@opengeni/contracts 0.3.0 → 0.5.0

package/dist/index.js

@@ -18,7 +18,8 @@ var SandboxBackend = z.enum([
   "e2b",
   "blaxel",
   "cloudflare",
-  "vercel"
+  "vercel",
+  "selfhosted"
 ]);
 var SandboxOs = z.enum(["linux", "macos", "windows"]);
 var SandboxCapabilityName = z.enum([
@@ -295,6 +296,58 @@ var CAPABILITY_DESCRIPTORS = {
     nativeBucketMount: false,
     persistable: false,
     supportsRunAs: false
+  },
+  // Bring-your-own-compute: the user's OWN machine, enrolled via a Rust agent,
+  // becomes ONE shared whole-machine sandbox (the agent IS the box). It is the
+  // first backend to make macOS/Windows reachable (default linux). Desktop is
+  // capability-PROCLAIMED ("vnc-ws") — the agent serves a native display stack
+  // (Linux X11/Xvfb, macOS CGEvent/ScreenCaptureKit) consent-gated at enroll;
+  // the online/offline/consent/display negotiation lives in select.ts (M3), this
+  // row is the static feasibility ceiling. Always-on (process-lifetime, never
+  // idle-reaped) and NOT persistable — OpenGeni cannot snapshot the user's disk,
+  // so resume = "is the agent's subject live?", never a cold re-create. Ports
+  // surface on-demand through the stateless relay edge, which lands behind the
+  // `resolveExposedPort` swap-seam later; until then it reuses the existing
+  // `provider-tunnel` exposure kind (the relay IS the provider tunnel for the
+  // agent) so no new PortExposureKind literal — and no new switch arms — are
+  // introduced. supportsOnDemandPorts:true: the agent opens a stream channel for
+  // a port on request rather than pre-declaring 6080/7681 at construction.
+  selfhosted: {
+    backend: "selfhosted",
+    backendId: "selfhosted",
+    tier: "desktop",
+    os: { supported: ["linux", "macos", "windows"], default: "linux" },
+    capabilities: {
+      FileSystem: { available: true, readOnly: false },
+      Terminal: { available: true, transport: "pty-ws", pty: true },
+      // real PTY over the relay
+      Git: { available: true },
+      DesktopStream: { available: true, transport: "vnc-ws" },
+      // proclaimed; consent-gated at enroll
+      Recording: { available: true }
+      // boot invariant: == DesktopStream.available
+    },
+    lifetime: {
+      // Whole-machine, always-there: online while the agent process runs, offline
+      // when it stops. The lease is NEVER idle-killed (it's the user's machine,
+      // not a reapable cloud box) and there is nothing to suspend/resume — the
+      // machine simply is or isn't reachable.
+      requiresSnapshotRollover: false,
+      hasIdleKiller: false,
+      supportsSuspendResume: false,
+      resumeIsLockFree: true
+      // resume = address the live NATS subject; no provider lock
+    },
+    // persistable:false forces snapshot.kind:"none" (the descriptor invariant
+    // `persistable ⇒ snapshot.kind!=="none"`): OpenGeni cannot snapshot the
+    // user's disk — the machine itself is the persistence.
+    snapshot: { kind: "none", hasTarFallback: false },
+    portExposure: { kind: "provider-tunnel", supportsOnDemandPorts: true },
+    workspaceRoot: "/",
+    // agent-reported machine root (the whole machine is the sandbox)
+    nativeBucketMount: false,
+    persistable: false,
+    supportsRunAs: false
   }
 };
 var ReasoningEffort = z.enum(["none", "minimal", "low", "medium", "high", "xhigh"]);
@@ -372,7 +425,18 @@ var Permission = z.enum([
   "api_keys:manage",
   "environments:manage",
   "environments:use",
-  "goals:manage"
+  // Attach or rotate per-session third-party MCP server credentials. Deliberately
+  // not part of the worker's default first-party MCP permission set: a sandboxed
+  // agent must not be able to hand itself new bearer credentials.
+  "mcp_servers:attach",
+  "goals:manage",
+  // Bring-your-own-compute (M5). enrollments:read lists a workspace's machines;
+  // enrollments:manage approves a device-flow enrollment (the LOUD whole-machine
+  // consent) + revokes a machine. Distinct from sessions/stream perms because an
+  // enrollment grants WHOLE-MACHINE access to a user's own hardware — a high-trust,
+  // admin-shaped action. workspace:admin is the super-wildcard over both.
+  "enrollments:read",
+  "enrollments:manage"
 ]);
 var ProductAccessMode = z.enum(["local", "configured", "managed"]);
 var BillingMode = z.enum(["disabled", "stripe"]);
@@ -465,6 +529,84 @@ async function verifyDelegatedAccessToken(secret, token, nowSeconds = Math.floor
   }
   return payload.data;
 }
+var EnrollmentBearerPayload = z.object({
+  workspaceId: z.string().uuid(),
+  agentId: z.string().uuid(),
+  enrollmentId: z.string().uuid(),
+  // The Account-scoped control-plane subject prefix the agent subscribes to.
+  subjectPrefix: z.string().min(1),
+  exp: z.number().int().positive()
+});
+async function signEnrollmentBearer(secret, payload) {
+  const encodedPayload = base64UrlEncode(JSON.stringify(EnrollmentBearerPayload.parse(payload)));
+  const signature = await hmacSha256Base64Url(secret, encodedPayload);
+  return `oge_${encodedPayload}.${signature}`;
+}
+async function verifyEnrollmentBearer(secret, token, nowSeconds = Math.floor(Date.now() / 1e3)) {
+  if (!token.startsWith("oge_")) {
+    return null;
+  }
+  const withoutPrefix = token.slice("oge_".length);
+  const dot = withoutPrefix.lastIndexOf(".");
+  if (dot <= 0) {
+    return null;
+  }
+  const encodedPayload = withoutPrefix.slice(0, dot);
+  const signature = withoutPrefix.slice(dot + 1);
+  const expected = await hmacSha256Base64Url(secret, encodedPayload);
+  if (!constantTimeEqual(signature, expected)) {
+    return null;
+  }
+  const payload = EnrollmentBearerPayload.safeParse(JSON.parse(base64UrlDecode(encodedPayload)));
+  if (!payload.success || payload.data.exp < nowSeconds) {
+    return null;
+  }
+  return payload.data;
+}
+var EnrollTokenPayload = z.object({
+  // Domain-separation claim — fixed "enroll" so an `oge_`/`ogd_`/`ogs_` payload (no
+  // typ, or a different typ) can never satisfy verifyEnrollToken even past the prefix.
+  typ: z.literal("enroll"),
+  workspaceId: z.string().uuid(),
+  accountId: z.string().uuid(),
+  // The screen-control consent baked into the token at mint (the minting user's
+  // decision); the exchange records it as consentedScreenControl on the enrollment.
+  allowScreenControl: z.boolean(),
+  iat: z.number().int().nonnegative(),
+  exp: z.number().int().positive()
+});
+async function signEnrollToken(secret, payload) {
+  const encodedPayload = base64UrlEncode(JSON.stringify(EnrollTokenPayload.parse(payload)));
+  const signature = await hmacSha256Base64Url(secret, encodedPayload);
+  return `oget_${encodedPayload}.${signature}`;
+}
+async function verifyEnrollToken(secret, token, nowSeconds = Math.floor(Date.now() / 1e3)) {
+  if (!token.startsWith("oget_")) {
+    return null;
+  }
+  const withoutPrefix = token.slice("oget_".length);
+  const dot = withoutPrefix.lastIndexOf(".");
+  if (dot <= 0) {
+    return null;
+  }
+  const encodedPayload = withoutPrefix.slice(0, dot);
+  const signature = withoutPrefix.slice(dot + 1);
+  const expected = await hmacSha256Base64Url(secret, encodedPayload);
+  if (!constantTimeEqual(signature, expected)) {
+    return null;
+  }
+  let decoded;
+  try {
+    decoded = JSON.parse(base64UrlDecode(encodedPayload));
+  } catch {
+    return null;
+  }
+  const payload = EnrollTokenPayload.safeParse(decoded);
+  if (!payload.success || payload.data.exp < nowSeconds) {
+    return null;
+  }
+  return payload.data;
+}
 var StreamTokenPayload = z.object({
   workspaceId: z.string().uuid(),
   sessionId: z.string().uuid(),
@@ -512,6 +654,47 @@ async function verifyStreamToken(secret, token, nowSeconds = Math.floor(Date.now
   }
   return payload.data;
 }
+var RelayTokenPayload = z.object({
+  // The workspace the agent (and its channels) belong to — the relay asserts this
+  // equals the channel-key's ws so a producer can only register its own channels.
+  workspaceId: z.string().uuid(),
+  // The agent (machine) id — the relay asserts this equals the channel-key's agent.
+  agentId: z.string().uuid(),
+  // Expiry (unix seconds). Enrollment-scoped horizon (re-minted on re-enroll).
+  exp: z.number().int().positive()
+});
+async function signRelayToken(secret, payload) {
+  const encodedPayload = base64UrlEncode(JSON.stringify(RelayTokenPayload.parse(payload)));
+  const signature = await hmacSha256Base64Url(secret, encodedPayload);
+  return `ogr_${encodedPayload}.${signature}`;
+}
+async function verifyRelayToken(secret, token, nowSeconds = Math.floor(Date.now() / 1e3)) {
+  if (!token.startsWith("ogr_")) {
+    return null;
+  }
+  const withoutPrefix = token.slice("ogr_".length);
+  const dot = withoutPrefix.lastIndexOf(".");
+  if (dot <= 0) {
+    return null;
+  }
+  const encodedPayload = withoutPrefix.slice(0, dot);
+  const signature = withoutPrefix.slice(dot + 1);
+  const expected = await hmacSha256Base64Url(secret, encodedPayload);
+  if (!constantTimeEqual(signature, expected)) {
+    return null;
+  }
+  let decoded;
+  try {
+    decoded = JSON.parse(base64UrlDecode(encodedPayload));
+  } catch {
+    return null;
+  }
+  const payload = RelayTokenPayload.safeParse(decoded);
+  if (!payload.success || payload.data.exp < nowSeconds) {
+    return null;
+  }
+  return payload.data;
+}
 var CreateWorkspaceRequest = z.object({
   accountId: z.string().uuid().optional(),
   name: z.string().min(1),
@@ -634,6 +817,10 @@ var LimitDecision = z.discriminatedUnion("allowed", [
   z.object({ allowed: z.literal(true) }),
   z.object({ allowed: z.literal(false), code: z.string(), message: z.string() })
 ]);
+var EntitlementDecision = z.discriminatedUnion("allowed", [
+  z.object({ allowed: z.literal(true), quantity: z.number().optional() }),
+  z.object({ allowed: z.literal(false), reason: z.string(), code: z.string().optional(), quantity: z.number().optional() })
+]);
 var BillingBalance = z.object({
   accountId: z.string().uuid(),
   balanceMicros: z.number().int(),
@@ -752,8 +939,45 @@ var DocumentSearchRequest = z.object({
 });
 var ToolRef = z.object({
   kind: z.literal("mcp"),
-  id: z.string().min(1)
-});
+  id: z.string().min(1),
+  // Non-fatal-on-connect marker for MCP server refs that can degrade
+  // gracefully. Absent/false is STRICT: the id must be configured and an
+  // unavailable server fails the turn. `optional:true` is preserved for known
+  // servers and makes runtime connect/list failures skip that server; if the
+  // deployment does not configure the id, validation drops the ref. The server
+  // also sets this for auto-attached workspace-default capability MCPs.
+  optional: z.boolean().optional()
+});
+var registryId = /^[A-Za-z0-9_-]+$/;
+var httpsUrl = z.string().url().refine((value) => {
+  try {
+    return new URL(value).protocol === "https:";
+  } catch {
+    return false;
+  }
+}, { message: "URL must use https" });
+var SessionMcpServerInput = z.object({
+  id: z.string().min(1).regex(registryId),
+  name: z.string().min(1).optional(),
+  url: httpsUrl,
+  allowedTools: z.array(z.string().min(1)).optional(),
+  timeoutMs: z.number().int().positive().optional(),
+  cacheToolsList: z.boolean().optional(),
+  // Write-only credential headers. Values are encrypted at rest and never
+  // returned in session responses or events; response metadata exposes names.
+  headers: z.record(z.string(), z.string()).optional()
+});
+var SessionMcpCredentialUpdateInput = z.object({
+  id: z.string().min(1).regex(registryId),
+  headers: z.record(z.string(), z.string())
+});
+var SessionMcpServerMetadata = z.object({
+  id: z.string().min(1).regex(registryId),
+  name: z.string().min(1).nullable(),
+  url: httpsUrl,
+  headerNames: z.array(z.string()).default([]),
+  credentialVersion: z.number().int().positive()
+}).strict();
 var ResourceRefConflictError = class extends Error {
   constructor(message) {
     super(message);
@@ -761,17 +985,22 @@ var ResourceRefConflictError = class extends Error {
   }
 };
 function mergeToolRefs(existing, additions) {
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
+  const byKey = /* @__PURE__ */ new Map();
+  const order = [];
   for (const tool of [...existing, ...additions]) {
     const key = `${tool.kind}:${tool.id}`;
-    if (seen.has(key)) {
+    const prior = byKey.get(key);
+    if (!prior) {
+      byKey.set(key, tool);
+      order.push(key);
       continue;
     }
-    seen.add(key);
-    out.push(tool);
+    if (prior.optional === true && tool.optional !== true) {
+      const { optional: _dropped, ...strict } = prior;
+      byKey.set(key, strict);
+    }
   }
-  return out;
+  return order.map((key) => byKey.get(key));
 }
 function mergeResourceRefs(existing, additions, options = {}) {
   const out = [...existing];
@@ -1346,10 +1575,20 @@ var Session = z.object({
   // own id for a singleton group (today's 1:1 default); equals the parent's
   // group when spawned shared (both sessions run in ONE box).
   sandboxGroupId: z.string().uuid(),
+  // The first-class swappable-sandbox POINTER (bring-your-own-compute M2). NULL
+  // resolves to the session's own group sandbox (the backward-compat default);
+  // a swap sets it to the target sandbox row. active_epoch is the second epoch
+  // ABOVE the lease epoch, bumped on every swap so the routing proxy can fence a
+  // stale in-flight op and retry against the new active sandbox.
+  activeSandboxId: z.string().uuid().nullable(),
+  activeEpoch: z.number().int().nonnegative(),
   environmentId: z.string().uuid().nullable(),
   // Non-default first-party MCP token permissions (manager-style sessions);
   // null means the fixed worker default set.
   firstPartyMcpPermissions: z.array(Permission).nullable(),
+  // Per-session third-party MCP servers, metadata only. Credential values are
+  // write-only and never appear here.
+  mcpServers: z.array(SessionMcpServerMetadata).default([]),
   // The manager session that spawned this one via session_create (set only
   // when the creating grant carried a worker-signed sessionId claim); null for
   // direct API creates and scheduled-task runs. When set, this session's
@@ -1366,6 +1605,12 @@ var Session = z.object({
   // signal. Null until a turn with usage has completed.
   lastInputTokens: z.number().int().nonnegative().nullable(),
   lastSequence: z.number().int().nonnegative(),
+  // Multi-account Codex (P1). codexPinnedCredentialId: the account this session is
+  // manually PINNED to (null ⇒ follow the workspace active pointer).
+  // codexLastCredentialId: the account the most recent turn actually ran on (the
+  // "Running on:" indicator's source). Both are credential-row ids, null until set.
+  codexPinnedCredentialId: z.string().uuid().nullable(),
+  codexLastCredentialId: z.string().uuid().nullable(),
   createdAt: z.string(),
   updatedAt: z.string()
 });
@@ -1441,7 +1686,11 @@ var SessionEventType = z.enum([
   // PTY stdout/stderr bytes (separate from command.output)
   "terminal.pty.exited",
   // PTY session ended (exitCode/reason)
-  "session.title_set"
+  "session.title_set",
+  // Multi-account Codex (P1): the account a session's turn runs on changed
+  // (manual switch in P1; failover/rotation in P3 reuse the same event). Drives
+  // the in-session "Running on:" indicator's live flip.
+  "codex.account.switched"
 ]);
 var StreamUrlRotatedPayload = z.object({
   url: z.string().url(),
@@ -1847,6 +2096,17 @@ var CreateSessionRequest = z.object({
   model: z.string().min(1).optional(),
   reasoningEffort: ReasoningEffort.optional(),
   sandboxBackend: SandboxBackend.optional(),
+  // The enrolled machine (a sandbox id) to run this session on; seeds the
+  // active-sandbox pointer at creation so the FIRST turn routes to the chosen
+  // machine (race-free: the pointer is committed before the worker turn
+  // workflow can read it). An invalid/unowned/offline target fails the create.
+  targetSandboxId: z.string().uuid().optional(),
+  // The working directory the targeted machine runs the session under — the
+  // path/cwd base for its agent exec, terminal, and file dock. Free-form pass-
+  // through: a launch-workspace_root-relative subdir or an absolute machine path
+  // (the agent's resolve_cwd handles both). Only valid WITH targetSandboxId
+  // (workingDir alone is a 422); omitted ⇒ the machine's default workspace_root.
+  workingDir: z.string().min(1).optional(),
   // Workspace environment attachment is fixed at session creation; follow-up
   // user.message events cannot switch or add one.
   environmentId: z.string().uuid().optional(),
@@ -1864,6 +2124,9 @@ var CreateSessionRequest = z.object({
   // the orchestration/environment/github tools. Capped at creation: every
   // requested permission must be held by the creating grant (no escalation).
   firstPartyMcpPermissions: z.array(Permission).optional(),
+  // Third-party MCP servers attached only to this session. Credential headers are
+  // write-only: create responses and events expose only SessionMcpServerMetadata.
+  mcpServers: z.array(SessionMcpServerInput).default([]),
   // Shared-sandbox placement (addendum 05 §D.1). Three-way union; OMITTED ⇒
   // today's behavior (a context-dependent default resolved server-side: from
   // inside a session → "shared" with the creator's box, top-level → "new").
@@ -1876,6 +2139,11 @@ var CreateSessionRequest = z.object({
   // A shared spawn inherits the box's (backend, os) — it is literally the same
   // box; the child cannot pick its own backend. Cross-workspace sharing is
   // forbidden by construction (the parent/group reads are RLS-workspace-scoped).
+  // ENV-AWARE: the box's environment is fixed at creation, so a share requires
+  // the SAME environmentId as the creator's box. On a mismatch the inherited
+  // default silently falls back to an own box; an explicit "shared"/{groupId}
+  // request 422s at create (instead of the first turn dying on the SDK's
+  // manifest-env guard).
   sandbox: z.union([
     z.literal("shared"),
     z.literal("new"),
@@ -1891,7 +2159,10 @@ var ClientSessionEvent = z.discriminatedUnion("type", [
       resources: z.array(ResourceRef).default([]),
       tools: z.array(ToolRef).default([]),
       model: z.string().min(1).optional(),
-      reasoningEffort: ReasoningEffort.optional()
+      reasoningEffort: ReasoningEffort.optional(),
+      // Header-value rotation only. URL/name/tool settings are immutable after
+      // session create; persisted events expose metadata, never header values.
+      mcpCredentialUpdates: z.array(SessionMcpCredentialUpdateInput).optional()
     })
   }),
   z.object({
@@ -1956,7 +2227,17 @@ var CapabilityUnavailableReason = z.enum([
   "not_provisioned",
   "disabled_by_policy",
   "lease_cold",
-  "tier_headless"
+  "tier_headless",
+  // Selfhosted (bring-your-own-compute) negotiation states (M1 additive; the
+  // selfhosted negotiation in select.ts wires them in M3):
+  "agent_offline",
+  // the enrolled agent process is not running / unreachable
+  "agent_reconnecting",
+  // a transient blip — the agent is reconnecting (warmable)
+  "consent_required",
+  // whole-machine / screen-control consent not yet acknowledged
+  "display_unavailable"
+  // headless machine with no display stack (no DesktopStream)
 ]);
 var SessionCapabilities = z.object({
   sessionId: z.string().uuid(),
@@ -1995,8 +2276,11 @@ var SessionCapabilities = z.object({
     reason: CapabilityUnavailableReason.nullable()
   }),
   DesktopStream: z.object({
-    transport: z.enum(["vnc-ws", "rdp-ws", "webrtc"]).nullable(),
-    client: z.enum(["novnc", "web-rdp"]).nullable(),
+    // "relay-frames" is the selfhosted framebuffer stream: PNG-per-frame protobuf
+    // datagrams spliced over the relay (NOT RFB). The viewer renders it with the
+    // "frames" client (a canvas painter), distinct from Modal's "vnc-ws"/"novnc".
+    transport: z.enum(["vnc-ws", "rdp-ws", "webrtc", "relay-frames"]).nullable(),
+    client: z.enum(["novnc", "web-rdp", "frames"]).nullable(),
     mode: z.enum(["read-only", "interactive"]).default("read-only"),
     url: z.string().url().nullable(),
     token: z.string().nullable(),
@@ -2070,6 +2354,209 @@ var ViewerHeartbeatResponse = z.object({
   // false ⇒ the holder was reaped or the epoch is stale; the client re-attaches.
   alive: z.boolean()
 });
+var EnrollmentOs = z.enum(["linux", "macos", "windows"]);
+var EnrollmentArch = z.enum(["x86_64", "aarch64"]);
+var DeviceEnrollmentStartRequest = z.object({
+  // The agent's ed25519 public key (the machine identity the enrollment binds to).
+  publicKey: z.string().min(1).max(1024),
+  os: EnrollmentOs.default("linux"),
+  arch: EnrollmentArch.default("x86_64"),
+  // Human-friendly machine name (hostname by default).
+  machineName: z.string().min(1).max(256).optional(),
+  // v1 only supports whole-machine; kept explicit so the consent is recorded.
+  exposure: z.literal("whole-machine").default("whole-machine"),
+  // The agent can offer a display (a real screen / Xvfb is available).
+  canOfferDisplay: z.boolean().default(false),
+  // The agent requests screen control (computer-use); the user's allow_screen_control
+  // at approve is the AUTHORITATIVE consent.
+  requestsScreenControl: z.boolean().default(false),
+  // The workspace this machine is enrolling into. The agent is told this at install
+  // (the user picks the workspace, or the install/enroll token carries it). The user
+  // who approves must hold a grant in THIS workspace — that binding is what makes
+  // the (user-unauthenticated) start safe: it cannot grant access to a workspace no
+  // authorized user later approves in.
+  workspaceId: z.string().uuid()
+});
+var DeviceEnrollmentStartResponse = z.object({
+  deviceCode: z.string(),
+  userCode: z.string(),
+  verificationUri: z.string(),
+  verificationUriComplete: z.string(),
+  intervalSeconds: z.number().int().positive(),
+  expiresInSeconds: z.number().int().positive()
+});
+var DeviceEnrollmentApproveRequest = z.object({
+  userCode: z.string().min(1).max(64),
+  allowScreenControl: z.boolean().default(false)
+});
+var DeviceEnrollmentApproveResponse = z.object({
+  approved: z.boolean(),
+  enrollmentId: z.string().uuid(),
+  sandboxId: z.string().uuid(),
+  allowScreenControl: z.boolean()
+});
+var DeviceEnrollmentPollRequest = z.object({
+  deviceCode: z.string().min(1).max(256)
+});
+var DeviceEnrollmentState = z.enum(["pending", "authorized", "denied", "expired", "disabled"]);
+var EnrollmentCredentialsResponse = z.object({
+  agentId: z.string().uuid(),
+  workspaceId: z.string().uuid(),
+  // The signed bearer the agent presents to the control plane (the `oge_` token).
+  bearer: z.string(),
+  // The Account-scoped control-plane subject prefix the agent subscribes to:
+  // agent.<workspaceId>.<agentId>.
+  subjectPrefix: z.string(),
+  // Connect info for the control plane + stream relay (may be empty when not yet
+  // configured for this deployment — the agent surfaces "control plane unconfigured").
+  natsUrls: z.array(z.string()),
+  relayUrl: z.string(),
+  // The agent's PRODUCER token for the relay edge (the `ogr_` token; M8b). Presented
+  // as StreamOpen.token when the agent registers a pty/desktop channel; the relay
+  // verifies it then pairs the producer with the viewer (whose `ogs_` token the
+  // relay also verifies). Empty when the relay-token plane is unconfigured for this
+  // deployment (graceful degrade — the agent then presents an empty token the relay
+  // rejects, surfacing the gap loudly rather than silently producing a dead stream).
+  relayToken: z.string(),
+  // VESTIGIAL (M-AUTH): there is no per-machine NATS Account creds file. The agent
+  // presents the `bearer` above as the NATS connect AUTH-TOKEN; the server's
+  // auth-callout responder validates it and mints a workspace-scoped user JWT. This
+  // field echoes the bearer so a consumer reading it as the connect credential still
+  // works; new consumers should read `bearer` directly.
+  natsAccountCreds: z.string(),
+  // The minisign public key the agent pins for self-update verification.
+  updatePublicKey: z.string(),
+  consentedWholeMachine: z.boolean(),
+  consentedScreenControl: z.boolean()
+});
+var DeviceEnrollmentPollResponse = z.object({
+  state: DeviceEnrollmentState,
+  // Present only when state === "authorized".
+  credentials: EnrollmentCredentialsResponse.optional()
+});
+var EnrollmentSummary = z.object({
+  id: z.string().uuid(),
+  pubkey: z.string(),
+  exposure: z.literal("whole-machine"),
+  hasDisplay: z.boolean(),
+  allowScreenControl: z.boolean(),
+  status: z.enum(["active", "revoked"]),
+  os: EnrollmentOs,
+  arch: z.string(),
+  lastSeenAt: z.string().nullable(),
+  createdAt: z.string(),
+  revokedAt: z.string().nullable()
+});
+var ListEnrollmentsResponse = z.object({
+  enrollments: z.array(EnrollmentSummary)
+});
+var RevokeEnrollmentResponse = z.object({
+  revoked: z.boolean()
+});
+var DeviceEnrollmentLookupRequest = z.object({
+  userCode: z.string().min(1).max(64)
+});
+var DeviceEnrollmentLookupMachine = z.object({
+  machineName: z.string().nullable(),
+  os: EnrollmentOs,
+  arch: z.string(),
+  canOfferDisplay: z.boolean(),
+  requestsScreenControl: z.boolean()
+});
+var DeviceEnrollmentLookupResponse = z.object({
+  workspaceId: z.string().uuid(),
+  userCode: z.string(),
+  machine: DeviceEnrollmentLookupMachine,
+  expiresAt: z.string()
+});
+var DeviceEnrollmentDenyRequest = z.object({
+  userCode: z.string().min(1).max(64)
+});
+var DeviceEnrollmentDenyResponse = z.object({
+  denied: z.boolean()
+});
+var MintEnrollTokenRequest = z.object({
+  allowScreenControl: z.boolean().default(false)
+});
+var MintEnrollTokenResponse = z.object({
+  // The `oget_` token. SECRET — the UI shows it once with a copy-now warning.
+  token: z.string(),
+  expiresAt: z.string(),
+  expiresInSeconds: z.number().int().positive()
+});
+var EnrollTokenExchangeRequest = z.object({
+  // The `oget_` enroll token (the auth + the workspace/account/consent grant).
+  token: z.string().min(1),
+  // The agent's ed25519 public key (the machine identity the enrollment binds to).
+  publicKey: z.string().min(1).max(1024),
+  os: EnrollmentOs.default("linux"),
+  arch: EnrollmentArch.default("x86_64"),
+  machineName: z.string().min(1).max(256).optional(),
+  // v1 only supports whole-machine; kept explicit so the consent is recorded.
+  exposure: z.literal("whole-machine").default("whole-machine"),
+  canOfferDisplay: z.boolean().default(false),
+  // The agent's REQUEST; the token's allowScreenControl is the AUTHORITATIVE consent.
+  requestsScreenControl: z.boolean().default(false)
+});
+var EnrollTokenExchangeResponse = z.object({
+  credentials: EnrollmentCredentialsResponse
+});
+var MetricSample = z.object({
+  cpuPct: z.number(),
+  load1: z.number(),
+  load5: z.number(),
+  load15: z.number(),
+  memUsedBytes: z.number().int(),
+  memTotalBytes: z.number().int(),
+  diskUsedBytes: z.number().int(),
+  diskTotalBytes: z.number().int(),
+  gpuUtilPct: z.number().nullable(),
+  gpuMemBytes: z.number().int().nullable(),
+  runQueue: z.number(),
+  sampledAt: z.string()
+});
+var MachineState = z.enum([
+  "online",
+  "reconnecting",
+  "offline",
+  "consent_required",
+  "display_unavailable",
+  "enrolling"
+]);
+var MachineKind = z.enum(["modal", "selfhosted"]);
+var MachineView = z.object({
+  sandboxId: z.string(),
+  enrollmentId: z.string().nullable(),
+  name: z.string(),
+  kind: MachineKind,
+  state: MachineState,
+  active: z.boolean(),
+  isSessionGroup: z.boolean(),
+  os: z.string(),
+  arch: z.string(),
+  hasDisplay: z.boolean(),
+  allowScreenControl: z.boolean(),
+  sharedSessionCount: z.number().int(),
+  lastSeenAt: z.string().nullable(),
+  metrics: MetricSample.nullable()
+});
+var MachinesResponse = z.object({
+  activeSandboxId: z.string().nullable(),
+  activeEpoch: z.number().int(),
+  machines: z.array(MachineView)
+});
+var SwapActiveSandboxRequest = z.object({
+  target: z.string().min(1)
+});
+var SwapActiveSandboxResponse = z.object({
+  swapped: z.boolean(),
+  activeSandboxId: z.string().nullable(),
+  activeEpoch: z.number().int(),
+  reason: z.string().optional()
+});
+var MachineMetricsSeriesResponse = z.object({
+  samples: z.array(MetricSample)
+});
 var ClientModel = z.object({
   id: z.string(),
   label: z.string(),
@@ -2192,6 +2679,18 @@ export {
   CreateWorkspaceRequest,
   DESKTOP_STREAM_PORT,
   DelegatedAccessTokenPayload,
+  DeviceEnrollmentApproveRequest,
+  DeviceEnrollmentApproveResponse,
+  DeviceEnrollmentDenyRequest,
+  DeviceEnrollmentDenyResponse,
+  DeviceEnrollmentLookupMachine,
+  DeviceEnrollmentLookupRequest,
+  DeviceEnrollmentLookupResponse,
+  DeviceEnrollmentPollRequest,
+  DeviceEnrollmentPollResponse,
+  DeviceEnrollmentStartRequest,
+  DeviceEnrollmentStartResponse,
+  DeviceEnrollmentState,
   DiscoverMcpCapabilitiesResponse,
   Document,
   DocumentBase,
@@ -2200,6 +2699,15 @@ export {
   DocumentStatus,
   EnableCapabilityRequest,
   EnablePackRequest,
+  EnrollTokenExchangeRequest,
+  EnrollTokenExchangeResponse,
+  EnrollTokenPayload,
+  EnrollmentArch,
+  EnrollmentBearerPayload,
+  EnrollmentCredentialsResponse,
+  EnrollmentOs,
+  EnrollmentSummary,
+  EntitlementDecision,
   EntitlementValue,
   Entitlements,
   EntitlementsMode,
@@ -2248,9 +2756,18 @@ export {
   GoalSpec,
   LimitAction,
   LimitDecision,
+  ListEnrollmentsResponse,
   ListWorkspaceMembersResponse,
+  MachineKind,
+  MachineMetricsSeriesResponse,
+  MachineState,
+  MachineView,
+  MachinesResponse,
   ManagedAccount,
   MarketingDailyAnalysisTaskRequest,
+  MetricSample,
+  MintEnrollTokenRequest,
+  MintEnrollTokenResponse,
   PackInstallation,
   PackInstallationStatus,
   PageInfo,
@@ -2270,10 +2787,12 @@ export {
   RecordingMode,
   RecordingStartedPayload,
   RegisterCapabilityPackRequest,
+  RelayTokenPayload,
   ReorderSessionTurnsRequest,
   RepositoryResourceRef,
   ResourceRef,
   ResourceRefConflictError,
+  RevokeEnrollmentResponse,
   SandboxBackend,
   SandboxCapabilityName,
   SandboxCommandOutputDeltaPayload,
@@ -2296,6 +2815,9 @@ export {
   SessionGoalCreatedBy,
   SessionGoalPausedReason,
   SessionGoalStatus,
+  SessionMcpCredentialUpdateInput,
+  SessionMcpServerInput,
+  SessionMcpServerMetadata,
   SessionStatus,
   SessionStructuredCapabilities,
   SessionTurn,
@@ -2312,6 +2834,8 @@ export {
   StreamRevokedPayload,
   StreamTokenPayload,
   StreamUrlRotatedPayload,
+  SwapActiveSandboxRequest,
+  SwapActiveSandboxResponse,
   TERMINAL_STREAM_PORT,
   TerminalExecRequest,
   TerminalExecResponse,
@@ -2346,9 +2870,15 @@ export {
   reasoningEffortForMetadata,
   resourceIdentityKey,
   signDelegatedAccessToken,
+  signEnrollToken,
+  signEnrollmentBearer,
+  signRelayToken,
   signStreamToken,
   stableJson,
   verifyDelegatedAccessToken,
+  verifyEnrollToken,
+  verifyEnrollmentBearer,
+  verifyRelayToken,
   verifyStreamToken
 };
 //# sourceMappingURL=index.js.map