@opengeni/contracts 2.7.0 → 2.9.2-canary.1

package/src/index.ts

@@ -942,15 +942,8 @@ const FIRST_PARTY_IN_PROCESS_TOOL_NAME_SET = new Set<FirstPartyMcpToolName>(
  * trustworthy logical-delivery identity. Server-owned Slack delivery paths
  * call the internal client directly with their own durable operation IDs.
  */
-// Names kept so previously written data still parses - immutable scheduled-task
-// execution snapshots recorded the tool set that was default at the time, and
-// they are strictly re-parsed on replay. Retiring a tool must not strand an
-// accepted occurrence. These are never registered, never default, and never
-// authorized; they exist so history stays readable.
 const FIRST_PARTY_COMPATIBILITY_ONLY_TOOL_NAMES = [
   "slack_bot_post_message",
-  "memory_save",
-  "memory_correct",
 ] as const satisfies readonly FirstPartyMcpToolName[];
 
 const FIRST_PARTY_COMPATIBILITY_ONLY_TOOL_NAME_SET = new Set<FirstPartyMcpToolName>(
@@ -983,10 +976,6 @@ export const EDITABLE_ARTIFACT_MCP_CODEMODE_PATHS = {
  */
 export const DEFAULT_FIRST_PARTY_MCP_TOOLS = FIRST_PARTY_MCP_TOOL_NAMES.filter(
   (name) =>
-    // Memory V1 writes are retired entirely; `remember` and task-note
-    // promotion own durable agent writes.
-    name !== "memory_save" &&
-    name !== "memory_correct" &&
     !name.startsWith("social_") &&
     !name.startsWith("x_") &&
     !name.startsWith("reddit_") &&
@@ -2311,6 +2300,79 @@ export const UpdateWorkspaceModelPolicyRequest = z.object({
 });
 export type UpdateWorkspaceModelPolicyRequest = z.infer<typeof UpdateWorkspaceModelPolicyRequest>;
 
+export const WORKSPACE_GATEWAY_CUSTOM_MODEL_UPSTREAM_ID_MAX_LENGTH = 238;
+
+export const CreateWorkspaceGatewayCustomModelRequest = z
+  .object({
+    operationId: z.string().uuid(),
+    upstreamModelId: z
+      .string()
+      .max(WORKSPACE_GATEWAY_CUSTOM_MODEL_UPSTREAM_ID_MAX_LENGTH)
+      .regex(/^[!-{}-~]+$/),
+    label: z
+      .string()
+      .min(1)
+      .max(128)
+      .refine((value) => new TextEncoder().encode(value).byteLength <= 128, {
+        message: "label must be at most 128 UTF-8 bytes",
+      })
+      .refine((value) => !/[\r\n|]/u.test(value), {
+        message: "label must not contain newlines or the | field separator",
+      })
+      .optional(),
+  })
+  .strict();
+export type CreateWorkspaceGatewayCustomModelRequest = z.infer<
+  typeof CreateWorkspaceGatewayCustomModelRequest
+>;
+
+export const DeleteWorkspaceGatewayCustomModelRequest = z
+  .object({
+    expectedVersion: z.number().int().positive(),
+    operationId: z.string().uuid(),
+  })
+  .strict();
+export type DeleteWorkspaceGatewayCustomModelRequest = z.infer<
+  typeof DeleteWorkspaceGatewayCustomModelRequest
+>;
+
+export const WorkspaceGatewayCustomModel = z.object({
+  id: z.string().uuid(),
+  upstreamModelId: z.string(),
+  label: z.string().nullable(),
+  version: z.number().int().positive(),
+  createdAt: z.string().datetime(),
+  updatedAt: z.string().datetime(),
+});
+export type WorkspaceGatewayCustomModel = z.infer<typeof WorkspaceGatewayCustomModel>;
+
+export const WorkspaceGatewayCustomModelsResponse = z.object({
+  models: z.array(WorkspaceGatewayCustomModel),
+});
+export type WorkspaceGatewayCustomModelsResponse = z.infer<
+  typeof WorkspaceGatewayCustomModelsResponse
+>;
+
+export const CreateWorkspaceOpenRouterCustomModelRequest = CreateWorkspaceGatewayCustomModelRequest;
+export type CreateWorkspaceOpenRouterCustomModelRequest = z.infer<
+  typeof CreateWorkspaceOpenRouterCustomModelRequest
+>;
+
+export const DeleteWorkspaceOpenRouterCustomModelRequest = DeleteWorkspaceGatewayCustomModelRequest;
+export type DeleteWorkspaceOpenRouterCustomModelRequest = z.infer<
+  typeof DeleteWorkspaceOpenRouterCustomModelRequest
+>;
+
+export const WorkspaceOpenRouterCustomModel = WorkspaceGatewayCustomModel;
+export type WorkspaceOpenRouterCustomModel = z.infer<typeof WorkspaceOpenRouterCustomModel>;
+
+export const WorkspaceOpenRouterCustomModelsResponse = z.object({
+  models: z.array(WorkspaceOpenRouterCustomModel),
+});
+export type WorkspaceOpenRouterCustomModelsResponse = z.infer<
+  typeof WorkspaceOpenRouterCustomModelsResponse
+>;
+
 const turnInitiatorIdentityFields = {
   subjectId: z.string().min(1),
   /** Immutable display snapshot; never an authorization input. */
@@ -2960,6 +3022,28 @@ export const CreateWorkspaceRequest = z.object({
 });
 export type CreateWorkspaceRequest = z.infer<typeof CreateWorkspaceRequest>;
 
+export const EnsureWorkspaceRequest = z
+  .object({
+    accountId: z.string().uuid(),
+    externalSource: z.string().trim().min(1).max(200),
+    externalId: z.string().trim().min(1).max(1024),
+    name: z.string().trim().min(1).max(200),
+    slug: z.string().trim().min(1).max(200).optional(),
+    // White-label persona override for this workspace's agent. null/omitted uses
+    // the deployment default template.
+    agentInstructions: z.string().min(1).nullable().optional(),
+  })
+  .strict();
+export type EnsureWorkspaceRequest = z.infer<typeof EnsureWorkspaceRequest>;
+
+export const EnsureWorkspaceResponse = z
+  .object({
+    workspace: Workspace,
+    created: z.boolean(),
+  })
+  .strict();
+export type EnsureWorkspaceResponse = z.infer<typeof EnsureWorkspaceResponse>;
+
 export const UpdateWorkspaceRequest = z
   .object({
     name: z.string().min(1).optional(),
@@ -3002,6 +3086,15 @@ export const CreateApiKeyResponse = z.object({
 });
 export type CreateApiKeyResponse = z.infer<typeof CreateApiKeyResponse>;
 
+export const CreateOrganizationApiKeyRequest = z
+  .object({
+    name: z.string().trim().min(1).max(200),
+    description: z.string().trim().min(1).max(500).optional(),
+    expiresAt: z.string().datetime({ offset: true }).optional(),
+  })
+  .strict();
+export type CreateOrganizationApiKeyRequest = z.infer<typeof CreateOrganizationApiKeyRequest>;
+
 // A person (or API key) with access to a workspace: one workspace_memberships
 // row. `subjectId` is `user:<betterAuthUserId>` or `api_key:<id>`; the People
 // surface lists the `user:` subjects (api_key subjects belong to API keys).
@@ -3019,10 +3112,26 @@ export const ListWorkspaceMembersResponse = z.object({
 });
 export type ListWorkspaceMembersResponse = z.infer<typeof ListWorkspaceMembersResponse>;
 
+export const WorkspaceMemberCandidate = z.object({
+  organizationMembershipId: z.string().uuid(),
+  subjectId: z.string().min(1),
+  name: z.string().min(1).max(1024).nullable(),
+  email: z.string().email().max(320).nullable(),
+  organizationRole: z.enum(["owner", "admin", "member"]),
+});
+export type WorkspaceMemberCandidate = z.infer<typeof WorkspaceMemberCandidate>;
+
+export const ListWorkspaceMemberCandidatesResponse = z.object({
+  members: z.array(WorkspaceMemberCandidate).max(1000),
+});
+export type ListWorkspaceMemberCandidatesResponse = z.infer<
+  typeof ListWorkspaceMemberCandidatesResponse
+>;
+
 export const AddWorkspaceMemberRequest = z.object({
-  // Resolved against the managed (Better Auth) users; email invites for
-  // not-yet-registered users are deferred, so an unknown email returns 404.
-  email: z.string().email(),
+  // The candidate inventory exposes this opaque organization-local identifier.
+  // Organization invitations stay in the organization-admin lifecycle.
+  organizationMembershipId: z.string().uuid(),
   role: z.string().min(1).optional(),
   permissions: z.array(Permission),
 });
@@ -7625,17 +7734,74 @@ export function renderSessionSystemUpdateBatch(
   ].join("\n");
 }
 
+export const SCHEDULED_OCCURRENCE_TASK_LABEL = "[OpenGeni scheduled task occurrence]" as const;
+
+/**
+ * A pure scheduled-occurrence batch is a new task boundary for the model, not
+ * merely background context. The user role here is conversational only: the
+ * owning turn retains its immutable scheduler/service initiator and frozen
+ * execution authority in the database.
+ *
+ * Malformed or mixed legacy batches fall back to the generic system envelope
+ * so this renderer never invents task identity from inconsistent payloads.
+ */
+function renderScheduledOccurrenceTaskBatch(
+  updates: Parameters<typeof renderSessionSystemUpdateBatch>[0],
+): string | null {
+  if (updates.length === 0 || updates.some((update) => update.kind !== "scheduled_occurrence")) {
+    return null;
+  }
+  const occurrences = updates.map((update) => {
+    const parsed = SessionSystemUpdatePayload.safeParse(update.payload);
+    if (
+      !parsed.success ||
+      parsed.data.type !== "scheduled_occurrence" ||
+      parsed.data.scheduledTaskRunId !== update.sourceId
+    ) {
+      return null;
+    }
+    return { update, payload: parsed.data };
+  });
+  if (occurrences.some((occurrence) => occurrence === null)) return null;
+
+  const introduction =
+    occurrences.length === 1
+      ? "A new scheduled occurrence has started. Execute the instructions below for this occurrence now."
+      : `${occurrences.length} new scheduled occurrences have started. Execute every instruction set below for this turn now.`;
+  return [
+    SCHEDULED_OCCURRENCE_TASK_LABEL,
+    introduction,
+    "The scheduled instructions below are the task for this turn. Earlier completed goals, occurrences, conversation, and tool outputs are historical context and do not complete this occurrence. When the task depends on mutable external state, query that state during this occurrence instead of reusing an earlier result.",
+    ...occurrences.flatMap((occurrence, index) => {
+      if (!occurrence) return [];
+      return [
+        "",
+        ...(occurrences.length > 1 ? [`Occurrence ${index + 1}:`] : []),
+        `Scheduled task ID: ${occurrence.payload.scheduledTaskId}`,
+        `Scheduled task run ID: ${occurrence.payload.scheduledTaskRunId}`,
+        `Update ID: ${occurrence.update.id}`,
+        "Instructions:",
+        occurrence.payload.text,
+      ];
+    }),
+  ].join("\n");
+}
+
 export function sessionSystemUpdateBatchHistoryItem(
   updates: Parameters<typeof renderSessionSystemUpdateBatch>[0],
   goalSnapshot?: SessionGoalSnapshot,
-): { type: "message"; role: "system"; content: string } {
+  options: { promoteScheduledOccurrenceToUser?: boolean } = {},
+): { type: "message"; role: "system" | "user"; content: string } {
   const goalContext = renderSessionGoalContext(goalSnapshot);
+  const scheduledTask = options.promoteScheduledOccurrenceToUser
+    ? renderScheduledOccurrenceTaskBatch(updates)
+    : null;
   return {
     type: "message",
-    role: "system",
+    role: scheduledTask ? "user" : "system",
     content: [
       ...(goalContext ? [`${SESSION_GOAL_CONTEXT_LABEL}\n${goalContext}`] : []),
-      renderSessionSystemUpdateBatch(updates),
+      scheduledTask ?? renderSessionSystemUpdateBatch(updates),
     ].join("\n\n"),
   };
 }
@@ -7646,6 +7812,48 @@ export const VariableSetVariableName = z
   .max(128);
 export type VariableSetVariableName = z.infer<typeof VariableSetVariableName>;
 
+export const VARIABLE_SET_RESERVED_EXACT_NAMES = [
+  "HOME",
+  "PATH",
+  "SHELL",
+  "USER",
+  "LOGNAME",
+  "TMPDIR",
+  "IFS",
+  "ENV",
+  "BASH_ENV",
+  "NODE_OPTIONS",
+  "PYTHONPATH",
+  "PYTHONSTARTUP",
+  "PERL5OPT",
+  "PERL5LIB",
+  "GH_TOKEN",
+  "GITHUB_TOKEN",
+  "GITLAB_TOKEN",
+  "AZURE_DEVOPS_EXT_PAT",
+  "GIT_ASKPASS",
+  "GIT_TERMINAL_PROMPT",
+] as const;
+
+export const VARIABLE_SET_RESERVED_PREFIXES = [
+  "OPENGENI_",
+  "GIT_CONFIG_",
+  "GIT_AUTHOR_",
+  "GIT_COMMITTER_",
+  "LD_",
+  "DYLD_",
+] as const;
+
+export function variableSetVariableNameReservation(
+  name: string,
+): { kind: "exact" | "prefix"; value: string } | null {
+  if ((VARIABLE_SET_RESERVED_EXACT_NAMES as readonly string[]).includes(name)) {
+    return { kind: "exact", value: name };
+  }
+  const prefix = VARIABLE_SET_RESERVED_PREFIXES.find((candidate) => name.startsWith(candidate));
+  return prefix ? { kind: "prefix", value: prefix } : null;
+}
+
 function withVariableSetIdAlias<T extends z.ZodRawShape>(
   shape: T,
   options: { rejectKeys?: readonly string[] } = {},
@@ -8483,17 +8691,24 @@ function scheduledTaskBoundedString(maxBytes: number, label: string) {
 }
 
 /** Ingress-bounded task name for create/update requests. */
-export const ScheduledTaskNameInput = /* @__PURE__ */ scheduledTaskBoundedString(
-  SCHEDULED_TASK_NAME_MAX_BYTES,
-  "scheduled task name",
-);
+export const ScheduledTaskNameInput =
+  /* @__PURE__ */ scheduledTaskBoundedString(SCHEDULED_TASK_NAME_MAX_BYTES, "scheduled task name");
 /** Ingress-bounded task metadata for create/update requests. */
-export const ScheduledTaskMetadataInput = /* @__PURE__ */ scheduledTaskBoundedJsonObject(
-  SCHEDULED_TASK_METADATA_MAX_BYTES,
-  "scheduled task metadata",
-);
+export const ScheduledTaskMetadataInput =
+  /* @__PURE__ */ scheduledTaskBoundedJsonObject(
+    SCHEDULED_TASK_METADATA_MAX_BYTES,
+    "scheduled task metadata",
+  );
 
 function scheduledTaskAgentConfigShape(bounded: boolean) {
+  const machineTarget = z
+    .object({
+      targetSandboxId: z.string().uuid(),
+      workingDir: bounded
+        ? z.string().trim().min(1).max(4096).optional()
+        : z.string().min(1).optional(),
+    })
+    .strict();
   return {
     prompt: bounded
       ? scheduledTaskBoundedString(SCHEDULED_TASK_PROMPT_MAX_BYTES, "scheduled task prompt")
@@ -8519,6 +8734,10 @@ function scheduledTaskAgentConfigShape(bounded: boolean) {
       : z.string().min(1).optional(),
     reasoningEffort: ReasoningEffort.optional(),
     sandboxBackend: SandboxBackend.optional(),
+    // Connected Machines are a concrete execution target, not a generic
+    // sandbox backend. Persist the exact machine + optional cwd so every
+    // generated session can seed its active route before its first turn.
+    machineTarget: machineTarget.optional(),
     goal: GoalSpec.optional(),
     // Incident telemetry is the only special execution class. Omission keeps
     // every existing task on the byte-compatible ordinary dispatch path.
@@ -8560,6 +8779,20 @@ export type ScheduledTaskAgentConfig = z.infer<typeof ScheduledTaskAgentConfig>;
 export const ScheduledTaskAgentConfigInput = /* @__PURE__ */ z
   .object(scheduledTaskAgentConfigShape(true))
   .superRefine((value, context) => {
+    if (value.machineTarget && value.sandboxBackend !== undefined) {
+      context.addIssue({
+        code: "custom",
+        path: ["machineTarget"],
+        message: "machineTarget cannot be combined with sandboxBackend",
+      });
+    }
+    if (value.sandboxBackend === "selfhosted") {
+      context.addIssue({
+        code: "custom",
+        path: ["sandboxBackend"],
+        message: "selfhosted scheduled tasks require machineTarget",
+      });
+    }
     if (scheduledTaskJsonUtf8Bytes(value) > SCHEDULED_TASK_AGENT_CONFIG_MAX_BYTES) {
       context.addIssue({
         code: "custom",
@@ -8627,6 +8860,10 @@ export const ScheduledTaskRunAcceptedExecution = /* @__PURE__ */ z
     resolvedModel: z.string().min(1),
     resolvedReasoningEffort: ReasoningEffort,
     resolvedLatencyMode: LatencyMode,
+    /** Secret-safe TurnExecutionPolicyV1 accepted with this occurrence. Kept
+     * structurally open here because the canonical policy schema is declared
+     * later in this package; consumers must parse it with TurnExecutionPolicyV1. */
+    turnExecutionPolicy: z.unknown().optional(),
     resolvedSandboxBackend: SandboxBackend,
     resolvedSandboxOs: SandboxOs,
     resolvedTools: z.array(ToolRef).max(SCHEDULED_TASK_TOOL_MAX_COUNT),
@@ -8884,6 +9121,13 @@ const CreateAgentScheduledTaskRequest = /* @__PURE__ */ withVariableSetIdAlias({
       message: "agentConfig.goal cannot be used with an existing-session target",
     });
   }
+  if (value.runMode === "existing_session" && value.agentConfig.machineTarget) {
+    context.addIssue({
+      code: "custom",
+      path: ["agentConfig", "machineTarget"],
+      message: "machineTarget cannot be used with an existing-session target",
+    });
+  }
 });
 
 const CreateKnowledgeSourceSyncScheduledTaskRequest = /* @__PURE__ */ z
@@ -8918,48 +9162,59 @@ export const CreateScheduledTaskRequest = /* @__PURE__ */ z.union([
 ]);
 export type CreateScheduledTaskRequest = z.infer<typeof CreateScheduledTaskRequest>;
 
-export const UpdateScheduledTaskRequest = /* @__PURE__ */ withVariableSetIdAlias({
-  name: ScheduledTaskNameInput.optional(),
-  schedule: ScheduledTaskScheduleSpec.optional(),
-  runMode: ScheduledTaskRunMode.optional(),
-  overlapPolicy: ScheduledTaskOverlapPolicy.optional(),
-  action: ScheduledTaskAction.optional(),
-  targetSessionId: z.string().uuid().nullable().optional(),
-  connectionAuthorities: McpConnectionAuthoritySelections.optional(),
-  agentConfig: ScheduledTaskAgentConfigInput.optional(),
-  status: ScheduledTaskStatus.optional(),
-  variableSetId: z.string().uuid().nullable().optional(),
-  environmentId: z.string().uuid().nullable().optional(),
-  // The rig each run binds to (M3); null clears it. Its active version is
-  // resolved per fire, so an update takes effect on the next dispatch.
-  rigId: z.string().uuid().nullable().optional(),
-  metadata: z.record(z.string(), z.unknown()).optional(),
-}).superRefine((value, context) => {
-  if (value.targetSessionId && value.runMode && value.runMode !== "existing_session") {
-    context.addIssue({
-      code: "custom",
-      path: ["targetSessionId"],
-      message: "targetSessionId requires runMode=existing_session",
-    });
-  }
-  if (value.runMode === "existing_session" && value.targetSessionId === null) {
-    context.addIssue({
-      code: "custom",
-      path: ["targetSessionId"],
-      message: "targetSessionId cannot be null when runMode=existing_session",
-    });
-  }
-  if (
-    value.agentConfig?.goal &&
-    (value.runMode === "existing_session" || Boolean(value.targetSessionId))
-  ) {
-    context.addIssue({
-      code: "custom",
-      path: ["agentConfig", "goal"],
-      message: "agentConfig.goal cannot be used with an existing-session target",
-    });
-  }
-});
+export const UpdateScheduledTaskRequest =
+  /* @__PURE__ */ withVariableSetIdAlias({
+    name: ScheduledTaskNameInput.optional(),
+    schedule: ScheduledTaskScheduleSpec.optional(),
+    runMode: ScheduledTaskRunMode.optional(),
+    overlapPolicy: ScheduledTaskOverlapPolicy.optional(),
+    action: ScheduledTaskAction.optional(),
+    targetSessionId: z.string().uuid().nullable().optional(),
+    connectionAuthorities: McpConnectionAuthoritySelections.optional(),
+    agentConfig: ScheduledTaskAgentConfigInput.optional(),
+    status: ScheduledTaskStatus.optional(),
+    variableSetId: z.string().uuid().nullable().optional(),
+    environmentId: z.string().uuid().nullable().optional(),
+    // The rig each run binds to (M3); null clears it. Its active version is
+    // resolved per fire, so an update takes effect on the next dispatch.
+    rigId: z.string().uuid().nullable().optional(),
+    metadata: z.record(z.string(), z.unknown()).optional(),
+  }).superRefine((value, context) => {
+    if (value.targetSessionId && value.runMode && value.runMode !== "existing_session") {
+      context.addIssue({
+        code: "custom",
+        path: ["targetSessionId"],
+        message: "targetSessionId requires runMode=existing_session",
+      });
+    }
+    if (value.runMode === "existing_session" && value.targetSessionId === null) {
+      context.addIssue({
+        code: "custom",
+        path: ["targetSessionId"],
+        message: "targetSessionId cannot be null when runMode=existing_session",
+      });
+    }
+    if (
+      value.agentConfig?.goal &&
+      (value.runMode === "existing_session" || Boolean(value.targetSessionId))
+    ) {
+      context.addIssue({
+        code: "custom",
+        path: ["agentConfig", "goal"],
+        message: "agentConfig.goal cannot be used with an existing-session target",
+      });
+    }
+    if (
+      value.agentConfig?.machineTarget &&
+      (value.runMode === "existing_session" || Boolean(value.targetSessionId))
+    ) {
+      context.addIssue({
+        code: "custom",
+        path: ["agentConfig", "machineTarget"],
+        message: "machineTarget cannot be used with an existing-session target",
+      });
+    }
+  });
 export type UpdateScheduledTaskRequest = z.infer<typeof UpdateScheduledTaskRequest>;
 
 /**
@@ -10312,6 +10567,15 @@ function compareDescending(left: number | string, right: number | string): numbe
 export const ConnectionCredentialBundle = z.record(z.string(), z.unknown());
 export type ConnectionCredentialBundle = z.infer<typeof ConnectionCredentialBundle>;
 
+export const VERCEL_AI_GATEWAY_CREDENTIAL_OPERATION_ID_METADATA_KEY =
+  "vercelAiGatewayCredentialOperationId" as const;
+export const VERCEL_AI_GATEWAY_CREDENTIAL_OPERATION_DIGEST_METADATA_KEY =
+  "vercelAiGatewayCredentialOperationDigest" as const;
+export const OPENROUTER_CREDENTIAL_OPERATION_ID_METADATA_KEY =
+  "openRouterCredentialOperationId" as const;
+export const OPENROUTER_CREDENTIAL_OPERATION_DIGEST_METADATA_KEY =
+  "openRouterCredentialOperationDigest" as const;
+
 export const CreateConnectionRequest = z.object({
   providerDomain: z.string().min(1),
   kind: ConnectionKind,
@@ -10322,6 +10586,7 @@ export const CreateConnectionRequest = z.object({
   grantedScopes: z.array(z.string().min(1)).default([]),
   expiresAt: z.string().datetime({ offset: true }).nullable().optional(),
   metadata: z.record(z.string(), z.unknown()).default({}),
+  operationId: z.string().uuid().optional(),
 });
 export type CreateConnectionRequest = z.infer<typeof CreateConnectionRequest>;
 
@@ -10377,6 +10642,8 @@ export const UpdateConnectionRequest = z.object({
   grantedScopes: z.array(z.string().min(1)).optional(),
   expiresAt: z.string().datetime({ offset: true }).nullable().optional(),
   metadata: z.record(z.string(), z.unknown()).optional(),
+  expectedVersion: z.number().int().positive().optional(),
+  operationId: z.string().uuid().optional(),
 });
 export type UpdateConnectionRequest = z.infer<typeof UpdateConnectionRequest>;
 
@@ -11664,8 +11931,11 @@ export const Session = z.object({
       queuedDescendants: z.number().int().nonnegative(),
       attentionDescendants: z.number().int().nonnegative(),
       pausedDescendants: z.number().int().nonnegative(),
+      /** Historical failed lifecycle states, including already-reviewed failures. */
       failedDescendants: z.number().int().nonnegative(),
       unreadDescendants: z.number().int().nonnegative().optional(),
+      /** Failed descendants whose latest durable event this viewer has not acknowledged. */
+      unreadFailedDescendants: z.number().int().nonnegative().optional(),
       activelyWorkingDescendants: z.number().int().nonnegative().optional(),
       /**
        * Earliest moment one of the counted `attentionDescendants` entered
@@ -14498,6 +14768,10 @@ export const ClientAuthConfig = z.discriminatedUnion("mode", [
     mode: z.literal("managedSession"),
     session: z.literal("cookie"),
     emailVerificationRequired: z.boolean().default(true),
+    socialProviders: z
+      .array(z.enum(["google", "github"]))
+      .max(2)
+      .default([]),
   }),
 ]);
 export type ClientAuthConfig = z.infer<typeof ClientAuthConfig>;
@@ -14596,10 +14870,10 @@ export const SessionCapabilities = z.object({
     codecs: z.array(z.enum(["h264-mp4", "vp9-webm"])),
     reason: CapabilityUnavailableReason.nullable(),
   }),
-  // The AGENT drives the SAME :0 (xdotool/XTEST + scrot) the human watches; the
-  // human viewer plane is read-only by default (§6). `available` == desktop-
-  // capable backend && computerUseEnabled; `readOnly` reports whether the agent
-  // driver itself is gated to no-op input (v1 default false — the agent clicks).
+  // Deprecated compatibility cell for clients that predate managed
+  // ComputerSession interaction tools. Newly negotiated documents report this
+  // unavailable/read-only with `disabled_by_policy`; the shape remains so older
+  // clients and persisted payloads still parse.
   ComputerUse: z.object({
     available: z.boolean(),
     readOnly: z.boolean(),
@@ -15279,9 +15553,8 @@ function defineModelContractSchema<Schema>(factory: () => Schema): Schema {
   return factory();
 }
 
-export const ModelCapabilitySupportV1 = /* @__PURE__ */ defineModelContractSchema(() =>
-  z.enum(["supported", "unsupported", "unknown"]),
-);
+export const ModelCapabilitySupportV1 =
+  /* @__PURE__ */ defineModelContractSchema(() => z.enum(["supported", "unsupported", "unknown"]));
 export type ModelCapabilitySupportV1 = z.infer<typeof ModelCapabilitySupportV1>;
 
 export const ModelCapabilityStateV1 = /* @__PURE__ */ defineModelContractSchema(() =>
@@ -15329,28 +15602,29 @@ export const ModelCapabilitiesV1 = /* @__PURE__ */ defineModelContractSchema(()
 );
 export type ModelCapabilitiesV1 = z.infer<typeof ModelCapabilitiesV1>;
 
-export const ModelCredentialSourceV1 = /* @__PURE__ */ defineModelContractSchema(() =>
-  z.union([
-    z
-      .object({
-        kind: z.literal("deployment"),
-        mechanism: z.enum(["api_key", "azure_ad_bearer"]),
-      })
-      .strict(),
-    z
-      .object({
-        kind: z.literal("connected_subscription"),
-        provider: z.enum(["codex", "xai"]),
-      })
-      .strict(),
-    z
-      .object({
-        kind: z.literal("workspace_connection"),
-        mechanism: z.literal("api_key"),
-      })
-      .strict(),
-  ]),
-);
+export const ModelCredentialSourceV1 =
+  /* @__PURE__ */ defineModelContractSchema(() =>
+    z.union([
+      z
+        .object({
+          kind: z.literal("deployment"),
+          mechanism: z.enum(["api_key", "azure_ad_bearer"]),
+        })
+        .strict(),
+      z
+        .object({
+          kind: z.literal("connected_subscription"),
+          provider: z.enum(["codex", "xai"]),
+        })
+        .strict(),
+      z
+        .object({
+          kind: z.literal("workspace_connection"),
+          mechanism: z.literal("api_key"),
+        })
+        .strict(),
+    ]),
+  );
 export type ModelCredentialSourceV1 = z.infer<typeof ModelCredentialSourceV1>;
 
 const TurnExecutionCredentialSourceV1 = z.union([
@@ -15363,31 +15637,40 @@ const TurnExecutionCredentialSourceV1 = z.union([
     .strict(),
 ]);
 
-export const ModelBillingAttributionV1 = /* @__PURE__ */ defineModelContractSchema(() =>
-  z
-    .object({
-      upstreamPayer: z.enum(["deployment", "workspace", "connected_subscription"]),
-      metering: z.enum(["opengeni_credits", "external"]),
-    })
-    .strict(),
-);
+export const ModelBillingAttributionV1 =
+  /* @__PURE__ */ defineModelContractSchema(() =>
+    z
+      .object({
+        upstreamPayer: z.enum(["deployment", "workspace", "connected_subscription"]),
+        metering: z.enum(["opengeni_credits", "external"]),
+      })
+      .strict(),
+  );
 export type ModelBillingAttributionV1 = z.infer<typeof ModelBillingAttributionV1>;
 
+export const ModelCostClassV1 = /* @__PURE__ */ defineModelContractSchema(() =>
+  z.enum(["free", "credits", "subscription", "workspace"]),
+);
+export type ModelCostClassV1 = z.infer<typeof ModelCostClassV1>;
+
 export const TURN_EXECUTION_POLICY_METADATA_KEY = "turnExecutionPolicyV1" as const;
 
-export const TurnExecutionModelSourceV1 = /* @__PURE__ */ defineModelContractSchema(() =>
-  z.enum(["explicit", "session", "deployment", "continuation"]),
-);
+export const TurnExecutionModelSourceV1 =
+  /* @__PURE__ */ defineModelContractSchema(() =>
+    z.enum(["explicit", "session", "deployment", "continuation"]),
+  );
 export type TurnExecutionModelSourceV1 = z.infer<typeof TurnExecutionModelSourceV1>;
 
-export const TurnExecutionReasoningSourceV1 = /* @__PURE__ */ defineModelContractSchema(() =>
-  z.enum(["explicit", "session", "deployment", "continuation"]),
-);
+export const TurnExecutionReasoningSourceV1 =
+  /* @__PURE__ */ defineModelContractSchema(() =>
+    z.enum(["explicit", "session", "deployment", "continuation"]),
+  );
 export type TurnExecutionReasoningSourceV1 = z.infer<typeof TurnExecutionReasoningSourceV1>;
 
-export const TurnExecutionLatencyModeSourceV1 = /* @__PURE__ */ defineModelContractSchema(() =>
-  z.enum(["explicit", "session", "deployment", "continuation"]),
-);
+export const TurnExecutionLatencyModeSourceV1 =
+  /* @__PURE__ */ defineModelContractSchema(() =>
+    z.enum(["explicit", "session", "deployment", "continuation"]),
+  );
 export type TurnExecutionLatencyModeSourceV1 = z.infer<typeof TurnExecutionLatencyModeSourceV1>;
 
 /**
@@ -15557,7 +15840,9 @@ export const ClientModel = /* @__PURE__ */ defineModelContractSchema(() =>
     provider: z.string(), // provider id
     providerLabel: z.string(),
     api: z.enum(["responses", "chat"]),
-    source: z.enum(["opengeni", "codex", "supergrok", "workspace_gateway"]).optional(),
+    source: z
+      .enum(["opengeni", "codex", "supergrok", "workspace_gateway", "openrouter"])
+      .optional(),
     contextWindowTokens: z.number().int().positive().optional(),
     // Additive normalized definition metadata. Optional so older server payloads
     // remain parseable; current servers project the complete V1 set.
@@ -15579,6 +15864,7 @@ export const ClientModel = /* @__PURE__ */ defineModelContractSchema(() =>
       .optional(),
     credentialSource: ModelCredentialSourceV1.optional(),
     billing: ModelBillingAttributionV1.optional(),
+    cost: ModelCostClassV1.optional(),
     capabilities: ModelCapabilitiesV1.optional(),
     pricing: ModelPricingScheduleV1.optional(),
     definitionVersion: z
@@ -15589,59 +15875,60 @@ export const ClientModel = /* @__PURE__ */ defineModelContractSchema(() =>
 );
 export type ClientModel = z.infer<typeof ClientModel>;
 
-export const ModelCredentialReadinessV1 = /* @__PURE__ */ defineModelContractSchema(() =>
-  z
-    .object({
-      status: z.enum(["ready", "not_ready", "error"]),
-      reason: z
-        .enum([
-          "missing_credential",
-          "needs_reauth",
-          "prerequisites_missing",
-          "resolver_error",
-          "observation_stale",
-        ])
-        .nullable(),
-      basis: z.enum(["configuration", "connection", "resolver"]),
-      checkedAt: z.string().datetime().nullable(),
-    })
-    .strict()
-    .superRefine((readiness, context) => {
-      if ((readiness.status === "ready") !== (readiness.reason === null)) {
-        context.addIssue({
-          code: "custom",
-          path: ["reason"],
-          message: "ready credential state requires no reason; non-ready state requires a reason",
-        });
-      }
-      if ((readiness.status === "error") !== (readiness.reason === "resolver_error")) {
-        context.addIssue({
-          code: "custom",
-          path: ["reason"],
-          message:
-            "credential errors require resolver_error and resolver_error requires error status",
-        });
-      }
-      if (
-        readiness.basis === "resolver" &&
-        readiness.status === "ready" &&
-        readiness.checkedAt === null
-      ) {
-        context.addIssue({
-          code: "custom",
-          path: ["checkedAt"],
-          message: "resolver readiness requires an observation timestamp",
-        });
-      }
-      if (readiness.reason === "observation_stale" && readiness.checkedAt === null) {
-        context.addIssue({
-          code: "custom",
-          path: ["checkedAt"],
-          message: "a stale observation requires its observation timestamp",
-        });
-      }
-    }),
-);
+export const ModelCredentialReadinessV1 =
+  /* @__PURE__ */ defineModelContractSchema(() =>
+    z
+      .object({
+        status: z.enum(["ready", "not_ready", "error"]),
+        reason: z
+          .enum([
+            "missing_credential",
+            "needs_reauth",
+            "prerequisites_missing",
+            "resolver_error",
+            "observation_stale",
+          ])
+          .nullable(),
+        basis: z.enum(["configuration", "connection", "resolver"]),
+        checkedAt: z.string().datetime().nullable(),
+      })
+      .strict()
+      .superRefine((readiness, context) => {
+        if ((readiness.status === "ready") !== (readiness.reason === null)) {
+          context.addIssue({
+            code: "custom",
+            path: ["reason"],
+            message: "ready credential state requires no reason; non-ready state requires a reason",
+          });
+        }
+        if ((readiness.status === "error") !== (readiness.reason === "resolver_error")) {
+          context.addIssue({
+            code: "custom",
+            path: ["reason"],
+            message:
+              "credential errors require resolver_error and resolver_error requires error status",
+          });
+        }
+        if (
+          readiness.basis === "resolver" &&
+          readiness.status === "ready" &&
+          readiness.checkedAt === null
+        ) {
+          context.addIssue({
+            code: "custom",
+            path: ["checkedAt"],
+            message: "resolver readiness requires an observation timestamp",
+          });
+        }
+        if (readiness.reason === "observation_stale" && readiness.checkedAt === null) {
+          context.addIssue({
+            code: "custom",
+            path: ["checkedAt"],
+            message: "a stale observation requires its observation timestamp",
+          });
+        }
+      }),
+  );
 export type ModelCredentialReadinessV1 = z.infer<typeof ModelCredentialReadinessV1>;
 
 export const ModelAvailabilityV1 = /* @__PURE__ */ defineModelContractSchema(() =>
@@ -15664,21 +15951,23 @@ export const ModelAvailabilityV1 = /* @__PURE__ */ defineModelContractSchema(()
 );
 export type ModelAvailabilityV1 = z.infer<typeof ModelAvailabilityV1>;
 
-export const WorkspaceModelCatalogModel = /* @__PURE__ */ defineModelContractSchema(() =>
-  ClientModel.extend({
-    credentialReadiness: ModelCredentialReadinessV1,
-    /** Exact workspace-policy verdict without exposing provider identity. */
-    policyAllowed: z.boolean().optional(),
-    availability: ModelAvailabilityV1,
-  }),
-);
+export const WorkspaceModelCatalogModel =
+  /* @__PURE__ */ defineModelContractSchema(() =>
+    ClientModel.extend({
+      credentialReadiness: ModelCredentialReadinessV1,
+      /** Exact workspace-policy verdict without exposing provider identity. */
+      policyAllowed: z.boolean().optional(),
+      availability: ModelAvailabilityV1,
+    }),
+  );
 export type WorkspaceModelCatalogModel = z.infer<typeof WorkspaceModelCatalogModel>;
 
-export const WorkspaceModelCatalogResponse = /* @__PURE__ */ defineModelContractSchema(() =>
-  z.object({
-    models: z.array(WorkspaceModelCatalogModel),
-  }),
-);
+export const WorkspaceModelCatalogResponse =
+  /* @__PURE__ */ defineModelContractSchema(() =>
+    z.object({
+      models: z.array(WorkspaceModelCatalogModel),
+    }),
+  );
 export type WorkspaceModelCatalogResponse = z.infer<typeof WorkspaceModelCatalogResponse>;
 
 /**
@@ -15709,6 +15998,9 @@ export const ClientConfig = /* @__PURE__ */ defineModelContractSchema(() =>
     models: z.array(ClientModel).default([]),
     defaultReasoningEffort: ReasoningEffort,
     allowedReasoningEfforts: z.array(ReasoningEffort).min(1),
+    // Client-safe execution default. The schedule editor uses this to avoid
+    // presenting a targetless "managed" choice on self-hosted deployments.
+    defaultSandboxBackend: SandboxBackend.default("modal"),
     mcpServers: z
       .array(
         z.object({