "not_retained";
-    };
+    fullEvidence: RetainedOutputEvidence;
     details: Array<{
         path: string;
         kind: "string" | "array" | "object" | "depth" | "budget" | "media" | "binary" | "unserializable";
@@ -35,6 +238,11 @@ type SessionEventPayloadTruncation = {
 type BoundSessionEventPayloadOptions = {
     surface?: SessionEventBoundarySurface;
     maxBytes?: number;
+    /**
+     * Separately trusted durable receipt. Producer payload fields never populate
+     * this slot; invalid values fail closed to not_retained.
+     */
+    fullEvidence?: unknown;
 };
 type SessionEventJsonMeasurement = {
     bytes: number;
@@ -251,6 +459,15 @@ declare const Permission: z.ZodEnum<{
     "rigs:manage": "rigs:manage";
 }>;
 type Permission = z.infer<typeof Permission>;
+/**
+ * Capability-first permissions signed into a session's first-party OpenGeni
+ * MCP token when a top-level creator does not explicitly narrow them.
+ *
+ * Keep this contract shared by admission and runtime signing: a worker-signed
+ * child whose parent was narrowed must inherit the parent's effective subset,
+ * never fall back to a different runtime-local default.
+ */
+declare const DEFAULT_FIRST_PARTY_MCP_PERMISSIONS: readonly ["workspace:read", "files:read", "documents:search", "scheduled_tasks:manage", "scheduled_tasks:run", "goals:manage", "sessions:read", "sessions:create", "sessions:control", "variable-sets:use", "variable-sets:manage", "rigs:use", "github:use"];
 declare function prefixedMcpToolName(registryId: string, toolName: string): string;
 declare const ProductAccessMode: z.ZodEnum<{
     local: "local";
@@ -1561,8 +1778,29 @@ type GitCredentialsRequest = {
     installationId: number;
     repositoryIds: number[];
 };
+/**
+ * One exact repository route exposed by a host-owned HTTPS smart-Git broker.
+ *
+ * `repositoryUri` must echo one URI from the request's `repositoryRefs`.
+ * `brokerUri` is a stable, credential-free HTTPS remote. The rotating bearer
+ * remains separate in `GitCredentials.token`, so it cannot leak through Git
+ * configuration, provider-CLI arguments, manifests, or repository metadata.
+ */
+type GitHttpBrokerRepositoryRoute = {
+    repositoryUri: string;
+    brokerUri: string;
+};
+/**
+ * Optional transport override for credentials that cannot be safely narrowed
+ * into a provider token. Omission retains the provider-token behavior.
+ */
+type GitCredentialTransport = {
+    kind: "http_broker";
+    repositories: GitHttpBrokerRepositoryRoute[];
+};
 type GitCredentials = {
     token?: string;
+    transport?: GitCredentialTransport;
     workspaceId: string;
     credentialBindingId?: GitCredentialBindingId;
     provider?: GitCredentialProvider;
@@ -1718,6 +1956,8 @@ type McpCredentialsRequest = {
     /** Immediate technical caller, retained only as non-authoritative audit context. */
     callerSubjectId?: string;
     surface: "model" | "toolspace";
+    /** Canonical MCP destination that will receive the resolved headers. */
+    destinationUrl: string;
     serverId: string;
     toolName?: string;
     connectionRef: McpServerConnectionRef;
@@ -2484,6 +2724,61 @@ declare const ToolRef: z.ZodObject<{
     optional: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 type ToolRef = z.infer<typeof ToolRef>;
+declare const SessionMcpServerId: z.ZodString;
+type SessionMcpServerId = z.infer<typeof SessionMcpServerId>;
+declare const SessionToolPolicy: z.ZodObject<{
+    mode: z.ZodEnum<{
+        explicit: "explicit";
+        workspace_default: "workspace_default";
+        inherited: "inherited";
+        legacy: "legacy";
+    }>;
+    inheritedFromSessionId: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+type SessionToolPolicy = z.infer<typeof SessionToolPolicy>;
+declare const SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT = 64;
+declare const SESSION_EFFECTIVE_TOOL_POLICY_ID_MAX_LENGTH = 200;
+declare const SessionEffectiveToolPolicy: z.ZodObject<{
+    mode: z.ZodEnum<{
+        explicit: "explicit";
+        workspace_default: "workspace_default";
+        inherited: "inherited";
+        legacy: "legacy";
+    }>;
+    inheritedFromSessionId: z.ZodNullable<z.ZodString>;
+    selectedIds: z.ZodArray<z.ZodString>;
+    effectiveIds: z.ZodArray<z.ZodString>;
+    mandatoryIds: z.ZodArray<z.ZodString>;
+    lazyRouter: z.ZodObject<{
+        state: z.ZodEnum<{
+            disabled: "disabled";
+            required: "required";
+        }>;
+        deferredIds: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>;
+    configuredIds: z.ZodArray<z.ZodString>;
+    droppedIds: z.ZodArray<z.ZodString>;
+    counts: z.ZodObject<{
+        selected: z.ZodNumber;
+        effective: z.ZodNumber;
+        mandatory: z.ZodNumber;
+        deferred: z.ZodNumber;
+        configured: z.ZodNumber;
+        dropped: z.ZodNumber;
+    }, z.core.$strict>;
+    idsTruncated: z.ZodBoolean;
+}, z.core.$strict>;
+type SessionEffectiveToolPolicy = z.infer<typeof SessionEffectiveToolPolicy>;
+/**
+ * Human-approval policy for one MCP server. `true` gates every tool, `false`
+ * gates none, and a list gates only those unprefixed names.
+ */
+declare const SESSION_MCP_APPROVAL_POLICY_MAX_TOOL_NAMES = 2048;
+declare const SESSION_MCP_APPROVAL_POLICY_MAX_BYTES: number;
+declare const SESSION_MCP_APPROVAL_TOOL_NAME_MAX_BYTES = 1024;
+declare const SESSION_MCP_SERVERS_MAX = 64;
+declare const SessionMcpApprovalPolicy: z.ZodUnion<readonly [z.ZodBoolean, z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>]>;
+type SessionMcpApprovalPolicy = z.infer<typeof SessionMcpApprovalPolicy>;
 declare const SessionMcpServerInput: z.ZodObject<{
     id: z.ZodString;
     name: z.ZodOptional<z.ZodString>;
@@ -2491,7 +2786,7 @@ declare const SessionMcpServerInput: z.ZodObject<{
     allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
     timeoutMs: z.ZodOptional<z.ZodNumber>;
     cacheToolsList: z.ZodOptional<z.ZodBoolean>;
-    requireApproval: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>>;
+    requireApproval: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>]>>;
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     connectionRef: z.ZodOptional<z.ZodObject<{
         connectionId: z.ZodOptional<z.ZodString>;
@@ -2527,6 +2822,7 @@ declare const SessionMcpServerMetadata: z.ZodObject<{
     url: z.ZodString;
     headerNames: z.ZodDefault<z.ZodArray<z.ZodString>>;
     credentialVersion: z.ZodNumber;
+    requireApproval: z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>]>>;
     connectionRef: z.ZodDefault<z.ZodNullable<z.ZodObject<{
         connectionId: z.ZodOptional<z.ZodString>;
         provider: z.ZodOptional<z.ZodString>;
@@ -2550,6 +2846,43 @@ declare const SessionMcpServerMetadata: z.ZodObject<{
     }, z.core.$strict>>>;
 }, z.core.$strict>;
 type SessionMcpServerMetadata = z.infer<typeof SessionMcpServerMetadata>;
+declare const UpdateSessionMcpApprovalPolicyRequest: z.ZodObject<{
+    requireApproval: z.ZodUnion<readonly [z.ZodBoolean, z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>]>;
+}, z.core.$strict>;
+type UpdateSessionMcpApprovalPolicyRequest = z.infer<typeof UpdateSessionMcpApprovalPolicyRequest>;
+declare const UpdateSessionMcpApprovalPolicyResponse: z.ZodObject<{
+    server: z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        url: z.ZodString;
+        headerNames: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        credentialVersion: z.ZodNumber;
+        requireApproval: z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>]>>;
+        connectionRef: z.ZodDefault<z.ZodNullable<z.ZodObject<{
+            connectionId: z.ZodOptional<z.ZodString>;
+            provider: z.ZodOptional<z.ZodString>;
+            providerDomain: z.ZodString;
+            kind: z.ZodOptional<z.ZodEnum<{
+                oauth2: "oauth2";
+                api_key: "api_key";
+                app_install: "app_install";
+                delegated: "delegated";
+            }>>;
+            scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            resource: z.ZodOptional<z.ZodString>;
+            selectedResources: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                kind: z.ZodLiteral<"repository">;
+            }, z.core.$strict>>>;
+            subjectScope: z.ZodOptional<z.ZodEnum<{
+                subject: "subject";
+                workspace: "workspace";
+            }>>;
+        }, z.core.$strict>>>;
+    }, z.core.$strict>;
+    effectiveFrom: z.ZodLiteral<"next_attempt">;
+}, z.core.$strict>;
+type UpdateSessionMcpApprovalPolicyResponse = z.infer<typeof UpdateSessionMcpApprovalPolicyResponse>;
 declare class ResourceRefConflictError extends Error {
     constructor(message: string);
 }
@@ -2767,6 +3100,7 @@ declare const SessionAuthorizationOperation: z.ZodEnum<{
     "session.human_input.read": "session.human_input.read";
     "session.human_input.write": "session.human_input.write";
     "session.title.write": "session.title.write";
+    "session.mcp.approval_policy.write": "session.mcp.approval_policy.write";
     "session.goal.read": "session.goal.read";
     "session.goal.write": "session.goal.write";
     "session.child.create": "session.child.create";
@@ -2915,6 +3249,7 @@ declare const SessionTurn: z.ZodObject<{
         id: z.ZodString;
         optional: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
+    toolsProvided: z.ZodOptional<z.ZodBoolean>;
     model: z.ZodString;
     reasoningEffort: z.ZodEnum<{
         none: "none";
@@ -2980,8 +3315,8 @@ type EffectiveControlBlocker = z.infer<typeof EffectiveControlBlocker>;
 declare const EffectiveControlResumeOption: z.ZodObject<{
     scope: z.ZodEnum<{
         workspace: "workspace";
-        session: "session";
         selected: "selected";
+        session: "session";
     }>;
     targetId: z.ZodOptional<z.ZodString>;
     selectedStateAfter: z.ZodEnum<{
@@ -3042,8 +3377,8 @@ declare const EffectiveSessionControl: z.ZodObject<{
     resumeOptions: z.ZodArray<z.ZodObject<{
         scope: z.ZodEnum<{
             workspace: "workspace";
-            session: "session";
             selected: "selected";
+            session: "session";
         }>;
         targetId: z.ZodOptional<z.ZodString>;
         selectedStateAfter: z.ZodEnum<{
@@ -3125,6 +3460,7 @@ declare const ComposerDraft: z.ZodObject<{
         id: z.ZodString;
         optional: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
+    toolsProvided: z.ZodDefault<z.ZodBoolean>;
     model: z.ZodString;
     reasoningEffort: z.ZodEnum<{
         none: "none";
@@ -3180,8 +3516,8 @@ declare const SessionQueueSnapshot: z.ZodObject<{
         resumeOptions: z.ZodArray<z.ZodObject<{
             scope: z.ZodEnum<{
                 workspace: "workspace";
-                session: "session";
                 selected: "selected";
+                session: "session";
             }>;
             targetId: z.ZodOptional<z.ZodString>;
             selectedStateAfter: z.ZodEnum<{
@@ -3274,6 +3610,7 @@ declare const SessionQueueSnapshot: z.ZodObject<{
             id: z.ZodString;
             optional: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>;
+        toolsProvided: z.ZodOptional<z.ZodBoolean>;
         model: z.ZodString;
         reasoningEffort: z.ZodEnum<{
             none: "none";
@@ -3392,6 +3729,7 @@ declare const SaveComposerDraftRequest: z.ZodObject<{
         id: z.ZodString;
         optional: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
+    toolsProvided: z.ZodDefault<z.ZodBoolean>;
     expectedRevision: z.ZodNumber;
 }, z.core.$strip>;
 type SaveComposerDraftRequest = z.infer<typeof SaveComposerDraftRequest>;
@@ -5205,6 +5543,19 @@ declare const CapabilityRuntime: z.ZodObject<{
     mcpServerId: z.ZodOptional<z.ZodString>;
     transport: z.ZodOptional<z.ZodString>;
     notes: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    catalogTrust: z.ZodOptional<z.ZodObject<{
+        state: z.ZodEnum<{
+            trusted: "trusted";
+            legacy_active: "legacy_active";
+            unverified: "unverified";
+        }>;
+        reason: z.ZodEnum<{
+            trusted_source: "trusted_source";
+            verified_probe: "verified_probe";
+            active_installation_compatibility: "active_installation_compatibility";
+            missing_verification: "missing_verification";
+        }>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 type CapabilityRuntime = z.infer<typeof CapabilityRuntime>;
 declare const CapabilityCatalogItem: z.ZodObject<{
@@ -5264,6 +5615,19 @@ declare const CapabilityCatalogItem: z.ZodObject<{
         mcpServerId: z.ZodOptional<z.ZodString>;
         transport: z.ZodOptional<z.ZodString>;
         notes: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+        catalogTrust: z.ZodOptional<z.ZodObject<{
+            state: z.ZodEnum<{
+                trusted: "trusted";
+                legacy_active: "legacy_active";
+                unverified: "unverified";
+            }>;
+            reason: z.ZodEnum<{
+                trusted_source: "trusted_source";
+                verified_probe: "verified_probe";
+                active_installation_compatibility: "active_installation_compatibility";
+                missing_verification: "missing_verification";
+            }>;
+        }, z.core.$strip>>;
     }, z.core.$strip>>;
     enabled: z.ZodDefault<z.ZodBoolean>;
     enabledReason: z.ZodDefault<z.ZodNullable<z.ZodString>>;
@@ -5277,6 +5641,14 @@ declare const CapabilityCatalogItem: z.ZodObject<{
     updatedAt: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 type CapabilityCatalogItem = z.infer<typeof CapabilityCatalogItem>;
+/**
+ * Shared trust gate for catalog visibility and runtime selection. Registry rows
+ * remain durable for provenance and audit, but only a reviewed real-MCP probe
+ * with known authentication is exposable. API-key rows additionally need a
+ * machine-actionable header contract; prose credential instructions are not a
+ * runtime contract and must fail closed.
+ */
+declare function capabilityCatalogItemIsTrustedForExposure(item: Pick<CapabilityCatalogItem, "source" | "stale" | "authKind" | "metadata">): boolean;
 declare const CapabilityInstallation: z.ZodObject<{
     id: z.ZodString;
     accountId: z.ZodString;
@@ -5413,6 +5785,19 @@ declare const CapabilityCatalogResponse: z.ZodObject<{
             mcpServerId: z.ZodOptional<z.ZodString>;
             transport: z.ZodOptional<z.ZodString>;
             notes: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            catalogTrust: z.ZodOptional<z.ZodObject<{
+                state: z.ZodEnum<{
+                    trusted: "trusted";
+                    legacy_active: "legacy_active";
+                    unverified: "unverified";
+                }>;
+                reason: z.ZodEnum<{
+                    trusted_source: "trusted_source";
+                    verified_probe: "verified_probe";
+                    active_installation_compatibility: "active_installation_compatibility";
+                    missing_verification: "missing_verification";
+                }>;
+            }, z.core.$strip>>;
         }, z.core.$strip>>;
         enabled: z.ZodDefault<z.ZodBoolean>;
         enabledReason: z.ZodDefault<z.ZodNullable<z.ZodString>>;
@@ -5506,6 +5891,19 @@ declare const DiscoverMcpCapabilitiesResponse: z.ZodObject<{
             mcpServerId: z.ZodOptional<z.ZodString>;
             transport: z.ZodOptional<z.ZodString>;
             notes: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+            catalogTrust: z.ZodOptional<z.ZodObject<{
+                state: z.ZodEnum<{
+                    trusted: "trusted";
+                    legacy_active: "legacy_active";
+                    unverified: "unverified";
+                }>;
+                reason: z.ZodEnum<{
+                    trusted_source: "trusted_source";
+                    verified_probe: "verified_probe";
+                    active_installation_compatibility: "active_installation_compatibility";
+                    missing_verification: "missing_verification";
+                }>;
+            }, z.core.$strip>>;
         }, z.core.$strip>>;
         enabled: z.ZodDefault<z.ZodBoolean>;
         enabledReason: z.ZodDefault<z.ZodNullable<z.ZodString>>;
@@ -5575,6 +5973,45 @@ declare const Session: z.ZodObject<{
         id: z.ZodString;
         optional: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
+    toolPolicy: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodEnum<{
+            explicit: "explicit";
+            workspace_default: "workspace_default";
+            inherited: "inherited";
+            legacy: "legacy";
+        }>;
+        inheritedFromSessionId: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    effectiveToolPolicy: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodEnum<{
+            explicit: "explicit";
+            workspace_default: "workspace_default";
+            inherited: "inherited";
+            legacy: "legacy";
+        }>;
+        inheritedFromSessionId: z.ZodNullable<z.ZodString>;
+        selectedIds: z.ZodArray<z.ZodString>;
+        effectiveIds: z.ZodArray<z.ZodString>;
+        mandatoryIds: z.ZodArray<z.ZodString>;
+        lazyRouter: z.ZodObject<{
+            state: z.ZodEnum<{
+                disabled: "disabled";
+                required: "required";
+            }>;
+            deferredIds: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>;
+        configuredIds: z.ZodArray<z.ZodString>;
+        droppedIds: z.ZodArray<z.ZodString>;
+        counts: z.ZodObject<{
+            selected: z.ZodNumber;
+            effective: z.ZodNumber;
+            mandatory: z.ZodNumber;
+            deferred: z.ZodNumber;
+            configured: z.ZodNumber;
+            dropped: z.ZodNumber;
+        }, z.core.$strict>;
+        idsTruncated: z.ZodBoolean;
+    }, z.core.$strict>>;
     metadata: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     createdBy: z.ZodObject<{
         subjectId: z.ZodString;
@@ -5657,6 +6094,7 @@ declare const Session: z.ZodObject<{
         url: z.ZodString;
         headerNames: z.ZodDefault<z.ZodArray<z.ZodString>>;
         credentialVersion: z.ZodNumber;
+        requireApproval: z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>]>>;
         connectionRef: z.ZodDefault<z.ZodNullable<z.ZodObject<{
             connectionId: z.ZodOptional<z.ZodString>;
             provider: z.ZodOptional<z.ZodString>;
@@ -5726,8 +6164,8 @@ declare const Session: z.ZodObject<{
         resumeOptions: z.ZodArray<z.ZodObject<{
             scope: z.ZodEnum<{
                 workspace: "workspace";
-                session: "session";
                 selected: "selected";
+                session: "session";
             }>;
             targetId: z.ZodOptional<z.ZodString>;
             selectedStateAfter: z.ZodEnum<{
@@ -5837,6 +6275,45 @@ declare const CreateSessionResponse: z.ZodObject<{
         id: z.ZodString;
         optional: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
+    toolPolicy: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodEnum<{
+            explicit: "explicit";
+            workspace_default: "workspace_default";
+            inherited: "inherited";
+            legacy: "legacy";
+        }>;
+        inheritedFromSessionId: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+    effectiveToolPolicy: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodEnum<{
+            explicit: "explicit";
+            workspace_default: "workspace_default";
+            inherited: "inherited";
+            legacy: "legacy";
+        }>;
+        inheritedFromSessionId: z.ZodNullable<z.ZodString>;
+        selectedIds: z.ZodArray<z.ZodString>;
+        effectiveIds: z.ZodArray<z.ZodString>;
+        mandatoryIds: z.ZodArray<z.ZodString>;
+        lazyRouter: z.ZodObject<{
+            state: z.ZodEnum<{
+                disabled: "disabled";
+                required: "required";
+            }>;
+            deferredIds: z.ZodArray<z.ZodString>;
+        }, z.core.$strict>;
+        configuredIds: z.ZodArray<z.ZodString>;
+        droppedIds: z.ZodArray<z.ZodString>;
+        counts: z.ZodObject<{
+            selected: z.ZodNumber;
+            effective: z.ZodNumber;
+            mandatory: z.ZodNumber;
+            deferred: z.ZodNumber;
+            configured: z.ZodNumber;
+            dropped: z.ZodNumber;
+        }, z.core.$strict>;
+        idsTruncated: z.ZodBoolean;
+    }, z.core.$strict>>;
     metadata: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     createdBy: z.ZodObject<{
         subjectId: z.ZodString;
@@ -5919,6 +6396,7 @@ declare const CreateSessionResponse: z.ZodObject<{
         url: z.ZodString;
         headerNames: z.ZodDefault<z.ZodArray<z.ZodString>>;
         credentialVersion: z.ZodNumber;
+        requireApproval: z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>]>>;
         connectionRef: z.ZodDefault<z.ZodNullable<z.ZodObject<{
             connectionId: z.ZodOptional<z.ZodString>;
             provider: z.ZodOptional<z.ZodString>;
@@ -5988,8 +6466,8 @@ declare const CreateSessionResponse: z.ZodObject<{
         resumeOptions: z.ZodArray<z.ZodObject<{
             scope: z.ZodEnum<{
                 workspace: "workspace";
-                session: "session";
                 selected: "selected";
+                session: "session";
             }>;
             targetId: z.ZodOptional<z.ZodString>;
             selectedStateAfter: z.ZodEnum<{
@@ -6105,6 +6583,45 @@ declare const SessionListResponse: z.ZodObject<{
             id: z.ZodString;
             optional: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>;
+        toolPolicy: z.ZodOptional<z.ZodObject<{
+            mode: z.ZodEnum<{
+                explicit: "explicit";
+                workspace_default: "workspace_default";
+                inherited: "inherited";
+                legacy: "legacy";
+            }>;
+            inheritedFromSessionId: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>;
+        effectiveToolPolicy: z.ZodOptional<z.ZodObject<{
+            mode: z.ZodEnum<{
+                explicit: "explicit";
+                workspace_default: "workspace_default";
+                inherited: "inherited";
+                legacy: "legacy";
+            }>;
+            inheritedFromSessionId: z.ZodNullable<z.ZodString>;
+            selectedIds: z.ZodArray<z.ZodString>;
+            effectiveIds: z.ZodArray<z.ZodString>;
+            mandatoryIds: z.ZodArray<z.ZodString>;
+            lazyRouter: z.ZodObject<{
+                state: z.ZodEnum<{
+                    disabled: "disabled";
+                    required: "required";
+                }>;
+                deferredIds: z.ZodArray<z.ZodString>;
+            }, z.core.$strict>;
+            configuredIds: z.ZodArray<z.ZodString>;
+            droppedIds: z.ZodArray<z.ZodString>;
+            counts: z.ZodObject<{
+                selected: z.ZodNumber;
+                effective: z.ZodNumber;
+                mandatory: z.ZodNumber;
+                deferred: z.ZodNumber;
+                configured: z.ZodNumber;
+                dropped: z.ZodNumber;
+            }, z.core.$strict>;
+            idsTruncated: z.ZodBoolean;
+        }, z.core.$strict>>;
         metadata: z.ZodRecord<z.ZodString, z.ZodUnknown>;
         createdBy: z.ZodObject<{
             subjectId: z.ZodString;
@@ -6187,6 +6704,7 @@ declare const SessionListResponse: z.ZodObject<{
             url: z.ZodString;
             headerNames: z.ZodDefault<z.ZodArray<z.ZodString>>;
             credentialVersion: z.ZodNumber;
+            requireApproval: z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>]>>;
             connectionRef: z.ZodDefault<z.ZodNullable<z.ZodObject<{
                 connectionId: z.ZodOptional<z.ZodString>;
                 provider: z.ZodOptional<z.ZodString>;
@@ -6256,8 +6774,8 @@ declare const SessionListResponse: z.ZodObject<{
             resumeOptions: z.ZodArray<z.ZodObject<{
                 scope: z.ZodEnum<{
                     workspace: "workspace";
-                    session: "session";
                     selected: "selected";
+                    session: "session";
                 }>;
                 targetId: z.ZodOptional<z.ZodString>;
                 selectedStateAfter: z.ZodEnum<{
@@ -6362,6 +6880,45 @@ declare const SessionListResponse: z.ZodObject<{
             id: z.ZodString;
             optional: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>;
+        toolPolicy: z.ZodOptional<z.ZodObject<{
+            mode: z.ZodEnum<{
+                explicit: "explicit";
+                workspace_default: "workspace_default";
+                inherited: "inherited";
+                legacy: "legacy";
+            }>;
+            inheritedFromSessionId: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>;
+        effectiveToolPolicy: z.ZodOptional<z.ZodObject<{
+            mode: z.ZodEnum<{
+                explicit: "explicit";
+                workspace_default: "workspace_default";
+                inherited: "inherited";
+                legacy: "legacy";
+            }>;
+            inheritedFromSessionId: z.ZodNullable<z.ZodString>;
+            selectedIds: z.ZodArray<z.ZodString>;
+            effectiveIds: z.ZodArray<z.ZodString>;
+            mandatoryIds: z.ZodArray<z.ZodString>;
+            lazyRouter: z.ZodObject<{
+                state: z.ZodEnum<{
+                    disabled: "disabled";
+                    required: "required";
+                }>;
+                deferredIds: z.ZodArray<z.ZodString>;
+            }, z.core.$strict>;
+            configuredIds: z.ZodArray<z.ZodString>;
+            droppedIds: z.ZodArray<z.ZodString>;
+            counts: z.ZodObject<{
+                selected: z.ZodNumber;
+                effective: z.ZodNumber;
+                mandatory: z.ZodNumber;
+                deferred: z.ZodNumber;
+                configured: z.ZodNumber;
+                dropped: z.ZodNumber;
+            }, z.core.$strict>;
+            idsTruncated: z.ZodBoolean;
+        }, z.core.$strict>>;
         metadata: z.ZodRecord<z.ZodString, z.ZodUnknown>;
         createdBy: z.ZodObject<{
             subjectId: z.ZodString;
@@ -6444,6 +7001,7 @@ declare const SessionListResponse: z.ZodObject<{
             url: z.ZodString;
             headerNames: z.ZodDefault<z.ZodArray<z.ZodString>>;
             credentialVersion: z.ZodNumber;
+            requireApproval: z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>]>>;
             connectionRef: z.ZodDefault<z.ZodNullable<z.ZodObject<{
                 connectionId: z.ZodOptional<z.ZodString>;
                 provider: z.ZodOptional<z.ZodString>;
@@ -6513,8 +7071,8 @@ declare const SessionListResponse: z.ZodObject<{
             resumeOptions: z.ZodArray<z.ZodObject<{
                 scope: z.ZodEnum<{
                     workspace: "workspace";
-                    session: "session";
                     selected: "selected";
+                    session: "session";
                 }>;
                 targetId: z.ZodOptional<z.ZodString>;
                 selectedStateAfter: z.ZodEnum<{
@@ -6627,6 +7185,45 @@ declare const SessionLineageResponse: z.ZodObject<{
             id: z.ZodString;
             optional: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>;
+        toolPolicy: z.ZodOptional<z.ZodObject<{
+            mode: z.ZodEnum<{
+                explicit: "explicit";
+                workspace_default: "workspace_default";
+                inherited: "inherited";
+                legacy: "legacy";
+            }>;
+            inheritedFromSessionId: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>>;
+        effectiveToolPolicy: z.ZodOptional<z.ZodObject<{
+            mode: z.ZodEnum<{
+                explicit: "explicit";
+                workspace_default: "workspace_default";
+                inherited: "inherited";
+                legacy: "legacy";
+            }>;
+            inheritedFromSessionId: z.ZodNullable<z.ZodString>;
+            selectedIds: z.ZodArray<z.ZodString>;
+            effectiveIds: z.ZodArray<z.ZodString>;
+            mandatoryIds: z.ZodArray<z.ZodString>;
+            lazyRouter: z.ZodObject<{
+                state: z.ZodEnum<{
+                    disabled: "disabled";
+                    required: "required";
+                }>;
+                deferredIds: z.ZodArray<z.ZodString>;
+            }, z.core.$strict>;
+            configuredIds: z.ZodArray<z.ZodString>;
+            droppedIds: z.ZodArray<z.ZodString>;
+            counts: z.ZodObject<{
+                selected: z.ZodNumber;
+                effective: z.ZodNumber;
+                mandatory: z.ZodNumber;
+                deferred: z.ZodNumber;
+                configured: z.ZodNumber;
+                dropped: z.ZodNumber;
+            }, z.core.$strict>;
+            idsTruncated: z.ZodBoolean;
+        }, z.core.$strict>>;
         metadata: z.ZodRecord<z.ZodString, z.ZodUnknown>;
         createdBy: z.ZodObject<{
             subjectId: z.ZodString;
@@ -6709,6 +7306,7 @@ declare const SessionLineageResponse: z.ZodObject<{
             url: z.ZodString;
             headerNames: z.ZodDefault<z.ZodArray<z.ZodString>>;
             credentialVersion: z.ZodNumber;
+            requireApproval: z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>]>>;
             connectionRef: z.ZodDefault<z.ZodNullable<z.ZodObject<{
                 connectionId: z.ZodOptional<z.ZodString>;
                 provider: z.ZodOptional<z.ZodString>;
@@ -6778,8 +7376,8 @@ declare const SessionLineageResponse: z.ZodObject<{
             resumeOptions: z.ZodArray<z.ZodObject<{
                 scope: z.ZodEnum<{
                     workspace: "workspace";
-                    session: "session";
                     selected: "selected";
+                    session: "session";
                 }>;
                 targetId: z.ZodOptional<z.ZodString>;
                 selectedStateAfter: z.ZodEnum<{
@@ -6861,6 +7459,7 @@ declare const SessionEventType: z.ZodEnum<{
     "agent.reasoning.delta": "agent.reasoning.delta";
     "agent.toolCall.created": "agent.toolCall.created";
     "agent.toolCall.output": "agent.toolCall.output";
+    "agent.model.request": "agent.model.request";
     "agent.model.usage": "agent.model.usage";
     "tool.auth_needed": "tool.auth_needed";
     "credential.auth_needed": "credential.auth_needed";
@@ -6907,6 +7506,7 @@ declare const SessionEventType: z.ZodEnum<{
     "terminal.pty.output.delta": "terminal.pty.output.delta";
     "terminal.pty.exited": "terminal.pty.exited";
     "session.title_set": "session.title_set";
+    "session.mcp.approval_policy.updated": "session.mcp.approval_policy.updated";
     "codex.account.switched": "codex.account.switched";
     "codex.credential.selected": "codex.credential.selected";
     "codex.capacity.waiting": "codex.capacity.waiting";
@@ -6941,12 +7541,34 @@ declare const SessionEventSemanticClass: z.ZodEnum<{
     provider_account: "provider_account";
 }>;
 type SessionEventSemanticClass = z.infer<typeof SessionEventSemanticClass>;
+/**
+ * The semantic classes accepted by an exclusive latest lookup. `receipt` is
+ * the concise public spelling for the historical `tool_receipt` class; the
+ * latter remains accepted everywhere for backwards compatibility.
+ */
+declare const SessionEventLatestClass: z.ZodEnum<{
+    control: "control";
+    receipt: "receipt";
+    failure: "failure";
+    terminal: "terminal";
+    checkpoint: "checkpoint";
+    tool_receipt: "tool_receipt";
+    provider_account: "provider_account";
+}>;
+type SessionEventLatestClass = z.infer<typeof SessionEventLatestClass>;
+declare function sessionEventLatestClassToSemanticClass(value: SessionEventLatestClass): SessionEventSemanticClass;
 declare const SessionEventPayloadMode: z.ZodEnum<{
     none: "none";
     summary: "summary";
     full: "full";
 }>;
 type SessionEventPayloadMode = z.infer<typeof SessionEventPayloadMode>;
+/** Select the compact semantic-result projection instead of an event array. */
+declare const SessionEventResultMode: z.ZodEnum<{
+    events: "events";
+    compact: "compact";
+}>;
+type SessionEventResultMode = z.infer<typeof SessionEventResultMode>;
 declare const SessionEventReadMode: z.ZodEnum<{
     monitoring: "monitoring";
     forensic: "forensic";
@@ -6959,8 +7581,8 @@ declare const SessionEventReadDirection: z.ZodEnum<{
 type SessionEventReadDirection = z.infer<typeof SessionEventReadDirection>;
 declare const SESSION_EVENT_RAW_DELTA_TYPES: readonly ["agent.message.delta", "agent.reasoning.delta", "sandbox.command.output.delta", "terminal.pty.output.delta"];
 declare const SESSION_EVENT_SEMANTIC_CLASS_TYPES: {
-    readonly control: readonly ["session.status.changed", "session.requiresAction", "session.humanInput.requested", "user.pause", "user.approvalDecision", "user.humanInputResponse", "goal.set", "goal.updated", "goal.completed", "goal.paused", "goal.resumed", "goal.cleared", "goal.continuation", "system.update.pending", "system.update.delivered", "session.control.paused", "session.control.resumed", "session.control.steer_requested", "workspace.inference.paused", "workspace.inference.resumed", "session.queue.changed", "session.queue.prompt.cancelled"];
-    readonly terminal: readonly ["turn.completed", "turn.failed", "turn.cancelled", "turn.superseded", "goal.completed", "goal.paused", "rig.setup.completed", "rig.setup.skipped", "rig.setup.failed", "sandbox.operation.completed", "sandbox.operation.failed", "recording.available", "recording.failed", "terminal.pty.exited"];
+    readonly control: readonly ["session.status.changed", "session.requiresAction", "session.humanInput.requested", "user.pause", "user.approvalDecision", "user.humanInputResponse", "goal.set", "goal.updated", "goal.completed", "goal.paused", "goal.resumed", "goal.cleared", "goal.continuation", "system.update.pending", "system.update.delivered", "session.control.paused", "session.control.resumed", "session.control.steer_requested", "workspace.inference.paused", "workspace.inference.resumed", "session.queue.changed", "session.queue.prompt.cancelled", "session.mcp.approval_policy.updated"];
+    readonly terminal: readonly ["turn.completed", "agent.message.completed", "turn.failed", "turn.cancelled", "turn.superseded", "goal.completed", "goal.paused", "rig.setup.completed", "rig.setup.skipped", "rig.setup.failed", "sandbox.operation.completed", "sandbox.operation.failed", "recording.available", "recording.failed", "terminal.pty.exited"];
     readonly failure: readonly ["session.event.envelope_omitted", "turn.failed", "tool.auth_needed", "credential.auth_needed", "rig.setup.failed", "sandbox.operation.failed", "recording.failed", "sandbox.box.lost", "workspace.revision.degraded", "machine.op.failed", "machine.link.lost"];
     readonly checkpoint: readonly ["session.context.compaction.requested", "session.context.compacted", "session.context.compaction.skipped", "session.context.cleared", "turn.recovery.requested", "session.queue.history", "sandbox.box.snapshot", "workspace.revision.captured"];
     readonly tool_receipt: readonly ["agent.toolCall.created", "agent.toolCall.output", "tool.auth_needed", "artifact.created"];
@@ -8209,6 +8831,7 @@ declare const SessionEvent: z.ZodObject<{
         "agent.reasoning.delta": "agent.reasoning.delta";
         "agent.toolCall.created": "agent.toolCall.created";
         "agent.toolCall.output": "agent.toolCall.output";
+        "agent.model.request": "agent.model.request";
         "agent.model.usage": "agent.model.usage";
         "tool.auth_needed": "tool.auth_needed";
         "credential.auth_needed": "credential.auth_needed";
@@ -8255,6 +8878,7 @@ declare const SessionEvent: z.ZodObject<{
         "terminal.pty.output.delta": "terminal.pty.output.delta";
         "terminal.pty.exited": "terminal.pty.exited";
         "session.title_set": "session.title_set";
+        "session.mcp.approval_policy.updated": "session.mcp.approval_policy.updated";
         "codex.account.switched": "codex.account.switched";
         "codex.credential.selected": "codex.credential.selected";
         "codex.capacity.waiting": "codex.capacity.waiting";
@@ -8289,6 +8913,62 @@ declare const SessionEvent: z.ZodObject<{
     duplicateReason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
 }, z.core.$strip>;
 type SessionEvent = z.infer<typeof SessionEvent>;
+type SessionEventCompactResult = {
+    version: 1;
+    semanticClass: SessionEventSemanticClass;
+    source: {
+        id: string;
+        type: SessionEventType;
+        sequence: number;
+        occurredAt: string;
+        turnId: string | null;
+        turnGeneration: number | null;
+        turnAttemptId: string | null;
+        turnAssociation: SessionEvent["turnAssociation"];
+    };
+    id: string;
+    type: SessionEventType;
+    sequence: number;
+    occurredAt: string;
+    turnId: string | null;
+    turnGeneration: number | null;
+    turnAttemptId: string | null;
+    turnAssociation: SessionEvent["turnAssociation"];
+    coveredSequence: {
+        first: number;
+        last: number;
+    };
+    status: "completed" | "failed" | "cancelled" | "superseded" | "checkpoint" | "receipt" | "unknown";
+    text: string | null;
+    output: unknown;
+    result: unknown;
+    failure: {
+        error: string | null;
+        code: string | null;
+        retryable: boolean | null;
+        recovery: string | null;
+    } | null;
+    checkpoint: unknown;
+    receipt: unknown;
+    truncation: {
+        truncated: boolean;
+        fields: string[];
+        originalBytes: number | null;
+        deliveredBytes: number;
+    };
+};
+/**
+ * Build the bounded semantic result used by `latest + result=compact`.
+ *
+ * This is intentionally a pure projection over one already-authoritative
+ * event. It never reads history, invokes a model, follows a URL, or stores an
+ * artifact. The DB/API/MCP layers decide which event is authoritative; this
+ * helper only extracts the small result facts that can cross a client boundary.
+ */
+declare function compactSessionEventResult(event: SessionEvent, semanticClass: SessionEventSemanticClass, coveredSequence?: {
+    first: number;
+    last: number;
+}): SessionEventCompactResult;
 /** Wire revision for the durable host event/usage export stream. */
 declare const OPENGENI_HOST_EXPORT_SCHEMA_REVISION: "2026-07-host-export-v1";
 /**
@@ -8627,8 +9307,8 @@ declare const SessionQueueMutationResponse: z.ZodObject<{
             resumeOptions: z.ZodArray<z.ZodObject<{
                 scope: z.ZodEnum<{
                     workspace: "workspace";
-                    session: "session";
                     selected: "selected";
+                    session: "session";
                 }>;
                 targetId: z.ZodOptional<z.ZodString>;
                 selectedStateAfter: z.ZodEnum<{
@@ -8721,6 +9401,7 @@ declare const SessionQueueMutationResponse: z.ZodObject<{
                 id: z.ZodString;
                 optional: z.ZodOptional<z.ZodBoolean>;
             }, z.core.$strip>>;
+            toolsProvided: z.ZodOptional<z.ZodBoolean>;
             model: z.ZodString;
             reasoningEffort: z.ZodEnum<{
                 none: "none";
@@ -8805,6 +9486,7 @@ declare const SessionQueueMutationResponse: z.ZodObject<{
             id: z.ZodString;
             optional: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>;
+        toolsProvided: z.ZodDefault<z.ZodBoolean>;
         model: z.ZodString;
         reasoningEffort: z.ZodEnum<{
             none: "none";
@@ -8872,8 +9554,8 @@ declare const SessionControlResponse: z.ZodObject<{
         resumeOptions: z.ZodArray<z.ZodObject<{
             scope: z.ZodEnum<{
                 workspace: "workspace";
-                session: "session";
                 selected: "selected";
+                session: "session";
             }>;
             targetId: z.ZodOptional<z.ZodString>;
             selectedStateAfter: z.ZodEnum<{
@@ -9028,7 +9710,7 @@ declare const CreateSessionRequest: z.ZodPreprocess<z.ZodObject<{
         allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
         timeoutMs: z.ZodOptional<z.ZodNumber>;
         cacheToolsList: z.ZodOptional<z.ZodBoolean>;
-        requireApproval: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodArray<z.ZodString>]>>;
+        requireApproval: z.ZodOptional<z.ZodUnion<readonly [z.ZodBoolean, z.ZodPipe<z.ZodArray<z.ZodString>, z.ZodTransform<string[], string[]>>]>>;
         headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         connectionRef: z.ZodOptional<z.ZodObject<{
             connectionId: z.ZodOptional<z.ZodString>;
@@ -9399,6 +10081,7 @@ declare const SteerSessionMessageResponse: z.ZodObject<{
             "agent.reasoning.delta": "agent.reasoning.delta";
             "agent.toolCall.created": "agent.toolCall.created";
             "agent.toolCall.output": "agent.toolCall.output";
+            "agent.model.request": "agent.model.request";
             "agent.model.usage": "agent.model.usage";
             "tool.auth_needed": "tool.auth_needed";
             "credential.auth_needed": "credential.auth_needed";
@@ -9445,6 +10128,7 @@ declare const SteerSessionMessageResponse: z.ZodObject<{
             "terminal.pty.output.delta": "terminal.pty.output.delta";
             "terminal.pty.exited": "terminal.pty.exited";
             "session.title_set": "session.title_set";
+            "session.mcp.approval_policy.updated": "session.mcp.approval_policy.updated";
             "codex.account.switched": "codex.account.switched";
             "codex.credential.selected": "codex.credential.selected";
             "codex.capacity.waiting": "codex.capacity.waiting";
@@ -9538,6 +10222,7 @@ declare const SteerSessionMessageResponse: z.ZodObject<{
             id: z.ZodString;
             optional: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>;
+        toolsProvided: z.ZodOptional<z.ZodBoolean>;
         model: z.ZodString;
         reasoningEffort: z.ZodEnum<{
             none: "none";
@@ -9623,6 +10308,7 @@ declare const SessionBusMessage: z.ZodObject<{
             "agent.reasoning.delta": "agent.reasoning.delta";
             "agent.toolCall.created": "agent.toolCall.created";
             "agent.toolCall.output": "agent.toolCall.output";
+            "agent.model.request": "agent.model.request";
             "agent.model.usage": "agent.model.usage";
             "tool.auth_needed": "tool.auth_needed";
             "credential.auth_needed": "credential.auth_needed";
@@ -9669,6 +10355,7 @@ declare const SessionBusMessage: z.ZodObject<{
             "terminal.pty.output.delta": "terminal.pty.output.delta";
             "terminal.pty.exited": "terminal.pty.exited";
             "session.title_set": "session.title_set";
+            "session.mcp.approval_policy.updated": "session.mcp.approval_policy.updated";
             "codex.account.switched": "codex.account.switched";
             "codex.credential.selected": "codex.credential.selected";
             "codex.capacity.waiting": "codex.capacity.waiting";
@@ -9725,8 +10412,8 @@ declare const GitHubRepository: z.ZodObject<{
 }, z.core.$strip>;
 type GitHubRepository = z.infer<typeof GitHubRepository>;
 declare const GitHubRepositoryScope: z.ZodEnum<{
-    all: "all";
     selected: "selected";
+    all: "all";
 }>;
 type GitHubRepositoryScope = z.infer<typeof GitHubRepositoryScope>;
 declare const GitHubInstallationBinding: z.ZodObject<{
@@ -9734,8 +10421,8 @@ declare const GitHubInstallationBinding: z.ZodObject<{
     accountLogin: z.ZodNullable<z.ZodString>;
     accountType: z.ZodNullable<z.ZodString>;
     repositoryScope: z.ZodEnum<{
-        all: "all";
         selected: "selected";
+        all: "all";
     }>;
     repositoryCount: z.ZodNumber;
     createdAt: z.ZodString;
@@ -9754,8 +10441,8 @@ declare const GitHubAppInfo: z.ZodObject<{
         accountLogin: z.ZodNullable<z.ZodString>;
         accountType: z.ZodNullable<z.ZodString>;
         repositoryScope: z.ZodEnum<{
-            all: "all";
             selected: "selected";
+            all: "all";
         }>;
         repositoryCount: z.ZodNumber;
         createdAt: z.ZodString;
@@ -10440,16 +11127,303 @@ declare const MachineMetricsSeriesResponse: z.ZodObject<{
     }, z.core.$strip>>;
 }, z.core.$strip>;
 type MachineMetricsSeriesResponse = z.infer<typeof MachineMetricsSeriesResponse>;
-/**
- * A single host-exposed model + the provider that serves it, as surfaced to
- * clients (SDK + React composer) by GET /v1/config/client. The wire `api`
- * ("responses" | "chat") lets a client reason about provider capabilities; the
- * provider id/label drive the picker's grouping. This mirrors the runtime's
- * ConfiguredModel (packages/config) projected to the client-safe fields.
- */
-declare const ClientModel: z.ZodObject<{
-    id: z.ZodString;
-    label: z.ZodString;
+declare const ModelCapabilitySupportV1: z.ZodEnum<{
+    unknown: "unknown";
+    supported: "supported";
+    unsupported: "unsupported";
+}>;
+type ModelCapabilitySupportV1 = z.infer<typeof ModelCapabilitySupportV1>;
+declare const ModelCapabilityStateV1: z.ZodObject<{
+    upstream: z.ZodEnum<{
+        unknown: "unknown";
+        supported: "supported";
+        unsupported: "unsupported";
+    }>;
+    runnable: z.ZodBoolean;
+}, z.core.$strip>;
+type ModelCapabilityStateV1 = z.infer<typeof ModelCapabilityStateV1>;
+declare const ModelCapabilitiesV1: z.ZodObject<{
+    reasoning: z.ZodObject<{
+        upstream: z.ZodEnum<{
+            unknown: "unknown";
+            supported: "supported";
+            unsupported: "unsupported";
+        }>;
+        runnable: z.ZodBoolean;
+        efforts: z.ZodArray<z.ZodEnum<{
+            none: "none";
+            minimal: "minimal";
+            low: "low";
+            medium: "medium";
+            high: "high";
+            xhigh: "xhigh";
+        }>>;
+        defaultEffort: z.ZodNullable<z.ZodEnum<{
+            none: "none";
+            minimal: "minimal";
+            low: "low";
+            medium: "medium";
+            high: "high";
+            xhigh: "xhigh";
+        }>>;
+        required: z.ZodBoolean;
+    }, z.core.$strip>;
+    functionCalling: z.ZodObject<{
+        upstream: z.ZodEnum<{
+            unknown: "unknown";
+            supported: "supported";
+            unsupported: "unsupported";
+        }>;
+        runnable: z.ZodBoolean;
+    }, z.core.$strip>;
+    structuredOutput: z.ZodObject<{
+        upstream: z.ZodEnum<{
+            unknown: "unknown";
+            supported: "supported";
+            unsupported: "unsupported";
+        }>;
+        runnable: z.ZodBoolean;
+    }, z.core.$strip>;
+    hostedTools: z.ZodObject<{
+        webSearch: z.ZodObject<{
+            upstream: z.ZodEnum<{
+                unknown: "unknown";
+                supported: "supported";
+                unsupported: "unsupported";
+            }>;
+            runnable: z.ZodBoolean;
+        }, z.core.$strip>;
+        xSearch: z.ZodObject<{
+            upstream: z.ZodEnum<{
+                unknown: "unknown";
+                supported: "supported";
+                unsupported: "unsupported";
+            }>;
+            runnable: z.ZodBoolean;
+        }, z.core.$strip>;
+        codeExecution: z.ZodObject<{
+            upstream: z.ZodEnum<{
+                unknown: "unknown";
+                supported: "supported";
+                unsupported: "unsupported";
+            }>;
+            runnable: z.ZodBoolean;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    inputModalities: z.ZodArray<z.ZodEnum<{
+        text: "text";
+        image: "image";
+        audio: "audio";
+    }>>;
+    outputModalities: z.ZodArray<z.ZodEnum<{
+        text: "text";
+        image: "image";
+        audio: "audio";
+    }>>;
+    transports: z.ZodObject<{
+        sse: z.ZodObject<{
+            upstream: z.ZodEnum<{
+                unknown: "unknown";
+                supported: "supported";
+                unsupported: "unsupported";
+            }>;
+            runnable: z.ZodBoolean;
+        }, z.core.$strip>;
+        responsesWebSocket: z.ZodObject<{
+            upstream: z.ZodEnum<{
+                unknown: "unknown";
+                supported: "supported";
+                unsupported: "unsupported";
+            }>;
+            runnable: z.ZodBoolean;
+        }, z.core.$strip>;
+        realtimeAudio: z.ZodObject<{
+            upstream: z.ZodEnum<{
+                unknown: "unknown";
+                supported: "supported";
+                unsupported: "unsupported";
+            }>;
+            runnable: z.ZodBoolean;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    latencyModes: z.ZodArray<z.ZodObject<{
+        id: z.ZodEnum<{
+            standard: "standard";
+            priority: "priority";
+            fast: "fast";
+        }>;
+        upstream: z.ZodEnum<{
+            unknown: "unknown";
+            supported: "supported";
+            unsupported: "unsupported";
+        }>;
+        runnable: z.ZodBoolean;
+        billingMultiplierBps: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type ModelCapabilitiesV1 = z.infer<typeof ModelCapabilitiesV1>;
+declare const ModelCredentialSourceV1: z.ZodUnion<readonly [z.ZodObject<{
+    kind: z.ZodLiteral<"deployment">;
+    mechanism: z.ZodEnum<{
+        api_key: "api_key";
+        azure_ad_bearer: "azure_ad_bearer";
+    }>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"connected_subscription">;
+    provider: z.ZodLiteral<"codex">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"workspace_connection">;
+    mechanism: z.ZodLiteral<"api_key">;
+}, z.core.$strict>]>;
+type ModelCredentialSourceV1 = z.infer<typeof ModelCredentialSourceV1>;
+declare const ModelBillingAttributionV1: z.ZodObject<{
+    upstreamPayer: z.ZodEnum<{
+        workspace: "workspace";
+        deployment: "deployment";
+        connected_subscription: "connected_subscription";
+    }>;
+    metering: z.ZodEnum<{
+        external: "external";
+        opengeni_credits: "opengeni_credits";
+    }>;
+}, z.core.$strict>;
+type ModelBillingAttributionV1 = z.infer<typeof ModelBillingAttributionV1>;
+declare const TURN_EXECUTION_POLICY_METADATA_KEY: "turnExecutionPolicyV1";
+declare const TurnExecutionModelSourceV1: z.ZodEnum<{
+    explicit: "explicit";
+    session: "session";
+    deployment: "deployment";
+    continuation: "continuation";
+}>;
+type TurnExecutionModelSourceV1 = z.infer<typeof TurnExecutionModelSourceV1>;
+declare const TurnExecutionReasoningSourceV1: z.ZodEnum<{
+    explicit: "explicit";
+    session: "session";
+    deployment: "deployment";
+    continuation: "continuation";
+}>;
+type TurnExecutionReasoningSourceV1 = z.infer<typeof TurnExecutionReasoningSourceV1>;
+/**
+ * Secret-safe execution identity frozen onto one accepted logical turn.
+ *
+ * This is deliberately a strict, normalized reference to the deployment
+ * definition rather than a serialized provider client. It must never contain
+ * a key/token, concrete connected credential id, account label, authorization
+ * header, or credential-bearing URL/query value.
+ */
+declare const TurnExecutionPolicyV1: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<1>;
+    productModelId: z.ZodString;
+    requestedModelId: z.ZodNullable<z.ZodString>;
+    modelSource: z.ZodEnum<{
+        explicit: "explicit";
+        session: "session";
+        deployment: "deployment";
+        continuation: "continuation";
+    }>;
+    reasoningEffort: z.ZodEnum<{
+        none: "none";
+        minimal: "minimal";
+        low: "low";
+        medium: "medium";
+        high: "high";
+        xhigh: "xhigh";
+    }>;
+    reasoningSource: z.ZodEnum<{
+        explicit: "explicit";
+        session: "session";
+        deployment: "deployment";
+        continuation: "continuation";
+    }>;
+    providerId: z.ZodString;
+    upstreamModelId: z.ZodString;
+    wireApi: z.ZodEnum<{
+        chat: "chat";
+        responses: "responses";
+    }>;
+    credentialSource: z.ZodUnion<readonly [z.ZodObject<{
+        kind: z.ZodLiteral<"deployment">;
+        mechanism: z.ZodEnum<{
+            api_key: "api_key";
+            azure_ad_bearer: "azure_ad_bearer";
+        }>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"connected_subscription">;
+        provider: z.ZodLiteral<"codex">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"workspace_connection">;
+        mechanism: z.ZodLiteral<"api_key">;
+    }, z.core.$strict>]>;
+    billing: z.ZodObject<{
+        upstreamPayer: z.ZodEnum<{
+            workspace: "workspace";
+            deployment: "deployment";
+            connected_subscription: "connected_subscription";
+        }>;
+        metering: z.ZodEnum<{
+            external: "external";
+            opengeni_credits: "opengeni_credits";
+        }>;
+    }, z.core.$strict>;
+    definitionVersion: z.ZodString;
+}, z.core.$strict>;
+type TurnExecutionPolicyV1 = z.infer<typeof TurnExecutionPolicyV1>;
+type TurnExecutionPolicyReadV1 = {
+    kind: "absent";
+} | {
+    kind: "valid";
+    policy: TurnExecutionPolicyV1;
+};
+/**
+ * Read the policy from turn metadata. Only a literally absent key is legacy;
+ * null, undefined, an unknown schema version, extra fields, and every other
+ * malformed present value fail closed. Error text reports paths only and never
+ * reflects the untrusted value into logs or events.
+ */
+declare function readTurnExecutionPolicyV1(metadata: unknown): TurnExecutionPolicyReadV1;
+/** Merge a trusted policy into metadata without disturbing dispatch/recovery state. */
+declare function metadataWithTurnExecutionPolicyV1(metadata: Readonly<Record<string, unknown>> | null | undefined, policy: TurnExecutionPolicyV1): Record<string, unknown>;
+/**
+ * Minimal, stable evidence projection for command receipts and audit events.
+ * It intentionally excludes aliases, URLs, request metadata, and all concrete
+ * credential-selection identity.
+ */
+declare function turnExecutionPolicyAuditMetadata(policy: TurnExecutionPolicyV1, turnId: string): Record<string, unknown>;
+declare const ModelPricingV1: z.ZodObject<{
+    inputMicrosPerMillionTokens: z.ZodNumber;
+    cachedInputMicrosPerMillionTokens: z.ZodOptional<z.ZodNumber>;
+    outputMicrosPerMillionTokens: z.ZodNumber;
+    marginBps: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+type ModelPricingV1 = z.infer<typeof ModelPricingV1>;
+declare const ModelPricingScheduleV1: z.ZodObject<{
+    default: z.ZodObject<{
+        inputMicrosPerMillionTokens: z.ZodNumber;
+        cachedInputMicrosPerMillionTokens: z.ZodOptional<z.ZodNumber>;
+        outputMicrosPerMillionTokens: z.ZodNumber;
+        marginBps: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>;
+    inputTokenTiers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        minimumInputTokens: z.ZodNumber;
+        pricing: z.ZodObject<{
+            inputMicrosPerMillionTokens: z.ZodNumber;
+            cachedInputMicrosPerMillionTokens: z.ZodOptional<z.ZodNumber>;
+            outputMicrosPerMillionTokens: z.ZodNumber;
+            marginBps: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+type ModelPricingScheduleV1 = z.infer<typeof ModelPricingScheduleV1>;
+/**
+ * A single host-exposed model + the provider that serves it, as surfaced to
+ * clients (SDK + React composer) by GET /v1/config/client. The wire `api`
+ * ("responses" | "chat") lets a client reason about provider capabilities; the
+ * provider id/label drive the picker's grouping. This mirrors the runtime's
+ * ConfiguredModel (packages/config) projected to the client-safe fields.
+ */
+declare const ClientModel: z.ZodObject<{
+    id: z.ZodString;
+    label: z.ZodString;
     provider: z.ZodString;
     providerLabel: z.ZodString;
     api: z.ZodEnum<{
@@ -10457,8 +11431,681 @@ declare const ClientModel: z.ZodObject<{
         responses: "responses";
     }>;
     contextWindowTokens: z.ZodOptional<z.ZodNumber>;
+    schemaVersion: z.ZodOptional<z.ZodLiteral<1>>;
+    aliases: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    deployment: z.ZodOptional<z.ZodObject<{
+        upstreamModelId: z.ZodString;
+        wireApi: z.ZodEnum<{
+            chat: "chat";
+            responses: "responses";
+        }>;
+    }, z.core.$strip>>;
+    executionLimits: z.ZodOptional<z.ZodObject<{
+        contextWindowTokens: z.ZodNullable<z.ZodNumber>;
+        effectiveContextWindowTokens: z.ZodNullable<z.ZodNumber>;
+        autoCompactTokenLimit: z.ZodNullable<z.ZodNumber>;
+        toolOutputTruncationTokens: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strip>>;
+    credentialSource: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        kind: z.ZodLiteral<"deployment">;
+        mechanism: z.ZodEnum<{
+            api_key: "api_key";
+            azure_ad_bearer: "azure_ad_bearer";
+        }>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"connected_subscription">;
+        provider: z.ZodLiteral<"codex">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"workspace_connection">;
+        mechanism: z.ZodLiteral<"api_key">;
+    }, z.core.$strict>]>>;
+    billing: z.ZodOptional<z.ZodObject<{
+        upstreamPayer: z.ZodEnum<{
+            workspace: "workspace";
+            deployment: "deployment";
+            connected_subscription: "connected_subscription";
+        }>;
+        metering: z.ZodEnum<{
+            external: "external";
+            opengeni_credits: "opengeni_credits";
+        }>;
+    }, z.core.$strict>>;
+    capabilities: z.ZodOptional<z.ZodObject<{
+        reasoning: z.ZodObject<{
+            upstream: z.ZodEnum<{
+                unknown: "unknown";
+                supported: "supported";
+                unsupported: "unsupported";
+            }>;
+            runnable: z.ZodBoolean;
+            efforts: z.ZodArray<z.ZodEnum<{
+                none: "none";
+                minimal: "minimal";
+                low: "low";
+                medium: "medium";
+                high: "high";
+                xhigh: "xhigh";
+            }>>;
+            defaultEffort: z.ZodNullable<z.ZodEnum<{
+                none: "none";
+                minimal: "minimal";
+                low: "low";
+                medium: "medium";
+                high: "high";
+                xhigh: "xhigh";
+            }>>;
+            required: z.ZodBoolean;
+        }, z.core.$strip>;
+        functionCalling: z.ZodObject<{
+            upstream: z.ZodEnum<{
+                unknown: "unknown";
+                supported: "supported";
+                unsupported: "unsupported";
+            }>;
+            runnable: z.ZodBoolean;
+        }, z.core.$strip>;
+        structuredOutput: z.ZodObject<{
+            upstream: z.ZodEnum<{
+                unknown: "unknown";
+                supported: "supported";
+                unsupported: "unsupported";
+            }>;
+            runnable: z.ZodBoolean;
+        }, z.core.$strip>;
+        hostedTools: z.ZodObject<{
+            webSearch: z.ZodObject<{
+                upstream: z.ZodEnum<{
+                    unknown: "unknown";
+                    supported: "supported";
+                    unsupported: "unsupported";
+                }>;
+                runnable: z.ZodBoolean;
+            }, z.core.$strip>;
+            xSearch: z.ZodObject<{
+                upstream: z.ZodEnum<{
+                    unknown: "unknown";
+                    supported: "supported";
+                    unsupported: "unsupported";
+                }>;
+                runnable: z.ZodBoolean;
+            }, z.core.$strip>;
+            codeExecution: z.ZodObject<{
+                upstream: z.ZodEnum<{
+                    unknown: "unknown";
+                    supported: "supported";
+                    unsupported: "unsupported";
+                }>;
+                runnable: z.ZodBoolean;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+        inputModalities: z.ZodArray<z.ZodEnum<{
+            text: "text";
+            image: "image";
+            audio: "audio";
+        }>>;
+        outputModalities: z.ZodArray<z.ZodEnum<{
+            text: "text";
+            image: "image";
+            audio: "audio";
+        }>>;
+        transports: z.ZodObject<{
+            sse: z.ZodObject<{
+                upstream: z.ZodEnum<{
+                    unknown: "unknown";
+                    supported: "supported";
+                    unsupported: "unsupported";
+                }>;
+                runnable: z.ZodBoolean;
+            }, z.core.$strip>;
+            responsesWebSocket: z.ZodObject<{
+                upstream: z.ZodEnum<{
+                    unknown: "unknown";
+                    supported: "supported";
+                    unsupported: "unsupported";
+                }>;
+                runnable: z.ZodBoolean;
+            }, z.core.$strip>;
+            realtimeAudio: z.ZodObject<{
+                upstream: z.ZodEnum<{
+                    unknown: "unknown";
+                    supported: "supported";
+                    unsupported: "unsupported";
+                }>;
+                runnable: z.ZodBoolean;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+        latencyModes: z.ZodArray<z.ZodObject<{
+            id: z.ZodEnum<{
+                standard: "standard";
+                priority: "priority";
+                fast: "fast";
+            }>;
+            upstream: z.ZodEnum<{
+                unknown: "unknown";
+                supported: "supported";
+                unsupported: "unsupported";
+            }>;
+            runnable: z.ZodBoolean;
+            billingMultiplierBps: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    pricing: z.ZodOptional<z.ZodObject<{
+        default: z.ZodObject<{
+            inputMicrosPerMillionTokens: z.ZodNumber;
+            cachedInputMicrosPerMillionTokens: z.ZodOptional<z.ZodNumber>;
+            outputMicrosPerMillionTokens: z.ZodNumber;
+            marginBps: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>;
+        inputTokenTiers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            minimumInputTokens: z.ZodNumber;
+            pricing: z.ZodObject<{
+                inputMicrosPerMillionTokens: z.ZodNumber;
+                cachedInputMicrosPerMillionTokens: z.ZodOptional<z.ZodNumber>;
+                outputMicrosPerMillionTokens: z.ZodNumber;
+                marginBps: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+    definitionVersion: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 type ClientModel = z.infer<typeof ClientModel>;
+declare const ModelCredentialReadinessV1: z.ZodObject<{
+    status: z.ZodEnum<{
+        error: "error";
+        ready: "ready";
+        not_ready: "not_ready";
+    }>;
+    reason: z.ZodNullable<z.ZodEnum<{
+        needs_reauth: "needs_reauth";
+        missing_credential: "missing_credential";
+        prerequisites_missing: "prerequisites_missing";
+        resolver_error: "resolver_error";
+        observation_stale: "observation_stale";
+    }>>;
+    basis: z.ZodEnum<{
+        connection: "connection";
+        configuration: "configuration";
+        resolver: "resolver";
+    }>;
+    checkedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+type ModelCredentialReadinessV1 = z.infer<typeof ModelCredentialReadinessV1>;
+declare const ModelAvailabilityV1: z.ZodObject<{
+    status: z.ZodEnum<{
+        unknown: "unknown";
+        available: "available";
+        unavailable: "unavailable";
+        degraded: "degraded";
+    }>;
+    selectable: z.ZodBoolean;
+    reason: z.ZodNullable<z.ZodEnum<{
+        policy_blocked: "policy_blocked";
+        needs_reauth: "needs_reauth";
+        unsupported: "unsupported";
+        missing_credential: "missing_credential";
+        credential_not_ready: "credential_not_ready";
+        not_entitled: "not_entitled";
+        provider_unhealthy: "provider_unhealthy";
+    }>>;
+    checkedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+type ModelAvailabilityV1 = z.infer<typeof ModelAvailabilityV1>;
+declare const WorkspaceModelCatalogModel: z.ZodObject<{
+    id: z.ZodString;
+    label: z.ZodString;
+    provider: z.ZodString;
+    providerLabel: z.ZodString;
+    api: z.ZodEnum<{
+        chat: "chat";
+        responses: "responses";
+    }>;
+    contextWindowTokens: z.ZodOptional<z.ZodNumber>;
+    schemaVersion: z.ZodOptional<z.ZodLiteral<1>>;
+    aliases: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    deployment: z.ZodOptional<z.ZodObject<{
+        upstreamModelId: z.ZodString;
+        wireApi: z.ZodEnum<{
+            chat: "chat";
+            responses: "responses";
+        }>;
+    }, z.core.$strip>>;
+    executionLimits: z.ZodOptional<z.ZodObject<{
+        contextWindowTokens: z.ZodNullable<z.ZodNumber>;
+        effectiveContextWindowTokens: z.ZodNullable<z.ZodNumber>;
+        autoCompactTokenLimit: z.ZodNullable<z.ZodNumber>;
+        toolOutputTruncationTokens: z.ZodNullable<z.ZodNumber>;
+    }, z.core.$strip>>;
+    credentialSource: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+        kind: z.ZodLiteral<"deployment">;
+        mechanism: z.ZodEnum<{
+            api_key: "api_key";
+            azure_ad_bearer: "azure_ad_bearer";
+        }>;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"connected_subscription">;
+        provider: z.ZodLiteral<"codex">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"workspace_connection">;
+        mechanism: z.ZodLiteral<"api_key">;
+    }, z.core.$strict>]>>;
+    billing: z.ZodOptional<z.ZodObject<{
+        upstreamPayer: z.ZodEnum<{
+            workspace: "workspace";
+            deployment: "deployment";
+            connected_subscription: "connected_subscription";
+        }>;
+        metering: z.ZodEnum<{
+            external: "external";
+            opengeni_credits: "opengeni_credits";
+        }>;
+    }, z.core.$strict>>;
+    capabilities: z.ZodOptional<z.ZodObject<{
+        reasoning: z.ZodObject<{
+            upstream: z.ZodEnum<{
+                unknown: "unknown";
+                supported: "supported";
+                unsupported: "unsupported";
+            }>;
+            runnable: z.ZodBoolean;
+            efforts: z.ZodArray<z.ZodEnum<{
+                none: "none";
+                minimal: "minimal";
+                low: "low";
+                medium: "medium";
+                high: "high";
+                xhigh: "xhigh";
+            }>>;
+            defaultEffort: z.ZodNullable<z.ZodEnum<{
+                none: "none";
+                minimal: "minimal";
+                low: "low";
+                medium: "medium";
+                high: "high";
+                xhigh: "xhigh";
+            }>>;
+            required: z.ZodBoolean;
+        }, z.core.$strip>;
+        functionCalling: z.ZodObject<{
+            upstream: z.ZodEnum<{
+                unknown: "unknown";
+                supported: "supported";
+                unsupported: "unsupported";
+            }>;
+            runnable: z.ZodBoolean;
+        }, z.core.$strip>;
+        structuredOutput: z.ZodObject<{
+            upstream: z.ZodEnum<{
+                unknown: "unknown";
+                supported: "supported";
+                unsupported: "unsupported";
+            }>;
+            runnable: z.ZodBoolean;
+        }, z.core.$strip>;
+        hostedTools: z.ZodObject<{
+            webSearch: z.ZodObject<{
+                upstream: z.ZodEnum<{
+                    unknown: "unknown";
+                    supported: "supported";
+                    unsupported: "unsupported";
+                }>;
+                runnable: z.ZodBoolean;
+            }, z.core.$strip>;
+            xSearch: z.ZodObject<{
+                upstream: z.ZodEnum<{
+                    unknown: "unknown";
+                    supported: "supported";
+                    unsupported: "unsupported";
+                }>;
+                runnable: z.ZodBoolean;
+            }, z.core.$strip>;
+            codeExecution: z.ZodObject<{
+                upstream: z.ZodEnum<{
+                    unknown: "unknown";
+                    supported: "supported";
+                    unsupported: "unsupported";
+                }>;
+                runnable: z.ZodBoolean;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+        inputModalities: z.ZodArray<z.ZodEnum<{
+            text: "text";
+            image: "image";
+            audio: "audio";
+        }>>;
+        outputModalities: z.ZodArray<z.ZodEnum<{
+            text: "text";
+            image: "image";
+            audio: "audio";
+        }>>;
+        transports: z.ZodObject<{
+            sse: z.ZodObject<{
+                upstream: z.ZodEnum<{
+                    unknown: "unknown";
+                    supported: "supported";
+                    unsupported: "unsupported";
+                }>;
+                runnable: z.ZodBoolean;
+            }, z.core.$strip>;
+            responsesWebSocket: z.ZodObject<{
+                upstream: z.ZodEnum<{
+                    unknown: "unknown";
+                    supported: "supported";
+                    unsupported: "unsupported";
+                }>;
+                runnable: z.ZodBoolean;
+            }, z.core.$strip>;
+            realtimeAudio: z.ZodObject<{
+                upstream: z.ZodEnum<{
+                    unknown: "unknown";
+                    supported: "supported";
+                    unsupported: "unsupported";
+                }>;
+                runnable: z.ZodBoolean;
+            }, z.core.$strip>;
+        }, z.core.$strip>;
+        latencyModes: z.ZodArray<z.ZodObject<{
+            id: z.ZodEnum<{
+                standard: "standard";
+                priority: "priority";
+                fast: "fast";
+            }>;
+            upstream: z.ZodEnum<{
+                unknown: "unknown";
+                supported: "supported";
+                unsupported: "unsupported";
+            }>;
+            runnable: z.ZodBoolean;
+            billingMultiplierBps: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    pricing: z.ZodOptional<z.ZodObject<{
+        default: z.ZodObject<{
+            inputMicrosPerMillionTokens: z.ZodNumber;
+            cachedInputMicrosPerMillionTokens: z.ZodOptional<z.ZodNumber>;
+            outputMicrosPerMillionTokens: z.ZodNumber;
+            marginBps: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>;
+        inputTokenTiers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            minimumInputTokens: z.ZodNumber;
+            pricing: z.ZodObject<{
+                inputMicrosPerMillionTokens: z.ZodNumber;
+                cachedInputMicrosPerMillionTokens: z.ZodOptional<z.ZodNumber>;
+                outputMicrosPerMillionTokens: z.ZodNumber;
+                marginBps: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+    definitionVersion: z.ZodOptional<z.ZodString>;
+    credentialReadiness: z.ZodObject<{
+        status: z.ZodEnum<{
+            error: "error";
+            ready: "ready";
+            not_ready: "not_ready";
+        }>;
+        reason: z.ZodNullable<z.ZodEnum<{
+            needs_reauth: "needs_reauth";
+            missing_credential: "missing_credential";
+            prerequisites_missing: "prerequisites_missing";
+            resolver_error: "resolver_error";
+            observation_stale: "observation_stale";
+        }>>;
+        basis: z.ZodEnum<{
+            connection: "connection";
+            configuration: "configuration";
+            resolver: "resolver";
+        }>;
+        checkedAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+    availability: z.ZodObject<{
+        status: z.ZodEnum<{
+            unknown: "unknown";
+            available: "available";
+            unavailable: "unavailable";
+            degraded: "degraded";
+        }>;
+        selectable: z.ZodBoolean;
+        reason: z.ZodNullable<z.ZodEnum<{
+            policy_blocked: "policy_blocked";
+            needs_reauth: "needs_reauth";
+            unsupported: "unsupported";
+            missing_credential: "missing_credential";
+            credential_not_ready: "credential_not_ready";
+            not_entitled: "not_entitled";
+            provider_unhealthy: "provider_unhealthy";
+        }>>;
+        checkedAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+type WorkspaceModelCatalogModel = z.infer<typeof WorkspaceModelCatalogModel>;
+declare const WorkspaceModelCatalogResponse: z.ZodObject<{
+    models: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodString;
+        provider: z.ZodString;
+        providerLabel: z.ZodString;
+        api: z.ZodEnum<{
+            chat: "chat";
+            responses: "responses";
+        }>;
+        contextWindowTokens: z.ZodOptional<z.ZodNumber>;
+        schemaVersion: z.ZodOptional<z.ZodLiteral<1>>;
+        aliases: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        deployment: z.ZodOptional<z.ZodObject<{
+            upstreamModelId: z.ZodString;
+            wireApi: z.ZodEnum<{
+                chat: "chat";
+                responses: "responses";
+            }>;
+        }, z.core.$strip>>;
+        executionLimits: z.ZodOptional<z.ZodObject<{
+            contextWindowTokens: z.ZodNullable<z.ZodNumber>;
+            effectiveContextWindowTokens: z.ZodNullable<z.ZodNumber>;
+            autoCompactTokenLimit: z.ZodNullable<z.ZodNumber>;
+            toolOutputTruncationTokens: z.ZodNullable<z.ZodNumber>;
+        }, z.core.$strip>>;
+        credentialSource: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            kind: z.ZodLiteral<"deployment">;
+            mechanism: z.ZodEnum<{
+                api_key: "api_key";
+                azure_ad_bearer: "azure_ad_bearer";
+            }>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"connected_subscription">;
+            provider: z.ZodLiteral<"codex">;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"workspace_connection">;
+            mechanism: z.ZodLiteral<"api_key">;
+        }, z.core.$strict>]>>;
+        billing: z.ZodOptional<z.ZodObject<{
+            upstreamPayer: z.ZodEnum<{
+                workspace: "workspace";
+                deployment: "deployment";
+                connected_subscription: "connected_subscription";
+            }>;
+            metering: z.ZodEnum<{
+                external: "external";
+                opengeni_credits: "opengeni_credits";
+            }>;
+        }, z.core.$strict>>;
+        capabilities: z.ZodOptional<z.ZodObject<{
+            reasoning: z.ZodObject<{
+                upstream: z.ZodEnum<{
+                    unknown: "unknown";
+                    supported: "supported";
+                    unsupported: "unsupported";
+                }>;
+                runnable: z.ZodBoolean;
+                efforts: z.ZodArray<z.ZodEnum<{
+                    none: "none";
+                    minimal: "minimal";
+                    low: "low";
+                    medium: "medium";
+                    high: "high";
+                    xhigh: "xhigh";
+                }>>;
+                defaultEffort: z.ZodNullable<z.ZodEnum<{
+                    none: "none";
+                    minimal: "minimal";
+                    low: "low";
+                    medium: "medium";
+                    high: "high";
+                    xhigh: "xhigh";
+                }>>;
+                required: z.ZodBoolean;
+            }, z.core.$strip>;
+            functionCalling: z.ZodObject<{
+                upstream: z.ZodEnum<{
+                    unknown: "unknown";
+                    supported: "supported";
+                    unsupported: "unsupported";
+                }>;
+                runnable: z.ZodBoolean;
+            }, z.core.$strip>;
+            structuredOutput: z.ZodObject<{
+                upstream: z.ZodEnum<{
+                    unknown: "unknown";
+                    supported: "supported";
+                    unsupported: "unsupported";
+                }>;
+                runnable: z.ZodBoolean;
+            }, z.core.$strip>;
+            hostedTools: z.ZodObject<{
+                webSearch: z.ZodObject<{
+                    upstream: z.ZodEnum<{
+                        unknown: "unknown";
+                        supported: "supported";
+                        unsupported: "unsupported";
+                    }>;
+                    runnable: z.ZodBoolean;
+                }, z.core.$strip>;
+                xSearch: z.ZodObject<{
+                    upstream: z.ZodEnum<{
+                        unknown: "unknown";
+                        supported: "supported";
+                        unsupported: "unsupported";
+                    }>;
+                    runnable: z.ZodBoolean;
+                }, z.core.$strip>;
+                codeExecution: z.ZodObject<{
+                    upstream: z.ZodEnum<{
+                        unknown: "unknown";
+                        supported: "supported";
+                        unsupported: "unsupported";
+                    }>;
+                    runnable: z.ZodBoolean;
+                }, z.core.$strip>;
+            }, z.core.$strip>;
+            inputModalities: z.ZodArray<z.ZodEnum<{
+                text: "text";
+                image: "image";
+                audio: "audio";
+            }>>;
+            outputModalities: z.ZodArray<z.ZodEnum<{
+                text: "text";
+                image: "image";
+                audio: "audio";
+            }>>;
+            transports: z.ZodObject<{
+                sse: z.ZodObject<{
+                    upstream: z.ZodEnum<{
+                        unknown: "unknown";
+                        supported: "supported";
+                        unsupported: "unsupported";
+                    }>;
+                    runnable: z.ZodBoolean;
+                }, z.core.$strip>;
+                responsesWebSocket: z.ZodObject<{
+                    upstream: z.ZodEnum<{
+                        unknown: "unknown";
+                        supported: "supported";
+                        unsupported: "unsupported";
+                    }>;
+                    runnable: z.ZodBoolean;
+                }, z.core.$strip>;
+                realtimeAudio: z.ZodObject<{
+                    upstream: z.ZodEnum<{
+                        unknown: "unknown";
+                        supported: "supported";
+                        unsupported: "unsupported";
+                    }>;
+                    runnable: z.ZodBoolean;
+                }, z.core.$strip>;
+            }, z.core.$strip>;
+            latencyModes: z.ZodArray<z.ZodObject<{
+                id: z.ZodEnum<{
+                    standard: "standard";
+                    priority: "priority";
+                    fast: "fast";
+                }>;
+                upstream: z.ZodEnum<{
+                    unknown: "unknown";
+                    supported: "supported";
+                    unsupported: "unsupported";
+                }>;
+                runnable: z.ZodBoolean;
+                billingMultiplierBps: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        pricing: z.ZodOptional<z.ZodObject<{
+            default: z.ZodObject<{
+                inputMicrosPerMillionTokens: z.ZodNumber;
+                cachedInputMicrosPerMillionTokens: z.ZodOptional<z.ZodNumber>;
+                outputMicrosPerMillionTokens: z.ZodNumber;
+                marginBps: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>;
+            inputTokenTiers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                minimumInputTokens: z.ZodNumber;
+                pricing: z.ZodObject<{
+                    inputMicrosPerMillionTokens: z.ZodNumber;
+                    cachedInputMicrosPerMillionTokens: z.ZodOptional<z.ZodNumber>;
+                    outputMicrosPerMillionTokens: z.ZodNumber;
+                    marginBps: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strip>;
+            }, z.core.$strip>>>;
+        }, z.core.$strip>>;
+        definitionVersion: z.ZodOptional<z.ZodString>;
+        credentialReadiness: z.ZodObject<{
+            status: z.ZodEnum<{
+                error: "error";
+                ready: "ready";
+                not_ready: "not_ready";
+            }>;
+            reason: z.ZodNullable<z.ZodEnum<{
+                needs_reauth: "needs_reauth";
+                missing_credential: "missing_credential";
+                prerequisites_missing: "prerequisites_missing";
+                resolver_error: "resolver_error";
+                observation_stale: "observation_stale";
+            }>>;
+            basis: z.ZodEnum<{
+                connection: "connection";
+                configuration: "configuration";
+                resolver: "resolver";
+            }>;
+            checkedAt: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>;
+        availability: z.ZodObject<{
+            status: z.ZodEnum<{
+                unknown: "unknown";
+                available: "available";
+                unavailable: "unavailable";
+                degraded: "degraded";
+            }>;
+            selectable: z.ZodBoolean;
+            reason: z.ZodNullable<z.ZodEnum<{
+                policy_blocked: "policy_blocked";
+                needs_reauth: "needs_reauth";
+                unsupported: "unsupported";
+                missing_credential: "missing_credential";
+                credential_not_ready: "credential_not_ready";
+                not_entitled: "not_entitled";
+                provider_unhealthy: "provider_unhealthy";
+            }>>;
+            checkedAt: z.ZodNullable<z.ZodString>;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type WorkspaceModelCatalogResponse = z.infer<typeof WorkspaceModelCatalogResponse>;
 /**
  * Exact public HTTP protocol revision spoken by this release train.
  *
@@ -10485,6 +12132,182 @@ declare const ClientConfig: z.ZodObject<{
             responses: "responses";
         }>;
         contextWindowTokens: z.ZodOptional<z.ZodNumber>;
+        schemaVersion: z.ZodOptional<z.ZodLiteral<1>>;
+        aliases: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        deployment: z.ZodOptional<z.ZodObject<{
+            upstreamModelId: z.ZodString;
+            wireApi: z.ZodEnum<{
+                chat: "chat";
+                responses: "responses";
+            }>;
+        }, z.core.$strip>>;
+        executionLimits: z.ZodOptional<z.ZodObject<{
+            contextWindowTokens: z.ZodNullable<z.ZodNumber>;
+            effectiveContextWindowTokens: z.ZodNullable<z.ZodNumber>;
+            autoCompactTokenLimit: z.ZodNullable<z.ZodNumber>;
+            toolOutputTruncationTokens: z.ZodNullable<z.ZodNumber>;
+        }, z.core.$strip>>;
+        credentialSource: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
+            kind: z.ZodLiteral<"deployment">;
+            mechanism: z.ZodEnum<{
+                api_key: "api_key";
+                azure_ad_bearer: "azure_ad_bearer";
+            }>;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"connected_subscription">;
+            provider: z.ZodLiteral<"codex">;
+        }, z.core.$strict>, z.ZodObject<{
+            kind: z.ZodLiteral<"workspace_connection">;
+            mechanism: z.ZodLiteral<"api_key">;
+        }, z.core.$strict>]>>;
+        billing: z.ZodOptional<z.ZodObject<{
+            upstreamPayer: z.ZodEnum<{
+                workspace: "workspace";
+                deployment: "deployment";
+                connected_subscription: "connected_subscription";
+            }>;
+            metering: z.ZodEnum<{
+                external: "external";
+                opengeni_credits: "opengeni_credits";
+            }>;
+        }, z.core.$strict>>;
+        capabilities: z.ZodOptional<z.ZodObject<{
+            reasoning: z.ZodObject<{
+                upstream: z.ZodEnum<{
+                    unknown: "unknown";
+                    supported: "supported";
+                    unsupported: "unsupported";
+                }>;
+                runnable: z.ZodBoolean;
+                efforts: z.ZodArray<z.ZodEnum<{
+                    none: "none";
+                    minimal: "minimal";
+                    low: "low";
+                    medium: "medium";
+                    high: "high";
+                    xhigh: "xhigh";
+                }>>;
+                defaultEffort: z.ZodNullable<z.ZodEnum<{
+                    none: "none";
+                    minimal: "minimal";
+                    low: "low";
+                    medium: "medium";
+                    high: "high";
+                    xhigh: "xhigh";
+                }>>;
+                required: z.ZodBoolean;
+            }, z.core.$strip>;
+            functionCalling: z.ZodObject<{
+                upstream: z.ZodEnum<{
+                    unknown: "unknown";
+                    supported: "supported";
+                    unsupported: "unsupported";
+                }>;
+                runnable: z.ZodBoolean;
+            }, z.core.$strip>;
+            structuredOutput: z.ZodObject<{
+                upstream: z.ZodEnum<{
+                    unknown: "unknown";
+                    supported: "supported";
+                    unsupported: "unsupported";
+                }>;
+                runnable: z.ZodBoolean;
+            }, z.core.$strip>;
+            hostedTools: z.ZodObject<{
+                webSearch: z.ZodObject<{
+                    upstream: z.ZodEnum<{
+                        unknown: "unknown";
+                        supported: "supported";
+                        unsupported: "unsupported";
+                    }>;
+                    runnable: z.ZodBoolean;
+                }, z.core.$strip>;
+                xSearch: z.ZodObject<{
+                    upstream: z.ZodEnum<{
+                        unknown: "unknown";
+                        supported: "supported";
+                        unsupported: "unsupported";
+                    }>;
+                    runnable: z.ZodBoolean;
+                }, z.core.$strip>;
+                codeExecution: z.ZodObject<{
+                    upstream: z.ZodEnum<{
+                        unknown: "unknown";
+                        supported: "supported";
+                        unsupported: "unsupported";
+                    }>;
+                    runnable: z.ZodBoolean;
+                }, z.core.$strip>;
+            }, z.core.$strip>;
+            inputModalities: z.ZodArray<z.ZodEnum<{
+                text: "text";
+                image: "image";
+                audio: "audio";
+            }>>;
+            outputModalities: z.ZodArray<z.ZodEnum<{
+                text: "text";
+                image: "image";
+                audio: "audio";
+            }>>;
+            transports: z.ZodObject<{
+                sse: z.ZodObject<{
+                    upstream: z.ZodEnum<{
+                        unknown: "unknown";
+                        supported: "supported";
+                        unsupported: "unsupported";
+                    }>;
+                    runnable: z.ZodBoolean;
+                }, z.core.$strip>;
+                responsesWebSocket: z.ZodObject<{
+                    upstream: z.ZodEnum<{
+                        unknown: "unknown";
+                        supported: "supported";
+                        unsupported: "unsupported";
+                    }>;
+                    runnable: z.ZodBoolean;
+                }, z.core.$strip>;
+                realtimeAudio: z.ZodObject<{
+                    upstream: z.ZodEnum<{
+                        unknown: "unknown";
+                        supported: "supported";
+                        unsupported: "unsupported";
+                    }>;
+                    runnable: z.ZodBoolean;
+                }, z.core.$strip>;
+            }, z.core.$strip>;
+            latencyModes: z.ZodArray<z.ZodObject<{
+                id: z.ZodEnum<{
+                    standard: "standard";
+                    priority: "priority";
+                    fast: "fast";
+                }>;
+                upstream: z.ZodEnum<{
+                    unknown: "unknown";
+                    supported: "supported";
+                    unsupported: "unsupported";
+                }>;
+                runnable: z.ZodBoolean;
+                billingMultiplierBps: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        pricing: z.ZodOptional<z.ZodObject<{
+            default: z.ZodObject<{
+                inputMicrosPerMillionTokens: z.ZodNumber;
+                cachedInputMicrosPerMillionTokens: z.ZodOptional<z.ZodNumber>;
+                outputMicrosPerMillionTokens: z.ZodNumber;
+                marginBps: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strip>;
+            inputTokenTiers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                minimumInputTokens: z.ZodNumber;
+                pricing: z.ZodObject<{
+                    inputMicrosPerMillionTokens: z.ZodNumber;
+                    cachedInputMicrosPerMillionTokens: z.ZodOptional<z.ZodNumber>;
+                    outputMicrosPerMillionTokens: z.ZodNumber;
+                    marginBps: z.ZodOptional<z.ZodNumber>;
+                }, z.core.$strip>;
+            }, z.core.$strip>>>;
+        }, z.core.$strip>>;
+        definitionVersion: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>>;
     defaultReasoningEffort: z.ZodEnum<{
         none: "none";
@@ -10566,4 +12389,4 @@ declare function evaluateWorkspaceModelPolicy(policy: WorkspaceModelPolicyContra
     modelId: string;
 }): WorkspaceModelPolicyVerdict;
 
-export { AccessContext, AccessGrant, AccountGrant, AccountRole, AcknowledgeStreamRequest, AcknowledgeStreamResponse, AddDocumentRequest, AddWorkspaceMemberRequest, type AdmitRunInput, ApiKey, AttachViewerRequest, type AuthorizeSessionInput, BillingBalance, BillingMode, type BoundSessionEventOptions, type BoundSessionEventPayloadOptions, type BoundWorkspaceControlEventOptions, CAPABILITY_DESCRIPTORS, CLEARED_RUN_STATE_BLOB, CLEARED_RUN_STATE_MARKER, CapabilityCatalogAuthKind, CapabilityCatalogItem, CapabilityCatalogResponse, CapabilityCatalogTier, type CapabilityDescriptor, CapabilityInstallation, CapabilityInstallationStatus, CapabilityKind, CapabilityPack, CapabilityPackConnector, CapabilityPackConnectorAuthModel, CapabilityPackKnowledge, CapabilityPackScheduledTaskTemplate, CapabilityPackSkill, CapabilityPackSkillFile, CapabilityRuntime, CapabilitySource, CapabilityUnavailableReason, ClearSessionContextRequest, ClientAuthConfig, ClientConfig, ClientModel, ClientSessionEvent, CompactSessionContextRequest, CompactSessionContextResult, CompleteFileUploadResponse, ComposerDraft, ConnectionCredentialBundle, type ConnectionCredentialsPort, ConnectionKind, ConnectionMetadata, ConnectionResponse, ConnectionStatus, CreateApiKeyRequest, CreateApiKeyResponse, CreateCapabilityCatalogItemRequest, CreateCheckoutRequest, CreateCheckoutResponse, CreateConnectionRequest, CreateDocumentBaseRequest, CreateFileUploadRequest, CreateFileUploadResponse, CreateKnowledgeMemoryRequest, CreateRigRequest, CreateScheduledTaskRequest, CreateSessionRequest, CreateSessionResponse, CreateSocialConnectionRequest, CreateSocialPostRequest, CreateVariableSetRequest, CreateWorkspaceEnvironmentRequest, CreateWorkspaceRequest, CredentialAuthNeededPayload, type CredentialAuthNeededReason, DESKTOP_STREAM_PORT, DelegatedAccessTokenPayload, DeleteSessionQueueItemRequest, DeviceEnrollmentApproveRequest, DeviceEnrollmentApproveResponse, DeviceEnrollmentDenyRequest, DeviceEnrollmentDenyResponse, DeviceEnrollmentLookupMachine, DeviceEnrollmentLookupRequest, DeviceEnrollmentLookupResponse, DeviceEnrollmentPollRequest, DeviceEnrollmentPollResponse, DeviceEnrollmentStartRequest, DeviceEnrollmentStartResponse, DeviceEnrollmentState, DiscoverMcpCapabilitiesResponse, Document, DocumentBase, DocumentSearchMode, DocumentSearchRequest, DocumentSearchResult, DocumentStatus, EditSessionQueueItemRequest, EffectiveControlBlocker, EffectiveControlResumeOption, EffectiveSessionControl, EnableCapabilityRequest, EnablePackRequest, EnrollTokenExchangeRequest, EnrollTokenExchangeResponse, EnrollTokenPayload, EnrollmentArch, EnrollmentBearerPayload, EnrollmentCredentialsResponse, EnrollmentOs, EnrollmentSummary, EntitlementDecision, EntitlementValue, Entitlements, EntitlementsMode, type EntitlementsPort, ErrorCode, ErrorEnvelope, FileAsset, FileDownloadUrlResponse, FileResourceRef, FileStatus, FileUploadStatus, FsChangeKind, FsChangedPayload, FsDeleteRequest, FsDeleteResponse, FsEncoding, FsListRequest, FsListResponse, FsMkdirRequest, FsMkdirResponse, FsMoveRequest, FsMoveResponse, FsNodeType, FsReadRequest, FsReadResponse, FsTreeNode, FsWriteRequest, FsWriteResponse, GetWorkspaceCaptureFileResponse, GetWorkspaceCaptureResponse, GitChangedPayload, GitCommit, GitCredentialBindingId, GitCredentialProvider, GitCredentialRepositoryRef, type GitCredentials, type GitCredentialsRequest, GitDiffHunk, GitDiffLine, GitDiffLineType, GitDiffRequest, GitDiffResponse, GitFileDiff, GitFileStatus, GitFileStatusCode, type GitHubAppApiPort, GitHubAppInfo, GitHubAppManifestCreate, GitHubInstallationBinding, type GitHubInstallationSummary, GitHubRepositoriesResponse, GitHubRepository, type GitHubRepositoryPermissions, GitHubRepositoryScope, type GitHubUserInstallationAccess, type GitHubUserRepositoryAccess, GitLogRequest, GitLogResponse, GitRepositoryAccess, GitShowRequest, GitShowResponse, GitStatusRequest, GitStatusResponse, GoalSpec, type HealthResponse, HostEventExport, HostEventExportBatch, type HostEventSink, HostExportConsumerId, HostExportCursor, HostExportInitiator, HostExportInitiatorContext, HostSessionEvent, HostUsageEvent, HostUsageExport, HostUsageExportBatch, type HostUsageSink, HumanInputAnswer, HumanInputOption, HumanInputQuestion, HumanInputQuestionKind, HumanInputRequestStatus, HumanInputResponse, IntegrationClientMetadata, KnowledgeMemory, KnowledgeMemoryKind, KnowledgeMemorySearchRequest, KnowledgeMemoryStatus, KnowledgeSourceKind, KnowledgeSourceRef, LimitAction, LimitDecision, LineageNode, ListConnectionsResponse, ListEnrollmentsResponse, ListWorkspaceMembersResponse, MachineKind, MachineMetricsSeriesResponse, MachineState, MachineView, MachinesResponse, ManagedAccount, MarketingDailyAnalysisTaskRequest, McpConnectionResourceScope, type McpCredentialAuthNeededReason, type McpCredentialResolution, type McpCredentialsRequest, McpServerConnectionRef, MetricSample, MintEnrollTokenRequest, MintEnrollTokenResponse, MoveSessionQueueItemRequest, OAuthStartRequest, OAuthStartResponse, OPENGENI_API_CONTRACT_HEADER, OPENGENI_API_CONTRACT_REVISION, OPENGENI_HOST_EXPORT_SCHEMA_REVISION, PackInstallation, PackInstallationStatus, Permission, type PortExposureKind, ProductAccessMode, ProposeRigChangeRequest, PtyCloseRequest, PtyOpenRequest, PtyOpenResponse, PtyResizeRequest, PtyWriteRequest, ReasoningEffort, RecordingAvailablePayload, RecordingCodec, RecordingContentType, RecordingFailedPayload, RecordingFailedReason, RecordingMode, RecordingStartedPayload, RegisterCapabilityPackRequest, RelayTokenPayload, RepositoryResourceRef, RequestHumanInputToolInput, type ResolveSessionAuthorizationListScopeInput, type ResolveSessionEventTypeFiltersInput, ResourceMountPathError, ResourceRef, ResourceRefConflictError, RevokeEnrollmentResponse, Rig, RigChange, RigChangeKind, RigChangeStatus, RigChangeVerification, RigCheck, RigCheckResult, RigDefinitionEditPayload, RigSetupAppendPayload, RigVerificationHealth, RigVersion, type RunCredentialAuthNeeded, type RunCredentialFile, type RunCredentialRedaction, type RunCredentialsRequest, type RunCredentialsResolution, SESSION_AUTHORIZATION_LIST_SCOPE_MAX_IDS, SESSION_EVENT_CLIENT_EVENT_ID_MAX_BYTES, SESSION_EVENT_DUPLICATE_REASON_MAX_BYTES, SESSION_EVENT_ENVELOPE_MAX_BYTES, SESSION_EVENT_PAYLOAD_MAX_BYTES, SESSION_EVENT_RAW_DELTA_TYPES, SESSION_EVENT_SEMANTIC_CLASS_TYPES, SESSION_EVENT_TURN_ASSOCIATION_MAX_BYTES, SESSION_EVENT_TYPE_MAX_BYTES, SESSION_OPERATION_KEY_MAX_CHARS, SandboxBackend, SandboxCapabilityName, SandboxCommandOutputDeltaPayload, SandboxOs, type SandboxSecrets, type SandboxSecretsRequest, SaveComposerDraftRequest, ScheduledTask, ScheduledTaskAgentConfig, ScheduledTaskOverlapPolicy, ScheduledTaskRun, ScheduledTaskRunMode, ScheduledTaskRunStatus, ScheduledTaskScheduleSpec, ScheduledTaskStatus, ScheduledTaskTriggerType, ServiceTurnInitiator, ServiceTurnInitiatorContext, Session, SessionAuthorizationActor, SessionAuthorizationDecision, SessionAuthorizationListScope, SessionAuthorizationOperation, type SessionAuthorizationPort, SessionAuthorizationSurface, SessionAuthorizationTarget, SessionBusMessage, SessionCapabilities, SessionCommandReceipt, SessionControlRequest, SessionControlResponse, SessionControlState, SessionEvent, type SessionEventBoundarySurface, type SessionEventJsonMeasurement, type SessionEventMediaPreview, SessionEventPayloadMode, type SessionEventPayloadTruncation, SessionEventReadDirection, SessionEventReadMode, SessionEventSemanticClass, SessionEventType, SessionGoal, SessionGoalCreatedBy, SessionGoalPausedReason, SessionGoalStatus, SessionHumanInputRequest, SessionLineageResponse, SessionListResponse, SessionMcpCredentialUpdateInput, SessionMcpServerInput, SessionMcpServerMetadata, SessionQueueMutationResponse, SessionQueueSnapshot, SessionStatus, SessionStructuredCapabilities, type SessionSummary, SessionSystemUpdate, SessionSystemUpdateKind, SessionSystemUpdatePayload, SessionSystemUpdateState, SessionTurn, SessionTurnSource, SessionTurnStatus, SetVariableSetVariableRequest, SetWorkspaceDefaultRigRequest, SetWorkspaceEnvironmentVariableRequest, SocialConnection, SocialConnectionStatus, SocialPost, SocialProvider, StaticUsageLimits, SteerSessionMessageRequest, SteerSessionMessageResponse, SteerSessionQueueItemRequest, StreamClosedPayload, StreamOpenedPayload, StreamRevokedPayload, StreamTokenPayload, StreamUrlRotatedPayload, SubmitHumanInputResponseRequest, SwapActiveSandboxRequest, SwapActiveSandboxResponse, SystemUpdateClassification, TERMINAL_STREAM_PORT, TerminalExecRequest, TerminalExecResponse, TerminalPtyExitedPayload, TerminalPtyOutputDeltaPayload, TerminalPtyStartedPayload, ToolAuthNeededPayload, ToolRef, TranscriptionErrorCode, TranscriptionEvent, TranscriptionResultMetadata, TranscriptionSpeaker, TranscriptionTimeSpan, TranscriptionWord, TriggerScheduledTaskRequest, TurnInitiator, TurnInitiatorContext, UNATTRIBUTED_LEGACY_INITIATOR_SUBJECT_ID, UpdateConnectionRequest, UpdateKnowledgeMemoryRequest, UpdateRigRequest, UpdateScheduledTaskRequest, UpdateSessionGoalRequest, UpdateSessionPinRequest, UpdateSessionRequest, UpdateVariableSetRequest, UpdateWorkspaceEnvironmentRequest, UpdateWorkspaceMemberRequest, UpdateWorkspaceModelPolicyRequest, UpdateWorkspaceRequest, UpdateWorkspaceSettingsRequest, UsageEvent, UsageEventType, UsageLimitsMode, VariableSet, VariableSetVariableMetadata, VariableSetVariableName, ViewerHeartbeatRequest, ViewerHeartbeatResponse, ViewerHolder, WORKSPACE_CONTROL_ACTOR_MAX_BYTES, WORKSPACE_CONTROL_EVENT_MAX_BYTES, WORKSPACE_CONTROL_REASON_MAX_BYTES, Workspace, WorkspaceCaptureDegradedReason, WorkspaceCaptureFile, WorkspaceCaptureManifest, WorkspaceCaptureRepo, WorkspaceCaptureSignedUrl, WorkspaceCaptureStats, type WorkspaceControlBoundarySurface, WorkspaceControlEvent, WorkspaceControlEventTruncation, WorkspaceEnvironment, WorkspaceEnvironmentVariableMetadata, WorkspaceInferenceControlRequest, WorkspaceInferenceControlResponse, WorkspaceInferenceState, WorkspaceMember, WorkspaceMemorySearchMode, WorkspaceMemorySearchRequest, WorkspaceMemorySearchResponse, WorkspaceMemorySearchResult, type WorkspaceModelPolicyContract, type WorkspaceModelPolicyVerdict, WorkspaceRegisteredPack, WorkspaceRevisionCapturedPayload, WorkspaceRevisionDegradedPayload, type WorkspaceSettings, WorkspaceSettingsSchema, WorkspaceTranscriptionPolicy, WorkspaceTranscriptionTarget, approvalIdentifier, approximateSessionEventTokens, assertUniqueResourceMountPaths, boundSessionEvent, boundSessionEventPayload, boundWorkspaceControlEvent, defaultRepositoryMountPath, evaluateWorkspaceModelPolicy, gitCredentialBindingIdForRepository, gitCredentialProviderForRepository, isClearedRunStateBlob, measureSessionEventJson, mergeResourceRefs, mergeToolRefs, normalizeRepositorySubpath, normalizeResourceMountPath, prefixedMcpToolName, reasoningEffortForMetadata, resolveSessionEventTypeFilters, resolveWorkspaceMemoryEnabled, resourceIdentityKey, resourceMountPath, resourceMountPathCollisionKey, sessionEventJsonBytes, sessionEventMediaPreview, sessionEventMediaPreviewFromDataUrl, sessionEventPayloadTruncation, signDelegatedAccessToken, signEnrollToken, signEnrollmentBearer, signRelayToken, signStreamToken, stableJson, verifyDelegatedAccessToken, verifyEnrollToken, verifyEnrollmentBearer, verifyRelayToken, verifyStreamToken, workspaceControlUtf8Bytes };
+export { AccessContext, AccessGrant, AccountGrant, AccountRole, AcknowledgeStreamRequest, AcknowledgeStreamResponse, AddDocumentRequest, AddWorkspaceMemberRequest, type AdmitRunInput, ApiKey, AttachViewerRequest, type AuthorizeSessionInput, BillingBalance, BillingMode, type BoundSessionEventOptions, type BoundSessionEventPayloadOptions, type BoundWorkspaceControlEventOptions, CAPABILITY_DESCRIPTORS, CLEARED_RUN_STATE_BLOB, CLEARED_RUN_STATE_MARKER, CapabilityCatalogAuthKind, CapabilityCatalogItem, CapabilityCatalogResponse, CapabilityCatalogTier, type CapabilityDescriptor, CapabilityInstallation, CapabilityInstallationStatus, CapabilityKind, CapabilityPack, CapabilityPackConnector, CapabilityPackConnectorAuthModel, CapabilityPackKnowledge, CapabilityPackScheduledTaskTemplate, CapabilityPackSkill, CapabilityPackSkillFile, CapabilityRuntime, CapabilitySource, CapabilityUnavailableReason, ClearSessionContextRequest, ClientAuthConfig, ClientConfig, ClientModel, ClientSessionEvent, CompactSessionContextRequest, CompactSessionContextResult, CompleteFileUploadResponse, ComposerDraft, ConnectionCredentialBundle, type ConnectionCredentialsPort, ConnectionKind, ConnectionMetadata, ConnectionResponse, ConnectionStatus, CreateApiKeyRequest, CreateApiKeyResponse, CreateCapabilityCatalogItemRequest, CreateCheckoutRequest, CreateCheckoutResponse, CreateConnectionRequest, CreateDocumentBaseRequest, CreateFileUploadRequest, CreateFileUploadResponse, CreateKnowledgeMemoryRequest, CreateRigRequest, CreateScheduledTaskRequest, CreateSessionRequest, CreateSessionResponse, CreateSocialConnectionRequest, CreateSocialPostRequest, CreateVariableSetRequest, CreateWorkspaceEnvironmentRequest, CreateWorkspaceRequest, CredentialAuthNeededPayload, type CredentialAuthNeededReason, DEFAULT_FIRST_PARTY_MCP_PERMISSIONS, DESKTOP_STREAM_PORT, DelegatedAccessTokenPayload, DeleteSessionQueueItemRequest, DeviceEnrollmentApproveRequest, DeviceEnrollmentApproveResponse, DeviceEnrollmentDenyRequest, DeviceEnrollmentDenyResponse, DeviceEnrollmentLookupMachine, DeviceEnrollmentLookupRequest, DeviceEnrollmentLookupResponse, DeviceEnrollmentPollRequest, DeviceEnrollmentPollResponse, DeviceEnrollmentStartRequest, DeviceEnrollmentStartResponse, DeviceEnrollmentState, DiscoverMcpCapabilitiesResponse, Document, DocumentBase, DocumentSearchMode, DocumentSearchRequest, DocumentSearchResult, DocumentStatus, EditSessionQueueItemRequest, EffectiveControlBlocker, EffectiveControlResumeOption, EffectiveSessionControl, EnableCapabilityRequest, EnablePackRequest, EnrollTokenExchangeRequest, EnrollTokenExchangeResponse, EnrollTokenPayload, EnrollmentArch, EnrollmentBearerPayload, EnrollmentCredentialsResponse, EnrollmentOs, EnrollmentSummary, EntitlementDecision, EntitlementValue, Entitlements, EntitlementsMode, type EntitlementsPort, ErrorCode, ErrorEnvelope, FileAsset, FileDownloadUrlResponse, FileResourceRef, FileStatus, FileUploadStatus, FsChangeKind, FsChangedPayload, FsDeleteRequest, FsDeleteResponse, FsEncoding, FsListRequest, FsListResponse, FsMkdirRequest, FsMkdirResponse, FsMoveRequest, FsMoveResponse, FsNodeType, FsReadRequest, FsReadResponse, FsTreeNode, FsWriteRequest, FsWriteResponse, GetWorkspaceCaptureFileResponse, GetWorkspaceCaptureResponse, GitChangedPayload, GitCommit, GitCredentialBindingId, GitCredentialProvider, GitCredentialRepositoryRef, type GitCredentialTransport, type GitCredentials, type GitCredentialsRequest, GitDiffHunk, GitDiffLine, GitDiffLineType, GitDiffRequest, GitDiffResponse, GitFileDiff, GitFileStatus, GitFileStatusCode, type GitHttpBrokerRepositoryRoute, type GitHubAppApiPort, GitHubAppInfo, GitHubAppManifestCreate, GitHubInstallationBinding, type GitHubInstallationSummary, GitHubRepositoriesResponse, GitHubRepository, type GitHubRepositoryPermissions, GitHubRepositoryScope, type GitHubUserInstallationAccess, type GitHubUserRepositoryAccess, GitLogRequest, GitLogResponse, GitRepositoryAccess, GitShowRequest, GitShowResponse, GitStatusRequest, GitStatusResponse, GoalSpec, type HealthResponse, HostEventExport, HostEventExportBatch, type HostEventSink, HostExportConsumerId, HostExportCursor, HostExportInitiator, HostExportInitiatorContext, HostSessionEvent, HostUsageEvent, HostUsageExport, HostUsageExportBatch, type HostUsageSink, HumanInputAnswer, HumanInputOption, HumanInputQuestion, HumanInputQuestionKind, HumanInputRequestStatus, HumanInputResponse, IntegrationClientMetadata, KnowledgeMemory, KnowledgeMemoryKind, KnowledgeMemorySearchRequest, KnowledgeMemoryStatus, KnowledgeSourceKind, KnowledgeSourceRef, LimitAction, LimitDecision, LineageNode, ListConnectionsResponse, ListEnrollmentsResponse, ListWorkspaceMembersResponse, MachineKind, MachineMetricsSeriesResponse, MachineState, MachineView, MachinesResponse, ManagedAccount, MarketingDailyAnalysisTaskRequest, McpConnectionResourceScope, type McpCredentialAuthNeededReason, type McpCredentialResolution, type McpCredentialsRequest, McpServerConnectionRef, MetricSample, MintEnrollTokenRequest, MintEnrollTokenResponse, ModelAvailabilityV1, ModelBillingAttributionV1, ModelCapabilitiesV1, ModelCapabilityStateV1, ModelCapabilitySupportV1, ModelCredentialReadinessV1, ModelCredentialSourceV1, ModelPricingScheduleV1, ModelPricingV1, MoveSessionQueueItemRequest, OAuthStartRequest, OAuthStartResponse, OPENGENI_API_CONTRACT_HEADER, OPENGENI_API_CONTRACT_REVISION, OPENGENI_HOST_EXPORT_SCHEMA_REVISION, PackInstallation, PackInstallationStatus, Permission, type PortExposureKind, ProductAccessMode, ProposeRigChangeRequest, PtyCloseRequest, PtyOpenRequest, PtyOpenResponse, PtyResizeRequest, PtyWriteRequest, RETAINED_OUTPUT_DEFAULT_PAGE_BYTES, RETAINED_OUTPUT_MAX_PAGE_BYTES, RETAINED_OUTPUT_RECEIPT_MAX_BYTES, ReasoningEffort, RecordingAvailablePayload, RecordingCodec, RecordingContentType, RecordingFailedPayload, RecordingFailedReason, RecordingMode, RecordingStartedPayload, RegisterCapabilityPackRequest, RelayTokenPayload, RepositoryResourceRef, RequestHumanInputToolInput, type ResolveSessionAuthorizationListScopeInput, type ResolveSessionEventTypeFiltersInput, ResourceMountPathError, ResourceRef, ResourceRefConflictError, type RetainedArtifactFileInput, type RetainedArtifactMetadata, RetainedArtifactMetadataSchema, type RetainedArtifactReference, RetainedArtifactReferenceSchema, type RetainedArtifactUnavailable, RetainedArtifactUnavailableSchema, type RetainedOutputAvailableEvidence, type RetainedOutputEvidence, RetainedOutputEvidenceSchema, RetainedOutputKind, type RetainedOutputRangeResolution, type RetainedOutputResolvedRange, RetainedOutputUnavailableReason, RevokeEnrollmentResponse, Rig, RigChange, RigChangeKind, RigChangeStatus, RigChangeVerification, RigCheck, RigCheckResult, RigDefinitionEditPayload, RigSetupAppendPayload, RigVerificationHealth, RigVersion, type RunCredentialAuthNeeded, type RunCredentialFile, type RunCredentialRedaction, type RunCredentialsRequest, type RunCredentialsResolution, SESSION_AUTHORIZATION_LIST_SCOPE_MAX_IDS, SESSION_EFFECTIVE_TOOL_POLICY_ID_LIMIT, SESSION_EFFECTIVE_TOOL_POLICY_ID_MAX_LENGTH, SESSION_EVENT_CLIENT_EVENT_ID_MAX_BYTES, SESSION_EVENT_DUPLICATE_REASON_MAX_BYTES, SESSION_EVENT_ENVELOPE_MAX_BYTES, SESSION_EVENT_PAYLOAD_MAX_BYTES, SESSION_EVENT_RAW_DELTA_TYPES, SESSION_EVENT_SEMANTIC_CLASS_TYPES, SESSION_EVENT_TURN_ASSOCIATION_MAX_BYTES, SESSION_EVENT_TYPE_MAX_BYTES, SESSION_MCP_APPROVAL_POLICY_MAX_BYTES, SESSION_MCP_APPROVAL_POLICY_MAX_TOOL_NAMES, SESSION_MCP_APPROVAL_TOOL_NAME_MAX_BYTES, SESSION_MCP_SERVERS_MAX, SESSION_OPERATION_KEY_MAX_CHARS, SandboxBackend, SandboxCapabilityName, SandboxCommandOutputDeltaPayload, SandboxOs, type SandboxSecrets, type SandboxSecretsRequest, SaveComposerDraftRequest, ScheduledTask, ScheduledTaskAgentConfig, ScheduledTaskOverlapPolicy, ScheduledTaskRun, ScheduledTaskRunMode, ScheduledTaskRunStatus, ScheduledTaskScheduleSpec, ScheduledTaskStatus, ScheduledTaskTriggerType, ServiceTurnInitiator, ServiceTurnInitiatorContext, Session, SessionAuthorizationActor, SessionAuthorizationDecision, SessionAuthorizationListScope, SessionAuthorizationOperation, type SessionAuthorizationPort, SessionAuthorizationSurface, SessionAuthorizationTarget, SessionBusMessage, SessionCapabilities, SessionCommandReceipt, SessionControlRequest, SessionControlResponse, SessionControlState, SessionEffectiveToolPolicy, SessionEvent, type SessionEventBoundarySurface, type SessionEventCompactResult, type SessionEventJsonMeasurement, SessionEventLatestClass, type SessionEventMediaPreview, SessionEventPayloadMode, type SessionEventPayloadTruncation, SessionEventReadDirection, SessionEventReadMode, SessionEventResultMode, SessionEventSemanticClass, SessionEventType, SessionGoal, SessionGoalCreatedBy, SessionGoalPausedReason, SessionGoalStatus, SessionHumanInputRequest, SessionLineageResponse, SessionListResponse, SessionMcpApprovalPolicy, SessionMcpCredentialUpdateInput, SessionMcpServerId, SessionMcpServerInput, SessionMcpServerMetadata, SessionQueueMutationResponse, SessionQueueSnapshot, SessionStatus, SessionStructuredCapabilities, type SessionSummary, SessionSystemUpdate, SessionSystemUpdateKind, SessionSystemUpdatePayload, SessionSystemUpdateState, SessionToolPolicy, SessionTurn, SessionTurnSource, SessionTurnStatus, SetVariableSetVariableRequest, SetWorkspaceDefaultRigRequest, SetWorkspaceEnvironmentVariableRequest, SocialConnection, SocialConnectionStatus, SocialPost, SocialProvider, StaticUsageLimits, SteerSessionMessageRequest, SteerSessionMessageResponse, SteerSessionQueueItemRequest, StreamClosedPayload, StreamOpenedPayload, StreamRevokedPayload, StreamTokenPayload, StreamUrlRotatedPayload, SubmitHumanInputResponseRequest, SwapActiveSandboxRequest, SwapActiveSandboxResponse, SystemUpdateClassification, TERMINAL_STREAM_PORT, TURN_EXECUTION_POLICY_METADATA_KEY, TerminalExecRequest, TerminalExecResponse, TerminalPtyExitedPayload, TerminalPtyOutputDeltaPayload, TerminalPtyStartedPayload, ToolAuthNeededPayload, ToolRef, TranscriptionErrorCode, TranscriptionEvent, TranscriptionResultMetadata, TranscriptionSpeaker, TranscriptionTimeSpan, TranscriptionWord, TriggerScheduledTaskRequest, TurnExecutionModelSourceV1, type TurnExecutionPolicyReadV1, TurnExecutionPolicyV1, TurnExecutionReasoningSourceV1, TurnInitiator, TurnInitiatorContext, UNATTRIBUTED_LEGACY_INITIATOR_SUBJECT_ID, UpdateConnectionRequest, UpdateKnowledgeMemoryRequest, UpdateRigRequest, UpdateScheduledTaskRequest, UpdateSessionGoalRequest, UpdateSessionMcpApprovalPolicyRequest, UpdateSessionMcpApprovalPolicyResponse, UpdateSessionPinRequest, UpdateSessionRequest, UpdateVariableSetRequest, UpdateWorkspaceEnvironmentRequest, UpdateWorkspaceMemberRequest, UpdateWorkspaceModelPolicyRequest, UpdateWorkspaceRequest, UpdateWorkspaceSettingsRequest, UsageEvent, UsageEventType, UsageLimitsMode, VariableSet, VariableSetVariableMetadata, VariableSetVariableName, ViewerHeartbeatRequest, ViewerHeartbeatResponse, ViewerHolder, WORKSPACE_CONTROL_ACTOR_MAX_BYTES, WORKSPACE_CONTROL_EVENT_MAX_BYTES, WORKSPACE_CONTROL_REASON_MAX_BYTES, Workspace, WorkspaceCaptureDegradedReason, WorkspaceCaptureFile, WorkspaceCaptureManifest, WorkspaceCaptureRepo, WorkspaceCaptureSignedUrl, WorkspaceCaptureStats, type WorkspaceControlBoundarySurface, WorkspaceControlEvent, WorkspaceControlEventTruncation, WorkspaceEnvironment, WorkspaceEnvironmentVariableMetadata, WorkspaceInferenceControlRequest, WorkspaceInferenceControlResponse, WorkspaceInferenceState, WorkspaceMember, WorkspaceMemorySearchMode, WorkspaceMemorySearchRequest, WorkspaceMemorySearchResponse, WorkspaceMemorySearchResult, WorkspaceModelCatalogModel, WorkspaceModelCatalogResponse, type WorkspaceModelPolicyContract, type WorkspaceModelPolicyVerdict, WorkspaceRegisteredPack, WorkspaceRevisionCapturedPayload, WorkspaceRevisionDegradedPayload, type WorkspaceSettings, WorkspaceSettingsSchema, WorkspaceTranscriptionPolicy, WorkspaceTranscriptionTarget, approvalIdentifier, approximateSessionEventTokens, assertUniqueResourceMountPaths, boundSessionEvent, boundSessionEventPayload, boundWorkspaceControlEvent, capabilityCatalogItemIsTrustedForExposure, compactSessionEventResult, defaultRepositoryMountPath, evaluateWorkspaceModelPolicy, gitCredentialBindingIdForRepository, gitCredentialProviderForRepository, isClearedRunStateBlob, measureSessionEventJson, mergeResourceRefs, mergeToolRefs, metadataWithTurnExecutionPolicyV1, normalizeRepositorySubpath, normalizeResourceMountPath, prefixedMcpToolName, readTurnExecutionPolicyV1, reasoningEffortForMetadata, resolveRetainedOutputRange, resolveSessionEventTypeFilters, resolveWorkspaceMemoryEnabled, resourceIdentityKey, resourceMountPath, resourceMountPathCollisionKey, retainedArtifactReferenceFromFile, retainedOutputUnavailable, sessionEventJsonBytes, sessionEventLatestClassToSemanticClass, sessionEventMediaPreview, sessionEventMediaPreviewFromDataUrl, sessionEventPayloadTruncation, signDelegatedAccessToken, signEnrollToken, signEnrollmentBearer, signRelayToken, signStreamToken, stableJson, turnExecutionPolicyAuditMetadata, validateRetainedOutputEvidence, verifyDelegatedAccessToken, verifyEnrollToken, verifyEnrollmentBearer, verifyRelayToken, verifyStreamToken, workspaceControlUtf8Bytes };