@opengeni/sdk 0.28.2 → 0.32.1

package/dist/client.d.ts

@@ -0,0 +1,643 @@
+import { type SessionEventStreamTransport, type StreamSessionEventsOptions } from "./stream";
+import { type WorkspaceControlStreamTransport } from "./workspace-control-stream";
+import type { AccessContext, AddWorkspaceMemberRequest, ApiKey, BillingEntitlementsResponse, CodexAccount, CodexAccountsResponse, CodexRotationSettings, CodexOverviewResponse, CodexAllocatorUpdate, CodexConnectionStatus, CodexConnectPoll, CodexConnectStart, CodexUsage, CodexUsageMap, BillingSummary, BillingUsageResponse, InsightsRange, WorkspaceInsightsResponse, CapabilityCatalogItem, CapabilityCatalogResponse, CapabilityInstallation, AddDocumentRequest, CreateKnowledgeDropRequest, MoveDocumentRequest, ClientConfig, WorkspaceModelCatalogResponse, ClientSessionEventInput, CompactSessionContextResult, ConnectionMetadata, CreateApiKeyRequest, CreateApiKeyResponse, CreateCapabilityCatalogItemRequest, CreateCheckoutRequest, CreateCheckoutResponse, OpenGeniSlackBotInstallRequest, OpenGeniSlackBotInstallStart, CreateConnectionRequest, CreateDocumentBaseRequest, CreateFileUploadRequest, CreateFileUploadResponse, CreateGitHubAppManifestRequest, CreateGitHubAppManifestResponse, CreateKnowledgeMemoryRequest, CreateScheduledTaskRequest, CreateSessionRequest, CreateSessionResponse, CreateVariableSetRequest, CreateRigRequest, CreateWorkspaceRequest, DeviceEnrollmentApproveResponse, DeviceEnrollmentDenyResponse, DeviceEnrollmentLookupResponse, MintEnrollTokenResponse, DiscoverMcpCapabilitiesResponse, Document, DocumentBase, DocumentSearchRequest, DocumentSearchResponse, EnableCapabilityRequest, EnablePackRequest, FileAsset, FileDownloadUrlResponse, GetPackResponse, GitHubAppInfo, GitHubRepositoriesResponse, KnowledgeMemory, KnowledgeMemorySearchRequest, ListPacksResponse, MachinesResponse, MetricSample, SwapActiveSandboxRequest, SwapActiveSandboxResponse, PackInstallation, LatencyMode, ReasoningEffort, RetainedArtifactContent, RetainedArtifactContentOptions, RetainedArtifactMetadata, RegisterCapabilityPackRequest, ResourceRef, ScheduledTask, ScheduledTaskRun, Session, SessionListResponse, UpdateSessionPinRequest, SessionEvent, SessionEventCompactResult, SessionEventCompactResultOptions, SessionEventListOptions, SessionEventPage, SessionGoal, SessionHumanInputRequest, SessionLineageResponse, SessionMcpCredentialUpdateInput, UpdateSessionMcpApprovalPolicyRequest, UpdateSessionMcpApprovalPolicyResponse, SessionQueueSnapshot, SessionQueueMutationResponse, ComposerDraft, DeleteSessionQueueItemRequest, EditSessionQueueItemRequest, MoveSessionQueueItemRequest, NewSessionDraft, SaveComposerDraftRequest, SaveNewSessionDraftRequest, SteerSessionQueueItemRequest, SessionControlResponse, WorkspaceInferenceControlResponse, WorkspaceControlEvent, SessionTurn, SubmitHumanInputResponseRequest, SessionCapabilities, AttachViewerRequest, AttachViewerResponse, AcknowledgeStreamRequest, AcknowledgeStreamResponse, ViewerHeartbeatRequest, ViewerHeartbeatResponse, FsListRequest, FsListResponse, FsReadRequest, FsReadResponse, FsWriteRequest, FsWriteResponse, FsDeleteRequest, FsDeleteResponse, FsMoveRequest, FsMoveResponse, FsMkdirRequest, FsMkdirResponse, GitStatusRequest, GitStatusResponse, GitDiffRequest, GitDiffResponse, GitLogRequest, GitLogResponse, GitShowRequest, GitShowResponse, GetWorkspaceCaptureResponse, GetWorkspaceCaptureFileResponse, TerminalExecRequest, TerminalExecResponse, PtyOpenRequest, PtyOpenResponse, PtyWriteRequest, PtyResizeRequest, PtyCloseRequest, ToolRef, TranscribeAudioResponse, UpdateConnectionRequest, UpdateKnowledgeMemoryRequest, UpdateScheduledTaskRequest, UpdateSessionGoalRequest, UpdateSessionRequest, UpdateSessionToolPolicyRequest, UpdateVariableSetRequest, UpdateRigRequest, UpdateWorkspaceMemberRequest, UpdateWorkspaceRequest, UpdateWorkspaceSettingsRequest, SetWorkspaceDefaultRigRequest, UploadFileInput, VariableSet, VariableSetVariableMetadata, Rig, RigVersion, RigChange, ProposeRigChangeRequest, WorkspaceMember, WorkspaceMemorySearchRequest, WorkspaceMemorySearchResponse, WorkspaceRegisteredPack, Workspace, OAuthStartRequest, OAuthStartResponse } from "./types";
+import type { ActivateWorkspaceInstructionPolicyRequest, CreateWorkspaceInstructionPolicyDraftRequest, ImportLegacyWorkspaceInstructionPolicyDraftRequest, RollbackWorkspaceInstructionPolicyRequest, WorkspaceInstructionPolicyActivationResponse, WorkspaceInstructionPolicyDiffRequest, WorkspaceInstructionPolicyDiffResponse, WorkspaceInstructionPolicyListOptions, WorkspaceInstructionPolicyListResponse, WorkspaceInstructionPolicyRevision } from "./workspace-instruction-policies";
+import type { WorkspaceStateResponse } from "./workspace-state";
+import type { ActivatePreferenceRegistryRevisionRequest, ChangePreferenceRegistryScopeRequest, CorrectPreferenceRegistryRequest, CreatePreferenceRegistryProposalRequest, DeactivatePreferenceRegistryRequest, PreferenceRegistryDetailResponse, PreferenceRegistryFullContent, PreferenceRegistryListOptions, PreferenceRegistryListResponse, PreferenceRegistryMutationResponse, PreferenceRegistryRecord, PreferenceRegistrySnapshot, RejectPreferenceRegistryProposalRequest, SupersedePreferenceRegistryRequest } from "./preference-registry";
+export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+export type WorkspaceControlEventPage = {
+    events: WorkspaceControlEvent[];
+    bytes: number;
+    truncated: boolean;
+    nextAfter: number | null;
+};
+export type OpenGeniClientOptions = {
+    /** Base URL of the OpenGeni API, e.g. `https://api.example.com`. */
+    baseUrl: string;
+    /** OpenGeni API key, sent as `Authorization: Bearer <apiKey>`. */
+    apiKey?: string;
+    /** Extra headers (static or computed per request) merged into every call. */
+    headers?: Record<string, string> | (() => Record<string, string>);
+    /** Custom fetch implementation. Defaults to the global `fetch`. */
+    fetch?: FetchLike;
+};
+/** Per-request cancellation for operations whose caller owns an AbortSignal. */
+export type OpenGeniRequestOptions = {
+    signal?: AbortSignal | undefined;
+};
+export type SendMessageInput = {
+    text: string;
+    /** System instructions scoped to this exact turn; never visible timeline text. */
+    turnInstructions?: string;
+    resources?: ResourceRef[];
+    tools?: ToolRef[];
+    model?: string;
+    reasoningEffort?: ReasoningEffort;
+    latencyMode?: LatencyMode;
+    clientEventId?: string;
+    controlEtag?: string;
+    expectedDraftRevision?: number;
+    mcpCredentialUpdates?: SessionMcpCredentialUpdateInput[];
+};
+export type SteerMessageResult = {
+    /** The accepted `user.message` event. */
+    accepted: SessionEvent;
+    /** The exact turn created for this message in the same server transaction. */
+    turn: SessionTurn;
+};
+export type TranscribeAudioInput = {
+    audio: Blob | File | Uint8Array;
+    mimeType: string;
+    durationSeconds?: number | undefined;
+    signal?: AbortSignal | undefined;
+};
+/**
+ * Typed client for the OpenGeni public API. Framework-agnostic: only needs
+ * WHATWG `fetch` + streams, so it runs in Node 18+, Bun, Deno, browsers, and
+ * edge runtimes.
+ */
+export declare class OpenGeniClient {
+    private readonly baseUrl;
+    private readonly options;
+    private readonly fetchImpl;
+    constructor(options: OpenGeniClientOptions);
+    /** Upload one ephemeral browser recording. This method never retries. */
+    transcribeAudio(workspaceId: string, input: TranscribeAudioInput): Promise<TranscribeAudioResponse>;
+    createSession(workspaceId: string, request: CreateSessionRequest): Promise<CreateSessionResponse>;
+    getNewSessionDraft(workspaceId: string): Promise<NewSessionDraft>;
+    saveNewSessionDraft(workspaceId: string, request: SaveNewSessionDraftRequest): Promise<NewSessionDraft>;
+    getSession(workspaceId: string, sessionId: string): Promise<Session>;
+    updateSession(workspaceId: string, sessionId: string, request: UpdateSessionRequest): Promise<Session>;
+    /** Replace the durable tool policy or explicitly adopt workspace defaults. */
+    updateSessionToolPolicy(workspaceId: string, sessionId: string, request: UpdateSessionToolPolicyRequest): Promise<Session>;
+    /**
+     * Replace one attached MCP server's approval policy. The change is captured
+     * by the next claimed attempt; already-claimed work keeps its immutable
+     * policy snapshot.
+     */
+    updateSessionMcpApprovalPolicy(workspaceId: string, sessionId: string, serverId: string, request: UpdateSessionMcpApprovalPolicyRequest): Promise<UpdateSessionMcpApprovalPolicyResponse>;
+    listSessions(workspaceId: string, options?: {
+        limit?: number;
+        parentSessionId?: string | null;
+        search?: string;
+    }): Promise<Session[]>;
+    /** Pin-aware ordinary-session page with a stable keyset cursor. */
+    listSessionPage(workspaceId: string, options?: {
+        limit?: number;
+        parentSessionId?: string | null;
+        cursor?: string;
+        search?: string;
+        /** Return only the complete personal pinned projection. */
+        pinsOnly?: boolean;
+    }): Promise<SessionListResponse>;
+    /** Set this authenticated member's personal workspace pin for a session. */
+    updateSessionPin(workspaceId: string, sessionId: string, request: UpdateSessionPinRequest): Promise<Session>;
+    getSessionLineage(workspaceId: string, sessionId: string): Promise<SessionLineageResponse>;
+    listTurns(workspaceId: string, sessionId: string, options?: {
+        limit?: number;
+        latestStarted?: boolean;
+    }): Promise<SessionTurn[]>;
+    /** Newest turn that durably emitted `turn.started`, or null before any admission. */
+    getLatestStartedTurn(workspaceId: string, sessionId: string): Promise<SessionTurn | null>;
+    /**
+     * List the workspace's machines (the Machines dashboard). Each enrolled
+     * selfhosted machine carries its derived state + latest metrics +
+     * sharedSessionCount. Pass `sessionId` for an in-session view, which adds the
+     * session's synthetic Modal group box + the active-sandbox pointer.
+     */
+    listMachines(workspaceId: string, options?: {
+        sessionId?: string;
+        signal?: AbortSignal;
+    }): Promise<MachinesResponse>;
+    /**
+     * Read the downsampled (~1/min) metrics series for ONE machine over a time
+     * window (default 1h). The samples are oldest-first (a left-to-right chart).
+     */
+    machineMetricsSeries(workspaceId: string, enrollmentId: string, options?: {
+        window?: "15m" | "1h" | "6h" | "24h";
+    }): Promise<MetricSample[]>;
+    /**
+     * Resolve a pending device-enrollment flow by its user_code for the click-Grant
+     * approve page (EnrollmentConsent). NO workspace in the path — the server
+     * resolves the workspace from the (globally-unique-among-pending) code, then
+     * authorizes the caller against it (enrollments:read). Rejects (404) when the
+     * code is unknown/expired OR the caller lacks the grant — the two are
+     * indistinguishable by design (no cross-workspace disclosure). Does not consume
+     * the request.
+     */
+    lookupDeviceEnrollment(userCode: string): Promise<DeviceEnrollmentLookupResponse>;
+    /**
+     * Approve a pending device-enrollment flow (the LOUD consent step). `allowScreenControl`
+     * is the authoritative screen-control consent (whole-machine is mandatory/implicit).
+     * Lands an enrollment + a selfhosted sandbox and unblocks the agent's poll.
+     */
+    approveDeviceEnrollment(workspaceId: string, request: {
+        userCode: string;
+        allowScreenControl?: boolean;
+    }): Promise<DeviceEnrollmentApproveResponse>;
+    /** Deny a pending device-enrollment flow (the explicit "no" at the approve page). */
+    denyDeviceEnrollment(workspaceId: string, request: {
+        userCode: string;
+    }): Promise<DeviceEnrollmentDenyResponse>;
+    /**
+     * Mint a short-TTL headless enroll token (the `oget_` token) for the fleet /
+     * non-interactive enroll path. The returned `token` is SECRET — surface it once
+     * with a copy-now warning; it cannot be re-read. `allowScreenControl` bakes the
+     * screen-control consent into the token.
+     */
+    mintEnrollToken(workspaceId: string, request?: {
+        allowScreenControl?: boolean;
+    }): Promise<MintEnrollTokenResponse>;
+    /**
+     * Swap a session's active sandbox (the user-authenticated equivalent of the
+     * M7 `sandbox_swap` MCP tool). `target` is a `MachineView.sandboxId` from
+     * `listMachines`, or "session"/"default" to swap back to the session's own
+     * group box. Validation (ownership/liveness/epoch fence) is server-side; the
+     * result echoes the resulting pointer (`swapped: false` + `reason` on a
+     * rejected target or a lost epoch fence).
+     */
+    swapActiveSandbox(workspaceId: string, sessionId: string, request: SwapActiveSandboxRequest): Promise<SwapActiveSandboxResponse>;
+    listScheduledTasks(workspaceId: string, options?: {
+        limit?: number;
+    }): Promise<ScheduledTask[]>;
+    getScheduledTask(workspaceId: string, taskId: string): Promise<ScheduledTask>;
+    /**
+     * Return the events from one bounded page. With no cursor, this uses the safe
+     * semantic monitoring tail; pass explicit forensic options and a cursor for
+     * retained audit replay. Use `listEventPage` when projection, coverage, or
+     * resume-cursor facts are required.
+     */
+    listEvents(workspaceId: string, sessionId: string, options?: SessionEventListOptions): Promise<SessionEvent[]>;
+    /** Bounded durable/monitoring page plus exact projection and cursor facts. */
+    listEventPage(workspaceId: string, sessionId: string, options: SessionEventCompactResultOptions): Promise<SessionEventCompactResult | null>;
+    listEventPage(workspaceId: string, sessionId: string, options?: SessionEventListOptions): Promise<SessionEventPage>;
+    /**
+     * Fetch the authoritative newest-sequence semantic result directly. This is
+     * the callback-loss recovery path: it reads one compact durable result and
+     * never creates a model turn. `latest: "receipt"` aliases `tool_receipt`;
+     * turn generation remains scoped retry metadata.
+     */
+    getLatestEventResult(workspaceId: string, sessionId: string, options?: Omit<SessionEventCompactResultOptions, "resultMode">): Promise<SessionEventCompactResult | null>;
+    /** POST a user/control event to the session. Returns the accepted event. */
+    sendEvent(workspaceId: string, sessionId: string, event: ClientSessionEventInput): Promise<SessionEvent>;
+    sendMessage(workspaceId: string, sessionId: string, message: string | SendMessageInput): Promise<SessionEvent>;
+    pauseSession(workspaceId: string, sessionId: string, options?: {
+        reason?: string;
+        clientEventId?: string;
+        expectedControlEtag?: string;
+    }): Promise<SessionControlResponse>;
+    sendApprovalDecision(workspaceId: string, sessionId: string, decision: {
+        approvalId: string;
+        decision: "approve" | "reject";
+        message?: string;
+        clientEventId?: string;
+    }): Promise<SessionEvent>;
+    listHumanInputRequests(workspaceId: string, sessionId: string, options?: {
+        status?: SessionHumanInputRequest["status"];
+    }): Promise<SessionHumanInputRequest[]>;
+    getHumanInputRequest(workspaceId: string, sessionId: string, requestId: string): Promise<SessionHumanInputRequest>;
+    submitHumanInputResponse(workspaceId: string, sessionId: string, requestId: string, response: SubmitHumanInputResponseRequest, options?: {
+        clientEventId?: string;
+    }): Promise<SessionEvent>;
+    /**
+     * Live-stream a session's events with automatic reconnect, resume from the
+     * last seen sequence, gap backfill, and duplicate suppression. See
+     * {@link streamSessionEvents} for the delivery guarantees.
+     */
+    streamEvents(workspaceId: string, sessionId: string, options?: StreamSessionEventsOptions): AsyncGenerator<SessionEvent, void, void>;
+    /** The transport `streamEvents` runs on; useful for custom streaming layers. */
+    eventStreamTransport(workspaceId: string, sessionId: string): SessionEventStreamTransport;
+    /** Open one raw SSE connection (no reconnect). Most callers want `streamEvents`. */
+    openEventStream(workspaceId: string, sessionId: string, options?: {
+        after?: number;
+        signal?: AbortSignal;
+    }): Promise<ReadableStream<Uint8Array>>;
+    getQueue(workspaceId: string, sessionId: string): Promise<SessionQueueSnapshot>;
+    moveQueueItem(workspaceId: string, sessionId: string, turnId: string, request: MoveSessionQueueItemRequest): Promise<SessionQueueMutationResponse>;
+    editQueueItem(workspaceId: string, sessionId: string, turnId: string, request: EditSessionQueueItemRequest): Promise<SessionQueueMutationResponse>;
+    steerQueueItem(workspaceId: string, sessionId: string, turnId: string, request: SteerSessionQueueItemRequest): Promise<SessionQueueMutationResponse>;
+    deleteQueueItem(workspaceId: string, sessionId: string, turnId: string, request: DeleteSessionQueueItemRequest): Promise<SessionQueueMutationResponse>;
+    getComposerDraft(workspaceId: string, sessionId: string): Promise<ComposerDraft>;
+    saveComposerDraft(workspaceId: string, sessionId: string, request: SaveComposerDraftRequest): Promise<ComposerDraft>;
+    controlSession(workspaceId: string, sessionId: string, request: {
+        action: "pause" | "resume";
+        reason?: string;
+        clientEventId: string;
+        expectedControlEtag?: string;
+    }): Promise<SessionControlResponse>;
+    resumeSession(workspaceId: string, sessionId: string, options?: {
+        reason?: string;
+        clientEventId?: string;
+        expectedControlEtag?: string;
+    }): Promise<SessionControlResponse>;
+    setWorkspaceInferenceState(workspaceId: string, request: {
+        action: "pause" | "resume";
+        reason?: string;
+        clientEventId: string;
+        expectedRevision?: number;
+    }): Promise<WorkspaceInferenceControlResponse>;
+    listWorkspaceControlEvents(workspaceId: string, options?: {
+        after?: number;
+        limit?: number;
+    }): Promise<WorkspaceControlEvent[]>;
+    /** Count/byte-bounded page plus an explicit continuation cursor. */
+    listWorkspaceControlEventPage(workspaceId: string, options?: {
+        after?: number;
+        limit?: number;
+    }): Promise<WorkspaceControlEventPage>;
+    streamWorkspaceControlEvents(workspaceId: string, options?: StreamSessionEventsOptions): AsyncGenerator<WorkspaceControlEvent, void, void>;
+    workspaceControlStreamTransport(workspaceId: string): WorkspaceControlStreamTransport;
+    openWorkspaceControlEventStream(workspaceId: string, options?: {
+        after?: number;
+        signal?: AbortSignal;
+    }): Promise<ReadableStream<Uint8Array>>;
+    /**
+     * Steer: atomically put this prompt at the head and supersede the current
+     * inference. The client performs one request and renders server order.
+     */
+    steerMessage(workspaceId: string, sessionId: string, message: string | SendMessageInput): Promise<SteerMessageResult>;
+    /** The session's goal. 404s when the session never had one. */
+    getGoal(workspaceId: string, sessionId: string): Promise<SessionGoal>;
+    updateGoal(workspaceId: string, sessionId: string, request: UpdateSessionGoalRequest): Promise<SessionGoal>;
+    deleteGoal(workspaceId: string, sessionId: string): Promise<void>;
+    /** Pause the goal loop: the session stops self-continuing until resumed. */
+    pauseGoal(workspaceId: string, sessionId: string, options?: {
+        rationale?: string;
+    }): Promise<SessionGoal>;
+    /** Resume a paused goal: resets counters and re-arms the continuation loop. */
+    resumeGoal(workspaceId: string, sessionId: string): Promise<SessionGoal>;
+    /**
+     * Clear the session's conversation context. Destructive and audit-preserving:
+     * the server supersedes (never deletes) the live history and emits a
+     * `session.context.cleared` event. Refused (409) while a turn is in flight or
+     * awaiting action. `confirm:true` is sent so an accidental call cannot wipe
+     * context — the destructive intent is explicit on the wire.
+     */
+    clearSessionContext(workspaceId: string, sessionId: string): Promise<void>;
+    /** Request one durable portable compaction at the next safe model boundary. */
+    compactSessionContext(workspaceId: string, sessionId: string): Promise<CompactSessionContextResult>;
+    /** FileSystem: list a directory tree (feeds the Pierre file tree). */
+    fsList(workspaceId: string, sessionId: string, request?: FsListRequest, options?: OpenGeniRequestOptions): Promise<FsListResponse>;
+    /** FileSystem: read a file (text or base64; binary-safe, size-capped). */
+    fsRead(workspaceId: string, sessionId: string, request: FsReadRequest, options?: OpenGeniRequestOptions): Promise<FsReadResponse>;
+    /** FileSystem: write a file (last-writer-wins; emits fs.changed). */
+    fsWrite(workspaceId: string, sessionId: string, request: FsWriteRequest): Promise<FsWriteResponse>;
+    /** FileSystem: delete a path (emits fs.changed). */
+    fsDelete(workspaceId: string, sessionId: string, request: FsDeleteRequest): Promise<FsDeleteResponse>;
+    /** FileSystem: move/rename a path (emits fs.changed; 409 if destination exists and overwrite is false). */
+    fsMove(workspaceId: string, sessionId: string, request: FsMoveRequest): Promise<FsMoveResponse>;
+    /** FileSystem: create a directory (emits fs.changed; recursive defaults to true). */
+    fsMkdir(workspaceId: string, sessionId: string, request: FsMkdirRequest): Promise<FsMkdirResponse>;
+    /** Git: working-tree/index status (the Pierre file-status feed). */
+    gitStatus(workspaceId: string, sessionId: string, request?: GitStatusRequest, options?: OpenGeniRequestOptions): Promise<GitStatusResponse>;
+    /** Git: structured diff hunks (the Pierre diff feed). */
+    gitDiff(workspaceId: string, sessionId: string, request?: GitDiffRequest, options?: OpenGeniRequestOptions): Promise<GitDiffResponse>;
+    /** Git: commit log. */
+    gitLog(workspaceId: string, sessionId: string, request?: GitLogRequest): Promise<GitLogResponse>;
+    /** Git: show a commit (diff vs first parent) or fetch a raw blob at a ref. */
+    gitShow(workspaceId: string, sessionId: string, request: GitShowRequest): Promise<GitShowResponse>;
+    /** Workspace capture: the latest turn-end snapshot of the session's workspace
+     *  (tree + per-repo diff + file after-image refs), served from durable storage
+     *  WITHOUT warming a machine — the workbench cold-paint source. Returns
+     *  `{available:false}` when no capture exists yet (fall back to the live path). */
+    getWorkspaceCapture(workspaceId: string, sessionId: string, options?: OpenGeniRequestOptions): Promise<GetWorkspaceCaptureResponse>;
+    /** Workspace capture: a single file's after-image from the capture (revision
+     *  pins a specific one; omitted → latest). Content is inline for small files,
+     *  else a short-TTL signed URL; a tooLarge file returns metadata only. */
+    getWorkspaceCaptureFile(workspaceId: string, sessionId: string, path: string, revision?: number, options?: OpenGeniRequestOptions): Promise<GetWorkspaceCaptureFileResponse>;
+    /** Terminal: run a bounded command, returning buffered stdout/stderr inline. */
+    terminalExec(workspaceId: string, sessionId: string, request: TerminalExecRequest): Promise<TerminalExecResponse>;
+    /** Terminal: open an interactive PTY. Output streams on the event SSE as
+     *  terminal.pty.output.delta; drive it with terminalPtyWrite. */
+    terminalPtyOpen(workspaceId: string, sessionId: string, request?: PtyOpenRequest): Promise<PtyOpenResponse>;
+    /** Terminal: send stdin to an open PTY (output rides A1). */
+    terminalPtyWrite(workspaceId: string, sessionId: string, request: PtyWriteRequest): Promise<void>;
+    /** Terminal: resize an open PTY. */
+    terminalPtyResize(workspaceId: string, sessionId: string, request: PtyResizeRequest): Promise<void>;
+    /** Terminal: close an open PTY (idempotent). */
+    terminalPtyClose(workspaceId: string, sessionId: string, request: PtyCloseRequest): Promise<void>;
+    /** Read the negotiated capability doc for a session WITHOUT acquiring a viewer
+     *  holder (no warm, no spawn). Drives capability-gated rendering: which
+     *  surfaces mount, the per-surface unavailability reasons, and the lease
+     *  liveness the client polls on while `cold`/`warming`. The desktop URL/token
+     *  are minted in-process only when the box is warm AND the principal has
+     *  acknowledged the un-redacted plane. */
+    getStreamCapabilities(workspaceId: string, sessionId: string, options?: OpenGeniRequestOptions): Promise<SessionCapabilities>;
+    /** Record the calling principal's acknowledgment of the un-redacted desktop
+     *  pixel plane (and, when the box is shared, the shared-exposure disclosure).
+     *  The desktop viewer-attach path returns 409 until this is recorded. */
+    acknowledgeStream(workspaceId: string, sessionId: string, request?: AcknowledgeStreamRequest): Promise<AcknowledgeStreamResponse>;
+    /** Attach a viewer holder (refcounted liveness — keeps the box warm while
+     *  watched/used), spinning the box up in-process when cold, and mint the scoped
+     *  direct-to-provider URLs for the requested plane(s). `request.desktop:true`
+     *  opts into the un-redacted pixel plane and mints the noVNC URL — that plane
+     *  alone throws `OpenGeniApiError(409)` when the un-redacted/shared
+     *  acknowledgment is missing (the consent gate). A terminal-only attach
+     *  (`desktop` omitted/false) warms the box + mints the pty-ws terminal cell with
+     *  NO consent gate. An omitted `viewerId` mints a fresh one. */
+    attachViewer(workspaceId: string, sessionId: string, request?: AttachViewerRequest): Promise<AttachViewerResponse>;
+    /** Heartbeat a viewer holder (Channel-A app-level liveness). A closed laptop
+     *  stops sending these → the reaper drops the holder within ~90s. Echoes
+     *  `leaseEpoch` so a superseded epoch is rejected (`alive:false` → re-attach). */
+    heartbeatViewer(workspaceId: string, sessionId: string, viewerId: string, request: ViewerHeartbeatRequest): Promise<ViewerHeartbeatResponse>;
+    /** Detach a viewer (delete this holder; idempotent delete-my-row). */
+    detachViewer(workspaceId: string, sessionId: string, viewerId: string): Promise<void>;
+    /**
+     * The deployment's public client bootstrap config: the host-exposed models
+     * (provider-grouped in `models`, flat in `allowedModels` for back-compat),
+     * reasoning efforts, MCP servers, file-upload limits, and how the client is
+     * expected to authenticate. Drives a composer's model picker without prior
+     * knowledge of the host setup; safe to call before any auth is established.
+     */
+    getClientConfig(): Promise<ClientConfig>;
+    /** Authenticated model definitions plus workspace-specific selectability. */
+    getWorkspaceModelCatalog(workspaceId: string): Promise<WorkspaceModelCatalogResponse>;
+    /** The caller's access context: subject, account + workspace grants, defaults. */
+    getAccessContext(): Promise<AccessContext>;
+    listWorkspaces(): Promise<Workspace[]>;
+    createWorkspace(request: CreateWorkspaceRequest): Promise<Workspace>;
+    getWorkspace(workspaceId: string): Promise<Workspace>;
+    /** Read-time, secret-safe inventory of policy heads and visible workspace knowledge. */
+    getWorkspaceState(workspaceId: string): Promise<WorkspaceStateResponse>;
+    updateWorkspace(workspaceId: string, request: UpdateWorkspaceRequest): Promise<Workspace>;
+    /** Inspect immutable instruction-policy history, active heads, and activation audit evidence. */
+    listWorkspaceInstructionPolicies(workspaceId: string, options?: WorkspaceInstructionPolicyListOptions): Promise<WorkspaceInstructionPolicyListResponse>;
+    getWorkspaceInstructionPolicyRevision(workspaceId: string, revisionId: string): Promise<WorkspaceInstructionPolicyRevision>;
+    createWorkspaceInstructionPolicyDraft(workspaceId: string, request: CreateWorkspaceInstructionPolicyDraftRequest): Promise<WorkspaceInstructionPolicyRevision>;
+    /** Import the stored legacy workspace override as an inactive charter draft. */
+    importLegacyWorkspaceInstructionPolicyDraft(workspaceId: string, request?: ImportLegacyWorkspaceInstructionPolicyDraftRequest): Promise<WorkspaceInstructionPolicyRevision>;
+    diffWorkspaceInstructionPolicyRevisions(workspaceId: string, request: WorkspaceInstructionPolicyDiffRequest): Promise<WorkspaceInstructionPolicyDiffResponse>;
+    activateWorkspaceInstructionPolicyRevision(workspaceId: string, revisionId: string, request: ActivateWorkspaceInstructionPolicyRequest): Promise<WorkspaceInstructionPolicyActivationResponse>;
+    rollbackWorkspaceInstructionPolicyRevision(workspaceId: string, request: RollbackWorkspaceInstructionPolicyRequest): Promise<WorkspaceInstructionPolicyActivationResponse>;
+    listPreferenceRegistry(workspaceId: string, options?: PreferenceRegistryListOptions): Promise<PreferenceRegistryListResponse>;
+    getPreferenceRegistry(workspaceId: string, preferenceId: string): Promise<PreferenceRegistryDetailResponse>;
+    createPreferenceRegistryProposal(workspaceId: string, request: CreatePreferenceRegistryProposalRequest): Promise<PreferenceRegistryRecord>;
+    activatePreferenceRegistryRevision(workspaceId: string, preferenceId: string, request: ActivatePreferenceRegistryRevisionRequest): Promise<PreferenceRegistryMutationResponse>;
+    correctPreferenceRegistry(workspaceId: string, preferenceId: string, request: CorrectPreferenceRegistryRequest): Promise<PreferenceRegistryMutationResponse>;
+    changePreferenceRegistryScope(workspaceId: string, preferenceId: string, request: ChangePreferenceRegistryScopeRequest): Promise<PreferenceRegistryMutationResponse>;
+    deactivatePreferenceRegistry(workspaceId: string, preferenceId: string, request: DeactivatePreferenceRegistryRequest): Promise<PreferenceRegistryMutationResponse>;
+    supersedePreferenceRegistry(workspaceId: string, preferenceId: string, request: SupersedePreferenceRegistryRequest): Promise<PreferenceRegistryMutationResponse>;
+    rejectPreferenceRegistryProposal(workspaceId: string, preferenceId: string, request: RejectPreferenceRegistryProposalRequest): Promise<PreferenceRegistryMutationResponse>;
+    getPreferenceRegistrySummary(workspaceId: string): Promise<PreferenceRegistrySnapshot>;
+    getPreferenceRegistryFullContent(workspaceId: string, retrievalHandle: string): Promise<PreferenceRegistryFullContent>;
+    /**
+     * Delete a workspace and everything in it. Refused (409) for the account's
+     * only workspace and while it still has a running session. Irreversible.
+     */
+    deleteWorkspace(workspaceId: string): Promise<void>;
+    /** The workspace's members (user + api_key subjects). */
+    listWorkspaceMembers(workspaceId: string): Promise<WorkspaceMember[]>;
+    /**
+     * Add an already-registered user by email. 404s when no user with that email
+     * exists (email invites for unknown users are deferred).
+     */
+    addWorkspaceMember(workspaceId: string, request: AddWorkspaceMemberRequest): Promise<WorkspaceMember>;
+    updateWorkspaceMember(workspaceId: string, subjectId: string, request: UpdateWorkspaceMemberRequest): Promise<WorkspaceMember>;
+    /**
+     * Remove a member. Refused (409) for your own membership and for the last
+     * member who can still manage the workspace.
+     */
+    removeWorkspaceMember(workspaceId: string, subjectId: string): Promise<void>;
+    createScheduledTask(workspaceId: string, request: CreateScheduledTaskRequest): Promise<ScheduledTask>;
+    updateScheduledTask(workspaceId: string, taskId: string, request: UpdateScheduledTaskRequest): Promise<ScheduledTask>;
+    pauseScheduledTask(workspaceId: string, taskId: string): Promise<ScheduledTask>;
+    resumeScheduledTask(workspaceId: string, taskId: string): Promise<ScheduledTask>;
+    /**
+     * Fire the task immediately (manual trigger), independent of its schedule.
+     * Pass a stable `triggerId` to make a retried trigger idempotent — the same
+     * token charges once and starts one run. Omit it and each call is distinct.
+     */
+    triggerScheduledTask(workspaceId: string, taskId: string, options?: {
+        triggerId?: string;
+    }): Promise<ScheduledTask>;
+    deleteScheduledTask(workspaceId: string, taskId: string): Promise<void>;
+    listScheduledTaskRuns(workspaceId: string, taskId: string, options?: {
+        limit?: number;
+    }): Promise<ScheduledTaskRun[]>;
+    listVariableSets(workspaceId: string): Promise<VariableSet[]>;
+    createVariableSet(workspaceId: string, request: CreateVariableSetRequest): Promise<VariableSet>;
+    getVariableSet(workspaceId: string, variableSetId: string): Promise<VariableSet>;
+    updateVariableSet(workspaceId: string, variableSetId: string, request: UpdateVariableSetRequest): Promise<VariableSet>;
+    deleteVariableSet(workspaceId: string, variableSetId: string): Promise<void>;
+    /** Create or rotate a variable. The value never comes back on any read. */
+    setVariableSetVariable(workspaceId: string, variableSetId: string, name: string, value: string): Promise<VariableSetVariableMetadata>;
+    deleteVariableSetVariable(workspaceId: string, variableSetId: string, name: string): Promise<void>;
+    listRigs(workspaceId: string): Promise<Rig[]>;
+    createRig(workspaceId: string, request: CreateRigRequest): Promise<Rig>;
+    getRig(workspaceId: string, rigId: string): Promise<Rig>;
+    updateRig(workspaceId: string, rigId: string, request: UpdateRigRequest): Promise<Rig>;
+    deleteRig(workspaceId: string, rigId: string): Promise<void>;
+    listRigVersions(workspaceId: string, rigId: string): Promise<RigVersion[]>;
+    /** Roll the active version to an existing one (rollback / promote-activate). */
+    activateRigVersion(workspaceId: string, rigId: string, versionId: string): Promise<RigVersion>;
+    listRigChanges(workspaceId: string, rigId: string): Promise<RigChange[]>;
+    /** Propose a change against the rig's active version (rigs:use). */
+    proposeRigChange(workspaceId: string, rigId: string, request: ProposeRigChangeRequest): Promise<RigChange>;
+    getRigChange(workspaceId: string, rigId: string, changeId: string): Promise<RigChange>;
+    /**
+     * Re-run verification for a change (rigs:use). Verification is asynchronous:
+     * this returns the change immediately with status `verifying`; poll
+     * `getRigChange`/`listRigChanges` for the terminal outcome + logs.
+     */
+    verifyRigChange(workspaceId: string, rigId: string, changeId: string): Promise<RigChange>;
+    /**
+     * Promote a verified `definition_edit` change into a new active rig version
+     * (rigs:manage). Only valid once the change's verification passed; returns the
+     * newly minted version.
+     */
+    promoteRigChange(workspaceId: string, rigId: string, changeId: string): Promise<RigVersion>;
+    /**
+     * Re-run the active version's checks in a clean throwaway sandbox (rigs:use).
+     * Asynchronous — returns the version id being verified; the outcome lands on
+     * the version's audit trail.
+     */
+    verifyRig(workspaceId: string, rigId: string): Promise<{
+        ok: boolean;
+        versionId: string;
+    }>;
+    /** @deprecated use listVariableSets */
+    listEnvironments(workspaceId: string): Promise<VariableSet[]>;
+    /** @deprecated use createVariableSet */
+    createEnvironment(workspaceId: string, request: CreateVariableSetRequest): Promise<VariableSet>;
+    /** @deprecated use getVariableSet */
+    getEnvironment(workspaceId: string, environmentId: string): Promise<VariableSet>;
+    /** @deprecated use updateVariableSet */
+    updateEnvironment(workspaceId: string, environmentId: string, request: UpdateVariableSetRequest): Promise<VariableSet>;
+    /** @deprecated use deleteVariableSet */
+    deleteEnvironment(workspaceId: string, environmentId: string): Promise<void>;
+    /** @deprecated use setVariableSetVariable */
+    setEnvironmentVariable(workspaceId: string, environmentId: string, name: string, value: string): Promise<VariableSetVariableMetadata>;
+    /** @deprecated use deleteVariableSetVariable */
+    deleteEnvironmentVariable(workspaceId: string, environmentId: string, name: string): Promise<void>;
+    /** Step 1 of the upload flow: returns the pre-signed PUT target. */
+    beginFileUpload(workspaceId: string, request: CreateFileUploadRequest): Promise<CreateFileUploadResponse>;
+    /** Step 3 of the upload flow: server verifies the object and marks it ready. */
+    completeFileUpload(workspaceId: string, uploadId: string): Promise<FileAsset>;
+    /**
+     * The whole upload flow as one call: begin -> PUT the bytes to the signed
+     * URL (with its required headers; no API auth is sent to object storage)
+     * -> complete. Returns the ready `FileAsset`.
+     */
+    uploadFile(workspaceId: string, input: UploadFileInput): Promise<FileAsset>;
+    getFile(workspaceId: string, fileId: string): Promise<FileAsset>;
+    /** Read provider-neutral retained evidence metadata; never returns a storage location. */
+    getRetainedArtifact(workspaceId: string, artifactId: string): Promise<RetainedArtifactMetadata>;
+    /**
+     * Read at most one authenticated retained-evidence range from the API. This
+     * deliberately does not use the ordinary signed file-download URL.
+     */
+    getRetainedArtifactContent(workspaceId: string, artifactId: string, options?: RetainedArtifactContentOptions): Promise<RetainedArtifactContent>;
+    /** Mint a short-lived signed download URL for a ready file. */
+    createFileDownloadUrl(workspaceId: string, fileId: string): Promise<FileDownloadUrlResponse>;
+    createDocumentBase(workspaceId: string, request: CreateDocumentBaseRequest): Promise<DocumentBase>;
+    listDocumentBases(workspaceId: string): Promise<DocumentBase[]>;
+    getDocumentBase(workspaceId: string, baseId: string): Promise<DocumentBase>;
+    /** Index an uploaded file into the base. The file must be `ready`. */
+    addDocument(workspaceId: string, baseId: string, request: AddDocumentRequest): Promise<Document>;
+    listDocuments(workspaceId: string, baseId: string): Promise<Document[]>;
+    /**
+     * Drop raw text or an already-uploaded file into the workspace's Default
+     * base. When curation is enabled, it may name, summarize, categorize, and
+     * (confidence permitting) file the document into the best-matching base;
+     * provider=none leaves caller metadata and Default placement unchanged.
+     */
+    createKnowledgeDrop(workspaceId: string, request: CreateKnowledgeDropRequest): Promise<Document>;
+    /**
+     * Move a document (and its indexed chunks) to another base. With no
+     * targetBaseId, applies the document's stored curation suggestion.
+     */
+    moveDocument(workspaceId: string, documentId: string, request?: MoveDocumentRequest): Promise<Document>;
+    /** Retry indexing for a failed document. */
+    reindexDocument(workspaceId: string, baseId: string, documentId: string): Promise<Document>;
+    /**
+     * Delete a document from a base. Removes the document row and its indexed
+     * chunks while leaving the uploaded file asset available for other uses.
+     */
+    deleteDocument(workspaceId: string, baseId: string, documentId: string): Promise<void>;
+    searchDocuments(workspaceId: string, baseId: string, request: Omit<DocumentSearchRequest, "baseIds">): Promise<DocumentSearchResponse>;
+    searchKnowledge(workspaceId: string, request: DocumentSearchRequest): Promise<DocumentSearchResponse>;
+    listKnowledgeMemories(workspaceId: string, request?: KnowledgeMemorySearchRequest): Promise<KnowledgeMemory[]>;
+    getKnowledgeMemory(workspaceId: string, memoryId: string): Promise<KnowledgeMemory>;
+    createKnowledgeMemory(workspaceId: string, request: CreateKnowledgeMemoryRequest): Promise<KnowledgeMemory>;
+    updateKnowledgeMemory(workspaceId: string, memoryId: string, request: UpdateKnowledgeMemoryRequest): Promise<KnowledgeMemory>;
+    /** Hybrid (semantic + keyword) search over the workspace's agent-visible memory. */
+    searchWorkspaceMemories(workspaceId: string, request: WorkspaceMemorySearchRequest): Promise<WorkspaceMemorySearchResponse>;
+    /** Deep-merge a settings patch into the workspace (preserves unknown keys). */
+    updateWorkspaceSettings(workspaceId: string, request: UpdateWorkspaceSettingsRequest): Promise<Workspace>;
+    setWorkspaceDefaultRig(workspaceId: string, request: SetWorkspaceDefaultRigRequest): Promise<Workspace>;
+    /** Built-in + registered packs, with the workspace's installations. */
+    listPacks(workspaceId: string): Promise<ListPacksResponse>;
+    /** Register (or replace) a workspace-scoped pack from a manifest. */
+    registerPack(workspaceId: string, manifest: RegisterCapabilityPackRequest): Promise<WorkspaceRegisteredPack>;
+    getPack(workspaceId: string, packId: string): Promise<GetPackResponse>;
+    enablePack(workspaceId: string, packId: string, request?: EnablePackRequest): Promise<PackInstallation>;
+    /** Unregister a workspace-scoped pack (built-in packs cannot be deleted). */
+    deletePack(workspaceId: string, packId: string): Promise<void>;
+    listPackInstallations(workspaceId: string): Promise<PackInstallation[]>;
+    listCapabilities(workspaceId: string): Promise<CapabilityCatalogResponse>;
+    /** Add a manual capability catalog item (e.g. a remote MCP server). */
+    createCapability(workspaceId: string, request: CreateCapabilityCatalogItemRequest): Promise<CapabilityCatalogItem>;
+    enableCapability(workspaceId: string, capabilityId: string, request?: EnableCapabilityRequest): Promise<CapabilityInstallation>;
+    disableCapability(workspaceId: string, capabilityId: string): Promise<CapabilityInstallation>;
+    /** Search the official MCP registry for installable capabilities. */
+    discoverMcpCapabilities(workspaceId: string, options?: {
+        query?: string;
+        limit?: number;
+    }): Promise<DiscoverMcpCapabilitiesResponse>;
+    listConnections(workspaceId: string): Promise<ConnectionMetadata[]>;
+    createConnection(workspaceId: string, request: CreateConnectionRequest): Promise<ConnectionMetadata>;
+    /** Start the public Slack installation flow for the workspace-shared OpenGeni bot. */
+    startOpenGeniSlackBotInstall(workspaceId: string, request?: OpenGeniSlackBotInstallRequest): Promise<OpenGeniSlackBotInstallStart>;
+    updateConnection(workspaceId: string, connectionId: string, request: UpdateConnectionRequest): Promise<ConnectionMetadata>;
+    deleteConnection(workspaceId: string, connectionId: string): Promise<ConnectionMetadata>;
+    /** Start an OAuth connection flow; redirect the user to the returned `authorizationUrl`. */
+    startConnectionOAuth(workspaceId: string, request: OAuthStartRequest, options?: OpenGeniRequestOptions): Promise<OAuthStartResponse>;
+    /** Public, immutably-cached URL for a catalog item's logo, or null when the item has none. */
+    catalogAssetUrl(logoAssetPath: string | null): string | null;
+    /** GitHub App server configuration plus truthful workspace binding status. */
+    getGitHubApp(workspaceId: string): Promise<GitHubAppInfo>;
+    /** Build the GitHub owner-consent entry URL for fresh workspace-bound state. */
+    githubConnectUrl(workspaceId: string, state: string): string;
+    listGitHubRepositories(workspaceId: string): Promise<GitHubRepositoriesResponse>;
+    /** Re-sync the installation's repository list from GitHub. */
+    syncGitHubRepositories(workspaceId: string): Promise<GitHubRepositoriesResponse>;
+    /** Remove one workspace binding without uninstalling the GitHub App itself. */
+    unlinkGitHubInstallation(workspaceId: string, installationId: number): Promise<void>;
+    /** Build a GitHub App manifest + the GitHub URL to submit it to. */
+    createGitHubAppManifest(workspaceId: string, request?: CreateGitHubAppManifestRequest): Promise<CreateGitHubAppManifestResponse>;
+    listApiKeys(workspaceId: string): Promise<ApiKey[]>;
+    /** The returned `token` is shown once; only its prefix is stored. */
+    createApiKey(workspaceId: string, request: CreateApiKeyRequest): Promise<CreateApiKeyResponse>;
+    /** Revoke an API key. Returns the revoked key. */
+    deleteApiKey(workspaceId: string, apiKeyId: string): Promise<ApiKey>;
+    getBilling(options?: {
+        accountId?: string;
+    }): Promise<BillingSummary>;
+    getBillingUsage(options?: {
+        accountId?: string;
+        workspaceId?: string;
+    }): Promise<BillingUsageResponse>;
+    getWorkspaceInsights(workspaceId: string, options?: {
+        range?: InsightsRange;
+        provider?: string;
+        model?: string;
+    }): Promise<WorkspaceInsightsResponse>;
+    getBillingEntitlements(options?: {
+        accountId?: string;
+    }): Promise<BillingEntitlementsResponse>;
+    /** Start a Stripe checkout for prepaid credits. */
+    createBillingCheckout(request: CreateCheckoutRequest): Promise<CreateCheckoutResponse>;
+    private headers;
+    private url;
+    /** Connection state + the codex models the workspace may select (empty until connected). */
+    codexStatus(workspaceId: string): Promise<CodexConnectionStatus>;
+    /** Begin device-code login: show `userCode` at `verificationUri`, then poll with `state`. */
+    codexConnectStart(workspaceId: string): Promise<CodexConnectStart>;
+    /** Poll device-code authorization with the `state` from {@link codexConnectStart}. */
+    codexConnectPoll(workspaceId: string, state: string): Promise<CodexConnectPoll>;
+    /** Remaining usage / limits for the connected (ACTIVE) subscription. Back-compat. */
+    codexUsage(workspaceId: string): Promise<CodexUsage>;
+    /** Live per-account usage read (refreshes THIS account's bearer; writes the cache). */
+    codexAccountUsage(workspaceId: string, accountId: string): Promise<CodexUsage>;
+    /** Batched live refresh across every connected account, keyed by credential id. */
+    refreshCodexUsage(workspaceId: string): Promise<{
+        usage: CodexUsageMap;
+    }>;
+    /** Live independently-settled quota + reset-credit overview for every account. */
+    codexOverview(workspaceId: string): Promise<CodexOverviewResponse>;
+    /** Disconnect ALL accounts (legacy workspace-wide). Prefer `disconnectCodexAccount`. */
+    codexDisconnect(workspaceId: string): Promise<{
+        disconnected: boolean;
+    }>;
+    /** List every connected Codex account + the workspace active pointer + settings. */
+    listCodexAccounts(workspaceId: string): Promise<CodexAccountsResponse>;
+    /** Switch the workspace ACTIVE Codex account (the one unpinned sessions use). */
+    activateCodexAccount(workspaceId: string, accountId: string): Promise<{
+        activated: boolean;
+        accountId: string;
+    }>;
+    /** P3: enable/disable Codex auto-rotation and/or pick the strategy. Returns the effective settings. */
+    setCodexRotationSettings(workspaceId: string, patch: {
+        rotationEnabled?: boolean;
+        rotationStrategy?: CodexRotationSettings["rotationStrategy"];
+    }): Promise<CodexRotationSettings>;
+    /** Toggle only NEW automatic allocations under independent allocator OCC. */
+    setCodexAccountAllocator(workspaceId: string, accountId: string, input: {
+        enabled: boolean;
+        expectedVersion: number;
+    }): Promise<CodexAllocatorUpdate>;
+    /** Disconnect ONE Codex account by id (re-picks active when the removed one was active). */
+    disconnectCodexAccount(workspaceId: string, accountId: string): Promise<{
+        disconnected: boolean;
+        newActiveId: string | null;
+    }>;
+    /** Rename a Codex account (label only in P1). */
+    renameCodexAccount(workspaceId: string, accountId: string, label: string | null): Promise<CodexAccount>;
+    /** Pin (or unpin via "auto") a session's Codex account. Applies on the next turn. */
+    pinSessionCodexAccount(workspaceId: string, sessionId: string, target: string): Promise<{
+        pinned: string;
+    }>;
+    private requestJson;
+    /** Like `requestJson` for endpoints that respond with no body (204). */
+    private requestVoid;
+}