@opengeni/contracts 0.9.0 → 0.15.0

package/dist/index.js

@@ -1,10 +1,664 @@
 // src/index.ts
 import { z } from "zod";
+
+// src/event-preview.ts
+var SESSION_EVENT_PAYLOAD_MAX_BYTES = 64 * 1024;
+var TARGET_PAYLOAD_BYTES = 60 * 1024;
+var DEFAULT_STRING_BYTES = 8 * 1024;
+var RETRY_STRING_BYTES = 1024;
+var DEFAULT_ARRAY_ENTRIES = 40;
+var RETRY_ARRAY_ENTRIES = 12;
+var DEFAULT_OBJECT_FIELDS = 80;
+var RETRY_OBJECT_FIELDS = 32;
+var MAX_PREVIEW_DEPTH = 12;
+var MAX_PREVIEW_NODES = 512;
+var MAX_MEASUREMENT_NODES = 2048;
+var MAX_MEASUREMENT_DEPTH = 64;
+var MAX_DETAIL_RECORDS = 24;
+var APPROX_BYTES_PER_TOKEN = 4;
+var encoder = new TextEncoder();
+var IDENTITY_FIELDS = /* @__PURE__ */ new Set([
+  "id",
+  "callId",
+  "call_id",
+  "name",
+  "toolName",
+  "type",
+  "status",
+  "code",
+  "isError",
+  "stream",
+  "commandId",
+  "sequence"
+]);
+function sessionEventJsonBytes(value) {
+  return encoder.encode(stringifyForBoundary(value)).byteLength;
+}
+function measureSessionEventJson(value) {
+  return measureJsonBytes(value);
+}
+function approximateSessionEventTokens(bytes) {
+  return Math.ceil(Math.max(0, bytes) / APPROX_BYTES_PER_TOKEN);
+}
+function sessionEventMediaPreview(mediaType, inlineBytes) {
+  return {
+    type: "media_preview",
+    mediaType: mediaType || "application/octet-stream",
+    inlineBytes: inlineBytes === null ? null : Math.max(0, Math.floor(Number.isFinite(inlineBytes) ? inlineBytes : 0)),
+    fullOutputAvailable: false,
+    preview: "Inline media omitted from the audit timeline; source bytes were not retained."
+  };
+}
+function sessionEventMediaPreviewFromDataUrl(value) {
+  const match = /^data:([^;,]+)(?:;[^,]*)?;base64,/i.exec(value);
+  if (!match) return null;
+  const encodedLength = Math.max(0, value.length - match[0].length);
+  const padding = value.endsWith("==") ? 2 : value.endsWith("=") ? 1 : 0;
+  return sessionEventMediaPreview(
+    match[1] ?? "application/octet-stream",
+    Math.max(0, Math.floor(encodedLength * 3 / 4) - padding)
+  );
+}
+function sessionEventPayloadTruncation(payload) {
+  if (!isPlainRecord(payload)) return null;
+  const value = payload.truncation;
+  if (!isPlainRecord(value) || value.truncated !== true) return null;
+  return value;
+}
+function boundSessionEventPayload(payload, options = {}) {
+  const maxBytes = Math.max(1024, Math.floor(options.maxBytes ?? SESSION_EVENT_PAYLOAD_MAX_BYTES));
+  const surface = options.surface ?? "durable_audit";
+  const originalMeasurement = measureJsonBytes(payload);
+  const originalBytes = originalMeasurement.bytes;
+  let state = previewState(DEFAULT_STRING_BYTES, DEFAULT_ARRAY_ENTRIES, DEFAULT_OBJECT_FIELDS);
+  let preview = previewValue(payload, state, "$", 0);
+  if (!state.changed && originalBytes !== null && originalBytes <= maxBytes) {
+    return payload;
+  }
+  let reason = payloadTruncationReason(originalMeasurement, state);
+  let bounded = attachTruncation(preview, boundaryMetadata(surface, reason, originalBytes, state));
+  if (sessionEventJsonBytes(bounded) > Math.min(maxBytes, TARGET_PAYLOAD_BYTES)) {
+    state = previewState(RETRY_STRING_BYTES, RETRY_ARRAY_ENTRIES, RETRY_OBJECT_FIELDS);
+    preview = previewValue(payload, state, "$", 0);
+    reason = payloadTruncationReason(originalMeasurement, state);
+    bounded = attachTruncation(preview, boundaryMetadata(surface, reason, originalBytes, state));
+  }
+  if (sessionEventJsonBytes(bounded) > maxBytes) {
+    const identity = identityPreview(payload);
+    state.changed = true;
+    recordDetail(state, {
+      path: "$",
+      kind: "object",
+      ...originalBytes === null ? {} : { originalBytes }
+    });
+    bounded = attachTruncation(
+      {
+        ...identity,
+        preview: "[event payload omitted: bounded audit preview exceeded the storage envelope]"
+      },
+      boundaryMetadata(surface, reason, originalBytes, state)
+    );
+  }
+  settleDeliveredSizes(bounded, maxBytes);
+  return bounded;
+}
+function previewState(stringBytes, arrayEntries, objectFields) {
+  return {
+    changed: false,
+    sawMedia: false,
+    details: [],
+    stringBytes,
+    arrayEntries,
+    objectFields,
+    remainingNodes: MAX_PREVIEW_NODES
+  };
+}
+function payloadTruncationReason(measurement, state) {
+  if (state.sawMedia) return "inline_media_not_retained";
+  return measurement.bytes === null ? measurement.reason : "payload_bytes_exceeded";
+}
+function previewValue(value, state, path, depth) {
+  if (state.remainingNodes <= 0) {
+    state.changed = true;
+    recordDetail(state, { path, kind: "budget" });
+    return "[nested value omitted at audit preview traversal boundary]";
+  }
+  state.remainingNodes -= 1;
+  if (typeof value === "string") {
+    const media = inlineMediaFact(value);
+    if (media) {
+      state.changed = true;
+      state.sawMedia = true;
+      recordDetail(state, {
+        path,
+        kind: "media",
+        originalBytes: utf8Bytes(value),
+        deliveredBytes: sessionEventJsonBytes(media),
+        mediaType: media.mediaType
+      });
+      return media;
+    }
+    const originalBytes = utf8Bytes(value);
+    if (originalBytes <= state.stringBytes) return value;
+    state.changed = true;
+    const delivered = truncateUtf8Middle(value, state.stringBytes, originalBytes);
+    recordDetail(state, {
+      path,
+      kind: "string",
+      originalBytes,
+      deliveredBytes: utf8Bytes(delivered)
+    });
+    return delivered;
+  }
+  if (typeof value === "bigint" || typeof value === "function" || typeof value === "symbol") {
+    state.changed = true;
+    recordDetail(state, { path, kind: "unserializable" });
+    return `[${typeof value} value omitted at audit serialization boundary]`;
+  }
+  if (value === null || typeof value !== "object") return value;
+  const binary = binaryFact(value);
+  if (binary) {
+    state.changed = true;
+    recordDetail(state, {
+      path,
+      kind: "binary",
+      originalBytes: binary.originalBytes,
+      deliveredBytes: sessionEventJsonBytes(binary.preview)
+    });
+    return binary.preview;
+  }
+  if (depth >= MAX_PREVIEW_DEPTH) {
+    state.changed = true;
+    recordDetail(state, { path, kind: "depth" });
+    return "[nested value omitted at audit preview depth boundary]";
+  }
+  if (Array.isArray(value)) {
+    const keep = Math.max(2, state.arrayEntries);
+    if (value.length <= keep) {
+      return Array.from(
+        { length: value.length },
+        (_, index) => previewArrayEntry(value, index, state, path, depth)
+      );
+    }
+    state.changed = true;
+    const head = Math.ceil(keep / 2);
+    const tail = Math.floor(keep / 2);
+    const omitted2 = value.length - head - tail;
+    recordDetail(state, { path, kind: "array", omittedEntries: omitted2 });
+    return [
+      ...Array.from(
+        { length: head },
+        (_, index) => previewArrayEntry(value, index, state, path, depth)
+      ),
+      { omittedEntries: omitted2, preview: "[middle array entries omitted]" },
+      ...Array.from(
+        { length: tail },
+        (_, index) => previewArrayEntry(value, value.length - tail + index, state, path, depth)
+      )
+    ];
+  }
+  if (value instanceof Date) {
+    if (!hasCanonicalDateSerialization(value)) {
+      state.changed = true;
+      recordDetail(state, { path, kind: "unserializable" });
+      return "[Date value with custom serialization omitted at audit boundary]";
+    }
+    try {
+      const epoch = Date.prototype.getTime.call(value);
+      return Number.isFinite(epoch) ? Date.prototype.toISOString.call(value) : null;
+    } catch {
+      state.changed = true;
+      recordDetail(state, { path, kind: "unserializable" });
+      return "[Date value omitted at audit serialization boundary]";
+    }
+  }
+  const record = value;
+  const { entries, omitted, accessorKeys } = selectObjectEntries(record, state.objectFields);
+  for (const key of accessorKeys) {
+    state.changed = true;
+    recordDetail(state, {
+      path: `${path}.${key}`,
+      kind: "unserializable"
+    });
+  }
+  if (omitted) {
+    state.changed = true;
+    recordDetail(state, {
+      path,
+      kind: "object",
+      // Counting every remaining field would defeat the traversal bound. `null`
+      // is deliberate: at least one field was omitted, but its exact count is
+      // unknown because the source was not fully enumerated.
+      omittedEntries: null
+    });
+  }
+  const out = {};
+  for (const [key, entry] of entries) {
+    out[key] = previewValue(entry, state, `${path}.${key}`, depth + 1);
+  }
+  if (omitted) {
+    out.omittedFields = "additional fields omitted; exact count not measured";
+  }
+  return out;
+}
+function previewArrayEntry(value, index, state, path, depth) {
+  let descriptor;
+  try {
+    descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+  } catch {
+    state.changed = true;
+    recordDetail(state, { path: `${path}[${index}]`, kind: "unserializable" });
+    return "[array element omitted at audit serialization boundary]";
+  }
+  if (descriptor && !("value" in descriptor)) {
+    state.changed = true;
+    recordDetail(state, { path: `${path}[${index}]`, kind: "unserializable" });
+    return "[array accessor value omitted at audit serialization boundary]";
+  }
+  return previewValue(
+    descriptor && "value" in descriptor ? descriptor.value : void 0,
+    state,
+    `${path}[${index}]`,
+    depth + 1
+  );
+}
+function selectObjectEntries(record, maxFields) {
+  const entries = [];
+  const selected = /* @__PURE__ */ new Set();
+  const accessorKeys = [];
+  const select = (key) => {
+    const descriptor = Object.getOwnPropertyDescriptor(record, key);
+    if (!descriptor?.enumerable) return false;
+    selected.add(key);
+    if ("value" in descriptor) {
+      entries.push([key, descriptor.value]);
+    } else {
+      entries.push([key, "[accessor value omitted at audit serialization boundary]"]);
+      accessorKeys.push(key);
+    }
+    return true;
+  };
+  try {
+    for (const key of IDENTITY_FIELDS) {
+      if (entries.length >= maxFields) break;
+      select(key);
+    }
+    for (const key in record) {
+      if (!Object.prototype.hasOwnProperty.call(record, key) || selected.has(key)) continue;
+      if (entries.length >= maxFields) {
+        return { entries, omitted: true, accessorKeys };
+      }
+      select(key);
+    }
+  } catch {
+    return { entries, omitted: true, accessorKeys };
+  }
+  return { entries, omitted: false, accessorKeys };
+}
+function attachTruncation(preview, truncation) {
+  if (isPlainRecord(preview)) {
+    return { ...preview, truncation };
+  }
+  return { value: preview, truncation };
+}
+function boundaryMetadata(surface, reason, originalBytes, state) {
+  return {
+    truncated: true,
+    surface,
+    reason,
+    originalBytes,
+    deliveredBytes: 0,
+    omittedBytes: originalBytes,
+    estimatedOriginalTokens: originalBytes === null ? null : approximateSessionEventTokens(originalBytes),
+    estimatedDeliveredTokens: 0,
+    fullEvidence: { available: false, reason: "not_retained" },
+    details: state.details
+  };
+}
+function settleDeliveredSizes(payload, maxBytes) {
+  const truncation = payload.truncation;
+  convergeDeliveredSizes(payload, truncation);
+  if (sessionEventJsonBytes(payload) > maxBytes) {
+    payload.preview = "[event payload omitted at audit byte boundary]";
+    for (const key of Object.keys(payload)) {
+      if (key !== "preview" && key !== "truncation" && IDENTITY_FIELDS.has(key) === false) {
+        delete payload[key];
+      }
+    }
+    truncation.details = truncation.details.slice(0, 4);
+    convergeDeliveredSizes(payload, truncation);
+  }
+}
+function convergeDeliveredSizes(payload, truncation) {
+  for (let attempt = 0; attempt < 16; attempt += 1) {
+    const deliveredBytes = sessionEventJsonBytes(payload);
+    const omittedBytes = truncation.originalBytes === null ? null : Math.max(0, truncation.originalBytes - deliveredBytes);
+    const estimatedDeliveredTokens = approximateSessionEventTokens(deliveredBytes);
+    if (truncation.deliveredBytes === deliveredBytes && truncation.omittedBytes === omittedBytes && truncation.estimatedDeliveredTokens === estimatedDeliveredTokens) {
+      return;
+    }
+    truncation.deliveredBytes = deliveredBytes;
+    truncation.omittedBytes = omittedBytes;
+    truncation.estimatedDeliveredTokens = estimatedDeliveredTokens;
+  }
+  throw new RangeError("Session event byte accounting did not converge");
+}
+function recordDetail(state, detail) {
+  if (state.details.length < MAX_DETAIL_RECORDS) state.details.push(detail);
+}
+function identityPreview(value) {
+  if (!isPlainRecord(value)) return {};
+  const out = {};
+  for (const key of IDENTITY_FIELDS) {
+    let field;
+    try {
+      const descriptor = Object.getOwnPropertyDescriptor(value, key);
+      if (!descriptor?.enumerable || !("value" in descriptor)) continue;
+      field = descriptor.value;
+    } catch {
+      continue;
+    }
+    if (typeof field === "string") {
+      out[key] = truncateUtf8Middle(field, 256, utf8Bytes(field));
+    } else if (typeof field === "number" || typeof field === "boolean" || field === null) {
+      out[key] = field;
+    }
+  }
+  return out;
+}
+function inlineMediaFact(value) {
+  return sessionEventMediaPreviewFromDataUrl(value);
+}
+function binaryFact(value) {
+  if (ArrayBuffer.isView(value)) {
+    return {
+      originalBytes: value.byteLength,
+      preview: {
+        type: "binary_preview",
+        byteLength: value.byteLength,
+        fullOutputAvailable: false,
+        preview: "Inline binary value omitted from the audit timeline; bytes were not retained."
+      }
+    };
+  }
+  if (value instanceof ArrayBuffer) {
+    return {
+      originalBytes: value.byteLength,
+      preview: {
+        type: "binary_preview",
+        byteLength: value.byteLength,
+        fullOutputAvailable: false,
+        preview: "Inline binary value omitted from the audit timeline; bytes were not retained."
+      }
+    };
+  }
+  return null;
+}
+function truncateUtf8Middle(value, maxBytes, knownBytes = utf8Bytes(value)) {
+  if (knownBytes <= maxBytes) return value;
+  let omittedBytes = Math.max(0, knownBytes - maxBytes);
+  for (let attempt = 0; attempt < 4; attempt += 1) {
+    const marker2 = `\u2026[${omittedBytes} bytes omitted]\u2026`;
+    const contentBudget2 = Math.max(0, maxBytes - utf8Bytes(marker2));
+    if (contentBudget2 === 0) return marker2;
+    const left2 = utf8Prefix(value, Math.floor(contentBudget2 / 2));
+    const right2 = utf8Suffix(value, contentBudget2 - left2.bytes);
+    const exactOmittedBytes = Math.max(0, knownBytes - left2.bytes - right2.bytes);
+    if (exactOmittedBytes === omittedBytes) {
+      return `${value.slice(0, left2.end)}${marker2}${value.slice(right2.start)}`;
+    }
+    omittedBytes = exactOmittedBytes;
+  }
+  const marker = `\u2026[${omittedBytes} bytes omitted]\u2026`;
+  const contentBudget = Math.max(0, maxBytes - utf8Bytes(marker));
+  const left = utf8Prefix(value, Math.floor(contentBudget / 2));
+  const right = utf8Suffix(value, contentBudget - left.bytes);
+  return `${value.slice(0, left.end)}${marker}${value.slice(right.start)}`;
+}
+function utf8Prefix(value, maxBytes) {
+  let end = 0;
+  let bytes = 0;
+  while (end < value.length) {
+    const unit = utf8UnitAt(value, end);
+    if (bytes + unit.bytes > maxBytes) break;
+    bytes += unit.bytes;
+    end += unit.codeUnits;
+  }
+  return { end, bytes };
+}
+function utf8Suffix(value, maxBytes) {
+  let start = value.length;
+  let bytes = 0;
+  while (start > 0) {
+    const unit = utf8UnitBefore(value, start);
+    if (bytes + unit.bytes > maxBytes) break;
+    bytes += unit.bytes;
+    start -= unit.codeUnits;
+  }
+  return { start, bytes };
+}
+function utf8UnitAt(value, index) {
+  const code = value.charCodeAt(index);
+  if (code <= 127) return { codeUnits: 1, bytes: 1 };
+  if (code <= 2047) return { codeUnits: 1, bytes: 2 };
+  if (code >= 55296 && code <= 56319) {
+    const next = index + 1 < value.length ? value.charCodeAt(index + 1) : 0;
+    if (next >= 56320 && next <= 57343) {
+      return { codeUnits: 2, bytes: 4 };
+    }
+  }
+  return { codeUnits: 1, bytes: 3 };
+}
+function utf8UnitBefore(value, end) {
+  const code = value.charCodeAt(end - 1);
+  if (code >= 56320 && code <= 57343 && end >= 2) {
+    const previous = value.charCodeAt(end - 2);
+    if (previous >= 55296 && previous <= 56319) {
+      return { codeUnits: 2, bytes: 4 };
+    }
+  }
+  if (code <= 127) return { codeUnits: 1, bytes: 1 };
+  if (code <= 2047) return { codeUnits: 1, bytes: 2 };
+  return { codeUnits: 1, bytes: 3 };
+}
+function utf8Bytes(value) {
+  let bytes = 0;
+  for (let index = 0; index < value.length; ) {
+    const unit = utf8UnitAt(value, index);
+    bytes += unit.bytes;
+    index += unit.codeUnits;
+  }
+  return bytes;
+}
+function measureJsonBytes(value) {
+  const state = {
+    remainingNodes: MAX_MEASUREMENT_NODES,
+    seen: /* @__PURE__ */ new WeakSet(),
+    failureReason: null
+  };
+  try {
+    const bytes = measureJsonValue(value, state, "top", 0);
+    return bytes === null ? {
+      bytes: null,
+      reason: state.failureReason ?? "payload_measurement_bounded"
+    } : { bytes, reason: null };
+  } catch {
+    return { bytes: null, reason: "payload_measurement_bounded" };
+  }
+}
+function measureJsonValue(value, state, position, depth) {
+  if (state.remainingNodes <= 0 || depth > MAX_MEASUREMENT_DEPTH) {
+    return failJsonMeasurement(state, "payload_measurement_bounded");
+  }
+  state.remainingNodes -= 1;
+  if (value === null) return 4;
+  if (typeof value === "string") return jsonStringBytes(value);
+  if (typeof value === "boolean") return value ? 4 : 5;
+  if (typeof value === "number") {
+    const serialized = JSON.stringify(value);
+    return serialized === void 0 ? null : serialized.length;
+  }
+  if (typeof value === "undefined" || typeof value === "function" || typeof value === "symbol") {
+    return position === "array" ? 4 : failJsonMeasurement(state, "payload_not_serializable");
+  }
+  if (typeof value === "bigint") {
+    return failJsonMeasurement(state, "payload_not_serializable");
+  }
+  if (typeof value !== "object") {
+    return failJsonMeasurement(state, "payload_not_serializable");
+  }
+  if (value instanceof Date) {
+    if (!hasCanonicalDateSerialization(value)) {
+      return failJsonMeasurement(state, "payload_measurement_bounded");
+    }
+    try {
+      const epoch = Date.prototype.getTime.call(value);
+      return Number.isFinite(epoch) ? jsonStringBytes(Date.prototype.toISOString.call(value)) : 4;
+    } catch {
+      return failJsonMeasurement(state, "payload_not_serializable");
+    }
+  }
+  if (ArrayBuffer.isView(value) || value instanceof ArrayBuffer) {
+    return failJsonMeasurement(state, "payload_measurement_bounded");
+  }
+  if (state.seen.has(value)) {
+    return failJsonMeasurement(state, "payload_not_serializable");
+  }
+  state.seen.add(value);
+  try {
+    if (Array.isArray(value)) {
+      if (Object.getPrototypeOf(value) !== Array.prototype) {
+        return failJsonMeasurement(state, "payload_measurement_bounded");
+      }
+      const toJson2 = Object.getOwnPropertyDescriptor(value, "toJSON");
+      if (toJson2 && ("get" in toJson2 || typeof toJson2.value === "function")) {
+        return failJsonMeasurement(state, "payload_measurement_bounded");
+      }
+      if (value.length > state.remainingNodes) {
+        return failJsonMeasurement(state, "payload_measurement_bounded");
+      }
+      let bytes2 = 2;
+      for (let index = 0; index < value.length; index += 1) {
+        if (index > 0) bytes2 += 1;
+        const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+        if (descriptor && !("value" in descriptor)) {
+          return failJsonMeasurement(state, "payload_measurement_bounded");
+        }
+        const entry = descriptor && "value" in descriptor ? descriptor.value : void 0;
+        const measured = measureJsonValue(entry, state, "array", depth + 1);
+        if (measured === null) return null;
+        bytes2 += measured;
+      }
+      return bytes2;
+    }
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null) {
+      return failJsonMeasurement(state, "payload_measurement_bounded");
+    }
+    const toJson = Object.getOwnPropertyDescriptor(value, "toJSON");
+    if (toJson && ("get" in toJson || typeof toJson.value === "function")) {
+      return failJsonMeasurement(state, "payload_measurement_bounded");
+    }
+    let bytes = 2;
+    let fields = 0;
+    try {
+      for (const key in value) {
+        if (!Object.prototype.hasOwnProperty.call(value, key)) continue;
+        if (state.remainingNodes <= 0) {
+          return failJsonMeasurement(state, "payload_measurement_bounded");
+        }
+        state.remainingNodes -= 1;
+        const descriptor = Object.getOwnPropertyDescriptor(value, key);
+        if (!descriptor || !("value" in descriptor)) {
+          return failJsonMeasurement(state, "payload_measurement_bounded");
+        }
+        const entry = descriptor.value;
+        if (typeof entry === "undefined" || typeof entry === "function" || typeof entry === "symbol") {
+          continue;
+        }
+        const measured = measureJsonValue(entry, state, "object", depth + 1);
+        if (measured === null) return null;
+        if (fields > 0) bytes += 1;
+        bytes += jsonStringBytes(key) + 1 + measured;
+        fields += 1;
+      }
+    } catch {
+      return null;
+    }
+    return bytes;
+  } finally {
+    state.seen.delete(value);
+  }
+}
+function hasCanonicalDateSerialization(value) {
+  try {
+    if (Object.getPrototypeOf(value) !== Date.prototype) return false;
+    return Object.getOwnPropertyDescriptor(value, "toJSON") === void 0;
+  } catch {
+    return false;
+  }
+}
+function failJsonMeasurement(state, reason) {
+  state.failureReason ??= reason;
+  return null;
+}
+function jsonStringBytes(value) {
+  let bytes = 2;
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code === 34 || code === 92 || code === 8 || code === 9 || code === 10 || code === 12 || code === 13) {
+      bytes += 2;
+    } else if (code <= 31) {
+      bytes += 6;
+    } else if (code <= 127) {
+      bytes += 1;
+    } else if (code <= 2047) {
+      bytes += 2;
+    } else if (code >= 55296 && code <= 56319) {
+      const next = index + 1 < value.length ? value.charCodeAt(index + 1) : 0;
+      if (next >= 56320 && next <= 57343) {
+        bytes += 4;
+        index += 1;
+      } else {
+        bytes += 6;
+      }
+    } else if (code >= 56320 && code <= 57343) {
+      bytes += 6;
+    } else {
+      bytes += 3;
+    }
+  }
+  return bytes;
+}
+function serializeForBoundary(value) {
+  try {
+    const serialized = JSON.stringify(value);
+    return {
+      value: serialized === void 0 ? "null" : serialized,
+      serializable: serialized !== void 0
+    };
+  } catch {
+    return {
+      value: JSON.stringify("[unserializable event payload omitted]"),
+      serializable: false
+    };
+  }
+}
+function stringifyForBoundary(value) {
+  return serializeForBoundary(value).value;
+}
+function isPlainRecord(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+
+// src/index.ts
 var SessionStatus = z.enum([
   "queued",
   "running",
   "idle",
   "requires_action",
+  "recovering",
+  "waiting_capacity",
   "failed",
   "cancelled"
 ]);
@@ -383,7 +1037,7 @@ var Permission = z.enum([
   "sessions:create",
   "sessions:read",
   "sessions:control",
-  // Sandbox-surfacing (master-spine §C.3 / crosscut PART 1.2). stream:view is a
+  // sandbox workspace (sandbox contract §C.3 / crosscut PART 1.2). stream:view is a
   // REAL, distinct permission — strictly BROADER than sessions:read — because the
   // pixel plane (Channel B) is UN-REDACTED: a viewer of raw pixels can see cloud
   // creds the agent cat's into a terminal, which the redacted Channel-A event log
@@ -414,8 +1068,12 @@ var Permission = z.enum([
   "api_keys:manage",
   "connections:read",
   "connections:write",
+  /** @deprecated alias of variable-sets:manage */
   "environments:manage",
+  /** @deprecated alias of variable-sets:use */
   "environments:use",
+  "variable-sets:manage",
+  "variable-sets:use",
   // Attach or rotate per-session third-party MCP server credentials. Deliberately
   // not part of the worker's default first-party MCP permission set: a sandboxed
   // agent must not be able to hand itself new bearer credentials.
@@ -431,7 +1089,14 @@ var Permission = z.enum([
   // enrollment grants WHOLE-MACHINE access to a user's own hardware — a high-trust,
   // admin-shaped action. workspace:admin is the super-wildcard over both.
   "enrollments:read",
-  "enrollments:manage"
+  "enrollments:manage",
+  // Rigs (workspace-scoped, versioned sandbox machine definitions). rigs:use is
+  // read + propose-change (the agent-native, additive path a sandboxed session
+  // is trusted with); rigs:manage is create/edit/activate/promote/delete (the
+  // admin-shaped path that mints or rolls versions). workspace:admin is the
+  // super-wildcard over both.
+  "rigs:use",
+  "rigs:manage"
 ]);
 function prefixedMcpToolName(registryId2, toolName) {
   return `${registryId2}__${toolName}`;
@@ -459,12 +1124,316 @@ var Workspace = z.object({
   // Per-workspace agent persona template (white-label override). null means
   // the deployment default (OPENGENI_AGENT_INSTRUCTIONS_TEMPLATE /
   // DEFAULT_AGENT_INSTRUCTIONS) is used. The runtime always injects the
-  // non-bypassable CORE (goal-loop ownership + environment block), so an
+  // non-bypassable CORE (goal-loop ownership + variableSet block), so an
   // override restyles the persona without dropping that contract.
   agentInstructions: z.string().nullable(),
+  // Growth-ready per-workspace settings bag (migration 0045). Known keys are
+  // validated by WorkspaceSettingsSchema; unknown keys are preserved across
+  // PATCH merges so newer settings survive an older server.
+  settings: z.record(z.string(), z.unknown()),
+  inferenceControl: z.object({
+    state: z.enum(["active", "paused"]),
+    revision: z.number().int().nonnegative(),
+    reason: z.string().nullable(),
+    changedBy: z.string().nullable(),
+    changedAt: z.string().nullable()
+  }),
+  // Workspace default rig used by session/scheduled-task create fallback.
+  defaultRigId: z.string().uuid().nullable(),
   createdAt: z.string(),
   updatedAt: z.string()
 });
+var WorkspaceTranscriptionTarget = z.object({
+  provider: z.string().trim().min(1).max(128),
+  model: z.string().trim().min(1).max(256).nullable(),
+  credentialMode: z.enum(["managed", "byok"]),
+  // A workspace-scoped connection reference, never credential material.
+  credentialConnectionId: z.string().uuid().nullable(),
+  region: z.string().trim().min(1).max(128).nullable()
+}).strict().superRefine((target, context) => {
+  if (target.provider === "azure-speech" && target.credentialMode !== "byok") {
+    context.addIssue({
+      code: "custom",
+      path: ["credentialMode"],
+      message: "Azure Speech is supported only through workspace BYOK"
+    });
+  }
+  if (target.credentialMode === "byok" && target.credentialConnectionId === null) {
+    context.addIssue({
+      code: "custom",
+      path: ["credentialConnectionId"],
+      message: "BYOK transcription targets require a workspace connection reference"
+    });
+  }
+  if (target.credentialMode === "managed" && target.credentialConnectionId !== null) {
+    context.addIssue({
+      code: "custom",
+      path: ["credentialConnectionId"],
+      message: "managed transcription targets cannot name a BYOK connection"
+    });
+  }
+});
+var TranscriptionErrorCode = z.enum([
+  "permission_denied",
+  "not_supported",
+  "network",
+  "provider",
+  "policy_blocked",
+  "timeout",
+  "cancelled",
+  "unknown"
+]);
+var TranscriptionTimeSpan = z.object({
+  startMilliseconds: z.number().finite().nonnegative(),
+  endMilliseconds: z.number().finite().nonnegative()
+}).strict().superRefine((span, context) => {
+  if (span.endMilliseconds < span.startMilliseconds) {
+    context.addIssue({
+      code: "custom",
+      path: ["endMilliseconds"],
+      message: "transcription spans must not end before they start"
+    });
+  }
+});
+var TranscriptionSpeaker = z.object({
+  id: z.string().trim().min(1).max(128),
+  label: z.string().trim().min(1).max(128).optional()
+}).strict();
+var TranscriptionWord = z.object({
+  text: z.string().min(1).max(4096),
+  span: TranscriptionTimeSpan,
+  confidence: z.number().finite().min(0).max(1).optional(),
+  speaker: TranscriptionSpeaker.optional()
+}).strict();
+var TranscriptionResultMetadata = z.object({
+  detectedLanguage: z.string().trim().min(1).max(64).optional(),
+  span: TranscriptionTimeSpan.optional(),
+  confidence: z.number().finite().min(0).max(1).optional(),
+  speaker: TranscriptionSpeaker.optional(),
+  words: z.array(TranscriptionWord).max(1e4).optional()
+}).strict().superRefine((metadata, context) => {
+  let previousStart = -1;
+  for (const [index, word] of (metadata.words ?? []).entries()) {
+    if (word.span.startMilliseconds < previousStart) {
+      context.addIssue({
+        code: "custom",
+        path: ["words", index, "span", "startMilliseconds"],
+        message: "transcription words must be ordered by start time"
+      });
+    }
+    previousStart = word.span.startMilliseconds;
+    if (metadata.span && (word.span.startMilliseconds < metadata.span.startMilliseconds || word.span.endMilliseconds > metadata.span.endMilliseconds)) {
+      context.addIssue({
+        code: "custom",
+        path: ["words", index, "span"],
+        message: "transcription word spans must fall within the result span"
+      });
+    }
+  }
+});
+var TranscriptionEventBase = z.object({
+  localSessionId: z.string().min(1).max(256),
+  sequence: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+  occurredAt: z.string().datetime({ offset: true })
+}).strict();
+var TranscriptionEvent = z.discriminatedUnion("type", [
+  TranscriptionEventBase.extend({ type: z.literal("permission.requested") }),
+  TranscriptionEventBase.extend({
+    type: z.literal("session.opened"),
+    providerSessionId: z.string().min(1).max(512)
+  }),
+  TranscriptionEventBase.extend({
+    type: z.literal("transcript.partial"),
+    segmentId: z.string().min(1).max(512),
+    text: z.string().max(1e6),
+    metadata: TranscriptionResultMetadata.optional()
+  }),
+  TranscriptionEventBase.extend({
+    type: z.literal("transcript.final"),
+    segmentId: z.string().min(1).max(512),
+    text: z.string().max(1e6),
+    providerAcceptanceId: z.string().min(1).max(512),
+    metadata: TranscriptionResultMetadata.optional()
+  }),
+  TranscriptionEventBase.extend({
+    type: z.literal("usage"),
+    audioMilliseconds: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+    costUsd: z.number().finite().nonnegative().max(1e9).nullable()
+  }),
+  TranscriptionEventBase.extend({
+    type: z.literal("session.reconnecting"),
+    attempt: z.number().int().nonnegative().max(1e4),
+    reason: z.string().min(1).max(256)
+  }),
+  TranscriptionEventBase.extend({
+    type: z.literal("session.error"),
+    code: TranscriptionErrorCode,
+    recoverable: z.boolean()
+  }),
+  TranscriptionEventBase.extend({
+    type: z.literal("session.closed"),
+    reason: z.enum(["completed", "cancelled", "error", "replaced"])
+  })
+]);
+var WorkspaceTranscriptionPolicy = z.object({
+  enabled: z.boolean(),
+  acceptanceId: z.string().uuid().nullable(),
+  primary: WorkspaceTranscriptionTarget.nullable(),
+  language: z.string().trim().min(1).max(64).nullable(),
+  autoDetectLanguage: z.boolean(),
+  diarization: z.object({
+    enabled: z.boolean(),
+    maxSpeakers: z.number().int().min(2).max(100).nullable()
+  }).strict(),
+  retention: z.object({
+    mode: z.enum(["none", "provider-policy"]),
+    maxDays: z.number().int().nonnegative().max(3650).nullable()
+  }).strict(),
+  privacy: z.object({
+    allowProviderLogging: z.boolean(),
+    allowProviderTraining: z.boolean()
+  }).strict(),
+  fallback: z.object({
+    mode: z.enum(["disabled", "explicit"]),
+    targets: z.array(WorkspaceTranscriptionTarget).max(8)
+  }).strict(),
+  cost: z.object({
+    currency: z.literal("USD"),
+    maxPerHour: z.number().finite().nonnegative().max(1e4).nullable(),
+    maxPerMonth: z.number().finite().nonnegative().max(1e6).nullable()
+  }).strict()
+}).strict().superRefine((policy, context) => {
+  if (policy.enabled && policy.acceptanceId === null) {
+    context.addIssue({
+      code: "custom",
+      path: ["acceptanceId"],
+      message: "enabled transcription requires an accepted policy identity"
+    });
+  }
+  if (policy.enabled && policy.primary === null) {
+    context.addIssue({
+      code: "custom",
+      path: ["primary"],
+      message: "enabled transcription requires a primary target"
+    });
+  }
+  if (policy.enabled && !policy.autoDetectLanguage && policy.language === null) {
+    context.addIssue({
+      code: "custom",
+      path: ["language"],
+      message: "enabled transcription requires a language or accepted automatic detection"
+    });
+  }
+  if (policy.autoDetectLanguage && policy.language !== null) {
+    context.addIssue({
+      code: "custom",
+      path: ["language"],
+      message: "automatic language detection and a fixed language are mutually exclusive"
+    });
+  }
+  if (!policy.diarization.enabled && policy.diarization.maxSpeakers !== null) {
+    context.addIssue({
+      code: "custom",
+      path: ["diarization", "maxSpeakers"],
+      message: "disabled diarization cannot retain a speaker limit"
+    });
+  }
+  if (policy.fallback.mode === "disabled" && policy.fallback.targets.length > 0) {
+    context.addIssue({
+      code: "custom",
+      path: ["fallback", "targets"],
+      message: "disabled fallback cannot retain accepted targets"
+    });
+  }
+  if (policy.fallback.mode === "explicit" && policy.fallback.targets.length === 0) {
+    context.addIssue({
+      code: "custom",
+      path: ["fallback", "targets"],
+      message: "explicit fallback requires at least one accepted target"
+    });
+  }
+  const targetKeys = [policy.primary, ...policy.fallback.targets].filter((target) => target !== null).map(
+    (target) => [
+      target.provider,
+      target.model ?? "",
+      target.credentialMode,
+      target.credentialConnectionId ?? "",
+      target.region ?? ""
+    ].join("\0")
+  );
+  if (new Set(targetKeys).size !== targetKeys.length) {
+    context.addIssue({
+      code: "custom",
+      path: ["fallback", "targets"],
+      message: "transcription targets must be unique"
+    });
+  }
+});
+var WorkspaceSettingsSchema = z.object({
+  memoryEnabled: z.boolean().optional(),
+  transcription: WorkspaceTranscriptionPolicy.optional()
+}).passthrough();
+function resolveWorkspaceMemoryEnabled(settings) {
+  const parsed = WorkspaceSettingsSchema.safeParse(settings ?? {});
+  return parsed.success ? parsed.data.memoryEnabled === true : false;
+}
+var UpdateWorkspaceSettingsRequest = z.object({
+  memoryEnabled: z.boolean().optional(),
+  transcription: WorkspaceTranscriptionPolicy.optional()
+}).passthrough();
+var SetWorkspaceDefaultRigRequest = z.object({
+  rigId: z.string().uuid().nullable()
+});
+var UpdateWorkspaceModelPolicyRequest = z.object({
+  allowedProviders: z.array(z.string().min(1).max(128)).max(64).nullable().optional(),
+  allowedModels: z.array(z.string().min(1).max(256)).max(256).nullable().optional()
+});
+var turnInitiatorIdentityFields = {
+  subjectId: z.string().min(1),
+  /** Immutable display snapshot; never an authorization input. */
+  label: z.string().min(1).optional()
+};
+var UNATTRIBUTED_LEGACY_INITIATOR_SUBJECT_ID = "unattributed-legacy";
+var ServiceTurnInitiator = z.object({
+  kind: z.literal("service"),
+  subjectId: z.string().min(1).max(1024).refine((value) => value !== UNATTRIBUTED_LEGACY_INITIATOR_SUBJECT_ID, {
+    message: "unattributed-legacy is reserved for migrated rows"
+  }),
+  /** Immutable display snapshot; never an authorization input. */
+  label: z.string().min(1).max(256).optional()
+});
+var TurnInitiatorContext = z.record(z.string(), z.unknown());
+var reservedServiceTurnInitiatorContextKeys = /* @__PURE__ */ new Set([
+  "backfill",
+  "label",
+  "provenanceError",
+  "via",
+  "viaTruncated"
+]);
+var ServiceTurnInitiatorContext = TurnInitiatorContext.superRefine((value, ctx) => {
+  for (const key of reservedServiceTurnInitiatorContextKeys) {
+    if (Object.prototype.hasOwnProperty.call(value, key)) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: [key],
+        message: `${key} is reserved OpenGeni initiator context`
+      });
+    }
+  }
+  try {
+    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > 4096) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: "service initiator context exceeds 4096 UTF-8 bytes"
+      });
+    }
+  } catch {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "service initiator context must be JSON-serializable"
+    });
+  }
+});
 var AccountGrant = z.object({
   accountId: z.string().uuid(),
   subjectId: z.string().min(1),
@@ -479,7 +1448,11 @@ var AccessGrant = z.object({
   subjectId: z.string().min(1),
   subjectLabel: z.string().optional(),
   permissions: z.array(Permission),
-  metadata: z.record(z.string(), z.unknown()).optional()
+  metadata: z.record(z.string(), z.unknown()).optional(),
+  // Optional trusted causal principal for a command submitted by an embedding
+  // host. Authorization still uses subjectId + permissions above.
+  serviceInitiator: ServiceTurnInitiator.optional(),
+  serviceInitiatorContext: ServiceTurnInitiatorContext.optional()
 });
 var AccessContext = z.object({
   mode: ProductAccessMode,
@@ -496,35 +1469,85 @@ var DelegatedAccessTokenPayload = z.object({
   subjectId: z.string().min(1),
   subjectLabel: z.string().optional(),
   permissions: z.array(Permission).min(1),
+  // Trusted embedding hosts can sign a causal service principal separately
+  // from the grant subject that authorizes the request. The claim is consumed
+  // only when a command creates a new session/turn.
+  serviceInitiator: ServiceTurnInitiator.optional(),
+  serviceInitiatorContext: ServiceTurnInitiatorContext.optional(),
   // Worker-asserted session scope for first-party MCP calls (HMAC-signed, not
   // agent-controlled); enables session-scoped tools such as goal management.
   sessionId: z.string().uuid().optional(),
+  // The turn making the call (the caller's identity), HMAC-signed by the worker
+  // at turn setup. Lets a tool classify WHO is calling from the token itself,
+  // instead of racily re-reading the session's live active_turn_id — e.g. the
+  // sacred-pause guard must know if the CALLER is a machine child-notification
+  // turn, and the active pointer can flip to another turn mid-check.
+  turnId: z.string().uuid().optional(),
+  // Exact execution owner. Agent control commands are accepted only while this
+  // attempt still owns the signed turn.
+  attemptId: z.string().uuid().optional(),
+  executionGeneration: z.number().int().positive().optional(),
   exp: z.number().int().positive()
+}).superRefine((payload, ctx) => {
+  if (payload.serviceInitiatorContext && !payload.serviceInitiator) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["serviceInitiatorContext"],
+      message: "serviceInitiatorContext requires serviceInitiator"
+    });
+  }
+  if (payload.serviceInitiator && (payload.turnId !== void 0 || payload.attemptId !== void 0 || payload.executionGeneration !== void 0)) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["serviceInitiator"],
+      message: "serviceInitiator cannot replace an exact agent-attempt initiator"
+    });
+  }
 });
+var delegatedAccessTokenPrefix = "ogd_";
+var delegatedServiceAccessTokenPrefix = "ogd2_";
 async function signDelegatedAccessToken(secret, payload) {
-  const encodedPayload = base64UrlEncode(JSON.stringify(DelegatedAccessTokenPayload.parse(payload)));
-  const signature = await hmacSha256Base64Url(secret, encodedPayload);
-  return `ogd_${encodedPayload}.${signature}`;
+  const parsed = DelegatedAccessTokenPayload.parse(payload);
+  const prefix = parsed.serviceInitiator ? delegatedServiceAccessTokenPrefix : delegatedAccessTokenPrefix;
+  const encodedPayload = base64UrlEncode(JSON.stringify(parsed));
+  const signature = await hmacSha256Base64Url(
+    secret,
+    prefix === delegatedServiceAccessTokenPrefix ? `${prefix}${encodedPayload}` : encodedPayload
+  );
+  return `${prefix}${encodedPayload}.${signature}`;
 }
 async function verifyDelegatedAccessToken(secret, token, nowSeconds = Math.floor(Date.now() / 1e3)) {
-  if (!token.startsWith("ogd_")) {
+  const prefix = token.startsWith(delegatedServiceAccessTokenPrefix) ? delegatedServiceAccessTokenPrefix : token.startsWith(delegatedAccessTokenPrefix) ? delegatedAccessTokenPrefix : null;
+  if (!prefix) {
     return null;
   }
-  const withoutPrefix = token.slice("ogd_".length);
+  const withoutPrefix = token.slice(prefix.length);
   const dot = withoutPrefix.lastIndexOf(".");
   if (dot <= 0) {
     return null;
   }
   const encodedPayload = withoutPrefix.slice(0, dot);
   const signature = withoutPrefix.slice(dot + 1);
-  const expected = await hmacSha256Base64Url(secret, encodedPayload);
+  const expected = await hmacSha256Base64Url(
+    secret,
+    prefix === delegatedServiceAccessTokenPrefix ? `${prefix}${encodedPayload}` : encodedPayload
+  );
   if (!constantTimeEqual(signature, expected)) {
     return null;
   }
-  const payload = DelegatedAccessTokenPayload.safeParse(JSON.parse(base64UrlDecode(encodedPayload)));
+  let decoded;
+  try {
+    decoded = JSON.parse(base64UrlDecode(encodedPayload));
+  } catch {
+    return null;
+  }
+  const payload = DelegatedAccessTokenPayload.safeParse(decoded);
   if (!payload.success || payload.data.exp < nowSeconds) {
     return null;
   }
+  if (prefix === delegatedServiceAccessTokenPrefix !== (payload.data.serviceInitiator !== void 0)) {
+    return null;
+  }
   return payload.data;
 }
 var EnrollmentBearerPayload = z.object({
@@ -813,12 +1836,86 @@ var EntitlementValue = z.union([z.boolean(), z.string(), z.number(), z.array(z.s
 var Entitlements = z.record(z.string().min(1), EntitlementValue);
 var LimitDecision = z.discriminatedUnion("allowed", [
   z.object({ allowed: z.literal(true) }),
-  z.object({ allowed: z.literal(false), code: z.string(), message: z.string() })
+  z.object({
+    allowed: z.literal(false),
+    code: z.string(),
+    message: z.string()
+  })
 ]);
 var EntitlementDecision = z.discriminatedUnion("allowed", [
   z.object({ allowed: z.literal(true), quantity: z.number().optional() }),
-  z.object({ allowed: z.literal(false), reason: z.string(), code: z.string().optional(), quantity: z.number().optional() })
+  z.object({
+    allowed: z.literal(false),
+    reason: z.string(),
+    code: z.string().optional(),
+    quantity: z.number().optional()
+  })
 ]);
+var GitCredentialProvider = z.enum(["github", "gitlab", "azure_devops"]);
+var GitCredentialBindingId = z.string().min(1).max(256);
+var GitRepositoryAccess = z.enum(["read", "write"]);
+var GitProviderRepositoryId = z.union([z.number().int().positive(), z.string().min(1)]);
+var GitCredentialRepositoryRef = z.object({
+  provider: GitCredentialProvider.optional(),
+  credentialBindingId: GitCredentialBindingId.optional(),
+  access: GitRepositoryAccess.optional(),
+  uri: z.string().min(1),
+  ref: z.string().min(1),
+  repositoryId: GitProviderRepositoryId.optional(),
+  installationId: GitProviderRepositoryId.optional(),
+  projectId: GitProviderRepositoryId.optional(),
+  connectionId: z.string().min(1).optional()
+});
+var McpConnectionResourceScope = z.object({
+  /** Provider-stable repository identity, serialized as a string on the wire. */
+  id: z.string().min(1).max(512),
+  kind: z.literal("repository")
+}).strict();
+var McpConnectionResourceScopes = z.array(McpConnectionResourceScope).min(1).max(256).superRefine((resources, context) => {
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, resource] of resources.entries()) {
+    const key = `${resource.kind}\0${resource.id}`;
+    if (seen.has(key)) {
+      context.addIssue({
+        code: "custom",
+        message: "selectedResources must not contain duplicates",
+        path: [index]
+      });
+    }
+    seen.add(key);
+  }
+});
+var McpServerConnectionRef = z.object({
+  /** Opaque host or standalone connection identifier. */
+  connectionId: z.string().min(1).optional(),
+  /** Stable provider family (for example github, gitlab, or azure_devops). */
+  provider: z.string().min(1).max(128).optional(),
+  /** Provider host or tenant domain. */
+  providerDomain: z.string().min(1),
+  kind: z.enum(["oauth2", "api_key", "app_install", "delegated"]).optional(),
+  scopes: z.array(z.string().min(1)).optional(),
+  /** OAuth resource indicator. This is distinct from selectedResources. */
+  resource: z.string().min(1).optional(),
+  /** Exact provider resources this MCP binding is allowed to operate on. */
+  selectedResources: McpConnectionResourceScopes.optional(),
+  subjectScope: z.enum(["workspace", "subject"]).optional()
+}).strict().superRefine((reference, context) => {
+  if (!reference.selectedResources) return;
+  if (!reference.connectionId) {
+    context.addIssue({
+      code: "custom",
+      message: "selectedResources requires connectionId",
+      path: ["connectionId"]
+    });
+  }
+  if (!reference.provider) {
+    context.addIssue({
+      code: "custom",
+      message: "selectedResources requires provider",
+      path: ["provider"]
+    });
+  }
+});
 var BillingBalance = z.object({
   accountId: z.string().uuid(),
   balanceMicros: z.number().int(),
@@ -844,17 +1941,109 @@ var RepositoryResourceRef = z.object({
   ref: z.string().min(1),
   mountPath: z.string().min(1).optional(),
   subpath: z.string().min(1).optional(),
+  provider: GitCredentialProvider.optional(),
+  credentialBindingId: GitCredentialBindingId.optional(),
+  access: GitRepositoryAccess.optional(),
+  repositoryId: GitProviderRepositoryId.optional(),
+  installationId: GitProviderRepositoryId.optional(),
+  projectId: GitProviderRepositoryId.optional(),
+  connectionId: z.string().min(1).optional(),
   githubInstallationId: z.number().int().positive().optional(),
   githubRepositoryId: z.number().int().positive().optional()
 });
+function positiveGitProviderInteger(value) {
+  if (typeof value === "number" && Number.isInteger(value) && value > 0) return value;
+  if (typeof value === "string" && /^\d+$/.test(value) && Number(value) > 0) {
+    return Number(value);
+  }
+  return null;
+}
+function gitCredentialProviderForRepository(resource) {
+  if (resource.provider) return resource.provider;
+  if (positiveGitProviderInteger(resource.githubInstallationId) && positiveGitProviderInteger(resource.githubRepositoryId)) {
+    return "github";
+  }
+  return null;
+}
+function gitCredentialBindingIdForRepository(resource, provider = gitCredentialProviderForRepository(resource)) {
+  if (!provider) return null;
+  const installationId = provider === "github" ? positiveGitProviderInteger(resource.githubInstallationId ?? resource.installationId) : null;
+  return resource.credentialBindingId ?? resource.connectionId ?? (installationId ? `github-installation:${installationId}` : provider);
+}
 var FileResourceRef = z.object({
   kind: z.literal("file"),
   fileId: z.string().uuid(),
   mountPath: z.string().min(1).optional()
 });
 var ResourceRef = z.discriminatedUnion("kind", [RepositoryResourceRef, FileResourceRef]);
+var ResourceMountPathError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ResourceMountPathError";
+  }
+};
+function normalizeResourceMountPath(path) {
+  const normalizedSeparators = path.trim().replace(/\\/g, "/");
+  if (!normalizedSeparators || normalizedSeparators.startsWith("/") || /^[A-Za-z]:\//.test(normalizedSeparators) || normalizedSeparators.includes("\0")) {
+    throw new ResourceMountPathError(`invalid resource mount path: ${path}`);
+  }
+  const segments = normalizedSeparators.split("/");
+  if (segments.some(
+    (segment) => !segment || segment === "." || segment === ".." || /[<>:"|?*\u0000-\u001f]/.test(segment) || /[ .]$/.test(segment) || /^(?:con|prn|aux|nul|com[1-9]|lpt[1-9])(?:\.|$)/i.test(segment)
+  )) {
+    throw new ResourceMountPathError(`invalid resource mount path: ${path}`);
+  }
+  return segments.join("/");
+}
+function normalizeRepositorySubpath(path) {
+  const relative = path.trim().replace(/\\/g, "/").replace(/^\/+|\/+$/g, "");
+  return normalizeResourceMountPath(relative);
+}
+function resourceMountPathCollisionKey(path) {
+  return normalizeResourceMountPath(path).normalize("NFKC").toLowerCase();
+}
+function defaultRepositoryMountPath(uri) {
+  let url;
+  try {
+    url = new URL(uri);
+  } catch {
+    throw new ResourceMountPathError(`invalid repository URI for mount path: ${uri}`);
+  }
+  if (url.protocol !== "https:" || !url.host) {
+    throw new ResourceMountPathError(`invalid repository URI for mount path: ${uri}`);
+  }
+  const repositoryPath = url.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/, "");
+  const segments = repositoryPath.split("/").filter(Boolean);
+  if (segments.length < 2) {
+    throw new ResourceMountPathError(`repository URI must include owner and repo: ${uri}`);
+  }
+  return normalizeResourceMountPath(
+    `repos/${encodeURIComponent(url.host.toLowerCase())}/${segments.join("/")}`
+  );
+}
+function resourceMountPath(resource) {
+  if (resource.mountPath) return normalizeResourceMountPath(resource.mountPath);
+  return resource.kind === "file" ? normalizeResourceMountPath(`files/${resource.fileId}`) : defaultRepositoryMountPath(resource.uri);
+}
+function assertUniqueResourceMountPaths(resources) {
+  const mounted = /* @__PURE__ */ new Set();
+  for (const resource of resources) {
+    const path = resourceMountPath(resource);
+    const key = resourceMountPathCollisionKey(path);
+    if (mounted.has(key)) {
+      throw new ResourceRefConflictError(`resource mount path is already attached: ${path}`);
+    }
+    mounted.add(key);
+  }
+}
 var FileStatus = z.enum(["pending_upload", "ready", "failed", "expired", "deleted"]);
-var FileUploadStatus = z.enum(["pending", "completed", "expired", "failed"]);
+var FileUploadStatus = z.enum([
+  "pending",
+  "cleanup_pending",
+  "completed",
+  "expired",
+  "failed"
+]);
 var FileAsset = z.object({
   id: z.string().uuid(),
   workspaceId: z.string().uuid(),
@@ -891,7 +2080,16 @@ var FileDownloadUrlResponse = z.object({
   expiresAt: z.string()
 });
 var DocumentStatus = z.enum(["queued", "indexing", "ready", "failed"]);
-var KnowledgeSourceKind = z.enum(["manual_upload", "meeting_transcript", "repository", "email", "chat", "document", "web", "other"]);
+var KnowledgeSourceKind = z.enum([
+  "manual_upload",
+  "meeting_transcript",
+  "repository",
+  "email",
+  "chat",
+  "document",
+  "web",
+  "other"
+]);
 var DocumentSearchMode = z.enum(["hybrid", "vector", "keyword"]);
 var DocumentBase = z.object({
   id: z.string().uuid(),
@@ -972,8 +2170,21 @@ var DocumentSearchRequest = z.object({
   aclTags: z.array(z.string().min(1)).optional(),
   limit: z.number().int().positive().max(50).default(5)
 });
-var KnowledgeMemoryStatus = z.enum(["proposed", "approved", "rejected"]);
-var KnowledgeMemoryKind = z.enum(["semantic", "episodic", "procedural", "decision", "preference"]);
+var KnowledgeMemoryStatus = z.enum([
+  "proposed",
+  "approved",
+  "rejected",
+  "active",
+  "superseded",
+  "archived"
+]);
+var KnowledgeMemoryKind = z.enum([
+  "semantic",
+  "episodic",
+  "procedural",
+  "decision",
+  "preference"
+]);
 var KnowledgeSourceRef = z.object({
   kind: z.enum(["document_chunk", "document", "session_event", "memory", "external"]),
   id: z.string().min(1),
@@ -994,18 +2205,31 @@ var KnowledgeMemory = z.object({
   createdBySessionId: z.string().uuid().nullable(),
   reviewedBy: z.string().nullable(),
   reviewedAt: z.string().nullable(),
+  // Workspace Memory V1 fields. usageCount/lastUsedAt feed end-state ranking and
+  // decay; supersedesId/supersededById link correction chains; validFrom/validUntil
+  // are the point-in-time window. embedding/embeddingModel/textHash are internal
+  // and never exposed on the wire.
+  pinned: z.boolean(),
+  usageCount: z.number().int(),
+  lastUsedAt: z.string().nullable(),
+  supersedesId: z.string().uuid().nullable(),
+  supersededById: z.string().uuid().nullable(),
+  validFrom: z.string(),
+  validUntil: z.string().nullable(),
   createdAt: z.string(),
   updatedAt: z.string()
 });
 var CreateKnowledgeMemoryRequest = z.object({
-  status: KnowledgeMemoryStatus.default("proposed"),
+  status: KnowledgeMemoryStatus.default("active"),
   kind: KnowledgeMemoryKind.default("semantic"),
   scope: z.string().min(1).default("workspace"),
   text: z.string().min(1),
   sourceRefs: z.array(KnowledgeSourceRef).default([]),
   confidence: z.number().min(0).max(1).default(0.5),
   metadata: z.record(z.string(), z.unknown()).default({}),
-  createdBySessionId: z.string().uuid().optional()
+  createdBySessionId: z.string().uuid().optional(),
+  pinned: z.boolean().optional(),
+  replacesId: z.string().min(1).optional()
 });
 var UpdateKnowledgeMemoryRequest = z.object({
   status: KnowledgeMemoryStatus.optional(),
@@ -1015,7 +2239,9 @@ var UpdateKnowledgeMemoryRequest = z.object({
   sourceRefs: z.array(KnowledgeSourceRef).optional(),
   confidence: z.number().min(0).max(1).optional(),
   metadata: z.record(z.string(), z.unknown()).optional(),
-  reviewedBy: z.string().min(1).optional()
+  reviewedBy: z.string().min(1).optional(),
+  // Human audit action: pin (never decays) / unpin.
+  pinned: z.boolean().optional()
 });
 var KnowledgeMemorySearchRequest = z.object({
   query: z.string().min(1).optional(),
@@ -1024,6 +2250,23 @@ var KnowledgeMemorySearchRequest = z.object({
   scope: z.string().min(1).optional(),
   limit: z.number().int().positive().max(100).default(20)
 });
+var WorkspaceMemorySearchMode = z.enum(["hybrid", "vector", "keyword"]);
+var WorkspaceMemorySearchRequest = z.object({
+  query: z.string().min(1),
+  kind: KnowledgeMemoryKind.optional(),
+  limit: z.number().int().positive().max(20).optional(),
+  mode: WorkspaceMemorySearchMode.optional()
+});
+var WorkspaceMemorySearchResult = z.object({
+  memory: KnowledgeMemory,
+  score: z.number(),
+  matchType: WorkspaceMemorySearchMode,
+  vectorScore: z.number().nullable(),
+  keywordScore: z.number().nullable()
+});
+var WorkspaceMemorySearchResponse = z.object({
+  results: z.array(WorkspaceMemorySearchResult)
+});
 var ToolRef = z.object({
   kind: z.literal("mcp"),
   id: z.string().min(1),
@@ -1036,13 +2279,16 @@ var ToolRef = z.object({
   optional: z.boolean().optional()
 });
 var registryId = /^[A-Za-z0-9_-]+$/;
-var httpsUrl = z.string().url().refine((value) => {
-  try {
-    return new URL(value).protocol === "https:";
-  } catch {
-    return false;
-  }
-}, { message: "URL must use https" });
+var httpsUrl = z.string().url().refine(
+  (value) => {
+    try {
+      return new URL(value).protocol === "https:";
+    } catch {
+      return false;
+    }
+  },
+  { message: "URL must use https" }
+);
 var SessionMcpServerInput = z.object({
   id: z.string().min(1).regex(registryId),
   name: z.string().min(1).optional(),
@@ -1058,7 +2304,10 @@ var SessionMcpServerInput = z.object({
   requireApproval: z.union([z.boolean(), z.array(z.string().min(1))]).optional(),
   // Write-only credential headers. Values are encrypted at rest and never
   // returned in session responses or events; response metadata exposes names.
-  headers: z.record(z.string(), z.string()).optional()
+  headers: z.record(z.string(), z.string()).optional(),
+  // Non-secret opaque pointer resolved at request time by the standalone
+  // connection broker or an embedding host's mcpCredentials port.
+  connectionRef: McpServerConnectionRef.optional()
 });
 var SessionMcpCredentialUpdateInput = z.object({
   id: z.string().min(1).regex(registryId),
@@ -1069,7 +2318,8 @@ var SessionMcpServerMetadata = z.object({
   name: z.string().min(1).nullable(),
   url: httpsUrl,
   headerNames: z.array(z.string()).default([]),
-  credentialVersion: z.number().int().positive()
+  credentialVersion: z.number().int().positive(),
+  connectionRef: McpServerConnectionRef.nullable().default(null)
 }).strict();
 var ResourceRefConflictError = class extends Error {
   constructor(message) {
@@ -1096,9 +2346,18 @@ function mergeToolRefs(existing, additions) {
   return order.map((key) => byKey.get(key));
 }
 function mergeResourceRefs(existing, additions, options = {}) {
+  if (options.rejectConflicts) {
+    assertUniqueResourceMountPaths(existing);
+  }
   const out = [...existing];
-  const mountPaths = new Map(existing.flatMap((resource) => resource.mountPath ? [[resource.mountPath, stableJson(resource)]] : []));
-  const identities = new Map(existing.map((resource) => [resourceIdentityKey(resource), stableJson(resource)]));
+  const mountPaths = new Map(
+    existing.map(
+      (resource) => [resourceMountPathCollisionKey(resourceMountPath(resource)), stableJson(resource)]
+    )
+  );
+  const identities = new Map(
+    existing.map((resource) => [resourceIdentityKey(resource), stableJson(resource)])
+  );
   const exact = new Set(existing.map(stableJson));
   for (const resource of additions) {
     const serialized = stableJson(resource);
@@ -1106,22 +2365,23 @@ function mergeResourceRefs(existing, additions, options = {}) {
       continue;
     }
     if (options.rejectConflicts) {
-      const existingAtMount = resource.mountPath ? mountPaths.get(resource.mountPath) : void 0;
+      const mountPath = resourceMountPath(resource);
+      const existingAtMount = mountPaths.get(resourceMountPathCollisionKey(mountPath));
       if (existingAtMount && existingAtMount !== serialized) {
-        throw new ResourceRefConflictError(`resource mount path is already attached: ${resource.mountPath}`);
+        throw new ResourceRefConflictError(`resource mount path is already attached: ${mountPath}`);
       }
       const identity = resourceIdentityKey(resource);
       const existingIdentity = identities.get(identity);
       if (existingIdentity && existingIdentity !== serialized) {
-        throw new ResourceRefConflictError(`resource is already attached with different settings: ${identity}`);
+        throw new ResourceRefConflictError(
+          `resource is already attached with different settings: ${identity}`
+        );
       }
     }
     out.push(resource);
     exact.add(serialized);
     identities.set(resourceIdentityKey(resource), serialized);
-    if (resource.mountPath) {
-      mountPaths.set(resource.mountPath, serialized);
-    }
+    mountPaths.set(resourceMountPathCollisionKey(resourceMountPath(resource)), serialized);
   }
   return out;
 }
@@ -1143,17 +2403,39 @@ function sortJson(value) {
     return value.map(sortJson);
   }
   if (value && typeof value === "object") {
-    return Object.fromEntries(Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, nested]) => [key, sortJson(nested)]));
+    return Object.fromEntries(
+      Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, nested]) => [key, sortJson(nested)])
+    );
   }
   return value;
 }
-var SessionTurnStatus = z.enum(["queued", "running", "requires_action", "completed", "failed", "cancelled"]);
-var SessionTurnSource = z.enum(["user", "scheduled_task", "api", "goal"]);
+var SessionTurnStatus = z.enum([
+  "queued",
+  "running",
+  "requires_action",
+  "recovering",
+  "waiting_capacity",
+  "completed",
+  "failed",
+  "cancelled",
+  "superseded",
+  "withdrawn_for_edit"
+]);
+var SessionTurnSource = z.enum([
+  "user",
+  "scheduled_task",
+  "api",
+  "goal",
+  "system",
+  "compaction"
+]);
+var SessionControlState = z.enum(["active", "paused"]);
+var WorkspaceInferenceState = z.enum(["active", "paused"]);
 var SessionGoalStatus = z.enum(["active", "paused", "completed"]);
 var SessionGoalCreatedBy = z.enum(["api", "agent", "scheduled_task"]);
 var SessionGoalPausedReason = z.enum([
   "agent",
-  "user_interrupt",
+  "user_pause",
   "api",
   "no_progress",
   "max_auto_continuations",
@@ -1191,11 +2473,17 @@ var UpdateSessionGoalRequest = z.object({
 var UpdateSessionRequest = z.object({
   title: z.string().min(1).max(200)
 });
+var UpdateSessionPinRequest = z.object({
+  pinned: z.boolean(),
+  expectedVersion: z.number().int().nonnegative().optional()
+});
 var ClearSessionContextRequest = z.object({
   confirm: z.literal(true)
 });
 var CLEARED_RUN_STATE_MARKER = "$opengeniCleared";
-var CLEARED_RUN_STATE_BLOB = JSON.stringify({ [CLEARED_RUN_STATE_MARKER]: true });
+var CLEARED_RUN_STATE_BLOB = JSON.stringify({
+  [CLEARED_RUN_STATE_MARKER]: true
+});
 function isClearedRunStateBlob(serialized) {
   if (!serialized) {
     return false;
@@ -1209,11 +2497,110 @@ function isClearedRunStateBlob(serialized) {
 }
 var CompactSessionContextRequest = z.object({}).strict();
 var CompactSessionContextResult = z.object({
-  // queued: a client-side (Azure) compaction will run before the next turn.
-  // noop:   nothing to do (server-managed provider, mode off, or no history).
-  status: z.enum(["queued", "noop"]),
+  // pending: an active/paused session will compact at its next safe boundary.
+  // completed: an idle compaction-only activity completed synchronously.
+  // noop: there is no active history to compact.
+  status: z.enum(["pending", "completed", "noop"]),
   message: z.string()
 });
+var TurnInitiator = z.object({
+  kind: z.enum(["subject", "service"]),
+  ...turnInitiatorIdentityFields
+});
+var SessionAuthorizationSurface = z.enum([
+  "http",
+  "core",
+  "stream",
+  "first_party_mcp",
+  "toolspace"
+]);
+var SessionAuthorizationOperation = z.enum([
+  "session.read",
+  "session.events.read",
+  "session.stream.read",
+  "session.stream.acknowledge",
+  "session.turns.read",
+  "session.append",
+  "session.steer",
+  "session.control",
+  "session.queue.read",
+  "session.queue.control",
+  "session.composer.read",
+  "session.composer.write",
+  "session.lineage.read",
+  "session.capture.read",
+  "session.files.read",
+  "session.files.write",
+  "session.git.read",
+  "session.terminal.read",
+  "session.terminal.control",
+  "session.viewer.read",
+  "session.viewer.control",
+  "session.first_party_mcp.call",
+  "session.toolspace.call",
+  "session.pin.write",
+  "session.codex_account.write",
+  "session.context.write",
+  "session.approval.write",
+  "session.human_input.read",
+  "session.human_input.write",
+  "session.title.write",
+  "session.goal.read",
+  "session.goal.write",
+  "session.child.create"
+]);
+var SessionAuthorizationActor = z.discriminatedUnion("kind", [
+  z.object({
+    kind: z.literal("subject"),
+    subjectId: z.string().min(1),
+    subjectLabel: z.string().min(1).optional()
+  }),
+  z.object({
+    kind: z.literal("agent_attempt"),
+    /** Technical, authenticated first-party caller (not the host authority). */
+    subjectId: z.string().min(1),
+    callerSessionId: z.string().uuid(),
+    callerRootSessionId: z.string().uuid(),
+    turnId: z.string().uuid(),
+    attemptId: z.string().uuid(),
+    executionGeneration: z.number().int().positive(),
+    /** Frozen authority that admitted the calling turn. */
+    initiator: TurnInitiator,
+    initiatorContext: TurnInitiatorContext
+  })
+]);
+var SessionAuthorizationTarget = z.object({
+  sessionId: z.string().uuid(),
+  /** Server-resolved workspace lineage root; never accepted from a caller. */
+  rootSessionId: z.string().uuid()
+});
+var SessionAuthorizationDecision = z.discriminatedUnion("allowed", [
+  z.object({
+    allowed: z.literal(true),
+    /**
+     * Whether related-session metadata may be projected with the target.
+     * `target` is the fail-closed default for exact shares; `root` permits the
+     * target's full lineage tree. This does not authorize a separate operation
+     * against another session, which always requires its own decision.
+     */
+    relatedSessionAccess: z.enum(["target", "root"]).optional(),
+    /** A host may request a tighter stream reauthorization bound. */
+    reauthorizeAfterMs: z.number().int().min(1e3).max(6e4).optional()
+  }),
+  z.object({
+    allowed: z.literal(false),
+    reason: z.enum(["not_found", "forbidden", "revoked"])
+  })
+]);
+var SESSION_AUTHORIZATION_LIST_SCOPE_MAX_IDS = 1e4;
+var SessionAuthorizationListScope = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("all") }),
+  z.object({
+    kind: z.literal("scoped"),
+    rootSessionIds: z.array(z.string().uuid()).max(SESSION_AUTHORIZATION_LIST_SCOPE_MAX_IDS),
+    sessionIds: z.array(z.string().uuid()).max(SESSION_AUTHORIZATION_LIST_SCOPE_MAX_IDS)
+  })
+]);
 var SessionTurn = z.object({
   id: z.string().uuid(),
   workspaceId: z.string().uuid(),
@@ -1222,7 +2609,7 @@ var SessionTurn = z.object({
   temporalWorkflowId: z.string(),
   status: SessionTurnStatus,
   source: SessionTurnSource,
-  position: z.number().int().positive(),
+  position: z.number().int(),
   prompt: z.string().min(1),
   resources: z.array(ResourceRef),
   tools: z.array(ToolRef),
@@ -1232,55 +2619,492 @@ var SessionTurn = z.object({
   // Per-turn OS override. NULL = inherit the session's sandboxOs.
   sandboxOs: SandboxOs.nullable(),
   metadata: z.record(z.string(), z.unknown()),
+  version: z.number().int().positive(),
+  executionGeneration: z.number().int().nonnegative(),
+  activeAttemptId: z.string().uuid().nullable(),
+  lineage: z.record(z.string(), z.unknown()),
+  initiator: TurnInitiator,
+  initiatorContext: TurnInitiatorContext,
+  cancelledBy: z.string().nullable(),
+  cancelReason: z.string().nullable(),
   startedAt: z.string().nullable(),
   finishedAt: z.string().nullable(),
   createdAt: z.string(),
   updatedAt: z.string()
 });
-var UpdateSessionTurnRequest = z.object({
-  prompt: z.string().min(1).optional(),
-  resources: z.array(ResourceRef).optional(),
-  tools: z.array(ToolRef).optional(),
-  model: z.string().min(1).optional(),
-  reasoningEffort: ReasoningEffort.optional(),
-  sandboxBackend: SandboxBackend.optional(),
-  metadata: z.record(z.string(), z.unknown()).optional()
+var EffectiveControlBlocker = z.object({
+  kind: z.enum(["session", "workspace"]),
+  sessionId: z.string().uuid().optional(),
+  displayName: z.string().min(1),
+  actor: z.string().nullable(),
+  reason: z.string().nullable(),
+  changedAt: z.string().nullable(),
+  revision: z.number().int().nonnegative()
+});
+var EffectiveControlResumeOption = z.object({
+  scope: z.enum(["selected", "session", "workspace"]),
+  targetId: z.string().uuid().optional(),
+  selectedStateAfter: SessionControlState,
+  remainingPrimaryBlocker: EffectiveControlBlocker.optional(),
+  impactCopy: z.string().min(1)
+});
+var EffectiveSessionControl = z.object({
+  state: SessionControlState,
+  controlVersion: z.number().int().nonnegative(),
+  controlEtag: z.string().min(1),
+  directState: SessionControlState,
+  primaryBlocker: EffectiveControlBlocker.nullable(),
+  additionalBlockerCount: z.number().int().nonnegative(),
+  blockers: z.array(EffectiveControlBlocker),
+  resumeOptions: z.array(EffectiveControlResumeOption),
+  override: z.object({
+    rootSessionId: z.string().uuid(),
+    revision: z.number().int().nonnegative()
+  }).nullable(),
+  settlement: z.object({
+    state: z.literal("stopping"),
+    attemptCount: z.number().int().positive(),
+    interruptionPendingCount: z.number().int().nonnegative(),
+    quiescencePendingCount: z.number().int().nonnegative()
+  }).nullable()
+});
+var SESSION_OPERATION_KEY_MAX_CHARS = 256;
+var SessionOperationKey = z.string().min(1).max(SESSION_OPERATION_KEY_MAX_CHARS);
+var SessionCommandReceipt = z.object({
+  id: z.string().uuid(),
+  action: z.string().min(1),
+  operationKey: z.string().min(1).max(SESSION_OPERATION_KEY_MAX_CHARS),
+  targetSessionId: z.string().uuid().nullable(),
+  targetTurnId: z.string().uuid().nullable(),
+  appliedControlRevision: z.number().int().nonnegative().nullable(),
+  appliedQueueVersion: z.number().int().nonnegative().nullable(),
+  appliedTurnVersion: z.number().int().positive().nullable(),
+  appliedDraftRevision: z.number().int().positive().nullable(),
+  createdAt: z.string()
 });
-var ReorderSessionTurnsRequest = z.object({
-  turnIds: z.array(z.string().uuid()).min(1)
+var ComposerDraft = z.object({
+  revision: z.number().int().nonnegative(),
+  text: z.string(),
+  resources: z.array(ResourceRef),
+  tools: z.array(ToolRef),
+  model: z.string().min(1),
+  reasoningEffort: ReasoningEffort,
+  sourceTurnId: z.string().uuid().nullable(),
+  sourceTurnVersion: z.number().int().positive().nullable(),
+  updatedAt: z.string().nullable()
+});
+var SessionQueueSnapshot = z.object({
+  version: z.number().int().nonnegative(),
+  effectiveControl: EffectiveSessionControl,
+  /**
+   * True while the latest attempt is interrupted but has not durably proved
+   * quiescence: no more inference, user-visible output, or workspace-persistence
+   * authority. Temporal cancellation/terminalization is not that proof. This is
+   * distinct from ordinary capacity queueing, remains accurate with an empty
+   * visible queue, and is independent of Steer-row metadata or withdrawal.
+   */
+  stoppingPreviousAttempt: z.boolean(),
+  items: z.array(SessionTurn)
+});
+var MoveSessionQueueItemRequest = z.object({
+  clientEventId: SessionOperationKey,
+  expectedQueueVersion: z.number().int().nonnegative(),
+  beforeTurnId: z.string().uuid().nullable()
+});
+var EditSessionQueueItemRequest = z.object({
+  clientEventId: SessionOperationKey,
+  expectedTurnVersion: z.number().int().positive(),
+  expectedDraftRevision: z.number().int().nonnegative(),
+  replaceDraft: z.boolean()
+});
+var SteerSessionQueueItemRequest = z.object({
+  clientEventId: SessionOperationKey,
+  expectedTurnVersion: z.number().int().positive(),
+  controlEtag: z.string().min(1).optional()
+});
+var DeleteSessionQueueItemRequest = z.object({
+  clientEventId: SessionOperationKey,
+  expectedTurnVersion: z.number().int().positive(),
+  reason: z.string().min(1).optional()
+});
+var SaveComposerDraftRequest = ComposerDraft.pick({
+  text: true,
+  resources: true,
+  tools: true,
+  model: true,
+  reasoningEffort: true
+}).extend({ expectedRevision: z.number().int().nonnegative() });
+var WORKSPACE_CONTROL_REASON_MAX_BYTES = 8 * 1024;
+var WORKSPACE_CONTROL_ACTOR_MAX_BYTES = 1024;
+var WORKSPACE_CONTROL_EVENT_MAX_BYTES = 16 * 1024;
+var WorkspaceControlReason = z.string().min(1).refine((value) => !value.includes("\0"), "reason must not contain NUL bytes").refine(
+  (value) => workspaceControlUtf8Bytes(value) <= WORKSPACE_CONTROL_REASON_MAX_BYTES,
+  `reason must not exceed ${WORKSPACE_CONTROL_REASON_MAX_BYTES} UTF-8 bytes`
+);
+var SessionControlRequest = z.object({
+  action: z.enum(["pause", "resume"]),
+  reason: WorkspaceControlReason.optional(),
+  clientEventId: SessionOperationKey,
+  expectedControlEtag: z.string().min(1).optional()
+});
+var WorkspaceInferenceControlRequest = z.object({
+  action: z.enum(["pause", "resume"]),
+  reason: WorkspaceControlReason.optional(),
+  clientEventId: SessionOperationKey,
+  expectedRevision: z.number().int().nonnegative().optional()
+});
+var WorkspaceInferenceControlResponse = z.object({
+  receipt: SessionCommandReceipt,
+  state: SessionControlState,
+  revision: z.number().int().nonnegative(),
+  interruptionCount: z.number().int().nonnegative(),
+  wakeCount: z.number().int().nonnegative()
+});
+var WorkspaceControlEventTruncation = z.object({
+  truncated: z.literal(true),
+  surface: z.enum([
+    "durable_control",
+    "database_guard",
+    "http_projection",
+    "nats_legacy_guard",
+    "sse_legacy_guard"
+  ]),
+  deliveredBytes: z.number().int().nonnegative(),
+  fields: z.array(
+    z.object({
+      field: z.enum(["reason", "actor"]),
+      originalBytes: z.number().int().nonnegative(),
+      deliveredBytes: z.number().int().nonnegative(),
+      omittedBytes: z.number().int().nonnegative()
+    })
+  ),
+  fullEvidence: z.object({
+    available: z.literal(false),
+    reason: z.literal("not_retained")
+  })
+});
+var WorkspaceControlEvent = z.object({
+  id: z.string().uuid(),
+  workspaceId: z.string().uuid(),
+  sequence: z.number().int().positive(),
+  revision: z.number().int().positive(),
+  type: z.literal("workspace.control.changed"),
+  scope: z.enum(["workspace", "session"]),
+  rootSessionId: z.string().uuid().nullable(),
+  action: z.enum(["pause", "resume"]),
+  automatic: z.boolean(),
+  reason: z.string().nullable(),
+  actor: z.string().min(1),
+  occurredAt: z.string(),
+  truncation: WorkspaceControlEventTruncation.nullable().optional()
+});
+function workspaceControlUtf8Bytes(value) {
+  return new TextEncoder().encode(value).byteLength;
+}
+function boundWorkspaceControlEvent(event, options = {}) {
+  const existingFields = new Map(
+    (event.truncation?.fields ?? []).map((field) => [field.field, field])
+  );
+  const reason = event.reason === null ? null : boundWorkspaceControlText(event.reason, WORKSPACE_CONTROL_REASON_MAX_BYTES);
+  const actor = boundWorkspaceControlText(event.actor, WORKSPACE_CONTROL_ACTOR_MAX_BYTES);
+  const reasonBytes = reason === null ? 0 : workspaceControlUtf8Bytes(reason);
+  const actorBytes = workspaceControlUtf8Bytes(actor);
+  const reasonOriginalBytes = event.reason === null ? null : Math.max(
+    workspaceControlUtf8Bytes(event.reason),
+    normalizedWorkspaceControlOriginalBytes(options.reasonOriginalBytes),
+    existingFields.get("reason")?.originalBytes ?? 0
+  );
+  const actorOriginalBytes = Math.max(
+    workspaceControlUtf8Bytes(event.actor),
+    normalizedWorkspaceControlOriginalBytes(options.actorOriginalBytes),
+    existingFields.get("actor")?.originalBytes ?? 0
+  );
+  const fields = [];
+  if (reasonOriginalBytes !== null && reasonOriginalBytes > reasonBytes) {
+    fields.push({
+      field: "reason",
+      originalBytes: reasonOriginalBytes,
+      deliveredBytes: reasonBytes,
+      omittedBytes: reasonOriginalBytes - reasonBytes
+    });
+  }
+  if (actorOriginalBytes > actorBytes) {
+    fields.push({
+      field: "actor",
+      originalBytes: actorOriginalBytes,
+      deliveredBytes: actorBytes,
+      omittedBytes: actorOriginalBytes - actorBytes
+    });
+  }
+  if (fields.length === 0 && event.truncation == null) {
+    if (sessionEventJsonBytes(event) > WORKSPACE_CONTROL_EVENT_MAX_BYTES) {
+      throw new RangeError("Workspace control event exceeds its bounded envelope");
+    }
+    return event;
+  }
+  const truncation = {
+    truncated: true,
+    surface: event.truncation?.surface ?? options.surface ?? "durable_control",
+    deliveredBytes: 0,
+    fields,
+    fullEvidence: { available: false, reason: "not_retained" }
+  };
+  const bounded = {
+    ...event,
+    reason,
+    actor,
+    truncation
+  };
+  settleWorkspaceControlDeliveredBytes(bounded, truncation);
+  const deliveredBytes = sessionEventJsonBytes(bounded);
+  if (deliveredBytes > WORKSPACE_CONTROL_EVENT_MAX_BYTES) {
+    throw new RangeError(
+      `Bounded workspace control event exceeds its final envelope (${deliveredBytes} > ${WORKSPACE_CONTROL_EVENT_MAX_BYTES} bytes)`
+    );
+  }
+  return bounded;
+}
+function boundWorkspaceControlText(value, maxBytes) {
+  const encoder2 = new TextEncoder();
+  const decoder = new TextDecoder();
+  const bytes = encoder2.encode(value);
+  if (bytes.byteLength <= maxBytes) return value;
+  const marker = "\u2026[truncated]";
+  const prefixBudget = Math.max(0, maxBytes - encoder2.encode(marker).byteLength);
+  let prefixEnd = Math.min(prefixBudget, bytes.byteLength);
+  while (prefixEnd > 0 && prefixEnd < bytes.byteLength && (bytes[prefixEnd] & 192) === 128) {
+    prefixEnd -= 1;
+  }
+  return `${decoder.decode(bytes.subarray(0, prefixEnd))}${marker}`;
+}
+function normalizedWorkspaceControlOriginalBytes(value) {
+  return value === null || value === void 0 || !Number.isFinite(value) ? 0 : Math.max(0, Math.floor(value));
+}
+function settleWorkspaceControlDeliveredBytes(event, truncation) {
+  for (let attempt = 0; attempt < 16; attempt += 1) {
+    const deliveredBytes2 = sessionEventJsonBytes(event);
+    if (truncation.deliveredBytes === deliveredBytes2) return;
+    truncation.deliveredBytes = deliveredBytes2;
+  }
+  const deliveredBytes = sessionEventJsonBytes(event);
+  if (truncation.deliveredBytes !== deliveredBytes) {
+    throw new RangeError("Workspace control event byte accounting did not converge");
+  }
+}
+var SystemUpdateClassification = z.enum(["success", "failure", "action_required", "info"]);
+var SessionSystemUpdateKind = z.enum([
+  "scheduled_occurrence",
+  "goal_continuation",
+  "agent_message",
+  "agent_steer_instruction",
+  "child_terminal_result"
+]);
+var SessionSystemUpdatePayload = z.discriminatedUnion("type", [
+  z.object({
+    type: z.literal("scheduled_occurrence"),
+    text: z.string().min(1),
+    scheduledTaskId: z.string().uuid(),
+    scheduledTaskRunId: z.string().uuid(),
+    resources: z.array(ResourceRef).optional(),
+    tools: z.array(ToolRef).optional()
+  }).passthrough(),
+  z.object({
+    type: z.literal("goal_continuation"),
+    goalId: z.string().uuid(),
+    goalVersion: z.number().int().positive(),
+    prompt: z.string().min(1),
+    reason: z.string().optional()
+  }).passthrough(),
+  z.object({
+    type: z.literal("agent_message"),
+    text: z.string().min(1),
+    operationId: z.string().uuid()
+  }).passthrough(),
+  z.object({
+    type: z.literal("agent_steer_instruction"),
+    instruction: z.string().min(1),
+    operationId: z.string().uuid()
+  }).passthrough(),
+  z.object({
+    type: z.literal("child_terminal_result"),
+    childSessionId: z.string().uuid(),
+    status: z.enum(["idle", "failed"])
+  }).passthrough()
+]);
+var SessionSystemUpdateState = z.enum([
+  "pending",
+  "deferred",
+  "delivered",
+  "cancelled",
+  "superseded",
+  "failed"
+]);
+var SessionSystemUpdate = z.object({
+  id: z.string().uuid(),
+  sessionId: z.string().uuid(),
+  kind: SessionSystemUpdateKind,
+  classification: SystemUpdateClassification,
+  sourceId: z.string(),
+  dedupeKey: z.string(),
+  summary: z.string(),
+  payload: SessionSystemUpdatePayload,
+  lineage: z.record(z.string(), z.unknown()),
+  state: SessionSystemUpdateState,
+  deliveredTurnId: z.string().uuid().nullable(),
+  deliveredAt: z.string().nullable(),
+  createdAt: z.string()
 });
-var WorkspaceEnvironmentVariableName = z.string().regex(/^[A-Z][A-Z0-9_]*$/).max(128);
-var WorkspaceEnvironmentVariableMetadata = z.object({
-  name: WorkspaceEnvironmentVariableName,
+var VariableSetVariableName = z.string().regex(/^[A-Z][A-Z0-9_]*$/).max(128);
+function withVariableSetIdAlias(shape) {
+  return z.preprocess((input) => {
+    if (!input || typeof input !== "object" || Array.isArray(input)) {
+      return input;
+    }
+    const record = input;
+    if (record.variableSetId !== void 0 || record.environmentId === void 0) {
+      return record;
+    }
+    return { ...record, variableSetId: record.environmentId };
+  }, z.object(shape));
+}
+var VariableSetVariableMetadata = z.object({
+  name: VariableSetVariableName,
   version: z.number().int().positive(),
   createdAt: z.string(),
   updatedAt: z.string()
 });
-var WorkspaceEnvironment = z.object({
+var WorkspaceEnvironmentVariableMetadata = VariableSetVariableMetadata;
+var VariableSet = z.object({
   id: z.string().uuid(),
   accountId: z.string().uuid(),
   workspaceId: z.string().uuid(),
   name: z.string(),
   description: z.string().nullable(),
-  variables: z.array(WorkspaceEnvironmentVariableMetadata),
+  variables: z.array(VariableSetVariableMetadata),
   createdAt: z.string(),
   updatedAt: z.string()
 });
-var CreateWorkspaceEnvironmentRequest = z.object({
+var WorkspaceEnvironment = VariableSet;
+var CreateVariableSetRequest = z.object({
   name: z.string().min(1).max(120),
   description: z.string().max(2e3).optional(),
-  variables: z.array(z.object({
-    name: WorkspaceEnvironmentVariableName,
-    value: z.string().min(1).max(32768)
-  })).default([])
+  variables: z.array(
+    z.object({
+      name: VariableSetVariableName,
+      value: z.string().min(1).max(32768)
+    })
+  ).default([])
 });
-var UpdateWorkspaceEnvironmentRequest = z.object({
+var CreateWorkspaceEnvironmentRequest = CreateVariableSetRequest;
+var UpdateVariableSetRequest = z.object({
   name: z.string().min(1).max(120).optional(),
   description: z.string().max(2e3).nullable().optional()
 });
-var SetWorkspaceEnvironmentVariableRequest = z.object({
+var UpdateWorkspaceEnvironmentRequest = UpdateVariableSetRequest;
+var SetVariableSetVariableRequest = z.object({
   value: z.string().min(1).max(32768)
 });
+var SetWorkspaceEnvironmentVariableRequest = SetVariableSetVariableRequest;
+var RigCheck = z.object({
+  name: z.string().min(1).max(120),
+  command: z.string().min(1).max(8192)
+});
+var RigVersion = z.object({
+  id: z.string().uuid(),
+  rigId: z.string().uuid(),
+  version: z.number().int().positive(),
+  image: z.string().nullable(),
+  setupScript: z.string().nullable(),
+  checks: z.array(RigCheck),
+  credentialHooks: z.array(z.string()),
+  defaultVariableSetIds: z.array(z.string().uuid()),
+  changelog: z.string().nullable(),
+  // Attribution: 'user:<subject>' | 'session:<id>' | 'system'.
+  createdBy: z.string().nullable(),
+  active: z.boolean(),
+  createdAt: z.string()
+});
+var RigVerificationHealth = z.object({
+  checkHealth: z.enum(["passing", "failing", "unknown"]),
+  lastVerifiedAt: z.string().nullable()
+});
+var Rig = z.object({
+  id: z.string().uuid(),
+  accountId: z.string().uuid(),
+  workspaceId: z.string().uuid(),
+  name: z.string(),
+  description: z.string().nullable(),
+  createdBy: z.string().nullable(),
+  // The rig's currently-active version (present after create; nullable so a
+  // partial/list read can omit it without a schema change).
+  activeVersion: RigVersion.nullable(),
+  // Summary for the currently active version. null only when there is no active
+  // version; otherwise "unknown" means the active version has no verification.
+  activeVersionHealth: RigVerificationHealth.nullable(),
+  versionCount: z.number().int().nonnegative(),
+  createdAt: z.string(),
+  updatedAt: z.string()
+});
+var RigChangeKind = z.enum(["setup_append", "definition_edit"]);
+var RigChangeStatus = z.enum(["proposed", "verifying", "merged", "rejected", "failed"]);
+var RigCheckResult = z.object({
+  name: z.string(),
+  command: z.string(),
+  exitCode: z.number().int().nullable(),
+  output: z.string().optional()
+});
+var RigChangeVerification = z.object({
+  startedAt: z.string().optional(),
+  finishedAt: z.string().optional(),
+  log: z.string().optional(),
+  checkResults: z.array(RigCheckResult).optional()
+}).passthrough();
+var RigChange = z.object({
+  id: z.string().uuid(),
+  rigId: z.string().uuid(),
+  baseVersionId: z.string().uuid().nullable(),
+  kind: RigChangeKind,
+  payload: z.record(z.string(), z.unknown()),
+  status: RigChangeStatus,
+  proposedBy: z.string().nullable(),
+  verification: RigChangeVerification.nullable(),
+  resultVersionId: z.string().uuid().nullable(),
+  createdAt: z.string(),
+  updatedAt: z.string()
+});
+var CreateRigRequest = z.object({
+  name: z.string().min(1).max(120),
+  description: z.string().max(2e3).optional(),
+  // Initial (version 1) content, inline.
+  image: z.string().max(1024).optional(),
+  setupScript: z.string().max(131072).optional(),
+  checks: z.array(RigCheck).max(100).default([]),
+  credentialHooks: z.array(z.string().min(1).max(200)).max(50).default([]),
+  defaultVariableSetIds: z.array(z.string().uuid()).max(25).default([])
+});
+var UpdateRigRequest = z.object({
+  name: z.string().min(1).max(120).optional(),
+  description: z.string().max(2e3).nullable().optional()
+});
+var RigSetupAppendPayload = z.object({
+  command: z.string().min(1).max(8192),
+  note: z.string().max(2e3).optional()
+});
+var RigDefinitionEditPayload = z.object({
+  image: z.string().max(1024).nullish(),
+  setupScript: z.string().max(131072).nullish(),
+  checks: z.array(RigCheck).max(100).optional(),
+  credentialHooks: z.array(z.string().min(1).max(200)).max(50).optional(),
+  defaultVariableSetIds: z.array(z.string().uuid()).max(25).optional(),
+  changelog: z.string().max(4096).nullish()
+});
+var ProposeRigChangeRequest = z.discriminatedUnion("kind", [
+  z.object({ kind: z.literal("setup_append"), payload: RigSetupAppendPayload }),
+  z.object({
+    kind: z.literal("definition_edit"),
+    payload: RigDefinitionEditPayload
+  })
+]);
 var ScheduledTaskStatus = z.enum(["active", "paused"]);
 var ScheduledTaskRunStatus = z.enum(["queued", "dispatched", "failed"]);
 var ScheduledTaskRunMode = z.enum(["new_session_per_run", "reusable_session"]);
@@ -1328,7 +3152,13 @@ var ScheduledTask = z.object({
   overlapPolicy: ScheduledTaskOverlapPolicy,
   agentConfig: ScheduledTaskAgentConfig,
   reusableSessionId: z.string().uuid().nullable(),
-  environmentId: z.string().uuid().nullable(),
+  variableSetId: z.string().uuid().nullable().default(null),
+  /** @deprecated use variableSetId */
+  environmentId: z.string().uuid().nullable().default(null),
+  // The rig each run binds to (M3). Stored on the task; the ACTIVE version is
+  // resolved PER FIRE (at dispatch), so a task always runs the rig's current
+  // version rather than one frozen at task-create time. Null ⇒ rig-less runs.
+  rigId: z.string().uuid().nullable().default(null),
   metadata: z.record(z.string(), z.unknown()),
   createdAt: z.string(),
   updatedAt: z.string()
@@ -1348,24 +3178,31 @@ var ScheduledTaskRun = z.object({
   createdAt: z.string(),
   updatedAt: z.string()
 });
-var CreateScheduledTaskRequest = z.object({
+var CreateScheduledTaskRequest = withVariableSetIdAlias({
   name: z.string().min(1),
   schedule: ScheduledTaskScheduleSpec,
   runMode: ScheduledTaskRunMode.default("new_session_per_run"),
   overlapPolicy: ScheduledTaskOverlapPolicy.default("allow_concurrent"),
   agentConfig: ScheduledTaskAgentConfig,
   status: ScheduledTaskStatus.default("active"),
+  variableSetId: z.string().uuid().nullable().optional(),
   environmentId: z.string().uuid().nullable().optional(),
+  // The rig each run binds to (M3); its active version is resolved per fire.
+  rigId: z.string().uuid().nullable().optional(),
   metadata: z.record(z.string(), z.unknown()).default({})
 });
-var UpdateScheduledTaskRequest = z.object({
+var UpdateScheduledTaskRequest = withVariableSetIdAlias({
   name: z.string().min(1).optional(),
   schedule: ScheduledTaskScheduleSpec.optional(),
   runMode: ScheduledTaskRunMode.optional(),
   overlapPolicy: ScheduledTaskOverlapPolicy.optional(),
   agentConfig: ScheduledTaskAgentConfig.optional(),
   status: ScheduledTaskStatus.optional(),
+  variableSetId: z.string().uuid().nullable().optional(),
   environmentId: z.string().uuid().nullable().optional(),
+  // The rig each run binds to (M3); null clears it. Its active version is
+  // resolved per fire, so an update takes effect on the next dispatch.
+  rigId: z.string().uuid().nullable().optional(),
   metadata: z.record(z.string(), z.unknown()).optional()
 });
 var TriggerScheduledTaskRequest = z.object({
@@ -1421,12 +3258,20 @@ var CapabilityPackSkill = z.object({
   const seen = /* @__PURE__ */ new Set();
   skill.files.forEach((file, index) => {
     if (seen.has(file.path)) {
-      ctx.addIssue({ code: "custom", message: `duplicate skill file path: ${file.path}`, path: ["files", index, "path"] });
+      ctx.addIssue({
+        code: "custom",
+        message: `duplicate skill file path: ${file.path}`,
+        path: ["files", index, "path"]
+      });
     }
     seen.add(file.path);
   });
   if (!skill.files.some((file) => file.path === "SKILL.md")) {
-    ctx.addIssue({ code: "custom", message: "skill must include a top-level SKILL.md file", path: ["files"] });
+    ctx.addIssue({
+      code: "custom",
+      message: "skill must include a top-level SKILL.md file",
+      path: ["files"]
+    });
   }
 });
 function isSafePackSkillRelativePath(path) {
@@ -1435,39 +3280,71 @@ function isSafePackSkillRelativePath(path) {
   }
   return path.split("/").every((segment) => segment.length > 0 && segment !== "." && segment !== "..");
 }
-var CapabilityPack = z.object({
-  id: z.string().min(1),
-  name: z.string().min(1),
+var CapabilityPackVariableSet = z.object({
   description: z.string().min(1),
-  role: z.string().min(1),
-  category: z.string().min(1),
-  version: z.string().min(1),
-  // Container image ref (digest-pinned recommended) the pack's sessions run
-  // in. At most one enabled pack per workspace may declare one; with none,
-  // sessions use the deployment-wide image settings.
-  sandboxImage: z.string().trim().min(1).max(512).optional(),
-  // Skills delivered into the sandbox skill index when the pack is enabled.
-  skills: z.array(CapabilityPackSkill).max(32).superRefine((skills, ctx) => {
-    const seen = /* @__PURE__ */ new Set();
-    skills.forEach((skill, index) => {
-      const key = skill.name.toLowerCase();
-      if (seen.has(key)) {
-        ctx.addIssue({ code: "custom", message: `duplicate pack skill name: ${skill.name}`, path: [index, "name"] });
-      }
-      seen.add(key);
-    });
-  }).default([]),
-  tools: z.array(ToolRef).default([]),
-  connectors: z.array(CapabilityPackConnector).default([]),
-  knowledge: z.array(CapabilityPackKnowledge).default([]),
-  scheduledTaskTemplates: z.array(CapabilityPackScheduledTaskTemplate).default([]),
-  environment: z.object({
-    description: z.string().min(1),
-    requiredVariables: z.array(WorkspaceEnvironmentVariableName).default([]),
-    required: z.boolean().default(false)
-  }).optional(),
-  metadata: z.record(z.string(), z.unknown()).default({})
+  requiredVariables: z.array(VariableSetVariableName).default([]),
+  required: z.boolean().default(false)
 });
+var CapabilityPack = z.preprocess(
+  (input) => {
+    if (!input || typeof input !== "object" || Array.isArray(input)) {
+      return input;
+    }
+    const record = input;
+    if (record.variableSet !== void 0) {
+      return record;
+    }
+    if (record.environment !== void 0) {
+      const { environment: _environment, ...rest } = record;
+      return { ...rest, variableSet: record.environment };
+    }
+    if (record.requiredVariables !== void 0) {
+      const { requiredVariables: _requiredVariables, ...rest } = record;
+      return {
+        ...rest,
+        variableSet: {
+          description: "Required variables",
+          requiredVariables: record.requiredVariables,
+          required: Array.isArray(record.requiredVariables) && record.requiredVariables.length > 0
+        }
+      };
+    }
+    return record;
+  },
+  z.object({
+    id: z.string().min(1),
+    name: z.string().min(1),
+    description: z.string().min(1),
+    role: z.string().min(1),
+    category: z.string().min(1),
+    version: z.string().min(1),
+    // Container image ref (digest-pinned recommended) the pack's sessions run
+    // in. At most one enabled pack per workspace may declare one; with none,
+    // sessions use the deployment-wide image settings.
+    sandboxImage: z.string().trim().min(1).max(512).optional(),
+    // Skills delivered into the sandbox skill index when the pack is enabled.
+    skills: z.array(CapabilityPackSkill).max(32).superRefine((skills, ctx) => {
+      const seen = /* @__PURE__ */ new Set();
+      skills.forEach((skill, index) => {
+        const key = skill.name.toLowerCase();
+        if (seen.has(key)) {
+          ctx.addIssue({
+            code: "custom",
+            message: `duplicate pack skill name: ${skill.name}`,
+            path: [index, "name"]
+          });
+        }
+        seen.add(key);
+      });
+    }).default([]),
+    tools: z.array(ToolRef).default([]),
+    connectors: z.array(CapabilityPackConnector).default([]),
+    knowledge: z.array(CapabilityPackKnowledge).default([]),
+    scheduledTaskTemplates: z.array(CapabilityPackScheduledTaskTemplate).default([]),
+    variableSet: CapabilityPackVariableSet.optional(),
+    metadata: z.record(z.string(), z.unknown()).default({})
+  })
+);
 var RegisterCapabilityPackRequest = CapabilityPack;
 var WorkspaceRegisteredPack = z.object({
   accountId: z.string().uuid(),
@@ -1487,7 +3364,8 @@ var PackInstallation = z.object({
   enabledAt: z.string(),
   updatedAt: z.string()
 });
-var EnablePackRequest = z.object({
+var EnablePackRequest = withVariableSetIdAlias({
+  variableSetId: z.string().uuid().optional(),
   environmentId: z.string().uuid().optional(),
   metadata: z.record(z.string(), z.unknown()).default({})
 });
@@ -1555,14 +3433,6 @@ var CreateSocialPostRequest = z.object({
 });
 var ConnectionKind = z.enum(["oauth2", "api_key", "app_install", "delegated"]);
 var ConnectionStatus = z.enum(["active", "needs_reauth", "revoked", "error"]);
-var McpServerConnectionRef = z.object({
-  connectionId: z.string().uuid().optional(),
-  providerDomain: z.string().min(1),
-  kind: ConnectionKind.optional(),
-  scopes: z.array(z.string().min(1)).optional(),
-  resource: z.string().min(1).optional(),
-  subjectScope: z.enum(["workspace", "subject"]).optional()
-}).strict();
 var ConnectionMetadata = z.object({
   id: z.string().uuid(),
   accountId: z.string().uuid(),
@@ -1615,7 +3485,12 @@ var OAuthStartRequest = z.object({
   resource: z.string().url().optional(),
   requestedScopes: z.array(z.string().min(1)).default([]),
   returnPath: z.string().min(1).optional(),
-  connectionId: z.string().uuid().optional()
+  connectionId: z.string().uuid().optional(),
+  oauthClient: z.object({
+    clientId: z.string().min(1),
+    clientSecret: z.string().min(1).optional(),
+    tokenEndpointAuthMethod: z.enum(["none", "client_secret_post", "client_secret_basic"]).optional()
+  }).optional()
 }).refine((value) => Boolean(value.mcpUrl ?? value.resource), {
   message: "mcpUrl is required",
   path: ["mcpUrl"]
@@ -1646,7 +3521,14 @@ var MarketingDailyAnalysisTaskRequest = z.object({
   overlapPolicy: ScheduledTaskOverlapPolicy.default("skip")
 });
 var CapabilityKind = z.enum(["pack", "mcp", "api", "skill", "plugin"]);
-var CapabilitySource = z.enum(["built_in", "configured", "public_registry", "registry", "manual"]);
+var CapabilitySource = z.enum([
+  "built_in",
+  "library",
+  "configured",
+  "public_registry",
+  "registry",
+  "manual"
+]);
 var CapabilityInstallationStatus = z.enum(["active", "disabled"]);
 var CapabilityCatalogAuthKind = z.enum(["oauth2", "api_key", "none", "unknown"]);
 var CapabilityCatalogTier = z.enum(["verified", "community"]);
@@ -1686,6 +3568,15 @@ var CapabilityCatalogItem = z.object({
   runtime: CapabilityRuntime.default({ available: false, notes: null }),
   enabled: z.boolean().default(false),
   enabledReason: z.string().nullable().default(null),
+  // The connection backing this enabled installation, when the enable-time
+  // connectionRef resolved to one (null for header/credential-free items —
+  // that means "no connection involved", not "broken"). Lets the UI match
+  // connection health by id instead of guessing from providerDomain alone.
+  connectionRef: z.object({
+    connectionId: z.string().min(1),
+    providerDomain: z.string().min(1),
+    kind: z.string().min(1)
+  }).nullable().default(null),
   metadata: z.record(z.string(), z.unknown()).default({}),
   createdAt: z.string().optional(),
   updatedAt: z.string().optional()
@@ -1716,23 +3607,24 @@ var CreateCapabilityCatalogItemRequest = z.object({
   authModel: z.string().min(1).optional(),
   metadata: z.record(z.string(), z.unknown()).default({})
 });
-var EnableCapabilityRequest = z.object({
+var EnableCapabilityRequest = withVariableSetIdAlias({
   config: z.record(z.string(), z.unknown()).default({}),
   metadata: z.record(z.string(), z.unknown()).default({}),
   connectionRef: McpServerConnectionRef.optional(),
   /**
    * Credential headers for remote MCP capabilities (for example an
    * Authorization bearer token). Values are encrypted at rest with the
-   * workspace-environments key, injected only into the runtime MCP client,
+   * workspace-variable-sets key, injected only into the runtime MCP client,
    * and never returned by the API — responses expose header names only.
    */
   headers: z.record(z.string(), z.string()).default({}),
   /**
-   * Initial environment attachment for kind=pack capabilities. Mirrors the
+   * Initial variableSet attachment for kind=pack capabilities. Mirrors the
    * dedicated POST /packs/:id/enable body: required to enable an
-   * environment.required pack through the unified capability-enable path,
+   * variableSet.required pack through the unified capability-enable path,
    * optional otherwise. Ignored by non-pack capabilities.
    */
+  variableSetId: z.string().uuid().optional(),
   environmentId: z.string().uuid().optional()
 });
 var CapabilityCatalogResponse = z.object({
@@ -1759,6 +3651,9 @@ var Session = z.object({
   resources: z.array(ResourceRef),
   tools: z.array(ToolRef),
   metadata: z.record(z.string(), z.unknown()),
+  /** Frozen creator fact used only for creation attribution/idempotent repair. */
+  createdBy: TurnInitiator,
+  createdByContext: TurnInitiatorContext,
   model: z.string(),
   sandboxBackend: SandboxBackend,
   // The OS the session's box runs. Defaults to 'linux' (today's only OS).
@@ -1774,7 +3669,16 @@ var Session = z.object({
   // stale in-flight op and retry against the new active sandbox.
   activeSandboxId: z.string().uuid().nullable(),
   activeEpoch: z.number().int().nonnegative(),
-  environmentId: z.string().uuid().nullable(),
+  variableSetId: z.string().uuid().nullable().default(null),
+  /** @deprecated use variableSetId */
+  environmentId: z.string().uuid().nullable().default(null),
+  // The rig this session rides (M3 runtime binding). Both are resolved and
+  // FROZEN at session create: rigId names the rig, rigVersionId pins the exact
+  // active version the session's box/env/setup/doctrine are built from for the
+  // session's whole life (a later promote does NOT move an existing session).
+  // Both null ⇒ a rig-less session (byte-for-byte today's behavior).
+  rigId: z.string().uuid().nullable().default(null),
+  rigVersionId: z.string().uuid().nullable().default(null),
   // Non-default first-party MCP token permissions (manager-style sessions);
   // null means the fixed worker default set.
   firstPartyMcpPermissions: z.array(Permission).nullable(),
@@ -1793,9 +3697,13 @@ var Session = z.object({
   temporalWorkflowId: z.string().nullable(),
   activeTurnId: z.string().uuid().nullable(),
   // Actual input tokens of the last model call of the most recent turn; the
-  // pre-turn client-side context-compaction trigger reads it as its budget
+  // pre-turn portable context-compaction trigger reads it as its budget
   // signal. Null until a turn with usage has completed.
   lastInputTokens: z.number().int().nonnegative().nullable(),
+  queueVersion: z.number().int().nonnegative(),
+  queueHeadPosition: z.number().int(),
+  queueTailPosition: z.number().int(),
+  effectiveControl: EffectiveSessionControl,
   lastSequence: z.number().int().nonnegative(),
   // Multi-account Codex (P1). codexPinnedCredentialId: the account this session is
   // manually PINNED to (null ⇒ follow the workspace active pointer).
@@ -1803,32 +3711,91 @@ var Session = z.object({
   // "Running on:" indicator's source). Both are credential-row ids, null until set.
   codexPinnedCredentialId: z.string().uuid().nullable(),
   codexLastCredentialId: z.string().uuid().nullable(),
+  /** Personal (authenticated subject) workspace pin state, never workspace-global. */
+  pinned: z.boolean().default(false),
+  /** Stable pin ordering key; null when this subject has not pinned the session. */
+  pinnedAt: z.string().nullable().default(null),
+  /** Optimistic pin-state revision; zero represents an absent pin relation. */
+  pinVersion: z.number().int().nonnegative().default(0),
+  /**
+   * Server-authoritative hierarchy summary populated on session-list reads.
+   * Detail reads may omit it. The rail uses this instead of guessing a tree
+   * from whichever global recency page happened to be loaded.
+   */
+  treeStats: z.object({
+    directChildren: z.number().int().nonnegative(),
+    totalDescendants: z.number().int().nonnegative(),
+    runningDescendants: z.number().int().nonnegative(),
+    queuedDescendants: z.number().int().nonnegative(),
+    attentionDescendants: z.number().int().nonnegative(),
+    pausedDescendants: z.number().int().nonnegative(),
+    failedDescendants: z.number().int().nonnegative(),
+    /** Counts are lower bounds rather than exact totals when true. */
+    truncated: z.boolean().default(false)
+  }).optional(),
   createdAt: z.string(),
   updatedAt: z.string()
 });
+var CreateSessionResponse = Session.extend({
+  initialTurnId: z.string().uuid().nullable()
+});
+var SessionListResponse = z.object({
+  pinned: z.array(Session),
+  /** True when older matching pins were omitted from this bounded page. */
+  pinnedTruncated: z.boolean().optional(),
+  sessions: z.array(Session),
+  nextCursor: z.string().nullable()
+});
+var LineageNode = z.lazy(
+  () => z.object({
+    session: Session,
+    children: z.array(LineageNode)
+  })
+);
+var SessionLineageResponse = z.object({
+  ancestors: z.array(Session),
+  children: z.array(LineageNode),
+  truncated: z.boolean().default(false)
+});
 var SessionEventType = z.enum([
   "session.created",
+  // Defensive read/transport projection for a malformed or historically
+  // oversized retained event envelope. The original row stays durable; this
+  // explicit synthetic type prevents unbounded free-form envelope fields from
+  // crossing NATS, SSE, REST, or browser boundaries.
+  "session.event.envelope_omitted",
   "session.status.changed",
   "session.requiresAction",
+  "session.humanInput.requested",
+  "session.context.compaction.requested",
   "session.context.compacted",
+  "session.context.compaction.skipped",
   "session.context.cleared",
   "user.message",
-  "user.interrupt",
+  "user.pause",
   "user.approvalDecision",
+  "user.humanInputResponse",
   "turn.queued",
-  "turn.updated",
   "turn.started",
   "turn.completed",
   "turn.failed",
   "turn.cancelled",
-  "turn.preempted",
+  "turn.superseded",
+  "turn.recovery.requested",
+  "turn.capacity_waiting",
   "agent.message.delta",
   "agent.message.completed",
   "agent.reasoning.delta",
   "agent.toolCall.created",
   "agent.toolCall.output",
+  "agent.model.usage",
   "tool.auth_needed",
+  "credential.auth_needed",
   "agent.updated",
+  "rig.setup.started",
+  "rig.setup.completed",
+  "rig.setup.skipped",
+  "rig.setup.failed",
   "sandbox.operation.started",
   "sandbox.operation.completed",
   "sandbox.operation.failed",
@@ -1839,7 +3806,23 @@ var SessionEventType = z.enum([
   "goal.completed",
   "goal.paused",
   "goal.resumed",
+  "goal.cleared",
   "goal.continuation",
+  "system.update.pending",
+  "system.update.delivered",
+  "session.control.paused",
+  "session.control.resumed",
+  "session.control.steer_requested",
+  "workspace.inference.paused",
+  "workspace.inference.resumed",
+  "session.queue.changed",
+  "session.queue.prompt.cancelled",
+  "session.queue.history",
+  // A terminal/stale activity callback is retained as an audit wrapper rather
+  // than being dropped or emitted as though it belonged to the current turn.
+  "turn.event.rejected_late",
+  "memory.saved",
+  "memory.corrected",
   // Channel-B desktop pixel-plane signals (07-channel-b §1.2). The pixel socket
   // carries opaque RFB and cannot carry a control message the client can act on,
   // so these ride the durable, sequenced, gap-filled Channel-A SSE spine.
@@ -1851,8 +3834,8 @@ var SessionEventType = z.enum([
   // a viewer detached / was reaped
   "stream.revoked",
   // a grant was revoked → connected clients MUST disconnect now
-  // Channel-B recording signals (P4.3 / module 05 §3.4). The "agent films itself
-  // proving the fix" loop: ffmpeg x11grab of the SAME :0 humans watch → artifact
+  // Desktop recording signals. The capture loop records the same display humans
+  // watch, then stores the finalized artifact for replay.
   // → storage. The artifact ref rides the AVAILABLE event (storageKey, NOT a
   // long-lived URL — clients mint a short-TTL signed GET via the route).
   "recording.started",
@@ -1861,8 +3844,8 @@ var SessionEventType = z.enum([
   // finalized: bytes PUT to storage, replayable
   "recording.failed",
   // ffmpeg/box-death/rollover/upload error — no artifact
-  // Channel-A structured-service notifications (P4.4 / modules/08-channel-a.md
-  // §2.2). The A2 reads (fs/git/terminal exec) are SYNCHRONOUS API-direct point
+  // Structured-service notifications. File, Git, and terminal reads are
+  // synchronous API-direct point
   // queries (their result is the HTTP response, NEVER an event). What rides A1
   // here are the side-effect NOTIFICATIONS — a path changed, git state changed,
   // a pty opened/printed/exited — durable, sequenced, gap-filled like every
@@ -1883,19 +3866,239 @@ var SessionEventType = z.enum([
   // Multi-account Codex (P1): the account a session's turn runs on changed
   // (manual switch in P1; failover/rotation in P3 reuse the same event). Drives
   // the in-session "Running on:" indicator's live flip.
-  "codex.account.switched"
+  "codex.account.switched",
+  // credential allocator per-turn selection audit. Payload is metadata only: credential row
+  // id, bounded strategy/reason, and pool counts — never token material.
+  "codex.credential.selected",
+  // credential allocator durable zero-capacity wait lifecycle. Runtime/system events only;
+  // no synthetic user message is created when capacity returns.
+  "codex.capacity.waiting",
+  "codex.capacity.resumed",
+  "codex.capacity.superseded",
+  // Sandbox durability observability (sandbox-file-persistence). The 2026-07
+  // incidents (mid-session box death with /workspace loss; a fatal manifest-env
+  // delta on a live box) were near-unattributable because box lifecycle left no
+  // durable trace — only worker logs, which rotate within hours. These events
+  // make every box transition and env recomputation drift readable from the DB
+  // alone. Payloads carry ids/flags/key NAMES only — never env values (secrets).
+  "sandbox.box.created",
+  // box cold-created/cold-restored ({hydrated: "archive"|"none"})
+  "sandbox.box.lost",
+  // resume-by-id found the box gone (provider NotFound)
+  "sandbox.box.terminated",
+  // reaper drain terminated the box ({actor, persisted})
+  "sandbox.box.snapshot",
+  // mid-session /workspace snapshot persisted ({trigger})
+  "sandbox.env.drift",
+  // recomputed manifest env != live box env (key names only)
+  // Active-sandbox pointer reconcile (issue #341 invariant B). Turn start found the
+  // persisted (active_sandbox_id, active_epoch) pointing at a target the turn cannot
+  // establish — a deleted/absent sandbox, a Modal sibling with no establisher, or a
+  // selfhosted sandbox with no enrollment — and reset it to the session HOME under
+  // the epoch fence instead of routing every op into the dead target. A VISIBLE,
+  // never-silent downgrade: payload carries the typed reason + from/to epoch, never a
+  // target id or command content. Announce-only; hits the timeline projection default
+  // (no rendered item) like the other sandbox.* diagnostics.
+  "session.route.reconciled",
+  // Workbench v2 turn-end workspace capture. ANNOUNCE-ONLY: a new
+  // capture revision was persisted at turn end; the client refetches the latest
+  // capture. It carries metadata only (revision/turnId/capturedAt/leaseEpoch/stats),
+  // never file content. Hits the timeline projection default case (ignored) — it
+  // must NEVER gain a rendered timeline item without regenerating the golden
+  // snapshots (golden-grammar gate).
+  "workspace.revision.captured",
+  // Repository discovery could not prove a complete capture. The worker
+  // persisted a failed/degraded revision marker and clients must fall back to
+  // the live box rather than trust a zero-repository snapshot.
+  "workspace.revision.degraded",
+  // Connected Machine (selfhosted) op-outcome observability (failure-visibility
+  // doctrine, out-of-band plane). SESSION-scoped facts only: these fire for the
+  // session whose turn ran the op (the two-planes rule — machine-plane facts like
+  // pressure live in the M10 metrics DB, never as session events). Payloads carry
+  // the op kind + a typed fault class + attempt count — NEVER command content.
+  //
+  // `machine.op.failed` fires ONLY for INFRASTRUCTURE fault classes (offline,
+  // draining-exhausted, payload-too-large, reconnecting-timeout, OS/stream/protocol)
+  // — a semantic miss the model asked about (a missing path, a consent gate, a
+  // nonzero exit) is an OUTCOME, not an infra fault, and never fires this.
+  // `machine.op.recovered` is the healed-fault leading indicator (a blip/backpressure
+  // the transport absorbed): announce-only, quiet. Both hit the timeline projection's
+  // quiet status-tick tier (the severity split's "degraded"); adding a rendered item
+  // requires regenerating the golden snapshots (the golden-grammar gate).
+  "machine.op.failed",
+  "machine.op.recovered",
+  // Connected Machine (selfhosted) LINK-plane observability (failure-visibility
+  // doctrine). SESSION-scoped, ANNOUNCE-ONLY facts fanned out to the sessions that
+  // had an active op running on the machine when its control link changed — never
+  // to idle/historical sessions. Payloads carry ids / a typed reason / key-names
+  // only, NEVER command content.
+  //
+  // `machine.link.lost` — the machine announced a clean GoingOffline (its control
+  // link is going away) while a session had a running turn on it. `machine.link.
+  // restored` — a reconnect Hello re-established the link that was previously lost.
+  // `machine.runner.restarted` — the additional signal that the going-offline was
+  // a self-update restart specifically (link.lost also fires for it; this
+  // distinguishes a restart from a plain stop / host shutdown). All three hit the
+  // timeline projection's quiet default tier (no rendered item); adding a rendered
+  // item requires regenerating the golden snapshots (the golden-grammar gate).
+  "machine.link.lost",
+  "machine.link.restored",
+  "machine.runner.restarted"
 ]);
+var SessionEventSemanticClass = z.enum([
+  "control",
+  "terminal",
+  "failure",
+  "checkpoint",
+  "tool_receipt",
+  "provider_account"
+]);
+var SessionEventPayloadMode = z.enum(["none", "summary", "full"]);
+var SessionEventReadMode = z.enum(["monitoring", "forensic"]);
+var SessionEventReadDirection = z.enum(["after", "before"]);
+var SESSION_EVENT_RAW_DELTA_TYPES = [
+  "agent.message.delta",
+  "agent.reasoning.delta",
+  "sandbox.command.output.delta",
+  "terminal.pty.output.delta"
+];
+var SESSION_EVENT_SEMANTIC_CLASS_TYPES = {
+  control: [
+    "session.status.changed",
+    "session.requiresAction",
+    "session.humanInput.requested",
+    "user.pause",
+    "user.approvalDecision",
+    "user.humanInputResponse",
+    "goal.set",
+    "goal.updated",
+    "goal.completed",
+    "goal.paused",
+    "goal.resumed",
+    "goal.cleared",
+    "goal.continuation",
+    "system.update.pending",
+    "system.update.delivered",
+    "session.control.paused",
+    "session.control.resumed",
+    "session.control.steer_requested",
+    "workspace.inference.paused",
+    "workspace.inference.resumed",
+    "session.queue.changed",
+    "session.queue.prompt.cancelled"
+  ],
+  terminal: [
+    "turn.completed",
+    "turn.failed",
+    "turn.cancelled",
+    "turn.superseded",
+    "goal.completed",
+    "goal.paused",
+    "rig.setup.completed",
+    "rig.setup.skipped",
+    "rig.setup.failed",
+    "sandbox.operation.completed",
+    "sandbox.operation.failed",
+    "recording.available",
+    "recording.failed",
+    "terminal.pty.exited"
+  ],
+  failure: [
+    "session.event.envelope_omitted",
+    "turn.failed",
+    "tool.auth_needed",
+    "credential.auth_needed",
+    "rig.setup.failed",
+    "sandbox.operation.failed",
+    "recording.failed",
+    "sandbox.box.lost",
+    "workspace.revision.degraded",
+    "machine.op.failed",
+    "machine.link.lost"
+  ],
+  checkpoint: [
+    "session.context.compaction.requested",
+    "session.context.compacted",
+    "session.context.compaction.skipped",
+    "session.context.cleared",
+    "turn.recovery.requested",
+    "session.queue.history",
+    "sandbox.box.snapshot",
+    "workspace.revision.captured"
+  ],
+  tool_receipt: [
+    "agent.toolCall.created",
+    "agent.toolCall.output",
+    "tool.auth_needed",
+    "artifact.created"
+  ],
+  provider_account: [
+    "agent.model.usage",
+    "codex.account.switched",
+    "codex.credential.selected",
+    "codex.capacity.waiting",
+    "codex.capacity.resumed",
+    "codex.capacity.superseded",
+    "sandbox.box.created",
+    "sandbox.box.lost",
+    "sandbox.box.terminated",
+    "sandbox.box.snapshot",
+    "sandbox.env.drift",
+    "session.route.reconciled",
+    "machine.op.failed",
+    "machine.op.recovered",
+    "machine.link.lost",
+    "machine.link.restored",
+    "machine.runner.restarted"
+  ]
+};
+function resolveSessionEventTypeFilters(input) {
+  const included = new Set(input.includeTypes ?? []);
+  for (const semanticClass of input.includeClasses ?? []) {
+    for (const type of SESSION_EVENT_SEMANTIC_CLASS_TYPES[semanticClass]) included.add(type);
+  }
+  const excluded = new Set(input.excludeTypes ?? []);
+  for (const semanticClass of input.excludeClasses ?? []) {
+    for (const type of SESSION_EVENT_SEMANTIC_CLASS_TYPES[semanticClass]) excluded.add(type);
+  }
+  for (const type of input.defaultExcludeTypes ?? []) {
+    if (!included.has(type)) excluded.add(type);
+  }
+  for (const type of excluded) included.delete(type);
+  return { includeTypes: [...included], excludeTypes: [...excluded] };
+}
 var ToolAuthNeededPayload = z.object({
   serverId: z.string().min(1),
   toolName: z.string().min(1).nullable().optional(),
   providerDomain: z.string().min(1),
-  connectionId: z.string().uuid().nullable().optional(),
-  reason: z.enum(["missing_connection", "expired", "insufficient_scope", "refresh_failed"]),
+  provider: z.string().min(1).max(128).optional(),
+  // Embedded hosts may use an opaque connection identity; never assume an
+  // OpenGeni UUID on the public event wire.
+  connectionId: z.string().min(1).nullable().optional(),
+  reason: z.enum([
+    "missing_connection",
+    "expired",
+    "insufficient_scope",
+    "refresh_failed",
+    "unsupported_auth",
+    "resource_scope_unavailable"
+  ]),
   scopes: z.array(z.string().min(1)).optional(),
   resource: z.string().min(1).optional(),
+  selectedResources: McpConnectionResourceScopes.optional(),
   authorizationUrl: z.string().url().optional(),
   subjectId: z.string().min(1).nullable().optional()
 });
+var CredentialAuthNeededPayload = z.object({
+  credentialClass: z.literal("run"),
+  providerDomain: z.string().min(1).optional(),
+  connectionId: z.string().min(1).optional(),
+  reason: z.enum(["missing_connection", "expired", "insufficient_scope", "refresh_failed"]),
+  scopes: z.array(z.string().min(1)).optional(),
+  resource: z.string().min(1).optional(),
+  authorizationUrl: z.string().url().optional(),
+  message: z.string().min(1).optional()
+});
 var StreamUrlRotatedPayload = z.object({
   url: z.string().url(),
   token: z.string().nullable(),
@@ -1977,15 +4180,17 @@ var SandboxCommandOutputDeltaPayload = z.object({
 });
 var FsChangeKind = z.enum(["created", "modified", "deleted", "renamed"]);
 var FsChangedPayload = z.object({
-  changes: z.array(z.object({
-    path: z.string(),
-    // workspace-relative POSIX path
-    kind: FsChangeKind,
-    isDir: z.boolean().default(false),
-    sizeBytes: z.number().int().nonnegative().nullable().default(null),
-    oldPath: z.string().optional()
-    // for "renamed"
-  })).min(1),
+  changes: z.array(
+    z.object({
+      path: z.string(),
+      // workspace-relative POSIX path
+      kind: FsChangeKind,
+      isDir: z.boolean().default(false),
+      sizeBytes: z.number().int().nonnegative().nullable().default(null),
+      oldPath: z.string().optional()
+      // for "renamed"
+    })
+  ).min(1),
   source: z.enum(["write", "watch", "agent"]).default("write"),
   // Monotonic FS revision (per-lease, paired with leaseEpoch for staleness).
   revision: z.number().int().nonnegative(),
@@ -2028,16 +4233,18 @@ var TerminalPtyExitedPayload = z.object({
   reason: z.enum(["exit", "killed", "owner_gone", "timeout"])
 });
 var FsNodeType = z.enum(["file", "dir", "symlink", "other"]);
-var FsTreeNode = z.lazy(() => z.object({
-  name: z.string(),
-  path: z.string(),
-  type: FsNodeType,
-  sizeBytes: z.number().int().nonnegative().nullable(),
-  mtimeMs: z.number().int().nonnegative().nullable(),
-  mode: z.number().int().nullable(),
-  children: z.array(FsTreeNode).optional(),
-  truncated: z.boolean().default(false)
-}));
+var FsTreeNode = z.lazy(
+  () => z.object({
+    name: z.string(),
+    path: z.string(),
+    type: FsNodeType,
+    sizeBytes: z.number().int().nonnegative().nullable(),
+    mtimeMs: z.number().int().nonnegative().nullable(),
+    mode: z.number().int().nullable(),
+    children: z.array(FsTreeNode).optional(),
+    truncated: z.boolean().default(false)
+  })
+);
 var FsListRequest = z.object({
   path: z.string().default(""),
   // "" = workspace root
@@ -2089,7 +4296,9 @@ var FsDeleteRequest = z.object({
   recursive: z.boolean().default(false)
   // required true to delete a non-empty dir
 });
-var FsDeleteResponse = z.object({ revision: z.number().int().nonnegative() });
+var FsDeleteResponse = z.object({
+  revision: z.number().int().nonnegative()
+});
 var FsMoveRequest = z.object({
   path: z.string(),
   newPath: z.string(),
@@ -2186,6 +4395,9 @@ var GitDiffRequest = z.object({
   // diff selectors, mutually exclusive precedence: refs > staged > worktree
   staged: z.boolean().default(false),
   // --cached (index vs HEAD)
+  // Workspace review includes after-images that ordinary `git diff` omits.
+  // Explicit so commit/staged consumers keep native Git semantics by default.
+  includeUntracked: z.boolean().default(false),
   fromRef: z.string().optional(),
   toRef: z.string().optional(),
   pathspec: z.array(z.string()).default([]),
@@ -2196,6 +4408,125 @@ var GitDiffResponse = z.object({
   files: z.array(GitFileDiff),
   revision: z.number().int().nonnegative()
 });
+var WorkspaceCaptureFile = z.object({
+  path: z.string(),
+  status: GitFileStatusCode,
+  // sha256 of the captured after-image bytes; null when deleted / tooLarge.
+  hash: z.string().nullable(),
+  // git blob sha of the HEAD version — the wake-on-edit flush guard (design
+  // §10.1). null when the path is new/untracked (no HEAD blob).
+  baseHash: z.string().nullable(),
+  // Content-addressed storage key of the after-image; null when deleted /
+  // tooLarge / binary (no inline content captured).
+  contentRef: z.string().nullable(),
+  sizeBytes: z.number().int().nonnegative(),
+  isBinary: z.boolean().default(false),
+  // >5MB per-file content guard tripped: content NOT captured, render "open live".
+  tooLarge: z.boolean().default(false),
+  deleted: z.boolean().default(false)
+});
+var WorkspaceCaptureRepo = z.object({
+  root: z.string(),
+  head: z.string().nullable(),
+  detached: z.boolean().default(false),
+  upstream: z.string().nullable(),
+  ahead: z.number().int().nonnegative().default(0),
+  behind: z.number().int().nonnegative().default(0),
+  status: z.array(GitFileStatus),
+  diff: z.array(GitFileDiff)
+});
+var WorkspaceCaptureDegradedReason = z.enum([
+  "repository_discovery_command_failed",
+  "repository_discovery_timed_out",
+  "repository_discovery_result_limit_exceeded"
+]);
+var WorkspaceCaptureStats = z.object({
+  repoCount: z.number().int().nonnegative(),
+  fileCount: z.number().int().nonnegative(),
+  additions: z.number().int().nonnegative(),
+  deletions: z.number().int().nonnegative(),
+  totalBytes: z.number().int().nonnegative(),
+  tooLargeCount: z.number().int().nonnegative(),
+  binaryCount: z.number().int().nonnegative(),
+  treeEntryCount: z.number().int().nonnegative(),
+  treeTruncated: z.boolean().default(false),
+  durationMs: z.number().int().nonnegative(),
+  // sha256 over the change surface (per-file path/hash/status + per-repo diff
+  // summary, tree/mtime excluded). The empty-turn gate skips a capture whose
+  // fingerprint equals the previous revision's — "no new revision when nothing
+  // changed" holds even when the tree stays dirty across read-only turns.
+  fingerprint: z.string().optional()
+});
+var WorkspaceCaptureManifest = z.object({
+  version: z.literal(1),
+  revision: z.number().int().nonnegative(),
+  capturedAt: z.string(),
+  turnId: z.string().nullable(),
+  leaseEpoch: z.number().int().nonnegative(),
+  treeIndex: FsTreeNode,
+  treeTruncated: z.boolean().default(false),
+  repos: z.array(WorkspaceCaptureRepo),
+  files: z.array(WorkspaceCaptureFile),
+  stats: WorkspaceCaptureStats
+});
+var WorkspaceRevisionCapturedPayload = z.object({
+  revision: z.number().int().nonnegative(),
+  turnId: z.string().nullable(),
+  capturedAt: z.string(),
+  leaseEpoch: z.number().int().nonnegative(),
+  stats: WorkspaceCaptureStats
+});
+var WorkspaceRevisionDegradedPayload = z.object({
+  revision: z.number().int().nonnegative(),
+  turnId: z.string().nullable(),
+  capturedAt: z.string(),
+  leaseEpoch: z.number().int().nonnegative(),
+  reason: WorkspaceCaptureDegradedReason
+});
+var WorkspaceCaptureSignedUrl = z.object({
+  url: z.string().url(),
+  expiresAt: z.string()
+});
+var GetWorkspaceCaptureResponse = z.discriminatedUnion("available", [
+  z.object({
+    available: z.literal(false),
+    // Optional for additive compatibility with older servers. New servers set
+    // these fields when the newest durable revision is an explicit degraded
+    // marker rather than "no capture exists yet".
+    degradedReason: WorkspaceCaptureDegradedReason.nullable().optional(),
+    revision: z.number().int().nonnegative().nullable().optional(),
+    capturedAt: z.string().nullable().optional(),
+    turnId: z.string().nullable().optional(),
+    leaseEpoch: z.number().int().nonnegative().nullable().optional()
+  }),
+  z.object({
+    available: z.literal(true),
+    revision: z.number().int().nonnegative(),
+    capturedAt: z.string(),
+    turnId: z.string().nullable(),
+    leaseEpoch: z.number().int().nonnegative(),
+    sizeBytes: z.number().int().nonnegative(),
+    stats: WorkspaceCaptureStats,
+    manifest: WorkspaceCaptureManifest.nullable().default(null),
+    manifestUrl: WorkspaceCaptureSignedUrl.nullable().default(null)
+  })
+]);
+var GetWorkspaceCaptureFileResponse = z.object({
+  path: z.string(),
+  revision: z.number().int().nonnegative(),
+  status: GitFileStatusCode,
+  hash: z.string().nullable(),
+  baseHash: z.string().nullable(),
+  sizeBytes: z.number().int().nonnegative(),
+  isBinary: z.boolean(),
+  tooLarge: z.boolean(),
+  encoding: FsEncoding.nullable().default(null),
+  // set iff content is inline
+  content: z.string().nullable().default(null),
+  // inline ≤256KB (per encoding)
+  contentUrl: WorkspaceCaptureSignedUrl.nullable().default(null)
+  // signed >256KB
+});
 var GitLogRequest = z.object({
   path: z.string().default(""),
   ref: z.string().default("HEAD"),
@@ -2207,14 +4538,25 @@ var GitCommit = z.object({
   sha: z.string(),
   shortSha: z.string(),
   parents: z.array(z.string()),
-  author: z.object({ name: z.string(), email: z.string(), timestamp: z.number().int() }),
-  committer: z.object({ name: z.string(), email: z.string(), timestamp: z.number().int() }),
+  author: z.object({
+    name: z.string(),
+    email: z.string(),
+    timestamp: z.number().int()
+  }),
+  committer: z.object({
+    name: z.string(),
+    email: z.string(),
+    timestamp: z.number().int()
+  }),
   subject: z.string(),
   body: z.string(),
   refs: z.array(z.string()).default([])
   // decorations: branch/tag pointers
 });
-var GitLogResponse = z.object({ commits: z.array(GitCommit), hasMore: z.boolean() });
+var GitLogResponse = z.object({
+  commits: z.array(GitCommit),
+  hasMore: z.boolean()
+});
 var GitShowRequest = z.object({
   path: z.string().default(""),
   ref: z.string(),
@@ -2229,7 +4571,12 @@ var GitShowResponse = z.object({
   // null when fetching a raw blob
   files: z.array(GitFileDiff),
   // commit diff vs first parent
-  blob: z.object({ content: z.string(), encoding: FsEncoding, sizeBytes: z.number().int(), truncated: z.boolean() }).nullable(),
+  blob: z.object({
+    content: z.string(),
+    encoding: FsEncoding,
+    sizeBytes: z.number().int(),
+    truncated: z.boolean()
+  }).nullable(),
   revision: z.number().int().nonnegative()
 });
 var TerminalExecRequest = z.object({
@@ -2266,11 +4613,22 @@ var PtyOpenResponse = z.object({
   supportsInput: z.boolean()
   // false on backends without writeStdin
 });
-var PtyWriteRequest = z.object({ ptyId: z.string().uuid(), data: z.string() });
-var PtyResizeRequest = z.object({ ptyId: z.string().uuid(), cols: z.number().int().positive(), rows: z.number().int().positive() });
+var PtyWriteRequest = z.object({
+  ptyId: z.string().uuid(),
+  data: z.string()
+});
+var PtyResizeRequest = z.object({
+  ptyId: z.string().uuid(),
+  cols: z.number().int().positive(),
+  rows: z.number().int().positive()
+});
 var PtyCloseRequest = z.object({ ptyId: z.string().uuid() });
 var SessionStructuredCapabilities = z.object({
-  FileSystem: z.object({ available: z.boolean(), readOnly: z.boolean(), root: z.string() }),
+  FileSystem: z.object({
+    available: z.boolean(),
+    readOnly: z.boolean(),
+    root: z.string()
+  }),
   Terminal: z.object({
     events: z.boolean(),
     // command.output firehose (always on if a box exists)
@@ -2289,11 +4647,407 @@ var SessionEvent = z.object({
   type: SessionEventType,
   payload: z.unknown().default({}),
   occurredAt: z.string(),
-  clientEventId: z.string().min(1).nullable().optional(),
-  turnId: z.string().uuid().nullable().optional()
+  clientEventId: SessionOperationKey.nullable().optional(),
+  turnId: z.string().uuid().nullable().optional(),
+  turnGeneration: z.number().int().nonnegative().nullable().optional(),
+  turnAttemptId: z.string().uuid().nullable().optional(),
+  turnAssociation: z.enum(["current", "late_rejected", "duplicate"]).nullable().optional(),
+  duplicateOfEventId: z.string().uuid().nullable().optional(),
+  duplicateReason: z.string().min(1).max(1024).nullable().optional()
+});
+var OPENGENI_HOST_EXPORT_SCHEMA_REVISION = "2026-07-host-export-v1";
+var HostExportCursor = z.string().regex(/^(0|[1-9][0-9]*)$/);
+var HostExportConsumerId = z.string().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._:-]*$/);
+var HostExportInitiator = TurnInitiator.extend({
+  subjectId: z.string().min(1).max(1024),
+  label: z.string().min(1).max(256).optional()
+});
+var HostExportInitiatorContext = TurnInitiatorContext.refine(
+  (value) => {
+    try {
+      return new TextEncoder().encode(JSON.stringify(value)).byteLength <= 4096;
+    } catch {
+      return false;
+    }
+  },
+  { message: "Host export initiator context exceeds 4096 UTF-8 bytes" }
+);
+var HostExportAttribution = {
+  initiator: HostExportInitiator.nullable(),
+  initiatorContext: HostExportInitiatorContext,
+  origin: SessionTurnSource.nullable()
+};
+var HostSessionEvent = SessionEvent.extend({
+  type: z.string().min(1).max(256),
+  clientEventId: z.string().max(1024).nullable().optional(),
+  turnAssociation: z.string().min(1).max(64).nullable().optional(),
+  duplicateReason: z.string().max(4096).nullable().optional()
+});
+var HostUsageEvent = UsageEvent.extend({
+  subjectId: z.string().max(1024).nullable(),
+  eventType: z.string().min(1).max(256),
+  unit: z.string().min(1).max(128),
+  sourceResourceType: z.string().max(256).nullable(),
+  sourceResourceId: z.string().max(2048).nullable(),
+  idempotencyKey: z.string().min(1).max(2048),
+  billingProviderEventId: z.string().max(2048).nullable()
+});
+var HostEventExport = z.object({
+  schemaRevision: z.literal(OPENGENI_HOST_EXPORT_SCHEMA_REVISION),
+  cursor: HostExportCursor,
+  idempotencyKey: z.string().min(1).max(2048),
+  accountId: z.string().uuid(),
+  workspaceId: z.string().uuid(),
+  /**
+   * Immutable root of event.sessionId's session lineage at capture time. Null
+   * only for an unresolved pre-lineage/legacy export row.
+   */
+  rootSessionId: z.string().uuid().nullable(),
+  ...HostExportAttribution,
+  event: HostSessionEvent
 });
-var CreateSessionRequest = z.object({
+var HostUsageExport = z.object({
+  schemaRevision: z.literal(OPENGENI_HOST_EXPORT_SCHEMA_REVISION),
+  cursor: HostExportCursor,
+  accountId: z.string().uuid(),
+  workspaceId: z.string().uuid(),
+  sessionId: z.string().uuid().nullable(),
+  /** Null when sessionId is null or an unresolved pre-lineage legacy row. */
+  rootSessionId: z.string().uuid().nullable(),
+  turnId: z.string().uuid().nullable(),
+  turnAttemptId: z.string().uuid().nullable(),
+  ...HostExportAttribution,
+  usage: HostUsageEvent
+});
+var HostEventExportBatch = z.object({
+  schemaRevision: z.literal(OPENGENI_HOST_EXPORT_SCHEMA_REVISION),
+  consumerId: HostExportConsumerId,
+  leaseToken: z.string().uuid(),
+  checkpoint: HostExportCursor,
+  throughCursor: HostExportCursor,
+  events: z.array(HostEventExport).min(1).max(256)
+});
+var HostUsageExportBatch = z.object({
+  schemaRevision: z.literal(OPENGENI_HOST_EXPORT_SCHEMA_REVISION),
+  consumerId: HostExportConsumerId,
+  leaseToken: z.string().uuid(),
+  checkpoint: HostExportCursor,
+  throughCursor: HostExportCursor,
+  events: z.array(HostUsageExport).min(1).max(256)
+});
+var SESSION_EVENT_TYPE_MAX_BYTES = 256;
+var SESSION_EVENT_CLIENT_EVENT_ID_MAX_BYTES = SESSION_OPERATION_KEY_MAX_CHARS * 4;
+var SESSION_EVENT_TURN_ASSOCIATION_MAX_BYTES = 64;
+var SESSION_EVENT_DUPLICATE_REASON_MAX_BYTES = 4 * 1024;
+var SESSION_EVENT_ENVELOPE_MAX_BYTES = 80 * 1024;
+function boundSessionEvent(event, options = {}) {
+  const surface = options.surface ?? "durable_audit";
+  const maxBytes = Math.max(8 * 1024, options.maxBytes ?? SESSION_EVENT_ENVELOPE_MAX_BYTES);
+  const originalBytes = measureSessionEventJson(event).bytes;
+  const source = sessionEventOwnDataFields(event);
+  const id = canonicalSessionEventUuid(source.id, SESSION_EVENT_ZERO_UUID);
+  const workspaceId = canonicalSessionEventUuid(source.workspaceId, SESSION_EVENT_ZERO_UUID);
+  const sessionId = canonicalSessionEventUuid(source.sessionId, SESSION_EVENT_ZERO_UUID);
+  const sequence = source.sequence.readable && typeof source.sequence.value === "number" && Number.isSafeInteger(source.sequence.value) && source.sequence.value > 0 ? source.sequence.value : 1;
+  const occurredAt = source.occurredAt.readable && typeof source.occurredAt.value === "string" && sessionEventUtf8Bytes(source.occurredAt.value) <= 256 ? source.occurredAt.value : "1970-01-01T00:00:00.000Z";
+  const rawType = source.type.readable ? source.type.value : void 0;
+  const typeIsSafe = typeof rawType === "string" && sessionEventUtf8Bytes(rawType) <= SESSION_EVENT_TYPE_MAX_BYTES && !rawType.includes("\n") && !rawType.includes("\r");
+  const rawClientEventId = source.clientEventId.readable ? source.clientEventId.value : void 0;
+  const clientEventId = boundOptionalSessionEventText(
+    typeof rawClientEventId === "string" || rawClientEventId === null ? rawClientEventId : void 0,
+    SESSION_EVENT_CLIENT_EVENT_ID_MAX_BYTES
+  );
+  const rawTurnAssociation = source.turnAssociation.readable ? source.turnAssociation.value : void 0;
+  const turnAssociation = rawTurnAssociation === null || rawTurnAssociation === void 0 || rawTurnAssociation === "current" || rawTurnAssociation === "late_rejected" || rawTurnAssociation === "duplicate" ? rawTurnAssociation : null;
+  const rawDuplicateReason = source.duplicateReason.readable ? source.duplicateReason.value : void 0;
+  const duplicateReason = boundOptionalSessionEventText(
+    typeof rawDuplicateReason === "string" || rawDuplicateReason === null ? rawDuplicateReason : void 0,
+    SESSION_EVENT_DUPLICATE_REASON_MAX_BYTES
+  );
+  const turnId = canonicalOptionalSessionEventUuid(source.turnId);
+  const turnGeneration = canonicalSessionEventGeneration(source.turnGeneration);
+  const turnAttemptId = canonicalOptionalSessionEventUuid(source.turnAttemptId);
+  const duplicateOfEventId = canonicalOptionalSessionEventUuid(source.duplicateOfEventId);
+  const envelopeFields = [
+    sessionEventCustomSerializerProjection(event),
+    sessionEventAdditionalTopLevelFieldProjection(event),
+    !typeIsSafe ? sessionEventEnvelopeFieldProjection(
+      "type",
+      rawType,
+      "session.event.envelope_omitted",
+      source.type.readable
+    ) : null,
+    !source.clientEventId.readable || rawClientEventId !== clientEventId ? sessionEventEnvelopeFieldProjection(
+      "clientEventId",
+      rawClientEventId,
+      clientEventId,
+      source.clientEventId.readable
+    ) : null,
+    !source.turnAssociation.readable || rawTurnAssociation !== turnAssociation ? sessionEventEnvelopeFieldProjection(
+      "turnAssociation",
+      rawTurnAssociation,
+      turnAssociation,
+      source.turnAssociation.readable
+    ) : null,
+    !source.duplicateReason.readable || rawDuplicateReason !== duplicateReason ? sessionEventEnvelopeFieldProjection(
+      "duplicateReason",
+      rawDuplicateReason,
+      duplicateReason,
+      source.duplicateReason.readable
+    ) : null,
+    ...sessionEventCanonicalFieldProjections(source, {
+      id,
+      workspaceId,
+      sessionId,
+      sequence,
+      occurredAt
+    }),
+    ...sessionEventOptionalFieldProjections(source, {
+      turnId,
+      turnGeneration,
+      turnAttemptId,
+      duplicateOfEventId
+    }),
+    !source.payload.readable ? sessionEventEnvelopeFieldProjection("payload", void 0, null, false) : null
+  ].filter((field) => field !== null);
+  const rawPayload = source.payload.readable ? source.payload.value : "[event payload accessor omitted at bounded projection boundary]";
+  const payload = envelopeFields.length === 0 ? boundSessionEventPayload(rawPayload, { surface }) : boundSessionEventPayload(
+    {
+      preview: "[legacy event envelope normalized at bounded projection boundary]",
+      originalEventBytes: originalBytes,
+      originalType: typeof rawType === "string" ? boundSessionEventText(rawType, 256) : null,
+      envelopeProjection: {
+        truncated: true,
+        surface,
+        fields: envelopeFields
+      },
+      fullEvidence: { available: false, reason: "not_retained" }
+    },
+    { surface, maxBytes: 8 * 1024 }
+  );
+  const bounded = {
+    id,
+    workspaceId,
+    sessionId,
+    sequence,
+    type: typeIsSafe ? rawType : "session.event.envelope_omitted",
+    payload,
+    occurredAt,
+    ...sessionEventShouldEmitOptionalField(source.clientEventId) ? { clientEventId } : {},
+    ...sessionEventShouldEmitOptionalField(source.turnId) ? { turnId } : {},
+    ...sessionEventShouldEmitOptionalField(source.turnGeneration) ? { turnGeneration } : {},
+    ...sessionEventShouldEmitOptionalField(source.turnAttemptId) ? { turnAttemptId } : {},
+    ...sessionEventShouldEmitOptionalField(source.turnAssociation) ? { turnAssociation } : {},
+    ...sessionEventShouldEmitOptionalField(source.duplicateOfEventId) ? { duplicateOfEventId } : {},
+    ...sessionEventShouldEmitOptionalField(source.duplicateReason) ? { duplicateReason } : {}
+  };
+  if (sessionEventJsonBytes(bounded) <= maxBytes) return bounded;
+  const fallback = {
+    id,
+    workspaceId,
+    sessionId,
+    sequence,
+    type: "session.event.envelope_omitted",
+    payload: boundSessionEventPayload(
+      {
+        preview: "[legacy event envelope omitted at bounded projection boundary]",
+        originalEventBytes: originalBytes,
+        originalType: typeof rawType === "string" ? boundSessionEventText(rawType, 256) : null,
+        fullEvidence: { available: false, reason: "not_retained" }
+      },
+      { surface, maxBytes: 4 * 1024 }
+    ),
+    occurredAt,
+    ...sessionEventShouldEmitOptionalField(source.clientEventId) ? { clientEventId } : {},
+    ...sessionEventShouldEmitOptionalField(source.turnId) ? { turnId } : {},
+    ...sessionEventShouldEmitOptionalField(source.turnGeneration) ? { turnGeneration } : {},
+    ...sessionEventShouldEmitOptionalField(source.turnAttemptId) ? { turnAttemptId } : {},
+    ...sessionEventShouldEmitOptionalField(source.turnAssociation) ? { turnAssociation } : {},
+    ...sessionEventShouldEmitOptionalField(source.duplicateOfEventId) ? { duplicateOfEventId } : {},
+    ...sessionEventShouldEmitOptionalField(source.duplicateReason) ? { duplicateReason } : {}
+  };
+  const deliveredBytes = sessionEventJsonBytes(fallback);
+  if (deliveredBytes > maxBytes) {
+    throw new RangeError(
+      `Bounded session event exceeds its final envelope (${deliveredBytes} > ${maxBytes} bytes)`
+    );
+  }
+  return fallback;
+}
+function sessionEventEnvelopeFieldProjection(field, original, delivered, originalReadable = true) {
+  return {
+    field,
+    originalBytes: originalReadable ? typeof original === "string" ? sessionEventUtf8Bytes(original) : typeof original === "number" || typeof original === "boolean" ? sessionEventJsonBytes(original) : original === null || original === void 0 ? 0 : null : null,
+    deliveredBytes: typeof delivered === "string" ? sessionEventUtf8Bytes(delivered) : typeof delivered === "number" || typeof delivered === "boolean" ? sessionEventJsonBytes(delivered) : 0
+  };
+}
+function sessionEventCustomSerializerProjection(event) {
+  const projection = {
+    field: "toJSON",
+    originalBytes: null,
+    deliveredBytes: 0
+  };
+  let candidate = event;
+  try {
+    for (let depth = 0; depth <= SESSION_EVENT_PROTOTYPE_MAX_DEPTH; depth += 1) {
+      if (candidate === null) return null;
+      const descriptor = Object.getOwnPropertyDescriptor(candidate, "toJSON");
+      if (descriptor) {
+        return !("value" in descriptor) || typeof descriptor.value === "function" ? projection : null;
+      }
+      candidate = Object.getPrototypeOf(candidate);
+    }
+    return projection;
+  } catch {
+    return projection;
+  }
+}
+var SESSION_EVENT_PROTOTYPE_MAX_DEPTH = 32;
+var SESSION_EVENT_ZERO_UUID = "00000000-0000-4000-8000-000000000000";
+var SESSION_EVENT_UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var SESSION_EVENT_OWN_DATA_FIELDS = [
+  "id",
+  "workspaceId",
+  "sessionId",
+  "sequence",
+  "type",
+  "payload",
+  "occurredAt",
+  "clientEventId",
+  "turnId",
+  "turnGeneration",
+  "turnAttemptId",
+  "turnAssociation",
+  "duplicateOfEventId",
+  "duplicateReason"
+];
+var SESSION_EVENT_KNOWN_ENUMERABLE_FIELDS = /* @__PURE__ */ new Set([
+  ...SESSION_EVENT_OWN_DATA_FIELDS,
+  "toJSON"
+]);
+function sessionEventAdditionalTopLevelFieldProjection(event) {
+  const projection = {
+    field: "additionalTopLevelFields",
+    originalBytes: null,
+    deliveredBytes: 0
+  };
+  let inspected = 0;
+  try {
+    for (const key in event) {
+      inspected += 1;
+      if (inspected > SESSION_EVENT_KNOWN_ENUMERABLE_FIELDS.size + 1) return projection;
+      const descriptor = Object.getOwnPropertyDescriptor(event, key);
+      if (descriptor?.enumerable && !SESSION_EVENT_KNOWN_ENUMERABLE_FIELDS.has(key)) {
+        return projection;
+      }
+    }
+    return null;
+  } catch {
+    return projection;
+  }
+}
+function sessionEventOwnDataFields(event) {
+  return Object.fromEntries(
+    SESSION_EVENT_OWN_DATA_FIELDS.map((key) => {
+      try {
+        const descriptor = Object.getOwnPropertyDescriptor(event, key);
+        if (!descriptor) return [key, { readable: true, value: void 0 }];
+        return [
+          key,
+          "value" in descriptor ? { readable: true, value: descriptor.value } : { readable: false }
+        ];
+      } catch {
+        return [key, { readable: false }];
+      }
+    })
+  );
+}
+function canonicalSessionEventUuid(field, fallback) {
+  return field.readable && typeof field.value === "string" && SESSION_EVENT_UUID_PATTERN.test(field.value) ? field.value : fallback;
+}
+function canonicalOptionalSessionEventUuid(field) {
+  return field.readable && typeof field.value === "string" && SESSION_EVENT_UUID_PATTERN.test(field.value) ? field.value : null;
+}
+function canonicalSessionEventGeneration(field) {
+  return field.readable && typeof field.value === "number" && Number.isSafeInteger(field.value) && field.value >= 0 ? field.value : null;
+}
+function sessionEventShouldEmitOptionalField(field) {
+  return !field.readable || field.value !== void 0;
+}
+function sessionEventCanonicalFieldProjections(source, delivered) {
+  return ["id", "workspaceId", "sessionId", "sequence", "occurredAt"].flatMap(
+    (field) => {
+      const original = source[field].readable ? source[field].value : void 0;
+      return source[field].readable && original === delivered[field] ? [] : [
+        sessionEventEnvelopeFieldProjection(
+          field,
+          original,
+          delivered[field],
+          source[field].readable
+        )
+      ];
+    }
+  );
+}
+function sessionEventOptionalFieldProjections(source, delivered) {
+  return ["turnId", "turnGeneration", "turnAttemptId", "duplicateOfEventId"].flatMap(
+    (field) => {
+      const original = source[field].readable ? source[field].value : void 0;
+      const canonicalOriginal = original ?? null;
+      return source[field].readable && canonicalOriginal === delivered[field] ? [] : [
+        sessionEventEnvelopeFieldProjection(
+          field,
+          original,
+          delivered[field],
+          source[field].readable
+        )
+      ];
+    }
+  );
+}
+function boundOptionalSessionEventText(value, maxBytes) {
+  return typeof value === "string" ? boundSessionEventText(value, maxBytes) : value;
+}
+function boundSessionEventText(value, maxBytes) {
+  const encoder2 = new TextEncoder();
+  const decoder = new TextDecoder();
+  const bytes = encoder2.encode(value);
+  if (bytes.byteLength <= maxBytes) return value;
+  const marker = "\u2026[truncated]";
+  const markerBytes = encoder2.encode(marker).byteLength;
+  const prefixBudget = Math.max(0, maxBytes - markerBytes);
+  let prefixEnd = Math.min(prefixBudget, bytes.byteLength);
+  while (prefixEnd > 0 && prefixEnd < bytes.byteLength && (bytes[prefixEnd] & 192) === 128) {
+    prefixEnd -= 1;
+  }
+  return `${decoder.decode(bytes.subarray(0, prefixEnd))}${marker}`;
+}
+function sessionEventUtf8Bytes(value) {
+  return new TextEncoder().encode(value).byteLength;
+}
+var SessionQueueMutationResponse = z.object({
+  receipt: SessionCommandReceipt,
+  snapshot: SessionQueueSnapshot,
+  draft: ComposerDraft.optional()
+});
+var SessionControlResponse = z.object({
+  receipt: SessionCommandReceipt,
+  effectiveControl: EffectiveSessionControl,
+  interruptionCount: z.number().int().nonnegative(),
+  wakeCount: z.number().int().nonnegative()
+});
+var CreateSessionRequest = withVariableSetIdAlias({
+  /**
+   * Optional UUID preallocated by an embedding host. This lets the host durably
+   * link its own projection before OpenGeni admits the initial turn. Replays
+   * must pair it with the same idempotency key; OpenGeni never derives host
+   * identity or authorization from the UUID.
+   */
+  requestedSessionId: z.string().uuid().optional(),
   initialMessage: z.string().min(1),
+  // System-level host context for the initial turn only. Unlike `instructions`,
+  // this does not persist into later turns and is never emitted as a user event.
+  turnInstructions: z.string().trim().min(1).max(32768).optional(),
   // Per-session agent persona/system instructions (org-visible metadata, NOT a
   // secret). Rides the SAME system-level instructions channel the per-workspace
   // agentInstructions rides, composed AFTER the workspace persona so it refines
@@ -2301,9 +5055,16 @@ var CreateSessionRequest = z.object({
   // leaking them into the user-visible timeline (it is NEVER emitted as an
   // event, unlike goal/initialMessage). Trimmed, non-empty. The 32768-char cap
   // matches the codebase's largest free-form string convention (workspace
-  // environment variable values). Absent ⇒ byte-identical to today.
+  // variable set variable values). Absent ⇒ byte-identical to today.
   instructions: z.string().trim().min(1).max(32768).optional(),
+  // For an agent-created child, omission inherits the trusted immediate
+  // parent's repository/file context. An explicit array, including [], is
+  // authoritative. Top-level omission remains []. Presence is resolved from
+  // the raw request because this Zod default erases absent-vs-empty.
   resources: z.array(ResourceRef).default([]),
+  // The same child omission rule applies to selected MCP tool refs. Top-level
+  // omission still applies workspace-default capability MCP tools; explicit []
+  // suppresses those defaults (the first-party OpenGeni server remains added).
   tools: z.array(ToolRef).default([]),
   metadata: z.record(z.string(), z.unknown()).default({}),
   model: z.string().min(1).optional(),
@@ -2320,11 +5081,17 @@ var CreateSessionRequest = z.object({
   // (the agent's resolve_cwd handles both). Only valid WITH targetSandboxId
   // (workingDir alone is a 422); omitted ⇒ the machine's default workspace_root.
   workingDir: z.string().min(1).optional(),
-  // Workspace environment attachment is fixed at session creation; follow-up
+  // Variable set attachment is fixed at session creation; follow-up
   // user.message events cannot switch or add one.
+  variableSetId: z.string().uuid().optional(),
   environmentId: z.string().uuid().optional(),
+  // The rig to bind this session to (M3). Its ACTIVE version is resolved and
+  // FROZEN onto the session at create. Omitted ⇒ the workspace's default rig
+  // (workspaces.default_rig_id) when set, else a rig-less session (today's
+  // behavior). An id that does not name a rig in the workspace is a 422.
+  rigId: z.string().uuid().optional(),
   goal: GoalSpec.optional(),
-  clientEventId: z.string().min(1).optional(),
+  clientEventId: SessionOperationKey.optional(),
   // Workspace-scoped CREATE idempotency key: collapses concurrent/retried
   // create calls carrying the same key to a single session (partial unique
   // index on (workspace_id, create_idempotency_key)). Distinct from
@@ -2332,13 +5099,19 @@ var CreateSessionRequest = z.object({
   // creation of a brand-new session. Absent means no create-dedup (each call
   // is an independent create).
   idempotencyKey: z.string().min(1).max(200).optional(),
-  // Permissions the session's first-party MCP token should carry instead of
-  // the fixed worker default — how an operator hands a manager-style session
-  // the orchestration/environment/github tools. Capped at creation: every
-  // requested permission must be held by the creating grant (no escalation).
+  // Permissions the session's first-party MCP token should carry. A top-level
+  // omission uses the deployment's worker default; a child omission inherits
+  // the creating session's effective grant. An explicit set is capped at
+  // creation: every requested permission must be held by the creating grant.
+  // A goal-bearing session whose explicit/effective set omits goals:manage is
+  // rejected; creation never silently expands a child beyond that set.
   firstPartyMcpPermissions: z.array(Permission).optional(),
-  // Third-party MCP servers attached only to this session. Credential headers are
-  // write-only: create responses and events expose only SessionMcpServerMetadata.
+  // Third-party MCP servers attached only to this session. For an agent-created
+  // child, omission snapshots its trusted immediate parent's server definitions,
+  // policies, connection refs, and encrypted credentials. Explicit arrays,
+  // including [], are authoritative; non-empty explicit arrays require attach
+  // permission. Credential headers are write-only: create responses and events
+  // expose only SessionMcpServerMetadata.
   mcpServers: z.array(SessionMcpServerInput).default([]),
   // Shared-sandbox placement (addendum 05 §D.1). Three-way union; OMITTED ⇒
   // today's behavior (a context-dependent default resolved server-side: from
@@ -2352,47 +5125,195 @@ var CreateSessionRequest = z.object({
   // A shared spawn inherits the box's (backend, os) — it is literally the same
   // box; the child cannot pick its own backend. Cross-workspace sharing is
   // forbidden by construction (the parent/group reads are RLS-workspace-scoped).
-  // ENV-AWARE: the box's environment is fixed at creation, so a share requires
-  // the SAME environmentId as the creator's box. On a mismatch the inherited
+  // ENV-AWARE: the box's variable set is fixed at creation, so a share requires
+  // the SAME variableSetId as the creator's box. On a mismatch the inherited
   // default silently falls back to an own box; an explicit "shared"/{groupId}
   // request 422s at create (instead of the first turn dying on the SDK's
   // manifest-env guard).
-  sandbox: z.union([
-    z.literal("shared"),
-    z.literal("new"),
-    z.object({ groupId: z.string().uuid() })
-  ]).optional()
+  sandbox: z.union([z.literal("shared"), z.literal("new"), z.object({ groupId: z.string().uuid() })]).optional()
+});
+var HumanInputQuestionKind = z.enum(["text", "single_select", "multi_select"]);
+var HumanInputOption = z.object({
+  id: z.string().min(1).max(64),
+  label: z.string().min(1).max(256),
+  description: z.string().max(2048).nullable().optional()
+});
+var HumanInputQuestion = z.object({
+  id: z.string().min(1).max(64),
+  kind: HumanInputQuestionKind,
+  prompt: z.string().min(1).max(4096),
+  label: z.string().min(1).max(128).nullable().optional(),
+  helpText: z.string().max(2048).nullable().optional(),
+  options: z.array(HumanInputOption).max(20).default([]),
+  required: z.boolean().default(true),
+  allowOther: z.boolean().default(false),
+  validation: z.object({
+    minLength: z.number().int().nonnegative().max(8192).nullable().optional(),
+    maxLength: z.number().int().positive().max(8192).nullable().optional(),
+    minSelections: z.number().int().nonnegative().max(20).nullable().optional(),
+    maxSelections: z.number().int().positive().max(20).nullable().optional()
+  }).nullable().optional()
+}).superRefine((question, ctx) => {
+  const optionIds = new Set(question.options.map((option) => option.id));
+  if (optionIds.size !== question.options.length) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["options"],
+      message: "option ids must be unique"
+    });
+  }
+  if (question.kind === "text") {
+    if (question.options.length > 0) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["options"],
+        message: "text questions cannot have options"
+      });
+    }
+    if (question.allowOther) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["allowOther"],
+        message: "text questions do not use Other"
+      });
+    }
+  } else if (question.options.length === 0) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["options"],
+      message: "select questions require options"
+    });
+  }
+  const validation = question.validation;
+  if (validation?.minLength != null && validation?.maxLength != null && validation.minLength > validation.maxLength) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["validation"],
+      message: "minLength exceeds maxLength"
+    });
+  }
+  if (validation?.minSelections != null && validation?.maxSelections != null && validation.minSelections > validation.maxSelections) {
+    ctx.addIssue({
+      code: "custom",
+      path: ["validation"],
+      message: "minSelections exceeds maxSelections"
+    });
+  }
+});
+var HumanInputRequestStatus = z.enum([
+  "pending",
+  "answered",
+  "skipped",
+  "expired",
+  "cancelled"
+]);
+var RequestHumanInputToolInput = z.object({
+  questions: z.array(HumanInputQuestion).min(1).max(20),
+  allowSkip: z.boolean().default(false),
+  expiresInSeconds: z.number().int().positive().max(30 * 24 * 60 * 60).nullable().optional()
+});
+var HumanInputAnswer = z.object({
+  questionId: z.string().min(1).max(64),
+  values: z.array(z.string().max(8192)).max(20),
+  other: z.string().max(8192).nullable().optional()
+});
+var HumanInputResponse = z.discriminatedUnion("outcome", [
+  z.object({
+    outcome: z.literal("answered"),
+    answers: z.array(HumanInputAnswer).max(20)
+  }),
+  z.object({ outcome: z.literal("skipped") }),
+  z.object({ outcome: z.literal("expired") }),
+  z.object({ outcome: z.literal("cancelled") })
+]);
+var SubmitHumanInputResponseRequest = z.discriminatedUnion("outcome", [
+  z.object({
+    outcome: z.literal("answered"),
+    answers: z.array(HumanInputAnswer).max(20)
+  }),
+  z.object({ outcome: z.literal("skipped") })
+]);
+var SessionHumanInputRequest = z.object({
+  id: z.string().uuid(),
+  workspaceId: z.string().uuid(),
+  sessionId: z.string().uuid(),
+  turnId: z.string().uuid(),
+  turnGeneration: z.number().int().positive(),
+  creationAttemptId: z.string().uuid(),
+  toolCallId: z.string().min(1).max(1024),
+  status: HumanInputRequestStatus,
+  questions: z.array(HumanInputQuestion).min(1).max(20),
+  allowSkip: z.boolean(),
+  response: HumanInputResponse.nullable(),
+  respondedBy: z.string().max(1024).nullable(),
+  respondedAt: z.string().nullable(),
+  expiresAt: z.string().nullable(),
+  createdAt: z.string(),
+  updatedAt: z.string()
 });
+function approvalIdentifier(value) {
+  if (!value || typeof value !== "object") return null;
+  const approval = value;
+  const rawItem = approval.rawItem && typeof approval.rawItem === "object" ? approval.rawItem : null;
+  const candidate = rawItem?.callId ?? rawItem?.id ?? approval.id ?? approval.name;
+  if (typeof candidate !== "string" && typeof candidate !== "number") return null;
+  return String(candidate);
+}
 var ClientSessionEvent = z.discriminatedUnion("type", [
   z.object({
     type: z.literal("user.message"),
-    clientEventId: z.string().min(1).optional(),
+    clientEventId: SessionOperationKey.optional(),
     payload: z.object({
       text: z.string().min(1),
+      // System-level host context for this exact turn only. Persisted on the
+      // turn for retry/recovery, never copied into the visible user message.
+      turnInstructions: z.string().trim().min(1).max(32768).optional(),
       resources: z.array(ResourceRef).default([]),
       tools: z.array(ToolRef).default([]),
       model: z.string().min(1).optional(),
       reasoningEffort: ReasoningEffort.optional(),
+      controlEtag: z.string().min(1).optional(),
+      expectedDraftRevision: z.number().int().nonnegative().optional(),
       // Header-value rotation only. URL/name/tool settings are immutable after
       // session create; persisted events expose metadata, never header values.
       mcpCredentialUpdates: z.array(SessionMcpCredentialUpdateInput).optional()
     })
   }),
-  z.object({
-    type: z.literal("user.interrupt"),
-    clientEventId: z.string().min(1).optional(),
-    payload: z.object({ reason: z.string().optional() }).default({})
-  }),
   z.object({
     type: z.literal("user.approvalDecision"),
-    clientEventId: z.string().min(1).optional(),
+    clientEventId: SessionOperationKey.optional(),
     payload: z.object({
-      approvalId: z.string().min(1),
+      approvalId: z.string().min(1).max(SESSION_OPERATION_KEY_MAX_CHARS),
       decision: z.enum(["approve", "reject"]),
       message: z.string().optional()
     })
+  }),
+  z.object({
+    type: z.literal("user.humanInputResponse"),
+    clientEventId: SessionOperationKey.optional(),
+    payload: z.object({
+      requestId: z.string().uuid(),
+      response: SubmitHumanInputResponseRequest
+    })
   })
 ]);
+var SteerSessionMessageRequest = z.object({
+  text: z.string().min(1),
+  // Same per-turn system-level context as a queued user.message.
+  turnInstructions: z.string().trim().min(1).max(32768).optional(),
+  resources: z.array(ResourceRef).default([]),
+  tools: z.array(ToolRef).default([]),
+  model: z.string().min(1).optional(),
+  reasoningEffort: ReasoningEffort.optional(),
+  clientEventId: SessionOperationKey.optional(),
+  controlEtag: z.string().min(1).optional(),
+  expectedDraftRevision: z.number().int().nonnegative().optional(),
+  mcpCredentialUpdates: z.array(SessionMcpCredentialUpdateInput).optional()
+});
+var SteerSessionMessageResponse = z.object({
+  accepted: SessionEvent,
+  turn: SessionTurn
+});
 var SessionBusMessage = z.object({
   workspaceId: z.string().uuid(),
   sessionId: z.string().uuid(),
@@ -2416,6 +5337,29 @@ var GitHubRepository = z.object({
   accountLogin: z.string(),
   accountType: z.string().nullable()
 });
+var GitHubRepositoryScope = z.enum(["all", "selected"]);
+var GitHubInstallationBinding = z.object({
+  installationId: z.number().int().positive(),
+  accountLogin: z.string().nullable(),
+  accountType: z.string().nullable(),
+  repositoryScope: GitHubRepositoryScope,
+  repositoryCount: z.number().int().nonnegative(),
+  createdAt: z.string(),
+  updatedAt: z.string()
+});
+var GitHubAppInfo = z.object({
+  configured: z.boolean(),
+  appId: z.string().nullable(),
+  clientId: z.string().nullable(),
+  appSlug: z.string().nullable(),
+  installUrl: z.string().nullable(),
+  linkUrl: z.string().nullable(),
+  installations: z.array(GitHubInstallationBinding),
+  missing: z.array(z.string())
+});
+var GitHubRepositoriesResponse = z.object({
+  repositories: z.array(GitHubRepository)
+});
 var ClientAuthConfig = z.discriminatedUnion("mode", [
   z.object({
     mode: z.literal("none")
@@ -2544,7 +5488,7 @@ var ViewerHolder = z.object({
   leaseEpoch: z.number().int().nonnegative(),
   viewerHeartbeatIntervalMs: z.number().int().positive(),
   // The desktop pixel tunnel URL the viewer connects to directly; null until
-  // P4 mints it (gated until then).
+  // a viewer grant is minted (gated until then).
   dataPlaneUrl: z.string().nullable()
 });
 var AcknowledgeStreamRequest = z.object({
@@ -2611,7 +5555,13 @@ var DeviceEnrollmentApproveResponse = z.object({
 var DeviceEnrollmentPollRequest = z.object({
   deviceCode: z.string().min(1).max(256)
 });
-var DeviceEnrollmentState = z.enum(["pending", "authorized", "denied", "expired", "disabled"]);
+var DeviceEnrollmentState = z.enum([
+  "pending",
+  "authorized",
+  "denied",
+  "expired",
+  "disabled"
+]);
 var EnrollmentCredentialsResponse = z.object({
   agentId: z.string().uuid(),
   workspaceId: z.string().uuid(),
@@ -2774,7 +5724,18 @@ var SwapActiveSandboxResponse = z.object({
   swapped: z.boolean(),
   activeSandboxId: z.string().nullable(),
   activeEpoch: z.number().int(),
-  reason: z.string().optional()
+  reason: z.string().optional(),
+  // Typed rejection discriminant (issue #341). Present only when swapped is false,
+  // so a client distinguishes a deleted/absent target from an unaddressable
+  // enrollment from a backend the turn cannot establish from a lost epoch race —
+  // without parsing the human reason string.
+  code: z.enum([
+    "stale_pointer",
+    "offline_enrollment",
+    "unsupported_backend_context",
+    "transient_establishment",
+    "concurrent_swap"
+  ]).optional()
 });
 var MachineMetricsSeriesResponse = z.object({
   samples: z.array(MetricSample)
@@ -2788,8 +5749,11 @@ var ClientModel = z.object({
   api: z.enum(["responses", "chat"]),
   contextWindowTokens: z.number().int().positive().optional()
 });
+var OPENGENI_API_CONTRACT_REVISION = "2026-07-turn-instructions-v1";
+var OPENGENI_API_CONTRACT_HEADER = "x-opengeni-api-contract";
 var ClientConfig = z.object({
   deploymentRevision: z.string(),
+  apiContractRevision: z.literal(OPENGENI_API_CONTRACT_REVISION),
   // Release-train version of the server (absent on dev/source builds). The
   // compatibility policy lives in docs/architecture.md — clients within the
   // same major are supported; evolution is additive within a major.
@@ -2801,10 +5765,12 @@ var ClientConfig = z.object({
   models: z.array(ClientModel).default([]),
   defaultReasoningEffort: ReasoningEffort,
   allowedReasoningEfforts: z.array(ReasoningEffort).min(1),
-  mcpServers: z.array(z.object({
-    id: z.string(),
-    name: z.string()
-  })).default([]),
+  mcpServers: z.array(
+    z.object({
+      id: z.string(),
+      name: z.string()
+    })
+  ).default([]),
   fileUploads: z.object({
     enabled: z.boolean(),
     maxSizeBytes: z.number().int().positive()
@@ -2850,6 +5816,18 @@ function constantTimeEqual(actual, expected) {
   }
   return diff === 0;
 }
+function evaluateWorkspaceModelPolicy(policy, candidate) {
+  if (!policy) {
+    return { allowed: true };
+  }
+  if (policy.allowedProviders !== null && !policy.allowedProviders.includes(candidate.providerId)) {
+    return { allowed: false, reason: "provider" };
+  }
+  if (policy.allowedModels !== null && !policy.allowedModels.includes(candidate.modelId)) {
+    return { allowed: false, reason: "model" };
+  }
+  return { allowed: true };
+}
 export {
   AccessContext,
   AccessGrant,
@@ -2891,6 +5869,7 @@ export {
   CompactSessionContextRequest,
   CompactSessionContextResult,
   CompleteFileUploadResponse,
+  ComposerDraft,
   ConnectionCredentialBundle,
   ConnectionKind,
   ConnectionMetadata,
@@ -2906,14 +5885,19 @@ export {
   CreateFileUploadRequest,
   CreateFileUploadResponse,
   CreateKnowledgeMemoryRequest,
+  CreateRigRequest,
   CreateScheduledTaskRequest,
   CreateSessionRequest,
+  CreateSessionResponse,
   CreateSocialConnectionRequest,
   CreateSocialPostRequest,
+  CreateVariableSetRequest,
   CreateWorkspaceEnvironmentRequest,
   CreateWorkspaceRequest,
+  CredentialAuthNeededPayload,
   DESKTOP_STREAM_PORT,
   DelegatedAccessTokenPayload,
+  DeleteSessionQueueItemRequest,
   DeviceEnrollmentApproveRequest,
   DeviceEnrollmentApproveResponse,
   DeviceEnrollmentDenyRequest,
@@ -2933,6 +5917,10 @@ export {
   DocumentSearchRequest,
   DocumentSearchResult,
   DocumentStatus,
+  EditSessionQueueItemRequest,
+  EffectiveControlBlocker,
+  EffectiveControlResumeOption,
+  EffectiveSessionControl,
   EnableCapabilityRequest,
   EnablePackRequest,
   EnrollTokenExchangeRequest,
@@ -2971,8 +5959,13 @@ export {
   FsTreeNode,
   FsWriteRequest,
   FsWriteResponse,
+  GetWorkspaceCaptureFileResponse,
+  GetWorkspaceCaptureResponse,
   GitChangedPayload,
   GitCommit,
+  GitCredentialBindingId,
+  GitCredentialProvider,
+  GitCredentialRepositoryRef,
   GitDiffHunk,
   GitDiffLine,
   GitDiffLineType,
@@ -2981,15 +5974,36 @@ export {
   GitFileDiff,
   GitFileStatus,
   GitFileStatusCode,
+  GitHubAppInfo,
   GitHubAppManifestCreate,
+  GitHubInstallationBinding,
+  GitHubRepositoriesResponse,
   GitHubRepository,
+  GitHubRepositoryScope,
   GitLogRequest,
   GitLogResponse,
+  GitRepositoryAccess,
   GitShowRequest,
   GitShowResponse,
   GitStatusRequest,
   GitStatusResponse,
   GoalSpec,
+  HostEventExport,
+  HostEventExportBatch,
+  HostExportConsumerId,
+  HostExportCursor,
+  HostExportInitiator,
+  HostExportInitiatorContext,
+  HostSessionEvent,
+  HostUsageEvent,
+  HostUsageExport,
+  HostUsageExportBatch,
+  HumanInputAnswer,
+  HumanInputOption,
+  HumanInputQuestion,
+  HumanInputQuestionKind,
+  HumanInputRequestStatus,
+  HumanInputResponse,
   IntegrationClientMetadata,
   KnowledgeMemory,
   KnowledgeMemoryKind,
@@ -2999,6 +6013,7 @@ export {
   KnowledgeSourceRef,
   LimitAction,
   LimitDecision,
+  LineageNode,
   ListConnectionsResponse,
   ListEnrollmentsResponse,
   ListWorkspaceMembersResponse,
@@ -3009,16 +6024,22 @@ export {
   MachinesResponse,
   ManagedAccount,
   MarketingDailyAnalysisTaskRequest,
+  McpConnectionResourceScope,
   McpServerConnectionRef,
   MetricSample,
   MintEnrollTokenRequest,
   MintEnrollTokenResponse,
+  MoveSessionQueueItemRequest,
   OAuthStartRequest,
   OAuthStartResponse,
+  OPENGENI_API_CONTRACT_HEADER,
+  OPENGENI_API_CONTRACT_REVISION,
+  OPENGENI_HOST_EXPORT_SCHEMA_REVISION,
   PackInstallation,
   PackInstallationStatus,
   Permission,
   ProductAccessMode,
+  ProposeRigChangeRequest,
   PtyCloseRequest,
   PtyOpenRequest,
   PtyOpenResponse,
@@ -3034,15 +6055,38 @@ export {
   RecordingStartedPayload,
   RegisterCapabilityPackRequest,
   RelayTokenPayload,
-  ReorderSessionTurnsRequest,
   RepositoryResourceRef,
+  RequestHumanInputToolInput,
+  ResourceMountPathError,
   ResourceRef,
   ResourceRefConflictError,
   RevokeEnrollmentResponse,
+  Rig,
+  RigChange,
+  RigChangeKind,
+  RigChangeStatus,
+  RigChangeVerification,
+  RigCheck,
+  RigCheckResult,
+  RigDefinitionEditPayload,
+  RigSetupAppendPayload,
+  RigVerificationHealth,
+  RigVersion,
+  SESSION_AUTHORIZATION_LIST_SCOPE_MAX_IDS,
+  SESSION_EVENT_CLIENT_EVENT_ID_MAX_BYTES,
+  SESSION_EVENT_DUPLICATE_REASON_MAX_BYTES,
+  SESSION_EVENT_ENVELOPE_MAX_BYTES,
+  SESSION_EVENT_PAYLOAD_MAX_BYTES,
+  SESSION_EVENT_RAW_DELTA_TYPES,
+  SESSION_EVENT_SEMANTIC_CLASS_TYPES,
+  SESSION_EVENT_TURN_ASSOCIATION_MAX_BYTES,
+  SESSION_EVENT_TYPE_MAX_BYTES,
+  SESSION_OPERATION_KEY_MAX_CHARS,
   SandboxBackend,
   SandboxCapabilityName,
   SandboxCommandOutputDeltaPayload,
   SandboxOs,
+  SaveComposerDraftRequest,
   ScheduledTask,
   ScheduledTaskAgentConfig,
   ScheduledTaskOverlapPolicy,
@@ -3052,36 +6096,68 @@ export {
   ScheduledTaskScheduleSpec,
   ScheduledTaskStatus,
   ScheduledTaskTriggerType,
+  ServiceTurnInitiator,
+  ServiceTurnInitiatorContext,
   Session,
+  SessionAuthorizationActor,
+  SessionAuthorizationDecision,
+  SessionAuthorizationListScope,
+  SessionAuthorizationOperation,
+  SessionAuthorizationSurface,
+  SessionAuthorizationTarget,
   SessionBusMessage,
   SessionCapabilities,
+  SessionCommandReceipt,
+  SessionControlRequest,
+  SessionControlResponse,
+  SessionControlState,
   SessionEvent,
+  SessionEventPayloadMode,
+  SessionEventReadDirection,
+  SessionEventReadMode,
+  SessionEventSemanticClass,
   SessionEventType,
   SessionGoal,
   SessionGoalCreatedBy,
   SessionGoalPausedReason,
   SessionGoalStatus,
+  SessionHumanInputRequest,
+  SessionLineageResponse,
+  SessionListResponse,
   SessionMcpCredentialUpdateInput,
   SessionMcpServerInput,
   SessionMcpServerMetadata,
+  SessionQueueMutationResponse,
+  SessionQueueSnapshot,
   SessionStatus,
   SessionStructuredCapabilities,
+  SessionSystemUpdate,
+  SessionSystemUpdateKind,
+  SessionSystemUpdatePayload,
+  SessionSystemUpdateState,
   SessionTurn,
   SessionTurnSource,
   SessionTurnStatus,
+  SetVariableSetVariableRequest,
+  SetWorkspaceDefaultRigRequest,
   SetWorkspaceEnvironmentVariableRequest,
   SocialConnection,
   SocialConnectionStatus,
   SocialPost,
   SocialProvider,
   StaticUsageLimits,
+  SteerSessionMessageRequest,
+  SteerSessionMessageResponse,
+  SteerSessionQueueItemRequest,
   StreamClosedPayload,
   StreamOpenedPayload,
   StreamRevokedPayload,
   StreamTokenPayload,
   StreamUrlRotatedPayload,
+  SubmitHumanInputResponseRequest,
   SwapActiveSandboxRequest,
   SwapActiveSandboxResponse,
+  SystemUpdateClassification,
   TERMINAL_STREAM_PORT,
   TerminalExecRequest,
   TerminalExecResponse,
@@ -3090,34 +6166,93 @@ export {
   TerminalPtyStartedPayload,
   ToolAuthNeededPayload,
   ToolRef,
+  TranscriptionErrorCode,
+  TranscriptionEvent,
+  TranscriptionResultMetadata,
+  TranscriptionSpeaker,
+  TranscriptionTimeSpan,
+  TranscriptionWord,
   TriggerScheduledTaskRequest,
+  TurnInitiator,
+  TurnInitiatorContext,
+  UNATTRIBUTED_LEGACY_INITIATOR_SUBJECT_ID,
   UpdateConnectionRequest,
   UpdateKnowledgeMemoryRequest,
+  UpdateRigRequest,
   UpdateScheduledTaskRequest,
   UpdateSessionGoalRequest,
+  UpdateSessionPinRequest,
   UpdateSessionRequest,
-  UpdateSessionTurnRequest,
+  UpdateVariableSetRequest,
   UpdateWorkspaceEnvironmentRequest,
   UpdateWorkspaceMemberRequest,
+  UpdateWorkspaceModelPolicyRequest,
   UpdateWorkspaceRequest,
+  UpdateWorkspaceSettingsRequest,
   UsageEvent,
   UsageEventType,
   UsageLimitsMode,
+  VariableSet,
+  VariableSetVariableMetadata,
+  VariableSetVariableName,
   ViewerHeartbeatRequest,
   ViewerHeartbeatResponse,
   ViewerHolder,
+  WORKSPACE_CONTROL_ACTOR_MAX_BYTES,
+  WORKSPACE_CONTROL_EVENT_MAX_BYTES,
+  WORKSPACE_CONTROL_REASON_MAX_BYTES,
   Workspace,
+  WorkspaceCaptureDegradedReason,
+  WorkspaceCaptureFile,
+  WorkspaceCaptureManifest,
+  WorkspaceCaptureRepo,
+  WorkspaceCaptureSignedUrl,
+  WorkspaceCaptureStats,
+  WorkspaceControlEvent,
+  WorkspaceControlEventTruncation,
   WorkspaceEnvironment,
   WorkspaceEnvironmentVariableMetadata,
-  WorkspaceEnvironmentVariableName,
+  WorkspaceInferenceControlRequest,
+  WorkspaceInferenceControlResponse,
+  WorkspaceInferenceState,
   WorkspaceMember,
+  WorkspaceMemorySearchMode,
+  WorkspaceMemorySearchRequest,
+  WorkspaceMemorySearchResponse,
+  WorkspaceMemorySearchResult,
   WorkspaceRegisteredPack,
+  WorkspaceRevisionCapturedPayload,
+  WorkspaceRevisionDegradedPayload,
+  WorkspaceSettingsSchema,
+  WorkspaceTranscriptionPolicy,
+  WorkspaceTranscriptionTarget,
+  approvalIdentifier,
+  approximateSessionEventTokens,
+  assertUniqueResourceMountPaths,
+  boundSessionEvent,
+  boundSessionEventPayload,
+  boundWorkspaceControlEvent,
+  defaultRepositoryMountPath,
+  evaluateWorkspaceModelPolicy,
+  gitCredentialBindingIdForRepository,
+  gitCredentialProviderForRepository,
   isClearedRunStateBlob,
+  measureSessionEventJson,
   mergeResourceRefs,
   mergeToolRefs,
+  normalizeRepositorySubpath,
+  normalizeResourceMountPath,
   prefixedMcpToolName,
   reasoningEffortForMetadata,
+  resolveSessionEventTypeFilters,
+  resolveWorkspaceMemoryEnabled,
   resourceIdentityKey,
+  resourceMountPath,
+  resourceMountPathCollisionKey,
+  sessionEventJsonBytes,
+  sessionEventMediaPreview,
+  sessionEventMediaPreviewFromDataUrl,
+  sessionEventPayloadTruncation,
   signDelegatedAccessToken,
   signEnrollToken,
   signEnrollmentBearer,
@@ -3128,6 +6263,7 @@ export {
   verifyEnrollToken,
   verifyEnrollmentBearer,
   verifyRelayToken,
-  verifyStreamToken
+  verifyStreamToken,
+  workspaceControlUtf8Bytes
 };
 //# sourceMappingURL=index.js.map