@opengeni/contracts 0.2.0 → 0.4.0

package/dist/index.js

@@ -8,7 +8,348 @@ var SessionStatus = z.enum([
   "failed",
   "cancelled"
 ]);
-var SandboxBackend = z.enum(["docker", "modal", "local", "none"]);
+var SandboxBackend = z.enum([
+  "docker",
+  "modal",
+  "local",
+  "none",
+  "daytona",
+  "runloop",
+  "e2b",
+  "blaxel",
+  "cloudflare",
+  "vercel",
+  "selfhosted"
+]);
+var SandboxOs = z.enum(["linux", "macos", "windows"]);
+var SandboxCapabilityName = z.enum([
+  "FileSystem",
+  // Channel A: list/read/write/search (Pierre tree)
+  "Terminal",
+  // Channel A: command-output firehose (+ future pty-ws)
+  "Git",
+  // Channel A: status/diff/log/show (Pierre diff)
+  "DesktopStream",
+  // Channel B: noVNC pixels over a scoped tunnel URL
+  "Recording"
+  // ffmpeg x11grab -> object storage
+]);
+var DESKTOP_STREAM_PORT = 6080;
+var TERMINAL_STREAM_PORT = 7681;
+var CAPABILITY_DESCRIPTORS = {
+  modal: {
+    backend: "modal",
+    backendId: "modal",
+    tier: "desktop",
+    os: { supported: ["linux"], default: "linux" },
+    capabilities: {
+      FileSystem: { available: true, readOnly: false },
+      Terminal: { available: true, transport: "sse-events", pty: true },
+      Git: { available: true },
+      DesktopStream: { available: true, transport: "vnc-ws" },
+      Recording: { available: true }
+    },
+    lifetime: {
+      hardLifetimeMs: 24 * 60 * 60 * 1e3,
+      requiresSnapshotRollover: true,
+      hasIdleKiller: true,
+      supportsSuspendResume: true,
+      resumeIsLockFree: true
+    },
+    snapshot: { kind: "native-fs", hasTarFallback: true },
+    portExposure: { kind: "provider-tunnel", supportsOnDemandPorts: false },
+    // pre-declare 6080
+    workspaceRoot: "/workspace",
+    nativeBucketMount: true,
+    persistable: true,
+    supportsRunAs: true
+  },
+  daytona: {
+    backend: "daytona",
+    backendId: "daytona",
+    tier: "desktop",
+    os: { supported: ["linux"], default: "linux" },
+    capabilities: {
+      FileSystem: { available: true, readOnly: false },
+      Terminal: { available: true, transport: "sse-events", pty: true },
+      Git: { available: true },
+      DesktopStream: { available: true, transport: "vnc-ws" },
+      Recording: { available: true }
+    },
+    lifetime: {
+      requiresSnapshotRollover: false,
+      hasIdleKiller: true,
+      supportsSuspendResume: true,
+      resumeIsLockFree: false
+    },
+    snapshot: { kind: "native-snapshot-id", hasTarFallback: true },
+    portExposure: { kind: "preview-url", supportsOnDemandPorts: false },
+    workspaceRoot: "/workspace",
+    nativeBucketMount: false,
+    persistable: true,
+    supportsRunAs: true
+  },
+  runloop: {
+    backend: "runloop",
+    backendId: "runloop",
+    tier: "desktop",
+    os: { supported: ["linux"], default: "linux" },
+    capabilities: {
+      FileSystem: { available: true, readOnly: false },
+      Terminal: { available: true, transport: "sse-events", pty: false },
+      Git: { available: true },
+      DesktopStream: { available: true, transport: "vnc-ws" },
+      Recording: { available: true }
+    },
+    lifetime: {
+      requiresSnapshotRollover: false,
+      hasIdleKiller: true,
+      supportsSuspendResume: true,
+      resumeIsLockFree: false
+    },
+    snapshot: { kind: "native-snapshot-id", hasTarFallback: true },
+    portExposure: { kind: "provider-tunnel", supportsOnDemandPorts: false },
+    // CR9: pre-declare 6080
+    workspaceRoot: "/workspace",
+    nativeBucketMount: false,
+    persistable: true,
+    supportsRunAs: false
+  },
+  e2b: {
+    backend: "e2b",
+    backendId: "e2b",
+    tier: "desktop",
+    os: { supported: ["linux"], default: "linux" },
+    capabilities: {
+      FileSystem: { available: true, readOnly: false },
+      Terminal: { available: true, transport: "sse-events", pty: false },
+      // pty-until-proven=no
+      Git: { available: true },
+      DesktopStream: { available: true, transport: "vnc-ws" },
+      Recording: { available: true }
+    },
+    lifetime: {
+      requiresSnapshotRollover: false,
+      hasIdleKiller: true,
+      supportsSuspendResume: true,
+      resumeIsLockFree: false
+    },
+    snapshot: { kind: "native-snapshot-id", hasTarFallback: true },
+    portExposure: { kind: "preview-url", supportsOnDemandPorts: false },
+    workspaceRoot: "/home/user",
+    nativeBucketMount: false,
+    persistable: true,
+    supportsRunAs: false
+  },
+  blaxel: {
+    backend: "blaxel",
+    backendId: "blaxel",
+    tier: "desktop",
+    os: { supported: ["linux"], default: "linux" },
+    capabilities: {
+      FileSystem: { available: true, readOnly: false },
+      Terminal: { available: true, transport: "sse-events", pty: false },
+      // pty-until-proven=no
+      Git: { available: true },
+      DesktopStream: { available: true, transport: "vnc-ws" },
+      Recording: { available: true }
+    },
+    lifetime: {
+      requiresSnapshotRollover: false,
+      hasIdleKiller: true,
+      supportsSuspendResume: false,
+      resumeIsLockFree: false
+    },
+    snapshot: { kind: "tar-only", hasTarFallback: true },
+    portExposure: { kind: "provider-tunnel", supportsOnDemandPorts: true },
+    // only on-demand backend
+    workspaceRoot: "/workspace",
+    nativeBucketMount: false,
+    persistable: true,
+    supportsRunAs: false
+  },
+  cloudflare: {
+    backend: "cloudflare",
+    backendId: "cloudflare",
+    tier: "headless",
+    os: { supported: ["linux"], default: "linux" },
+    capabilities: {
+      FileSystem: { available: true, readOnly: false },
+      Terminal: { available: true, transport: "sse-events", pty: true },
+      Git: { available: true },
+      DesktopStream: { available: false, transport: null },
+      Recording: { available: false }
+    },
+    lifetime: {
+      requiresSnapshotRollover: false,
+      hasIdleKiller: true,
+      supportsSuspendResume: false,
+      resumeIsLockFree: false
+    },
+    snapshot: { kind: "tar-only", hasTarFallback: true },
+    portExposure: { kind: "provider-tunnel", supportsOnDemandPorts: false },
+    workspaceRoot: "/workspace",
+    nativeBucketMount: false,
+    persistable: true,
+    supportsRunAs: true
+  },
+  vercel: {
+    backend: "vercel",
+    backendId: "vercel",
+    tier: "headless",
+    os: { supported: ["linux"], default: "linux" },
+    capabilities: {
+      FileSystem: { available: true, readOnly: false },
+      Terminal: { available: true, transport: "sse-events", pty: false },
+      Git: { available: true },
+      DesktopStream: { available: false, transport: null },
+      Recording: { available: false }
+    },
+    lifetime: {
+      hardLifetimeMs: 5 * 60 * 60 * 1e3,
+      requiresSnapshotRollover: true,
+      hasIdleKiller: true,
+      supportsSuspendResume: true,
+      resumeIsLockFree: false
+    },
+    snapshot: { kind: "tar-only", hasTarFallback: true },
+    portExposure: { kind: "preview-url", supportsOnDemandPorts: false },
+    workspaceRoot: "/vercel/sandbox",
+    nativeBucketMount: false,
+    persistable: true,
+    supportsRunAs: false
+  },
+  docker: {
+    backend: "docker",
+    backendId: "docker",
+    tier: "dev",
+    os: { supported: ["linux"], default: "linux" },
+    capabilities: {
+      FileSystem: { available: true, readOnly: false },
+      Terminal: { available: true, transport: "sse-events", pty: true },
+      Git: { available: true },
+      DesktopStream: { available: false, transport: null },
+      // local
+      Recording: { available: false }
+    },
+    lifetime: {
+      requiresSnapshotRollover: false,
+      hasIdleKiller: false,
+      supportsSuspendResume: false,
+      resumeIsLockFree: true
+    },
+    snapshot: { kind: "native-dir", hasTarFallback: true },
+    portExposure: { kind: "local-port", supportsOnDemandPorts: false },
+    workspaceRoot: "/workspace",
+    nativeBucketMount: false,
+    persistable: true,
+    supportsRunAs: true
+  },
+  local: {
+    backend: "local",
+    // The SDK's UnixLocalSandboxClient reports backendId "unix_local" — this MUST
+    // match it (it is the resume-fence field compared against client.backendId).
+    backendId: "unix_local",
+    tier: "dev",
+    os: { supported: ["linux"], default: "linux" },
+    capabilities: {
+      FileSystem: { available: true, readOnly: false },
+      Terminal: { available: true, transport: "sse-events", pty: true },
+      Git: { available: true },
+      DesktopStream: { available: false, transport: null },
+      Recording: { available: false }
+    },
+    lifetime: {
+      requiresSnapshotRollover: false,
+      hasIdleKiller: false,
+      supportsSuspendResume: false,
+      resumeIsLockFree: true
+    },
+    snapshot: { kind: "native-dir", hasTarFallback: true },
+    portExposure: { kind: "local-port", supportsOnDemandPorts: false },
+    workspaceRoot: "/workspace",
+    nativeBucketMount: false,
+    persistable: false,
+    supportsRunAs: false
+  },
+  none: {
+    backend: "none",
+    backendId: "none",
+    tier: "none",
+    os: { supported: ["linux"], default: "linux" },
+    capabilities: {
+      FileSystem: { available: false, readOnly: true },
+      Terminal: { available: false, transport: null, pty: false },
+      Git: { available: false },
+      DesktopStream: { available: false, transport: null },
+      Recording: { available: false }
+    },
+    lifetime: {
+      requiresSnapshotRollover: false,
+      hasIdleKiller: false,
+      supportsSuspendResume: false,
+      resumeIsLockFree: true
+    },
+    snapshot: { kind: "none", hasTarFallback: false },
+    portExposure: { kind: "none", supportsOnDemandPorts: false },
+    workspaceRoot: "/workspace",
+    nativeBucketMount: false,
+    persistable: false,
+    supportsRunAs: false
+  },
+  // Bring-your-own-compute: the user's OWN machine, enrolled via a Rust agent,
+  // becomes ONE shared whole-machine sandbox (the agent IS the box). It is the
+  // first backend to make macOS/Windows reachable (default linux). Desktop is
+  // capability-PROCLAIMED ("vnc-ws") — the agent serves a native display stack
+  // (Linux X11/Xvfb, macOS CGEvent/ScreenCaptureKit) consent-gated at enroll;
+  // the online/offline/consent/display negotiation lives in select.ts (M3), this
+  // row is the static feasibility ceiling. Always-on (process-lifetime, never
+  // idle-reaped) and NOT persistable — OpenGeni cannot snapshot the user's disk,
+  // so resume = "is the agent's subject live?", never a cold re-create. Ports
+  // surface on-demand through the stateless relay edge, which lands behind the
+  // `resolveExposedPort` swap-seam later; until then it reuses the existing
+  // `provider-tunnel` exposure kind (the relay IS the provider tunnel for the
+  // agent) so no new PortExposureKind literal — and no new switch arms — are
+  // introduced. supportsOnDemandPorts:true: the agent opens a stream channel for
+  // a port on request rather than pre-declaring 6080/7681 at construction.
+  selfhosted: {
+    backend: "selfhosted",
+    backendId: "selfhosted",
+    tier: "desktop",
+    os: { supported: ["linux", "macos", "windows"], default: "linux" },
+    capabilities: {
+      FileSystem: { available: true, readOnly: false },
+      Terminal: { available: true, transport: "pty-ws", pty: true },
+      // real PTY over the relay
+      Git: { available: true },
+      DesktopStream: { available: true, transport: "vnc-ws" },
+      // proclaimed; consent-gated at enroll
+      Recording: { available: true }
+      // boot invariant: == DesktopStream.available
+    },
+    lifetime: {
+      // Whole-machine, always-there: online while the agent process runs, offline
+      // when it stops. The lease is NEVER idle-killed (it's the user's machine,
+      // not a reapable cloud box) and there is nothing to suspend/resume — the
+      // machine simply is or isn't reachable.
+      requiresSnapshotRollover: false,
+      hasIdleKiller: false,
+      supportsSuspendResume: false,
+      resumeIsLockFree: true
+      // resume = address the live NATS subject; no provider lock
+    },
+    // persistable:false forces snapshot.kind:"none" (the descriptor invariant
+    // `persistable ⇒ snapshot.kind!=="none"`): OpenGeni cannot snapshot the
+    // user's disk — the machine itself is the persistence.
+    snapshot: { kind: "none", hasTarFallback: false },
+    portExposure: { kind: "provider-tunnel", supportsOnDemandPorts: true },
+    workspaceRoot: "/",
+    // agent-reported machine root (the whole machine is the sandbox)
+    nativeBucketMount: false,
+    persistable: false,
+    supportsRunAs: false
+  }
+};
 var ReasoningEffort = z.enum(["none", "minimal", "low", "medium", "high", "xhigh"]);
 var ErrorCode = z.enum([
   "unauthenticated",
@@ -53,8 +394,28 @@ var Permission = z.enum([
   "sessions:create",
   "sessions:read",
   "sessions:control",
+  // Sandbox-surfacing (master-spine §C.3 / crosscut PART 1.2). stream:view is a
+  // REAL, distinct permission — strictly BROADER than sessions:read — because the
+  // pixel plane (Channel B) is UN-REDACTED: a viewer of raw pixels can see cloud
+  // creds the agent cat's into a terminal, which the redacted Channel-A event log
+  // never exposes. sessions:read is NOT permission to watch raw pixels.
+  "stream:view",
+  // SEPARATE from stream:view: raw input to the desktop (bypasses approvalQueue /
+  // interrupt). NEVER granted by default in v1 (the input plane is OFF —
+  // streamControlEnabled=false); the permission exists so later hardening is a
+  // flag flip, not a redesign.
+  "stream:control",
+  // Accept the pixel-plane secret-leak acknowledgment (consent gate before the
+  // un-redacted desktop URL is handed out).
+  "stream:acknowledge",
   "files:upload",
   "files:read",
+  // Channel-A structured write surface (FS writes / apply-patch); distinct from
+  // files:read so a read-only viewer can't mutate the box filesystem.
+  "files:write",
+  // Attach to an interactive PTY (terminal-as-pty, Channel A); distinct from
+  // sessions:read which only reads the command-output firehose.
+  "terminal:attach",
   "documents:manage",
   "documents:search",
   "scheduled_tasks:manage",
@@ -64,7 +425,14 @@ var Permission = z.enum([
   "api_keys:manage",
   "environments:manage",
   "environments:use",
-  "goals:manage"
+  "goals:manage",
+  // Bring-your-own-compute (M5). enrollments:read lists a workspace's machines;
+  // enrollments:manage approves a device-flow enrollment (the LOUD whole-machine
+  // consent) + revokes a machine. Distinct from sessions/stream perms because an
+  // enrollment grants WHOLE-MACHINE access to a user's own hardware — a high-trust,
+  // admin-shaped action. workspace:admin is the super-wildcard over both.
+  "enrollments:read",
+  "enrollments:manage"
 ]);
 var ProductAccessMode = z.enum(["local", "configured", "managed"]);
 var BillingMode = z.enum(["disabled", "stripe"]);
@@ -157,6 +525,172 @@ async function verifyDelegatedAccessToken(secret, token, nowSeconds = Math.floor
   }
   return payload.data;
 }
+var EnrollmentBearerPayload = z.object({
+  workspaceId: z.string().uuid(),
+  agentId: z.string().uuid(),
+  enrollmentId: z.string().uuid(),
+  // The Account-scoped control-plane subject prefix the agent subscribes to.
+  subjectPrefix: z.string().min(1),
+  exp: z.number().int().positive()
+});
+async function signEnrollmentBearer(secret, payload) {
+  const encodedPayload = base64UrlEncode(JSON.stringify(EnrollmentBearerPayload.parse(payload)));
+  const signature = await hmacSha256Base64Url(secret, encodedPayload);
+  return `oge_${encodedPayload}.${signature}`;
+}
+async function verifyEnrollmentBearer(secret, token, nowSeconds = Math.floor(Date.now() / 1e3)) {
+  if (!token.startsWith("oge_")) {
+    return null;
+  }
+  const withoutPrefix = token.slice("oge_".length);
+  const dot = withoutPrefix.lastIndexOf(".");
+  if (dot <= 0) {
+    return null;
+  }
+  const encodedPayload = withoutPrefix.slice(0, dot);
+  const signature = withoutPrefix.slice(dot + 1);
+  const expected = await hmacSha256Base64Url(secret, encodedPayload);
+  if (!constantTimeEqual(signature, expected)) {
+    return null;
+  }
+  const payload = EnrollmentBearerPayload.safeParse(JSON.parse(base64UrlDecode(encodedPayload)));
+  if (!payload.success || payload.data.exp < nowSeconds) {
+    return null;
+  }
+  return payload.data;
+}
+var EnrollTokenPayload = z.object({
+  // Domain-separation claim — fixed "enroll" so an `oge_`/`ogd_`/`ogs_` payload (no
+  // typ, or a different typ) can never satisfy verifyEnrollToken even past the prefix.
+  typ: z.literal("enroll"),
+  workspaceId: z.string().uuid(),
+  accountId: z.string().uuid(),
+  // The screen-control consent baked into the token at mint (the minting user's
+  // decision); the exchange records it as consentedScreenControl on the enrollment.
+  allowScreenControl: z.boolean(),
+  iat: z.number().int().nonnegative(),
+  exp: z.number().int().positive()
+});
+async function signEnrollToken(secret, payload) {
+  const encodedPayload = base64UrlEncode(JSON.stringify(EnrollTokenPayload.parse(payload)));
+  const signature = await hmacSha256Base64Url(secret, encodedPayload);
+  return `oget_${encodedPayload}.${signature}`;
+}
+async function verifyEnrollToken(secret, token, nowSeconds = Math.floor(Date.now() / 1e3)) {
+  if (!token.startsWith("oget_")) {
+    return null;
+  }
+  const withoutPrefix = token.slice("oget_".length);
+  const dot = withoutPrefix.lastIndexOf(".");
+  if (dot <= 0) {
+    return null;
+  }
+  const encodedPayload = withoutPrefix.slice(0, dot);
+  const signature = withoutPrefix.slice(dot + 1);
+  const expected = await hmacSha256Base64Url(secret, encodedPayload);
+  if (!constantTimeEqual(signature, expected)) {
+    return null;
+  }
+  let decoded;
+  try {
+    decoded = JSON.parse(base64UrlDecode(encodedPayload));
+  } catch {
+    return null;
+  }
+  const payload = EnrollTokenPayload.safeParse(decoded);
+  if (!payload.success || payload.data.exp < nowSeconds) {
+    return null;
+  }
+  return payload.data;
+}
+var StreamTokenPayload = z.object({
+  workspaceId: z.string().uuid(),
+  sessionId: z.string().uuid(),
+  // Identifies the sandbox_lease_holders row (the viewer holder).
+  viewerId: z.string().uuid(),
+  // Fence: the token logically dies when the box is re-elected (epoch++).
+  leaseEpoch: z.number().int().nonnegative(),
+  // v1 is always "view"; "control" is the never-granted raw-input plane.
+  mode: z.enum(["view", "control"]),
+  // 6080 (noVNC); pins the token to ONE exposed port.
+  port: z.number().int().positive(),
+  // Short TTL (120s default); rotation is event-driven under the epoch fence,
+  // not on a keepalive clock.
+  exp: z.number().int().positive()
+});
+async function signStreamToken(secret, payload) {
+  const encodedPayload = base64UrlEncode(JSON.stringify(StreamTokenPayload.parse(payload)));
+  const signature = await hmacSha256Base64Url(secret, encodedPayload);
+  return `ogs_${encodedPayload}.${signature}`;
+}
+async function verifyStreamToken(secret, token, nowSeconds = Math.floor(Date.now() / 1e3)) {
+  if (!token.startsWith("ogs_")) {
+    return null;
+  }
+  const withoutPrefix = token.slice("ogs_".length);
+  const dot = withoutPrefix.lastIndexOf(".");
+  if (dot <= 0) {
+    return null;
+  }
+  const encodedPayload = withoutPrefix.slice(0, dot);
+  const signature = withoutPrefix.slice(dot + 1);
+  const expected = await hmacSha256Base64Url(secret, encodedPayload);
+  if (!constantTimeEqual(signature, expected)) {
+    return null;
+  }
+  let decoded;
+  try {
+    decoded = JSON.parse(base64UrlDecode(encodedPayload));
+  } catch {
+    return null;
+  }
+  const payload = StreamTokenPayload.safeParse(decoded);
+  if (!payload.success || payload.data.exp < nowSeconds) {
+    return null;
+  }
+  return payload.data;
+}
+var RelayTokenPayload = z.object({
+  // The workspace the agent (and its channels) belong to — the relay asserts this
+  // equals the channel-key's ws so a producer can only register its own channels.
+  workspaceId: z.string().uuid(),
+  // The agent (machine) id — the relay asserts this equals the channel-key's agent.
+  agentId: z.string().uuid(),
+  // Expiry (unix seconds). Enrollment-scoped horizon (re-minted on re-enroll).
+  exp: z.number().int().positive()
+});
+async function signRelayToken(secret, payload) {
+  const encodedPayload = base64UrlEncode(JSON.stringify(RelayTokenPayload.parse(payload)));
+  const signature = await hmacSha256Base64Url(secret, encodedPayload);
+  return `ogr_${encodedPayload}.${signature}`;
+}
+async function verifyRelayToken(secret, token, nowSeconds = Math.floor(Date.now() / 1e3)) {
+  if (!token.startsWith("ogr_")) {
+    return null;
+  }
+  const withoutPrefix = token.slice("ogr_".length);
+  const dot = withoutPrefix.lastIndexOf(".");
+  if (dot <= 0) {
+    return null;
+  }
+  const encodedPayload = withoutPrefix.slice(0, dot);
+  const signature = withoutPrefix.slice(dot + 1);
+  const expected = await hmacSha256Base64Url(secret, encodedPayload);
+  if (!constantTimeEqual(signature, expected)) {
+    return null;
+  }
+  let decoded;
+  try {
+    decoded = JSON.parse(base64UrlDecode(encodedPayload));
+  } catch {
+    return null;
+  }
+  const payload = RelayTokenPayload.safeParse(decoded);
+  if (!payload.success || payload.data.exp < nowSeconds) {
+    return null;
+  }
+  return payload.data;
+}
 var CreateWorkspaceRequest = z.object({
   accountId: z.string().uuid().optional(),
   name: z.string().min(1),
@@ -197,6 +731,27 @@ var CreateApiKeyResponse = z.object({
   apiKey: ApiKey,
   token: z.string().min(1)
 });
+var WorkspaceMember = z.object({
+  subjectId: z.string().min(1),
+  subjectLabel: z.string().nullable(),
+  role: z.string(),
+  permissions: z.array(Permission),
+  createdAt: z.string()
+});
+var ListWorkspaceMembersResponse = z.object({
+  members: z.array(WorkspaceMember)
+});
+var AddWorkspaceMemberRequest = z.object({
+  // Resolved against the managed (Better Auth) users; email invites for
+  // not-yet-registered users are deferred, so an unknown email returns 404.
+  email: z.string().email(),
+  role: z.string().min(1).optional(),
+  permissions: z.array(Permission)
+});
+var UpdateWorkspaceMemberRequest = z.object({
+  role: z.string().min(1).optional(),
+  permissions: z.array(Permission)
+});
 var UsageEventType = z.enum([
   "agent_run.created",
   "agent_run.completed",
@@ -206,7 +761,16 @@ var UsageEventType = z.enum([
   "file.deleted",
   "document.indexed",
   "scheduled_task.fired",
-  "api_key.request"
+  "api_key.request",
+  // --- sandbox warm-time metering (P2.1) ---
+  // Wall-clock seconds a box was warm — the billable warm-time meter. Accrued on
+  // the two stateless ticks (turn heartbeat + reaper sweep), idempotent on
+  // (sandbox_group_id, lease_epoch, tick) so a shared box (N sessions) is metered
+  // EXACTLY ONCE per tick (N sessions != N x bill). Orthogonal to model.tokens /
+  // model.cost (model API cost vs provider compute cost — both real, no overlap).
+  "sandbox.warm_seconds",
+  // usd_micros: warm-seconds x the per-provider per-second warm rate.
+  "sandbox.warm_cost"
 ]);
 var UsageEvent = z.object({
   id: z.string().uuid(),
@@ -249,6 +813,10 @@ var LimitDecision = z.discriminatedUnion("allowed", [
   z.object({ allowed: z.literal(true) }),
   z.object({ allowed: z.literal(false), code: z.string(), message: z.string() })
 ]);
+var EntitlementDecision = z.discriminatedUnion("allowed", [
+  z.object({ allowed: z.literal(true), quantity: z.number().optional() }),
+  z.object({ allowed: z.literal(false), reason: z.string(), code: z.string().optional(), quantity: z.number().optional() })
+]);
 var BillingBalance = z.object({
   accountId: z.string().uuid(),
   balanceMicros: z.number().int(),
@@ -367,7 +935,17 @@ var DocumentSearchRequest = z.object({
 });
 var ToolRef = z.object({
   kind: z.literal("mcp"),
-  id: z.string().min(1)
+  id: z.string().min(1),
+  // Non-fatal-on-connect marker for an AUTO-ATTACHED (workspace-default)
+  // capability MCP server: when true, a connect / tools-list failure (e.g. an
+  // expired capability credential returning 401) must SKIP that server with a
+  // logged warning and let the turn proceed, rather than failing the whole
+  // turn before the model runs. Absent/false ⇒ STRICT: an unavailable server
+  // fails the turn (the contract for EXPLICITLY-requested tools). This flag is
+  // set server-side only, at the default-capability auto-attach seam; it is
+  // stripped from client-supplied tool refs so an explicit request always
+  // stays strict.
+  optional: z.boolean().optional()
 });
 var ResourceRefConflictError = class extends Error {
   constructor(message) {
@@ -376,17 +954,22 @@ var ResourceRefConflictError = class extends Error {
   }
 };
 function mergeToolRefs(existing, additions) {
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
+  const byKey = /* @__PURE__ */ new Map();
+  const order = [];
   for (const tool of [...existing, ...additions]) {
     const key = `${tool.kind}:${tool.id}`;
-    if (seen.has(key)) {
+    const prior = byKey.get(key);
+    if (!prior) {
+      byKey.set(key, tool);
+      order.push(key);
       continue;
     }
-    seen.add(key);
-    out.push(tool);
+    if (prior.optional === true && tool.optional !== true) {
+      const { optional: _dropped, ...strict } = prior;
+      byKey.set(key, strict);
+    }
   }
-  return out;
+  return order.map((key) => byKey.get(key));
 }
 function mergeResourceRefs(existing, additions, options = {}) {
   const out = [...existing];
@@ -481,6 +1064,9 @@ var UpdateSessionGoalRequest = z.object({
   status: z.enum(["paused", "active"]),
   rationale: z.string().min(1).optional()
 });
+var UpdateSessionRequest = z.object({
+  title: z.string().min(1).max(200)
+});
 var ClearSessionContextRequest = z.object({
   confirm: z.literal(true)
 });
@@ -519,6 +1105,8 @@ var SessionTurn = z.object({
   model: z.string().min(1),
   reasoningEffort: ReasoningEffort,
   sandboxBackend: SandboxBackend,
+  // Per-turn OS override. NULL = inherit the session's sandboxOs.
+  sandboxOs: SandboxOs.nullable(),
   metadata: z.record(z.string(), z.unknown()),
   startedAt: z.string().nullable(),
   finishedAt: z.string().nullable(),
@@ -943,11 +1531,26 @@ var Session = z.object({
   accountId: z.string().uuid(),
   status: SessionStatus,
   initialMessage: z.string(),
+  title: z.string().nullable(),
+  titleSource: z.enum(["user", "agent"]).nullable(),
   resources: z.array(ResourceRef),
   tools: z.array(ToolRef),
   metadata: z.record(z.string(), z.unknown()),
   model: z.string(),
   sandboxBackend: SandboxBackend,
+  // The OS the session's box runs. Defaults to 'linux' (today's only OS).
+  sandboxOs: SandboxOs,
+  // The shared-sandbox group the session's box belongs to. Equals the session's
+  // own id for a singleton group (today's 1:1 default); equals the parent's
+  // group when spawned shared (both sessions run in ONE box).
+  sandboxGroupId: z.string().uuid(),
+  // The first-class swappable-sandbox POINTER (bring-your-own-compute M2). NULL
+  // resolves to the session's own group sandbox (the backward-compat default);
+  // a swap sets it to the target sandbox row. active_epoch is the second epoch
+  // ABOVE the lease epoch, bumped on every swap so the routing proxy can fence a
+  // stale in-flight op and retry against the new active sandbox.
+  activeSandboxId: z.string().uuid().nullable(),
+  activeEpoch: z.number().int().nonnegative(),
   environmentId: z.string().uuid().nullable(),
   // Non-default first-party MCP token permissions (manager-style sessions);
   // null means the fixed worker default set.
@@ -968,6 +1571,12 @@ var Session = z.object({
   // signal. Null until a turn with usage has completed.
   lastInputTokens: z.number().int().nonnegative().nullable(),
   lastSequence: z.number().int().nonnegative(),
+  // Multi-account Codex (P1). codexPinnedCredentialId: the account this session is
+  // manually PINNED to (null ⇒ follow the workspace active pointer).
+  // codexLastCredentialId: the account the most recent turn actually ran on (the
+  // "Running on:" indicator's source). Both are credential-row ids, null until set.
+  codexPinnedCredentialId: z.string().uuid().nullable(),
+  codexLastCredentialId: z.string().uuid().nullable(),
   createdAt: z.string(),
   updatedAt: z.string()
 });
@@ -1003,8 +1612,437 @@ var SessionEventType = z.enum([
   "goal.completed",
   "goal.paused",
   "goal.resumed",
-  "goal.continuation"
+  "goal.continuation",
+  // Channel-B desktop pixel-plane signals (07-channel-b §1.2). The pixel socket
+  // carries opaque RFB and cannot carry a control message the client can act on,
+  // so these ride the durable, sequenced, gap-filled Channel-A SSE spine.
+  "stream.url.rotated",
+  // re-minted {url,token,expiresAt} on box rollover (event-driven)
+  "stream.opened",
+  // a viewer attached (audit + refcount visibility)
+  "stream.closed",
+  // a viewer detached / was reaped
+  "stream.revoked",
+  // a grant was revoked → connected clients MUST disconnect now
+  // Channel-B recording signals (P4.3 / module 05 §3.4). The "agent films itself
+  // proving the fix" loop: ffmpeg x11grab of the SAME :0 humans watch → artifact
+  // → storage. The artifact ref rides the AVAILABLE event (storageKey, NOT a
+  // long-lived URL — clients mint a short-TTL signed GET via the route).
+  "recording.started",
+  // ffmpeg launched on :0 (mode/codec/dimensions)
+  "recording.available",
+  // finalized: bytes PUT to storage, replayable
+  "recording.failed",
+  // ffmpeg/box-death/rollover/upload error — no artifact
+  // Channel-A structured-service notifications (P4.4 / modules/08-channel-a.md
+  // §2.2). The A2 reads (fs/git/terminal exec) are SYNCHRONOUS API-direct point
+  // queries (their result is the HTTP response, NEVER an event). What rides A1
+  // here are the side-effect NOTIFICATIONS — a path changed, git state changed,
+  // a pty opened/printed/exited — durable, sequenced, gap-filled like every
+  // other session event, so any viewer's Pierre tree / diff / terminal stays
+  // live. fs.changed/git.changed are cache-invalidation signals; the pty.*
+  // events carry the interactive terminal byte stream.
+  "fs.changed",
+  // a path was created/modified/deleted (write or agent mutation)
+  "git.changed",
+  // working-tree/index/HEAD changed (debounced re-probe)
+  "terminal.pty.started",
+  // an interactive PTY session opened (carries ptyId)
+  "terminal.pty.output.delta",
+  // PTY stdout/stderr bytes (separate from command.output)
+  "terminal.pty.exited",
+  // PTY session ended (exitCode/reason)
+  "session.title_set",
+  // Multi-account Codex (P1): the account a session's turn runs on changed
+  // (manual switch in P1; failover/rotation in P3 reuse the same event). Drives
+  // the in-session "Running on:" indicator's live flip.
+  "codex.account.switched"
+]);
+var StreamUrlRotatedPayload = z.object({
+  url: z.string().url(),
+  token: z.string().nullable(),
+  expiresAt: z.string().datetime().nullable(),
+  // The epoch the new URL was minted under (the box-rollover fence the client
+  // reconciles against). A client must drop a rotation event whose epoch it has
+  // already advanced past.
+  leaseEpoch: z.number().int().nonnegative(),
+  transport: z.literal("vnc-ws"),
+  // The viewer holder this URL is for (so a client filters out other viewers').
+  viewerId: z.string().uuid().nullable().default(null)
+});
+var StreamOpenedPayload = z.object({
+  viewerId: z.string().uuid(),
+  shared: z.boolean().default(false),
+  viewerCount: z.number().int().nonnegative()
+});
+var StreamClosedPayload = z.object({
+  viewerId: z.string().uuid(),
+  reason: z.enum(["client-disconnect", "reaped", "revoked", "box-rollover"]),
+  viewerCount: z.number().int().nonnegative()
+});
+var StreamRevokedPayload = z.object({
+  viewerId: z.string().uuid().nullable().default(null),
+  reason: z.enum(["grant-revoked", "session-failed", "admin"])
+});
+var RecordingMode = z.enum(["manual", "on-turn", "on-verify"]);
+var RecordingCodec = z.enum(["h264-mp4", "vp9-webm"]);
+var RecordingContentType = z.enum(["video/mp4", "video/webm"]);
+var RecordingStartedPayload = z.object({
+  recordingId: z.string().uuid(),
+  turnId: z.string().uuid().nullable(),
+  mode: RecordingMode,
+  codec: RecordingCodec,
+  dimensions: z.tuple([z.number().int().positive(), z.number().int().positive()]),
+  framerate: z.number().int().positive(),
+  startedAt: z.string(),
+  // ISO
+  // The verification rationale ("agent-verification: tf apply succeeded"). Agent-
+  // authored free text — the producer caps + scrubs it before emit.
+  reason: z.string().nullable().optional()
+});
+var RecordingAvailablePayload = z.object({
+  recordingId: z.string().uuid(),
+  turnId: z.string().uuid().nullable(),
+  codec: RecordingCodec,
+  contentType: RecordingContentType,
+  // The @opengeni/storage object key. NO long-lived URL in the event — clients
+  // mint a short-TTL signed GET via GET …/recordings/:id/url.
+  storageKey: z.string(),
+  durationSeconds: z.number().nonnegative().nullable(),
+  sizeBytes: z.number().int().nonnegative(),
+  dimensions: z.tuple([z.number().int().positive(), z.number().int().positive()])
+});
+var RecordingFailedReason = z.enum([
+  "ffmpeg-error",
+  "box-death",
+  "box-rollover",
+  "upload-failed",
+  "max-bytes-exceeded",
+  "display-unavailable"
+]);
+var RecordingFailedPayload = z.object({
+  recordingId: z.string().uuid(),
+  turnId: z.string().uuid().nullable(),
+  reason: RecordingFailedReason,
+  // ffmpeg-stderr tail / error detail — agent/ffmpeg-controlled, so the producer
+  // caps + scrubs it before emit (it rides redact() like every payload).
+  detail: z.string().nullable().optional()
+});
+var SandboxCommandOutputDeltaPayload = z.object({
+  stream: z.enum(["stdout", "stderr"]).default("stdout"),
+  chunk: z.string(),
+  // raw bytes, utf-8 (lossy) — terminal is opaque-ish
+  commandId: z.string().optional(),
+  // groups deltas to one agent command
+  seq: z.number().int().nonnegative().optional()
+  // intra-command ordering hint
+});
+var FsChangeKind = z.enum(["created", "modified", "deleted", "renamed"]);
+var FsChangedPayload = z.object({
+  changes: z.array(z.object({
+    path: z.string(),
+    // workspace-relative POSIX path
+    kind: FsChangeKind,
+    isDir: z.boolean().default(false),
+    sizeBytes: z.number().int().nonnegative().nullable().default(null),
+    oldPath: z.string().optional()
+    // for "renamed"
+  })).min(1),
+  source: z.enum(["write", "watch", "agent"]).default("write"),
+  // Monotonic FS revision (per-lease, paired with leaseEpoch for staleness).
+  revision: z.number().int().nonnegative(),
+  // The lease epoch the revision was minted under: a client invalidates on a
+  // (leaseEpoch, revision) tuple change, never a bare revision compare (H3 —
+  // revision resets to 0 on box re-key, so a bare monotonic compare goes stale).
+  leaseEpoch: z.number().int().nonnegative().default(0)
+});
+var GitChangedPayload = z.object({
+  head: z.string().nullable(),
+  // current branch or detached SHA
+  dirty: z.boolean(),
+  // working tree has uncommitted changes
+  ahead: z.number().int().nonnegative().default(0),
+  behind: z.number().int().nonnegative().default(0),
+  changedFileCount: z.number().int().nonnegative(),
+  reason: z.enum(["commit", "checkout", "stage", "worktree", "fetch", "unknown"]).default("unknown"),
+  revision: z.number().int().nonnegative().default(0),
+  leaseEpoch: z.number().int().nonnegative().default(0)
+});
+var TerminalPtyStartedPayload = z.object({
+  ptyId: z.string().uuid(),
+  cols: z.number().int().positive(),
+  rows: z.number().int().positive(),
+  shell: z.string(),
+  // resolved shell, e.g. "/bin/bash"
+  cwd: z.string()
+});
+var TerminalPtyOutputDeltaPayload = z.object({
+  ptyId: z.string().uuid(),
+  stream: z.enum(["stdout", "stderr"]).default("stdout"),
+  chunk: z.string(),
+  // raw terminal bytes (incl. ANSI), utf-8 lossy
+  seq: z.number().int().nonnegative()
+  // strict per-pty ordering (owner-assigned)
+});
+var TerminalPtyExitedPayload = z.object({
+  ptyId: z.string().uuid(),
+  exitCode: z.number().int().nullable(),
+  reason: z.enum(["exit", "killed", "owner_gone", "timeout"])
+});
+var FsNodeType = z.enum(["file", "dir", "symlink", "other"]);
+var FsTreeNode = z.lazy(() => z.object({
+  name: z.string(),
+  path: z.string(),
+  type: FsNodeType,
+  sizeBytes: z.number().int().nonnegative().nullable(),
+  mtimeMs: z.number().int().nonnegative().nullable(),
+  mode: z.number().int().nullable(),
+  children: z.array(FsTreeNode).optional(),
+  truncated: z.boolean().default(false)
+}));
+var FsListRequest = z.object({
+  path: z.string().default(""),
+  // "" = workspace root
+  depth: z.number().int().min(0).max(8).default(1),
+  maxEntries: z.number().int().positive().max(2e4).default(2e3),
+  includeHidden: z.boolean().default(true)
+});
+var FsListResponse = z.object({
+  root: FsTreeNode,
+  revision: z.number().int().nonnegative(),
+  truncated: z.boolean()
+  // global cap hit
+});
+var FsEncoding = z.enum(["utf8", "base64"]);
+var FsReadRequest = z.object({
+  path: z.string(),
+  encoding: FsEncoding.default("utf8"),
+  maxBytes: z.number().int().positive().max(25 * 1024 * 1024).default(5 * 1024 * 1024)
+});
+var FsReadResponse = z.object({
+  path: z.string(),
+  encoding: FsEncoding,
+  content: z.string(),
+  // text or base64 per encoding
+  sizeBytes: z.number().int().nonnegative(),
+  // bytes returned (== content size)
+  truncated: z.boolean(),
+  // sizeBytes hit maxBytes; content is the prefix
+  isBinary: z.boolean(),
+  // sniffed NUL byte in first 8KB
+  revision: z.number().int().nonnegative()
+});
+var FsWriteRequest = z.object({
+  path: z.string(),
+  encoding: FsEncoding.default("utf8"),
+  content: z.string(),
+  overwrite: z.boolean().default(true),
+  // false + existing path => 409
+  createParents: z.boolean().default(true)
+});
+var FsWriteResponse = z.object({
+  path: z.string(),
+  sizeBytes: z.number().int().nonnegative(),
+  revision: z.number().int().nonnegative()
+  // == the fs.changed revision
+});
+var FsDeleteRequest = z.object({
+  path: z.string(),
+  recursive: z.boolean().default(false)
+  // required true to delete a non-empty dir
+});
+var FsDeleteResponse = z.object({ revision: z.number().int().nonnegative() });
+var FsMoveRequest = z.object({
+  path: z.string(),
+  newPath: z.string(),
+  overwrite: z.boolean().default(false),
+  // false + existing destination => 409
+  createParents: z.boolean().default(true)
+});
+var FsMoveResponse = z.object({
+  path: z.string(),
+  newPath: z.string(),
+  revision: z.number().int().nonnegative()
+  // == the fs.changed revision
+});
+var FsMkdirRequest = z.object({
+  path: z.string(),
+  recursive: z.boolean().default(true)
+  // false + existing path => 400
+});
+var FsMkdirResponse = z.object({
+  path: z.string(),
+  revision: z.number().int().nonnegative()
+  // == the fs.changed revision
+});
+var GitFileStatusCode = z.enum([
+  "added",
+  "modified",
+  "deleted",
+  "renamed",
+  "copied",
+  "untracked",
+  "ignored",
+  "conflicted",
+  "typechange"
 ]);
+var GitFileStatus = z.object({
+  path: z.string(),
+  oldPath: z.string().nullable(),
+  // for renamed/copied
+  index: GitFileStatusCode.nullable(),
+  // staged change (X in porcelain XY)
+  worktree: GitFileStatusCode.nullable(),
+  // unstaged change (Y in porcelain XY)
+  isConflicted: z.boolean().default(false)
+});
+var GitStatusRequest = z.object({
+  path: z.string().default("")
+  // repo root within workspace (multi-repo support)
+});
+var GitStatusResponse = z.object({
+  isRepo: z.boolean(),
+  head: z.string().nullable(),
+  // branch name
+  detached: z.boolean().default(false),
+  upstream: z.string().nullable(),
+  ahead: z.number().int().nonnegative().default(0),
+  behind: z.number().int().nonnegative().default(0),
+  files: z.array(GitFileStatus),
+  revision: z.number().int().nonnegative()
+});
+var GitDiffLineType = z.enum(["context", "add", "del", "meta"]);
+var GitDiffLine = z.object({
+  type: GitDiffLineType,
+  // null on the side that doesn't have the line (add => oldNo null; del => newNo null)
+  oldNo: z.number().int().positive().nullable(),
+  newNo: z.number().int().positive().nullable(),
+  text: z.string()
+  // line WITHOUT leading +/-/space marker
+});
+var GitDiffHunk = z.object({
+  oldStart: z.number().int().nonnegative(),
+  oldLines: z.number().int().nonnegative(),
+  newStart: z.number().int().nonnegative(),
+  newLines: z.number().int().nonnegative(),
+  header: z.string(),
+  // the @@ ... @@ section heading
+  lines: z.array(GitDiffLine)
+});
+var GitFileDiff = z.object({
+  path: z.string(),
+  oldPath: z.string().nullable(),
+  status: GitFileStatusCode,
+  isBinary: z.boolean().default(false),
+  isImage: z.boolean().default(false),
+  additions: z.number().int().nonnegative(),
+  deletions: z.number().int().nonnegative(),
+  hunks: z.array(GitDiffHunk),
+  // empty if binary or truncated
+  truncated: z.boolean().default(false)
+  // diff exceeded maxBytes; hunks omitted
+});
+var GitDiffRequest = z.object({
+  path: z.string().default(""),
+  // repo root
+  // diff selectors, mutually exclusive precedence: refs > staged > worktree
+  staged: z.boolean().default(false),
+  // --cached (index vs HEAD)
+  fromRef: z.string().optional(),
+  toRef: z.string().optional(),
+  pathspec: z.array(z.string()).default([]),
+  contextLines: z.number().int().min(0).max(10).default(3),
+  maxBytesPerFile: z.number().int().positive().max(2 * 1024 * 1024).default(512 * 1024)
+});
+var GitDiffResponse = z.object({
+  files: z.array(GitFileDiff),
+  revision: z.number().int().nonnegative()
+});
+var GitLogRequest = z.object({
+  path: z.string().default(""),
+  ref: z.string().default("HEAD"),
+  maxCount: z.number().int().positive().max(1e3).default(100),
+  skip: z.number().int().nonnegative().default(0),
+  pathspec: z.array(z.string()).default([])
+});
+var GitCommit = z.object({
+  sha: z.string(),
+  shortSha: z.string(),
+  parents: z.array(z.string()),
+  author: z.object({ name: z.string(), email: z.string(), timestamp: z.number().int() }),
+  committer: z.object({ name: z.string(), email: z.string(), timestamp: z.number().int() }),
+  subject: z.string(),
+  body: z.string(),
+  refs: z.array(z.string()).default([])
+  // decorations: branch/tag pointers
+});
+var GitLogResponse = z.object({ commits: z.array(GitCommit), hasMore: z.boolean() });
+var GitShowRequest = z.object({
+  path: z.string().default(""),
+  ref: z.string(),
+  // a commit/tag/tree-ish
+  filePath: z.string().optional(),
+  // ref + filePath => raw blob ("open file at commit")
+  encoding: FsEncoding.default("utf8"),
+  maxBytesPerFile: z.number().int().positive().max(2 * 1024 * 1024).default(512 * 1024)
+});
+var GitShowResponse = z.object({
+  commit: GitCommit.nullable(),
+  // null when fetching a raw blob
+  files: z.array(GitFileDiff),
+  // commit diff vs first parent
+  blob: z.object({ content: z.string(), encoding: FsEncoding, sizeBytes: z.number().int(), truncated: z.boolean() }).nullable(),
+  revision: z.number().int().nonnegative()
+});
+var TerminalExecRequest = z.object({
+  command: z.string().min(1),
+  cwd: z.string().default(""),
+  // workspace-relative
+  // Soft per-call wall-clock bound (the box yields output back when reached).
+  timeoutMs: z.number().int().positive().max(12e4).default(3e4),
+  // Stream the deltas onto A1 as the agent firehose (so other viewers see it),
+  // in addition to returning the buffered result inline.
+  emitStream: z.boolean().default(true)
+});
+var TerminalExecResponse = z.object({
+  stdout: z.string(),
+  stderr: z.string(),
+  exitCode: z.number().int().nullable(),
+  // True when the process was still running when the call yielded (a long
+  // command); the remaining output drains onto A1 if emitStream was set.
+  running: z.boolean(),
+  wallTimeSeconds: z.number().nonnegative()
+});
+var PtyOpenRequest = z.object({
+  cols: z.number().int().positive().max(500).default(80),
+  rows: z.number().int().positive().max(300).default(24),
+  cwd: z.string().default(""),
+  // workspace-relative
+  shell: z.string().optional()
+  // default: resolved login shell
+});
+var PtyOpenResponse = z.object({
+  ptyId: z.string().uuid(),
+  // output streams as terminal.pty.output.delta on the SSE channel the client holds
+  streamVia: z.literal("sse-events"),
+  supportsInput: z.boolean()
+  // false on backends without writeStdin
+});
+var PtyWriteRequest = z.object({ ptyId: z.string().uuid(), data: z.string() });
+var PtyResizeRequest = z.object({ ptyId: z.string().uuid(), cols: z.number().int().positive(), rows: z.number().int().positive() });
+var PtyCloseRequest = z.object({ ptyId: z.string().uuid() });
+var SessionStructuredCapabilities = z.object({
+  FileSystem: z.object({ available: z.boolean(), readOnly: z.boolean(), root: z.string() }),
+  Terminal: z.object({
+    events: z.boolean(),
+    // command.output firehose (always on if a box exists)
+    exec: z.boolean(),
+    // synchronous terminal exec
+    pty: z.object({ available: z.boolean() })
+    // interactive stdin (writeStdin)
+  }),
+  Git: z.object({ available: z.boolean(), repos: z.array(z.string()) })
+});
 var SessionEvent = z.object({
   id: z.string().uuid(),
   workspaceId: z.string().uuid(),
@@ -1024,6 +2062,17 @@ var CreateSessionRequest = z.object({
   model: z.string().min(1).optional(),
   reasoningEffort: ReasoningEffort.optional(),
   sandboxBackend: SandboxBackend.optional(),
+  // The enrolled machine (a sandbox id) to run this session on; seeds the
+  // active-sandbox pointer at creation so the FIRST turn routes to the chosen
+  // machine (race-free: the pointer is committed before the worker turn
+  // workflow can read it). An invalid/unowned/offline target fails the create.
+  targetSandboxId: z.string().uuid().optional(),
+  // The working directory the targeted machine runs the session under — the
+  // path/cwd base for its agent exec, terminal, and file dock. Free-form pass-
+  // through: a launch-workspace_root-relative subdir or an absolute machine path
+  // (the agent's resolve_cwd handles both). Only valid WITH targetSandboxId
+  // (workingDir alone is a 422); omitted ⇒ the machine's default workspace_root.
+  workingDir: z.string().min(1).optional(),
   // Workspace environment attachment is fixed at session creation; follow-up
   // user.message events cannot switch or add one.
   environmentId: z.string().uuid().optional(),
@@ -1040,7 +2089,29 @@ var CreateSessionRequest = z.object({
   // the fixed worker default — how an operator hands a manager-style session
   // the orchestration/environment/github tools. Capped at creation: every
   // requested permission must be held by the creating grant (no escalation).
-  firstPartyMcpPermissions: z.array(Permission).optional()
+  firstPartyMcpPermissions: z.array(Permission).optional(),
+  // Shared-sandbox placement (addendum 05 §D.1). Three-way union; OMITTED ⇒
+  // today's behavior (a context-dependent default resolved server-side: from
+  // inside a session → "shared" with the creator's box, top-level → "new").
+  //   - "shared":  join the CREATOR's box. Requires a parent session (inferred
+  //                from the worker-signed sessionId claim, never caller-supplied);
+  //                top-level "shared" is a 422.
+  //   - "new":     mint a fresh singleton box (group ≡ the new session's id).
+  //   - {groupId}: join a SPECIFIC sibling group in THIS workspace (manager
+  //                fan-out). Validated workspace-scoped (cross-workspace → 404).
+  // A shared spawn inherits the box's (backend, os) — it is literally the same
+  // box; the child cannot pick its own backend. Cross-workspace sharing is
+  // forbidden by construction (the parent/group reads are RLS-workspace-scoped).
+  // ENV-AWARE: the box's environment is fixed at creation, so a share requires
+  // the SAME environmentId as the creator's box. On a mismatch the inherited
+  // default silently falls back to an own box; an explicit "shared"/{groupId}
+  // request 422s at create (instead of the first turn dying on the SDK's
+  // manifest-env guard).
+  sandbox: z.union([
+    z.literal("shared"),
+    z.literal("new"),
+    z.object({ groupId: z.string().uuid() })
+  ]).optional()
 });
 var ClientSessionEvent = z.discriminatedUnion("type", [
   z.object({
@@ -1110,10 +2181,358 @@ var ClientAuthConfig = z.discriminatedUnion("mode", [
     session: z.literal("cookie")
   })
 ]);
+var CapabilityUnavailableReason = z.enum([
+  "backend_unsupported",
+  "os_unsupported",
+  "not_provisioned",
+  "disabled_by_policy",
+  "lease_cold",
+  "tier_headless",
+  // Selfhosted (bring-your-own-compute) negotiation states (M1 additive; the
+  // selfhosted negotiation in select.ts wires them in M3):
+  "agent_offline",
+  // the enrolled agent process is not running / unreachable
+  "agent_reconnecting",
+  // a transient blip — the agent is reconnecting (warmable)
+  "consent_required",
+  // whole-machine / screen-control consent not yet acknowledged
+  "display_unavailable"
+  // headless machine with no display stack (no DesktopStream)
+]);
+var SessionCapabilities = z.object({
+  sessionId: z.string().uuid(),
+  backend: SandboxBackend,
+  os: SandboxOs,
+  liveness: z.enum(["cold", "warming", "warm", "draining"]),
+  // Echoed on viewer heartbeats (the split-brain fence).
+  leaseEpoch: z.number().int().nonnegative(),
+  viewerHeartbeatIntervalMs: z.number().int().positive().default(3e4),
+  FileSystem: z.object({
+    available: z.boolean(),
+    readOnly: z.boolean(),
+    root: z.string(),
+    pathSep: z.enum(["/", "\\"]),
+    treeMode: z.enum(["lazy", "snapshot"]),
+    reason: CapabilityUnavailableReason.nullable()
+  }),
+  Terminal: z.object({
+    transport: z.enum(["sse-events", "pty-ws"]).nullable(),
+    ptyCapable: z.boolean(),
+    shell: z.string(),
+    // The direct-to-provider ttyd PTY-over-websocket URL (pty-ws) resolved on the
+    // SAME tunnel as the desktop; null on a cold lease / read-only sse-events
+    // firehose / degraded terminal. The scoped stream token is recorded against
+    // the holder (NEVER a URL query param), symmetric with DesktopStream.
+    url: z.string().url().nullable(),
+    token: z.string().nullable(),
+    // ISO absolute expiry of the minted stream token (symmetric with
+    // DesktopStream.expiresAt). Null when no live URL/token is minted.
+    expiresAt: z.string().nullable(),
+    reason: CapabilityUnavailableReason.nullable()
+  }),
+  Git: z.object({
+    available: z.boolean(),
+    repos: z.array(z.string()),
+    reason: CapabilityUnavailableReason.nullable()
+  }),
+  DesktopStream: z.object({
+    // "relay-frames" is the selfhosted framebuffer stream: PNG-per-frame protobuf
+    // datagrams spliced over the relay (NOT RFB). The viewer renders it with the
+    // "frames" client (a canvas painter), distinct from Modal's "vnc-ws"/"novnc".
+    transport: z.enum(["vnc-ws", "rdp-ws", "webrtc", "relay-frames"]).nullable(),
+    client: z.enum(["novnc", "web-rdp", "frames"]).nullable(),
+    mode: z.enum(["read-only", "interactive"]).default("read-only"),
+    url: z.string().url().nullable(),
+    token: z.string().nullable(),
+    expiresAt: z.string().nullable(),
+    resolution: z.tuple([z.number().int().positive(), z.number().int().positive()]).default([1024, 768]),
+    // REQUIRED, no default (the server must assert un-redacted pixels).
+    unredacted: z.boolean(),
+    requiresAcknowledgment: z.boolean(),
+    acknowledged: z.boolean(),
+    // SHARED-EXPOSURE disclosure (addendum E.1). `shared` is true when the box's
+    // group has >1 session: watching this desktop ALSO shows the sibling
+    // sessions' agents on the one :0 framebuffer (the pixels cannot be redacted).
+    // `sharedSessionIds` lists the OTHER sessions whose agents may appear — IDS
+    // ONLY, never their goal/metadata/conversation (a viewer of A must not be
+    // able to use "I can see B's id" to subscribe to B's events; stress g). When
+    // shared, the consent gate requires the shared-exposure acknowledgment (409
+    // shared_acknowledgment_required) before the desktop path is handed out.
+    shared: z.boolean().default(false),
+    sharedSessionIds: z.array(z.string().uuid()).default([]),
+    reason: CapabilityUnavailableReason.nullable()
+  }),
+  Recording: z.object({
+    available: z.boolean(),
+    modes: z.array(z.enum(["manual", "on-turn", "on-verify"])),
+    codecs: z.array(z.enum(["h264-mp4", "vp9-webm"])),
+    reason: CapabilityUnavailableReason.nullable()
+  }),
+  // The AGENT drives the SAME :0 (xdotool/XTEST + scrot) the human watches; the
+  // human viewer plane is read-only by default (§6). `available` == desktop-
+  // capable backend && computerUseEnabled; `readOnly` reports whether the agent
+  // driver itself is gated to no-op input (v1 default false — the agent clicks).
+  ComputerUse: z.object({
+    available: z.boolean(),
+    readOnly: z.boolean(),
+    reason: CapabilityUnavailableReason.nullable()
+  }),
+  negotiatedAt: z.string()
+});
+var AttachViewerRequest = z.object({
+  viewerId: z.string().uuid().optional(),
+  desktop: z.boolean().optional()
+});
+var ViewerHolder = z.object({
+  viewerId: z.string().uuid(),
+  sandboxGroupId: z.string().uuid(),
+  liveness: z.enum(["cold", "warming", "warm", "draining"]),
+  // The epoch the viewer is fenced on; echoed back on heartbeats.
+  leaseEpoch: z.number().int().nonnegative(),
+  viewerHeartbeatIntervalMs: z.number().int().positive(),
+  // The desktop pixel tunnel URL the viewer connects to directly; null until
+  // P4 mints it (gated until then).
+  dataPlaneUrl: z.string().nullable()
+});
+var AcknowledgeStreamRequest = z.object({
+  // The principal accepts that the desktop pixel plane is un-redacted (can show
+  // cloud creds the agent cat's into a terminal). Always true to record consent;
+  // present for self-documentation + a future explicit withdraw.
+  acknowledgeUnredacted: z.boolean().default(true),
+  // The principal accepts the shared-exposure disclosure: watching this desktop
+  // also shows sibling sessions' agents on the one framebuffer.
+  acknowledgeShared: z.boolean().default(false)
+});
+var AcknowledgeStreamResponse = z.object({
+  acknowledged: z.boolean(),
+  acknowledgedShared: z.boolean()
+});
+var ViewerHeartbeatRequest = z.object({
+  leaseEpoch: z.number().int().nonnegative()
+});
+var ViewerHeartbeatResponse = z.object({
+  // false ⇒ the holder was reaped or the epoch is stale; the client re-attaches.
+  alive: z.boolean()
+});
+var EnrollmentOs = z.enum(["linux", "macos", "windows"]);
+var EnrollmentArch = z.enum(["x86_64", "aarch64"]);
+var DeviceEnrollmentStartRequest = z.object({
+  // The agent's ed25519 public key (the machine identity the enrollment binds to).
+  publicKey: z.string().min(1).max(1024),
+  os: EnrollmentOs.default("linux"),
+  arch: EnrollmentArch.default("x86_64"),
+  // Human-friendly machine name (hostname by default).
+  machineName: z.string().min(1).max(256).optional(),
+  // v1 only supports whole-machine; kept explicit so the consent is recorded.
+  exposure: z.literal("whole-machine").default("whole-machine"),
+  // The agent can offer a display (a real screen / Xvfb is available).
+  canOfferDisplay: z.boolean().default(false),
+  // The agent requests screen control (computer-use); the user's allow_screen_control
+  // at approve is the AUTHORITATIVE consent.
+  requestsScreenControl: z.boolean().default(false),
+  // The workspace this machine is enrolling into. The agent is told this at install
+  // (the user picks the workspace, or the install/enroll token carries it). The user
+  // who approves must hold a grant in THIS workspace — that binding is what makes
+  // the (user-unauthenticated) start safe: it cannot grant access to a workspace no
+  // authorized user later approves in.
+  workspaceId: z.string().uuid()
+});
+var DeviceEnrollmentStartResponse = z.object({
+  deviceCode: z.string(),
+  userCode: z.string(),
+  verificationUri: z.string(),
+  verificationUriComplete: z.string(),
+  intervalSeconds: z.number().int().positive(),
+  expiresInSeconds: z.number().int().positive()
+});
+var DeviceEnrollmentApproveRequest = z.object({
+  userCode: z.string().min(1).max(64),
+  allowScreenControl: z.boolean().default(false)
+});
+var DeviceEnrollmentApproveResponse = z.object({
+  approved: z.boolean(),
+  enrollmentId: z.string().uuid(),
+  sandboxId: z.string().uuid(),
+  allowScreenControl: z.boolean()
+});
+var DeviceEnrollmentPollRequest = z.object({
+  deviceCode: z.string().min(1).max(256)
+});
+var DeviceEnrollmentState = z.enum(["pending", "authorized", "denied", "expired", "disabled"]);
+var EnrollmentCredentialsResponse = z.object({
+  agentId: z.string().uuid(),
+  workspaceId: z.string().uuid(),
+  // The signed bearer the agent presents to the control plane (the `oge_` token).
+  bearer: z.string(),
+  // The Account-scoped control-plane subject prefix the agent subscribes to:
+  // agent.<workspaceId>.<agentId>.
+  subjectPrefix: z.string(),
+  // Connect info for the control plane + stream relay (may be empty when not yet
+  // configured for this deployment — the agent surfaces "control plane unconfigured").
+  natsUrls: z.array(z.string()),
+  relayUrl: z.string(),
+  // The agent's PRODUCER token for the relay edge (the `ogr_` token; M8b). Presented
+  // as StreamOpen.token when the agent registers a pty/desktop channel; the relay
+  // verifies it then pairs the producer with the viewer (whose `ogs_` token the
+  // relay also verifies). Empty when the relay-token plane is unconfigured for this
+  // deployment (graceful degrade — the agent then presents an empty token the relay
+  // rejects, surfacing the gap loudly rather than silently producing a dead stream).
+  relayToken: z.string(),
+  // VESTIGIAL (M-AUTH): there is no per-machine NATS Account creds file. The agent
+  // presents the `bearer` above as the NATS connect AUTH-TOKEN; the server's
+  // auth-callout responder validates it and mints a workspace-scoped user JWT. This
+  // field echoes the bearer so a consumer reading it as the connect credential still
+  // works; new consumers should read `bearer` directly.
+  natsAccountCreds: z.string(),
+  // The minisign public key the agent pins for self-update verification.
+  updatePublicKey: z.string(),
+  consentedWholeMachine: z.boolean(),
+  consentedScreenControl: z.boolean()
+});
+var DeviceEnrollmentPollResponse = z.object({
+  state: DeviceEnrollmentState,
+  // Present only when state === "authorized".
+  credentials: EnrollmentCredentialsResponse.optional()
+});
+var EnrollmentSummary = z.object({
+  id: z.string().uuid(),
+  pubkey: z.string(),
+  exposure: z.literal("whole-machine"),
+  hasDisplay: z.boolean(),
+  allowScreenControl: z.boolean(),
+  status: z.enum(["active", "revoked"]),
+  os: EnrollmentOs,
+  arch: z.string(),
+  lastSeenAt: z.string().nullable(),
+  createdAt: z.string(),
+  revokedAt: z.string().nullable()
+});
+var ListEnrollmentsResponse = z.object({
+  enrollments: z.array(EnrollmentSummary)
+});
+var RevokeEnrollmentResponse = z.object({
+  revoked: z.boolean()
+});
+var DeviceEnrollmentLookupRequest = z.object({
+  userCode: z.string().min(1).max(64)
+});
+var DeviceEnrollmentLookupMachine = z.object({
+  machineName: z.string().nullable(),
+  os: EnrollmentOs,
+  arch: z.string(),
+  canOfferDisplay: z.boolean(),
+  requestsScreenControl: z.boolean()
+});
+var DeviceEnrollmentLookupResponse = z.object({
+  workspaceId: z.string().uuid(),
+  userCode: z.string(),
+  machine: DeviceEnrollmentLookupMachine,
+  expiresAt: z.string()
+});
+var DeviceEnrollmentDenyRequest = z.object({
+  userCode: z.string().min(1).max(64)
+});
+var DeviceEnrollmentDenyResponse = z.object({
+  denied: z.boolean()
+});
+var MintEnrollTokenRequest = z.object({
+  allowScreenControl: z.boolean().default(false)
+});
+var MintEnrollTokenResponse = z.object({
+  // The `oget_` token. SECRET — the UI shows it once with a copy-now warning.
+  token: z.string(),
+  expiresAt: z.string(),
+  expiresInSeconds: z.number().int().positive()
+});
+var EnrollTokenExchangeRequest = z.object({
+  // The `oget_` enroll token (the auth + the workspace/account/consent grant).
+  token: z.string().min(1),
+  // The agent's ed25519 public key (the machine identity the enrollment binds to).
+  publicKey: z.string().min(1).max(1024),
+  os: EnrollmentOs.default("linux"),
+  arch: EnrollmentArch.default("x86_64"),
+  machineName: z.string().min(1).max(256).optional(),
+  // v1 only supports whole-machine; kept explicit so the consent is recorded.
+  exposure: z.literal("whole-machine").default("whole-machine"),
+  canOfferDisplay: z.boolean().default(false),
+  // The agent's REQUEST; the token's allowScreenControl is the AUTHORITATIVE consent.
+  requestsScreenControl: z.boolean().default(false)
+});
+var EnrollTokenExchangeResponse = z.object({
+  credentials: EnrollmentCredentialsResponse
+});
+var MetricSample = z.object({
+  cpuPct: z.number(),
+  load1: z.number(),
+  load5: z.number(),
+  load15: z.number(),
+  memUsedBytes: z.number().int(),
+  memTotalBytes: z.number().int(),
+  diskUsedBytes: z.number().int(),
+  diskTotalBytes: z.number().int(),
+  gpuUtilPct: z.number().nullable(),
+  gpuMemBytes: z.number().int().nullable(),
+  runQueue: z.number(),
+  sampledAt: z.string()
+});
+var MachineState = z.enum([
+  "online",
+  "reconnecting",
+  "offline",
+  "consent_required",
+  "display_unavailable",
+  "enrolling"
+]);
+var MachineKind = z.enum(["modal", "selfhosted"]);
+var MachineView = z.object({
+  sandboxId: z.string(),
+  enrollmentId: z.string().nullable(),
+  name: z.string(),
+  kind: MachineKind,
+  state: MachineState,
+  active: z.boolean(),
+  isSessionGroup: z.boolean(),
+  os: z.string(),
+  arch: z.string(),
+  hasDisplay: z.boolean(),
+  allowScreenControl: z.boolean(),
+  sharedSessionCount: z.number().int(),
+  lastSeenAt: z.string().nullable(),
+  metrics: MetricSample.nullable()
+});
+var MachinesResponse = z.object({
+  activeSandboxId: z.string().nullable(),
+  activeEpoch: z.number().int(),
+  machines: z.array(MachineView)
+});
+var SwapActiveSandboxRequest = z.object({
+  target: z.string().min(1)
+});
+var SwapActiveSandboxResponse = z.object({
+  swapped: z.boolean(),
+  activeSandboxId: z.string().nullable(),
+  activeEpoch: z.number().int(),
+  reason: z.string().optional()
+});
+var MachineMetricsSeriesResponse = z.object({
+  samples: z.array(MetricSample)
+});
+var ClientModel = z.object({
+  id: z.string(),
+  label: z.string(),
+  provider: z.string(),
+  // provider id
+  providerLabel: z.string(),
+  api: z.enum(["responses", "chat"]),
+  contextWindowTokens: z.number().int().positive().optional()
+});
 var ClientConfig = z.object({
   deploymentRevision: z.string(),
   defaultModel: z.string(),
   allowedModels: z.array(z.string()).min(1),
+  // Richer model list (provider-grouped) for the picker. Defaults to [] for
+  // back-compat: callers that only read allowedModels are unaffected.
+  models: z.array(ClientModel).default([]),
   defaultReasoningEffort: ReasoningEffort,
   allowedReasoningEfforts: z.array(ReasoningEffort).min(1),
   mcpServers: z.array(z.object({
@@ -1125,7 +2544,16 @@ var ClientConfig = z.object({
     maxSizeBytes: z.number().int().positive()
   }),
   productAccessMode: ProductAccessMode,
-  auth: ClientAuthConfig.default({ mode: "none" })
+  auth: ClientAuthConfig.default({ mode: "none" }),
+  // Server-wide hint: does this deployment support Channel-A structured services
+  // at all (P4.4). Per-session availability is negotiated on /stream-capabilities
+  // (it depends on the session's pinned backend); this is the coarse on/off the
+  // client uses to decide whether to even attempt the fs/git/terminal panels.
+  structuredServices: z.object({
+    fileSystem: z.boolean(),
+    git: z.boolean(),
+    terminalEvents: z.boolean()
+  }).default({ fileSystem: false, git: false, terminalEvents: false })
 });
 function base64UrlEncode(value) {
   return Buffer.from(value, "utf8").toString("base64url");
@@ -1161,10 +2589,15 @@ export {
   AccessGrant,
   AccountGrant,
   AccountRole,
+  AcknowledgeStreamRequest,
+  AcknowledgeStreamResponse,
   AddDocumentRequest,
+  AddWorkspaceMemberRequest,
   ApiKey,
+  AttachViewerRequest,
   BillingBalance,
   BillingMode,
+  CAPABILITY_DESCRIPTORS,
   CLEARED_RUN_STATE_BLOB,
   CLEARED_RUN_STATE_MARKER,
   CapabilityCatalogItem,
@@ -1181,9 +2614,11 @@ export {
   CapabilityPackSkillFile,
   CapabilityRuntime,
   CapabilitySource,
+  CapabilityUnavailableReason,
   ClearSessionContextRequest,
   ClientAuthConfig,
   ClientConfig,
+  ClientModel,
   ClientSessionEvent,
   CompactSessionContextRequest,
   CompactSessionContextResult,
@@ -1202,7 +2637,20 @@ export {
   CreateSocialPostRequest,
   CreateWorkspaceEnvironmentRequest,
   CreateWorkspaceRequest,
+  DESKTOP_STREAM_PORT,
   DelegatedAccessTokenPayload,
+  DeviceEnrollmentApproveRequest,
+  DeviceEnrollmentApproveResponse,
+  DeviceEnrollmentDenyRequest,
+  DeviceEnrollmentDenyResponse,
+  DeviceEnrollmentLookupMachine,
+  DeviceEnrollmentLookupRequest,
+  DeviceEnrollmentLookupResponse,
+  DeviceEnrollmentPollRequest,
+  DeviceEnrollmentPollResponse,
+  DeviceEnrollmentStartRequest,
+  DeviceEnrollmentStartResponse,
+  DeviceEnrollmentState,
   DiscoverMcpCapabilitiesResponse,
   Document,
   DocumentBase,
@@ -1211,6 +2659,15 @@ export {
   DocumentStatus,
   EnableCapabilityRequest,
   EnablePackRequest,
+  EnrollTokenExchangeRequest,
+  EnrollTokenExchangeResponse,
+  EnrollTokenPayload,
+  EnrollmentArch,
+  EnrollmentBearerPayload,
+  EnrollmentCredentialsResponse,
+  EnrollmentOs,
+  EnrollmentSummary,
+  EntitlementDecision,
   EntitlementValue,
   Entitlements,
   EntitlementsMode,
@@ -1221,25 +2678,85 @@ export {
   FileResourceRef,
   FileStatus,
   FileUploadStatus,
+  FsChangeKind,
+  FsChangedPayload,
+  FsDeleteRequest,
+  FsDeleteResponse,
+  FsEncoding,
+  FsListRequest,
+  FsListResponse,
+  FsMkdirRequest,
+  FsMkdirResponse,
+  FsMoveRequest,
+  FsMoveResponse,
+  FsNodeType,
+  FsReadRequest,
+  FsReadResponse,
+  FsTreeNode,
+  FsWriteRequest,
+  FsWriteResponse,
+  GitChangedPayload,
+  GitCommit,
+  GitDiffHunk,
+  GitDiffLine,
+  GitDiffLineType,
+  GitDiffRequest,
+  GitDiffResponse,
+  GitFileDiff,
+  GitFileStatus,
+  GitFileStatusCode,
   GitHubAppManifestCreate,
   GitHubRepository,
+  GitLogRequest,
+  GitLogResponse,
+  GitShowRequest,
+  GitShowResponse,
+  GitStatusRequest,
+  GitStatusResponse,
   GoalSpec,
   LimitAction,
   LimitDecision,
+  ListEnrollmentsResponse,
+  ListWorkspaceMembersResponse,
+  MachineKind,
+  MachineMetricsSeriesResponse,
+  MachineState,
+  MachineView,
+  MachinesResponse,
   ManagedAccount,
   MarketingDailyAnalysisTaskRequest,
+  MetricSample,
+  MintEnrollTokenRequest,
+  MintEnrollTokenResponse,
   PackInstallation,
   PackInstallationStatus,
   PageInfo,
   Permission,
   ProductAccessMode,
+  PtyCloseRequest,
+  PtyOpenRequest,
+  PtyOpenResponse,
+  PtyResizeRequest,
+  PtyWriteRequest,
   ReasoningEffort,
+  RecordingAvailablePayload,
+  RecordingCodec,
+  RecordingContentType,
+  RecordingFailedPayload,
+  RecordingFailedReason,
+  RecordingMode,
+  RecordingStartedPayload,
   RegisterCapabilityPackRequest,
+  RelayTokenPayload,
   ReorderSessionTurnsRequest,
   RepositoryResourceRef,
   ResourceRef,
   ResourceRefConflictError,
+  RevokeEnrollmentResponse,
   SandboxBackend,
+  SandboxCapabilityName,
+  SandboxCommandOutputDeltaPayload,
+  SandboxOs,
   ScheduledTask,
   ScheduledTaskAgentConfig,
   ScheduledTaskOverlapPolicy,
@@ -1251,6 +2768,7 @@ export {
   ScheduledTaskTriggerType,
   Session,
   SessionBusMessage,
+  SessionCapabilities,
   SessionEvent,
   SessionEventType,
   SessionGoal,
@@ -1258,6 +2776,7 @@ export {
   SessionGoalPausedReason,
   SessionGoalStatus,
   SessionStatus,
+  SessionStructuredCapabilities,
   SessionTurn,
   SessionTurnSource,
   SessionTurnStatus,
@@ -1267,20 +2786,39 @@ export {
   SocialPost,
   SocialProvider,
   StaticUsageLimits,
+  StreamClosedPayload,
+  StreamOpenedPayload,
+  StreamRevokedPayload,
+  StreamTokenPayload,
+  StreamUrlRotatedPayload,
+  SwapActiveSandboxRequest,
+  SwapActiveSandboxResponse,
+  TERMINAL_STREAM_PORT,
+  TerminalExecRequest,
+  TerminalExecResponse,
+  TerminalPtyExitedPayload,
+  TerminalPtyOutputDeltaPayload,
+  TerminalPtyStartedPayload,
   ToolRef,
   TriggerScheduledTaskRequest,
   UpdateScheduledTaskRequest,
   UpdateSessionGoalRequest,
+  UpdateSessionRequest,
   UpdateSessionTurnRequest,
   UpdateWorkspaceEnvironmentRequest,
+  UpdateWorkspaceMemberRequest,
   UpdateWorkspaceRequest,
   UsageEvent,
   UsageEventType,
   UsageLimitsMode,
+  ViewerHeartbeatRequest,
+  ViewerHeartbeatResponse,
+  ViewerHolder,
   Workspace,
   WorkspaceEnvironment,
   WorkspaceEnvironmentVariableMetadata,
   WorkspaceEnvironmentVariableName,
+  WorkspaceMember,
   WorkspaceRegisteredPack,
   isClearedRunStateBlob,
   mergeResourceRefs,
@@ -1289,7 +2827,15 @@ export {
   reasoningEffortForMetadata,
   resourceIdentityKey,
   signDelegatedAccessToken,
+  signEnrollToken,
+  signEnrollmentBearer,
+  signRelayToken,
+  signStreamToken,
   stableJson,
-  verifyDelegatedAccessToken
+  verifyDelegatedAccessToken,
+  verifyEnrollToken,
+  verifyEnrollmentBearer,
+  verifyRelayToken,
+  verifyStreamToken
 };
 //# sourceMappingURL=index.js.map