@opengeni/contracts 0.2.0 → 0.4.0

package/dist/index.d.ts

@@ -14,8 +14,83 @@ declare const SandboxBackend: z.ZodEnum<{
     modal: "modal";
     local: "local";
     none: "none";
+    daytona: "daytona";
+    runloop: "runloop";
+    e2b: "e2b";
+    blaxel: "blaxel";
+    cloudflare: "cloudflare";
+    vercel: "vercel";
+    selfhosted: "selfhosted";
 }>;
 type SandboxBackend = z.infer<typeof SandboxBackend>;
+declare const SandboxOs: z.ZodEnum<{
+    linux: "linux";
+    macos: "macos";
+    windows: "windows";
+}>;
+type SandboxOs = z.infer<typeof SandboxOs>;
+declare const SandboxCapabilityName: z.ZodEnum<{
+    FileSystem: "FileSystem";
+    Terminal: "Terminal";
+    Git: "Git";
+    DesktopStream: "DesktopStream";
+    Recording: "Recording";
+}>;
+type SandboxCapabilityName = z.infer<typeof SandboxCapabilityName>;
+type PortExposureKind = "provider-tunnel" | "preview-url" | "local-port" | "none";
+type CapabilityDescriptor = {
+    backend: SandboxBackend;
+    backendId: string;
+    tier: "desktop" | "headless" | "dev" | "none";
+    os: {
+        supported: SandboxOs[];
+        default: SandboxOs;
+    };
+    capabilities: {
+        FileSystem: {
+            available: boolean;
+            readOnly: boolean;
+        };
+        Terminal: {
+            available: boolean;
+            transport: "sse-events" | "pty-ws" | null;
+            pty: boolean;
+        };
+        Git: {
+            available: boolean;
+        };
+        DesktopStream: {
+            available: boolean;
+            transport: "vnc-ws" | "rdp-ws" | "webrtc" | null;
+        };
+        Recording: {
+            available: boolean;
+        };
+    };
+    lifetime: {
+        hardLifetimeMs?: number;
+        requiresSnapshotRollover: boolean;
+        hasIdleKiller: boolean;
+        supportsSuspendResume: boolean;
+        resumeIsLockFree: boolean;
+        idleKillDisableHint?: string;
+    };
+    snapshot: {
+        kind: "native-fs" | "native-dir" | "native-snapshot-id" | "tar-only" | "none";
+        hasTarFallback: boolean;
+    };
+    portExposure: {
+        kind: PortExposureKind;
+        supportsOnDemandPorts: boolean;
+    };
+    workspaceRoot: string;
+    nativeBucketMount: boolean;
+    persistable: boolean;
+    supportsRunAs: boolean;
+};
+declare const DESKTOP_STREAM_PORT = 6080;
+declare const TERMINAL_STREAM_PORT = 7681;
+declare const CAPABILITY_DESCRIPTORS: Record<SandboxBackend, CapabilityDescriptor>;
 declare const ReasoningEffort: z.ZodEnum<{
     none: "none";
     minimal: "minimal";
@@ -84,8 +159,13 @@ declare const Permission: z.ZodEnum<{
     "sessions:create": "sessions:create";
     "sessions:read": "sessions:read";
     "sessions:control": "sessions:control";
+    "stream:view": "stream:view";
+    "stream:control": "stream:control";
+    "stream:acknowledge": "stream:acknowledge";
     "files:upload": "files:upload";
     "files:read": "files:read";
+    "files:write": "files:write";
+    "terminal:attach": "terminal:attach";
     "documents:manage": "documents:manage";
     "documents:search": "documents:search";
     "scheduled_tasks:manage": "scheduled_tasks:manage";
@@ -96,6 +176,8 @@ declare const Permission: z.ZodEnum<{
     "environments:manage": "environments:manage";
     "environments:use": "environments:use";
     "goals:manage": "goals:manage";
+    "enrollments:read": "enrollments:read";
+    "enrollments:manage": "enrollments:manage";
 }>;
 type Permission = z.infer<typeof Permission>;
 declare const ProductAccessMode: z.ZodEnum<{
@@ -169,8 +251,13 @@ declare const AccountGrant: z.ZodObject<{
         "sessions:create": "sessions:create";
         "sessions:read": "sessions:read";
         "sessions:control": "sessions:control";
+        "stream:view": "stream:view";
+        "stream:control": "stream:control";
+        "stream:acknowledge": "stream:acknowledge";
         "files:upload": "files:upload";
         "files:read": "files:read";
+        "files:write": "files:write";
+        "terminal:attach": "terminal:attach";
         "documents:manage": "documents:manage";
         "documents:search": "documents:search";
         "scheduled_tasks:manage": "scheduled_tasks:manage";
@@ -181,6 +268,8 @@ declare const AccountGrant: z.ZodObject<{
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
         "goals:manage": "goals:manage";
+        "enrollments:read": "enrollments:read";
+        "enrollments:manage": "enrollments:manage";
     }>>;
     metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$strip>;
@@ -202,8 +291,13 @@ declare const AccessGrant: z.ZodObject<{
         "sessions:create": "sessions:create";
         "sessions:read": "sessions:read";
         "sessions:control": "sessions:control";
+        "stream:view": "stream:view";
+        "stream:control": "stream:control";
+        "stream:acknowledge": "stream:acknowledge";
         "files:upload": "files:upload";
         "files:read": "files:read";
+        "files:write": "files:write";
+        "terminal:attach": "terminal:attach";
         "documents:manage": "documents:manage";
         "documents:search": "documents:search";
         "scheduled_tasks:manage": "scheduled_tasks:manage";
@@ -214,6 +308,8 @@ declare const AccessGrant: z.ZodObject<{
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
         "goals:manage": "goals:manage";
+        "enrollments:read": "enrollments:read";
+        "enrollments:manage": "enrollments:manage";
     }>>;
     metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$strip>;
@@ -247,8 +343,13 @@ declare const AccessContext: z.ZodObject<{
             "sessions:create": "sessions:create";
             "sessions:read": "sessions:read";
             "sessions:control": "sessions:control";
+            "stream:view": "stream:view";
+            "stream:control": "stream:control";
+            "stream:acknowledge": "stream:acknowledge";
             "files:upload": "files:upload";
             "files:read": "files:read";
+            "files:write": "files:write";
+            "terminal:attach": "terminal:attach";
             "documents:manage": "documents:manage";
             "documents:search": "documents:search";
             "scheduled_tasks:manage": "scheduled_tasks:manage";
@@ -259,6 +360,8 @@ declare const AccessContext: z.ZodObject<{
             "environments:manage": "environments:manage";
             "environments:use": "environments:use";
             "goals:manage": "goals:manage";
+            "enrollments:read": "enrollments:read";
+            "enrollments:manage": "enrollments:manage";
         }>>;
         metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, z.core.$strip>>;
@@ -279,8 +382,13 @@ declare const AccessContext: z.ZodObject<{
             "sessions:create": "sessions:create";
             "sessions:read": "sessions:read";
             "sessions:control": "sessions:control";
+            "stream:view": "stream:view";
+            "stream:control": "stream:control";
+            "stream:acknowledge": "stream:acknowledge";
             "files:upload": "files:upload";
             "files:read": "files:read";
+            "files:write": "files:write";
+            "terminal:attach": "terminal:attach";
             "documents:manage": "documents:manage";
             "documents:search": "documents:search";
             "scheduled_tasks:manage": "scheduled_tasks:manage";
@@ -291,6 +399,8 @@ declare const AccessContext: z.ZodObject<{
             "environments:manage": "environments:manage";
             "environments:use": "environments:use";
             "goals:manage": "goals:manage";
+            "enrollments:read": "enrollments:read";
+            "enrollments:manage": "enrollments:manage";
         }>>;
         metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, z.core.$strip>>;
@@ -315,8 +425,13 @@ declare const DelegatedAccessTokenPayload: z.ZodObject<{
         "sessions:create": "sessions:create";
         "sessions:read": "sessions:read";
         "sessions:control": "sessions:control";
+        "stream:view": "stream:view";
+        "stream:control": "stream:control";
+        "stream:acknowledge": "stream:acknowledge";
         "files:upload": "files:upload";
         "files:read": "files:read";
+        "files:write": "files:write";
+        "terminal:attach": "terminal:attach";
         "documents:manage": "documents:manage";
         "documents:search": "documents:search";
         "scheduled_tasks:manage": "scheduled_tasks:manage";
@@ -327,6 +442,8 @@ declare const DelegatedAccessTokenPayload: z.ZodObject<{
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
         "goals:manage": "goals:manage";
+        "enrollments:read": "enrollments:read";
+        "enrollments:manage": "enrollments:manage";
     }>>;
     sessionId: z.ZodOptional<z.ZodString>;
     exp: z.ZodNumber;
@@ -334,6 +451,77 @@ declare const DelegatedAccessTokenPayload: z.ZodObject<{
 type DelegatedAccessTokenPayload = z.infer<typeof DelegatedAccessTokenPayload>;
 declare function signDelegatedAccessToken(secret: string, payload: DelegatedAccessTokenPayload): Promise<string>;
 declare function verifyDelegatedAccessToken(secret: string, token: string, nowSeconds?: number): Promise<DelegatedAccessTokenPayload | null>;
+declare const EnrollmentBearerPayload: z.ZodObject<{
+    workspaceId: z.ZodString;
+    agentId: z.ZodString;
+    enrollmentId: z.ZodString;
+    subjectPrefix: z.ZodString;
+    exp: z.ZodNumber;
+}, z.core.$strip>;
+type EnrollmentBearerPayload = z.infer<typeof EnrollmentBearerPayload>;
+declare function signEnrollmentBearer(secret: string, payload: EnrollmentBearerPayload): Promise<string>;
+declare function verifyEnrollmentBearer(secret: string, token: string, nowSeconds?: number): Promise<EnrollmentBearerPayload | null>;
+declare const EnrollTokenPayload: z.ZodObject<{
+    typ: z.ZodLiteral<"enroll">;
+    workspaceId: z.ZodString;
+    accountId: z.ZodString;
+    allowScreenControl: z.ZodBoolean;
+    iat: z.ZodNumber;
+    exp: z.ZodNumber;
+}, z.core.$strip>;
+type EnrollTokenPayload = z.infer<typeof EnrollTokenPayload>;
+declare function signEnrollToken(secret: string, payload: EnrollTokenPayload): Promise<string>;
+/**
+ * Verify an enroll token: rejects (returns null) on a bad prefix (NOT `oget_`),
+ * a malformed envelope, a bad HMAC signature (constant-time), schema-invalid
+ * claims (which includes `typ !== "enroll"` — the `z.literal` rejects it), or an
+ * expired token (`exp < now`). Mirrors verifyEnrollmentBearer exactly. An `oge_`
+ * bearer fails the prefix gate; a same-secret token that lacks the typ claim fails
+ * the schema gate — both halves of the domain separation are enforced here.
+ */
+declare function verifyEnrollToken(secret: string, token: string, nowSeconds?: number): Promise<EnrollTokenPayload | null>;
+declare const StreamTokenPayload: z.ZodObject<{
+    workspaceId: z.ZodString;
+    sessionId: z.ZodString;
+    viewerId: z.ZodString;
+    leaseEpoch: z.ZodNumber;
+    mode: z.ZodEnum<{
+        view: "view";
+        control: "control";
+    }>;
+    port: z.ZodNumber;
+    exp: z.ZodNumber;
+}, z.core.$strip>;
+type StreamTokenPayload = z.infer<typeof StreamTokenPayload>;
+declare function signStreamToken(secret: string, payload: StreamTokenPayload): Promise<string>;
+/**
+ * Verify a stream token: rejects (returns null) on a bad prefix, malformed
+ * envelope, bad HMAC signature (constant-time), schema-invalid claims, or an
+ * expired token (`exp < now`). Mirrors verifyDelegatedAccessToken exactly.
+ *
+ * The epoch fence (claim.leaseEpoch vs the LIVE lease epoch) and the
+ * workspace/session scope are checked by the CALLER at use against the live
+ * lease + route params — verify proves the token is authentic + unexpired, the
+ * caller proves it is for THIS box's current epoch and THIS workspace+session.
+ */
+declare function verifyStreamToken(secret: string, token: string, nowSeconds?: number): Promise<StreamTokenPayload | null>;
+declare const RelayTokenPayload: z.ZodObject<{
+    workspaceId: z.ZodString;
+    agentId: z.ZodString;
+    exp: z.ZodNumber;
+}, z.core.$strip>;
+type RelayTokenPayload = z.infer<typeof RelayTokenPayload>;
+declare function signRelayToken(secret: string, payload: RelayTokenPayload): Promise<string>;
+/**
+ * Verify a relay producer token: rejects (returns null) on a bad prefix, malformed
+ * envelope, bad HMAC signature (constant-time), schema-invalid claims, or expiry.
+ * Mirrors verifyStreamToken exactly. The relay (Rust) re-implements this verify;
+ * the TS verify here proves the format for the cross-stack fixture + any TS caller.
+ *
+ * The channel-key scope (claim.workspaceId/agentId vs the StreamOpen channel key)
+ * is enforced by the relay at USE — verify proves authenticity + freshness only.
+ */
+declare function verifyRelayToken(secret: string, token: string, nowSeconds?: number): Promise<RelayTokenPayload | null>;
 declare const CreateWorkspaceRequest: z.ZodObject<{
     accountId: z.ZodOptional<z.ZodString>;
     name: z.ZodString;
@@ -367,8 +555,13 @@ declare const ApiKey: z.ZodObject<{
         "sessions:create": "sessions:create";
         "sessions:read": "sessions:read";
         "sessions:control": "sessions:control";
+        "stream:view": "stream:view";
+        "stream:control": "stream:control";
+        "stream:acknowledge": "stream:acknowledge";
         "files:upload": "files:upload";
         "files:read": "files:read";
+        "files:write": "files:write";
+        "terminal:attach": "terminal:attach";
         "documents:manage": "documents:manage";
         "documents:search": "documents:search";
         "scheduled_tasks:manage": "scheduled_tasks:manage";
@@ -379,6 +572,8 @@ declare const ApiKey: z.ZodObject<{
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
         "goals:manage": "goals:manage";
+        "enrollments:read": "enrollments:read";
+        "enrollments:manage": "enrollments:manage";
     }>>;
     expiresAt: z.ZodNullable<z.ZodString>;
     revokedAt: z.ZodNullable<z.ZodString>;
@@ -402,8 +597,13 @@ declare const CreateApiKeyRequest: z.ZodObject<{
         "sessions:create": "sessions:create";
         "sessions:read": "sessions:read";
         "sessions:control": "sessions:control";
+        "stream:view": "stream:view";
+        "stream:control": "stream:control";
+        "stream:acknowledge": "stream:acknowledge";
         "files:upload": "files:upload";
         "files:read": "files:read";
+        "files:write": "files:write";
+        "terminal:attach": "terminal:attach";
         "documents:manage": "documents:manage";
         "documents:search": "documents:search";
         "scheduled_tasks:manage": "scheduled_tasks:manage";
@@ -414,6 +614,8 @@ declare const CreateApiKeyRequest: z.ZodObject<{
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
         "goals:manage": "goals:manage";
+        "enrollments:read": "enrollments:read";
+        "enrollments:manage": "enrollments:manage";
     }>>;
     expiresAt: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
@@ -437,8 +639,13 @@ declare const CreateApiKeyResponse: z.ZodObject<{
             "sessions:create": "sessions:create";
             "sessions:read": "sessions:read";
             "sessions:control": "sessions:control";
+            "stream:view": "stream:view";
+            "stream:control": "stream:control";
+            "stream:acknowledge": "stream:acknowledge";
             "files:upload": "files:upload";
             "files:read": "files:read";
+            "files:write": "files:write";
+            "terminal:attach": "terminal:attach";
             "documents:manage": "documents:manage";
             "documents:search": "documents:search";
             "scheduled_tasks:manage": "scheduled_tasks:manage";
@@ -449,6 +656,8 @@ declare const CreateApiKeyResponse: z.ZodObject<{
             "environments:manage": "environments:manage";
             "environments:use": "environments:use";
             "goals:manage": "goals:manage";
+            "enrollments:read": "enrollments:read";
+            "enrollments:manage": "enrollments:manage";
         }>>;
         expiresAt: z.ZodNullable<z.ZodString>;
         revokedAt: z.ZodNullable<z.ZodString>;
@@ -459,6 +668,159 @@ declare const CreateApiKeyResponse: z.ZodObject<{
     token: z.ZodString;
 }, z.core.$strip>;
 type CreateApiKeyResponse = z.infer<typeof CreateApiKeyResponse>;
+declare const WorkspaceMember: z.ZodObject<{
+    subjectId: z.ZodString;
+    subjectLabel: z.ZodNullable<z.ZodString>;
+    role: z.ZodString;
+    permissions: z.ZodArray<z.ZodEnum<{
+        "account:read": "account:read";
+        "account:admin": "account:admin";
+        "members:manage": "members:manage";
+        "workspace:create": "workspace:create";
+        "billing:read": "billing:read";
+        "billing:manage": "billing:manage";
+        "workspace:read": "workspace:read";
+        "workspace:admin": "workspace:admin";
+        "sessions:create": "sessions:create";
+        "sessions:read": "sessions:read";
+        "sessions:control": "sessions:control";
+        "stream:view": "stream:view";
+        "stream:control": "stream:control";
+        "stream:acknowledge": "stream:acknowledge";
+        "files:upload": "files:upload";
+        "files:read": "files:read";
+        "files:write": "files:write";
+        "terminal:attach": "terminal:attach";
+        "documents:manage": "documents:manage";
+        "documents:search": "documents:search";
+        "scheduled_tasks:manage": "scheduled_tasks:manage";
+        "scheduled_tasks:run": "scheduled_tasks:run";
+        "github:manage": "github:manage";
+        "github:use": "github:use";
+        "api_keys:manage": "api_keys:manage";
+        "environments:manage": "environments:manage";
+        "environments:use": "environments:use";
+        "goals:manage": "goals:manage";
+        "enrollments:read": "enrollments:read";
+        "enrollments:manage": "enrollments:manage";
+    }>>;
+    createdAt: z.ZodString;
+}, z.core.$strip>;
+type WorkspaceMember = z.infer<typeof WorkspaceMember>;
+declare const ListWorkspaceMembersResponse: z.ZodObject<{
+    members: z.ZodArray<z.ZodObject<{
+        subjectId: z.ZodString;
+        subjectLabel: z.ZodNullable<z.ZodString>;
+        role: z.ZodString;
+        permissions: z.ZodArray<z.ZodEnum<{
+            "account:read": "account:read";
+            "account:admin": "account:admin";
+            "members:manage": "members:manage";
+            "workspace:create": "workspace:create";
+            "billing:read": "billing:read";
+            "billing:manage": "billing:manage";
+            "workspace:read": "workspace:read";
+            "workspace:admin": "workspace:admin";
+            "sessions:create": "sessions:create";
+            "sessions:read": "sessions:read";
+            "sessions:control": "sessions:control";
+            "stream:view": "stream:view";
+            "stream:control": "stream:control";
+            "stream:acknowledge": "stream:acknowledge";
+            "files:upload": "files:upload";
+            "files:read": "files:read";
+            "files:write": "files:write";
+            "terminal:attach": "terminal:attach";
+            "documents:manage": "documents:manage";
+            "documents:search": "documents:search";
+            "scheduled_tasks:manage": "scheduled_tasks:manage";
+            "scheduled_tasks:run": "scheduled_tasks:run";
+            "github:manage": "github:manage";
+            "github:use": "github:use";
+            "api_keys:manage": "api_keys:manage";
+            "environments:manage": "environments:manage";
+            "environments:use": "environments:use";
+            "goals:manage": "goals:manage";
+            "enrollments:read": "enrollments:read";
+            "enrollments:manage": "enrollments:manage";
+        }>>;
+        createdAt: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type ListWorkspaceMembersResponse = z.infer<typeof ListWorkspaceMembersResponse>;
+declare const AddWorkspaceMemberRequest: z.ZodObject<{
+    email: z.ZodString;
+    role: z.ZodOptional<z.ZodString>;
+    permissions: z.ZodArray<z.ZodEnum<{
+        "account:read": "account:read";
+        "account:admin": "account:admin";
+        "members:manage": "members:manage";
+        "workspace:create": "workspace:create";
+        "billing:read": "billing:read";
+        "billing:manage": "billing:manage";
+        "workspace:read": "workspace:read";
+        "workspace:admin": "workspace:admin";
+        "sessions:create": "sessions:create";
+        "sessions:read": "sessions:read";
+        "sessions:control": "sessions:control";
+        "stream:view": "stream:view";
+        "stream:control": "stream:control";
+        "stream:acknowledge": "stream:acknowledge";
+        "files:upload": "files:upload";
+        "files:read": "files:read";
+        "files:write": "files:write";
+        "terminal:attach": "terminal:attach";
+        "documents:manage": "documents:manage";
+        "documents:search": "documents:search";
+        "scheduled_tasks:manage": "scheduled_tasks:manage";
+        "scheduled_tasks:run": "scheduled_tasks:run";
+        "github:manage": "github:manage";
+        "github:use": "github:use";
+        "api_keys:manage": "api_keys:manage";
+        "environments:manage": "environments:manage";
+        "environments:use": "environments:use";
+        "goals:manage": "goals:manage";
+        "enrollments:read": "enrollments:read";
+        "enrollments:manage": "enrollments:manage";
+    }>>;
+}, z.core.$strip>;
+type AddWorkspaceMemberRequest = z.infer<typeof AddWorkspaceMemberRequest>;
+declare const UpdateWorkspaceMemberRequest: z.ZodObject<{
+    role: z.ZodOptional<z.ZodString>;
+    permissions: z.ZodArray<z.ZodEnum<{
+        "account:read": "account:read";
+        "account:admin": "account:admin";
+        "members:manage": "members:manage";
+        "workspace:create": "workspace:create";
+        "billing:read": "billing:read";
+        "billing:manage": "billing:manage";
+        "workspace:read": "workspace:read";
+        "workspace:admin": "workspace:admin";
+        "sessions:create": "sessions:create";
+        "sessions:read": "sessions:read";
+        "sessions:control": "sessions:control";
+        "stream:view": "stream:view";
+        "stream:control": "stream:control";
+        "stream:acknowledge": "stream:acknowledge";
+        "files:upload": "files:upload";
+        "files:read": "files:read";
+        "files:write": "files:write";
+        "terminal:attach": "terminal:attach";
+        "documents:manage": "documents:manage";
+        "documents:search": "documents:search";
+        "scheduled_tasks:manage": "scheduled_tasks:manage";
+        "scheduled_tasks:run": "scheduled_tasks:run";
+        "github:manage": "github:manage";
+        "github:use": "github:use";
+        "api_keys:manage": "api_keys:manage";
+        "environments:manage": "environments:manage";
+        "environments:use": "environments:use";
+        "goals:manage": "goals:manage";
+        "enrollments:read": "enrollments:read";
+        "enrollments:manage": "enrollments:manage";
+    }>>;
+}, z.core.$strip>;
+type UpdateWorkspaceMemberRequest = z.infer<typeof UpdateWorkspaceMemberRequest>;
 declare const UsageEventType: z.ZodEnum<{
     "agent_run.created": "agent_run.created";
     "agent_run.completed": "agent_run.completed";
@@ -469,6 +831,8 @@ declare const UsageEventType: z.ZodEnum<{
     "document.indexed": "document.indexed";
     "scheduled_task.fired": "scheduled_task.fired";
     "api_key.request": "api_key.request";
+    "sandbox.warm_seconds": "sandbox.warm_seconds";
+    "sandbox.warm_cost": "sandbox.warm_cost";
 }>;
 type UsageEventType = z.infer<typeof UsageEventType>;
 declare const UsageEvent: z.ZodObject<{
@@ -486,6 +850,8 @@ declare const UsageEvent: z.ZodObject<{
         "document.indexed": "document.indexed";
         "scheduled_task.fired": "scheduled_task.fired";
         "api_key.request": "api_key.request";
+        "sandbox.warm_seconds": "sandbox.warm_seconds";
+        "sandbox.warm_cost": "sandbox.warm_cost";
     }>;
     quantity: z.ZodNumber;
     unit: z.ZodString;
@@ -531,6 +897,70 @@ declare const LimitDecision: z.ZodDiscriminatedUnion<[z.ZodObject<{
     message: z.ZodString;
 }, z.core.$strip>], "allowed">;
 type LimitDecision = z.infer<typeof LimitDecision>;
+declare const EntitlementDecision: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    allowed: z.ZodLiteral<true>;
+    quantity: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>, z.ZodObject<{
+    allowed: z.ZodLiteral<false>;
+    reason: z.ZodString;
+    code: z.ZodOptional<z.ZodString>;
+    quantity: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>], "allowed">;
+type EntitlementDecision = z.infer<typeof EntitlementDecision>;
+type AdmitRunInput = {
+    accountId: string;
+    workspaceId: string;
+    action: string;
+    quantity: number;
+};
+type EntitlementsPort = {
+    admitRun(input: AdmitRunInput): Promise<EntitlementDecision>;
+};
+type GitCredentialsRequest = {
+    accountId: string;
+    workspaceId: string;
+    installationId: number;
+    repositoryIds: number[];
+};
+type GitCredentials = {
+    token: string;
+    workspaceId: string;
+    identity?: {
+        name: string;
+        email: string;
+    } | null;
+};
+type SandboxSecretsRequest = {
+    accountId: string;
+    workspaceId: string;
+    environmentId: string;
+};
+type SandboxSecrets = {
+    values: Record<string, string>;
+    workspaceId: string;
+    id?: string;
+    name?: string;
+    description?: string | null;
+};
+type ConnectionCredentialsPort = {
+    gitCredentials?: (input: GitCredentialsRequest) => Promise<GitCredentials>;
+    sandboxSecrets?: (input: SandboxSecretsRequest) => Promise<SandboxSecrets>;
+};
+type GitHubInstallationSummary = {
+    installationId: number;
+    accountLogin: string | null;
+    accountType: string | null;
+    suspended: boolean;
+};
+type GitHubAppApiPort = {
+    verifyInstallationAccessForUser?: (input: {
+        code: string;
+        installationId: number;
+    }) => Promise<GitHubInstallationSummary>;
+    listRepositories?: (input: {
+        installationIds?: number[];
+    }) => Promise<GitHubRepository[]>;
+};
 declare const BillingBalance: z.ZodObject<{
     accountId: z.ZodString;
     balanceMicros: z.ZodNumber;
@@ -725,6 +1155,7 @@ type DocumentSearchRequest = z.infer<typeof DocumentSearchRequest>;
 declare const ToolRef: z.ZodObject<{
     kind: z.ZodLiteral<"mcp">;
     id: z.ZodString;
+    optional: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 type ToolRef = z.infer<typeof ToolRef>;
 declare class ResourceRefConflictError extends Error {
@@ -817,6 +1248,10 @@ declare const UpdateSessionGoalRequest: z.ZodObject<{
     rationale: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 type UpdateSessionGoalRequest = z.infer<typeof UpdateSessionGoalRequest>;
+declare const UpdateSessionRequest: z.ZodObject<{
+    title: z.ZodString;
+}, z.core.$strip>;
+type UpdateSessionRequest = z.infer<typeof UpdateSessionRequest>;
 /**
  * Clear a session's conversation context. `confirm` must be the literal `true`
  * so an accidental/empty POST cannot wipe context — the destructive intent is
@@ -897,6 +1332,7 @@ declare const SessionTurn: z.ZodObject<{
     tools: z.ZodArray<z.ZodObject<{
         kind: z.ZodLiteral<"mcp">;
         id: z.ZodString;
+        optional: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
     model: z.ZodString;
     reasoningEffort: z.ZodEnum<{
@@ -912,7 +1348,19 @@ declare const SessionTurn: z.ZodObject<{
         modal: "modal";
         local: "local";
         none: "none";
+        daytona: "daytona";
+        runloop: "runloop";
+        e2b: "e2b";
+        blaxel: "blaxel";
+        cloudflare: "cloudflare";
+        vercel: "vercel";
+        selfhosted: "selfhosted";
     }>;
+    sandboxOs: z.ZodNullable<z.ZodEnum<{
+        linux: "linux";
+        macos: "macos";
+        windows: "windows";
+    }>>;
     metadata: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     startedAt: z.ZodNullable<z.ZodString>;
     finishedAt: z.ZodNullable<z.ZodString>;
@@ -938,6 +1386,7 @@ declare const UpdateSessionTurnRequest: z.ZodObject<{
     tools: z.ZodOptional<z.ZodArray<z.ZodObject<{
         kind: z.ZodLiteral<"mcp">;
         id: z.ZodString;
+        optional: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>>;
     model: z.ZodOptional<z.ZodString>;
     reasoningEffort: z.ZodOptional<z.ZodEnum<{
@@ -953,6 +1402,13 @@ declare const UpdateSessionTurnRequest: z.ZodObject<{
         modal: "modal";
         local: "local";
         none: "none";
+        daytona: "daytona";
+        runloop: "runloop";
+        e2b: "e2b";
+        blaxel: "blaxel";
+        cloudflare: "cloudflare";
+        vercel: "vercel";
+        selfhosted: "selfhosted";
     }>>;
     metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$strip>;
@@ -1074,6 +1530,7 @@ declare const ScheduledTaskAgentConfig: z.ZodObject<{
     tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
         kind: z.ZodLiteral<"mcp">;
         id: z.ZodString;
+        optional: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>>;
     metadata: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     model: z.ZodOptional<z.ZodString>;
@@ -1090,6 +1547,13 @@ declare const ScheduledTaskAgentConfig: z.ZodObject<{
         modal: "modal";
         local: "local";
         none: "none";
+        daytona: "daytona";
+        runloop: "runloop";
+        e2b: "e2b";
+        blaxel: "blaxel";
+        cloudflare: "cloudflare";
+        vercel: "vercel";
+        selfhosted: "selfhosted";
     }>>;
     goal: z.ZodOptional<z.ZodObject<{
         text: z.ZodString;
@@ -1159,6 +1623,7 @@ declare const ScheduledTask: z.ZodObject<{
         tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
             kind: z.ZodLiteral<"mcp">;
             id: z.ZodString;
+            optional: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>>;
         metadata: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         model: z.ZodOptional<z.ZodString>;
@@ -1175,6 +1640,13 @@ declare const ScheduledTask: z.ZodObject<{
             modal: "modal";
             local: "local";
             none: "none";
+            daytona: "daytona";
+            runloop: "runloop";
+            e2b: "e2b";
+            blaxel: "blaxel";
+            cloudflare: "cloudflare";
+            vercel: "vercel";
+            selfhosted: "selfhosted";
         }>>;
         goal: z.ZodOptional<z.ZodObject<{
             text: z.ZodString;
@@ -1265,6 +1737,7 @@ declare const CreateScheduledTaskRequest: z.ZodObject<{
         tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
             kind: z.ZodLiteral<"mcp">;
             id: z.ZodString;
+            optional: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>>;
         metadata: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         model: z.ZodOptional<z.ZodString>;
@@ -1281,6 +1754,13 @@ declare const CreateScheduledTaskRequest: z.ZodObject<{
             modal: "modal";
             local: "local";
             none: "none";
+            daytona: "daytona";
+            runloop: "runloop";
+            e2b: "e2b";
+            blaxel: "blaxel";
+            cloudflare: "cloudflare";
+            vercel: "vercel";
+            selfhosted: "selfhosted";
         }>>;
         goal: z.ZodOptional<z.ZodObject<{
             text: z.ZodString;
@@ -1349,6 +1829,7 @@ declare const UpdateScheduledTaskRequest: z.ZodObject<{
         tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
             kind: z.ZodLiteral<"mcp">;
             id: z.ZodString;
+            optional: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>>;
         metadata: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         model: z.ZodOptional<z.ZodString>;
@@ -1365,6 +1846,13 @@ declare const UpdateScheduledTaskRequest: z.ZodObject<{
             modal: "modal";
             local: "local";
             none: "none";
+            daytona: "daytona";
+            runloop: "runloop";
+            e2b: "e2b";
+            blaxel: "blaxel";
+            cloudflare: "cloudflare";
+            vercel: "vercel";
+            selfhosted: "selfhosted";
         }>>;
         goal: z.ZodOptional<z.ZodObject<{
             text: z.ZodString;
@@ -1493,6 +1981,7 @@ declare const CapabilityPack: z.ZodObject<{
     tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
         kind: z.ZodLiteral<"mcp">;
         id: z.ZodString;
+        optional: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>>;
     connectors: z.ZodDefault<z.ZodArray<z.ZodObject<{
         id: z.ZodString;
@@ -1582,6 +2071,7 @@ declare const RegisterCapabilityPackRequest: z.ZodObject<{
     tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
         kind: z.ZodLiteral<"mcp">;
         id: z.ZodString;
+        optional: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>>;
     connectors: z.ZodDefault<z.ZodArray<z.ZodObject<{
         id: z.ZodString;
@@ -1674,6 +2164,7 @@ declare const WorkspaceRegisteredPack: z.ZodObject<{
         tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
             kind: z.ZodLiteral<"mcp">;
             id: z.ZodString;
+            optional: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>>;
         connectors: z.ZodDefault<z.ZodArray<z.ZodObject<{
             id: z.ZodString;
@@ -1953,6 +2444,7 @@ declare const CapabilityCatalogItem: z.ZodObject<{
     tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
         kind: z.ZodLiteral<"mcp">;
         id: z.ZodString;
+        optional: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>>;
     runtime: z.ZodDefault<z.ZodObject<{
         available: z.ZodDefault<z.ZodBoolean>;
@@ -2050,6 +2542,7 @@ declare const CapabilityCatalogResponse: z.ZodObject<{
         tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
             kind: z.ZodLiteral<"mcp">;
             id: z.ZodString;
+            optional: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>>;
         runtime: z.ZodDefault<z.ZodObject<{
             available: z.ZodDefault<z.ZodBoolean>;
@@ -2115,6 +2608,7 @@ declare const DiscoverMcpCapabilitiesResponse: z.ZodObject<{
         tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
             kind: z.ZodLiteral<"mcp">;
             id: z.ZodString;
+            optional: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>>;
         runtime: z.ZodDefault<z.ZodObject<{
             available: z.ZodDefault<z.ZodBoolean>;
@@ -2145,6 +2639,11 @@ declare const Session: z.ZodObject<{
         cancelled: "cancelled";
     }>;
     initialMessage: z.ZodString;
+    title: z.ZodNullable<z.ZodString>;
+    titleSource: z.ZodNullable<z.ZodEnum<{
+        user: "user";
+        agent: "agent";
+    }>>;
     resources: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
         kind: z.ZodLiteral<"repository">;
         uri: z.ZodString;
@@ -2161,6 +2660,7 @@ declare const Session: z.ZodObject<{
     tools: z.ZodArray<z.ZodObject<{
         kind: z.ZodLiteral<"mcp">;
         id: z.ZodString;
+        optional: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
     metadata: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     model: z.ZodString;
@@ -2169,7 +2669,22 @@ declare const Session: z.ZodObject<{
         modal: "modal";
         local: "local";
         none: "none";
+        daytona: "daytona";
+        runloop: "runloop";
+        e2b: "e2b";
+        blaxel: "blaxel";
+        cloudflare: "cloudflare";
+        vercel: "vercel";
+        selfhosted: "selfhosted";
     }>;
+    sandboxOs: z.ZodEnum<{
+        linux: "linux";
+        macos: "macos";
+        windows: "windows";
+    }>;
+    sandboxGroupId: z.ZodString;
+    activeSandboxId: z.ZodNullable<z.ZodString>;
+    activeEpoch: z.ZodNumber;
     environmentId: z.ZodNullable<z.ZodString>;
     firstPartyMcpPermissions: z.ZodNullable<z.ZodArray<z.ZodEnum<{
         "account:read": "account:read";
@@ -2183,8 +2698,13 @@ declare const Session: z.ZodObject<{
         "sessions:create": "sessions:create";
         "sessions:read": "sessions:read";
         "sessions:control": "sessions:control";
+        "stream:view": "stream:view";
+        "stream:control": "stream:control";
+        "stream:acknowledge": "stream:acknowledge";
         "files:upload": "files:upload";
         "files:read": "files:read";
+        "files:write": "files:write";
+        "terminal:attach": "terminal:attach";
         "documents:manage": "documents:manage";
         "documents:search": "documents:search";
         "scheduled_tasks:manage": "scheduled_tasks:manage";
@@ -2195,6 +2715,8 @@ declare const Session: z.ZodObject<{
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
         "goals:manage": "goals:manage";
+        "enrollments:read": "enrollments:read";
+        "enrollments:manage": "enrollments:manage";
     }>>>;
     parentSessionId: z.ZodNullable<z.ZodString>;
     createIdempotencyKey: z.ZodNullable<z.ZodString>;
@@ -2202,6 +2724,8 @@ declare const Session: z.ZodObject<{
     activeTurnId: z.ZodNullable<z.ZodString>;
     lastInputTokens: z.ZodNullable<z.ZodNumber>;
     lastSequence: z.ZodNumber;
+    codexPinnedCredentialId: z.ZodNullable<z.ZodString>;
+    codexLastCredentialId: z.ZodNullable<z.ZodString>;
     createdAt: z.ZodString;
     updatedAt: z.ZodString;
 }, z.core.$strip>;
@@ -2239,8 +2763,725 @@ declare const SessionEventType: z.ZodEnum<{
     "goal.paused": "goal.paused";
     "goal.resumed": "goal.resumed";
     "goal.continuation": "goal.continuation";
+    "stream.url.rotated": "stream.url.rotated";
+    "stream.opened": "stream.opened";
+    "stream.closed": "stream.closed";
+    "stream.revoked": "stream.revoked";
+    "recording.started": "recording.started";
+    "recording.available": "recording.available";
+    "recording.failed": "recording.failed";
+    "fs.changed": "fs.changed";
+    "git.changed": "git.changed";
+    "terminal.pty.started": "terminal.pty.started";
+    "terminal.pty.output.delta": "terminal.pty.output.delta";
+    "terminal.pty.exited": "terminal.pty.exited";
+    "session.title_set": "session.title_set";
+    "codex.account.switched": "codex.account.switched";
 }>;
 type SessionEventType = z.infer<typeof SessionEventType>;
+declare const StreamUrlRotatedPayload: z.ZodObject<{
+    url: z.ZodString;
+    token: z.ZodNullable<z.ZodString>;
+    expiresAt: z.ZodNullable<z.ZodString>;
+    leaseEpoch: z.ZodNumber;
+    transport: z.ZodLiteral<"vnc-ws">;
+    viewerId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+type StreamUrlRotatedPayload = z.infer<typeof StreamUrlRotatedPayload>;
+declare const StreamOpenedPayload: z.ZodObject<{
+    viewerId: z.ZodString;
+    shared: z.ZodDefault<z.ZodBoolean>;
+    viewerCount: z.ZodNumber;
+}, z.core.$strip>;
+type StreamOpenedPayload = z.infer<typeof StreamOpenedPayload>;
+declare const StreamClosedPayload: z.ZodObject<{
+    viewerId: z.ZodString;
+    reason: z.ZodEnum<{
+        "client-disconnect": "client-disconnect";
+        reaped: "reaped";
+        revoked: "revoked";
+        "box-rollover": "box-rollover";
+    }>;
+    viewerCount: z.ZodNumber;
+}, z.core.$strip>;
+type StreamClosedPayload = z.infer<typeof StreamClosedPayload>;
+declare const StreamRevokedPayload: z.ZodObject<{
+    viewerId: z.ZodDefault<z.ZodNullable<z.ZodString>>;
+    reason: z.ZodEnum<{
+        admin: "admin";
+        "grant-revoked": "grant-revoked";
+        "session-failed": "session-failed";
+    }>;
+}, z.core.$strip>;
+type StreamRevokedPayload = z.infer<typeof StreamRevokedPayload>;
+declare const RecordingMode: z.ZodEnum<{
+    manual: "manual";
+    "on-turn": "on-turn";
+    "on-verify": "on-verify";
+}>;
+type RecordingMode = z.infer<typeof RecordingMode>;
+declare const RecordingCodec: z.ZodEnum<{
+    "h264-mp4": "h264-mp4";
+    "vp9-webm": "vp9-webm";
+}>;
+type RecordingCodec = z.infer<typeof RecordingCodec>;
+declare const RecordingContentType: z.ZodEnum<{
+    "video/mp4": "video/mp4";
+    "video/webm": "video/webm";
+}>;
+type RecordingContentType = z.infer<typeof RecordingContentType>;
+declare const RecordingStartedPayload: z.ZodObject<{
+    recordingId: z.ZodString;
+    turnId: z.ZodNullable<z.ZodString>;
+    mode: z.ZodEnum<{
+        manual: "manual";
+        "on-turn": "on-turn";
+        "on-verify": "on-verify";
+    }>;
+    codec: z.ZodEnum<{
+        "h264-mp4": "h264-mp4";
+        "vp9-webm": "vp9-webm";
+    }>;
+    dimensions: z.ZodTuple<[z.ZodNumber, z.ZodNumber], null>;
+    framerate: z.ZodNumber;
+    startedAt: z.ZodString;
+    reason: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+type RecordingStartedPayload = z.infer<typeof RecordingStartedPayload>;
+declare const RecordingAvailablePayload: z.ZodObject<{
+    recordingId: z.ZodString;
+    turnId: z.ZodNullable<z.ZodString>;
+    codec: z.ZodEnum<{
+        "h264-mp4": "h264-mp4";
+        "vp9-webm": "vp9-webm";
+    }>;
+    contentType: z.ZodEnum<{
+        "video/mp4": "video/mp4";
+        "video/webm": "video/webm";
+    }>;
+    storageKey: z.ZodString;
+    durationSeconds: z.ZodNullable<z.ZodNumber>;
+    sizeBytes: z.ZodNumber;
+    dimensions: z.ZodTuple<[z.ZodNumber, z.ZodNumber], null>;
+}, z.core.$strip>;
+type RecordingAvailablePayload = z.infer<typeof RecordingAvailablePayload>;
+declare const RecordingFailedReason: z.ZodEnum<{
+    "box-rollover": "box-rollover";
+    "ffmpeg-error": "ffmpeg-error";
+    "box-death": "box-death";
+    "upload-failed": "upload-failed";
+    "max-bytes-exceeded": "max-bytes-exceeded";
+    "display-unavailable": "display-unavailable";
+}>;
+type RecordingFailedReason = z.infer<typeof RecordingFailedReason>;
+declare const RecordingFailedPayload: z.ZodObject<{
+    recordingId: z.ZodString;
+    turnId: z.ZodNullable<z.ZodString>;
+    reason: z.ZodEnum<{
+        "box-rollover": "box-rollover";
+        "ffmpeg-error": "ffmpeg-error";
+        "box-death": "box-death";
+        "upload-failed": "upload-failed";
+        "max-bytes-exceeded": "max-bytes-exceeded";
+        "display-unavailable": "display-unavailable";
+    }>;
+    detail: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+type RecordingFailedPayload = z.infer<typeof RecordingFailedPayload>;
+declare const SandboxCommandOutputDeltaPayload: z.ZodObject<{
+    stream: z.ZodDefault<z.ZodEnum<{
+        stdout: "stdout";
+        stderr: "stderr";
+    }>>;
+    chunk: z.ZodString;
+    commandId: z.ZodOptional<z.ZodString>;
+    seq: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+type SandboxCommandOutputDeltaPayload = z.infer<typeof SandboxCommandOutputDeltaPayload>;
+declare const FsChangeKind: z.ZodEnum<{
+    deleted: "deleted";
+    created: "created";
+    modified: "modified";
+    renamed: "renamed";
+}>;
+type FsChangeKind = z.infer<typeof FsChangeKind>;
+declare const FsChangedPayload: z.ZodObject<{
+    changes: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        kind: z.ZodEnum<{
+            deleted: "deleted";
+            created: "created";
+            modified: "modified";
+            renamed: "renamed";
+        }>;
+        isDir: z.ZodDefault<z.ZodBoolean>;
+        sizeBytes: z.ZodDefault<z.ZodNullable<z.ZodNumber>>;
+        oldPath: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    source: z.ZodDefault<z.ZodEnum<{
+        agent: "agent";
+        write: "write";
+        watch: "watch";
+    }>>;
+    revision: z.ZodNumber;
+    leaseEpoch: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>;
+type FsChangedPayload = z.infer<typeof FsChangedPayload>;
+declare const GitChangedPayload: z.ZodObject<{
+    head: z.ZodNullable<z.ZodString>;
+    dirty: z.ZodBoolean;
+    ahead: z.ZodDefault<z.ZodNumber>;
+    behind: z.ZodDefault<z.ZodNumber>;
+    changedFileCount: z.ZodNumber;
+    reason: z.ZodDefault<z.ZodEnum<{
+        unknown: "unknown";
+        commit: "commit";
+        checkout: "checkout";
+        stage: "stage";
+        worktree: "worktree";
+        fetch: "fetch";
+    }>>;
+    revision: z.ZodDefault<z.ZodNumber>;
+    leaseEpoch: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>;
+type GitChangedPayload = z.infer<typeof GitChangedPayload>;
+declare const TerminalPtyStartedPayload: z.ZodObject<{
+    ptyId: z.ZodString;
+    cols: z.ZodNumber;
+    rows: z.ZodNumber;
+    shell: z.ZodString;
+    cwd: z.ZodString;
+}, z.core.$strip>;
+type TerminalPtyStartedPayload = z.infer<typeof TerminalPtyStartedPayload>;
+declare const TerminalPtyOutputDeltaPayload: z.ZodObject<{
+    ptyId: z.ZodString;
+    stream: z.ZodDefault<z.ZodEnum<{
+        stdout: "stdout";
+        stderr: "stderr";
+    }>>;
+    chunk: z.ZodString;
+    seq: z.ZodNumber;
+}, z.core.$strip>;
+type TerminalPtyOutputDeltaPayload = z.infer<typeof TerminalPtyOutputDeltaPayload>;
+declare const TerminalPtyExitedPayload: z.ZodObject<{
+    ptyId: z.ZodString;
+    exitCode: z.ZodNullable<z.ZodNumber>;
+    reason: z.ZodEnum<{
+        exit: "exit";
+        killed: "killed";
+        owner_gone: "owner_gone";
+        timeout: "timeout";
+    }>;
+}, z.core.$strip>;
+type TerminalPtyExitedPayload = z.infer<typeof TerminalPtyExitedPayload>;
+declare const FsNodeType: z.ZodEnum<{
+    file: "file";
+    dir: "dir";
+    symlink: "symlink";
+    other: "other";
+}>;
+type FsNodeType = z.infer<typeof FsNodeType>;
+interface FsTreeNode {
+    name: string;
+    path: string;
+    type: z.infer<typeof FsNodeType>;
+    sizeBytes: number | null;
+    mtimeMs: number | null;
+    mode: number | null;
+    children?: FsTreeNode[] | undefined;
+    truncated: boolean;
+}
+declare const FsTreeNode: z.ZodType<FsTreeNode>;
+declare const FsListRequest: z.ZodObject<{
+    path: z.ZodDefault<z.ZodString>;
+    depth: z.ZodDefault<z.ZodNumber>;
+    maxEntries: z.ZodDefault<z.ZodNumber>;
+    includeHidden: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+type FsListRequest = z.infer<typeof FsListRequest>;
+declare const FsListResponse: z.ZodObject<{
+    root: z.ZodType<FsTreeNode, unknown, z.core.$ZodTypeInternals<FsTreeNode, unknown>>;
+    revision: z.ZodNumber;
+    truncated: z.ZodBoolean;
+}, z.core.$strip>;
+type FsListResponse = z.infer<typeof FsListResponse>;
+declare const FsEncoding: z.ZodEnum<{
+    utf8: "utf8";
+    base64: "base64";
+}>;
+type FsEncoding = z.infer<typeof FsEncoding>;
+declare const FsReadRequest: z.ZodObject<{
+    path: z.ZodString;
+    encoding: z.ZodDefault<z.ZodEnum<{
+        utf8: "utf8";
+        base64: "base64";
+    }>>;
+    maxBytes: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>;
+type FsReadRequest = z.infer<typeof FsReadRequest>;
+declare const FsReadResponse: z.ZodObject<{
+    path: z.ZodString;
+    encoding: z.ZodEnum<{
+        utf8: "utf8";
+        base64: "base64";
+    }>;
+    content: z.ZodString;
+    sizeBytes: z.ZodNumber;
+    truncated: z.ZodBoolean;
+    isBinary: z.ZodBoolean;
+    revision: z.ZodNumber;
+}, z.core.$strip>;
+type FsReadResponse = z.infer<typeof FsReadResponse>;
+declare const FsWriteRequest: z.ZodObject<{
+    path: z.ZodString;
+    encoding: z.ZodDefault<z.ZodEnum<{
+        utf8: "utf8";
+        base64: "base64";
+    }>>;
+    content: z.ZodString;
+    overwrite: z.ZodDefault<z.ZodBoolean>;
+    createParents: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+type FsWriteRequest = z.infer<typeof FsWriteRequest>;
+declare const FsWriteResponse: z.ZodObject<{
+    path: z.ZodString;
+    sizeBytes: z.ZodNumber;
+    revision: z.ZodNumber;
+}, z.core.$strip>;
+type FsWriteResponse = z.infer<typeof FsWriteResponse>;
+declare const FsDeleteRequest: z.ZodObject<{
+    path: z.ZodString;
+    recursive: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+type FsDeleteRequest = z.infer<typeof FsDeleteRequest>;
+declare const FsDeleteResponse: z.ZodObject<{
+    revision: z.ZodNumber;
+}, z.core.$strip>;
+type FsDeleteResponse = z.infer<typeof FsDeleteResponse>;
+declare const FsMoveRequest: z.ZodObject<{
+    path: z.ZodString;
+    newPath: z.ZodString;
+    overwrite: z.ZodDefault<z.ZodBoolean>;
+    createParents: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+type FsMoveRequest = z.infer<typeof FsMoveRequest>;
+declare const FsMoveResponse: z.ZodObject<{
+    path: z.ZodString;
+    newPath: z.ZodString;
+    revision: z.ZodNumber;
+}, z.core.$strip>;
+type FsMoveResponse = z.infer<typeof FsMoveResponse>;
+declare const FsMkdirRequest: z.ZodObject<{
+    path: z.ZodString;
+    recursive: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+type FsMkdirRequest = z.infer<typeof FsMkdirRequest>;
+declare const FsMkdirResponse: z.ZodObject<{
+    path: z.ZodString;
+    revision: z.ZodNumber;
+}, z.core.$strip>;
+type FsMkdirResponse = z.infer<typeof FsMkdirResponse>;
+declare const GitFileStatusCode: z.ZodEnum<{
+    deleted: "deleted";
+    modified: "modified";
+    renamed: "renamed";
+    added: "added";
+    copied: "copied";
+    untracked: "untracked";
+    ignored: "ignored";
+    conflicted: "conflicted";
+    typechange: "typechange";
+}>;
+type GitFileStatusCode = z.infer<typeof GitFileStatusCode>;
+declare const GitFileStatus: z.ZodObject<{
+    path: z.ZodString;
+    oldPath: z.ZodNullable<z.ZodString>;
+    index: z.ZodNullable<z.ZodEnum<{
+        deleted: "deleted";
+        modified: "modified";
+        renamed: "renamed";
+        added: "added";
+        copied: "copied";
+        untracked: "untracked";
+        ignored: "ignored";
+        conflicted: "conflicted";
+        typechange: "typechange";
+    }>>;
+    worktree: z.ZodNullable<z.ZodEnum<{
+        deleted: "deleted";
+        modified: "modified";
+        renamed: "renamed";
+        added: "added";
+        copied: "copied";
+        untracked: "untracked";
+        ignored: "ignored";
+        conflicted: "conflicted";
+        typechange: "typechange";
+    }>>;
+    isConflicted: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+type GitFileStatus = z.infer<typeof GitFileStatus>;
+declare const GitStatusRequest: z.ZodObject<{
+    path: z.ZodDefault<z.ZodString>;
+}, z.core.$strip>;
+type GitStatusRequest = z.infer<typeof GitStatusRequest>;
+declare const GitStatusResponse: z.ZodObject<{
+    isRepo: z.ZodBoolean;
+    head: z.ZodNullable<z.ZodString>;
+    detached: z.ZodDefault<z.ZodBoolean>;
+    upstream: z.ZodNullable<z.ZodString>;
+    ahead: z.ZodDefault<z.ZodNumber>;
+    behind: z.ZodDefault<z.ZodNumber>;
+    files: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        oldPath: z.ZodNullable<z.ZodString>;
+        index: z.ZodNullable<z.ZodEnum<{
+            deleted: "deleted";
+            modified: "modified";
+            renamed: "renamed";
+            added: "added";
+            copied: "copied";
+            untracked: "untracked";
+            ignored: "ignored";
+            conflicted: "conflicted";
+            typechange: "typechange";
+        }>>;
+        worktree: z.ZodNullable<z.ZodEnum<{
+            deleted: "deleted";
+            modified: "modified";
+            renamed: "renamed";
+            added: "added";
+            copied: "copied";
+            untracked: "untracked";
+            ignored: "ignored";
+            conflicted: "conflicted";
+            typechange: "typechange";
+        }>>;
+        isConflicted: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    revision: z.ZodNumber;
+}, z.core.$strip>;
+type GitStatusResponse = z.infer<typeof GitStatusResponse>;
+declare const GitDiffLineType: z.ZodEnum<{
+    context: "context";
+    add: "add";
+    del: "del";
+    meta: "meta";
+}>;
+type GitDiffLineType = z.infer<typeof GitDiffLineType>;
+declare const GitDiffLine: z.ZodObject<{
+    type: z.ZodEnum<{
+        context: "context";
+        add: "add";
+        del: "del";
+        meta: "meta";
+    }>;
+    oldNo: z.ZodNullable<z.ZodNumber>;
+    newNo: z.ZodNullable<z.ZodNumber>;
+    text: z.ZodString;
+}, z.core.$strip>;
+type GitDiffLine = z.infer<typeof GitDiffLine>;
+declare const GitDiffHunk: z.ZodObject<{
+    oldStart: z.ZodNumber;
+    oldLines: z.ZodNumber;
+    newStart: z.ZodNumber;
+    newLines: z.ZodNumber;
+    header: z.ZodString;
+    lines: z.ZodArray<z.ZodObject<{
+        type: z.ZodEnum<{
+            context: "context";
+            add: "add";
+            del: "del";
+            meta: "meta";
+        }>;
+        oldNo: z.ZodNullable<z.ZodNumber>;
+        newNo: z.ZodNullable<z.ZodNumber>;
+        text: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type GitDiffHunk = z.infer<typeof GitDiffHunk>;
+declare const GitFileDiff: z.ZodObject<{
+    path: z.ZodString;
+    oldPath: z.ZodNullable<z.ZodString>;
+    status: z.ZodEnum<{
+        deleted: "deleted";
+        modified: "modified";
+        renamed: "renamed";
+        added: "added";
+        copied: "copied";
+        untracked: "untracked";
+        ignored: "ignored";
+        conflicted: "conflicted";
+        typechange: "typechange";
+    }>;
+    isBinary: z.ZodDefault<z.ZodBoolean>;
+    isImage: z.ZodDefault<z.ZodBoolean>;
+    additions: z.ZodNumber;
+    deletions: z.ZodNumber;
+    hunks: z.ZodArray<z.ZodObject<{
+        oldStart: z.ZodNumber;
+        oldLines: z.ZodNumber;
+        newStart: z.ZodNumber;
+        newLines: z.ZodNumber;
+        header: z.ZodString;
+        lines: z.ZodArray<z.ZodObject<{
+            type: z.ZodEnum<{
+                context: "context";
+                add: "add";
+                del: "del";
+                meta: "meta";
+            }>;
+            oldNo: z.ZodNullable<z.ZodNumber>;
+            newNo: z.ZodNullable<z.ZodNumber>;
+            text: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    truncated: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+type GitFileDiff = z.infer<typeof GitFileDiff>;
+declare const GitDiffRequest: z.ZodObject<{
+    path: z.ZodDefault<z.ZodString>;
+    staged: z.ZodDefault<z.ZodBoolean>;
+    fromRef: z.ZodOptional<z.ZodString>;
+    toRef: z.ZodOptional<z.ZodString>;
+    pathspec: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    contextLines: z.ZodDefault<z.ZodNumber>;
+    maxBytesPerFile: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>;
+type GitDiffRequest = z.infer<typeof GitDiffRequest>;
+declare const GitDiffResponse: z.ZodObject<{
+    files: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        oldPath: z.ZodNullable<z.ZodString>;
+        status: z.ZodEnum<{
+            deleted: "deleted";
+            modified: "modified";
+            renamed: "renamed";
+            added: "added";
+            copied: "copied";
+            untracked: "untracked";
+            ignored: "ignored";
+            conflicted: "conflicted";
+            typechange: "typechange";
+        }>;
+        isBinary: z.ZodDefault<z.ZodBoolean>;
+        isImage: z.ZodDefault<z.ZodBoolean>;
+        additions: z.ZodNumber;
+        deletions: z.ZodNumber;
+        hunks: z.ZodArray<z.ZodObject<{
+            oldStart: z.ZodNumber;
+            oldLines: z.ZodNumber;
+            newStart: z.ZodNumber;
+            newLines: z.ZodNumber;
+            header: z.ZodString;
+            lines: z.ZodArray<z.ZodObject<{
+                type: z.ZodEnum<{
+                    context: "context";
+                    add: "add";
+                    del: "del";
+                    meta: "meta";
+                }>;
+                oldNo: z.ZodNullable<z.ZodNumber>;
+                newNo: z.ZodNullable<z.ZodNumber>;
+                text: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        truncated: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    revision: z.ZodNumber;
+}, z.core.$strip>;
+type GitDiffResponse = z.infer<typeof GitDiffResponse>;
+declare const GitLogRequest: z.ZodObject<{
+    path: z.ZodDefault<z.ZodString>;
+    ref: z.ZodDefault<z.ZodString>;
+    maxCount: z.ZodDefault<z.ZodNumber>;
+    skip: z.ZodDefault<z.ZodNumber>;
+    pathspec: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+type GitLogRequest = z.infer<typeof GitLogRequest>;
+declare const GitCommit: z.ZodObject<{
+    sha: z.ZodString;
+    shortSha: z.ZodString;
+    parents: z.ZodArray<z.ZodString>;
+    author: z.ZodObject<{
+        name: z.ZodString;
+        email: z.ZodString;
+        timestamp: z.ZodNumber;
+    }, z.core.$strip>;
+    committer: z.ZodObject<{
+        name: z.ZodString;
+        email: z.ZodString;
+        timestamp: z.ZodNumber;
+    }, z.core.$strip>;
+    subject: z.ZodString;
+    body: z.ZodString;
+    refs: z.ZodDefault<z.ZodArray<z.ZodString>>;
+}, z.core.$strip>;
+type GitCommit = z.infer<typeof GitCommit>;
+declare const GitLogResponse: z.ZodObject<{
+    commits: z.ZodArray<z.ZodObject<{
+        sha: z.ZodString;
+        shortSha: z.ZodString;
+        parents: z.ZodArray<z.ZodString>;
+        author: z.ZodObject<{
+            name: z.ZodString;
+            email: z.ZodString;
+            timestamp: z.ZodNumber;
+        }, z.core.$strip>;
+        committer: z.ZodObject<{
+            name: z.ZodString;
+            email: z.ZodString;
+            timestamp: z.ZodNumber;
+        }, z.core.$strip>;
+        subject: z.ZodString;
+        body: z.ZodString;
+        refs: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    hasMore: z.ZodBoolean;
+}, z.core.$strip>;
+type GitLogResponse = z.infer<typeof GitLogResponse>;
+declare const GitShowRequest: z.ZodObject<{
+    path: z.ZodDefault<z.ZodString>;
+    ref: z.ZodString;
+    filePath: z.ZodOptional<z.ZodString>;
+    encoding: z.ZodDefault<z.ZodEnum<{
+        utf8: "utf8";
+        base64: "base64";
+    }>>;
+    maxBytesPerFile: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>;
+type GitShowRequest = z.infer<typeof GitShowRequest>;
+declare const GitShowResponse: z.ZodObject<{
+    commit: z.ZodNullable<z.ZodObject<{
+        sha: z.ZodString;
+        shortSha: z.ZodString;
+        parents: z.ZodArray<z.ZodString>;
+        author: z.ZodObject<{
+            name: z.ZodString;
+            email: z.ZodString;
+            timestamp: z.ZodNumber;
+        }, z.core.$strip>;
+        committer: z.ZodObject<{
+            name: z.ZodString;
+            email: z.ZodString;
+            timestamp: z.ZodNumber;
+        }, z.core.$strip>;
+        subject: z.ZodString;
+        body: z.ZodString;
+        refs: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    files: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        oldPath: z.ZodNullable<z.ZodString>;
+        status: z.ZodEnum<{
+            deleted: "deleted";
+            modified: "modified";
+            renamed: "renamed";
+            added: "added";
+            copied: "copied";
+            untracked: "untracked";
+            ignored: "ignored";
+            conflicted: "conflicted";
+            typechange: "typechange";
+        }>;
+        isBinary: z.ZodDefault<z.ZodBoolean>;
+        isImage: z.ZodDefault<z.ZodBoolean>;
+        additions: z.ZodNumber;
+        deletions: z.ZodNumber;
+        hunks: z.ZodArray<z.ZodObject<{
+            oldStart: z.ZodNumber;
+            oldLines: z.ZodNumber;
+            newStart: z.ZodNumber;
+            newLines: z.ZodNumber;
+            header: z.ZodString;
+            lines: z.ZodArray<z.ZodObject<{
+                type: z.ZodEnum<{
+                    context: "context";
+                    add: "add";
+                    del: "del";
+                    meta: "meta";
+                }>;
+                oldNo: z.ZodNullable<z.ZodNumber>;
+                newNo: z.ZodNullable<z.ZodNumber>;
+                text: z.ZodString;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        truncated: z.ZodDefault<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    blob: z.ZodNullable<z.ZodObject<{
+        content: z.ZodString;
+        encoding: z.ZodEnum<{
+            utf8: "utf8";
+            base64: "base64";
+        }>;
+        sizeBytes: z.ZodNumber;
+        truncated: z.ZodBoolean;
+    }, z.core.$strip>>;
+    revision: z.ZodNumber;
+}, z.core.$strip>;
+type GitShowResponse = z.infer<typeof GitShowResponse>;
+declare const TerminalExecRequest: z.ZodObject<{
+    command: z.ZodString;
+    cwd: z.ZodDefault<z.ZodString>;
+    timeoutMs: z.ZodDefault<z.ZodNumber>;
+    emitStream: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+type TerminalExecRequest = z.infer<typeof TerminalExecRequest>;
+declare const TerminalExecResponse: z.ZodObject<{
+    stdout: z.ZodString;
+    stderr: z.ZodString;
+    exitCode: z.ZodNullable<z.ZodNumber>;
+    running: z.ZodBoolean;
+    wallTimeSeconds: z.ZodNumber;
+}, z.core.$strip>;
+type TerminalExecResponse = z.infer<typeof TerminalExecResponse>;
+declare const PtyOpenRequest: z.ZodObject<{
+    cols: z.ZodDefault<z.ZodNumber>;
+    rows: z.ZodDefault<z.ZodNumber>;
+    cwd: z.ZodDefault<z.ZodString>;
+    shell: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type PtyOpenRequest = z.infer<typeof PtyOpenRequest>;
+declare const PtyOpenResponse: z.ZodObject<{
+    ptyId: z.ZodString;
+    streamVia: z.ZodLiteral<"sse-events">;
+    supportsInput: z.ZodBoolean;
+}, z.core.$strip>;
+type PtyOpenResponse = z.infer<typeof PtyOpenResponse>;
+declare const PtyWriteRequest: z.ZodObject<{
+    ptyId: z.ZodString;
+    data: z.ZodString;
+}, z.core.$strip>;
+type PtyWriteRequest = z.infer<typeof PtyWriteRequest>;
+declare const PtyResizeRequest: z.ZodObject<{
+    ptyId: z.ZodString;
+    cols: z.ZodNumber;
+    rows: z.ZodNumber;
+}, z.core.$strip>;
+type PtyResizeRequest = z.infer<typeof PtyResizeRequest>;
+declare const PtyCloseRequest: z.ZodObject<{
+    ptyId: z.ZodString;
+}, z.core.$strip>;
+type PtyCloseRequest = z.infer<typeof PtyCloseRequest>;
+declare const SessionStructuredCapabilities: z.ZodObject<{
+    FileSystem: z.ZodObject<{
+        available: z.ZodBoolean;
+        readOnly: z.ZodBoolean;
+        root: z.ZodString;
+    }, z.core.$strip>;
+    Terminal: z.ZodObject<{
+        events: z.ZodBoolean;
+        exec: z.ZodBoolean;
+        pty: z.ZodObject<{
+            available: z.ZodBoolean;
+        }, z.core.$strip>;
+    }, z.core.$strip>;
+    Git: z.ZodObject<{
+        available: z.ZodBoolean;
+        repos: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+type SessionStructuredCapabilities = z.infer<typeof SessionStructuredCapabilities>;
 declare const SessionEvent: z.ZodObject<{
     id: z.ZodString;
     workspaceId: z.ZodString;
@@ -2279,6 +3520,20 @@ declare const SessionEvent: z.ZodObject<{
         "goal.paused": "goal.paused";
         "goal.resumed": "goal.resumed";
         "goal.continuation": "goal.continuation";
+        "stream.url.rotated": "stream.url.rotated";
+        "stream.opened": "stream.opened";
+        "stream.closed": "stream.closed";
+        "stream.revoked": "stream.revoked";
+        "recording.started": "recording.started";
+        "recording.available": "recording.available";
+        "recording.failed": "recording.failed";
+        "fs.changed": "fs.changed";
+        "git.changed": "git.changed";
+        "terminal.pty.started": "terminal.pty.started";
+        "terminal.pty.output.delta": "terminal.pty.output.delta";
+        "terminal.pty.exited": "terminal.pty.exited";
+        "session.title_set": "session.title_set";
+        "codex.account.switched": "codex.account.switched";
     }>;
     payload: z.ZodDefault<z.ZodUnknown>;
     occurredAt: z.ZodString;
@@ -2304,6 +3559,7 @@ declare const CreateSessionRequest: z.ZodObject<{
     tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
         kind: z.ZodLiteral<"mcp">;
         id: z.ZodString;
+        optional: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>>;
     metadata: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     model: z.ZodOptional<z.ZodString>;
@@ -2320,7 +3576,16 @@ declare const CreateSessionRequest: z.ZodObject<{
         modal: "modal";
         local: "local";
         none: "none";
+        daytona: "daytona";
+        runloop: "runloop";
+        e2b: "e2b";
+        blaxel: "blaxel";
+        cloudflare: "cloudflare";
+        vercel: "vercel";
+        selfhosted: "selfhosted";
     }>>;
+    targetSandboxId: z.ZodOptional<z.ZodString>;
+    workingDir: z.ZodOptional<z.ZodString>;
     environmentId: z.ZodOptional<z.ZodString>;
     goal: z.ZodOptional<z.ZodObject<{
         text: z.ZodString;
@@ -2341,8 +3606,13 @@ declare const CreateSessionRequest: z.ZodObject<{
         "sessions:create": "sessions:create";
         "sessions:read": "sessions:read";
         "sessions:control": "sessions:control";
+        "stream:view": "stream:view";
+        "stream:control": "stream:control";
+        "stream:acknowledge": "stream:acknowledge";
         "files:upload": "files:upload";
         "files:read": "files:read";
+        "files:write": "files:write";
+        "terminal:attach": "terminal:attach";
         "documents:manage": "documents:manage";
         "documents:search": "documents:search";
         "scheduled_tasks:manage": "scheduled_tasks:manage";
@@ -2353,7 +3623,12 @@ declare const CreateSessionRequest: z.ZodObject<{
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
         "goals:manage": "goals:manage";
+        "enrollments:read": "enrollments:read";
+        "enrollments:manage": "enrollments:manage";
     }>>>;
+    sandbox: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"shared">, z.ZodLiteral<"new">, z.ZodObject<{
+        groupId: z.ZodString;
+    }, z.core.$strip>]>>;
 }, z.core.$strip>;
 type CreateSessionRequest = z.infer<typeof CreateSessionRequest>;
 declare const ClientSessionEvent: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -2377,6 +3652,7 @@ declare const ClientSessionEvent: z.ZodDiscriminatedUnion<[z.ZodObject<{
         tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
             kind: z.ZodLiteral<"mcp">;
             id: z.ZodString;
+            optional: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>>;
         model: z.ZodOptional<z.ZodString>;
         reasoningEffort: z.ZodOptional<z.ZodEnum<{
@@ -2448,6 +3724,20 @@ declare const SessionBusMessage: z.ZodObject<{
             "goal.paused": "goal.paused";
             "goal.resumed": "goal.resumed";
             "goal.continuation": "goal.continuation";
+            "stream.url.rotated": "stream.url.rotated";
+            "stream.opened": "stream.opened";
+            "stream.closed": "stream.closed";
+            "stream.revoked": "stream.revoked";
+            "recording.started": "recording.started";
+            "recording.available": "recording.available";
+            "recording.failed": "recording.failed";
+            "fs.changed": "fs.changed";
+            "git.changed": "git.changed";
+            "terminal.pty.started": "terminal.pty.started";
+            "terminal.pty.output.delta": "terminal.pty.output.delta";
+            "terminal.pty.exited": "terminal.pty.exited";
+            "session.title_set": "session.title_set";
+            "codex.account.switched": "codex.account.switched";
         }>;
         payload: z.ZodDefault<z.ZodUnknown>;
         occurredAt: z.ZodString;
@@ -2490,10 +3780,676 @@ declare const ClientAuthConfig: z.ZodDiscriminatedUnion<[z.ZodObject<{
     session: z.ZodLiteral<"cookie">;
 }, z.core.$strip>], "mode">;
 type ClientAuthConfig = z.infer<typeof ClientAuthConfig>;
+declare const CapabilityUnavailableReason: z.ZodEnum<{
+    backend_unsupported: "backend_unsupported";
+    os_unsupported: "os_unsupported";
+    not_provisioned: "not_provisioned";
+    disabled_by_policy: "disabled_by_policy";
+    lease_cold: "lease_cold";
+    tier_headless: "tier_headless";
+    agent_offline: "agent_offline";
+    agent_reconnecting: "agent_reconnecting";
+    consent_required: "consent_required";
+    display_unavailable: "display_unavailable";
+}>;
+type CapabilityUnavailableReason = z.infer<typeof CapabilityUnavailableReason>;
+declare const SessionCapabilities: z.ZodObject<{
+    sessionId: z.ZodString;
+    backend: z.ZodEnum<{
+        docker: "docker";
+        modal: "modal";
+        local: "local";
+        none: "none";
+        daytona: "daytona";
+        runloop: "runloop";
+        e2b: "e2b";
+        blaxel: "blaxel";
+        cloudflare: "cloudflare";
+        vercel: "vercel";
+        selfhosted: "selfhosted";
+    }>;
+    os: z.ZodEnum<{
+        linux: "linux";
+        macos: "macos";
+        windows: "windows";
+    }>;
+    liveness: z.ZodEnum<{
+        cold: "cold";
+        warming: "warming";
+        warm: "warm";
+        draining: "draining";
+    }>;
+    leaseEpoch: z.ZodNumber;
+    viewerHeartbeatIntervalMs: z.ZodDefault<z.ZodNumber>;
+    FileSystem: z.ZodObject<{
+        available: z.ZodBoolean;
+        readOnly: z.ZodBoolean;
+        root: z.ZodString;
+        pathSep: z.ZodEnum<{
+            "/": "/";
+            "\\": "\\";
+        }>;
+        treeMode: z.ZodEnum<{
+            lazy: "lazy";
+            snapshot: "snapshot";
+        }>;
+        reason: z.ZodNullable<z.ZodEnum<{
+            backend_unsupported: "backend_unsupported";
+            os_unsupported: "os_unsupported";
+            not_provisioned: "not_provisioned";
+            disabled_by_policy: "disabled_by_policy";
+            lease_cold: "lease_cold";
+            tier_headless: "tier_headless";
+            agent_offline: "agent_offline";
+            agent_reconnecting: "agent_reconnecting";
+            consent_required: "consent_required";
+            display_unavailable: "display_unavailable";
+        }>>;
+    }, z.core.$strip>;
+    Terminal: z.ZodObject<{
+        transport: z.ZodNullable<z.ZodEnum<{
+            "sse-events": "sse-events";
+            "pty-ws": "pty-ws";
+        }>>;
+        ptyCapable: z.ZodBoolean;
+        shell: z.ZodString;
+        url: z.ZodNullable<z.ZodString>;
+        token: z.ZodNullable<z.ZodString>;
+        expiresAt: z.ZodNullable<z.ZodString>;
+        reason: z.ZodNullable<z.ZodEnum<{
+            backend_unsupported: "backend_unsupported";
+            os_unsupported: "os_unsupported";
+            not_provisioned: "not_provisioned";
+            disabled_by_policy: "disabled_by_policy";
+            lease_cold: "lease_cold";
+            tier_headless: "tier_headless";
+            agent_offline: "agent_offline";
+            agent_reconnecting: "agent_reconnecting";
+            consent_required: "consent_required";
+            display_unavailable: "display_unavailable";
+        }>>;
+    }, z.core.$strip>;
+    Git: z.ZodObject<{
+        available: z.ZodBoolean;
+        repos: z.ZodArray<z.ZodString>;
+        reason: z.ZodNullable<z.ZodEnum<{
+            backend_unsupported: "backend_unsupported";
+            os_unsupported: "os_unsupported";
+            not_provisioned: "not_provisioned";
+            disabled_by_policy: "disabled_by_policy";
+            lease_cold: "lease_cold";
+            tier_headless: "tier_headless";
+            agent_offline: "agent_offline";
+            agent_reconnecting: "agent_reconnecting";
+            consent_required: "consent_required";
+            display_unavailable: "display_unavailable";
+        }>>;
+    }, z.core.$strip>;
+    DesktopStream: z.ZodObject<{
+        transport: z.ZodNullable<z.ZodEnum<{
+            "vnc-ws": "vnc-ws";
+            "rdp-ws": "rdp-ws";
+            webrtc: "webrtc";
+            "relay-frames": "relay-frames";
+        }>>;
+        client: z.ZodNullable<z.ZodEnum<{
+            novnc: "novnc";
+            "web-rdp": "web-rdp";
+            frames: "frames";
+        }>>;
+        mode: z.ZodDefault<z.ZodEnum<{
+            "read-only": "read-only";
+            interactive: "interactive";
+        }>>;
+        url: z.ZodNullable<z.ZodString>;
+        token: z.ZodNullable<z.ZodString>;
+        expiresAt: z.ZodNullable<z.ZodString>;
+        resolution: z.ZodDefault<z.ZodTuple<[z.ZodNumber, z.ZodNumber], null>>;
+        unredacted: z.ZodBoolean;
+        requiresAcknowledgment: z.ZodBoolean;
+        acknowledged: z.ZodBoolean;
+        shared: z.ZodDefault<z.ZodBoolean>;
+        sharedSessionIds: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        reason: z.ZodNullable<z.ZodEnum<{
+            backend_unsupported: "backend_unsupported";
+            os_unsupported: "os_unsupported";
+            not_provisioned: "not_provisioned";
+            disabled_by_policy: "disabled_by_policy";
+            lease_cold: "lease_cold";
+            tier_headless: "tier_headless";
+            agent_offline: "agent_offline";
+            agent_reconnecting: "agent_reconnecting";
+            consent_required: "consent_required";
+            display_unavailable: "display_unavailable";
+        }>>;
+    }, z.core.$strip>;
+    Recording: z.ZodObject<{
+        available: z.ZodBoolean;
+        modes: z.ZodArray<z.ZodEnum<{
+            manual: "manual";
+            "on-turn": "on-turn";
+            "on-verify": "on-verify";
+        }>>;
+        codecs: z.ZodArray<z.ZodEnum<{
+            "h264-mp4": "h264-mp4";
+            "vp9-webm": "vp9-webm";
+        }>>;
+        reason: z.ZodNullable<z.ZodEnum<{
+            backend_unsupported: "backend_unsupported";
+            os_unsupported: "os_unsupported";
+            not_provisioned: "not_provisioned";
+            disabled_by_policy: "disabled_by_policy";
+            lease_cold: "lease_cold";
+            tier_headless: "tier_headless";
+            agent_offline: "agent_offline";
+            agent_reconnecting: "agent_reconnecting";
+            consent_required: "consent_required";
+            display_unavailable: "display_unavailable";
+        }>>;
+    }, z.core.$strip>;
+    ComputerUse: z.ZodObject<{
+        available: z.ZodBoolean;
+        readOnly: z.ZodBoolean;
+        reason: z.ZodNullable<z.ZodEnum<{
+            backend_unsupported: "backend_unsupported";
+            os_unsupported: "os_unsupported";
+            not_provisioned: "not_provisioned";
+            disabled_by_policy: "disabled_by_policy";
+            lease_cold: "lease_cold";
+            tier_headless: "tier_headless";
+            agent_offline: "agent_offline";
+            agent_reconnecting: "agent_reconnecting";
+            consent_required: "consent_required";
+            display_unavailable: "display_unavailable";
+        }>>;
+    }, z.core.$strip>;
+    negotiatedAt: z.ZodString;
+}, z.core.$strip>;
+type SessionCapabilities = z.infer<typeof SessionCapabilities>;
+declare const AttachViewerRequest: z.ZodObject<{
+    viewerId: z.ZodOptional<z.ZodString>;
+    desktop: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+type AttachViewerRequest = z.infer<typeof AttachViewerRequest>;
+declare const ViewerHolder: z.ZodObject<{
+    viewerId: z.ZodString;
+    sandboxGroupId: z.ZodString;
+    liveness: z.ZodEnum<{
+        cold: "cold";
+        warming: "warming";
+        warm: "warm";
+        draining: "draining";
+    }>;
+    leaseEpoch: z.ZodNumber;
+    viewerHeartbeatIntervalMs: z.ZodNumber;
+    dataPlaneUrl: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+type ViewerHolder = z.infer<typeof ViewerHolder>;
+declare const AcknowledgeStreamRequest: z.ZodObject<{
+    acknowledgeUnredacted: z.ZodDefault<z.ZodBoolean>;
+    acknowledgeShared: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+type AcknowledgeStreamRequest = z.infer<typeof AcknowledgeStreamRequest>;
+declare const AcknowledgeStreamResponse: z.ZodObject<{
+    acknowledged: z.ZodBoolean;
+    acknowledgedShared: z.ZodBoolean;
+}, z.core.$strip>;
+type AcknowledgeStreamResponse = z.infer<typeof AcknowledgeStreamResponse>;
+declare const ViewerHeartbeatRequest: z.ZodObject<{
+    leaseEpoch: z.ZodNumber;
+}, z.core.$strip>;
+type ViewerHeartbeatRequest = z.infer<typeof ViewerHeartbeatRequest>;
+declare const ViewerHeartbeatResponse: z.ZodObject<{
+    alive: z.ZodBoolean;
+}, z.core.$strip>;
+type ViewerHeartbeatResponse = z.infer<typeof ViewerHeartbeatResponse>;
+declare const EnrollmentOs: z.ZodEnum<{
+    linux: "linux";
+    macos: "macos";
+    windows: "windows";
+}>;
+type EnrollmentOs = z.infer<typeof EnrollmentOs>;
+declare const EnrollmentArch: z.ZodEnum<{
+    x86_64: "x86_64";
+    aarch64: "aarch64";
+}>;
+type EnrollmentArch = z.infer<typeof EnrollmentArch>;
+declare const DeviceEnrollmentStartRequest: z.ZodObject<{
+    publicKey: z.ZodString;
+    os: z.ZodDefault<z.ZodEnum<{
+        linux: "linux";
+        macos: "macos";
+        windows: "windows";
+    }>>;
+    arch: z.ZodDefault<z.ZodEnum<{
+        x86_64: "x86_64";
+        aarch64: "aarch64";
+    }>>;
+    machineName: z.ZodOptional<z.ZodString>;
+    exposure: z.ZodDefault<z.ZodLiteral<"whole-machine">>;
+    canOfferDisplay: z.ZodDefault<z.ZodBoolean>;
+    requestsScreenControl: z.ZodDefault<z.ZodBoolean>;
+    workspaceId: z.ZodString;
+}, z.core.$strip>;
+type DeviceEnrollmentStartRequest = z.infer<typeof DeviceEnrollmentStartRequest>;
+declare const DeviceEnrollmentStartResponse: z.ZodObject<{
+    deviceCode: z.ZodString;
+    userCode: z.ZodString;
+    verificationUri: z.ZodString;
+    verificationUriComplete: z.ZodString;
+    intervalSeconds: z.ZodNumber;
+    expiresInSeconds: z.ZodNumber;
+}, z.core.$strip>;
+type DeviceEnrollmentStartResponse = z.infer<typeof DeviceEnrollmentStartResponse>;
+declare const DeviceEnrollmentApproveRequest: z.ZodObject<{
+    userCode: z.ZodString;
+    allowScreenControl: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+type DeviceEnrollmentApproveRequest = z.infer<typeof DeviceEnrollmentApproveRequest>;
+declare const DeviceEnrollmentApproveResponse: z.ZodObject<{
+    approved: z.ZodBoolean;
+    enrollmentId: z.ZodString;
+    sandboxId: z.ZodString;
+    allowScreenControl: z.ZodBoolean;
+}, z.core.$strip>;
+type DeviceEnrollmentApproveResponse = z.infer<typeof DeviceEnrollmentApproveResponse>;
+declare const DeviceEnrollmentPollRequest: z.ZodObject<{
+    deviceCode: z.ZodString;
+}, z.core.$strip>;
+type DeviceEnrollmentPollRequest = z.infer<typeof DeviceEnrollmentPollRequest>;
+declare const DeviceEnrollmentState: z.ZodEnum<{
+    disabled: "disabled";
+    expired: "expired";
+    pending: "pending";
+    authorized: "authorized";
+    denied: "denied";
+}>;
+type DeviceEnrollmentState = z.infer<typeof DeviceEnrollmentState>;
+declare const EnrollmentCredentialsResponse: z.ZodObject<{
+    agentId: z.ZodString;
+    workspaceId: z.ZodString;
+    bearer: z.ZodString;
+    subjectPrefix: z.ZodString;
+    natsUrls: z.ZodArray<z.ZodString>;
+    relayUrl: z.ZodString;
+    relayToken: z.ZodString;
+    natsAccountCreds: z.ZodString;
+    updatePublicKey: z.ZodString;
+    consentedWholeMachine: z.ZodBoolean;
+    consentedScreenControl: z.ZodBoolean;
+}, z.core.$strip>;
+type EnrollmentCredentialsResponse = z.infer<typeof EnrollmentCredentialsResponse>;
+declare const DeviceEnrollmentPollResponse: z.ZodObject<{
+    state: z.ZodEnum<{
+        disabled: "disabled";
+        expired: "expired";
+        pending: "pending";
+        authorized: "authorized";
+        denied: "denied";
+    }>;
+    credentials: z.ZodOptional<z.ZodObject<{
+        agentId: z.ZodString;
+        workspaceId: z.ZodString;
+        bearer: z.ZodString;
+        subjectPrefix: z.ZodString;
+        natsUrls: z.ZodArray<z.ZodString>;
+        relayUrl: z.ZodString;
+        relayToken: z.ZodString;
+        natsAccountCreds: z.ZodString;
+        updatePublicKey: z.ZodString;
+        consentedWholeMachine: z.ZodBoolean;
+        consentedScreenControl: z.ZodBoolean;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type DeviceEnrollmentPollResponse = z.infer<typeof DeviceEnrollmentPollResponse>;
+declare const EnrollmentSummary: z.ZodObject<{
+    id: z.ZodString;
+    pubkey: z.ZodString;
+    exposure: z.ZodLiteral<"whole-machine">;
+    hasDisplay: z.ZodBoolean;
+    allowScreenControl: z.ZodBoolean;
+    status: z.ZodEnum<{
+        active: "active";
+        revoked: "revoked";
+    }>;
+    os: z.ZodEnum<{
+        linux: "linux";
+        macos: "macos";
+        windows: "windows";
+    }>;
+    arch: z.ZodString;
+    lastSeenAt: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+    revokedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+type EnrollmentSummary = z.infer<typeof EnrollmentSummary>;
+declare const ListEnrollmentsResponse: z.ZodObject<{
+    enrollments: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        pubkey: z.ZodString;
+        exposure: z.ZodLiteral<"whole-machine">;
+        hasDisplay: z.ZodBoolean;
+        allowScreenControl: z.ZodBoolean;
+        status: z.ZodEnum<{
+            active: "active";
+            revoked: "revoked";
+        }>;
+        os: z.ZodEnum<{
+            linux: "linux";
+            macos: "macos";
+            windows: "windows";
+        }>;
+        arch: z.ZodString;
+        lastSeenAt: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+        revokedAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type ListEnrollmentsResponse = z.infer<typeof ListEnrollmentsResponse>;
+declare const RevokeEnrollmentResponse: z.ZodObject<{
+    revoked: z.ZodBoolean;
+}, z.core.$strip>;
+type RevokeEnrollmentResponse = z.infer<typeof RevokeEnrollmentResponse>;
+declare const DeviceEnrollmentLookupRequest: z.ZodObject<{
+    userCode: z.ZodString;
+}, z.core.$strip>;
+type DeviceEnrollmentLookupRequest = z.infer<typeof DeviceEnrollmentLookupRequest>;
+declare const DeviceEnrollmentLookupMachine: z.ZodObject<{
+    machineName: z.ZodNullable<z.ZodString>;
+    os: z.ZodEnum<{
+        linux: "linux";
+        macos: "macos";
+        windows: "windows";
+    }>;
+    arch: z.ZodString;
+    canOfferDisplay: z.ZodBoolean;
+    requestsScreenControl: z.ZodBoolean;
+}, z.core.$strip>;
+type DeviceEnrollmentLookupMachine = z.infer<typeof DeviceEnrollmentLookupMachine>;
+declare const DeviceEnrollmentLookupResponse: z.ZodObject<{
+    workspaceId: z.ZodString;
+    userCode: z.ZodString;
+    machine: z.ZodObject<{
+        machineName: z.ZodNullable<z.ZodString>;
+        os: z.ZodEnum<{
+            linux: "linux";
+            macos: "macos";
+            windows: "windows";
+        }>;
+        arch: z.ZodString;
+        canOfferDisplay: z.ZodBoolean;
+        requestsScreenControl: z.ZodBoolean;
+    }, z.core.$strip>;
+    expiresAt: z.ZodString;
+}, z.core.$strip>;
+type DeviceEnrollmentLookupResponse = z.infer<typeof DeviceEnrollmentLookupResponse>;
+declare const DeviceEnrollmentDenyRequest: z.ZodObject<{
+    userCode: z.ZodString;
+}, z.core.$strip>;
+type DeviceEnrollmentDenyRequest = z.infer<typeof DeviceEnrollmentDenyRequest>;
+declare const DeviceEnrollmentDenyResponse: z.ZodObject<{
+    denied: z.ZodBoolean;
+}, z.core.$strip>;
+type DeviceEnrollmentDenyResponse = z.infer<typeof DeviceEnrollmentDenyResponse>;
+declare const MintEnrollTokenRequest: z.ZodObject<{
+    allowScreenControl: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+type MintEnrollTokenRequest = z.infer<typeof MintEnrollTokenRequest>;
+declare const MintEnrollTokenResponse: z.ZodObject<{
+    token: z.ZodString;
+    expiresAt: z.ZodString;
+    expiresInSeconds: z.ZodNumber;
+}, z.core.$strip>;
+type MintEnrollTokenResponse = z.infer<typeof MintEnrollTokenResponse>;
+declare const EnrollTokenExchangeRequest: z.ZodObject<{
+    token: z.ZodString;
+    publicKey: z.ZodString;
+    os: z.ZodDefault<z.ZodEnum<{
+        linux: "linux";
+        macos: "macos";
+        windows: "windows";
+    }>>;
+    arch: z.ZodDefault<z.ZodEnum<{
+        x86_64: "x86_64";
+        aarch64: "aarch64";
+    }>>;
+    machineName: z.ZodOptional<z.ZodString>;
+    exposure: z.ZodDefault<z.ZodLiteral<"whole-machine">>;
+    canOfferDisplay: z.ZodDefault<z.ZodBoolean>;
+    requestsScreenControl: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+type EnrollTokenExchangeRequest = z.infer<typeof EnrollTokenExchangeRequest>;
+declare const EnrollTokenExchangeResponse: z.ZodObject<{
+    credentials: z.ZodObject<{
+        agentId: z.ZodString;
+        workspaceId: z.ZodString;
+        bearer: z.ZodString;
+        subjectPrefix: z.ZodString;
+        natsUrls: z.ZodArray<z.ZodString>;
+        relayUrl: z.ZodString;
+        relayToken: z.ZodString;
+        natsAccountCreds: z.ZodString;
+        updatePublicKey: z.ZodString;
+        consentedWholeMachine: z.ZodBoolean;
+        consentedScreenControl: z.ZodBoolean;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+type EnrollTokenExchangeResponse = z.infer<typeof EnrollTokenExchangeResponse>;
+/**
+ * A point-in-time machine metrics sample as the dashboard reads it. `cpuPct` and
+ * the load averages are 0..N doubles; the byte figures are integers; `gpuUtilPct`
+ * / `gpuMemBytes` are null when no GPU was present at sample time (the wire
+ * contract: absence == not-reported, NEVER a real zero). `runQueue` is the
+ * runnable-count contention signal. `sampledAt` is an ISO-8601 instant.
+ */
+declare const MetricSample: z.ZodObject<{
+    cpuPct: z.ZodNumber;
+    load1: z.ZodNumber;
+    load5: z.ZodNumber;
+    load15: z.ZodNumber;
+    memUsedBytes: z.ZodNumber;
+    memTotalBytes: z.ZodNumber;
+    diskUsedBytes: z.ZodNumber;
+    diskTotalBytes: z.ZodNumber;
+    gpuUtilPct: z.ZodNullable<z.ZodNumber>;
+    gpuMemBytes: z.ZodNullable<z.ZodNumber>;
+    runQueue: z.ZodNumber;
+    sampledAt: z.ZodString;
+}, z.core.$strip>;
+type MetricSample = z.infer<typeof MetricSample>;
+/** The derived dashboard state of a machine. The M3 liveness
+ *  (online/reconnecting/offline) plus the enrollment-derived consent/display
+ *  reasons (consent_required / display_unavailable) and the in-flight device-flow
+ *  (enrolling). */
+declare const MachineState: z.ZodEnum<{
+    consent_required: "consent_required";
+    display_unavailable: "display_unavailable";
+    online: "online";
+    reconnecting: "reconnecting";
+    offline: "offline";
+    enrolling: "enrolling";
+}>;
+type MachineState = z.infer<typeof MachineState>;
+declare const MachineKind: z.ZodEnum<{
+    modal: "modal";
+    selfhosted: "selfhosted";
+}>;
+type MachineKind = z.infer<typeof MachineKind>;
+/**
+ * A machine as the Machines dashboard renders it. The workspace's enrolled
+ * selfhosted machines PLUS the session's synthetic Modal group box
+ * (`isSessionGroup: true`). `active` marks the session's currently-active
+ * routing target. `sharedSessionCount` is the lease refcount (how many sessions
+ * share this whole machine). `metrics` is the latest sample, or null when none
+ * has landed yet (just enrolled / offline before a first heartbeat).
+ */
+declare const MachineView: z.ZodObject<{
+    sandboxId: z.ZodString;
+    enrollmentId: z.ZodNullable<z.ZodString>;
+    name: z.ZodString;
+    kind: z.ZodEnum<{
+        modal: "modal";
+        selfhosted: "selfhosted";
+    }>;
+    state: z.ZodEnum<{
+        consent_required: "consent_required";
+        display_unavailable: "display_unavailable";
+        online: "online";
+        reconnecting: "reconnecting";
+        offline: "offline";
+        enrolling: "enrolling";
+    }>;
+    active: z.ZodBoolean;
+    isSessionGroup: z.ZodBoolean;
+    os: z.ZodString;
+    arch: z.ZodString;
+    hasDisplay: z.ZodBoolean;
+    allowScreenControl: z.ZodBoolean;
+    sharedSessionCount: z.ZodNumber;
+    lastSeenAt: z.ZodNullable<z.ZodString>;
+    metrics: z.ZodNullable<z.ZodObject<{
+        cpuPct: z.ZodNumber;
+        load1: z.ZodNumber;
+        load5: z.ZodNumber;
+        load15: z.ZodNumber;
+        memUsedBytes: z.ZodNumber;
+        memTotalBytes: z.ZodNumber;
+        diskUsedBytes: z.ZodNumber;
+        diskTotalBytes: z.ZodNumber;
+        gpuUtilPct: z.ZodNullable<z.ZodNumber>;
+        gpuMemBytes: z.ZodNullable<z.ZodNumber>;
+        runQueue: z.ZodNumber;
+        sampledAt: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type MachineView = z.infer<typeof MachineView>;
+/**
+ * GET /v1/workspaces/:ws/machines — the dashboard list. `activeSandboxId` /
+ * `activeEpoch` echo the session's epoch-fenced active-sandbox pointer (null
+ * activeSandboxId == the session's own group box is active).
+ */
+declare const MachinesResponse: z.ZodObject<{
+    activeSandboxId: z.ZodNullable<z.ZodString>;
+    activeEpoch: z.ZodNumber;
+    machines: z.ZodArray<z.ZodObject<{
+        sandboxId: z.ZodString;
+        enrollmentId: z.ZodNullable<z.ZodString>;
+        name: z.ZodString;
+        kind: z.ZodEnum<{
+            modal: "modal";
+            selfhosted: "selfhosted";
+        }>;
+        state: z.ZodEnum<{
+            consent_required: "consent_required";
+            display_unavailable: "display_unavailable";
+            online: "online";
+            reconnecting: "reconnecting";
+            offline: "offline";
+            enrolling: "enrolling";
+        }>;
+        active: z.ZodBoolean;
+        isSessionGroup: z.ZodBoolean;
+        os: z.ZodString;
+        arch: z.ZodString;
+        hasDisplay: z.ZodBoolean;
+        allowScreenControl: z.ZodBoolean;
+        sharedSessionCount: z.ZodNumber;
+        lastSeenAt: z.ZodNullable<z.ZodString>;
+        metrics: z.ZodNullable<z.ZodObject<{
+            cpuPct: z.ZodNumber;
+            load1: z.ZodNumber;
+            load5: z.ZodNumber;
+            load15: z.ZodNumber;
+            memUsedBytes: z.ZodNumber;
+            memTotalBytes: z.ZodNumber;
+            diskUsedBytes: z.ZodNumber;
+            diskTotalBytes: z.ZodNumber;
+            gpuUtilPct: z.ZodNullable<z.ZodNumber>;
+            gpuMemBytes: z.ZodNullable<z.ZodNumber>;
+            runQueue: z.ZodNumber;
+            sampledAt: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type MachinesResponse = z.infer<typeof MachinesResponse>;
+/**
+ * POST /v1/workspaces/:ws/sessions/:sessionId/active-sandbox — the user-
+ * authenticated swap of a session's active sandbox (the same epoch-fenced
+ * mechanic the M7 `sandbox_swap` MCP tool exposes to the agent). `target` is a
+ * `MachinesResponse` machine's `sandboxId`, or "session"/"default" to swap back
+ * to the session's own group box.
+ */
+declare const SwapActiveSandboxRequest: z.ZodObject<{
+    target: z.ZodString;
+}, z.core.$strip>;
+type SwapActiveSandboxRequest = z.infer<typeof SwapActiveSandboxRequest>;
+/**
+ * The swap outcome (mirrors the server `FleetSwapResult`). `swapped` is true on a
+ * successful repoint OR a no-op (already pointed there); `reason` carries the
+ * failure detail (unowned/offline target, or a lost epoch fence) when false.
+ */
+declare const SwapActiveSandboxResponse: z.ZodObject<{
+    swapped: z.ZodBoolean;
+    activeSandboxId: z.ZodNullable<z.ZodString>;
+    activeEpoch: z.ZodNumber;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type SwapActiveSandboxResponse = z.infer<typeof SwapActiveSandboxResponse>;
+/**
+ * GET /v1/workspaces/:ws/machines/:enrollmentId/metrics/series?window=1h — the
+ * downsampled (~1/min) history the dashboard time-range reads.
+ */
+declare const MachineMetricsSeriesResponse: z.ZodObject<{
+    samples: z.ZodArray<z.ZodObject<{
+        cpuPct: z.ZodNumber;
+        load1: z.ZodNumber;
+        load5: z.ZodNumber;
+        load15: z.ZodNumber;
+        memUsedBytes: z.ZodNumber;
+        memTotalBytes: z.ZodNumber;
+        diskUsedBytes: z.ZodNumber;
+        diskTotalBytes: z.ZodNumber;
+        gpuUtilPct: z.ZodNullable<z.ZodNumber>;
+        gpuMemBytes: z.ZodNullable<z.ZodNumber>;
+        runQueue: z.ZodNumber;
+        sampledAt: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type MachineMetricsSeriesResponse = z.infer<typeof MachineMetricsSeriesResponse>;
+/**
+ * A single host-exposed model + the provider that serves it, as surfaced to
+ * clients (SDK + React composer) by GET /v1/config/client. The wire `api`
+ * ("responses" | "chat") lets a client reason about provider capabilities; the
+ * provider id/label drive the picker's grouping. This mirrors the runtime's
+ * ConfiguredModel (packages/config) projected to the client-safe fields.
+ */
+declare const ClientModel: z.ZodObject<{
+    id: z.ZodString;
+    label: z.ZodString;
+    provider: z.ZodString;
+    providerLabel: z.ZodString;
+    api: z.ZodEnum<{
+        responses: "responses";
+        chat: "chat";
+    }>;
+    contextWindowTokens: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+type ClientModel = z.infer<typeof ClientModel>;
 declare const ClientConfig: z.ZodObject<{
     deploymentRevision: z.ZodString;
     defaultModel: z.ZodString;
     allowedModels: z.ZodArray<z.ZodString>;
+    models: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        label: z.ZodString;
+        provider: z.ZodString;
+        providerLabel: z.ZodString;
+        api: z.ZodEnum<{
+            responses: "responses";
+            chat: "chat";
+        }>;
+        contextWindowTokens: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>>;
     defaultReasoningEffort: z.ZodEnum<{
         none: "none";
         minimal: "minimal";
@@ -2536,6 +4492,11 @@ declare const ClientConfig: z.ZodObject<{
         mode: z.ZodLiteral<"managedSession">;
         session: z.ZodLiteral<"cookie">;
     }, z.core.$strip>], "mode">>;
+    structuredServices: z.ZodDefault<z.ZodObject<{
+        fileSystem: z.ZodBoolean;
+        git: z.ZodBoolean;
+        terminalEvents: z.ZodBoolean;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 type ClientConfig = z.infer<typeof ClientConfig>;
 type HealthResponse = {
@@ -2544,4 +4505,4 @@ type HealthResponse = {
     ok: boolean;
 };
 
-export { AccessContext, AccessGrant, AccountGrant, AccountRole, AddDocumentRequest, ApiKey, BillingBalance, BillingMode, CLEARED_RUN_STATE_BLOB, CLEARED_RUN_STATE_MARKER, CapabilityCatalogItem, CapabilityCatalogResponse, CapabilityInstallation, CapabilityInstallationStatus, CapabilityKind, CapabilityPack, CapabilityPackConnector, CapabilityPackConnectorAuthModel, CapabilityPackKnowledge, CapabilityPackScheduledTaskTemplate, CapabilityPackSkill, CapabilityPackSkillFile, CapabilityRuntime, CapabilitySource, ClearSessionContextRequest, ClientAuthConfig, ClientConfig, ClientSessionEvent, CompactSessionContextRequest, CompactSessionContextResult, CompleteFileUploadResponse, CreateApiKeyRequest, CreateApiKeyResponse, CreateCapabilityCatalogItemRequest, CreateCheckoutRequest, CreateCheckoutResponse, CreateDocumentBaseRequest, CreateFileUploadRequest, CreateFileUploadResponse, CreateScheduledTaskRequest, CreateSessionRequest, CreateSocialConnectionRequest, CreateSocialPostRequest, CreateWorkspaceEnvironmentRequest, CreateWorkspaceRequest, DelegatedAccessTokenPayload, DiscoverMcpCapabilitiesResponse, Document, DocumentBase, DocumentSearchRequest, DocumentSearchResult, DocumentStatus, EnableCapabilityRequest, EnablePackRequest, EntitlementValue, Entitlements, EntitlementsMode, ErrorCode, ErrorEnvelope, FileAsset, FileDownloadUrlResponse, FileResourceRef, FileStatus, FileUploadStatus, GitHubAppManifestCreate, GitHubRepository, GoalSpec, type HealthResponse, LimitAction, LimitDecision, ManagedAccount, MarketingDailyAnalysisTaskRequest, PackInstallation, PackInstallationStatus, PageInfo, Permission, ProductAccessMode, ReasoningEffort, RegisterCapabilityPackRequest, ReorderSessionTurnsRequest, RepositoryResourceRef, ResourceRef, ResourceRefConflictError, SandboxBackend, ScheduledTask, ScheduledTaskAgentConfig, ScheduledTaskOverlapPolicy, ScheduledTaskRun, ScheduledTaskRunMode, ScheduledTaskRunStatus, ScheduledTaskScheduleSpec, ScheduledTaskStatus, ScheduledTaskTriggerType, Session, SessionBusMessage, SessionEvent, SessionEventType, SessionGoal, SessionGoalCreatedBy, SessionGoalPausedReason, SessionGoalStatus, SessionStatus, SessionTurn, SessionTurnSource, SessionTurnStatus, SetWorkspaceEnvironmentVariableRequest, SocialConnection, SocialConnectionStatus, SocialPost, SocialProvider, StaticUsageLimits, ToolRef, TriggerScheduledTaskRequest, UpdateScheduledTaskRequest, UpdateSessionGoalRequest, UpdateSessionTurnRequest, UpdateWorkspaceEnvironmentRequest, UpdateWorkspaceRequest, UsageEvent, UsageEventType, UsageLimitsMode, Workspace, WorkspaceEnvironment, WorkspaceEnvironmentVariableMetadata, WorkspaceEnvironmentVariableName, WorkspaceRegisteredPack, isClearedRunStateBlob, mergeResourceRefs, mergeToolRefs, paginated, reasoningEffortForMetadata, resourceIdentityKey, signDelegatedAccessToken, stableJson, verifyDelegatedAccessToken };
+export { AccessContext, AccessGrant, AccountGrant, AccountRole, AcknowledgeStreamRequest, AcknowledgeStreamResponse, AddDocumentRequest, AddWorkspaceMemberRequest, type AdmitRunInput, ApiKey, AttachViewerRequest, BillingBalance, BillingMode, CAPABILITY_DESCRIPTORS, CLEARED_RUN_STATE_BLOB, CLEARED_RUN_STATE_MARKER, CapabilityCatalogItem, CapabilityCatalogResponse, type CapabilityDescriptor, CapabilityInstallation, CapabilityInstallationStatus, CapabilityKind, CapabilityPack, CapabilityPackConnector, CapabilityPackConnectorAuthModel, CapabilityPackKnowledge, CapabilityPackScheduledTaskTemplate, CapabilityPackSkill, CapabilityPackSkillFile, CapabilityRuntime, CapabilitySource, CapabilityUnavailableReason, ClearSessionContextRequest, ClientAuthConfig, ClientConfig, ClientModel, ClientSessionEvent, CompactSessionContextRequest, CompactSessionContextResult, CompleteFileUploadResponse, type ConnectionCredentialsPort, CreateApiKeyRequest, CreateApiKeyResponse, CreateCapabilityCatalogItemRequest, CreateCheckoutRequest, CreateCheckoutResponse, CreateDocumentBaseRequest, CreateFileUploadRequest, CreateFileUploadResponse, CreateScheduledTaskRequest, CreateSessionRequest, CreateSocialConnectionRequest, CreateSocialPostRequest, CreateWorkspaceEnvironmentRequest, CreateWorkspaceRequest, DESKTOP_STREAM_PORT, DelegatedAccessTokenPayload, DeviceEnrollmentApproveRequest, DeviceEnrollmentApproveResponse, DeviceEnrollmentDenyRequest, DeviceEnrollmentDenyResponse, DeviceEnrollmentLookupMachine, DeviceEnrollmentLookupRequest, DeviceEnrollmentLookupResponse, DeviceEnrollmentPollRequest, DeviceEnrollmentPollResponse, DeviceEnrollmentStartRequest, DeviceEnrollmentStartResponse, DeviceEnrollmentState, DiscoverMcpCapabilitiesResponse, Document, DocumentBase, DocumentSearchRequest, DocumentSearchResult, DocumentStatus, EnableCapabilityRequest, EnablePackRequest, EnrollTokenExchangeRequest, EnrollTokenExchangeResponse, EnrollTokenPayload, EnrollmentArch, EnrollmentBearerPayload, EnrollmentCredentialsResponse, EnrollmentOs, EnrollmentSummary, EntitlementDecision, EntitlementValue, Entitlements, EntitlementsMode, type EntitlementsPort, ErrorCode, ErrorEnvelope, FileAsset, FileDownloadUrlResponse, FileResourceRef, FileStatus, FileUploadStatus, FsChangeKind, FsChangedPayload, FsDeleteRequest, FsDeleteResponse, FsEncoding, FsListRequest, FsListResponse, FsMkdirRequest, FsMkdirResponse, FsMoveRequest, FsMoveResponse, FsNodeType, FsReadRequest, FsReadResponse, FsTreeNode, FsWriteRequest, FsWriteResponse, GitChangedPayload, GitCommit, type GitCredentials, type GitCredentialsRequest, GitDiffHunk, GitDiffLine, GitDiffLineType, GitDiffRequest, GitDiffResponse, GitFileDiff, GitFileStatus, GitFileStatusCode, type GitHubAppApiPort, GitHubAppManifestCreate, type GitHubInstallationSummary, GitHubRepository, GitLogRequest, GitLogResponse, GitShowRequest, GitShowResponse, GitStatusRequest, GitStatusResponse, GoalSpec, type HealthResponse, LimitAction, LimitDecision, ListEnrollmentsResponse, ListWorkspaceMembersResponse, MachineKind, MachineMetricsSeriesResponse, MachineState, MachineView, MachinesResponse, ManagedAccount, MarketingDailyAnalysisTaskRequest, MetricSample, MintEnrollTokenRequest, MintEnrollTokenResponse, PackInstallation, PackInstallationStatus, PageInfo, Permission, type PortExposureKind, ProductAccessMode, PtyCloseRequest, PtyOpenRequest, PtyOpenResponse, PtyResizeRequest, PtyWriteRequest, ReasoningEffort, RecordingAvailablePayload, RecordingCodec, RecordingContentType, RecordingFailedPayload, RecordingFailedReason, RecordingMode, RecordingStartedPayload, RegisterCapabilityPackRequest, RelayTokenPayload, ReorderSessionTurnsRequest, RepositoryResourceRef, ResourceRef, ResourceRefConflictError, RevokeEnrollmentResponse, SandboxBackend, SandboxCapabilityName, SandboxCommandOutputDeltaPayload, SandboxOs, type SandboxSecrets, type SandboxSecretsRequest, ScheduledTask, ScheduledTaskAgentConfig, ScheduledTaskOverlapPolicy, ScheduledTaskRun, ScheduledTaskRunMode, ScheduledTaskRunStatus, ScheduledTaskScheduleSpec, ScheduledTaskStatus, ScheduledTaskTriggerType, Session, SessionBusMessage, SessionCapabilities, SessionEvent, SessionEventType, SessionGoal, SessionGoalCreatedBy, SessionGoalPausedReason, SessionGoalStatus, SessionStatus, SessionStructuredCapabilities, SessionTurn, SessionTurnSource, SessionTurnStatus, SetWorkspaceEnvironmentVariableRequest, SocialConnection, SocialConnectionStatus, SocialPost, SocialProvider, StaticUsageLimits, StreamClosedPayload, StreamOpenedPayload, StreamRevokedPayload, StreamTokenPayload, StreamUrlRotatedPayload, SwapActiveSandboxRequest, SwapActiveSandboxResponse, TERMINAL_STREAM_PORT, TerminalExecRequest, TerminalExecResponse, TerminalPtyExitedPayload, TerminalPtyOutputDeltaPayload, TerminalPtyStartedPayload, ToolRef, TriggerScheduledTaskRequest, UpdateScheduledTaskRequest, UpdateSessionGoalRequest, UpdateSessionRequest, UpdateSessionTurnRequest, UpdateWorkspaceEnvironmentRequest, UpdateWorkspaceMemberRequest, UpdateWorkspaceRequest, UsageEvent, UsageEventType, UsageLimitsMode, ViewerHeartbeatRequest, ViewerHeartbeatResponse, ViewerHolder, Workspace, WorkspaceEnvironment, WorkspaceEnvironmentVariableMetadata, WorkspaceEnvironmentVariableName, WorkspaceMember, WorkspaceRegisteredPack, isClearedRunStateBlob, mergeResourceRefs, mergeToolRefs, paginated, reasoningEffortForMetadata, resourceIdentityKey, signDelegatedAccessToken, signEnrollToken, signEnrollmentBearer, signRelayToken, signStreamToken, stableJson, verifyDelegatedAccessToken, verifyEnrollToken, verifyEnrollmentBearer, verifyRelayToken, verifyStreamToken };