@opengeni/contracts 0.3.0 → 0.5.0

package/dist/index.d.ts

@@ -20,6 +20,7 @@ declare const SandboxBackend: z.ZodEnum<{
     blaxel: "blaxel";
     cloudflare: "cloudflare";
     vercel: "vercel";
+    selfhosted: "selfhosted";
 }>;
 type SandboxBackend = z.infer<typeof SandboxBackend>;
 declare const SandboxOs: z.ZodEnum<{
@@ -174,7 +175,10 @@ declare const Permission: z.ZodEnum<{
     "api_keys:manage": "api_keys:manage";
     "environments:manage": "environments:manage";
     "environments:use": "environments:use";
+    "mcp_servers:attach": "mcp_servers:attach";
     "goals:manage": "goals:manage";
+    "enrollments:read": "enrollments:read";
+    "enrollments:manage": "enrollments:manage";
 }>;
 type Permission = z.infer<typeof Permission>;
 declare const ProductAccessMode: z.ZodEnum<{
@@ -264,7 +268,10 @@ declare const AccountGrant: z.ZodObject<{
         "api_keys:manage": "api_keys:manage";
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
+        "mcp_servers:attach": "mcp_servers:attach";
         "goals:manage": "goals:manage";
+        "enrollments:read": "enrollments:read";
+        "enrollments:manage": "enrollments:manage";
     }>>;
     metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$strip>;
@@ -302,7 +309,10 @@ declare const AccessGrant: z.ZodObject<{
         "api_keys:manage": "api_keys:manage";
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
+        "mcp_servers:attach": "mcp_servers:attach";
         "goals:manage": "goals:manage";
+        "enrollments:read": "enrollments:read";
+        "enrollments:manage": "enrollments:manage";
     }>>;
     metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$strip>;
@@ -352,7 +362,10 @@ declare const AccessContext: z.ZodObject<{
             "api_keys:manage": "api_keys:manage";
             "environments:manage": "environments:manage";
             "environments:use": "environments:use";
+            "mcp_servers:attach": "mcp_servers:attach";
             "goals:manage": "goals:manage";
+            "enrollments:read": "enrollments:read";
+            "enrollments:manage": "enrollments:manage";
         }>>;
         metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, z.core.$strip>>;
@@ -389,7 +402,10 @@ declare const AccessContext: z.ZodObject<{
             "api_keys:manage": "api_keys:manage";
             "environments:manage": "environments:manage";
             "environments:use": "environments:use";
+            "mcp_servers:attach": "mcp_servers:attach";
             "goals:manage": "goals:manage";
+            "enrollments:read": "enrollments:read";
+            "enrollments:manage": "enrollments:manage";
         }>>;
         metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, z.core.$strip>>;
@@ -430,7 +446,10 @@ declare const DelegatedAccessTokenPayload: z.ZodObject<{
         "api_keys:manage": "api_keys:manage";
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
+        "mcp_servers:attach": "mcp_servers:attach";
         "goals:manage": "goals:manage";
+        "enrollments:read": "enrollments:read";
+        "enrollments:manage": "enrollments:manage";
     }>>;
     sessionId: z.ZodOptional<z.ZodString>;
     exp: z.ZodNumber;
@@ -438,6 +457,35 @@ declare const DelegatedAccessTokenPayload: z.ZodObject<{
 type DelegatedAccessTokenPayload = z.infer<typeof DelegatedAccessTokenPayload>;
 declare function signDelegatedAccessToken(secret: string, payload: DelegatedAccessTokenPayload): Promise<string>;
 declare function verifyDelegatedAccessToken(secret: string, token: string, nowSeconds?: number): Promise<DelegatedAccessTokenPayload | null>;
+declare const EnrollmentBearerPayload: z.ZodObject<{
+    workspaceId: z.ZodString;
+    agentId: z.ZodString;
+    enrollmentId: z.ZodString;
+    subjectPrefix: z.ZodString;
+    exp: z.ZodNumber;
+}, z.core.$strip>;
+type EnrollmentBearerPayload = z.infer<typeof EnrollmentBearerPayload>;
+declare function signEnrollmentBearer(secret: string, payload: EnrollmentBearerPayload): Promise<string>;
+declare function verifyEnrollmentBearer(secret: string, token: string, nowSeconds?: number): Promise<EnrollmentBearerPayload | null>;
+declare const EnrollTokenPayload: z.ZodObject<{
+    typ: z.ZodLiteral<"enroll">;
+    workspaceId: z.ZodString;
+    accountId: z.ZodString;
+    allowScreenControl: z.ZodBoolean;
+    iat: z.ZodNumber;
+    exp: z.ZodNumber;
+}, z.core.$strip>;
+type EnrollTokenPayload = z.infer<typeof EnrollTokenPayload>;
+declare function signEnrollToken(secret: string, payload: EnrollTokenPayload): Promise<string>;
+/**
+ * Verify an enroll token: rejects (returns null) on a bad prefix (NOT `oget_`),
+ * a malformed envelope, a bad HMAC signature (constant-time), schema-invalid
+ * claims (which includes `typ !== "enroll"` — the `z.literal` rejects it), or an
+ * expired token (`exp < now`). Mirrors verifyEnrollmentBearer exactly. An `oge_`
+ * bearer fails the prefix gate; a same-secret token that lacks the typ claim fails
+ * the schema gate — both halves of the domain separation are enforced here.
+ */
+declare function verifyEnrollToken(secret: string, token: string, nowSeconds?: number): Promise<EnrollTokenPayload | null>;
 declare const StreamTokenPayload: z.ZodObject<{
     workspaceId: z.ZodString;
     sessionId: z.ZodString;
@@ -463,6 +511,23 @@ declare function signStreamToken(secret: string, payload: StreamTokenPayload): P
  * caller proves it is for THIS box's current epoch and THIS workspace+session.
  */
 declare function verifyStreamToken(secret: string, token: string, nowSeconds?: number): Promise<StreamTokenPayload | null>;
+declare const RelayTokenPayload: z.ZodObject<{
+    workspaceId: z.ZodString;
+    agentId: z.ZodString;
+    exp: z.ZodNumber;
+}, z.core.$strip>;
+type RelayTokenPayload = z.infer<typeof RelayTokenPayload>;
+declare function signRelayToken(secret: string, payload: RelayTokenPayload): Promise<string>;
+/**
+ * Verify a relay producer token: rejects (returns null) on a bad prefix, malformed
+ * envelope, bad HMAC signature (constant-time), schema-invalid claims, or expiry.
+ * Mirrors verifyStreamToken exactly. The relay (Rust) re-implements this verify;
+ * the TS verify here proves the format for the cross-stack fixture + any TS caller.
+ *
+ * The channel-key scope (claim.workspaceId/agentId vs the StreamOpen channel key)
+ * is enforced by the relay at USE — verify proves authenticity + freshness only.
+ */
+declare function verifyRelayToken(secret: string, token: string, nowSeconds?: number): Promise<RelayTokenPayload | null>;
 declare const CreateWorkspaceRequest: z.ZodObject<{
     accountId: z.ZodOptional<z.ZodString>;
     name: z.ZodString;
@@ -512,7 +577,10 @@ declare const ApiKey: z.ZodObject<{
         "api_keys:manage": "api_keys:manage";
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
+        "mcp_servers:attach": "mcp_servers:attach";
         "goals:manage": "goals:manage";
+        "enrollments:read": "enrollments:read";
+        "enrollments:manage": "enrollments:manage";
     }>>;
     expiresAt: z.ZodNullable<z.ZodString>;
     revokedAt: z.ZodNullable<z.ZodString>;
@@ -552,7 +620,10 @@ declare const CreateApiKeyRequest: z.ZodObject<{
         "api_keys:manage": "api_keys:manage";
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
+        "mcp_servers:attach": "mcp_servers:attach";
         "goals:manage": "goals:manage";
+        "enrollments:read": "enrollments:read";
+        "enrollments:manage": "enrollments:manage";
     }>>;
     expiresAt: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
@@ -592,7 +663,10 @@ declare const CreateApiKeyResponse: z.ZodObject<{
             "api_keys:manage": "api_keys:manage";
             "environments:manage": "environments:manage";
             "environments:use": "environments:use";
+            "mcp_servers:attach": "mcp_servers:attach";
             "goals:manage": "goals:manage";
+            "enrollments:read": "enrollments:read";
+            "enrollments:manage": "enrollments:manage";
         }>>;
         expiresAt: z.ZodNullable<z.ZodString>;
         revokedAt: z.ZodNullable<z.ZodString>;
@@ -635,7 +709,10 @@ declare const WorkspaceMember: z.ZodObject<{
         "api_keys:manage": "api_keys:manage";
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
+        "mcp_servers:attach": "mcp_servers:attach";
         "goals:manage": "goals:manage";
+        "enrollments:read": "enrollments:read";
+        "enrollments:manage": "enrollments:manage";
     }>>;
     createdAt: z.ZodString;
 }, z.core.$strip>;
@@ -673,7 +750,10 @@ declare const ListWorkspaceMembersResponse: z.ZodObject<{
             "api_keys:manage": "api_keys:manage";
             "environments:manage": "environments:manage";
             "environments:use": "environments:use";
+            "mcp_servers:attach": "mcp_servers:attach";
             "goals:manage": "goals:manage";
+            "enrollments:read": "enrollments:read";
+            "enrollments:manage": "enrollments:manage";
         }>>;
         createdAt: z.ZodString;
     }, z.core.$strip>>;
@@ -710,7 +790,10 @@ declare const AddWorkspaceMemberRequest: z.ZodObject<{
         "api_keys:manage": "api_keys:manage";
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
+        "mcp_servers:attach": "mcp_servers:attach";
         "goals:manage": "goals:manage";
+        "enrollments:read": "enrollments:read";
+        "enrollments:manage": "enrollments:manage";
     }>>;
 }, z.core.$strip>;
 type AddWorkspaceMemberRequest = z.infer<typeof AddWorkspaceMemberRequest>;
@@ -744,7 +827,10 @@ declare const UpdateWorkspaceMemberRequest: z.ZodObject<{
         "api_keys:manage": "api_keys:manage";
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
+        "mcp_servers:attach": "mcp_servers:attach";
         "goals:manage": "goals:manage";
+        "enrollments:read": "enrollments:read";
+        "enrollments:manage": "enrollments:manage";
     }>>;
 }, z.core.$strip>;
 type UpdateWorkspaceMemberRequest = z.infer<typeof UpdateWorkspaceMemberRequest>;
@@ -824,6 +910,70 @@ declare const LimitDecision: z.ZodDiscriminatedUnion<[z.ZodObject<{
     message: z.ZodString;
 }, z.core.$strip>], "allowed">;
 type LimitDecision = z.infer<typeof LimitDecision>;
+declare const EntitlementDecision: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    allowed: z.ZodLiteral<true>;
+    quantity: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>, z.ZodObject<{
+    allowed: z.ZodLiteral<false>;
+    reason: z.ZodString;
+    code: z.ZodOptional<z.ZodString>;
+    quantity: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>], "allowed">;
+type EntitlementDecision = z.infer<typeof EntitlementDecision>;
+type AdmitRunInput = {
+    accountId: string;
+    workspaceId: string;
+    action: string;
+    quantity: number;
+};
+type EntitlementsPort = {
+    admitRun(input: AdmitRunInput): Promise<EntitlementDecision>;
+};
+type GitCredentialsRequest = {
+    accountId: string;
+    workspaceId: string;
+    installationId: number;
+    repositoryIds: number[];
+};
+type GitCredentials = {
+    token: string;
+    workspaceId: string;
+    identity?: {
+        name: string;
+        email: string;
+    } | null;
+};
+type SandboxSecretsRequest = {
+    accountId: string;
+    workspaceId: string;
+    environmentId: string;
+};
+type SandboxSecrets = {
+    values: Record<string, string>;
+    workspaceId: string;
+    id?: string;
+    name?: string;
+    description?: string | null;
+};
+type ConnectionCredentialsPort = {
+    gitCredentials?: (input: GitCredentialsRequest) => Promise<GitCredentials>;
+    sandboxSecrets?: (input: SandboxSecretsRequest) => Promise<SandboxSecrets>;
+};
+type GitHubInstallationSummary = {
+    installationId: number;
+    accountLogin: string | null;
+    accountType: string | null;
+    suspended: boolean;
+};
+type GitHubAppApiPort = {
+    verifyInstallationAccessForUser?: (input: {
+        code: string;
+        installationId: number;
+    }) => Promise<GitHubInstallationSummary>;
+    listRepositories?: (input: {
+        installationIds?: number[];
+    }) => Promise<GitHubRepository[]>;
+};
 declare const BillingBalance: z.ZodObject<{
     accountId: z.ZodString;
     balanceMicros: z.ZodNumber;
@@ -1018,8 +1168,32 @@ type DocumentSearchRequest = z.infer<typeof DocumentSearchRequest>;
 declare const ToolRef: z.ZodObject<{
     kind: z.ZodLiteral<"mcp">;
     id: z.ZodString;
+    optional: z.ZodOptional<z.ZodBoolean>;
 }, z.core.$strip>;
 type ToolRef = z.infer<typeof ToolRef>;
+declare const SessionMcpServerInput: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodOptional<z.ZodString>;
+    url: z.ZodString;
+    allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    timeoutMs: z.ZodOptional<z.ZodNumber>;
+    cacheToolsList: z.ZodOptional<z.ZodBoolean>;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>;
+type SessionMcpServerInput = z.infer<typeof SessionMcpServerInput>;
+declare const SessionMcpCredentialUpdateInput: z.ZodObject<{
+    id: z.ZodString;
+    headers: z.ZodRecord<z.ZodString, z.ZodString>;
+}, z.core.$strip>;
+type SessionMcpCredentialUpdateInput = z.infer<typeof SessionMcpCredentialUpdateInput>;
+declare const SessionMcpServerMetadata: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodNullable<z.ZodString>;
+    url: z.ZodString;
+    headerNames: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    credentialVersion: z.ZodNumber;
+}, z.core.$strict>;
+type SessionMcpServerMetadata = z.infer<typeof SessionMcpServerMetadata>;
 declare class ResourceRefConflictError extends Error {
     constructor(message: string);
 }
@@ -1194,6 +1368,7 @@ declare const SessionTurn: z.ZodObject<{
     tools: z.ZodArray<z.ZodObject<{
         kind: z.ZodLiteral<"mcp">;
         id: z.ZodString;
+        optional: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
     model: z.ZodString;
     reasoningEffort: z.ZodEnum<{
@@ -1215,6 +1390,7 @@ declare const SessionTurn: z.ZodObject<{
         blaxel: "blaxel";
         cloudflare: "cloudflare";
         vercel: "vercel";
+        selfhosted: "selfhosted";
     }>;
     sandboxOs: z.ZodNullable<z.ZodEnum<{
         linux: "linux";
@@ -1246,6 +1422,7 @@ declare const UpdateSessionTurnRequest: z.ZodObject<{
     tools: z.ZodOptional<z.ZodArray<z.ZodObject<{
         kind: z.ZodLiteral<"mcp">;
         id: z.ZodString;
+        optional: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>>;
     model: z.ZodOptional<z.ZodString>;
     reasoningEffort: z.ZodOptional<z.ZodEnum<{
@@ -1267,6 +1444,7 @@ declare const UpdateSessionTurnRequest: z.ZodObject<{
         blaxel: "blaxel";
         cloudflare: "cloudflare";
         vercel: "vercel";
+        selfhosted: "selfhosted";
     }>>;
     metadata: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
 }, z.core.$strip>;
@@ -1388,6 +1566,7 @@ declare const ScheduledTaskAgentConfig: z.ZodObject<{
     tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
         kind: z.ZodLiteral<"mcp">;
         id: z.ZodString;
+        optional: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>>;
     metadata: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     model: z.ZodOptional<z.ZodString>;
@@ -1410,6 +1589,7 @@ declare const ScheduledTaskAgentConfig: z.ZodObject<{
         blaxel: "blaxel";
         cloudflare: "cloudflare";
         vercel: "vercel";
+        selfhosted: "selfhosted";
     }>>;
     goal: z.ZodOptional<z.ZodObject<{
         text: z.ZodString;
@@ -1479,6 +1659,7 @@ declare const ScheduledTask: z.ZodObject<{
         tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
             kind: z.ZodLiteral<"mcp">;
             id: z.ZodString;
+            optional: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>>;
         metadata: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         model: z.ZodOptional<z.ZodString>;
@@ -1501,6 +1682,7 @@ declare const ScheduledTask: z.ZodObject<{
             blaxel: "blaxel";
             cloudflare: "cloudflare";
             vercel: "vercel";
+            selfhosted: "selfhosted";
         }>>;
         goal: z.ZodOptional<z.ZodObject<{
             text: z.ZodString;
@@ -1591,6 +1773,7 @@ declare const CreateScheduledTaskRequest: z.ZodObject<{
         tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
             kind: z.ZodLiteral<"mcp">;
             id: z.ZodString;
+            optional: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>>;
         metadata: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         model: z.ZodOptional<z.ZodString>;
@@ -1613,6 +1796,7 @@ declare const CreateScheduledTaskRequest: z.ZodObject<{
             blaxel: "blaxel";
             cloudflare: "cloudflare";
             vercel: "vercel";
+            selfhosted: "selfhosted";
         }>>;
         goal: z.ZodOptional<z.ZodObject<{
             text: z.ZodString;
@@ -1681,6 +1865,7 @@ declare const UpdateScheduledTaskRequest: z.ZodObject<{
         tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
             kind: z.ZodLiteral<"mcp">;
             id: z.ZodString;
+            optional: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>>;
         metadata: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
         model: z.ZodOptional<z.ZodString>;
@@ -1703,6 +1888,7 @@ declare const UpdateScheduledTaskRequest: z.ZodObject<{
             blaxel: "blaxel";
             cloudflare: "cloudflare";
             vercel: "vercel";
+            selfhosted: "selfhosted";
         }>>;
         goal: z.ZodOptional<z.ZodObject<{
             text: z.ZodString;
@@ -1831,6 +2017,7 @@ declare const CapabilityPack: z.ZodObject<{
     tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
         kind: z.ZodLiteral<"mcp">;
         id: z.ZodString;
+        optional: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>>;
     connectors: z.ZodDefault<z.ZodArray<z.ZodObject<{
         id: z.ZodString;
@@ -1920,6 +2107,7 @@ declare const RegisterCapabilityPackRequest: z.ZodObject<{
     tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
         kind: z.ZodLiteral<"mcp">;
         id: z.ZodString;
+        optional: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>>;
     connectors: z.ZodDefault<z.ZodArray<z.ZodObject<{
         id: z.ZodString;
@@ -2012,6 +2200,7 @@ declare const WorkspaceRegisteredPack: z.ZodObject<{
         tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
             kind: z.ZodLiteral<"mcp">;
             id: z.ZodString;
+            optional: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>>;
         connectors: z.ZodDefault<z.ZodArray<z.ZodObject<{
             id: z.ZodString;
@@ -2291,6 +2480,7 @@ declare const CapabilityCatalogItem: z.ZodObject<{
     tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
         kind: z.ZodLiteral<"mcp">;
         id: z.ZodString;
+        optional: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>>;
     runtime: z.ZodDefault<z.ZodObject<{
         available: z.ZodDefault<z.ZodBoolean>;
@@ -2388,6 +2578,7 @@ declare const CapabilityCatalogResponse: z.ZodObject<{
         tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
             kind: z.ZodLiteral<"mcp">;
             id: z.ZodString;
+            optional: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>>;
         runtime: z.ZodDefault<z.ZodObject<{
             available: z.ZodDefault<z.ZodBoolean>;
@@ -2453,6 +2644,7 @@ declare const DiscoverMcpCapabilitiesResponse: z.ZodObject<{
         tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
             kind: z.ZodLiteral<"mcp">;
             id: z.ZodString;
+            optional: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>>;
         runtime: z.ZodDefault<z.ZodObject<{
             available: z.ZodDefault<z.ZodBoolean>;
@@ -2504,6 +2696,7 @@ declare const Session: z.ZodObject<{
     tools: z.ZodArray<z.ZodObject<{
         kind: z.ZodLiteral<"mcp">;
         id: z.ZodString;
+        optional: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>;
     metadata: z.ZodRecord<z.ZodString, z.ZodUnknown>;
     model: z.ZodString;
@@ -2518,6 +2711,7 @@ declare const Session: z.ZodObject<{
         blaxel: "blaxel";
         cloudflare: "cloudflare";
         vercel: "vercel";
+        selfhosted: "selfhosted";
     }>;
     sandboxOs: z.ZodEnum<{
         linux: "linux";
@@ -2525,6 +2719,8 @@ declare const Session: z.ZodObject<{
         windows: "windows";
     }>;
     sandboxGroupId: z.ZodString;
+    activeSandboxId: z.ZodNullable<z.ZodString>;
+    activeEpoch: z.ZodNumber;
     environmentId: z.ZodNullable<z.ZodString>;
     firstPartyMcpPermissions: z.ZodNullable<z.ZodArray<z.ZodEnum<{
         "account:read": "account:read";
@@ -2554,14 +2750,26 @@ declare const Session: z.ZodObject<{
         "api_keys:manage": "api_keys:manage";
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
+        "mcp_servers:attach": "mcp_servers:attach";
         "goals:manage": "goals:manage";
+        "enrollments:read": "enrollments:read";
+        "enrollments:manage": "enrollments:manage";
     }>>>;
+    mcpServers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        url: z.ZodString;
+        headerNames: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        credentialVersion: z.ZodNumber;
+    }, z.core.$strict>>>;
     parentSessionId: z.ZodNullable<z.ZodString>;
     createIdempotencyKey: z.ZodNullable<z.ZodString>;
     temporalWorkflowId: z.ZodNullable<z.ZodString>;
     activeTurnId: z.ZodNullable<z.ZodString>;
     lastInputTokens: z.ZodNullable<z.ZodNumber>;
     lastSequence: z.ZodNumber;
+    codexPinnedCredentialId: z.ZodNullable<z.ZodString>;
+    codexLastCredentialId: z.ZodNullable<z.ZodString>;
     createdAt: z.ZodString;
     updatedAt: z.ZodString;
 }, z.core.$strip>;
@@ -2612,6 +2820,7 @@ declare const SessionEventType: z.ZodEnum<{
     "terminal.pty.output.delta": "terminal.pty.output.delta";
     "terminal.pty.exited": "terminal.pty.exited";
     "session.title_set": "session.title_set";
+    "codex.account.switched": "codex.account.switched";
 }>;
 type SessionEventType = z.infer<typeof SessionEventType>;
 declare const StreamUrlRotatedPayload: z.ZodObject<{
@@ -3368,6 +3577,7 @@ declare const SessionEvent: z.ZodObject<{
         "terminal.pty.output.delta": "terminal.pty.output.delta";
         "terminal.pty.exited": "terminal.pty.exited";
         "session.title_set": "session.title_set";
+        "codex.account.switched": "codex.account.switched";
     }>;
     payload: z.ZodDefault<z.ZodUnknown>;
     occurredAt: z.ZodString;
@@ -3393,6 +3603,7 @@ declare const CreateSessionRequest: z.ZodObject<{
     tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
         kind: z.ZodLiteral<"mcp">;
         id: z.ZodString;
+        optional: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strip>>>;
     metadata: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     model: z.ZodOptional<z.ZodString>;
@@ -3415,7 +3626,10 @@ declare const CreateSessionRequest: z.ZodObject<{
         blaxel: "blaxel";
         cloudflare: "cloudflare";
         vercel: "vercel";
+        selfhosted: "selfhosted";
     }>>;
+    targetSandboxId: z.ZodOptional<z.ZodString>;
+    workingDir: z.ZodOptional<z.ZodString>;
     environmentId: z.ZodOptional<z.ZodString>;
     goal: z.ZodOptional<z.ZodObject<{
         text: z.ZodString;
@@ -3452,8 +3666,20 @@ declare const CreateSessionRequest: z.ZodObject<{
         "api_keys:manage": "api_keys:manage";
         "environments:manage": "environments:manage";
         "environments:use": "environments:use";
+        "mcp_servers:attach": "mcp_servers:attach";
         "goals:manage": "goals:manage";
+        "enrollments:read": "enrollments:read";
+        "enrollments:manage": "enrollments:manage";
     }>>>;
+    mcpServers: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodOptional<z.ZodString>;
+        url: z.ZodString;
+        allowedTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        timeoutMs: z.ZodOptional<z.ZodNumber>;
+        cacheToolsList: z.ZodOptional<z.ZodBoolean>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>>;
     sandbox: z.ZodOptional<z.ZodUnion<readonly [z.ZodLiteral<"shared">, z.ZodLiteral<"new">, z.ZodObject<{
         groupId: z.ZodString;
     }, z.core.$strip>]>>;
@@ -3480,6 +3706,7 @@ declare const ClientSessionEvent: z.ZodDiscriminatedUnion<[z.ZodObject<{
         tools: z.ZodDefault<z.ZodArray<z.ZodObject<{
             kind: z.ZodLiteral<"mcp">;
             id: z.ZodString;
+            optional: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strip>>>;
         model: z.ZodOptional<z.ZodString>;
         reasoningEffort: z.ZodOptional<z.ZodEnum<{
@@ -3490,6 +3717,10 @@ declare const ClientSessionEvent: z.ZodDiscriminatedUnion<[z.ZodObject<{
             high: "high";
             xhigh: "xhigh";
         }>>;
+        mcpCredentialUpdates: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            headers: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, z.core.$strip>>>;
     }, z.core.$strip>;
 }, z.core.$strip>, z.ZodObject<{
     type: z.ZodLiteral<"user.interrupt">;
@@ -3564,6 +3795,7 @@ declare const SessionBusMessage: z.ZodObject<{
             "terminal.pty.output.delta": "terminal.pty.output.delta";
             "terminal.pty.exited": "terminal.pty.exited";
             "session.title_set": "session.title_set";
+            "codex.account.switched": "codex.account.switched";
         }>;
         payload: z.ZodDefault<z.ZodUnknown>;
         occurredAt: z.ZodString;
@@ -3613,6 +3845,10 @@ declare const CapabilityUnavailableReason: z.ZodEnum<{
     disabled_by_policy: "disabled_by_policy";
     lease_cold: "lease_cold";
     tier_headless: "tier_headless";
+    agent_offline: "agent_offline";
+    agent_reconnecting: "agent_reconnecting";
+    consent_required: "consent_required";
+    display_unavailable: "display_unavailable";
 }>;
 type CapabilityUnavailableReason = z.infer<typeof CapabilityUnavailableReason>;
 declare const SessionCapabilities: z.ZodObject<{
@@ -3628,6 +3864,7 @@ declare const SessionCapabilities: z.ZodObject<{
         blaxel: "blaxel";
         cloudflare: "cloudflare";
         vercel: "vercel";
+        selfhosted: "selfhosted";
     }>;
     os: z.ZodEnum<{
         linux: "linux";
@@ -3661,6 +3898,10 @@ declare const SessionCapabilities: z.ZodObject<{
             disabled_by_policy: "disabled_by_policy";
             lease_cold: "lease_cold";
             tier_headless: "tier_headless";
+            agent_offline: "agent_offline";
+            agent_reconnecting: "agent_reconnecting";
+            consent_required: "consent_required";
+            display_unavailable: "display_unavailable";
         }>>;
     }, z.core.$strip>;
     Terminal: z.ZodObject<{
@@ -3680,6 +3921,10 @@ declare const SessionCapabilities: z.ZodObject<{
             disabled_by_policy: "disabled_by_policy";
             lease_cold: "lease_cold";
             tier_headless: "tier_headless";
+            agent_offline: "agent_offline";
+            agent_reconnecting: "agent_reconnecting";
+            consent_required: "consent_required";
+            display_unavailable: "display_unavailable";
         }>>;
     }, z.core.$strip>;
     Git: z.ZodObject<{
@@ -3692,6 +3937,10 @@ declare const SessionCapabilities: z.ZodObject<{
             disabled_by_policy: "disabled_by_policy";
             lease_cold: "lease_cold";
             tier_headless: "tier_headless";
+            agent_offline: "agent_offline";
+            agent_reconnecting: "agent_reconnecting";
+            consent_required: "consent_required";
+            display_unavailable: "display_unavailable";
         }>>;
     }, z.core.$strip>;
     DesktopStream: z.ZodObject<{
@@ -3699,10 +3948,12 @@ declare const SessionCapabilities: z.ZodObject<{
             "vnc-ws": "vnc-ws";
             "rdp-ws": "rdp-ws";
             webrtc: "webrtc";
+            "relay-frames": "relay-frames";
         }>>;
         client: z.ZodNullable<z.ZodEnum<{
             novnc: "novnc";
             "web-rdp": "web-rdp";
+            frames: "frames";
         }>>;
         mode: z.ZodDefault<z.ZodEnum<{
             "read-only": "read-only";
@@ -3724,6 +3975,10 @@ declare const SessionCapabilities: z.ZodObject<{
             disabled_by_policy: "disabled_by_policy";
             lease_cold: "lease_cold";
             tier_headless: "tier_headless";
+            agent_offline: "agent_offline";
+            agent_reconnecting: "agent_reconnecting";
+            consent_required: "consent_required";
+            display_unavailable: "display_unavailable";
         }>>;
     }, z.core.$strip>;
     Recording: z.ZodObject<{
@@ -3744,6 +3999,10 @@ declare const SessionCapabilities: z.ZodObject<{
             disabled_by_policy: "disabled_by_policy";
             lease_cold: "lease_cold";
             tier_headless: "tier_headless";
+            agent_offline: "agent_offline";
+            agent_reconnecting: "agent_reconnecting";
+            consent_required: "consent_required";
+            display_unavailable: "display_unavailable";
         }>>;
     }, z.core.$strip>;
     ComputerUse: z.ZodObject<{
@@ -3756,6 +4015,10 @@ declare const SessionCapabilities: z.ZodObject<{
             disabled_by_policy: "disabled_by_policy";
             lease_cold: "lease_cold";
             tier_headless: "tier_headless";
+            agent_offline: "agent_offline";
+            agent_reconnecting: "agent_reconnecting";
+            consent_required: "consent_required";
+            display_unavailable: "display_unavailable";
         }>>;
     }, z.core.$strip>;
     negotiatedAt: z.ZodString;
@@ -3798,6 +4061,419 @@ declare const ViewerHeartbeatResponse: z.ZodObject<{
     alive: z.ZodBoolean;
 }, z.core.$strip>;
 type ViewerHeartbeatResponse = z.infer<typeof ViewerHeartbeatResponse>;
+declare const EnrollmentOs: z.ZodEnum<{
+    linux: "linux";
+    macos: "macos";
+    windows: "windows";
+}>;
+type EnrollmentOs = z.infer<typeof EnrollmentOs>;
+declare const EnrollmentArch: z.ZodEnum<{
+    x86_64: "x86_64";
+    aarch64: "aarch64";
+}>;
+type EnrollmentArch = z.infer<typeof EnrollmentArch>;
+declare const DeviceEnrollmentStartRequest: z.ZodObject<{
+    publicKey: z.ZodString;
+    os: z.ZodDefault<z.ZodEnum<{
+        linux: "linux";
+        macos: "macos";
+        windows: "windows";
+    }>>;
+    arch: z.ZodDefault<z.ZodEnum<{
+        x86_64: "x86_64";
+        aarch64: "aarch64";
+    }>>;
+    machineName: z.ZodOptional<z.ZodString>;
+    exposure: z.ZodDefault<z.ZodLiteral<"whole-machine">>;
+    canOfferDisplay: z.ZodDefault<z.ZodBoolean>;
+    requestsScreenControl: z.ZodDefault<z.ZodBoolean>;
+    workspaceId: z.ZodString;
+}, z.core.$strip>;
+type DeviceEnrollmentStartRequest = z.infer<typeof DeviceEnrollmentStartRequest>;
+declare const DeviceEnrollmentStartResponse: z.ZodObject<{
+    deviceCode: z.ZodString;
+    userCode: z.ZodString;
+    verificationUri: z.ZodString;
+    verificationUriComplete: z.ZodString;
+    intervalSeconds: z.ZodNumber;
+    expiresInSeconds: z.ZodNumber;
+}, z.core.$strip>;
+type DeviceEnrollmentStartResponse = z.infer<typeof DeviceEnrollmentStartResponse>;
+declare const DeviceEnrollmentApproveRequest: z.ZodObject<{
+    userCode: z.ZodString;
+    allowScreenControl: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+type DeviceEnrollmentApproveRequest = z.infer<typeof DeviceEnrollmentApproveRequest>;
+declare const DeviceEnrollmentApproveResponse: z.ZodObject<{
+    approved: z.ZodBoolean;
+    enrollmentId: z.ZodString;
+    sandboxId: z.ZodString;
+    allowScreenControl: z.ZodBoolean;
+}, z.core.$strip>;
+type DeviceEnrollmentApproveResponse = z.infer<typeof DeviceEnrollmentApproveResponse>;
+declare const DeviceEnrollmentPollRequest: z.ZodObject<{
+    deviceCode: z.ZodString;
+}, z.core.$strip>;
+type DeviceEnrollmentPollRequest = z.infer<typeof DeviceEnrollmentPollRequest>;
+declare const DeviceEnrollmentState: z.ZodEnum<{
+    disabled: "disabled";
+    expired: "expired";
+    pending: "pending";
+    authorized: "authorized";
+    denied: "denied";
+}>;
+type DeviceEnrollmentState = z.infer<typeof DeviceEnrollmentState>;
+declare const EnrollmentCredentialsResponse: z.ZodObject<{
+    agentId: z.ZodString;
+    workspaceId: z.ZodString;
+    bearer: z.ZodString;
+    subjectPrefix: z.ZodString;
+    natsUrls: z.ZodArray<z.ZodString>;
+    relayUrl: z.ZodString;
+    relayToken: z.ZodString;
+    natsAccountCreds: z.ZodString;
+    updatePublicKey: z.ZodString;
+    consentedWholeMachine: z.ZodBoolean;
+    consentedScreenControl: z.ZodBoolean;
+}, z.core.$strip>;
+type EnrollmentCredentialsResponse = z.infer<typeof EnrollmentCredentialsResponse>;
+declare const DeviceEnrollmentPollResponse: z.ZodObject<{
+    state: z.ZodEnum<{
+        disabled: "disabled";
+        expired: "expired";
+        pending: "pending";
+        authorized: "authorized";
+        denied: "denied";
+    }>;
+    credentials: z.ZodOptional<z.ZodObject<{
+        agentId: z.ZodString;
+        workspaceId: z.ZodString;
+        bearer: z.ZodString;
+        subjectPrefix: z.ZodString;
+        natsUrls: z.ZodArray<z.ZodString>;
+        relayUrl: z.ZodString;
+        relayToken: z.ZodString;
+        natsAccountCreds: z.ZodString;
+        updatePublicKey: z.ZodString;
+        consentedWholeMachine: z.ZodBoolean;
+        consentedScreenControl: z.ZodBoolean;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type DeviceEnrollmentPollResponse = z.infer<typeof DeviceEnrollmentPollResponse>;
+declare const EnrollmentSummary: z.ZodObject<{
+    id: z.ZodString;
+    pubkey: z.ZodString;
+    exposure: z.ZodLiteral<"whole-machine">;
+    hasDisplay: z.ZodBoolean;
+    allowScreenControl: z.ZodBoolean;
+    status: z.ZodEnum<{
+        active: "active";
+        revoked: "revoked";
+    }>;
+    os: z.ZodEnum<{
+        linux: "linux";
+        macos: "macos";
+        windows: "windows";
+    }>;
+    arch: z.ZodString;
+    lastSeenAt: z.ZodNullable<z.ZodString>;
+    createdAt: z.ZodString;
+    revokedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+type EnrollmentSummary = z.infer<typeof EnrollmentSummary>;
+declare const ListEnrollmentsResponse: z.ZodObject<{
+    enrollments: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        pubkey: z.ZodString;
+        exposure: z.ZodLiteral<"whole-machine">;
+        hasDisplay: z.ZodBoolean;
+        allowScreenControl: z.ZodBoolean;
+        status: z.ZodEnum<{
+            active: "active";
+            revoked: "revoked";
+        }>;
+        os: z.ZodEnum<{
+            linux: "linux";
+            macos: "macos";
+            windows: "windows";
+        }>;
+        arch: z.ZodString;
+        lastSeenAt: z.ZodNullable<z.ZodString>;
+        createdAt: z.ZodString;
+        revokedAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type ListEnrollmentsResponse = z.infer<typeof ListEnrollmentsResponse>;
+declare const RevokeEnrollmentResponse: z.ZodObject<{
+    revoked: z.ZodBoolean;
+}, z.core.$strip>;
+type RevokeEnrollmentResponse = z.infer<typeof RevokeEnrollmentResponse>;
+declare const DeviceEnrollmentLookupRequest: z.ZodObject<{
+    userCode: z.ZodString;
+}, z.core.$strip>;
+type DeviceEnrollmentLookupRequest = z.infer<typeof DeviceEnrollmentLookupRequest>;
+declare const DeviceEnrollmentLookupMachine: z.ZodObject<{
+    machineName: z.ZodNullable<z.ZodString>;
+    os: z.ZodEnum<{
+        linux: "linux";
+        macos: "macos";
+        windows: "windows";
+    }>;
+    arch: z.ZodString;
+    canOfferDisplay: z.ZodBoolean;
+    requestsScreenControl: z.ZodBoolean;
+}, z.core.$strip>;
+type DeviceEnrollmentLookupMachine = z.infer<typeof DeviceEnrollmentLookupMachine>;
+declare const DeviceEnrollmentLookupResponse: z.ZodObject<{
+    workspaceId: z.ZodString;
+    userCode: z.ZodString;
+    machine: z.ZodObject<{
+        machineName: z.ZodNullable<z.ZodString>;
+        os: z.ZodEnum<{
+            linux: "linux";
+            macos: "macos";
+            windows: "windows";
+        }>;
+        arch: z.ZodString;
+        canOfferDisplay: z.ZodBoolean;
+        requestsScreenControl: z.ZodBoolean;
+    }, z.core.$strip>;
+    expiresAt: z.ZodString;
+}, z.core.$strip>;
+type DeviceEnrollmentLookupResponse = z.infer<typeof DeviceEnrollmentLookupResponse>;
+declare const DeviceEnrollmentDenyRequest: z.ZodObject<{
+    userCode: z.ZodString;
+}, z.core.$strip>;
+type DeviceEnrollmentDenyRequest = z.infer<typeof DeviceEnrollmentDenyRequest>;
+declare const DeviceEnrollmentDenyResponse: z.ZodObject<{
+    denied: z.ZodBoolean;
+}, z.core.$strip>;
+type DeviceEnrollmentDenyResponse = z.infer<typeof DeviceEnrollmentDenyResponse>;
+declare const MintEnrollTokenRequest: z.ZodObject<{
+    allowScreenControl: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+type MintEnrollTokenRequest = z.infer<typeof MintEnrollTokenRequest>;
+declare const MintEnrollTokenResponse: z.ZodObject<{
+    token: z.ZodString;
+    expiresAt: z.ZodString;
+    expiresInSeconds: z.ZodNumber;
+}, z.core.$strip>;
+type MintEnrollTokenResponse = z.infer<typeof MintEnrollTokenResponse>;
+declare const EnrollTokenExchangeRequest: z.ZodObject<{
+    token: z.ZodString;
+    publicKey: z.ZodString;
+    os: z.ZodDefault<z.ZodEnum<{
+        linux: "linux";
+        macos: "macos";
+        windows: "windows";
+    }>>;
+    arch: z.ZodDefault<z.ZodEnum<{
+        x86_64: "x86_64";
+        aarch64: "aarch64";
+    }>>;
+    machineName: z.ZodOptional<z.ZodString>;
+    exposure: z.ZodDefault<z.ZodLiteral<"whole-machine">>;
+    canOfferDisplay: z.ZodDefault<z.ZodBoolean>;
+    requestsScreenControl: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strip>;
+type EnrollTokenExchangeRequest = z.infer<typeof EnrollTokenExchangeRequest>;
+declare const EnrollTokenExchangeResponse: z.ZodObject<{
+    credentials: z.ZodObject<{
+        agentId: z.ZodString;
+        workspaceId: z.ZodString;
+        bearer: z.ZodString;
+        subjectPrefix: z.ZodString;
+        natsUrls: z.ZodArray<z.ZodString>;
+        relayUrl: z.ZodString;
+        relayToken: z.ZodString;
+        natsAccountCreds: z.ZodString;
+        updatePublicKey: z.ZodString;
+        consentedWholeMachine: z.ZodBoolean;
+        consentedScreenControl: z.ZodBoolean;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+type EnrollTokenExchangeResponse = z.infer<typeof EnrollTokenExchangeResponse>;
+/**
+ * A point-in-time machine metrics sample as the dashboard reads it. `cpuPct` and
+ * the load averages are 0..N doubles; the byte figures are integers; `gpuUtilPct`
+ * / `gpuMemBytes` are null when no GPU was present at sample time (the wire
+ * contract: absence == not-reported, NEVER a real zero). `runQueue` is the
+ * runnable-count contention signal. `sampledAt` is an ISO-8601 instant.
+ */
+declare const MetricSample: z.ZodObject<{
+    cpuPct: z.ZodNumber;
+    load1: z.ZodNumber;
+    load5: z.ZodNumber;
+    load15: z.ZodNumber;
+    memUsedBytes: z.ZodNumber;
+    memTotalBytes: z.ZodNumber;
+    diskUsedBytes: z.ZodNumber;
+    diskTotalBytes: z.ZodNumber;
+    gpuUtilPct: z.ZodNullable<z.ZodNumber>;
+    gpuMemBytes: z.ZodNullable<z.ZodNumber>;
+    runQueue: z.ZodNumber;
+    sampledAt: z.ZodString;
+}, z.core.$strip>;
+type MetricSample = z.infer<typeof MetricSample>;
+/** The derived dashboard state of a machine. The M3 liveness
+ *  (online/reconnecting/offline) plus the enrollment-derived consent/display
+ *  reasons (consent_required / display_unavailable) and the in-flight device-flow
+ *  (enrolling). */
+declare const MachineState: z.ZodEnum<{
+    consent_required: "consent_required";
+    display_unavailable: "display_unavailable";
+    online: "online";
+    reconnecting: "reconnecting";
+    offline: "offline";
+    enrolling: "enrolling";
+}>;
+type MachineState = z.infer<typeof MachineState>;
+declare const MachineKind: z.ZodEnum<{
+    modal: "modal";
+    selfhosted: "selfhosted";
+}>;
+type MachineKind = z.infer<typeof MachineKind>;
+/**
+ * A machine as the Machines dashboard renders it. The workspace's enrolled
+ * selfhosted machines PLUS the session's synthetic Modal group box
+ * (`isSessionGroup: true`). `active` marks the session's currently-active
+ * routing target. `sharedSessionCount` is the lease refcount (how many sessions
+ * share this whole machine). `metrics` is the latest sample, or null when none
+ * has landed yet (just enrolled / offline before a first heartbeat).
+ */
+declare const MachineView: z.ZodObject<{
+    sandboxId: z.ZodString;
+    enrollmentId: z.ZodNullable<z.ZodString>;
+    name: z.ZodString;
+    kind: z.ZodEnum<{
+        modal: "modal";
+        selfhosted: "selfhosted";
+    }>;
+    state: z.ZodEnum<{
+        consent_required: "consent_required";
+        display_unavailable: "display_unavailable";
+        online: "online";
+        reconnecting: "reconnecting";
+        offline: "offline";
+        enrolling: "enrolling";
+    }>;
+    active: z.ZodBoolean;
+    isSessionGroup: z.ZodBoolean;
+    os: z.ZodString;
+    arch: z.ZodString;
+    hasDisplay: z.ZodBoolean;
+    allowScreenControl: z.ZodBoolean;
+    sharedSessionCount: z.ZodNumber;
+    lastSeenAt: z.ZodNullable<z.ZodString>;
+    metrics: z.ZodNullable<z.ZodObject<{
+        cpuPct: z.ZodNumber;
+        load1: z.ZodNumber;
+        load5: z.ZodNumber;
+        load15: z.ZodNumber;
+        memUsedBytes: z.ZodNumber;
+        memTotalBytes: z.ZodNumber;
+        diskUsedBytes: z.ZodNumber;
+        diskTotalBytes: z.ZodNumber;
+        gpuUtilPct: z.ZodNullable<z.ZodNumber>;
+        gpuMemBytes: z.ZodNullable<z.ZodNumber>;
+        runQueue: z.ZodNumber;
+        sampledAt: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type MachineView = z.infer<typeof MachineView>;
+/**
+ * GET /v1/workspaces/:ws/machines — the dashboard list. `activeSandboxId` /
+ * `activeEpoch` echo the session's epoch-fenced active-sandbox pointer (null
+ * activeSandboxId == the session's own group box is active).
+ */
+declare const MachinesResponse: z.ZodObject<{
+    activeSandboxId: z.ZodNullable<z.ZodString>;
+    activeEpoch: z.ZodNumber;
+    machines: z.ZodArray<z.ZodObject<{
+        sandboxId: z.ZodString;
+        enrollmentId: z.ZodNullable<z.ZodString>;
+        name: z.ZodString;
+        kind: z.ZodEnum<{
+            modal: "modal";
+            selfhosted: "selfhosted";
+        }>;
+        state: z.ZodEnum<{
+            consent_required: "consent_required";
+            display_unavailable: "display_unavailable";
+            online: "online";
+            reconnecting: "reconnecting";
+            offline: "offline";
+            enrolling: "enrolling";
+        }>;
+        active: z.ZodBoolean;
+        isSessionGroup: z.ZodBoolean;
+        os: z.ZodString;
+        arch: z.ZodString;
+        hasDisplay: z.ZodBoolean;
+        allowScreenControl: z.ZodBoolean;
+        sharedSessionCount: z.ZodNumber;
+        lastSeenAt: z.ZodNullable<z.ZodString>;
+        metrics: z.ZodNullable<z.ZodObject<{
+            cpuPct: z.ZodNumber;
+            load1: z.ZodNumber;
+            load5: z.ZodNumber;
+            load15: z.ZodNumber;
+            memUsedBytes: z.ZodNumber;
+            memTotalBytes: z.ZodNumber;
+            diskUsedBytes: z.ZodNumber;
+            diskTotalBytes: z.ZodNumber;
+            gpuUtilPct: z.ZodNullable<z.ZodNumber>;
+            gpuMemBytes: z.ZodNullable<z.ZodNumber>;
+            runQueue: z.ZodNumber;
+            sampledAt: z.ZodString;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type MachinesResponse = z.infer<typeof MachinesResponse>;
+/**
+ * POST /v1/workspaces/:ws/sessions/:sessionId/active-sandbox — the user-
+ * authenticated swap of a session's active sandbox (the same epoch-fenced
+ * mechanic the M7 `sandbox_swap` MCP tool exposes to the agent). `target` is a
+ * `MachinesResponse` machine's `sandboxId`, or "session"/"default" to swap back
+ * to the session's own group box.
+ */
+declare const SwapActiveSandboxRequest: z.ZodObject<{
+    target: z.ZodString;
+}, z.core.$strip>;
+type SwapActiveSandboxRequest = z.infer<typeof SwapActiveSandboxRequest>;
+/**
+ * The swap outcome (mirrors the server `FleetSwapResult`). `swapped` is true on a
+ * successful repoint OR a no-op (already pointed there); `reason` carries the
+ * failure detail (unowned/offline target, or a lost epoch fence) when false.
+ */
+declare const SwapActiveSandboxResponse: z.ZodObject<{
+    swapped: z.ZodBoolean;
+    activeSandboxId: z.ZodNullable<z.ZodString>;
+    activeEpoch: z.ZodNumber;
+    reason: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+type SwapActiveSandboxResponse = z.infer<typeof SwapActiveSandboxResponse>;
+/**
+ * GET /v1/workspaces/:ws/machines/:enrollmentId/metrics/series?window=1h — the
+ * downsampled (~1/min) history the dashboard time-range reads.
+ */
+declare const MachineMetricsSeriesResponse: z.ZodObject<{
+    samples: z.ZodArray<z.ZodObject<{
+        cpuPct: z.ZodNumber;
+        load1: z.ZodNumber;
+        load5: z.ZodNumber;
+        load15: z.ZodNumber;
+        memUsedBytes: z.ZodNumber;
+        memTotalBytes: z.ZodNumber;
+        diskUsedBytes: z.ZodNumber;
+        diskTotalBytes: z.ZodNumber;
+        gpuUtilPct: z.ZodNullable<z.ZodNumber>;
+        gpuMemBytes: z.ZodNullable<z.ZodNumber>;
+        runQueue: z.ZodNumber;
+        sampledAt: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type MachineMetricsSeriesResponse = z.infer<typeof MachineMetricsSeriesResponse>;
 /**
  * A single host-exposed model + the provider that serves it, as surfaced to
  * clients (SDK + React composer) by GET /v1/config/client. The wire `api`
@@ -3887,4 +4563,4 @@ type HealthResponse = {
     ok: boolean;
 };
 
-export { AccessContext, AccessGrant, AccountGrant, AccountRole, AcknowledgeStreamRequest, AcknowledgeStreamResponse, AddDocumentRequest, AddWorkspaceMemberRequest, ApiKey, AttachViewerRequest, BillingBalance, BillingMode, CAPABILITY_DESCRIPTORS, CLEARED_RUN_STATE_BLOB, CLEARED_RUN_STATE_MARKER, CapabilityCatalogItem, CapabilityCatalogResponse, type CapabilityDescriptor, CapabilityInstallation, CapabilityInstallationStatus, CapabilityKind, CapabilityPack, CapabilityPackConnector, CapabilityPackConnectorAuthModel, CapabilityPackKnowledge, CapabilityPackScheduledTaskTemplate, CapabilityPackSkill, CapabilityPackSkillFile, CapabilityRuntime, CapabilitySource, CapabilityUnavailableReason, ClearSessionContextRequest, ClientAuthConfig, ClientConfig, ClientModel, ClientSessionEvent, CompactSessionContextRequest, CompactSessionContextResult, CompleteFileUploadResponse, CreateApiKeyRequest, CreateApiKeyResponse, CreateCapabilityCatalogItemRequest, CreateCheckoutRequest, CreateCheckoutResponse, CreateDocumentBaseRequest, CreateFileUploadRequest, CreateFileUploadResponse, CreateScheduledTaskRequest, CreateSessionRequest, CreateSocialConnectionRequest, CreateSocialPostRequest, CreateWorkspaceEnvironmentRequest, CreateWorkspaceRequest, DESKTOP_STREAM_PORT, DelegatedAccessTokenPayload, DiscoverMcpCapabilitiesResponse, Document, DocumentBase, DocumentSearchRequest, DocumentSearchResult, DocumentStatus, EnableCapabilityRequest, EnablePackRequest, EntitlementValue, Entitlements, EntitlementsMode, ErrorCode, ErrorEnvelope, FileAsset, FileDownloadUrlResponse, FileResourceRef, FileStatus, FileUploadStatus, FsChangeKind, FsChangedPayload, FsDeleteRequest, FsDeleteResponse, FsEncoding, FsListRequest, FsListResponse, FsMkdirRequest, FsMkdirResponse, FsMoveRequest, FsMoveResponse, FsNodeType, FsReadRequest, FsReadResponse, FsTreeNode, FsWriteRequest, FsWriteResponse, GitChangedPayload, GitCommit, GitDiffHunk, GitDiffLine, GitDiffLineType, GitDiffRequest, GitDiffResponse, GitFileDiff, GitFileStatus, GitFileStatusCode, GitHubAppManifestCreate, GitHubRepository, GitLogRequest, GitLogResponse, GitShowRequest, GitShowResponse, GitStatusRequest, GitStatusResponse, GoalSpec, type HealthResponse, LimitAction, LimitDecision, ListWorkspaceMembersResponse, ManagedAccount, MarketingDailyAnalysisTaskRequest, PackInstallation, PackInstallationStatus, PageInfo, Permission, type PortExposureKind, ProductAccessMode, PtyCloseRequest, PtyOpenRequest, PtyOpenResponse, PtyResizeRequest, PtyWriteRequest, ReasoningEffort, RecordingAvailablePayload, RecordingCodec, RecordingContentType, RecordingFailedPayload, RecordingFailedReason, RecordingMode, RecordingStartedPayload, RegisterCapabilityPackRequest, ReorderSessionTurnsRequest, RepositoryResourceRef, ResourceRef, ResourceRefConflictError, SandboxBackend, SandboxCapabilityName, SandboxCommandOutputDeltaPayload, SandboxOs, ScheduledTask, ScheduledTaskAgentConfig, ScheduledTaskOverlapPolicy, ScheduledTaskRun, ScheduledTaskRunMode, ScheduledTaskRunStatus, ScheduledTaskScheduleSpec, ScheduledTaskStatus, ScheduledTaskTriggerType, Session, SessionBusMessage, SessionCapabilities, SessionEvent, SessionEventType, SessionGoal, SessionGoalCreatedBy, SessionGoalPausedReason, SessionGoalStatus, SessionStatus, SessionStructuredCapabilities, SessionTurn, SessionTurnSource, SessionTurnStatus, SetWorkspaceEnvironmentVariableRequest, SocialConnection, SocialConnectionStatus, SocialPost, SocialProvider, StaticUsageLimits, StreamClosedPayload, StreamOpenedPayload, StreamRevokedPayload, StreamTokenPayload, StreamUrlRotatedPayload, TERMINAL_STREAM_PORT, TerminalExecRequest, TerminalExecResponse, TerminalPtyExitedPayload, TerminalPtyOutputDeltaPayload, TerminalPtyStartedPayload, ToolRef, TriggerScheduledTaskRequest, UpdateScheduledTaskRequest, UpdateSessionGoalRequest, UpdateSessionRequest, UpdateSessionTurnRequest, UpdateWorkspaceEnvironmentRequest, UpdateWorkspaceMemberRequest, UpdateWorkspaceRequest, UsageEvent, UsageEventType, UsageLimitsMode, ViewerHeartbeatRequest, ViewerHeartbeatResponse, ViewerHolder, Workspace, WorkspaceEnvironment, WorkspaceEnvironmentVariableMetadata, WorkspaceEnvironmentVariableName, WorkspaceMember, WorkspaceRegisteredPack, isClearedRunStateBlob, mergeResourceRefs, mergeToolRefs, paginated, reasoningEffortForMetadata, resourceIdentityKey, signDelegatedAccessToken, signStreamToken, stableJson, verifyDelegatedAccessToken, verifyStreamToken };
+export { AccessContext, AccessGrant, AccountGrant, AccountRole, AcknowledgeStreamRequest, AcknowledgeStreamResponse, AddDocumentRequest, AddWorkspaceMemberRequest, type AdmitRunInput, ApiKey, AttachViewerRequest, BillingBalance, BillingMode, CAPABILITY_DESCRIPTORS, CLEARED_RUN_STATE_BLOB, CLEARED_RUN_STATE_MARKER, CapabilityCatalogItem, CapabilityCatalogResponse, type CapabilityDescriptor, CapabilityInstallation, CapabilityInstallationStatus, CapabilityKind, CapabilityPack, CapabilityPackConnector, CapabilityPackConnectorAuthModel, CapabilityPackKnowledge, CapabilityPackScheduledTaskTemplate, CapabilityPackSkill, CapabilityPackSkillFile, CapabilityRuntime, CapabilitySource, CapabilityUnavailableReason, ClearSessionContextRequest, ClientAuthConfig, ClientConfig, ClientModel, ClientSessionEvent, CompactSessionContextRequest, CompactSessionContextResult, CompleteFileUploadResponse, type ConnectionCredentialsPort, CreateApiKeyRequest, CreateApiKeyResponse, CreateCapabilityCatalogItemRequest, CreateCheckoutRequest, CreateCheckoutResponse, CreateDocumentBaseRequest, CreateFileUploadRequest, CreateFileUploadResponse, CreateScheduledTaskRequest, CreateSessionRequest, CreateSocialConnectionRequest, CreateSocialPostRequest, CreateWorkspaceEnvironmentRequest, CreateWorkspaceRequest, DESKTOP_STREAM_PORT, DelegatedAccessTokenPayload, DeviceEnrollmentApproveRequest, DeviceEnrollmentApproveResponse, DeviceEnrollmentDenyRequest, DeviceEnrollmentDenyResponse, DeviceEnrollmentLookupMachine, DeviceEnrollmentLookupRequest, DeviceEnrollmentLookupResponse, DeviceEnrollmentPollRequest, DeviceEnrollmentPollResponse, DeviceEnrollmentStartRequest, DeviceEnrollmentStartResponse, DeviceEnrollmentState, DiscoverMcpCapabilitiesResponse, Document, DocumentBase, DocumentSearchRequest, DocumentSearchResult, DocumentStatus, EnableCapabilityRequest, EnablePackRequest, EnrollTokenExchangeRequest, EnrollTokenExchangeResponse, EnrollTokenPayload, EnrollmentArch, EnrollmentBearerPayload, EnrollmentCredentialsResponse, EnrollmentOs, EnrollmentSummary, EntitlementDecision, EntitlementValue, Entitlements, EntitlementsMode, type EntitlementsPort, ErrorCode, ErrorEnvelope, FileAsset, FileDownloadUrlResponse, FileResourceRef, FileStatus, FileUploadStatus, FsChangeKind, FsChangedPayload, FsDeleteRequest, FsDeleteResponse, FsEncoding, FsListRequest, FsListResponse, FsMkdirRequest, FsMkdirResponse, FsMoveRequest, FsMoveResponse, FsNodeType, FsReadRequest, FsReadResponse, FsTreeNode, FsWriteRequest, FsWriteResponse, GitChangedPayload, GitCommit, type GitCredentials, type GitCredentialsRequest, GitDiffHunk, GitDiffLine, GitDiffLineType, GitDiffRequest, GitDiffResponse, GitFileDiff, GitFileStatus, GitFileStatusCode, type GitHubAppApiPort, GitHubAppManifestCreate, type GitHubInstallationSummary, GitHubRepository, GitLogRequest, GitLogResponse, GitShowRequest, GitShowResponse, GitStatusRequest, GitStatusResponse, GoalSpec, type HealthResponse, LimitAction, LimitDecision, ListEnrollmentsResponse, ListWorkspaceMembersResponse, MachineKind, MachineMetricsSeriesResponse, MachineState, MachineView, MachinesResponse, ManagedAccount, MarketingDailyAnalysisTaskRequest, MetricSample, MintEnrollTokenRequest, MintEnrollTokenResponse, PackInstallation, PackInstallationStatus, PageInfo, Permission, type PortExposureKind, ProductAccessMode, PtyCloseRequest, PtyOpenRequest, PtyOpenResponse, PtyResizeRequest, PtyWriteRequest, ReasoningEffort, RecordingAvailablePayload, RecordingCodec, RecordingContentType, RecordingFailedPayload, RecordingFailedReason, RecordingMode, RecordingStartedPayload, RegisterCapabilityPackRequest, RelayTokenPayload, ReorderSessionTurnsRequest, RepositoryResourceRef, ResourceRef, ResourceRefConflictError, RevokeEnrollmentResponse, SandboxBackend, SandboxCapabilityName, SandboxCommandOutputDeltaPayload, SandboxOs, type SandboxSecrets, type SandboxSecretsRequest, ScheduledTask, ScheduledTaskAgentConfig, ScheduledTaskOverlapPolicy, ScheduledTaskRun, ScheduledTaskRunMode, ScheduledTaskRunStatus, ScheduledTaskScheduleSpec, ScheduledTaskStatus, ScheduledTaskTriggerType, Session, SessionBusMessage, SessionCapabilities, SessionEvent, SessionEventType, SessionGoal, SessionGoalCreatedBy, SessionGoalPausedReason, SessionGoalStatus, SessionMcpCredentialUpdateInput, SessionMcpServerInput, SessionMcpServerMetadata, SessionStatus, SessionStructuredCapabilities, SessionTurn, SessionTurnSource, SessionTurnStatus, SetWorkspaceEnvironmentVariableRequest, SocialConnection, SocialConnectionStatus, SocialPost, SocialProvider, StaticUsageLimits, StreamClosedPayload, StreamOpenedPayload, StreamRevokedPayload, StreamTokenPayload, StreamUrlRotatedPayload, SwapActiveSandboxRequest, SwapActiveSandboxResponse, TERMINAL_STREAM_PORT, TerminalExecRequest, TerminalExecResponse, TerminalPtyExitedPayload, TerminalPtyOutputDeltaPayload, TerminalPtyStartedPayload, ToolRef, TriggerScheduledTaskRequest, UpdateScheduledTaskRequest, UpdateSessionGoalRequest, UpdateSessionRequest, UpdateSessionTurnRequest, UpdateWorkspaceEnvironmentRequest, UpdateWorkspaceMemberRequest, UpdateWorkspaceRequest, UsageEvent, UsageEventType, UsageLimitsMode, ViewerHeartbeatRequest, ViewerHeartbeatResponse, ViewerHolder, Workspace, WorkspaceEnvironment, WorkspaceEnvironmentVariableMetadata, WorkspaceEnvironmentVariableName, WorkspaceMember, WorkspaceRegisteredPack, isClearedRunStateBlob, mergeResourceRefs, mergeToolRefs, paginated, reasoningEffortForMetadata, resourceIdentityKey, signDelegatedAccessToken, signEnrollToken, signEnrollmentBearer, signRelayToken, signStreamToken, stableJson, verifyDelegatedAccessToken, verifyEnrollToken, verifyEnrollmentBearer, verifyRelayToken, verifyStreamToken };