@opengeni/contracts 5.5.0 → 5.5.2-canary.40656248492001

package/dist/remember.d.ts

@@ -22,8 +22,8 @@ export declare const RememberScope: z.ZodEnum<{
 export type RememberScope = z.infer<typeof RememberScope>;
 /**
  * Ceiling for the Knowledge lane, which is retrieval evidence rather than
- * always-composed prompt text. The prompt-composed lanes are bounded far more
- * tightly: see `AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_MAX_CHARS` and
+ * always-composed prompt text. Other lanes have their own destination bounds:
+ * see `AGENT_AUTHORED_INSTRUCTION_POLICY_CONTENT_MAX_CHARS` and
  * `AGENT_AUTHORED_PREFERENCE_CONTENT_MAX_CHARS`.
  */
 export declare const REMEMBER_CONTENT_MAX_CHARS = 4000;
@@ -82,6 +82,7 @@ export declare const RememberHumanInputPrompt: z.ZodObject<{
         id: z.ZodString;
         kind: z.ZodEnum<{
             multi_select: "multi_select";
+            secret: "secret";
             single_select: "single_select";
             text: "text";
         }>;
@@ -101,6 +102,53 @@ export declare const RememberHumanInputPrompt: z.ZodObject<{
             label: z.ZodString;
             description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
         }, z.core.$strip>>>;
+        secret: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            item: z.ZodString;
+            field: z.ZodDefault<z.ZodString>;
+            fieldKind: z.ZodDefault<z.ZodEnum<{
+                concealed: "concealed";
+                text: "text";
+                totp: "totp";
+            }>>;
+            itemType: z.ZodDefault<z.ZodEnum<{
+                api_key: "api_key";
+                card: "card";
+                identity: "identity";
+                login: "login";
+                note: "note";
+                ssh_key: "ssh_key";
+            }>>;
+            username: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+                prompt: z.ZodString;
+                value: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            }, z.core.$strict>>>;
+            website: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            looksLike: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            pattern: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            saveTo: z.ZodDefault<z.ZodEnum<{
+                task: "task";
+                user: "user";
+                workspace: "workspace";
+            }>>;
+            vault: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            allowGenerate: z.ZodDefault<z.ZodBoolean>;
+            generate: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+                length: z.ZodDefault<z.ZodNumber>;
+                lowercase: z.ZodDefault<z.ZodBoolean>;
+                uppercase: z.ZodDefault<z.ZodBoolean>;
+                digits: z.ZodDefault<z.ZodBoolean>;
+                symbols: z.ZodDefault<z.ZodBoolean>;
+                symbolSet: z.ZodDefault<z.ZodString>;
+                excludeAmbiguous: z.ZodDefault<z.ZodBoolean>;
+                requireEachClass: z.ZodDefault<z.ZodBoolean>;
+            }, z.core.$strict>>>;
+            autocomplete: z.ZodDefault<z.ZodEnum<{
+                "current-password": "current-password";
+                "new-password": "new-password";
+                off: "off";
+                "one-time-code": "one-time-code";
+            }>>;
+        }, z.core.$strict>>>;
         required: z.ZodDefault<z.ZodBoolean>;
         allowOther: z.ZodDefault<z.ZodBoolean>;
         validation: z.ZodOptional<z.ZodNullable<z.ZodObject<{
@@ -273,6 +321,7 @@ export declare const RememberReceipt: z.ZodDiscriminatedUnion<[z.ZodObject<{
             id: z.ZodString;
             kind: z.ZodEnum<{
                 multi_select: "multi_select";
+                secret: "secret";
                 single_select: "single_select";
                 text: "text";
             }>;
@@ -292,6 +341,53 @@ export declare const RememberReceipt: z.ZodDiscriminatedUnion<[z.ZodObject<{
                 label: z.ZodString;
                 description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
             }, z.core.$strip>>>;
+            secret: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+                item: z.ZodString;
+                field: z.ZodDefault<z.ZodString>;
+                fieldKind: z.ZodDefault<z.ZodEnum<{
+                    concealed: "concealed";
+                    text: "text";
+                    totp: "totp";
+                }>>;
+                itemType: z.ZodDefault<z.ZodEnum<{
+                    api_key: "api_key";
+                    card: "card";
+                    identity: "identity";
+                    login: "login";
+                    note: "note";
+                    ssh_key: "ssh_key";
+                }>>;
+                username: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+                    prompt: z.ZodString;
+                    value: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                }, z.core.$strict>>>;
+                website: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                looksLike: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                pattern: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                saveTo: z.ZodDefault<z.ZodEnum<{
+                    task: "task";
+                    user: "user";
+                    workspace: "workspace";
+                }>>;
+                vault: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                allowGenerate: z.ZodDefault<z.ZodBoolean>;
+                generate: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+                    length: z.ZodDefault<z.ZodNumber>;
+                    lowercase: z.ZodDefault<z.ZodBoolean>;
+                    uppercase: z.ZodDefault<z.ZodBoolean>;
+                    digits: z.ZodDefault<z.ZodBoolean>;
+                    symbols: z.ZodDefault<z.ZodBoolean>;
+                    symbolSet: z.ZodDefault<z.ZodString>;
+                    excludeAmbiguous: z.ZodDefault<z.ZodBoolean>;
+                    requireEachClass: z.ZodDefault<z.ZodBoolean>;
+                }, z.core.$strict>>>;
+                autocomplete: z.ZodDefault<z.ZodEnum<{
+                    "current-password": "current-password";
+                    "new-password": "new-password";
+                    off: "off";
+                    "one-time-code": "one-time-code";
+                }>>;
+            }, z.core.$strict>>>;
             required: z.ZodDefault<z.ZodBoolean>;
             allowOther: z.ZodDefault<z.ZodBoolean>;
             validation: z.ZodOptional<z.ZodNullable<z.ZodObject<{

package/dist/retained-output.d.ts

@@ -11,8 +11,6 @@ export declare const COMPUTER_SCREENSHOT_MAX_DIMENSION = 16384;
 export declare const COMPUTER_SCREENSHOT_MAX_PIXELS = 67108864;
 /** Canonical ready-object retention window: 30 days from successful settlement. */
 export declare const COMPUTER_SCREENSHOT_RETENTION_MS: number;
-/** Hard workspace reservation across pending + ready screenshot artifacts. */
-export declare const COMPUTER_SCREENSHOT_WORKSPACE_QUOTA_BYTES: number;
 /** Generated images are permanent workspace files, never inline history blobs. */
 export declare const GENERATED_IMAGE_MAX_BYTES: number;
 /** Generated videos are permanent workspace files and are always streamed. */
@@ -38,6 +36,7 @@ export declare const RetainedOutputUnavailableReason: z.ZodEnum<{
     not_retained: "not_retained";
     oversized: "oversized";
     pending: "pending";
+    private: "private";
     quota_exceeded: "quota_exceeded";
     storage_write_failed: "storage_write_failed";
     unsupported: "unsupported";
@@ -97,6 +96,7 @@ export declare const RetainedOutputEvidenceSchema: z.ZodDiscriminatedUnion<[z.Zo
         not_retained: "not_retained";
         oversized: "oversized";
         pending: "pending";
+        private: "private";
         quota_exceeded: "quota_exceeded";
         storage_write_failed: "storage_write_failed";
         unsupported: "unsupported";
@@ -153,6 +153,7 @@ export declare const RetainedArtifactUnavailableSchema: z.ZodObject<{
         not_retained: "not_retained";
         oversized: "oversized";
         pending: "pending";
+        private: "private";
         quota_exceeded: "quota_exceeded";
         storage_write_failed: "storage_write_failed";
         unsupported: "unsupported";
@@ -207,6 +208,7 @@ export declare const RetainedArtifactMetadataSchema: z.ZodUnion<readonly [z.ZodO
         not_retained: "not_retained";
         oversized: "oversized";
         pending: "pending";
+        private: "private";
         quota_exceeded: "quota_exceeded";
         storage_write_failed: "storage_write_failed";
         unsupported: "unsupported";

package/dist/sandbox-file-artifacts.d.ts

@@ -1,12 +1,22 @@
 import { z } from "zod";
 /**
- * Channel-A currently returns one bounded binary-safe read. Keep publication
+ * Largest publishable sandbox file: one object-storage PUT. Files up to
+ * SANDBOX_FILE_ARTIFACT_INLINE_MAX_BYTES are read through Channel-A; larger
+ * files are hashed and uploaded by the box itself.
+ */
+export declare const SANDBOX_FILE_ARTIFACT_MAX_BYTES = 5000000000;
+/**
+ * Channel-A returns one bounded binary-safe read. Keep inline publication
  * below that ceiling so an extra sentinel byte can distinguish an exact file
  * from a truncated prefix.
  */
-export declare const SANDBOX_FILE_ARTIFACT_MAX_BYTES: number;
+export declare const SANDBOX_FILE_ARTIFACT_INLINE_MAX_BYTES: number;
 export declare const PublishSandboxFileArtifactRequest: z.ZodObject<{
     path: z.ZodString;
+    visibility: z.ZodOptional<z.ZodEnum<{
+        private: "private";
+        workspace: "workspace";
+    }>>;
 }, z.core.$strict>;
 export type PublishSandboxFileArtifactRequest = z.infer<typeof PublishSandboxFileArtifactRequest>;
 /**
@@ -53,5 +63,12 @@ export declare const SandboxFileArtifactReceipt: z.ZodObject<{
             maxRangeBytes: z.ZodNumber;
         }, z.core.$strict>;
     }, z.core.$strict>;
+    access: z.ZodOptional<z.ZodObject<{
+        visibility: z.ZodEnum<{
+            private: "private";
+            workspace: "workspace";
+        }>;
+        whoCanOpen: z.ZodString;
+    }, z.core.$strict>>;
 }, z.core.$strict>;
 export type SandboxFileArtifactReceipt = z.infer<typeof SandboxFileArtifactReceipt>;

package/dist/sandbox-provider-command.d.ts

@@ -1,26 +1,4 @@
 import { z } from "zod";
-/** Provider-owned execution identity and acknowledged output cursors. These
- * values are retained by the control plane, never recovered from sandbox files. */
-export declare const ModalLegacyProviderCommand: z.ZodObject<{
-    kind: z.ZodLiteral<"modal-control-v1">;
-    sandboxId: z.ZodString;
-    taskId: z.ZodString;
-    execId: z.ZodString;
-    pty: z.ZodOptional<z.ZodBoolean>;
-    streams: z.ZodObject<{
-        stdout: z.ZodObject<{
-            batchIndex: z.ZodNumber;
-            utf8Remainder: z.ZodString;
-            exitCode: z.ZodNullable<z.ZodNumber>;
-        }, z.core.$strict>;
-        stderr: z.ZodObject<{
-            batchIndex: z.ZodNumber;
-            utf8Remainder: z.ZodString;
-            exitCode: z.ZodNullable<z.ZodNumber>;
-        }, z.core.$strict>;
-    }, z.core.$strict>;
-}, z.core.$strict>;
-export type ModalLegacyProviderCommand = z.infer<typeof ModalLegacyProviderCommand>;
 export declare const CommandSupervisionDescriptor: z.ZodObject<{
     protocol: z.ZodLiteral<"native-subreaper-v1">;
     invocationId: z.ZodString;
@@ -63,27 +41,10 @@ export declare const ModalRouterProviderCommand: z.ZodObject<{
     }, z.core.$strict>;
 }, z.core.$strict>;
 export type ModalRouterProviderCommand = z.infer<typeof ModalRouterProviderCommand>;
-/** Legacy locators are read-only compatibility for already launched commands;
- * new starts use authenticated task-router byte offsets, never batch indices. */
-export declare const SandboxProviderCommand: z.ZodDiscriminatedUnion<[z.ZodObject<{
-    kind: z.ZodLiteral<"modal-control-v1">;
-    sandboxId: z.ZodString;
-    taskId: z.ZodString;
-    execId: z.ZodString;
-    pty: z.ZodOptional<z.ZodBoolean>;
-    streams: z.ZodObject<{
-        stdout: z.ZodObject<{
-            batchIndex: z.ZodNumber;
-            utf8Remainder: z.ZodString;
-            exitCode: z.ZodNullable<z.ZodNumber>;
-        }, z.core.$strict>;
-        stderr: z.ZodObject<{
-            batchIndex: z.ZodNumber;
-            utf8Remainder: z.ZodString;
-            exitCode: z.ZodNullable<z.ZodNumber>;
-        }, z.core.$strict>;
-    }, z.core.$strict>;
-}, z.core.$strict>, z.ZodObject<{
+/** Provider-owned execution identity and acknowledged byte-offset cursors.
+ * These values are retained by the control plane, never recovered from
+ * sandbox files. */
+export declare const SandboxProviderCommand: z.ZodObject<{
     kind: z.ZodLiteral<"modal-router-v1">;
     sandboxId: z.ZodString;
     taskId: z.ZodString;
@@ -109,5 +70,5 @@ export declare const SandboxProviderCommand: z.ZodDiscriminatedUnion<[z.ZodObjec
             exitCode: z.ZodNullable<z.ZodNumber>;
         }, z.core.$strict>;
     }, z.core.$strict>;
-}, z.core.$strict>], "kind">;
+}, z.core.$strict>;
 export type SandboxProviderCommand = z.infer<typeof SandboxProviderCommand>;

package/dist/sandbox-recovery.d.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
-/** Public, content-free selection. Never include native provider bindings. */
+/** Public, content-free selection of a registered native checkpoint, offered
+ * for human consent. Never include native provider bindings. */
 export declare const SandboxRecoverySelection: z.ZodObject<{
     version: z.ZodLiteral<1>;
     sessionId: z.ZodString;
@@ -10,11 +11,46 @@ export declare const SandboxRecoverySelection: z.ZodObject<{
     leaseEpoch: z.ZodNumber;
     workspaceGeneration: z.ZodNumber;
     archiveGeneration: z.ZodNumber;
-    artifactId: z.ZodString;
     revision: z.ZodString;
     capturedAt: z.ZodString;
+    artifactId: z.ZodString;
 }, z.core.$strict>;
 export type SandboxRecoverySelection = z.infer<typeof SandboxRecoverySelection>;
+/** The checkpoint automatic recovery restores, native or portable. `artifactId`
+ * is the registered native checkpoint (Modal), or null for a portable archive,
+ * whose bytes are verified against `revision` instead. Only human consent uses
+ * {@link SandboxRecoverySelection}, which always names a native checkpoint. */
+export declare const SandboxCheckpointSelection: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    sessionId: z.ZodString;
+    sandboxGroupId: z.ZodString;
+    leaseId: z.ZodString;
+    routeEpoch: z.ZodNumber;
+    authorityEpoch: z.ZodNumber;
+    leaseEpoch: z.ZodNumber;
+    workspaceGeneration: z.ZodNumber;
+    archiveGeneration: z.ZodNumber;
+    revision: z.ZodString;
+    capturedAt: z.ZodString;
+    artifactId: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type SandboxCheckpointSelection = z.infer<typeof SandboxCheckpointSelection>;
+/** Exact failed/current workspace selection; portable archives need no native
+ * checkpoint artifact. Contains no object keys or provider credentials. */
+export declare const SandboxRecoveryTarget: z.ZodObject<{
+    sessionId: z.ZodString;
+    sandboxGroupId: z.ZodString;
+    leaseId: z.ZodString;
+    routeEpoch: z.ZodNumber;
+    authorityEpoch: z.ZodNumber;
+    leaseEpoch: z.ZodNumber;
+    workspaceGeneration: z.ZodNumber;
+    archiveGeneration: z.ZodNullable<z.ZodNumber>;
+    revision: z.ZodNullable<z.ZodString>;
+    restoreStatus: z.ZodString;
+    restoreCompletedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strict>;
+export type SandboxRecoveryTarget = z.infer<typeof SandboxRecoveryTarget>;
 export declare const SandboxRecoveryProjection: z.ZodObject<{
     version: z.ZodLiteral<1>;
     status: z.ZodEnum<{
@@ -36,16 +72,46 @@ export declare const SandboxRecoveryProjection: z.ZodObject<{
         leaseEpoch: z.ZodNumber;
         workspaceGeneration: z.ZodNumber;
         archiveGeneration: z.ZodNumber;
-        artifactId: z.ZodString;
         revision: z.ZodString;
         capturedAt: z.ZodString;
+        artifactId: z.ZodString;
     }, z.core.$strict>>;
     operationId: z.ZodNullable<z.ZodString>;
+    target: z.ZodOptional<z.ZodObject<{
+        sessionId: z.ZodString;
+        sandboxGroupId: z.ZodString;
+        leaseId: z.ZodString;
+        routeEpoch: z.ZodNumber;
+        authorityEpoch: z.ZodNumber;
+        leaseEpoch: z.ZodNumber;
+        workspaceGeneration: z.ZodNumber;
+        archiveGeneration: z.ZodNullable<z.ZodNumber>;
+        revision: z.ZodNullable<z.ZodString>;
+        restoreStatus: z.ZodString;
+        restoreCompletedAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
+    retryAvailable: z.ZodOptional<z.ZodBoolean>;
+    freshWorkspaceAvailable: z.ZodOptional<z.ZodBoolean>;
+    groupSessionCount: z.ZodOptional<z.ZodNumber>;
     automaticAvailable: z.ZodOptional<z.ZodBoolean>;
     automaticLane: z.ZodOptional<z.ZodEnum<{
         checkpoint: "checkpoint";
         fresh_workspace: "fresh_workspace";
     }>>;
+    automaticCheckpoint: z.ZodOptional<z.ZodObject<{
+        version: z.ZodLiteral<1>;
+        sessionId: z.ZodString;
+        sandboxGroupId: z.ZodString;
+        leaseId: z.ZodString;
+        routeEpoch: z.ZodNumber;
+        authorityEpoch: z.ZodNumber;
+        leaseEpoch: z.ZodNumber;
+        workspaceGeneration: z.ZodNumber;
+        archiveGeneration: z.ZodNumber;
+        revision: z.ZodString;
+        capturedAt: z.ZodString;
+        artifactId: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>>;
     availableAt: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>;
 export type SandboxRecoveryProjection = z.infer<typeof SandboxRecoveryProjection>;
@@ -55,6 +121,7 @@ export declare const SandboxFreshWorkspaceReason: z.ZodEnum<{
     archive_unverified: "archive_unverified";
     checkpoint_restore_failed: "checkpoint_restore_failed";
     checkpoint_unrestorable: "checkpoint_unrestorable";
+    restore_abandoned: "restore_abandoned";
 }>;
 export type SandboxFreshWorkspaceReason = z.infer<typeof SandboxFreshWorkspaceReason>;
 /** Durable, content-free fresh-workspace decision for one group member. */
@@ -72,10 +139,11 @@ export declare const SandboxFreshWorkspaceRecovery: z.ZodObject<{
         archive_unverified: "archive_unverified";
         checkpoint_restore_failed: "checkpoint_restore_failed";
         checkpoint_unrestorable: "checkpoint_unrestorable";
+        restore_abandoned: "restore_abandoned";
     }>;
 }, z.core.$strict>;
 export type SandboxFreshWorkspaceRecovery = z.infer<typeof SandboxFreshWorkspaceRecovery>;
-export declare const SandboxRecoveryRequest: z.ZodObject<{
+export declare const SandboxRecoveryRequest: z.ZodUnion<readonly [z.ZodObject<{
     operationId: z.ZodString;
     acceptHistoricalCheckpoint: z.ZodLiteral<true>;
     selection: z.ZodObject<{
@@ -88,11 +156,44 @@ export declare const SandboxRecoveryRequest: z.ZodObject<{
         leaseEpoch: z.ZodNumber;
         workspaceGeneration: z.ZodNumber;
         archiveGeneration: z.ZodNumber;
-        artifactId: z.ZodString;
         revision: z.ZodString;
         capturedAt: z.ZodString;
+        artifactId: z.ZodString;
     }, z.core.$strict>;
-}, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    operationId: z.ZodString;
+    action: z.ZodLiteral<"retry">;
+    target: z.ZodObject<{
+        sessionId: z.ZodString;
+        sandboxGroupId: z.ZodString;
+        leaseId: z.ZodString;
+        routeEpoch: z.ZodNumber;
+        authorityEpoch: z.ZodNumber;
+        leaseEpoch: z.ZodNumber;
+        workspaceGeneration: z.ZodNumber;
+        archiveGeneration: z.ZodNullable<z.ZodNumber>;
+        revision: z.ZodNullable<z.ZodString>;
+        restoreStatus: z.ZodString;
+        restoreCompletedAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>, z.ZodObject<{
+    operationId: z.ZodString;
+    action: z.ZodLiteral<"continue_fresh">;
+    acceptEmptyWorkspace: z.ZodLiteral<true>;
+    target: z.ZodObject<{
+        sessionId: z.ZodString;
+        sandboxGroupId: z.ZodString;
+        leaseId: z.ZodString;
+        routeEpoch: z.ZodNumber;
+        authorityEpoch: z.ZodNumber;
+        leaseEpoch: z.ZodNumber;
+        workspaceGeneration: z.ZodNumber;
+        archiveGeneration: z.ZodNullable<z.ZodNumber>;
+        revision: z.ZodNullable<z.ZodString>;
+        restoreStatus: z.ZodString;
+        restoreCompletedAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>]>;
 export type SandboxRecoveryRequest = z.infer<typeof SandboxRecoveryRequest>;
 export declare const SandboxRecoveryResponse: z.ZodObject<{
     outcome: z.ZodEnum<{
@@ -121,16 +222,46 @@ export declare const SandboxRecoveryResponse: z.ZodObject<{
             leaseEpoch: z.ZodNumber;
             workspaceGeneration: z.ZodNumber;
             archiveGeneration: z.ZodNumber;
-            artifactId: z.ZodString;
             revision: z.ZodString;
             capturedAt: z.ZodString;
+            artifactId: z.ZodString;
         }, z.core.$strict>>;
         operationId: z.ZodNullable<z.ZodString>;
+        target: z.ZodOptional<z.ZodObject<{
+            sessionId: z.ZodString;
+            sandboxGroupId: z.ZodString;
+            leaseId: z.ZodString;
+            routeEpoch: z.ZodNumber;
+            authorityEpoch: z.ZodNumber;
+            leaseEpoch: z.ZodNumber;
+            workspaceGeneration: z.ZodNumber;
+            archiveGeneration: z.ZodNullable<z.ZodNumber>;
+            revision: z.ZodNullable<z.ZodString>;
+            restoreStatus: z.ZodString;
+            restoreCompletedAt: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>>;
+        retryAvailable: z.ZodOptional<z.ZodBoolean>;
+        freshWorkspaceAvailable: z.ZodOptional<z.ZodBoolean>;
+        groupSessionCount: z.ZodOptional<z.ZodNumber>;
         automaticAvailable: z.ZodOptional<z.ZodBoolean>;
         automaticLane: z.ZodOptional<z.ZodEnum<{
             checkpoint: "checkpoint";
             fresh_workspace: "fresh_workspace";
         }>>;
+        automaticCheckpoint: z.ZodOptional<z.ZodObject<{
+            version: z.ZodLiteral<1>;
+            sessionId: z.ZodString;
+            sandboxGroupId: z.ZodString;
+            leaseId: z.ZodString;
+            routeEpoch: z.ZodNumber;
+            authorityEpoch: z.ZodNumber;
+            leaseEpoch: z.ZodNumber;
+            workspaceGeneration: z.ZodNumber;
+            archiveGeneration: z.ZodNumber;
+            revision: z.ZodString;
+            capturedAt: z.ZodString;
+            artifactId: z.ZodNullable<z.ZodString>;
+        }, z.core.$strict>>;
         availableAt: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>;
 }, z.core.$strict>;
@@ -140,7 +271,7 @@ export declare function sandboxRecoveryDiscontinuity(selection: SandboxRecoveryS
 /** Stable tail instructions, sourced from a durable system recovery receipt.
  * `shared` names the sandbox this session shares with other sessions; every
  * member of that group receives its own receipt for the same selection. */
-export declare function automaticSandboxRecoveryDiscontinuity(selection: SandboxRecoverySelection, scope?: "session" | "shared"): string;
+export declare function automaticSandboxRecoveryDiscontinuity(selection: SandboxCheckpointSelection, scope?: "session" | "shared"): string;
 /** Stable tail instructions for continuing on a new empty workspace. The text
  * is true on every later turn too: it names the loss, not the current tree. */
 export declare function freshWorkspaceSandboxRecoveryDiscontinuity(recovery: SandboxFreshWorkspaceRecovery): string;

package/dist/secret-generator.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The one password generator shared by agents (`secret_save` with
+ * `generate`), the ask card's server-side generate, and the web/mobile UI.
+ *
+ * Isomorphic and dependency-free: randomness comes from
+ * `crypto.getRandomValues` unless a test injects `random`. Output is ASCII
+ * only, and every character is drawn uniformly from the selected alphabet by
+ * rejection sampling, so no modulo bias is introduced. When
+ * `requireEachClass` is set, whole candidates lacking an enabled class are
+ * rejected and redrawn, which keeps the result uniform over all compliant
+ * passwords.
+ */
+import { z } from "zod";
+export declare const SECRET_GENERATOR_DEFAULT_SYMBOLS = "!#%+-.:=?@_";
+/** Characters that are easy to confuse when a person reads them. */
+export declare const SECRET_GENERATOR_AMBIGUOUS_CHARACTERS = "0O1lI|";
+export declare const GeneratePasswordSpec: z.ZodObject<{
+    length: z.ZodDefault<z.ZodNumber>;
+    lowercase: z.ZodDefault<z.ZodBoolean>;
+    uppercase: z.ZodDefault<z.ZodBoolean>;
+    digits: z.ZodDefault<z.ZodBoolean>;
+    symbols: z.ZodDefault<z.ZodBoolean>;
+    symbolSet: z.ZodDefault<z.ZodString>;
+    excludeAmbiguous: z.ZodDefault<z.ZodBoolean>;
+    requireEachClass: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strict>;
+export type GeneratePasswordSpec = z.infer<typeof GeneratePasswordSpec>;
+export type GeneratePasswordSpecInput = z.input<typeof GeneratePasswordSpec>;
+export declare class PasswordGeneratorError extends Error {
+    constructor(message: string);
+}
+/** The enabled character classes after exclusions; empty classes are dropped. */
+export declare function passwordCharacterClasses(spec: GeneratePasswordSpec): string[];
+/** Generate a password. The spec input is parsed (defaults applied) first. */
+export declare function generatePassword(spec?: GeneratePasswordSpecInput, random?: (n: number) => Uint8Array): string;
+export type PasswordStrengthLabel = "weak" | "fair" | "strong" | "very_strong";
+/**
+ * Estimated entropy from length and the character pools the password uses.
+ * A display hint for the UI, not a security decision.
+ */
+export declare function passwordStrength(password: string): {
+    bits: number;
+    label: PasswordStrengthLabel;
+};

package/dist/secret-mask-strings.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The string walk shared by the secret maskers (known values and, later,
+ * secret shapes): every string a masker may change.
+ *
+ * Binary payloads keep their exact bytes: a string that is entirely a base64
+ * data URL, and the `data` of an object that also carries a MIME type (image
+ * and file content). A payload of a text type (`text/*`, JSON, XML, YAML and
+ * similar) is decoded, masked as text and encoded again, so a secret inside a
+ * text file is masked while the payload stays valid base64.
+ */
+export declare function isBase64DataUrl(text: string): boolean;
+/** Whether a payload of this media type is text (and so is searched decoded). */
+export declare function isTextMediaType(mediaType: string | null | undefined): boolean;
+/**
+ * For the `data` of an object that also carries a MIME type (a file or image
+ * payload): that media type, or null when it is not a string. Undefined when
+ * the string is not such a payload.
+ */
+export declare function payloadMediaType(key: string | null, parent: Record<string, unknown> | null): string | null | undefined;
+/**
+ * `map` applied to the text a base64 payload encodes, encoded again; the
+ * payload itself when it is not UTF-8 text, is too large, or `map` changes
+ * nothing.
+ */
+export declare function mapBase64TextPayload(payload: string, map: (text: string) => string): string;
+/**
+ * Deep copy of `value` with `map` applied to every string a masker may
+ * change (object keys are kept; an own `__proto__` key stays data). Binary
+ * payloads are skipped and text payloads mapped decoded (see the module
+ * comment). Inputs that need no change keep their identity.
+ */
+export declare function mapSecretMaskableStrings<T>(value: T, map: (text: string) => string, skipKey?: (key: string) => boolean): T;

package/dist/secret-references.d.ts

@@ -0,0 +1,90 @@
+export type SecretReferenceKind = "secret" | "secretfile";
+export type SecretReferenceTarget = {
+    form: "id";
+    itemId: string;
+    field: string | null;
+} | {
+    form: "path";
+    segments: [string] | [string, string] | [string, string, string];
+};
+export interface SecretReference {
+    kind: SecretReferenceKind;
+    raw: string;
+    /** Offsets in the source text; `end` is exclusive. */
+    start: number;
+    end: number;
+    target: SecretReferenceTarget;
+    otp: boolean;
+    previous: boolean;
+}
+export type SecretTextToken = 
+/** Escapes already unescaped. */
+{
+    type: "text";
+    value: string;
+} | {
+    type: "reference";
+    reference: SecretReference;
+} | {
+    type: "invalid";
+    raw: string;
+    start: number;
+    end: number;
+    reason: string;
+};
+/** Fast-path needle; also matches `{{secretfile:`. */
+export declare const SECRET_REFERENCE_MARKER = "{{secret";
+export declare class SecretReferenceSyntaxError extends Error {
+    readonly reason: string;
+    constructor(reason: string, message?: string);
+}
+export declare function containsSecretReference(text: string): boolean;
+/**
+ * Split text into literal text, references and invalid candidates. Adjacent
+ * text is merged; an escaped reference (`\{{secret:…}}`) becomes literal
+ * text without the backslash. Never throws.
+ */
+export declare function tokenizeSecretText(text: string): SecretTextToken[];
+/** Valid references only, in text order. */
+export declare function findSecretReferences(text: string): SecretReference[];
+/** Invalid candidates only, in text order. */
+export declare function findInvalidSecretReferences(text: string): Array<Extract<SecretTextToken, {
+    type: "invalid";
+}>>;
+/** Parse exactly one reference (`{{…}}`). Throws SecretReferenceSyntaxError. */
+export declare function parseSecretReference(raw: string): SecretReference;
+export type FormatSecretReferenceInput = {
+    kind?: SecretReferenceKind;
+    vault?: string;
+    item: string;
+    field?: string;
+    otp?: boolean;
+    previous?: boolean;
+} | {
+    kind?: SecretReferenceKind;
+    itemId: string;
+    field?: string;
+    otp?: boolean;
+    previous?: boolean;
+};
+/** Build a reference. Throws SecretReferenceSyntaxError when a name cannot be referenced. */
+export declare function formatSecretReference(input: FormatSecretReferenceInput): string;
+/** NFC + trim + lowercase. For UI and dedupe only; SQL `vault_name_key` is authoritative. */
+export declare function secretNameKey(name: string): string;
+/** Canonical dedupe key within one call (same target and modifiers → same key). */
+export declare function referenceKey(ref: SecretReference): string;
+/** Remove escapes (`\{{secret:…}}` → `{{secret:…}}`); references stay as written. */
+export declare function unescapeSecretText(text: string): string;
+/** Every valid reference in every string value of a JSON-like structure. */
+export declare function collectReferencesDeep(value: unknown): SecretReference[];
+/** Every invalid candidate in every string value of a JSON-like structure. */
+export declare function collectInvalidReferencesDeep(value: unknown): Array<Extract<SecretTextToken, {
+    type: "invalid";
+}>>;
+/**
+ * Deep copy with each reference replaced by `replace(ref)` and escapes
+ * removed. Strings without the marker are copied unchanged; invalid
+ * candidates are kept verbatim (callers reject them before replacing).
+ * Object keys are not rewritten.
+ */
+export declare function replaceReferencesDeep<T>(value: T, replace: (ref: SecretReference) => string): T;