@opengeni/contracts 2.2.0-canary.0 → 2.5.0-canary.0

package/dist/remember.d.ts

@@ -2,7 +2,7 @@ import { z } from "zod";
 /**
  * Explicit user-directed durable write ("remember X for this workspace").
  *
- * The lane is the Company Brain area the content belongs to:
+ * The lane is the Agent Knowledge area the content belongs to:
  * - `preference`: a Ways-of-working preference (how agents should act);
  * - `instruction_policy`: a mandatory workspace rule ("always"/"never");
  * - `knowledge`: a company/product/people fact.
@@ -120,10 +120,11 @@ export declare const RememberActivationSummary: z.ZodDiscriminatedUnion<[z.ZodOb
     destination: z.ZodLiteral<"knowledge">;
     receiptId: z.ZodString;
     claimId: z.ZodString;
+    memoryId: z.ZodString;
     approvalReviewId: z.ZodString;
     effectiveAt: z.ZodNullable<z.ZodString>;
     authorityKind: z.ZodLiteral<"human_confirmed">;
-    undo: z.ZodLiteral<"knowledge_review">;
+    undo: z.ZodLiteral<"memory_management">;
 }, z.core.$strip>], "destination">;
 export type RememberActivationSummary = z.infer<typeof RememberActivationSummary>;
 export declare const RememberReceipt: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -205,10 +206,11 @@ export declare const RememberReceipt: z.ZodDiscriminatedUnion<[z.ZodObject<{
         destination: z.ZodLiteral<"knowledge">;
         receiptId: z.ZodString;
         claimId: z.ZodString;
+        memoryId: z.ZodString;
         approvalReviewId: z.ZodString;
         effectiveAt: z.ZodNullable<z.ZodString>;
         authorityKind: z.ZodLiteral<"human_confirmed">;
-        undo: z.ZodLiteral<"knowledge_review">;
+        undo: z.ZodLiteral<"memory_management">;
     }, z.core.$strip>], "destination">;
 }, z.core.$strip>, z.ZodObject<{
     status: z.ZodLiteral<"confirmation_required">;
@@ -322,10 +324,11 @@ export declare const RememberConfirmReceipt: z.ZodObject<{
         destination: z.ZodLiteral<"knowledge">;
         receiptId: z.ZodString;
         claimId: z.ZodString;
+        memoryId: z.ZodString;
         approvalReviewId: z.ZodString;
         effectiveAt: z.ZodNullable<z.ZodString>;
         authorityKind: z.ZodLiteral<"human_confirmed">;
-        undo: z.ZodLiteral<"knowledge_review">;
+        undo: z.ZodLiteral<"memory_management">;
     }, z.core.$strip>], "destination">;
 }, z.core.$strip>;
 export type RememberConfirmReceipt = z.infer<typeof RememberConfirmReceipt>;

package/dist/session-titles.d.ts

@@ -0,0 +1,23 @@
+/** Human-authored session titles keep the existing public API ceiling. */
+export declare const SESSION_TITLE_MAX_CHARACTERS = 200;
+/**
+ * Automatic titles are intentionally much shorter than the manual rename
+ * ceiling. This is measured in grapheme clusters so emoji and combining text
+ * are never split into malformed display strings.
+ */
+export declare const AUTOMATIC_SESSION_TITLE_MAX_GRAPHEMES = 80;
+/**
+ * Safe durable title used until semantic generation succeeds. It contains no
+ * user prompt bytes, so provider failure/offline operation cannot leak a
+ * credential or leave a raw prompt prefix in navigation surfaces.
+ */
+export declare const AUTOMATIC_SESSION_TITLE_FALLBACK = "New conversation";
+/**
+ * Normalize a model/system-authored title before it reaches durable session
+ * metadata. Human renames intentionally do not use this path.
+ *
+ * Returns null when the candidate is empty, only boilerplate, or appears to
+ * contain a credential/opaque prompt value. Callers should retain the current
+ * title (normally {@link AUTOMATIC_SESSION_TITLE_FALLBACK}) in that case.
+ */
+export declare function normalizeAutomaticSessionTitle(value: string): string | null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/contracts",
-  "version": "2.2.0-canary.0",
+  "version": "2.5.0-canary.0",
   "description": "Shared zod schemas and wire-contract types for the OpenGeni API.",
   "license": "Apache-2.0",
   "repository": {

package/src/agent-authored-durable-text.ts

@@ -15,8 +15,11 @@
  *   retrieved on demand behind the exact attempt's retrieval handle. Its length
  *   is therefore retrieval cost, not standing prompt cost, which is why it gets
  *   more room rather than less.
- * - A company profile is the largest always-on surface: every field is
- *   mandatory prompt context in every session across the whole organization.
+ * - Organization identity and mission are always-on context for root sessions
+ *   across the whole organization. Historical company-profile list fields stay
+ *   in the storage contract for compatibility; nonempty values on an already-
+ *   active historical revision remain composed with an explicit compatibility
+ *   label until an organization owner replaces the profile.
  * - Knowledge is retrieval evidence and never joins the always-composed prefix.
  *
  * These caps deliberately bind only agent-authored writes. The human-facing
@@ -38,10 +41,10 @@ export const AGENT_AUTHORED_PREFERENCE_CONTENT_MAX_CHARS = 1_200;
 /** `identity` and `mission`: a couple of sentences, not a positioning document. */
 export const AGENT_AUTHORED_COMPANY_PROFILE_SCALAR_MAX_CHARS = 400;
 
-/** One product, customer, goal, or constraint: a phrase or a single sentence. */
+/** Legacy company-profile list entry bound; retained for stored-revision compatibility. */
 export const AGENT_AUTHORED_COMPANY_PROFILE_ENTRY_MAX_CHARS = 200;
 
-/** Whole canonical profile, mandatory in every session across the organization. */
+/** Whole canonical compatibility profile; current agent tools submit only identity and mission. */
 export const AGENT_AUTHORED_COMPANY_PROFILE_CONTENT_MAX_UTF8_BYTES = 4_096;
 
 export const AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_TOO_LONG_MESSAGE =
@@ -51,19 +54,17 @@ export const AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_TOO_LONG_MESSAGE =
   "imperative, no numbered procedure. Split unrelated rules into separate entries.";
 
 export const AGENT_AUTHORED_PREFERENCE_CONTENT_TOO_LONG_MESSAGE =
-  "A workspace preference is durable Company Brain content that agents retrieve on demand, so its length is " +
+  "A Skill is durable Agent Knowledge that agents retrieve on demand, so its length is " +
   "retrieval cost rather than standing prompt cost: only its short title and description are composed into " +
   `every session prompt. Keep it under ${AGENT_AUTHORED_PREFERENCE_CONTENT_MAX_CHARS} characters: state the ` +
   "preference plainly, no numbered procedure and no examples. Put procedure in a Document or Skill and " +
   "reference it instead.";
 
 export const AGENT_AUTHORED_COMPANY_PROFILE_TOO_LONG_MESSAGE =
-  "Every company-profile field is mandatory prompt context in every session across the organization. Keep " +
-  `identity and mission under ${AGENT_AUTHORED_COMPANY_PROFILE_SCALAR_MAX_CHARS} characters each, each list ` +
-  `entry under ${AGENT_AUTHORED_COMPANY_PROFILE_ENTRY_MAX_CHARS}, and the whole profile under ` +
-  `${AGENT_AUTHORED_COMPANY_PROFILE_CONTENT_MAX_UTF8_BYTES} UTF-8 bytes: one concise statement per field, no ` +
-  "numbered procedure and no marketing copy. Longer source material belongs in organization Documents and is " +
-  "retrieved as evidence.";
+  "Organization identity and mission are mandatory prompt context in every root session across the " +
+  `organization. Keep each under ${AGENT_AUTHORED_COMPANY_PROFILE_SCALAR_MAX_CHARS} characters: one concise ` +
+  "descriptive statement, no products, customers, goals, constraints, procedure, or marketing copy. Those " +
+  "details belong in organization Documents and are retrieved as evidence when relevant.";
 
 /**
  * Lane-agnostic guidance for the one `remember` content field, whose schema

package/src/company-profile.ts

@@ -110,9 +110,9 @@ export type CompanyProfileContent = z.infer<typeof CompanyProfileContent>;
 /**
  * The same profile, bounded for an **agent** author. The human `account:admin`
  * route keeps `CompanyProfileContent` and its wider limits; this is the shape
- * the first-party `company_profile_propose` tool accepts, because the profile is
- * the largest always-on prompt surface in the product and a model left to its
- * own judgement fills every field to the ceiling.
+ * persisted by the first-party `company_profile_propose` tool. The current tool
+ * accepts only identity and mission and writes empty compatibility lists, but
+ * the validator must still read historical revisions without rewriting them.
  */
 export const AgentAuthoredCompanyProfileContent = CompanyProfileContent.superRefine(
   (value, context) => {

package/src/index.ts

@@ -30,6 +30,7 @@ export * from "./tool-result-spill";
 export * from "./interaction";
 export * from "./sandbox-file-artifacts";
 export * from "./permissions";
+export * from "./session-titles";
 
 export {
   CreateWorkspaceArtifactRequest,
@@ -1459,6 +1460,7 @@ export const SessionTenancyBlocker = z.enum([
 export type SessionTenancyBlocker = z.infer<typeof SessionTenancyBlocker>;
 
 export const SESSION_OPERATION_KEY_MAX_CHARS = 256;
+export const MAX_SELECTED_VARIABLE_SETS = 25;
 const SessionTenancyIdempotencyKey = z.string().trim().min(1).max(SESSION_OPERATION_KEY_MAX_CHARS);
 
 export const UpdateSessionVisibilityRequest = z
@@ -1505,6 +1507,10 @@ export const ForkSessionRequest = z
     idempotencyKey: SessionTenancyIdempotencyKey,
     visibility: SessionVisibility,
     workspaceSharedAcknowledged: z.boolean(),
+    // Optional fresh-session runtime setup. Omission preserves the historical
+    // content-only fork; explicit null/[] creates a rigless, set-free restart.
+    rigId: z.string().uuid().nullable().optional(),
+    variableSetIds: z.array(z.string().uuid()).max(MAX_SELECTED_VARIABLE_SETS).optional(),
   })
   .strict()
   .superRefine((value, context) => {
@@ -1515,6 +1521,16 @@ export const ForkSessionRequest = z
         message: "workspaceSharedAcknowledged must be false for a private destination",
       });
     }
+    if (
+      value.variableSetIds &&
+      new Set(value.variableSetIds).size !== value.variableSetIds.length
+    ) {
+      context.addIssue({
+        code: "custom",
+        path: ["variableSetIds"],
+        message: "variableSetIds must not contain duplicates",
+      });
+    }
   });
 export type ForkSessionRequest = z.infer<typeof ForkSessionRequest>;
 
@@ -1546,6 +1562,7 @@ export type ManagedAccount = z.infer<typeof ManagedAccount>;
 export const Workspace = z.object({
   id: z.string().uuid(),
   accountId: z.string().uuid(),
+  kind: z.enum(["personal", "shared"]),
   name: z.string(),
   slug: z.string().nullable(),
   externalSource: z.string().nullable(),
@@ -1998,6 +2015,43 @@ export const SlackReactionChannelListResponse = z.object({
 });
 export type SlackReactionChannelListResponse = z.infer<typeof SlackReactionChannelListResponse>;
 
+/** Where one Slack channel starts work. */
+export const SlackChannelRoute = z.object({
+  slackChannelId: z.string().min(1).max(64),
+  targetWorkspaceId: z.string().uuid(),
+  // Unbounded like `Workspace.name` itself: a cap here would reject a row the
+  // database happily holds.
+  targetWorkspaceName: z.string().min(1).nullable(),
+  source: z.enum(["picker", "admin"]),
+  updatedAt: z.string(),
+});
+export type SlackChannelRoute = z.infer<typeof SlackChannelRoute>;
+
+export const SlackChannelRouteListResponse = z.object({
+  /** Every stored route. Bounded in practice by the channels the bot is in. */
+  routes: z.array(SlackChannelRoute),
+  /**
+   * Whether routing is switched on for this deployment. With it off the stored
+   * routes are inert, so the surface says so instead of implying they apply.
+   */
+  routingEnabled: z.boolean(),
+});
+export type SlackChannelRouteListResponse = z.infer<typeof SlackChannelRouteListResponse>;
+
+export const UpdateSlackChannelRoutesRequest = z.object({
+  connectionId: z.string().uuid(),
+  routes: z
+    .array(
+      z.object({
+        slackChannelId: z.string().min(1).max(64),
+        /** Null clears the route, so the channel asks once again. */
+        targetWorkspaceId: z.string().uuid().nullable(),
+      }),
+    )
+    .max(200),
+});
+export type UpdateSlackChannelRoutesRequest = z.infer<typeof UpdateSlackChannelRoutesRequest>;
+
 export const DEFAULT_WORKSPACE_SLACK_REACTION_SUMMON_SETTINGS = {
   enabled: false,
   emoji: "genie",
@@ -3102,7 +3156,7 @@ export const ModelContextContributionSource = z.enum([
 ]);
 export type ModelContextContributionSource = z.infer<typeof ModelContextContributionSource>;
 
-/** Content-free per-call summary of model-visible Company Brain material. */
+/** Content-free per-call summary of model-visible Agent Knowledge material. */
 export const ModelContextContributionSummary = z
   .object({
     source: ModelContextContributionSource,
@@ -4914,11 +4968,113 @@ export const DocumentDefaultCollectionBackfill = z.object({
 });
 export type DocumentDefaultCollectionBackfill = z.infer<typeof DocumentDefaultCollectionBackfill>;
 
+export const DocumentDefaultCollectionBackfillRunAudit = DocumentDefaultCollectionBackfill.omit({
+  operationId: true,
+}).extend({
+  actorSubjectId: z.string().min(1),
+  startedAt: z.string().datetime({ offset: true }),
+  updatedAt: z.string().datetime({ offset: true }),
+});
+export type DocumentDefaultCollectionBackfillRunAudit = z.infer<
+  typeof DocumentDefaultCollectionBackfillRunAudit
+>;
+
+export const DocumentDefaultCollectionBackfillOperationAudit = z.object({
+  operationId: z.string().uuid(),
+  result: DocumentDefaultCollectionBackfill,
+  createdAt: z.string().datetime({ offset: true }),
+});
+export type DocumentDefaultCollectionBackfillOperationAudit = z.infer<
+  typeof DocumentDefaultCollectionBackfillOperationAudit
+>;
+
+export const DocumentDefaultCollectionBackfillReceiptAudit = z.object({
+  workspaceId: z.string().uuid(),
+  baseId: z.string().uuid(),
+  outcome: z.enum(["created", "adopted"]),
+  createdAt: z.string().datetime({ offset: true }),
+});
+export type DocumentDefaultCollectionBackfillReceiptAudit = z.infer<
+  typeof DocumentDefaultCollectionBackfillReceiptAudit
+>;
+
+export const ListDocumentMigrationAuditQuery = ListDocumentAuthorityReclassificationsQuery;
+export type ListDocumentMigrationAuditQuery = z.infer<typeof ListDocumentMigrationAuditQuery>;
+
+export const ListDocumentDefaultCollectionBackfillRunsResponse = z.object({
+  runs: z.array(DocumentDefaultCollectionBackfillRunAudit),
+  hasMore: z.boolean(),
+  nextCursor: z.string().max(DOCUMENT_AUTHORITY_RECLASSIFICATION_CURSOR_MAX_CHARS).nullable(),
+});
+export type ListDocumentDefaultCollectionBackfillRunsResponse = z.infer<
+  typeof ListDocumentDefaultCollectionBackfillRunsResponse
+>;
+
+export const GetDocumentDefaultCollectionBackfillAuditQuery = z.object({
+  limit: z.coerce
+    .number()
+    .int()
+    .positive()
+    .max(DOCUMENT_AUTHORITY_RECLASSIFICATION_LIST_MAX_LIMIT)
+    .default(DOCUMENT_AUTHORITY_RECLASSIFICATION_LIST_DEFAULT_LIMIT),
+  operationCursor: z
+    .string()
+    .min(1)
+    .max(DOCUMENT_AUTHORITY_RECLASSIFICATION_CURSOR_MAX_CHARS)
+    .optional(),
+  receiptCursor: z
+    .string()
+    .min(1)
+    .max(DOCUMENT_AUTHORITY_RECLASSIFICATION_CURSOR_MAX_CHARS)
+    .optional(),
+});
+export type GetDocumentDefaultCollectionBackfillAuditQuery = z.infer<
+  typeof GetDocumentDefaultCollectionBackfillAuditQuery
+>;
+
+export const DocumentDefaultCollectionBackfillAudit = z.object({
+  run: DocumentDefaultCollectionBackfillRunAudit,
+  operations: z.array(DocumentDefaultCollectionBackfillOperationAudit),
+  receipts: z.array(DocumentDefaultCollectionBackfillReceiptAudit),
+  operationsHasMore: z.boolean(),
+  operationsNextCursor: z
+    .string()
+    .max(DOCUMENT_AUTHORITY_RECLASSIFICATION_CURSOR_MAX_CHARS)
+    .nullable(),
+  receiptsHasMore: z.boolean(),
+  receiptsNextCursor: z
+    .string()
+    .max(DOCUMENT_AUTHORITY_RECLASSIFICATION_CURSOR_MAX_CHARS)
+    .nullable(),
+});
+export type DocumentDefaultCollectionBackfillAudit = z.infer<
+  typeof DocumentDefaultCollectionBackfillAudit
+>;
+
+export const OrganizationDocumentAuthorityReclassification =
+  DocumentAuthorityReclassification.extend({
+    actorSubjectId: z.string().min(1),
+    requestWorkspaceId: z.string().uuid(),
+  });
+export type OrganizationDocumentAuthorityReclassification = z.infer<
+  typeof OrganizationDocumentAuthorityReclassification
+>;
+
+export const ListOrganizationDocumentAuthorityReclassificationsResponse = z.object({
+  receipts: z.array(OrganizationDocumentAuthorityReclassification),
+  hasMore: z.boolean(),
+  nextCursor: z.string().max(DOCUMENT_AUTHORITY_RECLASSIFICATION_CURSOR_MAX_CHARS).nullable(),
+});
+export type ListOrganizationDocumentAuthorityReclassificationsResponse = z.infer<
+  typeof ListOrganizationDocumentAuthorityReclassificationsResponse
+>;
+
 export const DocumentSearchRequest = z.object({
   query: z.string().min(1),
   baseIds: z.array(z.string().uuid()).optional(),
   mode: DocumentSearchMode.optional(),
   sourceKinds: z.array(KnowledgeSourceKind).optional(),
+  authorityKinds: z.array(DocumentAuthorityKind).max(3).optional(),
   aclTags: z.array(z.string().min(1)).optional(),
   limit: z.number().int().positive().max(50).default(5),
 });
@@ -5707,6 +5863,22 @@ export const UpdateSessionRequest = z.object({
 });
 export type UpdateSessionRequest = z.infer<typeof UpdateSessionRequest>;
 
+export const UpdateSessionVariableSetsRequest = z
+  .object({
+    variableSetIds: z.array(z.string().uuid()).max(MAX_SELECTED_VARIABLE_SETS),
+  })
+  .strict()
+  .superRefine((value, context) => {
+    if (new Set(value.variableSetIds).size !== value.variableSetIds.length) {
+      context.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["variableSetIds"],
+        message: "variableSetIds must not contain duplicates",
+      });
+    }
+  });
+export type UpdateSessionVariableSetsRequest = z.infer<typeof UpdateSessionVariableSetsRequest>;
+
 /**
  * Replace the complete durable session tool policy, or explicitly opt back in
  * to current workspace defaults. MCP servers and individual OpenGeni tools
@@ -6224,6 +6396,7 @@ export const SessionAuthorizationOperation = z.enum([
   "session.human_input.write",
   "session.title.write",
   "session.channel.write",
+  "session.variable_sets.write",
   "session.mcp.approval_policy.write",
   "session.tool_policy.write",
   "session.goal.read",
@@ -6833,12 +7006,13 @@ export type SubmitComposerDraftRequest = z.infer<typeof SubmitComposerDraftReque
  * deliberately narrower than CreateSessionRequest: idempotency/event keys and
  * credential-bearing MCP server inputs are per-attempt data, never draft state.
  */
-export const NewSessionDraftOptions = z.object({
+export const NewSessionDraftOptions = withVariableSetIdAlias({
   visibility: SessionVisibility.optional(),
   sandboxBackend: SandboxBackend.optional(),
   targetSandboxId: z.string().uuid().optional(),
   workingDir: z.string().min(1).optional(),
   variableSetId: z.string().uuid().optional(),
+  variableSetIds: z.array(z.string().uuid()).max(MAX_SELECTED_VARIABLE_SETS).optional(),
   rigId: z.string().uuid().optional(),
   goal: GoalSpec.optional(),
   firstPartyMcpPermissions: z.array(Permission).optional(),
@@ -7482,17 +7656,49 @@ function withVariableSetIdAlias<T extends z.ZodRawShape>(
   shape: T,
   options: { rejectKeys?: readonly string[] } = {},
 ) {
-  return z.preprocess((input) => {
-    if (!input || typeof input !== "object" || Array.isArray(input)) {
-      return input;
-    }
-    const record = input as Record<string, unknown>;
-    if (options.rejectKeys?.some((key) => Object.hasOwn(record, key))) return null;
-    if (record.variableSetId !== undefined || record.environmentId === undefined) {
-      return record;
-    }
-    return { ...record, variableSetId: record.environmentId };
-  }, z.object(shape));
+  return z.preprocess(
+    (input) => {
+      if (!input || typeof input !== "object" || Array.isArray(input)) {
+        return input;
+      }
+      const record = input as Record<string, unknown>;
+      if (options.rejectKeys?.some((key) => Object.hasOwn(record, key))) return null;
+      const aliased =
+        record.variableSetId !== undefined || record.environmentId === undefined
+          ? record
+          : { ...record, variableSetId: record.environmentId };
+      if (aliased.variableSetIds === undefined && aliased.variableSetId !== undefined) {
+        return {
+          ...aliased,
+          variableSetIds: aliased.variableSetId === null ? [] : [aliased.variableSetId],
+        };
+      }
+      return aliased;
+    },
+    z.object(shape).superRefine((value, context) => {
+      const record = value as Record<string, unknown>;
+      if (!Array.isArray(record.variableSetIds)) return;
+      if (new Set(record.variableSetIds).size !== record.variableSetIds.length) {
+        context.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: ["variableSetIds"],
+          message: "variableSetIds must not contain duplicates",
+        });
+      }
+      if (record.variableSetId === undefined) return;
+      const expected =
+        record.variableSetIds.length > 0
+          ? record.variableSetIds[record.variableSetIds.length - 1]
+          : null;
+      if (record.variableSetId !== expected) {
+        context.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: ["variableSetId"],
+          message: "variableSetId must match the last variableSetIds entry",
+        });
+      }
+    }),
+  );
 }
 
 // Generic variable-set reads remain metadata-only. Exact plaintext has one
@@ -7781,6 +7987,7 @@ export const RigChangeVerification = z
     startedAt: z.string().optional(),
     finishedAt: z.string().optional(),
     log: z.string().optional(),
+    platformCheckResults: z.array(RigCheckResult).optional(),
     checkResults: z.array(RigCheckResult).optional(),
   })
   .passthrough();
@@ -7807,7 +8014,12 @@ export const CreateRigRequest = z.object({
   name: z.string().min(1).max(120),
   description: z.string().max(2000).optional(),
   // Initial (version 1) content, inline.
-  image: z.string().max(1024).optional(),
+  // Explicit Rig base images are temporarily disabled. Rigs always compose on
+  // the deployment-owned platform sandbox image so Computer, Browser, Terminal,
+  // and the stock runtime cannot be replaced by a user definition. Keep an
+  // explicit never-field instead of silently stripping `image` from older
+  // clients: callers must receive a validation error and remove the override.
+  image: z.never().optional(),
   setupScript: z.string().max(131072).optional(),
   checks: z.array(RigCheck).max(100).default([]),
   credentialHooks: z.array(z.string().min(1).max(200)).max(50).default([]),
@@ -7874,7 +8086,10 @@ export type RigSetupAppendPayload = z.infer<typeof RigSetupAppendPayload>;
 // definition_edit: the full next-version content (all fields optional; unset
 // fields inherit from the base version at promote time).
 export const RigDefinitionEditPayload = z.object({
-  image: z.string().max(1024).nullish(),
+  // See CreateRigRequest.image. Historical RigVersion.image values remain on
+  // the read model for compatibility, but no new definition may set or clear
+  // one through the public write contract.
+  image: z.never().optional(),
   setupScript: z.string().max(131072).nullish(),
   checks: z.array(RigCheck).max(100).optional(),
   credentialHooks: z.array(z.string().min(1).max(200)).max(50).optional(),
@@ -8449,6 +8664,17 @@ export const ScheduledTaskRunAcceptedExecution = /* @__PURE__ */ z
           .array(z.string().min(1).max(256))
           .max(SCHEDULED_TASK_TOOL_MAX_COUNT),
         toolPolicyVersion: z.number().int().nonnegative(),
+        variableSets: z
+          .array(
+            z
+              .object({
+                id: z.string().uuid(),
+                generation: z.number().int().positive(),
+              })
+              .strict(),
+          )
+          .max(MAX_SELECTED_VARIABLE_SETS)
+          .default([]),
         variableSetId: z.string().uuid().nullable(),
         variableSetGeneration: z.number().int().positive().nullable(),
         rigId: z.string().uuid().nullable(),
@@ -9460,7 +9686,11 @@ export const OPENGENI_PR_REVIEW_SESSION_ROLE = "pull_request_review" as const;
 export const PrReviewProvider = GitCredentialProvider;
 export type PrReviewProvider = z.infer<typeof PrReviewProvider>;
 
-export const PrReviewCredentialKind = /* @__PURE__ */ z.enum(["github_app", "provider_token"]);
+export const PrReviewCredentialKind = /* @__PURE__ */ z.enum([
+  "github_app",
+  "managed_github_app",
+  "provider_token",
+]);
 export type PrReviewCredentialKind = z.infer<typeof PrReviewCredentialKind>;
 
 export const PrReviewWebhookAuthKind = /* @__PURE__ */ z.enum([
@@ -9581,6 +9811,9 @@ export const PrReviewAppRegistration = /* @__PURE__ */ (() =>
     provider: PrReviewProvider,
     providerBaseUrl: z.string().url(),
     appId: z.string().nullable(),
+    installationId: z.string().nullable(),
+    providerAccountLogin: z.string().nullable(),
+    providerAccountType: z.enum(["User", "Organization"]).nullable(),
     credentialKind: PrReviewCredentialKind,
     hasCredential: z.boolean(),
     accessTokenExpiresAt: z.string().nullable(),
@@ -9595,6 +9828,27 @@ export const PrReviewAppRegistration = /* @__PURE__ */ (() =>
   }))();
 export type PrReviewAppRegistration = z.infer<typeof PrReviewAppRegistration>;
 
+export const PrReviewManagedGitHubInstallation = /* @__PURE__ */ (() =>
+  z.object({
+    registrationId: z.string().uuid(),
+    installationId: z.string(),
+    accountLogin: z.string().nullable(),
+    configureUrl: z.string().url().nullable(),
+    repositoryCount: z.number().int().nonnegative(),
+  }))();
+export type PrReviewManagedGitHubInstallation = z.infer<typeof PrReviewManagedGitHubInstallation>;
+
+export const PrReviewManagedGitHubSetup = /* @__PURE__ */ (() =>
+  z.object({
+    configured: z.boolean(),
+    status: z.enum(["unavailable", "not_connected", "connected"]),
+    appName: z.literal("OpenGeni Lens"),
+    connectUrl: z.string().url().nullable(),
+    installations: z.array(PrReviewManagedGitHubInstallation),
+    missing: z.array(z.string()),
+  }))();
+export type PrReviewManagedGitHubSetup = z.infer<typeof PrReviewManagedGitHubSetup>;
+
 export const CreatePrReviewRepositoryBindingRequest = /* @__PURE__ */ (() =>
   z
     .object({
@@ -11281,6 +11535,9 @@ export const Session = z.object({
   // The explicit connected-machine project root selected for this session.
   // Null means the enrolled agent's launch workspace root.
   workingDir: z.string().nullable().default(null),
+  // Ordered low-to-high precedence. The legacy singular aliases below expose
+  // the final (highest-precedence) entry for older clients.
+  variableSetIds: z.array(z.string().uuid()).max(MAX_SELECTED_VARIABLE_SETS).default([]),
   variableSetId: z.string().uuid().nullable().default(null),
   /** @deprecated use variableSetId */
   environmentId: z.string().uuid().nullable().default(null),
@@ -11498,6 +11755,8 @@ export type SessionLineageResponse = z.infer<typeof SessionLineageResponse>;
 
 export const SessionEventType = z.enum([
   "session.created",
+  "session.variable_sets.updated",
+  "session.runtime.configured",
   "session.personal_resources.attached",
   "session.visibility.changed",
   // Defensive read/transport projection for a malformed or historically
@@ -13750,8 +14009,10 @@ export const CreateSessionRequest = withVariableSetIdAlias(
     // plane has no authenticated home-directory fact. Only valid WITH
     // targetSandboxId; omitted selects the reported root.
     workingDir: z.string().min(1).optional(),
-    // Variable set attachment is fixed at session creation; follow-up
-    // user.message events cannot switch or add one.
+    // Ordered low-to-high precedence. A legacy singular selection is normalized
+    // into one entry by withVariableSetIdAlias; when both are present the
+    // singular value must match the final (highest-precedence) entry.
+    variableSetIds: z.array(z.string().uuid()).max(MAX_SELECTED_VARIABLE_SETS).optional(),
     variableSetId: z.string().uuid().optional(),
     environmentId: z.string().uuid().optional(),
     // The rig to bind this session to (M3). Its ACTIVE version is resolved and
@@ -15443,7 +15704,8 @@ export type WorkspaceModelCatalogResponse = z.infer<typeof WorkspaceModelCatalog
  * that rollout boundary. Mutating clients send this value in
  * `x-opengeni-api-contract`; the API rejects any other value before routing.
  */
-export const OPENGENI_API_CONTRACT_REVISION = "2026-08-atomic-session-fork-visibility-v1" as const;
+export const OPENGENI_API_CONTRACT_REVISION =
+  "2026-08-personal-only-organization-setup-v1" as const;
 export const OPENGENI_API_CONTRACT_HEADER = "x-opengeni-api-contract" as const;
 /** Bounded request/response identifier shared by browser, ingress, and API diagnostics. */
 export const OPENGENI_CORRELATION_HEADER = "x-opengeni-correlation-id" as const;

package/src/knowledge.ts

@@ -119,6 +119,7 @@ export const KnowledgeSearchRequest = z
     baseIds: z.array(z.string().uuid()).max(50).optional(),
     mode: z.enum(["hybrid", "vector", "keyword"]).optional(),
     sourceKinds: z.array(KnowledgeSource.shape.kind).max(8).optional(),
+    authorityKinds: z.array(KnowledgeAuthority.shape.kind).max(3).optional(),
     aclTags: z
       .array(boundedUtf8(KNOWLEDGE_TOPIC_MAX_BYTES).pipe(z.string().min(1)))
       .max(64)