@opengeni/contracts 3.1.0-canary.1 → 3.1.2

package/dist/direct-model-provider.d.ts

@@ -0,0 +1,36 @@
+import { z } from "zod";
+export declare const DirectModelProvider: z.ZodEnum<{
+    azure_openai: "azure_openai";
+    openai: "openai";
+}>;
+export type DirectModelProvider = z.infer<typeof DirectModelProvider>;
+/** Pin customer credentials to official provider origins, never arbitrary URLs. */
+export declare const AzureOpenAIEndpoint: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+export declare const DirectModelProviderMetadata: z.ZodObject<{
+    provider: z.ZodEnum<{
+        azure_openai: "azure_openai";
+        openai: "openai";
+    }>;
+    model: z.ZodString;
+    endpoint: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+}, z.core.$strict>;
+export type DirectModelProviderMetadata = z.infer<typeof DirectModelProviderMetadata>;
+export declare function directModelConnectionSpec(connection: {
+    id: string;
+    version: number;
+    subjectId: string | null;
+    kind: string;
+    status: string;
+    providerDomain: string;
+    metadata: Record<string, unknown>;
+}): {
+    provider: "azure_openai" | "openai";
+    model: string;
+    endpoint?: string | undefined;
+    baseUrl: string;
+    providerId: string;
+    modelId: string;
+    connectionId: string;
+    version: number;
+} | null;
+export declare function isDirectModelId(modelId: string): boolean;

package/dist/editable-artifact-codec-registry.js

@@ -2,12 +2,12 @@ import {
   EDITABLE_ARTIFACT_CODEC_REGISTRY,
   currentEditableArtifactCompatibility,
   editableArtifactCodecFor
-} from "./chunk-5LYFSZ7O.js";
-import "./chunk-Y3KNXVTD.js";
-import "./chunk-D2HKF2EF.js";
-import "./chunk-TXTQIYCV.js";
+} from "./chunk-352X6ENP.js";
 import "./chunk-RIY7GYQS.js";
+import "./chunk-D2HKF2EF.js";
 import "./chunk-MYBZRDTY.js";
+import "./chunk-RMWXDZEO.js";
+import "./chunk-ILJ72KPO.js";
 import {
   DOCUMENT_ARTIFACT_MODEL_SCHEMA_VERSION,
   DOCUMENT_ARTIFACT_SNAPSHOT_VERSION,
@@ -15,7 +15,7 @@ import {
   PRESENTATION_ARTIFACT_SNAPSHOT_VERSION,
   SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,
   SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION
-} from "./chunk-PX3VCKAU.js";
+} from "./chunk-WVCFSOUZ.js";
 export {
   DOCUMENT_ARTIFACT_MODEL_SCHEMA_VERSION,
   DOCUMENT_ARTIFACT_SNAPSHOT_VERSION,

package/dist/editable-artifact-committed-transaction.js

@@ -4,10 +4,11 @@ import {
   MAX_COMMITTED_TRANSACTION_CELLS,
   MAX_COMMITTED_TRANSACTION_OPERATIONS,
   decodeCommittedTransactionSummary
-} from "./chunk-3SIZGL3O.js";
+} from "./chunk-IK36LXKC.js";
+import "./chunk-ILJ72KPO.js";
 import {
   COMMITTED_TRANSACTION_PROTOCOL_VERSION
-} from "./chunk-PX3VCKAU.js";
+} from "./chunk-WVCFSOUZ.js";
 export {
   COMMITTED_TRANSACTION_PROTOCOL_VERSION,
   MAX_COMMITTED_TRANSACTION_BYTES,

package/dist/editable-artifact-live.js

@@ -2,16 +2,16 @@ import {
   EDITABLE_ARTIFACT_INTENT_MAX_BYTES,
   hashEditableArtifactMutationIntentBytes
 } from "./chunk-NVJMJWLL.js";
+import "./chunk-352X6ENP.js";
 import "./chunk-YRKRZ6OF.js";
-import "./chunk-5LYFSZ7O.js";
-import "./chunk-Y3KNXVTD.js";
-import "./chunk-D2HKF2EF.js";
-import "./chunk-TXTQIYCV.js";
 import "./chunk-RIY7GYQS.js";
+import "./chunk-D2HKF2EF.js";
 import "./chunk-MYBZRDTY.js";
+import "./chunk-RMWXDZEO.js";
+import "./chunk-ILJ72KPO.js";
 import {
   EDITABLE_ARTIFACT_LIVE_WIRE_VERSION
-} from "./chunk-PX3VCKAU.js";
+} from "./chunk-WVCFSOUZ.js";
 
 // src/editable-artifact-live.ts
 var MAGIC = new TextEncoder().encode("OGALV002");

package/dist/editable-artifact-serialized-commit.js

@@ -4,18 +4,18 @@ import {
   assertCanonicalEditableArtifactSerializedCommit,
   decodeEditableArtifactSerializedCommit,
   encodeEditableArtifactSerializedCommit
-} from "./chunk-O5LEQHDM.js";
+} from "./chunk-Z7WEVGCL.js";
 import "./chunk-NVJMJWLL.js";
+import "./chunk-352X6ENP.js";
 import "./chunk-YRKRZ6OF.js";
-import "./chunk-5LYFSZ7O.js";
-import "./chunk-Y3KNXVTD.js";
-import "./chunk-D2HKF2EF.js";
-import "./chunk-TXTQIYCV.js";
 import "./chunk-RIY7GYQS.js";
+import "./chunk-D2HKF2EF.js";
 import "./chunk-MYBZRDTY.js";
+import "./chunk-RMWXDZEO.js";
+import "./chunk-ILJ72KPO.js";
 import {
   EDITABLE_ARTIFACT_SERIALIZED_COMMIT_VERSION
-} from "./chunk-PX3VCKAU.js";
+} from "./chunk-WVCFSOUZ.js";
 export {
   EDITABLE_ARTIFACT_NATIVE_RECEIPT_MAX_BYTES,
   EDITABLE_ARTIFACT_SERIALIZED_COMMIT_MAX_BYTES,

package/dist/editable-artifact-versions.d.ts

@@ -1,4 +1,10 @@
-/** Modality-specific durable semantic/schema versions. */
+/**
+ * Modality-specific durable semantic/schema versions.
+ * Spreadsheet dimensions are an additive current-schema extension: existing
+ * command/operation tags and dimension-free snapshot bytes stay unchanged.
+ * Direct snapshots and private projections advertise their explicit extension
+ * flags; old executables reject new tags/flags, never silently discard them.
+ */
 export declare const SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION: 2;
 export declare const DOCUMENT_ARTIFACT_MODEL_SCHEMA_VERSION: 1;
 export declare const PRESENTATION_ARTIFACT_MODEL_SCHEMA_VERSION: 1;

package/dist/editable-artifact-versions.js

@@ -11,7 +11,7 @@ import {
   SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION,
   SPREADSHEET_KERNEL_COMMAND_VERSION,
   SPREADSHEET_KERNEL_SNAPSHOT_VERSION
-} from "./chunk-PX3VCKAU.js";
+} from "./chunk-WVCFSOUZ.js";
 export {
   COMMITTED_TRANSACTION_PROTOCOL_VERSION,
   DOCUMENT_ARTIFACT_MODEL_SCHEMA_VERSION,

package/dist/editable-artifacts.js

@@ -13,6 +13,11 @@ import {
   hashEditableArtifactMutationIntent,
   hashEditableArtifactMutationIntentBytes
 } from "./chunk-NVJMJWLL.js";
+import {
+  EDITABLE_ARTIFACT_CODEC_REGISTRY,
+  currentEditableArtifactCompatibility,
+  editableArtifactCodecFor
+} from "./chunk-352X6ENP.js";
 import {
   EDITABLE_ARTIFACT_CAUSAL_FRONTIER_MAX_BYTES,
   EDITABLE_ARTIFACT_CAUSAL_FRONTIER_MAX_REPLICAS,
@@ -22,33 +27,31 @@ import {
   encodeEditableArtifactCausalFrontier
 } from "./chunk-YRKRZ6OF.js";
 import {
-  EDITABLE_ARTIFACT_CODEC_REGISTRY,
-  currentEditableArtifactCompatibility,
-  editableArtifactCodecFor
-} from "./chunk-5LYFSZ7O.js";
-import {
-  SPREADSHEET_ARTIFACT_METADATA_MAX_SHEETS,
-  SPREADSHEET_ARTIFACT_METADATA_MIN_RESPONSE_BYTES,
-  SPREADSHEET_ARTIFACT_PROJECTION_MAX_BYTES,
-  SPREADSHEET_ARTIFACT_PROJECTION_MAX_STRING_BYTES,
-  SPREADSHEET_ARTIFACT_QUERY_MAX_BYTES,
-  SPREADSHEET_ARTIFACT_QUERY_VERSION,
-  SPREADSHEET_ARTIFACT_VIEWPORT_MAX_AREA,
-  SPREADSHEET_ARTIFACT_VIEWPORT_MAX_CELLS,
-  SPREADSHEET_ARTIFACT_VIEWPORT_MIN_RESPONSE_BYTES,
-  assertCanonicalSpreadsheetArtifactKernelProjectionBytes,
-  assertCanonicalSpreadsheetArtifactKernelQueryBytes,
-  decodeSpreadsheetArtifactKernelProjection,
-  decodeSpreadsheetArtifactKernelQuery,
-  decodeSpreadsheetMetadataKernelProjection,
-  decodeSpreadsheetViewportKernelProjection,
-  encodeSpreadsheetArtifactKernelProjection,
-  encodeSpreadsheetArtifactKernelQuery,
-  encodeSpreadsheetMetadataKernelProjection,
-  encodeSpreadsheetMetadataKernelQuery,
-  encodeSpreadsheetViewportKernelProjection,
-  encodeSpreadsheetViewportKernelQuery
-} from "./chunk-Y3KNXVTD.js";
+  DOCUMENT_ARTIFACT_COMMAND_MAX_BYTES,
+  DOCUMENT_ARTIFACT_COMMAND_MAX_COMMANDS,
+  DOCUMENT_ARTIFACT_COMMAND_MAX_STRING_BYTES,
+  DOCUMENT_ARTIFACT_COMMAND_VERSION,
+  DOCUMENT_ARTIFACT_MAX_STRUCTURAL_COUNTER,
+  DOCUMENT_ARTIFACT_MAX_TABLE_CELLS,
+  DOCUMENT_ARTIFACT_MAX_TEXT_RUNS,
+  DOCUMENT_ARTIFACT_MAX_TEXT_UTF16,
+  DOCUMENT_ARTIFACT_QUERY_MAX_BYTES,
+  DOCUMENT_ARTIFACT_QUERY_MAX_ITEMS,
+  DOCUMENT_ARTIFACT_QUERY_MAX_TABLE_CELLS,
+  DOCUMENT_ARTIFACT_QUERY_MAX_TEXT_UTF16,
+  DOCUMENT_ARTIFACT_QUERY_RESPONSE_MAX_BYTES,
+  DOCUMENT_ARTIFACT_QUERY_RESPONSE_VERSION,
+  DOCUMENT_ARTIFACT_QUERY_VERSION,
+  assertCanonicalDocumentArtifactCommandBytes,
+  assertCanonicalDocumentArtifactQueryBytes,
+  assertCanonicalDocumentArtifactQueryResponseBytes,
+  decodeDocumentArtifactCommandBatch,
+  decodeDocumentArtifactQuery,
+  decodeDocumentArtifactQueryResponse,
+  encodeDocumentArtifactCommandBatch,
+  encodeDocumentArtifactQuery,
+  encodeDocumentArtifactQueryResponse
+} from "./chunk-RIY7GYQS.js";
 import {
   PRESENTATION_ARTIFACT_COMMAND_MAX_BYTES,
   PRESENTATION_ARTIFACT_COMMAND_MAX_COMMANDS,
@@ -81,45 +84,45 @@ import {
   encodePresentationArtifactQuery,
   encodePresentationArtifactQueryResponse
 } from "./chunk-D2HKF2EF.js";
+import "./chunk-MYBZRDTY.js";
+import {
+  SPREADSHEET_ARTIFACT_METADATA_MAX_SHEETS,
+  SPREADSHEET_ARTIFACT_METADATA_MIN_RESPONSE_BYTES,
+  SPREADSHEET_ARTIFACT_PROJECTION_MAX_BYTES,
+  SPREADSHEET_ARTIFACT_PROJECTION_MAX_STRING_BYTES,
+  SPREADSHEET_ARTIFACT_QUERY_MAX_BYTES,
+  SPREADSHEET_ARTIFACT_QUERY_VERSION,
+  SPREADSHEET_ARTIFACT_VIEWPORT_MAX_AREA,
+  SPREADSHEET_ARTIFACT_VIEWPORT_MAX_CELLS,
+  SPREADSHEET_ARTIFACT_VIEWPORT_MIN_RESPONSE_BYTES,
+  assertCanonicalSpreadsheetArtifactKernelProjectionBytes,
+  assertCanonicalSpreadsheetArtifactKernelQueryBytes,
+  decodeSpreadsheetArtifactKernelProjection,
+  decodeSpreadsheetArtifactKernelQuery,
+  decodeSpreadsheetMetadataKernelProjection,
+  decodeSpreadsheetViewportKernelProjection,
+  encodeSpreadsheetArtifactKernelProjection,
+  encodeSpreadsheetArtifactKernelQuery,
+  encodeSpreadsheetMetadataKernelProjection,
+  encodeSpreadsheetMetadataKernelQuery,
+  encodeSpreadsheetViewportKernelProjection,
+  encodeSpreadsheetViewportKernelQuery
+} from "./chunk-RMWXDZEO.js";
 import {
   SPREADSHEET_ARTIFACT_COMMAND_MAX_BYTES,
   SPREADSHEET_ARTIFACT_COMMAND_MAX_CELLS,
   SPREADSHEET_ARTIFACT_COMMAND_MAX_COMMANDS,
   SPREADSHEET_ARTIFACT_COMMAND_MAX_STRING_BYTES,
   SPREADSHEET_ARTIFACT_SHEET_NAME_MAX_UTF16_UNITS,
+  SPREADSHEET_DEFAULT_COLUMN_WIDTH,
+  SPREADSHEET_DEFAULT_ROW_HEIGHT,
+  SPREADSHEET_MAX_DIMENSION_PIXELS,
   assertCanonicalSpreadsheetArtifactCommandBytes,
   decodeSpreadsheetArtifactCommandBatch,
   editableArtifactStableId,
   encodeSpreadsheetArtifactCommandBatch,
   spreadsheetSheetId
-} from "./chunk-TXTQIYCV.js";
-import {
-  DOCUMENT_ARTIFACT_COMMAND_MAX_BYTES,
-  DOCUMENT_ARTIFACT_COMMAND_MAX_COMMANDS,
-  DOCUMENT_ARTIFACT_COMMAND_MAX_STRING_BYTES,
-  DOCUMENT_ARTIFACT_COMMAND_VERSION,
-  DOCUMENT_ARTIFACT_MAX_STRUCTURAL_COUNTER,
-  DOCUMENT_ARTIFACT_MAX_TABLE_CELLS,
-  DOCUMENT_ARTIFACT_MAX_TEXT_RUNS,
-  DOCUMENT_ARTIFACT_MAX_TEXT_UTF16,
-  DOCUMENT_ARTIFACT_QUERY_MAX_BYTES,
-  DOCUMENT_ARTIFACT_QUERY_MAX_ITEMS,
-  DOCUMENT_ARTIFACT_QUERY_MAX_TABLE_CELLS,
-  DOCUMENT_ARTIFACT_QUERY_MAX_TEXT_UTF16,
-  DOCUMENT_ARTIFACT_QUERY_RESPONSE_MAX_BYTES,
-  DOCUMENT_ARTIFACT_QUERY_RESPONSE_VERSION,
-  DOCUMENT_ARTIFACT_QUERY_VERSION,
-  assertCanonicalDocumentArtifactCommandBytes,
-  assertCanonicalDocumentArtifactQueryBytes,
-  assertCanonicalDocumentArtifactQueryResponseBytes,
-  decodeDocumentArtifactCommandBatch,
-  decodeDocumentArtifactQuery,
-  decodeDocumentArtifactQueryResponse,
-  encodeDocumentArtifactCommandBatch,
-  encodeDocumentArtifactQuery,
-  encodeDocumentArtifactQueryResponse
-} from "./chunk-RIY7GYQS.js";
-import "./chunk-MYBZRDTY.js";
+} from "./chunk-ILJ72KPO.js";
 import {
   DOCUMENT_ARTIFACT_MODEL_SCHEMA_VERSION,
   DOCUMENT_ARTIFACT_SNAPSHOT_VERSION,
@@ -128,7 +131,7 @@ import {
   SPREADSHEET_ARTIFACT_COMMAND_VERSION,
   SPREADSHEET_ARTIFACT_MODEL_SCHEMA_VERSION,
   SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION
-} from "./chunk-PX3VCKAU.js";
+} from "./chunk-WVCFSOUZ.js";
 export {
   DOCUMENT_ARTIFACT_COMMAND_MAX_BYTES,
   DOCUMENT_ARTIFACT_COMMAND_MAX_COMMANDS,
@@ -199,6 +202,9 @@ export {
   SPREADSHEET_ARTIFACT_VIEWPORT_MAX_CELLS,
   SPREADSHEET_ARTIFACT_VIEWPORT_MIN_RESPONSE_BYTES,
   SPREADSHEET_COLLABORATION_SNAPSHOT_VERSION,
+  SPREADSHEET_DEFAULT_COLUMN_WIDTH,
+  SPREADSHEET_DEFAULT_ROW_HEIGHT,
+  SPREADSHEET_MAX_DIMENSION_PIXELS,
   assertCanonicalDocumentArtifactCommandBytes,
   assertCanonicalDocumentArtifactQueryBytes,
   assertCanonicalDocumentArtifactQueryResponseBytes,

package/dist/event-preview.d.ts

@@ -8,6 +8,16 @@
  */
 import { type RetainedOutputEvidence } from "./retained-output.js";
 export declare const SESSION_EVENT_PAYLOAD_MAX_BYTES: number;
+/**
+ * Durable ceiling for one `agent.toolCall.output` event. The event is the
+ * human/audit record of a tool result; model history keeps its own truncated
+ * copy separately. A tool can return far more than anyone ever sees (a shell
+ * command printing a 45 MB line, for example), and storing that inline made
+ * every later history read load it whole. The budget comfortably exceeds the
+ * model-facing tool-output truncation, so the timeline never shows less than
+ * the model saw.
+ */
+export declare const TOOL_CALL_OUTPUT_EVENT_MAX_BYTES: number;
 export type SessionEventBoundarySurface = "durable_audit" | "database_guard" | "database_read_projection" | "http_projection" | "nats_legacy_guard" | "sse_legacy_guard" | "browser_legacy_guard";
 export type SessionEventPayloadTruncation = {
     truncated: true;
@@ -31,6 +41,11 @@ export type SessionEventPayloadTruncation = {
 export type BoundSessionEventPayloadOptions = {
     surface?: SessionEventBoundarySurface;
     maxBytes?: number;
+    /**
+     * Per-string head+tail budget once the payload must be bounded. Defaults to
+     * the compact preview budget; larger budgets keep the byte target at maxBytes.
+     */
+    stringBytes?: number;
     /**
      * Separately trusted durable receipt. Producer payload fields never populate
      * this slot; invalid values fail closed to not_retained.
@@ -75,3 +90,10 @@ export declare function sessionEventPayloadTruncation(payload: unknown): Session
  * durably retain their source bytes as independently retrievable evidence.
  */
 export declare function boundSessionEventPayload<T>(payload: T, options?: BoundSessionEventPayloadOptions): T;
+/**
+ * Write-time bound for durable session events. Only tool-call output has an
+ * unbounded producer; it is kept intact up to TOOL_CALL_OUTPUT_EVENT_MAX_BYTES
+ * and otherwise stored as an explicit head+tail preview whose `truncation`
+ * records the original size. Every other event type is returned unchanged.
+ */
+export declare function boundSessionEventPayloadForWrite<T>(type: string, payload: T): T;

package/dist/external-identities.d.ts

@@ -41,6 +41,7 @@ export declare const AddExternalWorkspaceMemberRequest: z.ZodObject<{
         "scheduled_tasks:run": "scheduled_tasks:run";
         "secrets:list": "secrets:list";
         "secrets:read": "secrets:read";
+        "secrets:use": "secrets:use";
         "secrets:write": "secrets:write";
         "sessions:control": "sessions:control";
         "sessions:create": "sessions:create";
@@ -49,6 +50,7 @@ export declare const AddExternalWorkspaceMemberRequest: z.ZodObject<{
         "stream:control": "stream:control";
         "stream:view": "stream:view";
         "terminal:attach": "terminal:attach";
+        "usage_allowances:manage": "usage_allowances:manage";
         "variable-sets:attach": "variable-sets:attach";
         "variable-sets:list": "variable-sets:list";
         "variable-sets:manage": "variable-sets:manage";
@@ -59,8 +61,162 @@ export declare const AddExternalWorkspaceMemberRequest: z.ZodObject<{
         "workspace:create": "workspace:create";
         "workspace:read": "workspace:read";
     }>>;
+    operationId: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export type AddExternalWorkspaceMemberRequest = z.infer<typeof AddExternalWorkspaceMemberRequest>;
+/** Content-free service lookup, including identities which can no longer act. */
+export declare const ExternalIdentityLookup: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    found: z.ZodLiteral<false>;
+}, z.core.$strict>, z.ZodObject<{
+    found: z.ZodLiteral<true>;
+    subjectId: z.ZodString;
+    organizationMembershipId: z.ZodString;
+    identityStatus: z.ZodEnum<{
+        active: "active";
+        disabled: "disabled";
+        revoked: "revoked";
+    }>;
+    identityAuthorizationRevision: z.ZodNumber;
+    membershipStatus: z.ZodEnum<{
+        active: "active";
+        provisioning: "provisioning";
+        revoked: "revoked";
+        suspended: "suspended";
+    }>;
+    membershipAuthorizationRevision: z.ZodNumber;
+}, z.core.$strict>], "found">;
+export type ExternalIdentityLookup = z.infer<typeof ExternalIdentityLookup>;
+/** Terminal withdrawal of this external member's workspace access, also fencing
+ * an exact earlier onboarding operation whether or not it has reached the API. */
+export declare const CancelExternalWorkspaceMemberGrantRequest: z.ZodObject<{
+    operationId: z.ZodString;
+    cancelGrantOperationId: z.ZodString;
+}, z.core.$strict>;
+export type CancelExternalWorkspaceMemberGrantRequest = z.infer<typeof CancelExternalWorkspaceMemberGrantRequest>;
+export declare const CancelExternalWorkspaceMemberGrantResponse: z.ZodObject<{
+    removed: z.ZodBoolean;
+    replay: z.ZodBoolean;
+    fencedGrantOperationId: z.ZodString;
+}, z.core.$strict>;
+export type CancelExternalWorkspaceMemberGrantResponse = z.infer<typeof CancelExternalWorkspaceMemberGrantResponse>;
+/** Replace an existing external member's permissions in one shared workspace.
+ * Keyed and idempotent like a grant; narrowing forces live authority to
+ * re-check but never cancels or tears down work. */
+export declare const UpdateExternalWorkspaceMemberRequest: z.ZodObject<{
+    permissions: z.ZodArray<z.ZodEnum<{
+        "account:admin": "account:admin";
+        "account:read": "account:read";
+        "api_keys:manage": "api_keys:manage";
+        "artifacts:publish": "artifacts:publish";
+        "artifacts:read": "artifacts:read";
+        "billing:manage": "billing:manage";
+        "billing:read": "billing:read";
+        "capabilities:manage": "capabilities:manage";
+        "codemode:call": "codemode:call";
+        "connections:read": "connections:read";
+        "connections:write": "connections:write";
+        "documents:manage": "documents:manage";
+        "documents:search": "documents:search";
+        "enrollments:manage": "enrollments:manage";
+        "enrollments:read": "enrollments:read";
+        "environments:manage": "environments:manage";
+        "environments:use": "environments:use";
+        "files:read": "files:read";
+        "files:upload": "files:upload";
+        "files:write": "files:write";
+        "github:manage": "github:manage";
+        "github:use": "github:use";
+        "goals:manage": "goals:manage";
+        "mcp_servers:attach": "mcp_servers:attach";
+        "members:manage": "members:manage";
+        "rigs:manage": "rigs:manage";
+        "rigs:use": "rigs:use";
+        "scheduled_tasks:manage": "scheduled_tasks:manage";
+        "scheduled_tasks:run": "scheduled_tasks:run";
+        "secrets:list": "secrets:list";
+        "secrets:read": "secrets:read";
+        "secrets:use": "secrets:use";
+        "secrets:write": "secrets:write";
+        "sessions:control": "sessions:control";
+        "sessions:create": "sessions:create";
+        "sessions:read": "sessions:read";
+        "stream:acknowledge": "stream:acknowledge";
+        "stream:control": "stream:control";
+        "stream:view": "stream:view";
+        "terminal:attach": "terminal:attach";
+        "usage_allowances:manage": "usage_allowances:manage";
+        "variable-sets:attach": "variable-sets:attach";
+        "variable-sets:list": "variable-sets:list";
+        "variable-sets:manage": "variable-sets:manage";
+        "variable-sets:read": "variable-sets:read";
+        "variable-sets:use": "variable-sets:use";
+        "variable-sets:write": "variable-sets:write";
+        "workspace:admin": "workspace:admin";
+        "workspace:create": "workspace:create";
+        "workspace:read": "workspace:read";
+    }>>;
+    operationId: z.ZodString;
+}, z.core.$strict>;
+export type UpdateExternalWorkspaceMemberRequest = z.infer<typeof UpdateExternalWorkspaceMemberRequest>;
+export declare const UpdateExternalWorkspaceMemberResponse: z.ZodObject<{
+    subjectId: z.ZodString;
+    organizationMembershipId: z.ZodString;
+    permissions: z.ZodArray<z.ZodEnum<{
+        "account:admin": "account:admin";
+        "account:read": "account:read";
+        "api_keys:manage": "api_keys:manage";
+        "artifacts:publish": "artifacts:publish";
+        "artifacts:read": "artifacts:read";
+        "billing:manage": "billing:manage";
+        "billing:read": "billing:read";
+        "capabilities:manage": "capabilities:manage";
+        "codemode:call": "codemode:call";
+        "connections:read": "connections:read";
+        "connections:write": "connections:write";
+        "documents:manage": "documents:manage";
+        "documents:search": "documents:search";
+        "enrollments:manage": "enrollments:manage";
+        "enrollments:read": "enrollments:read";
+        "environments:manage": "environments:manage";
+        "environments:use": "environments:use";
+        "files:read": "files:read";
+        "files:upload": "files:upload";
+        "files:write": "files:write";
+        "github:manage": "github:manage";
+        "github:use": "github:use";
+        "goals:manage": "goals:manage";
+        "mcp_servers:attach": "mcp_servers:attach";
+        "members:manage": "members:manage";
+        "rigs:manage": "rigs:manage";
+        "rigs:use": "rigs:use";
+        "scheduled_tasks:manage": "scheduled_tasks:manage";
+        "scheduled_tasks:run": "scheduled_tasks:run";
+        "secrets:list": "secrets:list";
+        "secrets:read": "secrets:read";
+        "secrets:use": "secrets:use";
+        "secrets:write": "secrets:write";
+        "sessions:control": "sessions:control";
+        "sessions:create": "sessions:create";
+        "sessions:read": "sessions:read";
+        "stream:acknowledge": "stream:acknowledge";
+        "stream:control": "stream:control";
+        "stream:view": "stream:view";
+        "terminal:attach": "terminal:attach";
+        "usage_allowances:manage": "usage_allowances:manage";
+        "variable-sets:attach": "variable-sets:attach";
+        "variable-sets:list": "variable-sets:list";
+        "variable-sets:manage": "variable-sets:manage";
+        "variable-sets:read": "variable-sets:read";
+        "variable-sets:use": "variable-sets:use";
+        "variable-sets:write": "variable-sets:write";
+        "workspace:admin": "workspace:admin";
+        "workspace:create": "workspace:create";
+        "workspace:read": "workspace:read";
+    }>>;
+    narrowed: z.ZodBoolean;
+    replay: z.ZodBoolean;
+}, z.core.$strict>;
+export type UpdateExternalWorkspaceMemberResponse = z.infer<typeof UpdateExternalWorkspaceMemberResponse>;
 /** Uses the organization membership ID returned by lazy identity admission.
  * Reactivation restores admission only, not revoked work or workspace grants. */
 export declare const UpdateExternalIdentityMembershipRequest: z.ZodObject<{
@@ -191,6 +347,7 @@ export declare const ExternalIdentityLink: z.ZodObject<{
         "scheduled_tasks:run": "scheduled_tasks:run";
         "secrets:list": "secrets:list";
         "secrets:read": "secrets:read";
+        "secrets:use": "secrets:use";
         "secrets:write": "secrets:write";
         "sessions:control": "sessions:control";
         "sessions:create": "sessions:create";
@@ -199,6 +356,7 @@ export declare const ExternalIdentityLink: z.ZodObject<{
         "stream:control": "stream:control";
         "stream:view": "stream:view";
         "terminal:attach": "terminal:attach";
+        "usage_allowances:manage": "usage_allowances:manage";
         "variable-sets:attach": "variable-sets:attach";
         "variable-sets:list": "variable-sets:list";
         "variable-sets:manage": "variable-sets:manage";
@@ -261,6 +419,7 @@ export declare const ExternalIdentityLinkPage: z.ZodObject<{
             "scheduled_tasks:run": "scheduled_tasks:run";
             "secrets:list": "secrets:list";
             "secrets:read": "secrets:read";
+            "secrets:use": "secrets:use";
             "secrets:write": "secrets:write";
             "sessions:control": "sessions:control";
             "sessions:create": "sessions:create";
@@ -269,6 +428,7 @@ export declare const ExternalIdentityLinkPage: z.ZodObject<{
             "stream:control": "stream:control";
             "stream:view": "stream:view";
             "terminal:attach": "terminal:attach";
+            "usage_allowances:manage": "usage_allowances:manage";
             "variable-sets:attach": "variable-sets:attach";
             "variable-sets:list": "variable-sets:list";
             "variable-sets:manage": "variable-sets:manage";
@@ -319,6 +479,7 @@ export declare const BeginExternalIdentityLinkRequest: z.ZodObject<{
         "scheduled_tasks:run": "scheduled_tasks:run";
         "secrets:list": "secrets:list";
         "secrets:read": "secrets:read";
+        "secrets:use": "secrets:use";
         "secrets:write": "secrets:write";
         "sessions:control": "sessions:control";
         "sessions:create": "sessions:create";
@@ -327,6 +488,7 @@ export declare const BeginExternalIdentityLinkRequest: z.ZodObject<{
         "stream:control": "stream:control";
         "stream:view": "stream:view";
         "terminal:attach": "terminal:attach";
+        "usage_allowances:manage": "usage_allowances:manage";
         "variable-sets:attach": "variable-sets:attach";
         "variable-sets:list": "variable-sets:list";
         "variable-sets:manage": "variable-sets:manage";
@@ -375,6 +537,7 @@ export declare const ConfirmExternalIdentityLinkRequest: z.ZodObject<{
         "scheduled_tasks:run": "scheduled_tasks:run";
         "secrets:list": "secrets:list";
         "secrets:read": "secrets:read";
+        "secrets:use": "secrets:use";
         "secrets:write": "secrets:write";
         "sessions:control": "sessions:control";
         "sessions:create": "sessions:create";
@@ -383,6 +546,7 @@ export declare const ConfirmExternalIdentityLinkRequest: z.ZodObject<{
         "stream:control": "stream:control";
         "stream:view": "stream:view";
         "terminal:attach": "terminal:attach";
+        "usage_allowances:manage": "usage_allowances:manage";
         "variable-sets:attach": "variable-sets:attach";
         "variable-sets:list": "variable-sets:list";
         "variable-sets:manage": "variable-sets:manage";
@@ -444,6 +608,7 @@ export declare const BeginExternalIdentityLinkResponse: z.ZodObject<{
             "scheduled_tasks:run": "scheduled_tasks:run";
             "secrets:list": "secrets:list";
             "secrets:read": "secrets:read";
+            "secrets:use": "secrets:use";
             "secrets:write": "secrets:write";
             "sessions:control": "sessions:control";
             "sessions:create": "sessions:create";
@@ -452,6 +617,7 @@ export declare const BeginExternalIdentityLinkResponse: z.ZodObject<{
             "stream:control": "stream:control";
             "stream:view": "stream:view";
             "terminal:attach": "terminal:attach";
+            "usage_allowances:manage": "usage_allowances:manage";
             "variable-sets:attach": "variable-sets:attach";
             "variable-sets:list": "variable-sets:list";
             "variable-sets:manage": "variable-sets:manage";
@@ -517,6 +683,7 @@ export declare const ExternalIdentityLinkPreview: z.ZodObject<{
             "scheduled_tasks:run": "scheduled_tasks:run";
             "secrets:list": "secrets:list";
             "secrets:read": "secrets:read";
+            "secrets:use": "secrets:use";
             "secrets:write": "secrets:write";
             "sessions:control": "sessions:control";
             "sessions:create": "sessions:create";
@@ -525,6 +692,7 @@ export declare const ExternalIdentityLinkPreview: z.ZodObject<{
             "stream:control": "stream:control";
             "stream:view": "stream:view";
             "terminal:attach": "terminal:attach";
+            "usage_allowances:manage": "usage_allowances:manage";
             "variable-sets:attach": "variable-sets:attach";
             "variable-sets:list": "variable-sets:list";
             "variable-sets:manage": "variable-sets:manage";
@@ -598,6 +766,7 @@ export declare const ExternalLinkWorkSnapshot: z.ZodObject<{
         "scheduled_tasks:run": "scheduled_tasks:run";
         "secrets:list": "secrets:list";
         "secrets:read": "secrets:read";
+        "secrets:use": "secrets:use";
         "secrets:write": "secrets:write";
         "sessions:control": "sessions:control";
         "sessions:create": "sessions:create";
@@ -606,6 +775,7 @@ export declare const ExternalLinkWorkSnapshot: z.ZodObject<{
         "stream:control": "stream:control";
         "stream:view": "stream:view";
         "terminal:attach": "terminal:attach";
+        "usage_allowances:manage": "usage_allowances:manage";
         "variable-sets:attach": "variable-sets:attach";
         "variable-sets:list": "variable-sets:list";
         "variable-sets:manage": "variable-sets:manage";
@@ -616,5 +786,9 @@ export declare const ExternalLinkWorkSnapshot: z.ZodObject<{
         "workspace:create": "workspace:create";
         "workspace:read": "workspace:read";
     }>>;
+    permissionMode: z.ZodOptional<z.ZodEnum<{
+        explicit: "explicit";
+        legacy: "legacy";
+    }>>;
 }, z.core.$strict>;
 export type ExternalLinkWorkSnapshot = z.infer<typeof ExternalLinkWorkSnapshot>;