@opengeni/contracts 2.3.0-canary.0 → 2.5.0-canary.0

package/dist/{chunk-XW2RKNEU.js → chunk-4I7DWNRR.js}

@@ -1405,6 +1405,7 @@ var KnowledgeSearchRequest = z6.object({
   baseIds: z6.array(z6.string().uuid()).max(50).optional(),
   mode: z6.enum(["hybrid", "vector", "keyword"]).optional(),
   sourceKinds: z6.array(KnowledgeSource.shape.kind).max(8).optional(),
+  authorityKinds: z6.array(KnowledgeAuthority.shape.kind).max(3).optional(),
   aclTags: z6.array(boundedUtf8(KNOWLEDGE_TOPIC_MAX_BYTES).pipe(z6.string().min(1))).max(64).optional(),
   limit: z6.number().int().positive().max(KNOWLEDGE_SEARCH_MAX_RESULTS).default(5)
 }).strict();
@@ -4368,6 +4369,218 @@ var SandboxFileArtifactReceipt = z12.object({
   }
 });
 
+// src/session-titles.ts
+var SESSION_TITLE_MAX_CHARACTERS = 200;
+var AUTOMATIC_SESSION_TITLE_MAX_GRAPHEMES = 80;
+var AUTOMATIC_SESSION_TITLE_FALLBACK = "New conversation";
+var titleSegmenter;
+var KNOWN_SENSITIVE_VALUE_PATTERNS = [
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----/iu,
+  /\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/iu,
+  /\b(?:sk-(?:proj-)?|gh[oprsu]_|github_pat_|glpat-|xox[baprs]-)[A-Za-z0-9_-]{8,}/iu,
+  /\bAKIA[0-9A-Z]{16}\b/u,
+  /\bAIza[0-9A-Za-z_-]{20,}\b/u,
+  /\beyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/u,
+  /[?&](?:access_token|api_key|apikey|password|secret|token)=[^\s&#]+/iu
+];
+var URI_SCHEME_CANDIDATE_PATTERN = /\b[a-z][a-z0-9+.-]*:\S+/giu;
+var WINDOWS_DRIVE_PATH_PATTERN = /^[a-z]:[\\/](?![\\/])[^:]*$/iu;
+var SCHEMELESS_HOST_CANDIDATE_PATTERN = /\b(?:www\.)?(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z](?:[a-z0-9-]{0,61}[a-z0-9])?(?::\d{1,5})?(?:[/?#][^\s]*)?/giu;
+var SCHEMELESS_LOCAL_NETWORK_PATTERNS = [
+  /\blocalhost(?:(?::\d{1,5})(?:[/?#][^\s]*)?|[/?#][^\s]*)/iu,
+  /\b(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)(?:(?::\d{1,5})(?:[/?#][^\s]*)?|[/?#][^\s]*)/u,
+  /\[(?=[0-9a-f:.]*:[0-9a-f:.]*\])[0-9a-f:.]+\](?:(?::\d{1,5})(?:[/?#][^\s]*)?|[/?#][^\s]*)/iu
+];
+var FILE_LIKE_HOST_SUFFIXES = /* @__PURE__ */ new Set([
+  "css",
+  "html",
+  "js",
+  "json",
+  "jsx",
+  "lock",
+  "md",
+  "sql",
+  "toml",
+  "ts",
+  "tsx",
+  "xml",
+  "yaml",
+  "yml"
+]);
+var DOTTED_TECHNOLOGY_PATH_AUTHORITIES = /* @__PURE__ */ new Set([
+  "ASP.NET",
+  "AWS.SDK",
+  "Microsoft.Extensions",
+  "System.IO"
+]);
+var SECRET_ASSIGNMENT_CANDIDATE_PATTERN = /(?:^|[^A-Za-z0-9])(?:(['"])([A-Za-z][A-Za-z0-9_. -]*)\1|([A-Za-z][A-Za-z0-9_.-]*))\s*[=:]\s*[^\s,;]+/gu;
+var SECRET_LABEL_ASSIGNMENT_PATTERN = /\b(?:api[ _-]?key|access[ _-]?token|auth[ _-]?token|credential|credentials|password|passwd|private[ _-]?key|secret|token)\b\s*[=:]\s*[^\s,;]+/iu;
+var SENSITIVE_ASSIGNMENT_KEY_SUFFIXES = /* @__PURE__ */ new Set([
+  "credential",
+  "credentials",
+  "password",
+  "passwd",
+  "secret",
+  "token"
+]);
+var COMPACT_SENSITIVE_ASSIGNMENT_KEY_SUFFIXES = [
+  "apikey",
+  "accesskey",
+  "accesskeyid",
+  "accesstoken",
+  "authtoken",
+  "credential",
+  "credentials",
+  "password",
+  "passwd",
+  "privatekey",
+  "secret",
+  "secretkey",
+  "token"
+];
+var SENSITIVE_ASSIGNMENT_KEY_WORD_SUFFIXES = [
+  ["api", "key"],
+  ["access", "key"],
+  ["access", "key", "id"],
+  ["auth", "key"],
+  ["private", "key"],
+  ["secret", "key"]
+];
+function hasWordSuffix(words, suffix) {
+  if (words.length < suffix.length) return false;
+  const offset = words.length - suffix.length;
+  return suffix.every((word, index) => words[offset + index] === word);
+}
+function containsSensitiveAssignment(value) {
+  for (const match of value.matchAll(SECRET_ASSIGNMENT_CANDIDATE_PATTERN)) {
+    const key = match[2] ?? match[3];
+    if (!key) continue;
+    const words = key.replace(/([a-z0-9])([A-Z])/g, "$1 $2").replace(/([A-Z]+)([A-Z][a-z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/).filter(Boolean);
+    const last = words.at(-1);
+    if (last && SENSITIVE_ASSIGNMENT_KEY_SUFFIXES.has(last)) return true;
+    if (last && COMPACT_SENSITIVE_ASSIGNMENT_KEY_SUFFIXES.some((suffix) => last.endsWith(suffix))) {
+      return true;
+    }
+    if (SENSITIVE_ASSIGNMENT_KEY_WORD_SUFFIXES.some((suffix) => hasWordSuffix(words, suffix))) {
+      return true;
+    }
+  }
+  return false;
+}
+function containsUriScheme(value) {
+  for (const match of value.matchAll(URI_SCHEME_CANDIDATE_PATTERN)) {
+    if (!WINDOWS_DRIVE_PATH_PATTERN.test(match[0])) return true;
+  }
+  return false;
+}
+function isDottedTechnologyPath(candidate) {
+  if (/[?:#]/u.test(candidate)) return false;
+  const [authority, ...pathSegments] = candidate.split("/");
+  if (!authority || pathSegments.length === 0 || pathSegments.some((segment) => !segment)) {
+    return false;
+  }
+  if (!DOTTED_TECHNOLOGY_PATH_AUTHORITIES.has(authority) || pathSegments.some((segment) => !/^[A-Z][A-Za-z0-9_-]*$/u.test(segment))) {
+    return false;
+  }
+  return true;
+}
+function containsSchemelessUrl(value) {
+  if (SCHEMELESS_LOCAL_NETWORK_PATTERNS.some((pattern) => pattern.test(value))) return true;
+  for (const match of value.matchAll(SCHEMELESS_HOST_CANDIDATE_PATTERN)) {
+    const candidate = match[0];
+    if (candidate.toLowerCase().startsWith("www.")) return true;
+    if (!/[/?#]/u.test(candidate)) continue;
+    const authority = candidate.split(/[/?#]/u, 1)[0] ?? "";
+    const hostname = authority.replace(/:\d{1,5}$/u, "");
+    const suffix = hostname.split(".").at(-1)?.toLowerCase();
+    if (suffix && FILE_LIKE_HOST_SUFFIXES.has(suffix)) continue;
+    if (isDottedTechnologyPath(candidate)) continue;
+    return true;
+  }
+  return false;
+}
+var OPAQUE_IDENTIFIER_PATTERN = /\b(?=[A-Za-z0-9_-]{32,}\b)(?=[A-Za-z0-9_-]*[A-Za-z])(?=[A-Za-z0-9_-]*\d)[A-Za-z0-9_-]+\b/u;
+var DEFAULT_IGNORABLE_CODE_POINTS = /\p{Default_Ignorable_Code_Point}+/gu;
+var ESCAPED_QUOTE_DELIMITERS = /\\+(?=["'])/gu;
+var TITLE_LABEL_PATTERN = /^(?:(?:suggested|generated|concise)\s+)?(?:(?:session|chat|conversation|task)\s+)?title\s*[:\-–—]\s*/iu;
+var LEADING_BOILERPLATE_PATTERNS = [
+  /^(?:hi|hello|hey)(?:\s+there)?\s*[,!:.\-–—]*\s*/iu,
+  /^(?:i\s+(?:would\s+like|want|need)\s+you\s+to|i['’]d\s+like\s+you\s+to)\s+/iu,
+  /^(?:please\s+)?(?:can|could|would|will)\s+you\s+/iu,
+  /^(?:your|the)\s+(?:task|job)\s+is\s+to\s+/iu,
+  /^(?:please\s+)?help\s+me\s+(?:to\s+)?/iu,
+  /^please(?:\s*[,!:.\-–—]+\s*|\s+|$)/iu
+];
+function automaticTitleDetectionValue(value) {
+  return value.normalize("NFKC").replace(DEFAULT_IGNORABLE_CODE_POINTS, "").replace(ESCAPED_QUOTE_DELIMITERS, "");
+}
+function hasVisibleAutomaticTitleContent(value) {
+  return automaticTitleDetectionValue(value).trim().length > 0;
+}
+function containsSensitiveAutomaticTitleValue(value) {
+  const detectionValue = automaticTitleDetectionValue(value);
+  if (KNOWN_SENSITIVE_VALUE_PATTERNS.some((pattern) => pattern.test(detectionValue))) return true;
+  if (containsUriScheme(detectionValue)) return true;
+  if (containsSchemelessUrl(detectionValue)) return true;
+  if (SECRET_LABEL_ASSIGNMENT_PATTERN.test(detectionValue)) return true;
+  if (containsSensitiveAssignment(detectionValue)) return true;
+  if (OPAQUE_IDENTIFIER_PATTERN.test(detectionValue)) return true;
+  return false;
+}
+function stripAutomaticTitleBoilerplate(value) {
+  let title = value;
+  for (let pass = 0; pass < 4; pass += 1) {
+    const before = title;
+    title = title.replace(/^(?:```[^\n]*|[\s#>*_`"'“”‘’\-–—]+)+/u, "").replace(TITLE_LABEL_PATTERN, "");
+    for (const pattern of LEADING_BOILERPLATE_PATTERNS) {
+      title = title.replace(pattern, "");
+    }
+    title = title.trim();
+    if (title === before) break;
+  }
+  return title;
+}
+function automaticTitleGraphemes(value) {
+  if (titleSegmenter === void 0) {
+    titleSegmenter = typeof Intl.Segmenter === "function" ? new Intl.Segmenter(void 0, { granularity: "grapheme" }) : null;
+  }
+  if (titleSegmenter) {
+    return Array.from(titleSegmenter.segment(value), (part) => part.segment);
+  }
+  const graphemes = [];
+  for (const point of value) {
+    const prior = graphemes.at(-1);
+    if (prior && (/^[\p{Mark}\u{FE0E}\u{FE0F}\p{Emoji_Modifier}]$/u.test(point) || point === "\u200D" || prior.endsWith("\u200D"))) {
+      graphemes[graphemes.length - 1] = `${prior}${point}`;
+    } else {
+      graphemes.push(point);
+    }
+  }
+  return graphemes;
+}
+function boundAutomaticTitle(value) {
+  const words = value.split(/\s+/u);
+  const wordBounded = words.length > 10 ? words.slice(0, 10).join(" ") : value;
+  const graphemes = automaticTitleGraphemes(wordBounded);
+  if (graphemes.length <= AUTOMATIC_SESSION_TITLE_MAX_GRAPHEMES) return wordBounded;
+  const prefix = graphemes.slice(0, AUTOMATIC_SESSION_TITLE_MAX_GRAPHEMES).join("");
+  const lastWhitespace = prefix.search(/\s+\S*$/u);
+  return (lastWhitespace >= 16 ? prefix.slice(0, lastWhitespace) : prefix).trimEnd();
+}
+function normalizeAutomaticSessionTitle(value) {
+  const firstLine = value.replace(/[\u0000-\u001f\u007f-\u009f]+/gu, "\n").split(/\n+/u).map((line) => line.trim()).find(Boolean);
+  if (!firstLine || !hasVisibleAutomaticTitleContent(firstLine) || containsSensitiveAutomaticTitleValue(firstLine)) {
+    return null;
+  }
+  let title = stripAutomaticTitleBoilerplate(firstLine).replace(/\s+/gu, " ").replace(/[\s.!?,;:\-–—]+$/u, "").trim();
+  if (!title || !hasVisibleAutomaticTitleContent(title) || containsSensitiveAutomaticTitleValue(title)) {
+    return null;
+  }
+  title = boundAutomaticTitle(title).replace(/[\s.!?,;:\-–—]+$/u, "").trim();
+  if (!title || !hasVisibleAutomaticTitleContent(title)) return null;
+  return title;
+}
+
 // src/artifacts.ts
 import { z as z13 } from "zod";
 var WORKSPACE_ARTIFACT_HTML_MAX_UTF8_BYTES = 4 * 1024 * 1024;
@@ -5755,8 +5968,8 @@ var AGENT_AUTHORED_COMPANY_PROFILE_SCALAR_MAX_CHARS = 400;
 var AGENT_AUTHORED_COMPANY_PROFILE_ENTRY_MAX_CHARS = 200;
 var AGENT_AUTHORED_COMPANY_PROFILE_CONTENT_MAX_UTF8_BYTES = 4096;
 var AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_TOO_LONG_MESSAGE = `A workspace rule is composed verbatim into the prompt of every session it applies to (every session for a global charter or policy, every session bound to the role for a role policy), for as long as it stays active. Keep it under ${AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_MAX_CHARS} characters: one rule, imperative, no numbered procedure. Split unrelated rules into separate entries.`;
-var AGENT_AUTHORED_PREFERENCE_CONTENT_TOO_LONG_MESSAGE = `A workspace preference is durable Company Brain content that agents retrieve on demand, so its length is retrieval cost rather than standing prompt cost: only its short title and description are composed into every session prompt. Keep it under ${AGENT_AUTHORED_PREFERENCE_CONTENT_MAX_CHARS} characters: state the preference plainly, no numbered procedure and no examples. Put procedure in a Document or Skill and reference it instead.`;
-var AGENT_AUTHORED_COMPANY_PROFILE_TOO_LONG_MESSAGE = `Every company-profile field is mandatory prompt context in every session across the organization. Keep identity and mission under ${AGENT_AUTHORED_COMPANY_PROFILE_SCALAR_MAX_CHARS} characters each, each list entry under ${AGENT_AUTHORED_COMPANY_PROFILE_ENTRY_MAX_CHARS}, and the whole profile under ${AGENT_AUTHORED_COMPANY_PROFILE_CONTENT_MAX_UTF8_BYTES} UTF-8 bytes: one concise statement per field, no numbered procedure and no marketing copy. Longer source material belongs in organization Documents and is retrieved as evidence.`;
+var AGENT_AUTHORED_PREFERENCE_CONTENT_TOO_LONG_MESSAGE = `A Skill is durable Agent Knowledge that agents retrieve on demand, so its length is retrieval cost rather than standing prompt cost: only its short title and description are composed into every session prompt. Keep it under ${AGENT_AUTHORED_PREFERENCE_CONTENT_MAX_CHARS} characters: state the preference plainly, no numbered procedure and no examples. Put procedure in a Document or Skill and reference it instead.`;
+var AGENT_AUTHORED_COMPANY_PROFILE_TOO_LONG_MESSAGE = `Organization identity and mission are mandatory prompt context in every root session across the organization. Keep each under ${AGENT_AUTHORED_COMPANY_PROFILE_SCALAR_MAX_CHARS} characters: one concise descriptive statement, no products, customers, goals, constraints, procedure, or marketing copy. Those details belong in organization Documents and are retrieved as evidence when relevant.`;
 var AGENT_AUTHORED_REMEMBER_CONTENT_TOO_LONG_MESSAGE = `Remembered content is bounded by where it lands: a mandatory workspace rule at most ${AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_MAX_CHARS} characters because it is composed into every session prompt it applies to, a preference at most ${AGENT_AUTHORED_PREFERENCE_CONTENT_MAX_CHARS}, a Knowledge fact at most 4000. Write one imperative statement in 1-3 sentences, split unrelated entries, and keep procedure in a Document or Skill that the entry references.`;
 var AGENT_AUTHORED_DURABLE_TEXT_STYLE = "Durable text is prompt cost, not a place to be thorough: write one imperative statement in 1-3 sentences, with no numbered steps, no examples, no rationale and no restating of defaults. Prefer several small entries over one long one, and keep procedure in a Document or Skill that the rule references instead of inlining it.";
 function agentAuthoredDurableTextTooLongMessage(input) {
@@ -7468,10 +7681,30 @@ var TaskNoteListResponse = z24.object({
 // src/organization-membership-lifecycle.ts
 import { z as z25 } from "zod";
 var OrganizationMembershipRole = z25.enum(["owner", "admin", "member"]);
+var WorkspaceMemberRole = z25.enum(["viewer", "member", "admin", "custom"]);
+var AssignableWorkspaceMemberRole = z25.enum(["viewer", "member", "admin"]);
 var OrganizationInvitationStatus = z25.enum(["pending", "accepted", "revoked", "expired"]);
+var OrganizationUserSetupDeliveryState = z25.enum([
+  "pending",
+  "sent",
+  "failed",
+  "outcome_unknown",
+  "revoked"
+]);
+var OrganizationUserSetupDelivery = z25.object({
+  id: z25.string().uuid(),
+  state: OrganizationUserSetupDeliveryState,
+  attemptCount: z25.number().int().nonnegative(),
+  revision: z25.number().int().positive(),
+  errorClass: z25.string().min(1).max(64).nullable(),
+  retryState: z25.enum(["available", "reconciliation_required", "unavailable"]),
+  sentAt: z25.string().datetime({ offset: true }).nullable(),
+  updatedAt: z25.string().datetime({ offset: true })
+});
 var OrganizationInvitation = z25.object({
   id: z25.string().uuid(),
   organizationId: z25.string().uuid(),
+  organizationName: z25.string().trim().min(1).max(120).nullable().default(null),
   targetEmail: z25.string().email(),
   targetName: z25.string().trim().min(1).max(120).nullable().default(null),
   initialWorkspaceIds: z25.array(z25.string().uuid()).max(100).default([]),
@@ -7481,7 +7714,8 @@ var OrganizationInvitation = z25.object({
   expiresAt: z25.string().datetime({ offset: true }),
   acceptedMembershipId: z25.string().uuid().nullable(),
   createdAt: z25.string().datetime({ offset: true }),
-  updatedAt: z25.string().datetime({ offset: true })
+  updatedAt: z25.string().datetime({ offset: true }),
+  delivery: OrganizationUserSetupDelivery.nullable().default(null)
 });
 var OrganizationMember = z25.object({
   id: z25.string().uuid(),
@@ -7498,6 +7732,27 @@ var OrganizationMember = z25.object({
   createdAt: z25.string().datetime({ offset: true }),
   updatedAt: z25.string().datetime({ offset: true })
 });
+var OrganizationAdministrationMemberWorkspaceAccess = z25.object({
+  workspaceId: z25.string().uuid(),
+  workspaceName: z25.string().min(1).max(255),
+  membershipId: z25.string().uuid(),
+  role: WorkspaceMemberRole,
+  updatedAt: z25.string().datetime({ offset: true })
+});
+var OrganizationAdministrationMember = z25.object({
+  id: z25.string().uuid(),
+  organizationId: z25.string().uuid(),
+  subjectId: z25.string().min(1).max(1024),
+  name: z25.string().min(1).max(1024).nullable(),
+  email: z25.string().email().max(320).nullable(),
+  role: OrganizationMembershipRole,
+  status: z25.enum(["provisioning", "active", "suspended", "revoked"]),
+  authorizationRevision: z25.number().int().positive(),
+  sharedWorkspaceAccess: z25.array(OrganizationAdministrationMemberWorkspaceAccess).max(500),
+  revokedAt: z25.string().datetime({ offset: true }).nullable(),
+  createdAt: z25.string().datetime({ offset: true }),
+  updatedAt: z25.string().datetime({ offset: true })
+});
 var OrganizationSummary = z25.object({
   id: z25.string().uuid(),
   name: z25.string().trim().min(1).max(120),
@@ -7519,12 +7774,17 @@ var UpdateOrganizationPrivateSessionSettingsRequest = z25.object({
 }).strict();
 var OrganizationWorkspaceAccessMember = z25.object({
   membershipId: z25.string().uuid(),
+  organizationMembershipId: z25.string().uuid().nullable(),
   subjectId: z25.string().min(1).max(1024),
+  name: z25.string().min(1).max(1024).nullable(),
+  email: z25.string().email().max(320).nullable(),
   subjectLabel: z25.string().min(1).max(1024).nullable(),
   principalKind: z25.enum(["human", "service"]),
-  role: z25.string().min(1).max(64),
+  organizationRole: OrganizationMembershipRole.nullable(),
+  role: WorkspaceMemberRole,
   permissions: z25.array(z25.string().min(1).max(128)),
-  createdAt: z25.string().datetime({ offset: true })
+  createdAt: z25.string().datetime({ offset: true }),
+  updatedAt: z25.string().datetime({ offset: true })
 });
 var OrganizationWorkspaceAccess = z25.object({
   id: z25.string().uuid(),
@@ -7534,21 +7794,47 @@ var OrganizationWorkspaceAccess = z25.object({
   updatedAt: z25.string().datetime({ offset: true }),
   members: z25.array(OrganizationWorkspaceAccessMember).max(1e3)
 });
+var OrganizationWorkspaceRoleDefinition = z25.object({
+  role: AssignableWorkspaceMemberRole,
+  label: z25.string().min(1).max(64),
+  description: z25.string().min(1).max(512),
+  permissions: z25.array(Permission).min(1)
+});
 var OrganizationAdministrationOverview = z25.object({
   organization: OrganizationSummary,
+  roles: z25.array(OrganizationWorkspaceRoleDefinition).length(3),
   workspaces: z25.array(OrganizationWorkspaceAccess).max(500)
 });
-var AddOrganizationWorkspaceMemberRequest = z25.object({
-  organizationMembershipId: z25.string().uuid(),
-  role: z25.string().trim().min(1).max(64).optional(),
-  permissions: z25.array(Permission).max(128)
-});
 var CreateOrganizationWorkspaceRequest = z25.object({
   name: z25.string().trim().min(1).max(120),
-  slug: z25.string().trim().min(1).max(120).nullable().optional(),
-  agentInstructions: z25.string().nullable().optional(),
   operationId: z25.string().uuid()
-});
+}).strict();
+var UpdateOrganizationWorkspaceRequest = z25.object({
+  name: z25.string().trim().min(1).max(120),
+  expectedUpdatedAt: z25.string().datetime({ offset: true }),
+  operationId: z25.string().uuid()
+}).strict();
+var PutOrganizationWorkspaceMemberRequest = z25.discriminatedUnion("role", [
+  z25.object({
+    role: AssignableWorkspaceMemberRole,
+    expectedUpdatedAt: z25.string().datetime({ offset: true }).nullable(),
+    operationId: z25.string().uuid()
+  }).strict(),
+  z25.object({
+    role: z25.literal("custom"),
+    permissions: z25.array(Permission).max(128),
+    expectedUpdatedAt: z25.string().datetime({ offset: true }).nullable(),
+    operationId: z25.string().uuid()
+  }).strict()
+]);
+var RevokeOrganizationWorkspaceMemberRequest = z25.object({
+  expectedUpdatedAt: z25.string().datetime({ offset: true }),
+  operationId: z25.string().uuid()
+}).strict();
+var RevokeOrganizationWorkspaceMemberResponse = z25.object({
+  removed: z25.boolean(),
+  replay: z25.boolean()
+}).strict();
 var CreateOrganizationRequest = z25.object({
   name: z25.string().trim().min(1).max(120),
   operationId: z25.string().uuid()
@@ -7638,6 +7924,51 @@ var CreateOrganizationInvitationRequest = z25.object({
   expiresAt: z25.string().datetime({ offset: true }),
   operationId: z25.string().uuid()
 });
+var CompleteOrganizationUserSetupRequest = z25.object({
+  token: z25.string().min(32).max(2048),
+  name: z25.string().trim().min(1).max(120),
+  password: z25.string().min(8).max(128),
+  operationId: z25.string().uuid()
+});
+var CompleteOrganizationUserSetupResponse = z25.object({
+  status: z25.literal("complete")
+});
+var PreviewOrganizationUserSetupRequest = z25.object({ token: z25.string().min(32).max(2048) }).strict();
+var OrganizationUserSetupPreviewWorkspace = z25.object({
+  workspaceId: z25.string().uuid(),
+  workspaceName: z25.string().min(1).max(255),
+  role: AssignableWorkspaceMemberRole
+});
+var OrganizationUserSetupPreviewUnavailable = z25.object({
+  state: z25.enum(["unavailable", "expired", "revoked", "completed"])
+});
+var OrganizationUserSetupPreviewPending = z25.object({
+  state: z25.literal("pending"),
+  organizationId: z25.string().uuid(),
+  organizationName: z25.string().trim().min(1).max(120),
+  targetEmail: z25.string().email().max(320),
+  targetName: z25.string().trim().min(1).max(120).nullable(),
+  organizationRole: OrganizationMembershipRole,
+  sharedWorkspaceAccess: z25.array(OrganizationUserSetupPreviewWorkspace).max(100),
+  expiresAt: z25.string().datetime({ offset: true })
+});
+var OrganizationUserSetupPreview = z25.discriminatedUnion("state", [
+  OrganizationUserSetupPreviewUnavailable,
+  OrganizationUserSetupPreviewPending
+]);
+var RetryOrganizationUserSetupDeliveryRequest = z25.object({ operationId: z25.string().uuid() }).strict();
+var CompleteSelfServiceOrganizationSetupRequest = z25.object({
+  organizationName: z25.string().trim().min(1).max(120),
+  operationId: z25.string().uuid()
+});
+var CompleteSelfServiceOrganizationSetupResponse = z25.object({
+  status: z25.literal("complete"),
+  organizationId: z25.string().uuid(),
+  personalWorkspaceId: z25.string().uuid()
+});
+var SelfServiceOrganizationOnboardingStatus = z25.object({
+  state: z25.enum(["required", "invitation_pending", "unavailable", "complete"])
+});
 var AcceptOrganizationInvitationRequest = z25.object({
   expectedRevision: z25.number().int().positive(),
   operationId: z25.string().uuid()
@@ -7696,6 +8027,9 @@ var AcceptOrganizationInvitationResponse = z25.object({
 var ListOrganizationMembersResponse = z25.object({
   members: z25.array(OrganizationMember)
 });
+var ListOrganizationAdministrationMembersResponse = z25.object({
+  members: z25.array(OrganizationAdministrationMember).max(1e3)
+});
 var ListSelfOrganizationMembershipsResponse = z25.object({
   memberships: z25.array(OrganizationMember)
 });
@@ -7734,7 +8068,7 @@ var RememberRequest = z26.discriminatedUnion("lane", [
     lane: z26.literal("instruction_policy"),
     // A mandatory rule is composed verbatim into the prompt of every session
     // it applies to, for as long as it stays active, so this is the tightest
-    // agent budget in the Company Brain.
+    // agent budget in Agent Knowledge.
     content: z26.string().trim().min(1).max(
       AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_MAX_CHARS,
       AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_TOO_LONG_MESSAGE
@@ -7775,11 +8109,13 @@ var RememberActivationSummary = z26.discriminatedUnion("destination", [
     destination: z26.literal("knowledge"),
     receiptId: z26.string().uuid(),
     claimId: z26.string().uuid(),
+    /** The retrievable Memory record materialized from the approved claim. */
+    memoryId: z26.string().uuid(),
     approvalReviewId: z26.string().uuid(),
     effectiveAt: z26.string().datetime().nullable(),
     authorityKind: z26.literal("human_confirmed"),
-    /** Knowledge approvals are undone through the Knowledge review lifecycle (`knowledge_correct` or a human revocation). */
-    undo: z26.literal("knowledge_review")
+    /** Correct or archive the materialized record through the Memory lifecycle. */
+    undo: z26.literal("memory_management")
   })
 ]);
 var RememberReceipt = z26.discriminatedUnion("status", [
@@ -8852,6 +9188,7 @@ var SessionTenancyBlocker = z27.enum([
   "shared_sandbox_group"
 ]);
 var SESSION_OPERATION_KEY_MAX_CHARS = 256;
+var MAX_SELECTED_VARIABLE_SETS = 25;
 var SessionTenancyIdempotencyKey = z27.string().trim().min(1).max(SESSION_OPERATION_KEY_MAX_CHARS);
 var UpdateSessionVisibilityRequest = z27.object({
   visibility: SessionVisibility,
@@ -8886,7 +9223,11 @@ var UpdateSessionVisibilityResponse = z27.object({
 var ForkSessionRequest = z27.object({
   idempotencyKey: SessionTenancyIdempotencyKey,
   visibility: SessionVisibility,
-  workspaceSharedAcknowledged: z27.boolean()
+  workspaceSharedAcknowledged: z27.boolean(),
+  // Optional fresh-session runtime setup. Omission preserves the historical
+  // content-only fork; explicit null/[] creates a rigless, set-free restart.
+  rigId: z27.string().uuid().nullable().optional(),
+  variableSetIds: z27.array(z27.string().uuid()).max(MAX_SELECTED_VARIABLE_SETS).optional()
 }).strict().superRefine((value, context) => {
   if (value.visibility === "private" && value.workspaceSharedAcknowledged) {
     context.addIssue({
@@ -8895,6 +9236,13 @@ var ForkSessionRequest = z27.object({
       message: "workspaceSharedAcknowledged must be false for a private destination"
     });
   }
+  if (value.variableSetIds && new Set(value.variableSetIds).size !== value.variableSetIds.length) {
+    context.addIssue({
+      code: "custom",
+      path: ["variableSetIds"],
+      message: "variableSetIds must not contain duplicates"
+    });
+  }
 });
 var ForkSessionResponse = z27.object({
   operationId: z27.string().uuid(),
@@ -8918,6 +9266,7 @@ var ManagedAccount = z27.object({
 var Workspace = z27.object({
   id: z27.string().uuid(),
   accountId: z27.string().uuid(),
+  kind: z27.enum(["personal", "shared"]),
   name: z27.string(),
   slug: z27.string().nullable(),
   externalSource: z27.string().nullable(),
@@ -10950,6 +11299,7 @@ var DocumentSearchRequest = z27.object({
   baseIds: z27.array(z27.string().uuid()).optional(),
   mode: DocumentSearchMode.optional(),
   sourceKinds: z27.array(KnowledgeSourceKind).optional(),
+  authorityKinds: z27.array(DocumentAuthorityKind).max(3).optional(),
   aclTags: z27.array(z27.string().min(1)).optional(),
   limit: z27.number().int().positive().max(50).default(5)
 });
@@ -11515,6 +11865,17 @@ var UpdateSessionGoalRequest = z27.union([
 var UpdateSessionRequest = z27.object({
   title: z27.string().min(1).max(200)
 });
+var UpdateSessionVariableSetsRequest = z27.object({
+  variableSetIds: z27.array(z27.string().uuid()).max(MAX_SELECTED_VARIABLE_SETS)
+}).strict().superRefine((value, context) => {
+  if (new Set(value.variableSetIds).size !== value.variableSetIds.length) {
+    context.addIssue({
+      code: z27.ZodIssueCode.custom,
+      path: ["variableSetIds"],
+      message: "variableSetIds must not contain duplicates"
+    });
+  }
+});
 var UpdateSessionToolPolicyRequest = z27.union([
   z27.object({
     mode: z27.literal("workspace_default"),
@@ -11839,6 +12200,7 @@ var SessionAuthorizationOperation = z27.enum([
   "session.human_input.write",
   "session.title.write",
   "session.channel.write",
+  "session.variable_sets.write",
   "session.mcp.approval_policy.write",
   "session.tool_policy.write",
   "session.goal.read",
@@ -12282,12 +12644,13 @@ var SubmitComposerDraftRequest = ComposerDraft.pick({
   connectionAuthorities: McpConnectionAuthoritySelections.default([]),
   personalResourceAttachment: PersonalResourceAttachmentIntent.optional()
 }).superRefine(requireEstablishedPersonalResourceEpoch);
-var NewSessionDraftOptions = z27.object({
+var NewSessionDraftOptions = withVariableSetIdAlias({
   visibility: SessionVisibility.optional(),
   sandboxBackend: SandboxBackend.optional(),
   targetSandboxId: z27.string().uuid().optional(),
   workingDir: z27.string().min(1).optional(),
   variableSetId: z27.string().uuid().optional(),
+  variableSetIds: z27.array(z27.string().uuid()).max(MAX_SELECTED_VARIABLE_SETS).optional(),
   rigId: z27.string().uuid().optional(),
   goal: GoalSpec.optional(),
   firstPartyMcpPermissions: z27.array(Permission).optional(),
@@ -12744,17 +13107,43 @@ ${goalContext}`] : [],
 }
 var VariableSetVariableName = z27.string().regex(/^[A-Z][A-Z0-9_]*$/).max(128);
 function withVariableSetIdAlias(shape, options = {}) {
-  return z27.preprocess((input) => {
-    if (!input || typeof input !== "object" || Array.isArray(input)) {
-      return input;
-    }
-    const record = input;
-    if (options.rejectKeys?.some((key) => Object.hasOwn(record, key))) return null;
-    if (record.variableSetId !== void 0 || record.environmentId === void 0) {
-      return record;
-    }
-    return { ...record, variableSetId: record.environmentId };
-  }, z27.object(shape));
+  return z27.preprocess(
+    (input) => {
+      if (!input || typeof input !== "object" || Array.isArray(input)) {
+        return input;
+      }
+      const record = input;
+      if (options.rejectKeys?.some((key) => Object.hasOwn(record, key))) return null;
+      const aliased = record.variableSetId !== void 0 || record.environmentId === void 0 ? record : { ...record, variableSetId: record.environmentId };
+      if (aliased.variableSetIds === void 0 && aliased.variableSetId !== void 0) {
+        return {
+          ...aliased,
+          variableSetIds: aliased.variableSetId === null ? [] : [aliased.variableSetId]
+        };
+      }
+      return aliased;
+    },
+    z27.object(shape).superRefine((value, context) => {
+      const record = value;
+      if (!Array.isArray(record.variableSetIds)) return;
+      if (new Set(record.variableSetIds).size !== record.variableSetIds.length) {
+        context.addIssue({
+          code: z27.ZodIssueCode.custom,
+          path: ["variableSetIds"],
+          message: "variableSetIds must not contain duplicates"
+        });
+      }
+      if (record.variableSetId === void 0) return;
+      const expected = record.variableSetIds.length > 0 ? record.variableSetIds[record.variableSetIds.length - 1] : null;
+      if (record.variableSetId !== expected) {
+        context.addIssue({
+          code: z27.ZodIssueCode.custom,
+          path: ["variableSetId"],
+          message: "variableSetId must match the last variableSetIds entry"
+        });
+      }
+    })
+  );
 }
 var VariableSetVariableMetadata = z27.object({
   name: VariableSetVariableName,
@@ -12965,6 +13354,7 @@ var RigChangeVerification = z27.object({
   startedAt: z27.string().optional(),
   finishedAt: z27.string().optional(),
   log: z27.string().optional(),
+  platformCheckResults: z27.array(RigCheckResult).optional(),
   checkResults: z27.array(RigCheckResult).optional()
 }).passthrough();
 var RigChange = z27.object({
@@ -12986,7 +13376,12 @@ var CreateRigRequest = z27.object({
   name: z27.string().min(1).max(120),
   description: z27.string().max(2e3).optional(),
   // Initial (version 1) content, inline.
-  image: z27.string().max(1024).optional(),
+  // Explicit Rig base images are temporarily disabled. Rigs always compose on
+  // the deployment-owned platform sandbox image so Computer, Browser, Terminal,
+  // and the stock runtime cannot be replaced by a user definition. Keep an
+  // explicit never-field instead of silently stripping `image` from older
+  // clients: callers must receive a validation error and remove the override.
+  image: z27.never().optional(),
   setupScript: z27.string().max(131072).optional(),
   checks: z27.array(RigCheck).max(100).default([]),
   credentialHooks: z27.array(z27.string().min(1).max(200)).max(50).default([]),
@@ -13026,7 +13421,10 @@ var RigSetupAppendPayload = z27.object({
   note: z27.string().max(2e3).optional()
 });
 var RigDefinitionEditPayload = z27.object({
-  image: z27.string().max(1024).nullish(),
+  // See CreateRigRequest.image. Historical RigVersion.image values remain on
+  // the read model for compatibility, but no new definition may set or clear
+  // one through the public write contract.
+  image: z27.never().optional(),
   setupScript: z27.string().max(131072).nullish(),
   checks: z27.array(RigCheck).max(100).optional(),
   credentialHooks: z27.array(z27.string().min(1).max(200)).max(50).optional(),
@@ -13428,6 +13826,12 @@ var ScheduledTaskRunAcceptedExecution = /* @__PURE__ */ z27.object({
     mcpServerIds: z27.array(z27.string().min(1).max(256)).max(SCHEDULED_TASK_TOOL_MAX_COUNT),
     effectiveMcpServerIds: z27.array(z27.string().min(1).max(256)).max(SCHEDULED_TASK_TOOL_MAX_COUNT),
     toolPolicyVersion: z27.number().int().nonnegative(),
+    variableSets: z27.array(
+      z27.object({
+        id: z27.string().uuid(),
+        generation: z27.number().int().positive()
+      }).strict()
+    ).max(MAX_SELECTED_VARIABLE_SETS).default([]),
     variableSetId: z27.string().uuid().nullable(),
     variableSetGeneration: z27.number().int().positive().nullable(),
     rigId: z27.string().uuid().nullable(),
@@ -14165,7 +14569,11 @@ var PackInstallation = z27.object({
 var OPENGENI_PR_REVIEW_PACK_ID = "pr-review";
 var OPENGENI_PR_REVIEW_SESSION_ROLE = "pull_request_review";
 var PrReviewProvider = GitCredentialProvider;
-var PrReviewCredentialKind = /* @__PURE__ */ z27.enum(["github_app", "provider_token"]);
+var PrReviewCredentialKind = /* @__PURE__ */ z27.enum([
+  "github_app",
+  "managed_github_app",
+  "provider_token"
+]);
 var PrReviewWebhookAuthKind = /* @__PURE__ */ z27.enum([
   "hmac_sha256",
   "shared_token",
@@ -14261,6 +14669,9 @@ var PrReviewAppRegistration = /* @__PURE__ */ (() => z27.object({
   provider: PrReviewProvider,
   providerBaseUrl: z27.string().url(),
   appId: z27.string().nullable(),
+  installationId: z27.string().nullable(),
+  providerAccountLogin: z27.string().nullable(),
+  providerAccountType: z27.enum(["User", "Organization"]).nullable(),
   credentialKind: PrReviewCredentialKind,
   hasCredential: z27.boolean(),
   accessTokenExpiresAt: z27.string().nullable(),
@@ -14273,6 +14684,21 @@ var PrReviewAppRegistration = /* @__PURE__ */ (() => z27.object({
   createdAt: z27.string(),
   updatedAt: z27.string()
 }))();
+var PrReviewManagedGitHubInstallation = /* @__PURE__ */ (() => z27.object({
+  registrationId: z27.string().uuid(),
+  installationId: z27.string(),
+  accountLogin: z27.string().nullable(),
+  configureUrl: z27.string().url().nullable(),
+  repositoryCount: z27.number().int().nonnegative()
+}))();
+var PrReviewManagedGitHubSetup = /* @__PURE__ */ (() => z27.object({
+  configured: z27.boolean(),
+  status: z27.enum(["unavailable", "not_connected", "connected"]),
+  appName: z27.literal("OpenGeni Lens"),
+  connectUrl: z27.string().url().nullable(),
+  installations: z27.array(PrReviewManagedGitHubInstallation),
+  missing: z27.array(z27.string())
+}))();
 var CreatePrReviewRepositoryBindingRequest = /* @__PURE__ */ (() => z27.object({
   registrationId: z27.string().uuid(),
   repositoryUri: z27.string().url().max(2048),
@@ -15447,6 +15873,9 @@ var Session = z27.object({
   // The explicit connected-machine project root selected for this session.
   // Null means the enrolled agent's launch workspace root.
   workingDir: z27.string().nullable().default(null),
+  // Ordered low-to-high precedence. The legacy singular aliases below expose
+  // the final (highest-precedence) entry for older clients.
+  variableSetIds: z27.array(z27.string().uuid()).max(MAX_SELECTED_VARIABLE_SETS).default([]),
   variableSetId: z27.string().uuid().nullable().default(null),
   /** @deprecated use variableSetId */
   environmentId: z27.string().uuid().nullable().default(null),
@@ -15624,6 +16053,8 @@ var SessionLineageResponse = z27.object({
 });
 var SessionEventType = z27.enum([
   "session.created",
+  "session.variable_sets.updated",
+  "session.runtime.configured",
   "session.personal_resources.attached",
   "session.visibility.changed",
   // Defensive read/transport projection for a malformed or historically
@@ -17294,8 +17725,10 @@ var CreateSessionRequest = withVariableSetIdAlias(
     // plane has no authenticated home-directory fact. Only valid WITH
     // targetSandboxId; omitted selects the reported root.
     workingDir: z27.string().min(1).optional(),
-    // Variable set attachment is fixed at session creation; follow-up
-    // user.message events cannot switch or add one.
+    // Ordered low-to-high precedence. A legacy singular selection is normalized
+    // into one entry by withVariableSetIdAlias; when both are present the
+    // singular value must match the final (highest-precedence) entry.
+    variableSetIds: z27.array(z27.string().uuid()).max(MAX_SELECTED_VARIABLE_SETS).optional(),
     variableSetId: z27.string().uuid().optional(),
     environmentId: z27.string().uuid().optional(),
     // The rig to bind this session to (M3). Its ACTIVE version is resolved and
@@ -18499,7 +18932,7 @@ var WorkspaceModelCatalogResponse = /* @__PURE__ */ defineModelContractSchema(
     models: z27.array(WorkspaceModelCatalogModel)
   })
 );
-var OPENGENI_API_CONTRACT_REVISION = "2026-08-atomic-session-fork-visibility-v1";
+var OPENGENI_API_CONTRACT_REVISION = "2026-08-personal-only-organization-setup-v1";
 var OPENGENI_API_CONTRACT_HEADER = "x-opengeni-api-contract";
 var OPENGENI_CORRELATION_HEADER = "x-opengeni-correlation-id";
 var ClientConfig = /* @__PURE__ */ defineModelContractSchema(
@@ -19128,6 +19561,10 @@ export {
   SANDBOX_FILE_ARTIFACT_MAX_BYTES,
   PublishSandboxFileArtifactRequest,
   SandboxFileArtifactReceipt,
+  SESSION_TITLE_MAX_CHARACTERS,
+  AUTOMATIC_SESSION_TITLE_MAX_GRAPHEMES,
+  AUTOMATIC_SESSION_TITLE_FALLBACK,
+  normalizeAutomaticSessionTitle,
   WORKSPACE_ARTIFACT_HTML_MAX_UTF8_BYTES,
   WORKSPACE_ARTIFACT_TITLE_MAX_CHARS,
   WORKSPACE_ARTIFACT_DESCRIPTION_MAX_CHARS,
@@ -19413,17 +19850,27 @@ export {
   TaskNoteReplacementResult,
   TaskNoteListResponse,
   OrganizationMembershipRole,
+  WorkspaceMemberRole,
+  AssignableWorkspaceMemberRole,
   OrganizationInvitationStatus,
+  OrganizationUserSetupDeliveryState,
+  OrganizationUserSetupDelivery,
   OrganizationInvitation,
   OrganizationMember,
+  OrganizationAdministrationMemberWorkspaceAccess,
+  OrganizationAdministrationMember,
   OrganizationSummary,
   OrganizationPrivateSessionSettings,
   UpdateOrganizationPrivateSessionSettingsRequest,
   OrganizationWorkspaceAccessMember,
   OrganizationWorkspaceAccess,
+  OrganizationWorkspaceRoleDefinition,
   OrganizationAdministrationOverview,
-  AddOrganizationWorkspaceMemberRequest,
   CreateOrganizationWorkspaceRequest,
+  UpdateOrganizationWorkspaceRequest,
+  PutOrganizationWorkspaceMemberRequest,
+  RevokeOrganizationWorkspaceMemberRequest,
+  RevokeOrganizationWorkspaceMemberResponse,
   CreateOrganizationRequest,
   CreateOrganizationResponse,
   UpdateOrganizationNameRequest,
@@ -19434,6 +19881,15 @@ export {
   OrganizationRetentionDeletionResult,
   OrganizationRetentionDeletionPreview,
   CreateOrganizationInvitationRequest,
+  CompleteOrganizationUserSetupRequest,
+  CompleteOrganizationUserSetupResponse,
+  PreviewOrganizationUserSetupRequest,
+  OrganizationUserSetupPreviewWorkspace,
+  OrganizationUserSetupPreview,
+  RetryOrganizationUserSetupDeliveryRequest,
+  CompleteSelfServiceOrganizationSetupRequest,
+  CompleteSelfServiceOrganizationSetupResponse,
+  SelfServiceOrganizationOnboardingStatus,
   AcceptOrganizationInvitationRequest,
   RevokeOrganizationInvitationRequest,
   OrganizationMemberTransitionKind,
@@ -19444,6 +19900,7 @@ export {
   ListOrganizationInvitationsPageResponse,
   AcceptOrganizationInvitationResponse,
   ListOrganizationMembersResponse,
+  ListOrganizationAdministrationMembersResponse,
   ListSelfOrganizationMembershipsResponse,
   RememberLane,
   RememberScope,
@@ -19529,6 +19986,7 @@ export {
   SessionTenancyPublicProjection,
   SessionTenancyBlocker,
   SESSION_OPERATION_KEY_MAX_CHARS,
+  MAX_SELECTED_VARIABLE_SETS,
   UpdateSessionVisibilityRequest,
   UpdateSessionVisibilityResponse,
   ForkSessionRequest,
@@ -19804,6 +20262,7 @@ export {
   GoalSpec,
   UpdateSessionGoalRequest,
   UpdateSessionRequest,
+  UpdateSessionVariableSetsRequest,
   UpdateSessionToolPolicyRequest,
   UpdateSessionPinRequest,
   UpdateSessionAttentionRequest,
@@ -20043,6 +20502,8 @@ export {
   CreatePrReviewAppRegistrationRequest,
   UpdatePrReviewAppRegistrationRequest,
   PrReviewAppRegistration,
+  PrReviewManagedGitHubInstallation,
+  PrReviewManagedGitHubSetup,
   CreatePrReviewRepositoryBindingRequest,
   UpdatePrReviewRepositoryBindingRequest,
   PrReviewRepositoryBinding,
@@ -20395,4 +20856,4 @@ export {
   ClientConfig,
   evaluateWorkspaceModelPolicy
 };
-//# sourceMappingURL=chunk-XW2RKNEU.js.map
+//# sourceMappingURL=chunk-4I7DWNRR.js.map