@opengeni/sdk 0.29.0 → 0.32.1

package/dist/index.d.ts

@@ -1,4211 +1,25 @@
-/**
- * Framework- and transport-agnostic speech-to-text capability contract.
- *
- * Audio transport, microphone access, credentials, and provider SDKs belong to
- * host-supplied adapters. This module deliberately contains no browser globals
- * and no provider implementation.
- */
-type TranscriptionCredentialMode = "managed" | "byok";
-type WorkspaceTranscriptionTarget = {
-    provider: string;
-    model: string | null;
-    credentialMode: TranscriptionCredentialMode;
-    /** Workspace-scoped connection reference. This is never a secret. */
-    credentialConnectionId: string | null;
-    region: string | null;
-};
-type WorkspaceTranscriptionPolicy = {
-    enabled: boolean;
-    /** Exact admin-accepted policy identity; required whenever enabled. */
-    acceptanceId: string | null;
-    primary: WorkspaceTranscriptionTarget | null;
-    /** Explicit language preference. Required when automatic detection is not accepted. */
-    language: string | null;
-    /** Whether the accepted adapter may automatically detect the spoken language. */
-    autoDetectLanguage: boolean;
-    /** Whether the accepted adapter may identify distinct speakers. */
-    diarization: {
-        enabled: boolean;
-        maxSpeakers: number | null;
-    };
-    retention: {
-        mode: "none" | "provider-policy";
-        maxDays: number | null;
-    };
-    privacy: {
-        allowProviderLogging: boolean;
-        allowProviderTraining: boolean;
-    };
-    fallback: {
-        mode: "disabled" | "explicit";
-        targets: WorkspaceTranscriptionTarget[];
-    };
-    cost: {
-        currency: "USD";
-        maxPerHour: number | null;
-        maxPerMonth: number | null;
-    };
-};
-declare const DEFAULT_WORKSPACE_TRANSCRIPTION_POLICY: WorkspaceTranscriptionPolicy;
-type TranscriptionAdapterDescriptor = {
-    provider: string;
-    model: string | null;
-    credentialMode: TranscriptionCredentialMode;
-    region: string | null;
-};
-type TranscriptionTargetSelection = {
-    kind: "primary";
-} | {
-    kind: "fallback";
-    index: number;
-};
-type TranscriptionPolicyBlockReason = "disabled" | "unaccepted" | "target_missing" | "fallback_disabled" | "fallback_unaccepted" | "provider_mismatch" | "model_mismatch" | "credential_mode_mismatch" | "region_mismatch";
-type TranscriptionAuthorization = {
-    authorized: true;
-    acceptanceId: string;
-    target: WorkspaceTranscriptionTarget;
-    selection: TranscriptionTargetSelection;
-} | {
-    authorized: false;
-    reason: TranscriptionPolicyBlockReason;
-};
-type TranscriptionLifecycleStatus = "idle" | "requesting-permission" | "listening" | "reconnecting" | "cancelling" | "closed" | "error";
-type TranscriptionErrorCode = "permission_denied" | "not_supported" | "network" | "provider" | "policy_blocked" | "timeout" | "cancelled" | "unknown";
-type TranscriptionTimeSpan = {
-    startMilliseconds: number;
-    endMilliseconds: number;
-};
-type TranscriptionSpeaker = {
-    /** Provider-neutral identity stable within the local transcription session. */
-    id: string;
-    label?: string | undefined;
-};
-type TranscriptionWord = {
-    text: string;
-    span: TranscriptionTimeSpan;
-    confidence?: number | undefined;
-    speaker?: TranscriptionSpeaker | undefined;
-};
-/** Optional result detail; adapters omit fields their provider cannot supply. */
-type TranscriptionResultMetadata = {
-    detectedLanguage?: string | undefined;
-    span?: TranscriptionTimeSpan | undefined;
-    confidence?: number | undefined;
-    speaker?: TranscriptionSpeaker | undefined;
-    words?: TranscriptionWord[] | undefined;
-};
-type TranscriptionDiagnostic = {
-    operation: "start" | "session" | "cancel" | "close";
-    code: TranscriptionErrorCode;
-    /** Diagnostic-only detail. React sanitizes and bounds this before forwarding it. */
-    detail: string;
-};
-type TranscriptionEventBase = {
-    /** Stable across reconnects and explicitly accepted fallback attempts. */
-    localSessionId: string;
-    /** Adapter-monotonic across the entire local session, including replay. */
-    sequence: number;
-    occurredAt: string;
-};
-type TranscriptionEvent = (TranscriptionEventBase & {
-    type: "permission.requested";
-}) | (TranscriptionEventBase & {
-    type: "session.opened";
-    providerSessionId: string;
-}) | (TranscriptionEventBase & {
-    type: "transcript.partial";
-    segmentId: string;
-    text: string;
-    metadata?: TranscriptionResultMetadata | undefined;
-}) | (TranscriptionEventBase & {
-    type: "transcript.final";
-    segmentId: string;
-    text: string;
-    /** Stable provider/coordinator acceptance identity used for dedupe. */
-    providerAcceptanceId: string;
-    metadata?: TranscriptionResultMetadata | undefined;
-}) | (TranscriptionEventBase & {
-    type: "usage";
-    audioMilliseconds: number;
-    costUsd: number | null;
-}) | (TranscriptionEventBase & {
-    type: "session.reconnecting";
-    attempt: number;
-    reason: string;
-}) | (TranscriptionEventBase & {
-    type: "session.error";
-    code: TranscriptionErrorCode;
-    recoverable: boolean;
-}) | (TranscriptionEventBase & {
-    type: "session.closed";
-    reason: "completed" | "cancelled" | "error" | "replaced";
-});
-type TranscriptionSessionRequest = {
-    localSessionId: string;
-    policyAcceptanceId: string;
-    selection: TranscriptionTargetSelection;
-    target: WorkspaceTranscriptionTarget;
-    language: string | null;
-    autoDetectLanguage: boolean;
-    diarization: WorkspaceTranscriptionPolicy["diarization"];
-    retention: WorkspaceTranscriptionPolicy["retention"];
-    privacy: WorkspaceTranscriptionPolicy["privacy"];
-    cost: WorkspaceTranscriptionPolicy["cost"];
-    /** A replacement/reconnect adapter must emit events above this floor. */
-    sequenceFloor: number;
-};
-type TranscriptionEventListener = (event: TranscriptionEvent) => void;
-type TranscriptionAdapterStartContext = {
-    /** Aborted on local cancellation, policy replacement, timeout, or unmount. */
-    signal: AbortSignal;
-    /** Non-UI observability seam; callers receive only bounded, redacted detail. */
-    reportDiagnostic: (diagnostic: TranscriptionDiagnostic) => void;
-};
-type TranscriptionSession = {
-    readonly localSessionId: string;
-    cancel(reason?: string): Promise<void>;
-    close(): Promise<void>;
-};
-type TranscriptionAdapter = {
-    readonly descriptor: TranscriptionAdapterDescriptor;
-    start(request: TranscriptionSessionRequest, listener: TranscriptionEventListener, context: TranscriptionAdapterStartContext): Promise<TranscriptionSession>;
-};
-/** Invalid or absent settings always resolve to the fail-closed default. */
-declare function resolveWorkspaceTranscriptionPolicy(settings: unknown): WorkspaceTranscriptionPolicy;
-/**
- * Speech authorization is intentionally independent from turn model policy.
- * Every selected adapter must match one exact admin-accepted target.
- */
-declare function authorizeTranscriptionAdapter(policy: WorkspaceTranscriptionPolicy, descriptor: TranscriptionAdapterDescriptor, selection?: TranscriptionTargetSelection): TranscriptionAuthorization;
-declare function createTranscriptionSessionRequest(input: {
-    policy: WorkspaceTranscriptionPolicy;
-    adapter: TranscriptionAdapter;
-    localSessionId: string;
-    selection?: TranscriptionTargetSelection | undefined;
-    sequenceFloor?: number | undefined;
-}): TranscriptionSessionRequest | null;
-
-type SessionStatus = "queued" | "running" | "idle" | "requires_action" | "recovering" | "waiting_capacity" | "failed" | "cancelled";
-type SandboxBackend = "docker" | "modal" | "local" | "none" | "daytona" | "runloop" | "e2b" | "blaxel" | "cloudflare" | "vercel" | "selfhosted";
-type SandboxOs = "linux" | "macos" | "windows";
-type SandboxCapabilityName = "FileSystem" | "Terminal" | "Git" | "DesktopStream" | "Recording";
-type CapabilityUnavailableReason = "backend_unsupported" | "os_unsupported" | "not_provisioned" | "disabled_by_policy" | "lease_cold" | "tier_headless" | "agent_offline" | "agent_reconnecting" | "consent_required" | "display_unavailable";
-type SessionCapabilities = {
-    sessionId: string;
-    backend: SandboxBackend;
-    os: SandboxOs;
-    liveness: "cold" | "warming" | "warm" | "draining";
-    leaseEpoch: number;
-    workspaceGeneration: number | null;
-    archiveGeneration: number | null;
-    archiveComplete: boolean;
-    viewerHeartbeatIntervalMs: number;
-    FileSystem: {
-        available: boolean;
-        readOnly: boolean;
-        root: string;
-        pathSep: "/" | "\\";
-        treeMode: "lazy" | "snapshot";
-        reason: CapabilityUnavailableReason | null;
-    };
-    Terminal: {
-        transport: "sse-events" | "pty-ws" | null;
-        ptyCapable: boolean;
-        shell: string;
-        url: string | null;
-        token: string | null;
-        reason: CapabilityUnavailableReason | null;
-    };
-    Git: {
-        available: boolean;
-        repos: string[];
-        reason: CapabilityUnavailableReason | null;
-    };
-    DesktopStream: {
-        transport: "vnc-ws" | "rdp-ws" | "webrtc" | "relay-frames" | null;
-        client: "novnc" | "web-rdp" | "frames" | null;
-        mode: "read-only" | "interactive";
-        url: string | null;
-        token: string | null;
-        expiresAt: string | null;
-        resolution: [number, number];
-        unredacted: boolean;
-        requiresAcknowledgment: boolean;
-        acknowledged: boolean;
-        shared: boolean;
-        sharedSessionIds: string[];
-        reason: CapabilityUnavailableReason | null;
-    };
-    Recording: {
-        available: boolean;
-        modes: ("manual" | "on-turn" | "on-verify")[];
-        codecs: ("h264-mp4" | "vp9-webm")[];
-        reason: CapabilityUnavailableReason | null;
-    };
-    ComputerUse: {
-        available: boolean;
-        readOnly: boolean;
-        reason: CapabilityUnavailableReason | null;
-    };
-    negotiatedAt: string;
-};
-type FileSystemCapability = SessionCapabilities["FileSystem"];
-type TerminalCapability = SessionCapabilities["Terminal"];
-type GitCapability = SessionCapabilities["Git"];
-type DesktopStreamCapability = SessionCapabilities["DesktopStream"];
-type RecordingCapability = SessionCapabilities["Recording"];
-type ComputerUseCapability = SessionCapabilities["ComputerUse"];
-type StreamUrlRotatedPayload = {
-    url: string;
-    token: string | null;
-    expiresAt: string | null;
-    leaseEpoch: number;
-    transport: "vnc-ws";
-    viewerId: string | null;
-};
-type StreamOpenedPayload = {
-    viewerId: string;
-    shared: boolean;
-    viewerCount: number;
-};
-type StreamClosedPayload = {
-    viewerId: string;
-    reason: "client-disconnect" | "reaped" | "revoked" | "box-rollover";
-    viewerCount: number;
-};
-type StreamRevokedPayload = {
-    viewerId: string | null;
-    reason: "grant-revoked" | "session-failed" | "admin";
-};
-type AttachViewerRequest = {
-    viewerId?: string | undefined;
-    desktop?: boolean | undefined;
-};
-type ViewerHolder = {
-    viewerId: string;
-    sandboxGroupId: string;
-    liveness: "cold" | "warming" | "warm" | "draining";
-    leaseEpoch: number;
-    workspaceGeneration: number | null;
-    archiveGeneration: number | null;
-    archiveComplete: boolean;
-    viewerHeartbeatIntervalMs: number;
-    dataPlaneUrl: string | null;
-};
-type AttachViewerResponse = ViewerHolder & {
-    streamToken: string | null;
-    streamExpiresAt: string | null;
-    resolution: [number, number] | null;
-    transport: "vnc-ws" | null;
-    client: "novnc" | null;
-    terminalUrl: string | null;
-    terminalToken: string | null;
-    terminalTransport: "pty-ws" | null;
-};
-type AcknowledgeStreamRequest = {
-    acknowledgeUnredacted?: boolean | undefined;
-    acknowledgeShared?: boolean | undefined;
-};
-type AcknowledgeStreamResponse = {
-    acknowledged: boolean;
-    acknowledgedShared: boolean;
-};
-type ViewerHeartbeatRequest = {
-    leaseEpoch: number;
-};
-type ViewerHeartbeatResponse = {
-    alive: boolean;
-};
-type ReasoningEffort = "none" | "minimal" | "low" | "medium" | "high" | "xhigh";
-type GitCredentialProvider = "github" | "gitlab" | "azure_devops";
-type GitCredentialBindingId = string;
-type GitRepositoryAccess = "read" | "write";
-type RepositoryResourceRef = {
-    kind: "repository";
-    uri: string;
-    ref: string;
-    /**
-     * Optional workspace-relative override. When omitted, OpenGeni persists
-     * `repos/<encoded-host>/<owner>/<repo>` so equal names on different Git
-     * providers do not collide. Explicit paths are portable, traversal-free, and
-     * collision-checked case-insensitively before sandbox execution.
-     */
-    mountPath?: string | undefined;
-    subpath?: string | undefined;
-    provider?: GitCredentialProvider | undefined;
-    credentialBindingId?: GitCredentialBindingId | undefined;
-    access?: GitRepositoryAccess | undefined;
-    repositoryId?: number | string | undefined;
-    installationId?: number | string | undefined;
-    projectId?: number | string | undefined;
-    connectionId?: string | undefined;
-    githubInstallationId?: number | undefined;
-    githubRepositoryId?: number | undefined;
-};
-type FileResourceRef = {
-    kind: "file";
-    fileId: string;
-    /** Optional workspace-relative override; defaults to `files/<file-id>`. */
-    mountPath?: string | undefined;
-};
-type ResourceRef = RepositoryResourceRef | FileResourceRef;
-type ToolRef = {
-    kind: "mcp";
-    id: string;
-    optional?: boolean | undefined;
-};
-type SessionToolPolicy = {
-    mode: "workspace_default" | "explicit" | "inherited";
-    inheritedFromSessionId: string | null;
-};
-type UpdateSessionToolPolicyRequest = {
-    mode: "workspace_default";
-    expectedVersion: number;
-} | {
-    mode: "explicit";
-    tools: ToolRef[];
-    firstPartyMcpTools: FirstPartyMcpToolName[];
-    expectedVersion: number;
-};
-type SessionEffectiveToolPolicy = {
-    mode: SessionToolPolicy["mode"];
-    inheritedFromSessionId: string | null;
-    selectedIds: string[];
-    effectiveIds: string[];
-    mandatoryIds: string[];
-    lazyRouter: {
-        state: "required" | "disabled";
-        deferredIds: string[];
-    };
-    configuredIds: string[];
-    droppedIds: string[];
-    counts: {
-        selected: number;
-        effective: number;
-        mandatory: number;
-        deferred: number;
-        configured: number;
-        dropped: number;
-    };
-    idsTruncated: boolean;
-};
-type GoalSpec = {
-    text: string;
-    successCriteria?: string | undefined;
-    maxAutoContinuations?: number | undefined;
-};
-type SessionMcpServerInput = {
-    id: string;
-    name?: string | undefined;
-    url: string;
-    allowedTools?: string[] | undefined;
-    timeoutMs?: number | undefined;
-    cacheToolsList?: boolean | undefined;
-    /** Require human approval for every tool, or only the listed unprefixed tool names. */
-    requireApproval?: boolean | string[] | undefined;
-    headers?: Record<string, string> | undefined;
-    connectionRef?: McpServerConnectionRef | undefined;
-};
-type SessionMcpCredentialUpdateInput = {
-    id: string;
-    headers: Record<string, string>;
-};
-type SessionMcpApprovalPolicy = boolean | string[];
-type SessionMcpServerMetadata = {
-    id: string;
-    name: string | null;
-    url: string;
-    headerNames: string[];
-    credentialVersion: number;
-    requireApproval: SessionMcpApprovalPolicy;
-    connectionRef: McpServerConnectionRef | null;
-};
-type UpdateSessionMcpApprovalPolicyRequest = {
-    requireApproval: SessionMcpApprovalPolicy;
-};
-type UpdateSessionMcpApprovalPolicyResponse = {
-    server: SessionMcpServerMetadata;
-    effectiveFrom: "next_attempt";
-};
-type ConnectionKind = "oauth2" | "api_key" | "app_install" | "delegated";
-type ConnectionStatus = "active" | "needs_reauth" | "revoked" | "error";
-type McpServerConnectionRef = {
-    connectionId?: string | undefined;
-    provider?: string | undefined;
-    providerDomain: string;
-    kind?: ConnectionKind | undefined;
-    scopes?: string[] | undefined;
-    resource?: string | undefined;
-    selectedResources?: Array<{
-        id: string;
-        kind: "repository";
-    }> | undefined;
-    subjectScope?: "workspace" | "subject" | undefined;
-};
-type ConnectionMetadata = {
-    id: string;
-    accountId: string;
-    workspaceId: string;
-    subjectId: string | null;
-    providerDomain: string;
-    kind: ConnectionKind;
-    status: ConnectionStatus;
-    grantedScopes: string[];
-    expiresAt: string | null;
-    lastRefreshAt: string | null;
-    lastUsedAt: string | null;
-    lastError: string | null;
-    version: number;
-    verifiedInstallAt?: string | null;
-    verifiedInstallVersion?: number | null;
-    metadata: Record<string, unknown>;
-    createdBySubjectId: string | null;
-    updatedBySubjectId: string | null;
-    createdAt: string;
-    updatedAt: string;
-};
-type CreateConnectionRequest = {
-    providerDomain: string;
-    kind: ConnectionKind;
-    subjectId?: string | null | undefined;
-    credential: Record<string, unknown>;
-    grantedScopes?: string[] | undefined;
-    expiresAt?: string | null | undefined;
-    metadata?: Record<string, unknown> | undefined;
-};
-type OpenGeniSlackBotInstallRequest = {
-    /** Existing OpenGeni Slack bot connection to reinstall in place. */
-    connectionId?: string | undefined;
-};
-type OpenGeniSlackBotInstallStart = {
-    authorizationUrl: string;
-    expiresAt: string;
-};
-type UpdateConnectionRequest = {
-    providerDomain?: string | undefined;
-    subjectId?: string | null | undefined;
-    kind?: ConnectionKind | undefined;
-    status?: ConnectionStatus | undefined;
-    credential?: Record<string, unknown> | undefined;
-    grantedScopes?: string[] | undefined;
-    expiresAt?: string | null | undefined;
-    metadata?: Record<string, unknown> | undefined;
-};
-type ConnectionResponse = {
-    connection: ConnectionMetadata;
-};
-type ListConnectionsResponse = {
-    connections: ConnectionMetadata[];
-};
-type OAuthStartRequest = {
-    providerDomain?: string | undefined;
-    mcpUrl?: string | undefined;
-    resource?: string | undefined;
-    requestedScopes?: string[] | undefined;
-    returnPath?: string | undefined;
-    connectionId?: string | undefined;
-    oauthClient?: {
-        clientId: string;
-        clientSecret?: string | undefined;
-        tokenEndpointAuthMethod?: "none" | "client_secret_post" | "client_secret_basic" | undefined;
-    } | undefined;
-};
-type OAuthStartResponse = {
-    state: string;
-    authorizationUrl: string | null;
-    expiresAt: string;
-};
-/** The immutable principal whose authority accepted a session or turn. */
-type TurnInitiator = {
-    kind: "subject" | "service";
-    subjectId: string;
-    /** Display-only snapshot; never an authorization input. */
-    label?: string | undefined;
-};
-/** A trusted embedding host's causal machine/service principal. */
-type ServiceTurnInitiator = TurnInitiator & {
-    kind: "service";
-};
-/** Bounded host provenance; OpenGeni-owned lineage keys are reserved. */
-type ServiceTurnInitiatorContext = Record<string, unknown>;
-type IntegrationClientMetadata = {
-    client_id: string;
-    client_name: "OpenGeni";
-    redirect_uris: string[];
-    token_endpoint_auth_method: "none";
-    grant_types: Array<"authorization_code" | "refresh_token">;
-    response_types: ["code"];
-};
-type Session = {
-    id: string;
-    workspaceId: string;
-    accountId: string;
-    status: SessionStatus;
-    initialMessage: string;
-    title: string | null;
-    titleSource: "user" | "agent" | null;
-    instructions: string | null;
-    resources: ResourceRef[];
-    skills: SessionSkill[];
-    tools: ToolRef[];
-    toolPolicy: SessionToolPolicy;
-    toolPolicyVersion: number;
-    effectiveToolPolicy?: SessionEffectiveToolPolicy | undefined;
-    metadata: Record<string, unknown>;
-    /** Frozen creator fact; later turns carry their own independent initiator. */
-    createdBy: TurnInitiator;
-    createdByContext: Record<string, unknown>;
-    model: string;
-    sandboxBackend: SandboxBackend;
-    sandboxOs: SandboxOs;
-    sandboxGroupId: string;
-    activeSandboxId: string | null;
-    activeEpoch: number;
-    variableSetId: string | null;
-    /** @deprecated use variableSetId */
-    environmentId: string | null;
-    rigId: string | null;
-    rigVersionId: string | null;
-    firstPartyMcpPermissions: string[] | null;
-    firstPartyMcpTools: FirstPartyMcpToolName[];
-    mcpServers: SessionMcpServerMetadata[];
-    parentSessionId: string | null;
-    /** Immutable server-authored nested-agent lineage and policy snapshot. */
-    rootSessionId: string;
-    nestedAgentDepth: number;
-    maxNestedAgentDepthOverride: number | null;
-    effectiveMaxNestedAgentDepth: number;
-    nestedAgentDepthPolicySource: "session" | "workspace" | "deployment" | "default";
-    nestedAgentDepthPolicySessionId: string | null;
-    createIdempotencyKey: string | null;
-    temporalWorkflowId: string | null;
-    activeTurnId: string | null;
-    queueVersion: number;
-    queueHeadPosition: number;
-    queueTailPosition: number;
-    effectiveControl: EffectiveSessionControl;
-    lastSequence: number;
-    /** Multi-account Codex (P1): the account this session is pinned to (null ⇒ follow workspace active). */
-    codexPinnedCredentialId?: string | null;
-    /** Multi-account Codex (P1): the account the most recent turn ran on (the "Running on:" indicator). */
-    codexLastCredentialId?: string | null;
-    /** Personal (authenticated subject) workspace pin state, never workspace-global. */
-    pinned?: boolean;
-    /** Stable pin ordering key; null when this subject has not pinned the session. */
-    pinnedAt?: string | null;
-    /** Optimistic pin-state revision; zero represents an absent pin relation. */
-    pinVersion?: number;
-    /** Server-authoritative descendant counts populated by session-list reads. */
-    treeStats?: {
-        directChildren: number;
-        totalDescendants: number;
-        runningDescendants: number;
-        queuedDescendants: number;
-        attentionDescendants: number;
-        pausedDescendants: number;
-        failedDescendants: number;
-        /** Counts are lower bounds rather than exact totals when true. */
-        truncated: boolean;
-    } | undefined;
-    createdAt: string;
-    updatedAt: string;
-};
-/** Additive receipt returned by POST /sessions. */
-type CreateSessionResponse = Session & {
-    initialTurnId: string | null;
-};
-type SessionSummary = Session;
-/** Canonical session-list page; pinned rows are excluded from ordinary pages. */
-type SessionListResponse = {
-    pinned: Session[];
-    /** True when the server omitted older pins from its bounded pinned section. */
-    pinnedTruncated?: boolean;
-    sessions: Session[];
-    nextCursor: string | null;
-};
-type UpdateSessionPinRequest = {
-    pinned: boolean;
-    expectedVersion?: number;
-};
-type LineageNode = {
-    session: SessionSummary;
-    children: LineageNode[];
-};
-type SessionLineageResponse = {
-    ancestors: SessionSummary[];
-    children: LineageNode[];
-    truncated: boolean;
-};
-type SessionTurnStatus = "queued" | "running" | "requires_action" | "recovering" | "waiting_capacity" | "completed" | "failed" | "cancelled" | "superseded" | "withdrawn_for_edit";
-type SessionTurnSource = "user" | "scheduled_task" | "api" | "goal" | "system" | "compaction";
-type SessionTurn = {
-    id: string;
-    workspaceId: string;
-    sessionId: string;
-    triggerEventId: string;
-    temporalWorkflowId: string;
-    status: SessionTurnStatus;
-    source: SessionTurnSource;
-    position: number;
-    prompt: string;
-    resources: ResourceRef[];
-    tools: ToolRef[];
-    toolsProvided?: boolean | undefined;
-    model: string;
-    reasoningEffort: ReasoningEffort;
-    sandboxBackend: SandboxBackend;
-    sandboxOs: SandboxOs | null;
-    metadata: Record<string, unknown>;
-    version: number;
-    executionGeneration: number;
-    activeAttemptId: string | null;
-    lineage: Record<string, unknown>;
-    initiator: TurnInitiator;
-    initiatorContext: Record<string, unknown>;
-    cancelledBy?: string | null;
-    cancelReason?: string | null;
-    startedAt: string | null;
-    finishedAt: string | null;
-    createdAt: string;
-    updatedAt: string;
-};
-type HumanInputQuestionKind = "text" | "single_select" | "multi_select";
-type HumanInputOption = {
-    id: string;
-    label: string;
-    description?: string | null | undefined;
-};
-type HumanInputQuestion = {
-    id: string;
-    kind: HumanInputQuestionKind;
-    prompt: string;
-    label?: string | null | undefined;
-    helpText?: string | null | undefined;
-    options: HumanInputOption[];
-    required: boolean;
-    allowOther: boolean;
-    validation?: {
-        minLength?: number | null | undefined;
-        maxLength?: number | null | undefined;
-        minSelections?: number | null | undefined;
-        maxSelections?: number | null | undefined;
-    } | null | undefined;
-};
-type HumanInputAnswer = {
-    questionId: string;
-    values: string[];
-    other?: string | null | undefined;
-};
-type HumanInputResponse = {
-    outcome: "answered";
-    answers: HumanInputAnswer[];
-} | {
-    outcome: "skipped" | "expired" | "cancelled";
-};
-type SubmitHumanInputResponseRequest = {
-    outcome: "answered";
-    answers: HumanInputAnswer[];
-} | {
-    outcome: "skipped";
-};
-type SessionHumanInputRequest = {
-    id: string;
-    workspaceId: string;
-    sessionId: string;
-    turnId: string;
-    turnGeneration: number;
-    creationAttemptId: string;
-    toolCallId: string;
-    status: "pending" | "answered" | "skipped" | "expired" | "cancelled";
-    questions: HumanInputQuestion[];
-    allowSkip: boolean;
-    response: HumanInputResponse | null;
-    respondedBy: string | null;
-    respondedAt: string | null;
-    expiresAt: string | null;
-    createdAt: string;
-    updatedAt: string;
-};
-declare const SESSION_EVENT_TYPES: readonly ["session.created", "session.event.envelope_omitted", "session.status.changed", "session.requiresAction", "session.humanInput.requested", "session.context.compaction.requested", "session.context.compacted", "session.context.compaction.skipped", "session.context.cleared", "user.message", "user.pause", "user.approvalDecision", "user.humanInputResponse", "turn.queued", "turn.started", "turn.completed", "turn.failed", "turn.cancelled", "turn.superseded", "turn.recovery.requested", "turn.capacity_waiting", "agent.message.delta", "agent.message.completed", "agent.reasoning.delta", "agent.toolCall.created", "agent.toolCall.output", "agent.model.request", "agent.model.usage", "tool.auth_needed", "credential.auth_needed", "agent.updated", "rig.setup.started", "rig.setup.completed", "rig.setup.skipped", "rig.setup.failed", "sandbox.operation.started", "sandbox.operation.completed", "sandbox.operation.failed", "sandbox.command.output.delta", "artifact.created", "goal.set", "goal.updated", "goal.completed", "goal.paused", "goal.resumed", "goal.cleared", "goal.continuation", "system.update.pending", "system.update.delivered", "system.update.superseded", "system.update.cancelled", "system.update.settled", "session.control.paused", "session.control.resumed", "session.control.steer_requested", "workspace.inference.paused", "workspace.inference.resumed", "session.queue.changed", "session.queue.prompt.cancelled", "session.queue.history", "turn.event.rejected_late", "memory.saved", "memory.corrected", "stream.url.rotated", "stream.opened", "stream.closed", "stream.revoked", "recording.started", "recording.available", "recording.failed", "fs.changed", "git.changed", "terminal.pty.started", "terminal.pty.output.delta", "terminal.pty.exited", "session.title_set", "session.mcp.approval_policy.updated", "session.tool_policy.updated", "codex.account.switched", "codex.credential.selected", "codex.fleet.decision", "codex.capacity.waiting", "codex.capacity.resumed", "codex.capacity.superseded", "sandbox.box.created", "sandbox.box.lost", "sandbox.box.terminated", "sandbox.box.snapshot", "sandbox.env.drift", "session.route.reconciled", "workspace.revision.captured", "workspace.revision.degraded", "machine.op.failed", "machine.op.recovered", "machine.link.lost", "machine.link.restored", "machine.runner.restarted"];
-type KnownSessionEventType = (typeof SESSION_EVENT_TYPES)[number];
-/**
- * Event types the SDK knows about today, kept open so a newer OpenGeni server
- * can introduce event types without breaking older SDK consumers.
- */
-type SessionEventType = KnownSessionEventType | (string & {});
-type SessionEvent = {
-    id: string;
-    workspaceId: string;
-    sessionId: string;
-    /** Per-session sequence number: positive, contiguous, strictly increasing. */
-    sequence: number;
-    type: SessionEventType;
-    payload: unknown;
-    occurredAt: string;
-    clientEventId?: string | null | undefined;
-    turnId?: string | null | undefined;
-    turnGeneration?: number | null | undefined;
-    turnAttemptId?: string | null | undefined;
-    turnAssociation?: "current" | "late_rejected" | "duplicate" | null | undefined;
-    duplicateOfEventId?: string | null | undefined;
-    duplicateReason?: string | null | undefined;
-};
-type SessionEventSemanticClass = "control" | "terminal" | "failure" | "checkpoint" | "tool_receipt" | "provider_account";
-type SessionEventLatestClass = SessionEventSemanticClass | "receipt";
-type SessionEventPayloadMode = "none" | "summary" | "full";
-type SessionEventReadMode = "monitoring" | "forensic";
-type SessionEventReadDirection = "after" | "before";
-type SessionEventResultMode = "events" | "compact";
-type SessionEventListCommonOptions = {
-    after?: number;
-    before?: number;
-    limit?: number;
-    compact?: boolean;
-    mode?: SessionEventReadMode;
-    direction?: SessionEventReadDirection;
-    payloadMode?: SessionEventPayloadMode;
-    resultMode?: "events";
-};
-type SessionEventListOptions = SessionEventListCommonOptions & ({
-    latest?: never;
-    includeTypes?: SessionEventType[];
-    excludeTypes?: SessionEventType[];
-    includeClasses?: SessionEventSemanticClass[];
-    excludeClasses?: SessionEventSemanticClass[];
-} | {
-    /** Exclusive lookup for the newest event in exactly this semantic class. */
-    latest: SessionEventLatestClass;
-    includeTypes?: never;
-    excludeTypes?: never;
-    includeClasses?: never;
-    excludeClasses?: never;
-});
-type SessionEventCompactResult = {
-    version: 1;
-    semanticClass: SessionEventSemanticClass;
-    source: {
-        id: string;
-        type: SessionEventType;
-        sequence: number;
-        occurredAt: string;
-        turnId: string | null;
-        turnGeneration: number | null;
-        turnAttemptId: string | null;
-        turnAssociation: SessionEvent["turnAssociation"];
-    };
-    id: string;
-    type: SessionEventType;
-    sequence: number;
-    occurredAt: string;
-    turnId: string | null;
-    turnGeneration: number | null;
-    turnAttemptId: string | null;
-    turnAssociation: SessionEvent["turnAssociation"];
-    coveredSequence: {
-        first: number;
-        last: number;
-    };
-    status: "completed" | "failed" | "cancelled" | "superseded" | "checkpoint" | "receipt" | "unknown";
-    text: string | null;
-    output: unknown;
-    result: unknown;
-    failure: {
-        error: string | null;
-        code: string | null;
-        retryable: boolean | null;
-        recovery: string | null;
-    } | null;
-    checkpoint: unknown;
-    receipt: unknown;
-    truncation: {
-        truncated: boolean;
-        fields: string[];
-        originalBytes: number | null;
-        deliveredBytes: number;
-    };
-};
-type SessionEventCompactResultOptions = {
-    latest: SessionEventLatestClass;
-    resultMode: "compact";
-    mode?: SessionEventReadMode;
-    payloadMode?: SessionEventPayloadMode;
-};
-type SessionEventPage = {
-    events: SessionEvent[];
-    mode: SessionEventReadMode;
-    payloadMode: SessionEventPayloadMode;
-    direction: SessionEventReadDirection;
-    bytes: number;
-    maxBytes: number;
-    truncated: boolean;
-    hasMore: boolean;
-    truncatedBy: "count" | "bytes" | "http_bytes" | null;
-    coveredSequence: {
-        first: number;
-        last: number;
-    } | null;
-    nextAfter: number | null;
-    nextBefore: number | null;
-    forensicExact: boolean;
-};
-type ToolAuthNeededPayload = {
-    serverId: string;
-    toolName?: string | null | undefined;
-    providerDomain: string;
-    provider?: string | undefined;
-    connectionId?: string | null | undefined;
-    reason: "missing_connection" | "expired" | "insufficient_scope" | "refresh_failed" | "unsupported_auth" | "resource_scope_unavailable";
-    scopes?: string[] | undefined;
-    resource?: string | undefined;
-    selectedResources?: Array<{
-        id: string;
-        kind: "repository";
-    }> | undefined;
-    authorizationUrl?: string | undefined;
-    subjectId?: string | null | undefined;
-};
-type AgentTextDeltaPayload = {
-    text: string;
-};
-type AgentMessageCompletedPayload = {
-    text: string;
-};
-type AgentToolCallCreatedPayload = {
-    id: string | null;
-    name: string;
-    arguments: unknown;
-    raw?: unknown | undefined;
-};
-type AgentToolCallOutputPayload = {
-    id: string | null;
-    output: unknown;
-};
-type SessionStatusChangedPayload = {
-    status: SessionStatus;
-};
-type CodexFleetConfidence = "unknown" | "low" | "medium" | "high";
-type CodexFleetCacheState = "unknown" | "healthy" | "collapsed";
-type CodexFleetShadowComparison = "match" | "different_candidate" | "different_outcome" | "not_comparable_truncated";
-type CodexFleetDecisionScore = {
-    candidateKey: string;
-    eligible: boolean;
-    rejectionReason: "allocator_disabled" | "unavailable" | "cooling" | "quota_ceiling" | "overlay_isolation" | null;
-    quotaPressure: number;
-    leasePressure: number;
-    observedBurnPressure: number;
-    inferredBurnPressure: number;
-    runwayPressure: number;
-    uncertaintyPressure: number;
-    cacheAffinityBenefit: number;
-    cacheState: CodexFleetCacheState;
-    overlayPreferenceBenefit: number;
-    total: number;
-    confidence: CodexFleetConfidence;
-};
-type CodexFleetDecisionEventPayload = {
-    schemaVersion: 1;
-    mode: "shadow";
-    actual: {
-        outcome: "selected" | "waiting" | "none";
-        candidateKey: string | null;
-        reason: "lease_reused" | "pin" | "rotation" | "active" | "all_capped" | "none";
-    };
-    comparison: CodexFleetShadowComparison;
-    replay: {
-        schemaVersion: 1;
-        policyVersion: "adaptive-shadow-v1";
-        mode: "shadow";
-        input: {
-            candidates: Array<{
-                key: string;
-            }>;
-        } & Record<string, unknown>;
-        truncatedCandidateCount: number;
-        inputFingerprint: string;
-        decisionFingerprint: string;
-        decision: {
-            outcome: "selected" | "paced" | "none";
-            selectedCandidateKey: string | null;
-            reason: "fenced_in_flight" | "fenced_candidate_missing" | "admission_paced" | "no_eligible_candidate" | "overlay_isolated_empty" | "best_score" | "affinity_best" | "hysteresis_hold";
-            admission: {
-                outcome: "admit" | "pace";
-                reason: "fenced_in_flight" | "pacing_disabled" | "capacity_unknown" | "capacity_available" | "work_conserving_borrow" | "manager_priority" | "standard_starvation_bound" | "capacity_saturated" | "emergency_fuse";
-                borrowedIdleCapacity: boolean;
-            };
-            borrowedOverlayCapacity: boolean;
-            strandedEligibleCount: number;
-            confidence: CodexFleetConfidence;
-            scores: CodexFleetDecisionScore[];
-        };
-    } & Record<string, unknown>;
-};
-type RecordingMode = "manual" | "on-turn" | "on-verify";
-type RecordingCodec = "h264-mp4" | "vp9-webm";
-type RecordingContentType = "video/mp4" | "video/webm";
-type RecordingFailedReason = "ffmpeg-error" | "box-death" | "box-rollover" | "upload-failed" | "max-bytes-exceeded" | "display-unavailable";
-type RecordingStartedPayload = {
-    recordingId: string;
-    turnId: string | null;
-    mode: RecordingMode;
-    codec: RecordingCodec;
-    dimensions: [number, number];
-    framerate: number;
-    startedAt: string;
-    reason?: string | null | undefined;
-};
-type RecordingAvailablePayload = {
-    recordingId: string;
-    turnId: string | null;
-    codec: RecordingCodec;
-    contentType: RecordingContentType;
-    storageKey: string;
-    durationSeconds: number | null;
-    sizeBytes: number;
-    dimensions: [number, number];
-};
-type RecordingFailedPayload = {
-    recordingId: string;
-    turnId: string | null;
-    reason: RecordingFailedReason;
-    detail?: string | null | undefined;
-};
-type SandboxCommandOutputDeltaPayload = {
-    stream: "stdout" | "stderr";
-    chunk: string;
-    commandId?: string | undefined;
-    seq?: number | undefined;
-};
-type FsChangeKind = "created" | "modified" | "deleted" | "renamed";
-type FsChangedPayload = {
-    changes: {
-        path: string;
-        kind: FsChangeKind;
-        isDir: boolean;
-        sizeBytes: number | null;
-        oldPath?: string | undefined;
-    }[];
-    source: "write" | "watch" | "agent";
-    revision: number;
-    leaseEpoch: number;
-};
-type GitChangedPayload = {
-    head: string | null;
-    dirty: boolean;
-    ahead: number;
-    behind: number;
-    changedFileCount: number;
-    reason: "commit" | "checkout" | "stage" | "worktree" | "fetch" | "unknown";
-    revision: number;
-    leaseEpoch: number;
-};
-type TerminalPtyStartedPayload = {
-    ptyId: string;
-    cols: number;
-    rows: number;
-    shell: string;
-    cwd: string;
-};
-type TerminalPtyOutputDeltaPayload = {
-    ptyId: string;
-    stream: "stdout" | "stderr";
-    chunk: string;
-    seq: number;
-};
-type TerminalPtyExitedPayload = {
-    ptyId: string;
-    exitCode: number | null;
-    reason: "exit" | "killed" | "owner_gone" | "timeout" | "lost";
-};
-type FsNodeType = "file" | "dir" | "symlink" | "other";
-type FsTreeNode = {
-    name: string;
-    path: string;
-    type: FsNodeType;
-    sizeBytes: number | null;
-    mtimeMs: number | null;
-    mode: number | null;
-    children?: FsTreeNode[] | undefined;
-    truncated: boolean;
-};
-type FsEncoding = "utf8" | "base64";
-type FsListRequest = {
-    path?: string;
-    depth?: number;
-    maxEntries?: number;
-    includeHidden?: boolean;
-};
-type FsListResponse = {
-    root: FsTreeNode;
-    revision: number;
-    truncated: boolean;
-};
-type FsReadRequest = {
-    path: string;
-    encoding?: FsEncoding;
-    maxBytes?: number;
-};
-type FsReadResponse = {
-    path: string;
-    encoding: FsEncoding;
-    content: string;
-    sizeBytes: number;
-    truncated: boolean;
-    isBinary: boolean;
-    revision: number;
-};
-type FsWriteRequest = {
-    path: string;
-    encoding?: FsEncoding;
-    content: string;
-    overwrite?: boolean;
-    createParents?: boolean;
-};
-type FsWriteResponse = {
-    path: string;
-    sizeBytes: number;
-    revision: number;
-};
-type FsDeleteRequest = {
-    path: string;
-    recursive?: boolean;
-};
-type FsDeleteResponse = {
-    revision: number;
-};
-type FsMoveRequest = {
-    path: string;
-    newPath: string;
-    overwrite?: boolean;
-    createParents?: boolean;
-};
-type FsMoveResponse = {
-    path: string;
-    newPath: string;
-    revision: number;
-};
-type FsMkdirRequest = {
-    path: string;
-    recursive?: boolean;
-};
-type FsMkdirResponse = {
-    path: string;
-    revision: number;
-};
-type GitFileStatusCode = "added" | "modified" | "deleted" | "renamed" | "copied" | "untracked" | "ignored" | "conflicted" | "typechange";
-type GitFileStatus = {
-    path: string;
-    oldPath: string | null;
-    index: GitFileStatusCode | null;
-    worktree: GitFileStatusCode | null;
-    isConflicted: boolean;
-};
-type GitStatusRequest = {
-    path?: string;
-};
-type GitStatusResponse = {
-    isRepo: boolean;
-    head: string | null;
-    detached: boolean;
-    upstream: string | null;
-    ahead: number;
-    behind: number;
-    files: GitFileStatus[];
-    revision: number;
-};
-type GitDiffLineType = "context" | "add" | "del" | "meta";
-type GitDiffLine = {
-    type: GitDiffLineType;
-    oldNo: number | null;
-    newNo: number | null;
-    text: string;
-};
-type GitDiffHunk = {
-    oldStart: number;
-    oldLines: number;
-    newStart: number;
-    newLines: number;
-    header: string;
-    lines: GitDiffLine[];
-};
-type GitFileDiff = {
-    path: string;
-    oldPath: string | null;
-    status: GitFileStatusCode;
-    isBinary: boolean;
-    isImage: boolean;
-    additions: number;
-    deletions: number;
-    hunks: GitDiffHunk[];
-    truncated: boolean;
-};
-type GitDiffRequest = {
-    path?: string;
-    staged?: boolean;
-    includeUntracked?: boolean;
-    fromRef?: string;
-    toRef?: string;
-    pathspec?: string[];
-    contextLines?: number;
-    maxBytesPerFile?: number;
-};
-type GitDiffResponse = {
-    files: GitFileDiff[];
-    revision: number;
-};
-type GitLogRequest = {
-    path?: string;
-    ref?: string;
-    maxCount?: number;
-    skip?: number;
-    pathspec?: string[];
-};
-type GitCommit = {
-    sha: string;
-    shortSha: string;
-    parents: string[];
-    author: {
-        name: string;
-        email: string;
-        timestamp: number;
-    };
-    committer: {
-        name: string;
-        email: string;
-        timestamp: number;
-    };
-    subject: string;
-    body: string;
-    refs: string[];
-};
-type GitLogResponse = {
-    commits: GitCommit[];
-    hasMore: boolean;
-};
-type GitShowRequest = {
-    path?: string;
-    ref: string;
-    filePath?: string;
-    encoding?: FsEncoding;
-    maxBytesPerFile?: number;
-};
-type GitShowResponse = {
-    commit: GitCommit | null;
-    files: GitFileDiff[];
-    blob: {
-        content: string;
-        encoding: FsEncoding;
-        sizeBytes: number;
-        truncated: boolean;
-    } | null;
-    revision: number;
-};
-type WorkspaceCaptureFile = {
-    path: string;
-    status: GitFileStatusCode;
-    hash: string | null;
-    baseHash: string | null;
-    contentRef: string | null;
-    sizeBytes: number;
-    isBinary: boolean;
-    tooLarge: boolean;
-    deleted: boolean;
-};
-type WorkspaceCaptureRepo = {
-    root: string;
-    head: string | null;
-    detached: boolean;
-    upstream: string | null;
-    ahead: number;
-    behind: number;
-    status: GitFileStatus[];
-    diff: GitFileDiff[];
-};
-type WorkspaceCaptureDegradedReason = "repository_discovery_command_failed" | "repository_discovery_timed_out" | "repository_discovery_result_limit_exceeded" | "repository_read_unavailable";
-type WorkspaceCaptureStats = {
-    repoCount: number;
-    fileCount: number;
-    additions: number;
-    deletions: number;
-    totalBytes: number;
-    tooLargeCount: number;
-    binaryCount: number;
-    treeEntryCount: number;
-    treeTruncated: boolean;
-    durationMs: number;
-    fingerprint?: string;
-};
-type WorkspaceCaptureManifest = {
-    version: 1;
-    revision: number;
-    capturedAt: string;
-    turnId: string | null;
-    leaseEpoch: number;
-    treeIndex: FsTreeNode;
-    treeTruncated: boolean;
-    repos: WorkspaceCaptureRepo[];
-    files: WorkspaceCaptureFile[];
-    stats: WorkspaceCaptureStats;
-};
-type WorkspaceRevisionCapturedPayload = {
-    revision: number;
-    turnId: string | null;
-    capturedAt: string;
-    leaseEpoch: number;
-    stats: WorkspaceCaptureStats;
-};
-type WorkspaceRevisionDegradedPayload = {
-    revision: number;
-    turnId: string | null;
-    capturedAt: string;
-    leaseEpoch: number;
-    reason: WorkspaceCaptureDegradedReason;
-};
-type WorkspaceCaptureSignedUrl = {
-    url: string;
-    expiresAt: string;
-};
-type GetWorkspaceCaptureResponse = {
-    available: false;
-    degradedReason?: WorkspaceCaptureDegradedReason | null;
-    revision?: number | null;
-    capturedAt?: string | null;
-    turnId?: string | null;
-    leaseEpoch?: number | null;
-} | {
-    available: true;
-    revision: number;
-    capturedAt: string;
-    turnId: string | null;
-    leaseEpoch: number;
-    sizeBytes: number;
-    stats: WorkspaceCaptureStats;
-    manifest: WorkspaceCaptureManifest | null;
-    manifestUrl: WorkspaceCaptureSignedUrl | null;
-};
-type GetWorkspaceCaptureFileResponse = {
-    path: string;
-    revision: number;
-    status: GitFileStatusCode;
-    hash: string | null;
-    baseHash: string | null;
-    sizeBytes: number;
-    isBinary: boolean;
-    tooLarge: boolean;
-    encoding: FsEncoding | null;
-    content: string | null;
-    contentUrl: WorkspaceCaptureSignedUrl | null;
-};
-type TerminalExecRequest = {
-    command: string;
-    cwd?: string;
-    timeoutMs?: number;
-    emitStream?: boolean;
-};
-type TerminalExecResponse = {
-    stdout: string;
-    stderr: string;
-    exitCode: number;
-    running: false;
-    wallTimeSeconds: number;
-};
-type PtyOpenRequest = {
-    cols?: number;
-    rows?: number;
-    cwd?: string;
-    shell?: string;
-};
-type PtyOpenResponse = {
-    ptyId: string;
-    streamVia: "sse-events";
-    supportsInput: boolean;
-};
-type PtyWriteRequest = {
-    ptyId: string;
-    data: string;
-};
-type PtyResizeRequest = {
-    ptyId: string;
-    cols: number;
-    rows: number;
-};
-type PtyCloseRequest = {
-    ptyId: string;
-};
-type SessionStructuredCapabilities = {
-    FileSystem: {
-        available: boolean;
-        readOnly: boolean;
-        root: string;
-    };
-    Terminal: {
-        events: boolean;
-        exec: boolean;
-        pty: {
-            available: boolean;
-        };
-    };
-    Git: {
-        available: boolean;
-        repos: string[];
-    };
-};
-type ScheduledTaskStatus = "active" | "paused";
-type ScheduledTaskRunMode = "new_session_per_run" | "reusable_session";
-type ScheduledTaskOverlapPolicy = "allow_concurrent" | "skip" | "buffer_one";
-type ScheduledTaskDayOfWeek = "SUNDAY" | "MONDAY" | "TUESDAY" | "WEDNESDAY" | "THURSDAY" | "FRIDAY" | "SATURDAY";
-type ScheduledTaskScheduleSpec = {
-    type: "once";
-    runAt: string;
-    timeZone: string;
-} | {
-    type: "interval";
-    everySeconds: number;
-    startAt?: string | undefined;
-    endAt?: string | undefined;
-} | {
-    type: "calendar";
-    timeZone: string;
-    hour: number;
-    minute: number;
-    daysOfWeek?: ScheduledTaskDayOfWeek[] | undefined;
-};
-type ScheduledTaskAgentConfig = {
-    prompt: string;
-    resources: ResourceRef[];
-    tools: ToolRef[];
-    metadata: Record<string, unknown>;
-    slackBotConnectionId?: string | undefined;
-    model?: string | undefined;
-    reasoningEffort?: ReasoningEffort | undefined;
-    sandboxBackend?: SandboxBackend | undefined;
-    goal?: GoalSpec | undefined;
-    maxNestedAgentDepth?: number | undefined;
-};
-type ScheduledTask = {
-    id: string;
-    accountId: string;
-    workspaceId: string;
-    name: string;
-    status: ScheduledTaskStatus;
-    schedule: ScheduledTaskScheduleSpec;
-    temporalScheduleId: string;
-    runMode: ScheduledTaskRunMode;
-    overlapPolicy: ScheduledTaskOverlapPolicy;
-    agentConfig: ScheduledTaskAgentConfig;
-    reusableSessionId: string | null;
-    variableSetId: string | null;
-    /** @deprecated use variableSetId */
-    environmentId: string | null;
-    rigId: string | null;
-    metadata: Record<string, unknown>;
-    createdAt: string;
-    updatedAt: string;
-};
-type CreateSessionRequest = {
-    requestedSessionId?: string | undefined;
-    initialMessage: string;
-    /** System instructions scoped to the initial turn; never visible timeline text. */
-    turnInstructions?: string | undefined;
-    instructions?: string | undefined;
-    resources?: ResourceRef[] | undefined;
-    /** Inline skills fixed onto this session; omitted children inherit them. */
-    skills?: SessionSkill[] | undefined;
-    tools?: ToolRef[] | undefined;
-    metadata?: Record<string, unknown> | undefined;
-    model?: string | undefined;
-    reasoningEffort?: ReasoningEffort | undefined;
-    sandboxBackend?: SandboxBackend | undefined;
-    targetSandboxId?: string | undefined;
-    workingDir?: string | undefined;
-    variableSetId?: string | undefined;
-    /** @deprecated use variableSetId */
-    environmentId?: string | undefined;
-    rigId?: string | undefined;
-    goal?: GoalSpec | undefined;
-    clientEventId?: string | undefined;
-    idempotencyKey?: string | undefined;
-    expectedNewSessionDraftRevision?: number | undefined;
-    maxNestedAgentDepth?: number | undefined;
-    firstPartyMcpPermissions?: string[] | undefined;
-    firstPartyMcpTools?: FirstPartyMcpToolName[] | undefined;
-    mcpServers?: SessionMcpServerInput[] | undefined;
-    sandbox?: "shared" | "new" | {
-        groupId: string;
-    } | undefined;
-};
-declare const KNOWN_PERMISSIONS: readonly ["account:read", "account:admin", "members:manage", "workspace:create", "billing:read", "billing:manage", "workspace:read", "workspace:admin", "sessions:create", "sessions:read", "sessions:control", "stream:view", "stream:control", "stream:acknowledge", "files:upload", "files:read", "files:write", "terminal:attach", "documents:manage", "documents:search", "scheduled_tasks:manage", "scheduled_tasks:run", "github:manage", "github:use", "api_keys:manage", "connections:read", "connections:write", "environments:manage", "environments:use", "variable-sets:manage", "variable-sets:use", "mcp_servers:attach", "toolspace:call", "goals:manage", "enrollments:read", "enrollments:manage", "rigs:use", "rigs:manage"];
-type KnownPermission = (typeof KNOWN_PERMISSIONS)[number];
-/**
- * Permissions the SDK knows about today, kept open so a newer OpenGeni server
- * can introduce permissions without breaking older SDK consumers.
- */
-type Permission = KnownPermission | (string & {});
-type FirstPartyMcpToolName = "set_session_title" | "goal_set" | "goal_update" | "goal_complete" | "goal_pause" | "memory_search" | "memory_save" | "memory_correct" | "sandboxes_list" | "sandbox_attach" | "sandbox_swap" | "run_on" | "sandbox_provision" | "rig_list" | "rig_get" | "rig_propose_change" | "rig_verify" | "rig_promote" | "sessions_list" | "session_get" | "session_events" | "session_create" | "session_send_message" | "session_pause" | "session_resume" | "session_steer" | "set_other_session_title" | "variable_set_list" | "environment_list" | "variable_set_set_variable" | "environment_set_variable" | "github_connect_link" | "github_token" | "github_repositories_list" | "social_connections_list" | "social_posts_recent" | "social_daily_analysis_context" | "scheduled_tasks_list" | "scheduled_tasks_get" | "scheduled_tasks_create" | "scheduled_tasks_update" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_delete" | "scheduled_task_runs_list" | "slack_bot_list_channels" | "slack_bot_channel_history" | "slack_bot_list_users" | "slack_bot_post_message";
-type ProductAccessMode = "local" | "configured" | "managed";
-type ModelCapabilitySupportV1 = "supported" | "unsupported" | "unknown";
-type ModelCapabilityStateV1 = {
-    upstream: ModelCapabilitySupportV1;
-    runnable: boolean;
-};
-type ModelCapabilitiesV1 = {
-    reasoning: ModelCapabilityStateV1 & {
-        efforts: ReasoningEffort[];
-        defaultEffort: ReasoningEffort | null;
-        required: boolean;
-    };
-    functionCalling: ModelCapabilityStateV1;
-    structuredOutput: ModelCapabilityStateV1;
-    hostedTools: {
-        webSearch: ModelCapabilityStateV1;
-        xSearch: ModelCapabilityStateV1;
-        codeExecution: ModelCapabilityStateV1;
-    };
-    inputModalities: Array<"text" | "image" | "audio">;
-    outputModalities: Array<"text" | "image" | "audio">;
-    transports: {
-        sse: ModelCapabilityStateV1;
-        responsesWebSocket: ModelCapabilityStateV1;
-        realtimeAudio: ModelCapabilityStateV1;
-    };
-    latencyModes: Array<{
-        id: "standard" | "priority" | "fast";
-        upstream: ModelCapabilitySupportV1;
-        runnable: boolean;
-        billingMultiplierBps?: number | undefined;
-    }>;
-};
-type ModelCredentialSourceV1 = {
-    kind: "deployment";
-    mechanism: "api_key" | "azure_ad_bearer";
-} | {
-    kind: "connected_subscription";
-    provider: "codex";
-} | {
-    kind: "workspace_connection";
-    mechanism: "api_key";
-};
-type ModelBillingAttributionV1 = {
-    upstreamPayer: "deployment" | "workspace" | "connected_subscription";
-    metering: "opengeni_credits" | "external";
-};
-type ModelPricingV1 = {
-    inputMicrosPerMillionTokens: number;
-    cachedInputMicrosPerMillionTokens?: number | undefined;
-    outputMicrosPerMillionTokens: number;
-    marginBps?: number | undefined;
-};
-type ModelPricingScheduleV1 = {
-    default: ModelPricingV1;
-    inputTokenTiers?: Array<{
-        minimumInputTokens: number;
-        pricing: ModelPricingV1;
-    }> | undefined;
-};
-/**
- * One model a client may select at send time, plus the provider that serves it.
- * The wire API (`responses` | `chat`) lets a client reason about provider
- * capabilities; the provider id/label drive a picker's grouping. Mirrors the
- * `ClientModel` shape projected into `ClientConfig` by the server.
- */
-type ClientModel = {
-    id: string;
-    label: string;
-    /** Provider id (e.g. `openai`, `azure`, or a registry provider id). */
-    provider: string;
-    providerLabel: string;
-    api: "responses" | "chat";
-    contextWindowTokens?: number | undefined;
-    schemaVersion?: 1 | undefined;
-    aliases?: string[] | undefined;
-    deployment?: {
-        upstreamModelId: string;
-        wireApi: "responses" | "chat";
-    } | undefined;
-    executionLimits?: {
-        contextWindowTokens: number | null;
-        effectiveContextWindowTokens: number | null;
-        autoCompactTokenLimit: number | null;
-        toolOutputTruncationTokens: number | null;
-    } | undefined;
-    credentialSource?: ModelCredentialSourceV1 | undefined;
-    billing?: ModelBillingAttributionV1 | undefined;
-    capabilities?: ModelCapabilitiesV1 | undefined;
-    pricing?: ModelPricingScheduleV1 | undefined;
-    definitionVersion?: string | undefined;
-};
-type ModelAvailabilityV1 = {
-    status: "available" | "unavailable" | "degraded" | "unknown";
-    selectable: boolean;
-    reason: "missing_credential" | "needs_reauth" | "credential_not_ready" | "not_entitled" | "provider_unhealthy" | "policy_blocked" | "unsupported" | null;
-    checkedAt: string | null;
-};
-type ModelCredentialReadinessV1 = {
-    status: "ready" | "not_ready" | "error";
-    reason: "missing_credential" | "needs_reauth" | "prerequisites_missing" | "resolver_error" | "observation_stale" | null;
-    basis: "configuration" | "connection" | "resolver";
-    checkedAt: string | null;
-};
-type WorkspaceModelCatalogModel = ClientModel & {
-    credentialReadiness: ModelCredentialReadinessV1;
-    availability: ModelAvailabilityV1;
-};
-type WorkspaceModelCatalogResponse = {
-    models: WorkspaceModelCatalogModel[];
-};
-/**
- * Connection state of a workspace's Codex (ChatGPT) subscription, returned by
- * `GET /v1/workspaces/:id/codex/status`. `models` are the codex models the
- * workspace can select (projected as ClientModel under their own "no credits"
- * provider group), present only while connected.
- */
-type CodexConnectionStatus = {
-    connected: boolean;
-    plan?: string | null;
-    valid?: boolean;
-    expiresAt?: string | null;
-    lastError?: string | null;
-    models?: ClientModel[];
-    /** The account a session runs on when unpinned (label for the in-session indicator). */
-    activeAccount?: {
-        id: string;
-        label?: string | null;
-        chatgptAccountId?: string | null;
-    } | null;
-    /** How many Codex accounts the workspace has connected. */
-    accountCount?: number;
-};
-/**
- * One normalized Codex usage window (5h or weekly), camelCase end-to-end (the
- * route normalizes server-side; the web layer never re-hand-types snake_case).
- * `percent` is authoritative; used/limit/remaining are a synthesized 0–100 scale
- * (limit = 100) because the provider gives only a percentage. `remaining =
- * 100 - percent` is the P3 rotation key. Identify the window by `limitWindowSeconds`
- * (18000 ⇒ 5h, 604800 ⇒ weekly), never by position.
- */
-type CodexUsageWindow = {
-    used: number;
-    limit: number;
-    remaining: number;
-    percent: number;
-    resetAt: string | null;
-    resetAfterSeconds: number | null;
-    limitWindowSeconds: number;
-};
-/** The normalized usage payload for one account — the P2/P3 contract. */
-type CodexUsagePayload = {
-    status: "ok" | "limit_reached" | "error" | "no-data";
-    planType: string | null;
-    fiveHour: CodexUsageWindow | null;
-    weekly: CodexUsageWindow | null;
-    limitReached: boolean;
-    fetchedAt: string;
-    /** Authoritative count-only summary from /wham/usage; never synthesized rows. */
-    rateLimitResetCredits?: {
-        availableCount: number;
-        credits: null;
-    } | null;
-    /** Present only on an auth/refresh failure path. */
-    reason?: "needs_relogin";
-    additionalLimits?: Array<{
-        limitName: string;
-        meteredFeature: string;
-        fiveHour: CodexUsageWindow | null;
-        weekly: CodexUsageWindow | null;
-    }>;
-    credits?: {
-        hasCredits: boolean;
-        unlimited: boolean;
-        overageLimitReached: boolean;
-        balance: string;
-    };
-};
-/** One connected Codex (ChatGPT) account in a workspace (multi-account P1). Metadata only. */
-type CodexAccount = {
-    id: string;
-    chatgptAccountId?: string | null;
-    label?: string | null;
-    email?: string | null;
-    plan?: string | null;
-    status: "active" | "needs_relogin" | "error";
-    active: boolean;
-    expiresAt?: string | null;
-    lastRefreshAt?: string | null;
-    lastError?: string | null;
-    fiveHour?: CodexUsageWindow | null;
-    weekly?: CodexUsageWindow | null;
-    usageCheckedAt?: string | null;
-    exhaustedUntil?: string | null;
-    /** Controls only NEW automatic allocations. */
-    allocatorEnabled: boolean;
-    /** Independent OCC sequence; credential/token `version` is never exposed. */
-    allocatorVersion: number;
-    allocatorUpdatedAt?: string | null;
-    /** Cached authoritative summary count, never detailed redemption authority. */
-    resetCreditAvailableCount?: number | null;
-    resetCreditsCheckedAt?: string | null;
-};
-type CodexResetCredit = {
-    id: string;
-    resetType: "codexRateLimits" | "unknown";
-    status: "available" | "redeeming" | "redeemed" | "unknown";
-    /** Unix seconds from the provider contract. */
-    grantedAt: number;
-    /** Unix seconds, or null when the provider reports no expiry. */
-    expiresAt: number | null;
-    title: string | null;
-    description: string | null;
-    /** True only for fresh, complete, owning-human provider detail. */
-    actionable: boolean;
-};
-/** Owning-human recovery metadata. It contains no token, browser-session hash, or provider key. */
-type CodexResetRedemptionRecovery = {
-    attemptId: string;
-    creditId: string;
-    status: "provider_started" | "completed";
-    outcome: "reset" | "nothingToReset" | "noCredit" | "alreadyRedeemed" | null;
-    providerStartedAt: string | null;
-    completedAt: string | null;
-    createdAt: string;
-    updatedAt: string;
-};
-type CodexAccountOverview = {
-    accountId: string;
-    usage: {
-        source: "provider" | "cache" | "none";
-        fetchedAt: string | null;
-        stale: boolean;
-        error: string | null;
-        value: CodexUsagePayload | null;
-    };
-    resetCredits: {
-        source: "provider" | "cache" | "none";
-        fetchedAt: string | null;
-        stale: boolean;
-        error: string | null;
-        detailState: "detailed" | "count_only" | "capped" | "unsupported" | "unknown" | "error";
-        detailsComplete: boolean;
-        availableCount: number | null;
-        credits: CodexResetCredit[];
-    };
-    canRedeem: boolean;
-    /** Owning managed-cookie human may replay durable completion without a healthy provider token. */
-    canResumeRedemption: boolean;
-    /** Durable owner-scoped ambiguity/completion discovery; never redemption authority for agents. */
-    redemptions: CodexResetRedemptionRecovery[];
-};
-/** Independently settled live overview keyed by workspace credential id. */
-type CodexOverviewResponse = {
-    accounts: Record<string, CodexAccountOverview>;
-};
-type CodexAllocatorUpdate = {
-    allocatorEnabled: boolean;
-    allocatorVersion: number;
-    allocatorUpdatedAt: string | null;
-    changed: boolean;
-};
-/** Per-workspace Codex rotation/active settings. P1: rotation inert, only activeCredentialId loads. */
-type CodexRotationSettings = {
-    rotationEnabled: boolean;
-    rotationStrategy: "most_remaining" | "round_robin" | "drain_then_next";
-    activeCredentialId: string | null;
-};
-/** GET /codex/accounts — the accounts list + the workspace active pointer + settings. */
-type CodexAccountsResponse = {
-    accounts: CodexAccount[];
-    activeAccountId: string | null;
-    settings: CodexRotationSettings;
-};
-/** Payload of a `codex.account.switched` session event. */
-type CodexAccountSwitchedPayload = {
-    fromAccountId: string | null;
-    toAccountId: string;
-    reason: "manual" | "exhausted" | "rotation";
-    droppedConnectors?: string[];
-};
-/** Device-code start: show `userCode` at `verificationUri`, then poll with `state`. */
-type CodexConnectStart = {
-    userCode: string;
-    verificationUri: string;
-    intervalSeconds: number;
-    state: string;
-};
-/** Poll result: keep polling on `pending`, restart on `expired`, done on `connected`. */
-type CodexConnectPoll = {
-    status: "pending";
-} | {
-    status: "expired";
-} | {
-    status: "connected";
-    plan?: string | null;
-    accountId?: string;
-    isActive?: boolean;
-};
-/** Remaining usage/limits for one account. `usage` is the normalized P2 payload. */
-type CodexUsage = {
-    status: "ok" | "limit_reached" | "error" | "no-data";
-    usage: CodexUsagePayload | null;
-};
-/** Batched live-refresh response, keyed by credential id; each entry independently statused. */
-type CodexUsageMap = Record<string, CodexUsage>;
-/**
- * How a deployment expects clients to authenticate to it, surfaced so a UI can
- * wire up the right header/cookie without prior knowledge of the host setup.
- * Discriminated on `mode`; `none` is the back-compat default.
- */
-type ClientAuthConfig = {
-    mode: "none";
-} | {
-    mode: "deploymentKey";
-    headerName: "x-opengeni-access-key";
-} | {
-    mode: "configuredToken";
-    headerName: "authorization";
-    scheme: "bearer";
-} | {
-    mode: "managedSession";
-    session: "cookie";
-};
-declare const OPENGENI_API_CONTRACT_REVISION: "2026-07-turn-instructions-v1";
-declare const OPENGENI_API_CONTRACT_HEADER: "x-opengeni-api-contract";
-/** Bounded request/response identifier shared by browser, ingress, and API diagnostics. */
-declare const OPENGENI_CORRELATION_HEADER: "x-opengeni-correlation-id";
-/**
- * Public, unauthenticated-by-default client bootstrap config returned by
- * `GET /v1/config/client`: which models + reasoning efforts are exposed, the
- * MCP servers and file-upload limits a composer should offer, and how the
- * deployment expects the client to authenticate. `allowedModels` is kept for
- * back-compat; `models` carries the richer provider-grouped list for a picker.
- */
-type ClientConfig = {
-    deploymentRevision: string;
-    apiContractRevision: typeof OPENGENI_API_CONTRACT_REVISION;
-    serverVersion?: string | undefined;
-    defaultModel: string;
-    allowedModels: string[];
-    models: ClientModel[];
-    defaultReasoningEffort: ReasoningEffort;
-    allowedReasoningEfforts: ReasoningEffort[];
-    mcpServers: {
-        id: string;
-        name: string;
-    }[];
-    fileUploads: {
-        enabled: boolean;
-        maxSizeBytes: number;
-    };
-    productAccessMode: ProductAccessMode;
-    auth: ClientAuthConfig;
-    structuredServices: {
-        fileSystem: boolean;
-        git: boolean;
-        terminalEvents: boolean;
-    };
-};
-type AccountRole = "owner" | "admin" | "member";
-type AccountGrant = {
-    accountId: string;
-    subjectId: string;
-    subjectLabel?: string | undefined;
-    role?: AccountRole | undefined;
-    permissions: Permission[];
-    metadata?: Record<string, unknown> | undefined;
-};
-type AccessGrant = {
-    workspaceId: string;
-    accountId: string;
-    subjectId: string;
-    subjectLabel?: string | undefined;
-    permissions: Permission[];
-    metadata?: Record<string, unknown> | undefined;
-    serviceInitiator?: ServiceTurnInitiator | undefined;
-    serviceInitiatorContext?: ServiceTurnInitiatorContext | undefined;
-};
-type AccessContext = {
-    mode: ProductAccessMode;
-    subjectId: string;
-    subjectLabel?: string | undefined;
-    accountGrants: AccountGrant[];
-    workspaceGrants: AccessGrant[];
-    defaultAccountId: string | null;
-    defaultWorkspaceId: string | null;
-};
-type Workspace = {
-    id: string;
-    accountId: string;
-    name: string;
-    slug: string | null;
-    externalSource: string | null;
-    externalId: string | null;
-    agentInstructions: string | null;
-    settings: Record<string, unknown>;
-    inferenceControl: {
-        state: "active" | "paused";
-        revision: number;
-        reason: string | null;
-        changedBy: string | null;
-        changedAt: string | null;
-    };
-    defaultRigId?: string | null;
-    createdAt: string;
-    updatedAt: string;
-};
-type WorkspaceSettings = {
-    memoryEnabled?: boolean | undefined;
-    transcription?: WorkspaceTranscriptionPolicy | undefined;
-    maxNestedAgentDepth?: number | null | undefined;
-    [key: string]: unknown;
-};
-type UpdateWorkspaceSettingsRequest = {
-    memoryEnabled?: boolean | undefined;
-    transcription?: WorkspaceTranscriptionPolicy | undefined;
-    maxNestedAgentDepth?: number | null | undefined;
-    [key: string]: unknown;
-};
-type SetWorkspaceDefaultRigRequest = {
-    rigId: string | null;
-};
-type CreateWorkspaceRequest = {
-    accountId?: string | undefined;
-    name: string;
-    slug?: string | undefined;
-    externalSource?: string | undefined;
-    externalId?: string | undefined;
-    agentInstructions?: string | null | undefined;
-};
-type UpdateWorkspaceRequest = {
-    name?: string | undefined;
-    slug?: string | null | undefined;
-    agentInstructions?: string | null | undefined;
-};
-type ApiKey = {
-    id: string;
-    accountId: string;
-    workspaceId: string | null;
-    name: string;
-    prefix: string;
-    permissions: Permission[];
-    expiresAt: string | null;
-    revokedAt: string | null;
-    lastUsedAt: string | null;
-    createdAt: string;
-    updatedAt: string;
-};
-type CreateApiKeyRequest = {
-    name: string;
-    permissions: Permission[];
-    expiresAt?: string | undefined;
-};
-type CreateApiKeyResponse = {
-    apiKey: ApiKey;
-    /** The full secret token — shown once at creation, never returned again. */
-    token: string;
-};
-type ListApiKeysResponse = {
-    apiKeys: ApiKey[];
-};
-type WorkspaceMember = {
-    subjectId: string;
-    subjectLabel: string | null;
-    role: string;
-    permissions: Permission[];
-    createdAt: string;
-};
-type ListWorkspaceMembersResponse = {
-    members: WorkspaceMember[];
-};
-type AddWorkspaceMemberRequest = {
-    email: string;
-    role?: string | undefined;
-    permissions: Permission[];
-};
-type UpdateWorkspaceMemberRequest = {
-    role?: string | undefined;
-    permissions: Permission[];
-};
-type SessionGoalStatus = "active" | "paused" | "completed";
-type SessionGoalCreatedBy = "api" | "agent" | "scheduled_task";
-type SessionGoalContinuationState = "inactive" | "scheduled" | "running" | "blocked" | "invariant_broken";
-type SessionGoalContinuationReason = "goal_inactive" | "wake_pending" | "continuation_pending" | "human_work_pending" | "goal_turn_running" | "human_turn_running" | "workstream_paused" | "approval_required" | "provider_backpressure" | "session_cancelled" | "system_work_pending" | "missing_obligation";
-type SessionGoalContinuation = {
-    state: SessionGoalContinuationState;
-    reason: SessionGoalContinuationReason;
-    wakeRevision: number;
-    observedRevision: number;
-    nextAttemptAt: string | null;
-    lastError: string | null;
-};
-type SessionGoal = {
-    id: string;
-    accountId: string;
-    workspaceId: string;
-    sessionId: string;
-    status: SessionGoalStatus;
-    text: string;
-    successCriteria: string | null;
-    evidence: string | null;
-    rationale: string | null;
-    pausedReason: string | null;
-    createdBy: SessionGoalCreatedBy;
-    version: number;
-    autoContinuations: number;
-    noProgressStreak: number;
-    maxAutoContinuations: number | null;
-    metadata: Record<string, unknown>;
-    /** Optional for source compatibility; the API always supplies this projection. */
-    continuation?: SessionGoalContinuation | undefined;
-    createdAt: string;
-    updatedAt: string;
-};
-type UpdateSessionGoalRequest = {
-    status: "paused" | "active";
-    rationale?: string | undefined;
-};
-type UpdateSessionRequest = {
-    title: string;
-};
-/** Outcome of a manual /compact trigger. */
-type CompactSessionContextResult = {
-    /** pending waits for the current safe boundary; completed ran while idle. */
-    status: "pending" | "completed" | "noop";
-    message: string;
-};
-type EffectiveControlBlocker = {
-    kind: "session" | "workspace";
-    sessionId?: string | undefined;
-    displayName: string;
-    actor: string | null;
-    reason: string | null;
-    changedAt: string | null;
-    revision: number;
-};
-type EffectiveControlResumeOption = {
-    scope: "selected" | "session" | "workspace";
-    targetId?: string | undefined;
-    selectedStateAfter: "active" | "paused";
-    remainingPrimaryBlocker?: EffectiveControlBlocker | undefined;
-    impactCopy: string;
-};
-type EffectiveSessionControl = {
-    state: "active" | "paused";
-    controlVersion: number;
-    controlEtag: string;
-    directState: "active" | "paused";
-    primaryBlocker: EffectiveControlBlocker | null;
-    additionalBlockerCount: number;
-    blockers: EffectiveControlBlocker[];
-    resumeOptions: EffectiveControlResumeOption[];
-    override: {
-        rootSessionId: string;
-        revision: number;
-    } | null;
-    settlement: {
-        state: "stopping";
-        attemptCount: number;
-        interruptionPendingCount: number;
-        quiescencePendingCount: number;
-    } | null;
-};
-type SessionCommandReceipt = {
-    id: string;
-    action: string;
-    operationKey: string;
-    targetSessionId: string | null;
-    targetTurnId: string | null;
-    appliedControlRevision: number | null;
-    appliedQueueVersion: number | null;
-    appliedTurnVersion: number | null;
-    appliedDraftRevision: number | null;
-    createdAt: string;
-};
-type ComposerDraft = {
-    revision: number;
-    text: string;
-    resources: ResourceRef[];
-    model: string;
-    reasoningEffort: ReasoningEffort;
-    sourceTurnId: string | null;
-    sourceTurnVersion: number | null;
-    updatedAt: string | null;
-};
-type NewSessionDraftOptions = {
-    sandboxBackend?: SandboxBackend | undefined;
-    targetSandboxId?: string | undefined;
-    workingDir?: string | undefined;
-    variableSetId?: string | undefined;
-    rigId?: string | undefined;
-    goal?: GoalSpec | undefined;
-    firstPartyMcpPermissions?: Permission[] | undefined;
-    firstPartyMcpTools?: FirstPartyMcpToolName[] | undefined;
-};
-type NewSessionDraft = {
-    revision: number;
-    text: string;
-    resources: ResourceRef[];
-    tools: ToolRef[];
-    /** False inherits the workspace-default MCP policy; true preserves an explicit array. */
-    toolsProvided: boolean;
-    model: string;
-    reasoningEffort: ReasoningEffort;
-    options: NewSessionDraftOptions;
-    updatedAt: string | null;
-};
-type SessionQueueSnapshot = {
-    version: number;
-    effectiveControl: EffectiveSessionControl;
-    /** The latest interrupted attempt has not yet durably proved physical quiescence. */
-    stoppingPreviousAttempt: boolean;
-    items: SessionTurn[];
-    /** Canonical pending machine inputs. Events only invalidate this snapshot. */
-    pendingInputs: SessionPendingInputPreview[];
-    /** Exact next bounded input batch that will join an already-waiting prompt. */
-    pendingInputAttachment: {
-        turnId: string;
-        inputIds: string[];
-    } | null;
-};
-type SessionPendingInputPreview = Pick<SessionSystemUpdate, "id" | "sessionId" | "kind" | "classification" | "sourceId" | "summary" | "createdAt">;
-type SystemUpdateClassification = "success" | "failure" | "action_required" | "info";
-type SessionSystemUpdateKind = "scheduled_occurrence" | "goal_continuation" | "agent_message" | "agent_steer_instruction" | "child_terminal_result";
-type SessionSystemUpdateState = "pending" | "delivered" | "cancelled" | "superseded" | "failed";
-type SessionSystemUpdate = {
-    id: string;
-    sessionId: string;
-    kind: SessionSystemUpdateKind;
-    classification: SystemUpdateClassification;
-    sourceId: string;
-    dedupeKey: string;
-    summary: string;
-    payload: Record<string, unknown>;
-    lineage: Record<string, unknown>;
-    state: SessionSystemUpdateState;
-    deliveredTurnId: string | null;
-    deliveredHistoryItemId: string | null;
-    deliveredAt: string | null;
-    createdAt: string;
-};
-type SessionControlResponse = {
-    receipt: SessionCommandReceipt;
-    effectiveControl: EffectiveSessionControl;
-    interruptionCount: number;
-    wakeCount: number;
-};
-type WorkspaceInferenceControlResponse = {
-    receipt: SessionCommandReceipt;
-    state: "active" | "paused";
-    revision: number;
-    interruptionCount: number;
-    wakeCount: number;
-};
-type WorkspaceControlEvent = {
-    id: string;
-    workspaceId: string;
-    /** Same monotonic value as revision; named sequence for SSE resume cursors. */
-    sequence: number;
-    revision: number;
-    type: "workspace.control.changed";
-    scope: "workspace" | "session";
-    rootSessionId: string | null;
-    action: "pause" | "resume";
-    automatic: boolean;
-    reason: string | null;
-    actor: string;
-    occurredAt: string;
-    truncation?: {
-        truncated: true;
-        surface: "durable_control" | "database_guard" | "http_projection" | "nats_legacy_guard" | "sse_legacy_guard";
-        deliveredBytes: number;
-        fields: Array<{
-            field: "reason" | "actor";
-            originalBytes: number;
-            deliveredBytes: number;
-            omittedBytes: number;
-        }>;
-        fullEvidence: {
-            available: false;
-            reason: "not_retained";
-        };
-    } | null;
-};
-type SessionQueueMutationResponse = {
-    receipt: SessionCommandReceipt;
-    snapshot: SessionQueueSnapshot;
-    draft?: ComposerDraft;
-};
-type MoveSessionQueueItemRequest = {
-    clientEventId: string;
-    expectedQueueVersion: number;
-    beforeTurnId: string | null;
-};
-type EditSessionQueueItemRequest = {
-    clientEventId: string;
-    expectedTurnVersion: number;
-    expectedDraftRevision: number;
-    replaceDraft: boolean;
-};
-type SteerSessionQueueItemRequest = {
-    clientEventId: string;
-    expectedTurnVersion: number;
-    controlEtag?: string;
-};
-type DeleteSessionQueueItemRequest = {
-    clientEventId: string;
-    expectedTurnVersion: number;
-    reason?: string;
-};
-type SaveComposerDraftRequest = Omit<ComposerDraft, "revision" | "sourceTurnId" | "sourceTurnVersion" | "updatedAt"> & {
-    expectedRevision: number;
-};
-type SaveNewSessionDraftRequest = Omit<NewSessionDraft, "revision" | "updatedAt"> & {
-    expectedRevision: number;
-};
-/** Input shape for agent config on create/update (server applies defaults). */
-type ScheduledTaskAgentConfigInput = {
-    prompt: string;
-    resources?: ResourceRef[] | undefined;
-    tools?: ToolRef[] | undefined;
-    metadata?: Record<string, unknown> | undefined;
-    slackBotConnectionId?: string | undefined;
-    model?: string | undefined;
-    reasoningEffort?: ReasoningEffort | undefined;
-    sandboxBackend?: SandboxBackend | undefined;
-    goal?: GoalSpec | undefined;
-    maxNestedAgentDepth?: number | undefined;
-};
-type CreateScheduledTaskRequest = {
-    name: string;
-    schedule: ScheduledTaskScheduleSpec;
-    runMode?: ScheduledTaskRunMode | undefined;
-    overlapPolicy?: ScheduledTaskOverlapPolicy | undefined;
-    agentConfig: ScheduledTaskAgentConfigInput;
-    status?: ScheduledTaskStatus | undefined;
-    variableSetId?: string | null | undefined;
-    /** @deprecated use variableSetId */
-    environmentId?: string | null | undefined;
-    rigId?: string | null | undefined;
-    metadata?: Record<string, unknown> | undefined;
-};
-type UpdateScheduledTaskRequest = {
-    name?: string | undefined;
-    schedule?: ScheduledTaskScheduleSpec | undefined;
-    runMode?: ScheduledTaskRunMode | undefined;
-    overlapPolicy?: ScheduledTaskOverlapPolicy | undefined;
-    agentConfig?: ScheduledTaskAgentConfigInput | undefined;
-    status?: ScheduledTaskStatus | undefined;
-    variableSetId?: string | null | undefined;
-    /** @deprecated use variableSetId */
-    environmentId?: string | null | undefined;
-    rigId?: string | null | undefined;
-    metadata?: Record<string, unknown> | undefined;
-};
-type ScheduledTaskRunStatus = "queued" | "dispatched" | "failed";
-type ScheduledTaskTriggerType = "scheduled" | "manual";
-type ScheduledTaskRun = {
-    id: string;
-    accountId: string;
-    workspaceId: string;
-    taskId: string;
-    status: ScheduledTaskRunStatus;
-    triggerType: ScheduledTaskTriggerType;
-    scheduledAt: string | null;
-    firedAt: string;
-    sessionId: string | null;
-    triggerEventId: string | null;
-    error: string | null;
-    createdAt: string;
-    updatedAt: string;
-};
-/**
- * Variable values are write-only by design: the API never returns a value, so
- * reads expose name + version metadata only. Values are decrypted exclusively
- * inside the worker at sandbox materialization time.
- */
-type VariableSetVariableMetadata = {
-    name: string;
-    version: number;
-    createdAt: string;
-    updatedAt: string;
-};
-type VariableSet = {
-    id: string;
-    accountId: string;
-    workspaceId: string;
-    name: string;
-    description: string | null;
-    variables: VariableSetVariableMetadata[];
-    createdAt: string;
-    updatedAt: string;
-};
-/** @deprecated use VariableSetVariableMetadata */
-type WorkspaceEnvironmentVariableMetadata = VariableSetVariableMetadata;
-/** @deprecated use VariableSet */
-type WorkspaceEnvironment = VariableSet;
-type CreateVariableSetRequest = {
-    name: string;
-    description?: string | undefined;
-    /** Initial variables. Values are write-only: they never come back on reads. */
-    variables?: {
-        name: string;
-        value: string;
-    }[] | undefined;
-};
-/** @deprecated use CreateVariableSetRequest */
-type CreateWorkspaceEnvironmentRequest = CreateVariableSetRequest;
-type UpdateVariableSetRequest = {
-    name?: string | undefined;
-    description?: string | null | undefined;
-};
-/** @deprecated use UpdateVariableSetRequest */
-type UpdateWorkspaceEnvironmentRequest = UpdateVariableSetRequest;
-type SetVariableSetVariableRequest = {
-    value: string;
-};
-/** @deprecated use SetVariableSetVariableRequest */
-type SetWorkspaceEnvironmentVariableRequest = SetVariableSetVariableRequest;
-type RigCheck = {
-    name: string;
-    command: string;
-};
-type RigVersion = {
-    id: string;
-    rigId: string;
-    version: number;
-    image: string | null;
-    setupScript: string | null;
-    checks: RigCheck[];
-    credentialHooks: string[];
-    defaultVariableSetIds: string[];
-    changelog: string | null;
-    createdBy: string | null;
-    active: boolean;
-    createdAt: string;
-};
-type RigVerificationHealth = {
-    checkHealth: "passing" | "failing" | "unknown";
-    lastVerifiedAt: string | null;
-};
-type Rig = {
-    id: string;
-    accountId: string;
-    workspaceId: string;
-    name: string;
-    description: string | null;
-    createdBy: string | null;
-    activeVersion: RigVersion | null;
-    activeVersionHealth?: RigVerificationHealth | null;
-    versionCount: number;
-    createdAt: string;
-    updatedAt: string;
-};
-type RigChangeKind = "setup_append" | "definition_edit";
-type RigChangeStatus = "proposed" | "verifying" | "merged" | "rejected" | "failed";
-type RigCheckResult = {
-    name: string;
-    command: string;
-    exitCode: number | null;
-    output?: string | undefined;
-};
-type RigChangeVerification = {
-    startedAt?: string | undefined;
-    finishedAt?: string | undefined;
-    log?: string | undefined;
-    checkResults?: RigCheckResult[] | undefined;
-    [key: string]: unknown;
-};
-type RigChange = {
-    id: string;
-    rigId: string;
-    baseVersionId: string | null;
-    kind: RigChangeKind;
-    payload: Record<string, unknown>;
-    status: RigChangeStatus;
-    proposedBy: string | null;
-    verification: RigChangeVerification | null;
-    resultVersionId: string | null;
-    createdAt: string;
-    updatedAt: string;
-};
-type CreateRigRequest = {
-    name: string;
-    description?: string | undefined;
-    image?: string | undefined;
-    setupScript?: string | undefined;
-    checks?: RigCheck[] | undefined;
-    credentialHooks?: string[] | undefined;
-    defaultVariableSetIds?: string[] | undefined;
-};
-type UpdateRigRequest = {
-    name?: string | undefined;
-    description?: string | null | undefined;
-};
-type RigSetupAppendPayload = {
-    command: string;
-    note?: string | undefined;
-};
-type RigDefinitionEditPayload = {
-    image?: string | null | undefined;
-    setupScript?: string | null | undefined;
-    checks?: RigCheck[] | undefined;
-    credentialHooks?: string[] | undefined;
-    defaultVariableSetIds?: string[] | undefined;
-    changelog?: string | null | undefined;
-};
-type ProposeRigChangeRequest = {
-    kind: "setup_append";
-    payload: RigSetupAppendPayload;
-} | {
-    kind: "definition_edit";
-    payload: RigDefinitionEditPayload;
-};
-type FileStatus = "pending_upload" | "ready" | "failed" | "expired" | "deleted";
-type FileAsset = {
-    id: string;
-    workspaceId: string;
-    status: FileStatus;
-    filename: string;
-    safeFilename: string;
-    contentType: string;
-    sizeBytes: number;
-    sha256: string | null;
-    bucket: string;
-    objectKey: string;
-    createdAt: string;
-    updatedAt: string;
-};
-/** Mirrors the closed, provider-neutral retained-output contract. */
-declare const RETAINED_OUTPUT_DEFAULT_PAGE_BYTES: number;
-declare const RETAINED_OUTPUT_MAX_PAGE_BYTES: number;
-type RetainedOutputKind = "tool_result" | "assistant_completion" | "internal_update" | "event_media" | "file";
-type RetainedOutputUnavailableReason = "not_retained" | "pending" | "failed" | "expired" | "deleted" | "missing_storage" | "storage_write_failed" | "unsupported";
-type RetainedArtifactReference = {
-    available: true;
-    artifactId: string;
-    kind: RetainedOutputKind;
-    contentType: string;
-    originalBytes: number;
-    sha256: string;
-    retainedAt: string;
-    retention: {
-        policy: "workspace_file";
-        expiresAt: null;
-    };
-    retrieval: {
-        method: "GET";
-        path: string;
-        acceptRanges: "bytes";
-        maxRangeBytes: number;
-    };
-};
-type RetainedArtifactUnavailable = {
-    available: false;
-    artifactId: string;
-    reason: RetainedOutputUnavailableReason;
-};
-type RetainedArtifactMetadata = RetainedArtifactReference | RetainedArtifactUnavailable;
-type RetainedArtifactContentOptions = {
-    /** One RFC-style bytes range, for example `bytes=1048576-2097151`. */
-    range?: string | undefined;
-    signal?: AbortSignal | undefined;
-};
-type RetainedArtifactContent = {
-    bytes: Uint8Array;
-    status: 200 | 206;
-    contentType: string;
-    contentLength: number;
-    contentRange: string | null;
-    acceptRanges: "bytes";
-};
-type CreateFileUploadRequest = {
-    filename: string;
-    contentType: string;
-    sizeBytes: number;
-    sha256?: string | undefined;
-};
-type CreateFileUploadResponse = {
-    fileId: string;
-    uploadId: string;
-    /** Pre-signed PUT URL for the file bytes (direct to object storage). */
-    putUrl: string;
-    /** Headers that MUST be sent with the PUT for the signature to validate. */
-    requiredHeaders: Record<string, string>;
-    expiresAt: string;
-    maxSizeBytes: number;
-};
-type CompleteFileUploadResponse = {
-    file: FileAsset;
-};
-type FileDownloadUrlResponse = {
-    url: string;
-    expiresAt: string;
-};
-/** Bytes accepted by the `uploadFile` helper. */
-type FileUploadData = Blob | ArrayBuffer | Uint8Array | string;
-type UploadFileInput = {
-    filename: string;
-    contentType: string;
-    data: FileUploadData;
-    sha256?: string | undefined;
-};
-type DocumentStatus = "queued" | "indexing" | "ready" | "failed";
-type KnowledgeSourceKind = "manual_upload" | "meeting_transcript" | "repository" | "email" | "chat" | "document" | "web" | "other";
-type DocumentSearchMode = "hybrid" | "vector" | "keyword";
-type DocumentVisibility = "workspace" | "private";
-type DocumentCurationStatus = "none" | "pending" | "suggested" | "auto_filed" | "failed";
-type DocumentCuration = {
-    suggestedBaseId: string | null;
-    suggestedBaseName: string | null;
-    confidence: number;
-    reason: string | null;
-    originalTitle: string | null;
-    model: string | null;
-};
-type DocumentBase = {
-    id: string;
-    workspaceId: string;
-    name: string;
-    description: string | null;
-    createdAt: string;
-    updatedAt: string;
-};
-type Document = {
-    id: string;
-    workspaceId: string;
-    baseId: string;
-    fileId: string;
-    status: DocumentStatus;
-    title: string;
-    parser: string;
-    chunkCount: number;
-    error: string | null;
-    sourceKind: KnowledgeSourceKind;
-    sourceUri: string | null;
-    sourceExternalId: string | null;
-    sourceTitle: string | null;
-    sourceAuthor: string | null;
-    sourceCreatedAt: string | null;
-    sourceUpdatedAt: string | null;
-    sourceVersion: string | null;
-    aclTags: string[];
-    visibility: DocumentVisibility;
-    createdBy: string | null;
-    agentAccess: boolean;
-    summary: string | null;
-    topics: string[];
-    curationStatus: DocumentCurationStatus;
-    curation: DocumentCuration | null;
-    createdAt: string;
-    updatedAt: string;
-};
-type DocumentSearchResult = {
-    chunkId: string;
-    workspaceId: string;
-    documentId: string;
-    baseId: string;
-    fileId: string;
-    title: string;
-    text: string;
-    score: number;
-    matchType: DocumentSearchMode;
-    vectorScore: number | null;
-    keywordScore: number | null;
-    chunkIndex: number;
-    metadata: Record<string, unknown>;
-    sourceKind: KnowledgeSourceKind;
-    sourceUri: string | null;
-    sourceExternalId: string | null;
-    sourceTitle: string | null;
-    sourceAuthor: string | null;
-    sourceCreatedAt: string | null;
-    sourceUpdatedAt: string | null;
-    sourceVersion: string | null;
-    aclTags: string[];
-};
-type CreateDocumentBaseRequest = {
-    name: string;
-    description?: string | undefined;
-};
-type AddDocumentRequest = {
-    fileId: string;
-    title?: string | undefined;
-    sourceKind?: KnowledgeSourceKind | undefined;
-    sourceUri?: string | undefined;
-    sourceExternalId?: string | undefined;
-    sourceTitle?: string | undefined;
-    sourceAuthor?: string | undefined;
-    sourceCreatedAt?: string | undefined;
-    sourceUpdatedAt?: string | undefined;
-    sourceVersion?: string | undefined;
-    aclTags?: string[] | undefined;
-    visibility?: DocumentVisibility | undefined;
-    agentAccess?: boolean | undefined;
-};
-type CreateKnowledgeDropRequest = {
-    text?: string | undefined;
-    fileId?: string | undefined;
-    filename?: string | undefined;
-    title?: string | undefined;
-    visibility?: DocumentVisibility | undefined;
-    agentAccess?: boolean | undefined;
-};
-type MoveDocumentRequest = {
-    targetBaseId?: string | undefined;
-};
-type DocumentSearchRequest = {
-    query: string;
-    baseIds?: string[] | undefined;
-    mode?: DocumentSearchMode | undefined;
-    sourceKinds?: KnowledgeSourceKind[] | undefined;
-    aclTags?: string[] | undefined;
-    limit?: number | undefined;
-};
-type DocumentSearchResponse = {
-    results: DocumentSearchResult[];
-};
-type KnowledgeMemoryStatus = "proposed" | "approved" | "rejected" | "active" | "superseded" | "archived";
-type KnowledgeMemoryKind = "semantic" | "episodic" | "procedural" | "decision" | "preference";
-type KnowledgeSourceRef = {
-    kind: "document_chunk" | "document" | "session_event" | "memory" | "external";
-    id: string;
-    uri?: string | undefined;
-    title?: string | undefined;
-    metadata?: Record<string, unknown> | undefined;
-};
-type KnowledgeMemory = {
-    id: string;
-    workspaceId: string;
-    status: KnowledgeMemoryStatus;
-    kind: KnowledgeMemoryKind;
-    scope: string;
-    text: string;
-    sourceRefs: KnowledgeSourceRef[];
-    confidence: number;
-    metadata: Record<string, unknown>;
-    createdBySessionId: string | null;
-    reviewedBy: string | null;
-    reviewedAt: string | null;
-    pinned: boolean;
-    usageCount: number;
-    lastUsedAt: string | null;
-    supersedesId: string | null;
-    supersededById: string | null;
-    validFrom: string;
-    validUntil: string | null;
-    createdAt: string;
-    updatedAt: string;
-};
-type CreateKnowledgeMemoryRequest = {
-    status?: KnowledgeMemoryStatus | undefined;
-    kind?: KnowledgeMemoryKind | undefined;
-    scope?: string | undefined;
-    text: string;
-    sourceRefs?: KnowledgeSourceRef[] | undefined;
-    confidence?: number | undefined;
-    metadata?: Record<string, unknown> | undefined;
-    createdBySessionId?: string | undefined;
-    pinned?: boolean | undefined;
-    replacesId?: string | undefined;
-};
-type UpdateKnowledgeMemoryRequest = {
-    status?: KnowledgeMemoryStatus | undefined;
-    kind?: KnowledgeMemoryKind | undefined;
-    scope?: string | undefined;
-    text?: string | undefined;
-    sourceRefs?: KnowledgeSourceRef[] | undefined;
-    confidence?: number | undefined;
-    metadata?: Record<string, unknown> | undefined;
-    reviewedBy?: string | undefined;
-    pinned?: boolean | undefined;
-};
-type KnowledgeMemorySearchRequest = {
-    query?: string | undefined;
-    status?: KnowledgeMemoryStatus | undefined;
-    kind?: KnowledgeMemoryKind | undefined;
-    scope?: string | undefined;
-    limit?: number | undefined;
-};
-type WorkspaceMemorySearchMode = "hybrid" | "vector" | "keyword";
-type WorkspaceMemorySearchRequest = {
-    query: string;
-    kind?: KnowledgeMemoryKind | undefined;
-    limit?: number | undefined;
-    mode?: WorkspaceMemorySearchMode | undefined;
-};
-type WorkspaceMemorySearchResult = {
-    memory: KnowledgeMemory;
-    score: number;
-    matchType: WorkspaceMemorySearchMode;
-    vectorScore: number | null;
-    keywordScore: number | null;
-};
-type WorkspaceMemorySearchResponse = {
-    results: WorkspaceMemorySearchResult[];
-};
-type CapabilityPackConnectorAuthModel = "oauth2_authorization_code_pkce" | "oauth2_authorization_code" | "api_key" | "credential_ref";
-type CapabilityPackConnector = {
-    id: string;
-    name: string;
-    category: string;
-    authModel: CapabilityPackConnectorAuthModel;
-    providers: string[];
-    scopes: string[];
-    required: boolean;
-    metadata: Record<string, unknown>;
-};
-type CapabilityPackKnowledge = {
-    type: "document_base";
-    id: string;
-    name: string;
-    description: string | null;
-    required: boolean;
-};
-type CapabilityPackScheduledTaskTemplate = {
-    id: string;
-    name: string;
-    description: string;
-    defaultSchedule: ScheduledTaskScheduleSpec;
-    defaultRunMode: ScheduledTaskRunMode;
-    defaultOverlapPolicy: ScheduledTaskOverlapPolicy;
-    prompt?: string | undefined;
-};
-type CapabilityPackSkillFile = {
-    path: string;
-    content: string;
-};
-type CapabilityPackSkill = {
-    name: string;
-    description?: string | undefined;
-    files: CapabilityPackSkillFile[];
-};
-type SessionSkill = CapabilityPackSkill;
-type CapabilityPackVariableSetSpec = {
-    description: string;
-    requiredVariables: string[];
-    required: boolean;
-};
-type CapabilityPack = {
-    id: string;
-    name: string;
-    description: string;
-    role: string;
-    category: string;
-    version: string;
-    sandboxImage?: string | undefined;
-    skills: CapabilityPackSkill[];
-    tools: ToolRef[];
-    connectors: CapabilityPackConnector[];
-    knowledge: CapabilityPackKnowledge[];
-    scheduledTaskTemplates: CapabilityPackScheduledTaskTemplate[];
-    variableSet?: CapabilityPackVariableSetSpec | undefined;
-    metadata: Record<string, unknown>;
-};
-/** Input shape for registering a pack manifest (server applies defaults). */
-type RegisterCapabilityPackRequest = {
-    id: string;
-    name: string;
-    description: string;
-    role: string;
-    category: string;
-    version: string;
-    sandboxImage?: string | undefined;
-    skills?: {
-        name: string;
-        description?: string | undefined;
-        files: CapabilityPackSkillFile[];
-    }[] | undefined;
-    tools?: ToolRef[] | undefined;
-    connectors?: {
-        id: string;
-        name: string;
-        category: string;
-        authModel: CapabilityPackConnectorAuthModel;
-        providers?: string[] | undefined;
-        scopes?: string[] | undefined;
-        required?: boolean | undefined;
-        metadata?: Record<string, unknown> | undefined;
-    }[] | undefined;
-    knowledge?: {
-        type: "document_base";
-        id: string;
-        name: string;
-        description?: string | null | undefined;
-        required?: boolean | undefined;
-    }[] | undefined;
-    scheduledTaskTemplates?: {
-        id: string;
-        name: string;
-        description: string;
-        defaultSchedule: ScheduledTaskScheduleSpec;
-        defaultRunMode?: ScheduledTaskRunMode | undefined;
-        defaultOverlapPolicy?: ScheduledTaskOverlapPolicy | undefined;
-        prompt?: string | undefined;
-    }[] | undefined;
-    variableSet?: {
-        description: string;
-        requiredVariables?: string[] | undefined;
-        required?: boolean | undefined;
-    } | undefined;
-    metadata?: Record<string, unknown> | undefined;
-};
-type WorkspaceRegisteredPack = {
-    accountId: string;
-    workspaceId: string;
-    pack: CapabilityPack;
-    createdAt: string;
-    updatedAt: string;
-};
-type PackInstallationStatus = "active" | "disabled";
-type PackInstallation = {
-    id: string;
-    accountId: string;
-    workspaceId: string;
-    packId: string;
-    status: PackInstallationStatus;
-    metadata: Record<string, unknown>;
-    enabledAt: string;
-    updatedAt: string;
-};
-type EnablePackRequest = {
-    variableSetId?: string | undefined;
-    /** @deprecated use variableSetId */
-    environmentId?: string | undefined;
-    metadata?: Record<string, unknown> | undefined;
-};
-type ListPacksResponse = {
-    packs: CapabilityPack[];
-    installations: PackInstallation[];
-};
-type GetPackResponse = {
-    pack: CapabilityPack;
-    installation: PackInstallation | null;
-};
-type CapabilityKind = "pack" | "mcp" | "api" | "skill" | "plugin";
-type CapabilitySource = "built_in" | "library" | "configured" | "public_registry" | "registry" | "manual";
-type CapabilityInstallationStatus = "active" | "disabled";
-type CapabilityCatalogAuthKind = "oauth2" | "api_key" | "none" | "unknown";
-type CapabilityCatalogTier = "verified" | "community";
-type CapabilityRuntime = {
-    available: boolean;
-    mcpServerId?: string | undefined;
-    transport?: string | undefined;
-    notes: string | null;
-    /** Secret-safe server-derived registry exposure state. */
-    catalogTrust?: {
-        state: "trusted" | "legacy_active" | "unverified";
-        reason: "trusted_source" | "verified_probe" | "active_installation_compatibility" | "missing_verification";
-    } | undefined;
-};
-type CapabilityCatalogItem = {
-    id: string;
-    accountId?: string | undefined;
-    workspaceId?: string | undefined;
-    kind: CapabilityKind;
-    source: CapabilitySource;
-    name: string;
-    description: string | null;
-    category: string;
-    tags: string[];
-    homepageUrl: string | null;
-    endpointUrl: string | null;
-    installUrl: string | null;
-    authModel: string | null;
-    providerDomain: string | null;
-    surfaceType: string | null;
-    transport: string | null;
-    mcpUrl: string | null;
-    authKind: CapabilityCatalogAuthKind | null;
-    credentialFacts: Record<string, unknown>[];
-    tier: CapabilityCatalogTier | null;
-    provenance: string | null;
-    logoAssetPath: string | null;
-    importBatchId: string | null;
-    stale: boolean;
-    staleAt: string | null;
-    tools: ToolRef[];
-    runtime: CapabilityRuntime;
-    enabled: boolean;
-    enabledReason: string | null;
-    /** The connection backing this enabled installation, or null when none is involved. */
-    connectionRef: {
-        connectionId?: string | undefined;
-        providerDomain: string;
-        kind: string;
-        subjectScope?: "subject" | "workspace" | undefined;
-    } | null;
-    metadata: Record<string, unknown>;
-    createdAt?: string | undefined;
-    updatedAt?: string | undefined;
-};
-type CapabilityInstallation = {
-    id: string;
-    accountId: string;
-    workspaceId: string;
-    capabilityId: string;
-    kind: CapabilityKind;
-    status: CapabilityInstallationStatus;
-    config: Record<string, unknown>;
-    metadata: Record<string, unknown>;
-    enabledAt: string;
-    updatedAt: string;
-};
-type CapabilityCatalogResponse = {
-    items: CapabilityCatalogItem[];
-    installations: CapabilityInstallation[];
-};
-type CreateCapabilityCatalogItemRequest = {
-    id?: string | undefined;
-    kind: Exclude<CapabilityKind, "pack">;
-    source?: CapabilitySource | undefined;
-    name: string;
-    description?: string | undefined;
-    category?: string | undefined;
-    tags?: string[] | undefined;
-    homepageUrl?: string | undefined;
-    endpointUrl?: string | undefined;
-    installUrl?: string | undefined;
-    authModel?: string | undefined;
-    metadata?: Record<string, unknown> | undefined;
-};
-type EnableCapabilityRequest = {
-    config?: Record<string, unknown> | undefined;
-    metadata?: Record<string, unknown> | undefined;
-    connectionRef?: McpServerConnectionRef | undefined;
-    /**
-     * Credential headers for remote MCP capabilities. Write-only: encrypted at
-     * rest, injected only into the runtime MCP client, never returned by the
-     * API (responses expose header names only).
-     */
-    headers?: Record<string, string> | undefined;
-    /**
-     * Initial variableSet attachment for kind=pack capabilities — mirrors the
-     * dedicated POST /packs/:id/enable body. Required to enable an
-     * variableSet.required pack through this unified path; ignored otherwise.
-     */
-    variableSetId?: string | undefined;
-    /** @deprecated use variableSetId */
-    environmentId?: string | undefined;
-};
-type DiscoverMcpCapabilitiesResponse = {
-    items: CapabilityCatalogItem[];
-    source: "official_mcp_registry";
-    sourceUrl: string;
-};
-type GitHubRepository = {
-    id: number;
-    installationId: number;
-    fullName: string;
-    name: string;
-    private: boolean;
-    htmlUrl: string;
-    cloneUrl: string;
-    defaultBranch: string;
-    accountLogin: string;
-    accountType: string | null;
-};
-type GitHubRepositoryScope = "all" | "selected";
-type GitHubBindingStatus = "disabled" | "unbound" | "bound";
-type GitHubAppSetupMode = "platform" | "operator";
-type GitHubInstallationLifecycle = "active" | "suspended" | "deleted" | "unverified";
-type GitHubInstallationBinding = {
-    installationId: number;
-    githubAccountId: number | null;
-    accountLogin: string | null;
-    accountType: string | null;
-    lifecycle: GitHubInstallationLifecycle;
-    repositoryScope: GitHubRepositoryScope;
-    repositoryCount: number;
-    /** OpenGeni-owned entry point for changing the installation's repository allowlist. */
-    configureUrl: string | null;
-    createdAt: string;
-    updatedAt: string;
-};
-type GitHubAppInfo = {
-    configured: boolean;
-    /** Truthful workspace binding state; server App credentials alone are not a binding. */
-    status: GitHubBindingStatus;
-    /** Platform deployments expose installation only; operator deployments may create an App. */
-    setupMode: GitHubAppSetupMode;
-    appId: string | null;
-    clientId: string | null;
-    appSlug: string | null;
-    /** Fresh OAuth-first existing-installation discovery and install entry point. */
-    installUrl: string | null;
-    /** Compatibility alias for installUrl. */
-    linkUrl: string | null;
-    /** Installation bindings owned independently by this workspace. */
-    installations: GitHubInstallationBinding[];
-    /** Setting names still missing when `configured` is false. */
-    missing: string[];
-};
-type GitHubRepositoriesResponse = {
-    repositories: GitHubRepository[];
-};
-type CreateGitHubAppManifestRequest = {
-    appName?: string | undefined;
-    organization?: string | undefined;
-    public?: boolean | undefined;
-    includeCiPermissions?: boolean | undefined;
-};
-type CreateGitHubAppManifestResponse = {
-    /** GitHub URL to POST the manifest to (personal or organization flow). */
-    actionUrl: string;
-    state: string;
-    manifest: Record<string, unknown>;
-};
-type BillingMode = "disabled" | "stripe";
-type EntitlementsMode = "none" | "static" | "managed";
-type BillingBalance = {
-    accountId: string;
-    balanceMicros: number;
-    currency: "usd";
-    updatedAt: string;
-};
-declare const KNOWN_USAGE_EVENT_TYPES: readonly ["agent_run.created", "agent_run.completed", "model.tokens", "model.cost", "file.uploaded", "file.deleted", "document.indexed", "scheduled_task.fired", "api_key.request", "sandbox.warm_seconds", "sandbox.warm_cost"];
-type KnownUsageEventType = (typeof KNOWN_USAGE_EVENT_TYPES)[number];
-type UsageEventType = KnownUsageEventType | (string & {});
-type UsageEvent = {
-    id: string;
-    workspaceId: string;
-    accountId: string;
-    subjectId: string | null;
-    eventType: UsageEventType;
-    quantity: number;
-    unit: string;
-    sourceResourceType: string | null;
-    sourceResourceId: string | null;
-    idempotencyKey: string;
-    occurredAt: string;
-    recordedAt: string;
-    exportedToBillingAt: string | null;
-    billingProviderEventId: string | null;
-};
-type EntitlementValue = boolean | string | number | string[];
-type Entitlements = Record<string, EntitlementValue>;
-type BillingSummary = {
-    mode: BillingMode;
-    balance: BillingBalance;
-};
-type BillingUsageResponse = {
-    balance: BillingBalance;
-    usage: UsageEvent[];
-};
-type BillingEntitlementsResponse = {
-    accountId: string;
-    mode: EntitlementsMode;
-    entitlements: Entitlements;
-};
-type CreateCheckoutRequest = {
-    accountId?: string | undefined;
-    /** USD amount with cent precision (server enforces min/max). */
-    amountUsd: number;
-    successUrl?: string | undefined;
-    cancelUrl?: string | undefined;
-};
-type CreateCheckoutResponse = {
-    checkoutSessionId: string;
-    url: string;
-};
-type UserMessageEventInput = {
-    type: "user.message";
-    clientEventId?: string | undefined;
-    payload: {
-        text: string;
-        turnInstructions?: string | undefined;
-        resources?: ResourceRef[] | undefined;
-        model?: string | undefined;
-        reasoningEffort?: ReasoningEffort | undefined;
-        mcpCredentialUpdates?: SessionMcpCredentialUpdateInput[] | undefined;
-    };
-};
-type UserApprovalDecisionEventInput = {
-    type: "user.approvalDecision";
-    clientEventId?: string | undefined;
-    payload: {
-        approvalId: string;
-        decision: "approve" | "reject";
-        message?: string | undefined;
-    };
-};
-type UserHumanInputResponseEventInput = {
-    type: "user.humanInputResponse";
-    clientEventId?: string | undefined;
-    payload: {
-        requestId: string;
-        response: SubmitHumanInputResponseRequest;
-    };
-};
-/** Control/user events a client may POST to a session's event log. */
-type ClientSessionEventInput = UserMessageEventInput | UserApprovalDecisionEventInput | UserHumanInputResponseEventInput;
-/** A point-in-time machine metrics sample. `gpuUtilPct`/`gpuMemBytes` are null
- *  when no GPU was present (not-reported, never a real zero); the bytes/load are
- *  numbers; `sampledAt` is an ISO-8601 instant. */
-type MetricSample = {
-    cpuPct: number;
-    load1: number;
-    load5: number;
-    load15: number;
-    memUsedBytes: number;
-    memTotalBytes: number;
-    diskUsedBytes: number;
-    diskTotalBytes: number;
-    gpuUtilPct: number | null;
-    gpuMemBytes: number | null;
-    runQueue: number;
-    sampledAt: string;
-};
-/** The derived dashboard state of a machine (M3 liveness + consent/display
- *  reasons + the in-flight device-flow). */
-type MachineState = "online" | "reconnecting" | "offline" | "consent_required" | "display_unavailable" | "enrolling";
-type MachineKind = "modal" | "selfhosted";
-/** A machine as the Machines dashboard renders it (an enrolled selfhosted machine
- *  or the session's synthetic Modal group box, `isSessionGroup: true`). */
-type MachineView = {
-    sandboxId: string;
-    enrollmentId: string | null;
-    name: string;
-    kind: MachineKind;
-    state: MachineState;
-    active: boolean;
-    isSessionGroup: boolean;
-    workspaceGeneration: number | null;
-    archiveGeneration: number | null;
-    archiveComplete: boolean;
-    os: string;
-    arch: string;
-    hasDisplay: boolean;
-    /** Non-null only when a display exists but capture is blocked (macOS Screen
-     *  Recording / TCC not granted) — the UI can surface "display: capture not
-     *  granted". null == capture permitted OR headless. */
-    desktopUnavailableReason?: string | null | undefined;
-    allowScreenControl: boolean;
-    sharedSessionCount: number;
-    lastSeenAt: string | null;
-    metrics: MetricSample | null;
-};
-/** GET /v1/workspaces/:ws/machines — the dashboard list + the active-sandbox
- *  pointer (null activeSandboxId == the session's own group box is active). */
-type MachinesResponse = {
-    activeSandboxId: string | null;
-    activeEpoch: number;
-    machines: MachineView[];
-};
-/** GET /v1/workspaces/:ws/machines/:enrollmentId/metrics/series — the downsampled
- *  (~1/min) history the dashboard time-range reads. */
-type MachineMetricsSeriesResponse = {
-    samples: MetricSample[];
-};
-/** POST /v1/workspaces/:ws/sessions/:sessionId/active-sandbox — swap a session's
- *  active sandbox. `target` is a `MachineView.sandboxId`, or "session"/"default"
- *  to swap back to the session's own group box. */
-type SwapActiveSandboxRequest = {
-    target: string;
-};
-/** The swap outcome (mirrors the server `FleetSwapResult`). `swapped` is true on a
- *  successful repoint OR a no-op (already there); `reason` carries the failure
- *  detail (unowned/offline target, or a lost epoch fence) when false. */
-type SwapActiveSandboxResponse = {
-    swapped: boolean;
-    activeSandboxId: string | null;
-    activeEpoch: number;
-    reason?: string;
-    code?: "stale_pointer" | "offline_enrollment" | "unsupported_backend_context" | "transient_establishment" | "concurrent_swap" | "recovery_in_progress" | "recovery_degraded" | "recovery_unrecoverable";
-};
-/** Mirror of `@opengeni/contracts` EnrollmentOs. */
-type EnrollmentOs = "linux" | "macos" | "windows";
-/** POST /v1/enrollments/device/lookup body. */
-type DeviceEnrollmentLookupRequest = {
-    userCode: string;
-};
-/** The presentational machine details the consent screen renders. */
-type DeviceEnrollmentLookupMachine = {
-    machineName: string | null;
-    os: EnrollmentOs;
-    arch: string;
-    canOfferDisplay: boolean;
-    requestsScreenControl: boolean;
-};
-/** POST /v1/enrollments/device/lookup response (no secrets, no device_code). */
-type DeviceEnrollmentLookupResponse = {
-    workspaceId: string;
-    userCode: string;
-    machine: DeviceEnrollmentLookupMachine;
-    expiresAt: string;
-};
-/** POST /v1/workspaces/:ws/enrollments/device/approve body. */
-type DeviceEnrollmentApproveRequest = {
-    userCode: string;
-    allowScreenControl?: boolean;
-};
-/** POST /v1/workspaces/:ws/enrollments/device/approve response. */
-type DeviceEnrollmentApproveResponse = {
-    approved: boolean;
-    enrollmentId: string;
-    sandboxId: string;
-    allowScreenControl: boolean;
-};
-/** POST /v1/workspaces/:ws/enrollments/device/deny body. */
-type DeviceEnrollmentDenyRequest = {
-    userCode: string;
-};
-/** POST /v1/workspaces/:ws/enrollments/device/deny response. */
-type DeviceEnrollmentDenyResponse = {
-    denied: boolean;
-};
-/** POST /v1/workspaces/:ws/enrollments/token body. */
-type MintEnrollTokenRequest = {
-    allowScreenControl?: boolean;
-};
-/** POST /v1/workspaces/:ws/enrollments/token response. The `token` is SECRET. */
-type MintEnrollTokenResponse = {
-    token: string;
-    expiresAt: string;
-    expiresInSeconds: number;
-};
-/** The credential payload the headless exchange returns (a subset of the agent's
- *  EnrollmentCredentials — IDENTICAL to the device-flow poll authorized branch). */
-type EnrollmentCredentials = {
-    agentId: string;
-    workspaceId: string;
-    bearer: string;
-    subjectPrefix: string;
-    natsUrls: string[];
-    relayUrl: string;
-    relayToken: string;
-    natsAccountCreds: string;
-    updatePublicKey: string;
-    consentedWholeMachine: boolean;
-    consentedScreenControl: boolean;
-};
-/** POST /v1/enrollments/token/exchange body (the headless / fleet enroll path). */
-type EnrollTokenExchangeRequest = {
-    token: string;
-    publicKey: string;
-    os?: EnrollmentOs;
-    arch?: string;
-    machineName?: string;
-    exposure?: "whole-machine";
-    canOfferDisplay?: boolean;
-    requestsScreenControl?: boolean;
-};
-/** POST /v1/enrollments/token/exchange response (wraps the credential shape). */
-type EnrollTokenExchangeResponse = {
-    credentials: EnrollmentCredentials;
-};
-
-/**
- * Transport boundary for the streaming core. The client implements it with
- * `fetch`; unit tests script it directly.
- */
-type SessionEventStreamTransport = {
-    /** Open the SSE stream, replaying durable events after `after` first. */
-    openStream: (after: number, signal: AbortSignal | undefined) => Promise<ReadableStream<Uint8Array>>;
-    /** Replay durable events by sequence (`GET .../events?after=&limit=`). */
-    listEvents: (after: number, limit: number) => Promise<SessionEvent[]>;
-};
-type StreamConnectionState = "connecting" | "live" | "reconnecting";
-type StreamSessionEventsOptions = {
-    /** Resume after this sequence number (exclusive). Defaults to 0 (full replay). */
-    after?: number;
-    /** Aborting ends the stream gracefully (the generator returns). */
-    signal?: AbortSignal;
-    /** Reconnect on transient drops. Defaults to true. */
-    reconnect?: boolean;
-    /** Initial reconnect backoff. Defaults to 500ms. */
-    reconnectDelayMs?: number;
-    /** Backoff ceiling. Defaults to 10s. */
-    maxReconnectDelayMs?: number;
-    /**
-     * Give up after this many consecutive failed reconnect attempts (i.e. N
-     * reconnects = N+1 total open-stream calls). Defaults to unlimited.
-     */
-    maxReconnectAttempts?: number;
-    /** Await authoritative client reconciliation before exposing `live`. */
-    beforeLive?: (() => void | Promise<void>) | undefined;
-    onStateChange?: (state: StreamConnectionState) => void;
-};
-/**
- * Stream a session's events with exactly-once, in-order delivery.
- *
- * Guarantees, anchored on the per-session contiguous `sequence`:
- * - **No duplicates**: events at or below the cursor are dropped, so server
- *   replay overlap and reconnect overlap never re-yield.
- * - **No gaps**: each reconnect resumes from the last seen sequence, and a
- *   gap observed inside one connection is backfilled from the durable replay
- *   endpoint before the newer event is yielded (events are durable before
- *   they are published live, so the backfill always finds them).
- * - **Ordered**: sequences are yielded strictly ascending.
- *
- * The generator ends when `signal` aborts, when the server closes and
- * `reconnect` is false, or with an error for non-retryable failures.
- */
-declare function streamSessionEvents(transport: SessionEventStreamTransport, options?: StreamSessionEventsOptions): AsyncGenerator<SessionEvent, void, void>;
-
-type WorkspaceControlStreamTransport = {
-    /** The server replays every durable event after the cursor before going live. */
-    openStream: (after: number, signal: AbortSignal | undefined) => Promise<ReadableStream<Uint8Array>>;
-};
-/**
- * Reconnecting workspace invalidation stream. Control revisions are monotonic
- * but can begin above one after the one-way migration, so unlike conversation
- * events this stream intentionally permits sparse sequence values.
- */
-declare function streamWorkspaceControlEvents(transport: WorkspaceControlStreamTransport, options?: StreamSessionEventsOptions): AsyncGenerator<WorkspaceControlEvent, void, void>;
-
-type WorkspaceInstructionPolicyKind = "charter" | "policy";
-type WorkspaceInstructionPolicyScope = "global" | "role";
-type WorkspaceInstructionPolicyProvenanceSource = "human" | "onboarding" | "knowledge_proposal" | "legacy_import";
-type WorkspaceInstructionPolicyDraftProvenanceSource = Exclude<WorkspaceInstructionPolicyProvenanceSource, "legacy_import">;
-type WorkspaceInstructionPolicyActivationType = "activate" | "rollback";
-declare function normalizeWorkspaceInstructionPolicyRoleKey(value: string): string;
-type WorkspaceInstructionPolicyTarget = {
-    kind: WorkspaceInstructionPolicyKind;
-    scope: WorkspaceInstructionPolicyScope;
-    roleKey: string | null;
-};
-type WorkspaceInstructionPolicyRevisionIdentity = {
-    id: string;
-    revision: number;
-    contentHash: string;
-};
-type WorkspaceInstructionPolicyRevision = WorkspaceInstructionPolicyRevisionIdentity & WorkspaceInstructionPolicyTarget & {
-    accountId: string;
-    workspaceId: string;
-    content: string;
-    provenance: {
-        source: WorkspaceInstructionPolicyProvenanceSource;
-        sourceId: string | null;
-    };
-    supersedesRevisionId: string | null;
-    createdBySubjectId: string;
-    createdAt: string;
-};
-type WorkspaceInstructionPolicyHead = WorkspaceInstructionPolicyTarget & {
-    workspaceId: string;
-    revisionId: string;
-    revision: number;
-    contentHash: string;
-    activationVersion: number;
-    activatedAt: string;
-};
-type WorkspaceInstructionPolicyActivationEvent = WorkspaceInstructionPolicyTarget & {
-    id: string;
-    accountId: string;
-    workspaceId: string;
-    type: WorkspaceInstructionPolicyActivationType;
-    activationVersion: number;
-    oldRevision: WorkspaceInstructionPolicyRevisionIdentity | null;
-    newRevision: WorkspaceInstructionPolicyRevisionIdentity;
-    actorSubjectId: string;
-    reason: string;
-    createdAt: string;
-};
-type CreateWorkspaceInstructionPolicyDraftRequest = WorkspaceInstructionPolicyTarget & {
-    content: string;
-    provenanceSource?: WorkspaceInstructionPolicyDraftProvenanceSource;
-    provenanceSourceId?: string | null;
-    supersedesRevisionId?: string | null;
-};
-type ImportLegacyWorkspaceInstructionPolicyDraftRequest = {
-    supersedesRevisionId?: string | null;
-};
-type WorkspaceInstructionPolicyListOptions = {
-    kind?: WorkspaceInstructionPolicyKind;
-    scope?: WorkspaceInstructionPolicyScope;
-    roleKey?: string;
-    afterRevision?: number;
-    limit?: number;
-};
-type WorkspaceInstructionPolicyListResponse = {
-    revisions: WorkspaceInstructionPolicyRevision[];
-    activeHeads: WorkspaceInstructionPolicyHead[];
-    activationEvents: WorkspaceInstructionPolicyActivationEvent[];
-    nextAfterRevision: number | null;
-};
-type WorkspaceInstructionPolicyDiffRequest = {
-    fromRevisionId: string;
-    toRevisionId: string;
-};
-type WorkspaceInstructionPolicyDiffResponse = {
-    from: WorkspaceInstructionPolicyRevision;
-    to: WorkspaceInstructionPolicyRevision;
-    format: "unified";
-    diff: string;
-};
-type ActivateWorkspaceInstructionPolicyRequest = {
-    expectedCurrentRevisionId: string | null;
-    reason: string;
-};
-type RollbackWorkspaceInstructionPolicyRequest = {
-    targetRevisionId: string;
-    expectedCurrentRevisionId: string;
-    reason: string;
-};
-type WorkspaceInstructionPolicyActivationResponse = {
-    head: WorkspaceInstructionPolicyHead;
-    event: WorkspaceInstructionPolicyActivationEvent;
-};
-type WorkspaceInstructionPolicyConflictResponse = {
-    code: "WORKSPACE_INSTRUCTION_POLICY_CONFLICT";
-    message: string;
-    currentHead: WorkspaceInstructionPolicyHead | null;
-};
-
-type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
-type WorkspaceControlEventPage = {
-    events: WorkspaceControlEvent[];
-    bytes: number;
-    truncated: boolean;
-    nextAfter: number | null;
-};
-type OpenGeniClientOptions = {
-    /** Base URL of the OpenGeni API, e.g. `https://api.example.com`. */
-    baseUrl: string;
-    /** OpenGeni API key, sent as `Authorization: Bearer <apiKey>`. */
-    apiKey?: string;
-    /** Extra headers (static or computed per request) merged into every call. */
-    headers?: Record<string, string> | (() => Record<string, string>);
-    /** Custom fetch implementation. Defaults to the global `fetch`. */
-    fetch?: FetchLike;
-};
-/** Per-request cancellation for identity-scoped, side-effect-free reads. */
-type OpenGeniRequestOptions = {
-    signal?: AbortSignal | undefined;
-};
-type SendMessageInput = {
-    text: string;
-    /** System instructions scoped to this exact turn; never visible timeline text. */
-    turnInstructions?: string;
-    resources?: ResourceRef[];
-    tools?: ToolRef[];
-    model?: string;
-    reasoningEffort?: ReasoningEffort;
-    clientEventId?: string;
-    controlEtag?: string;
-    expectedDraftRevision?: number;
-    mcpCredentialUpdates?: SessionMcpCredentialUpdateInput[];
-};
-type SteerMessageResult = {
-    /** The accepted `user.message` event. */
-    accepted: SessionEvent;
-    /** The exact turn created for this message in the same server transaction. */
-    turn: SessionTurn;
-};
-/**
- * Typed client for the OpenGeni public API. Framework-agnostic: only needs
- * WHATWG `fetch` + streams, so it runs in Node 18+, Bun, Deno, browsers, and
- * edge runtimes.
- */
-declare class OpenGeniClient {
-    private readonly baseUrl;
-    private readonly options;
-    private readonly fetchImpl;
-    constructor(options: OpenGeniClientOptions);
-    createSession(workspaceId: string, request: CreateSessionRequest): Promise<CreateSessionResponse>;
-    getNewSessionDraft(workspaceId: string): Promise<NewSessionDraft>;
-    saveNewSessionDraft(workspaceId: string, request: SaveNewSessionDraftRequest): Promise<NewSessionDraft>;
-    getSession(workspaceId: string, sessionId: string): Promise<Session>;
-    updateSession(workspaceId: string, sessionId: string, request: UpdateSessionRequest): Promise<Session>;
-    /** Replace the durable tool policy or explicitly adopt workspace defaults. */
-    updateSessionToolPolicy(workspaceId: string, sessionId: string, request: UpdateSessionToolPolicyRequest): Promise<Session>;
-    /**
-     * Replace one attached MCP server's approval policy. The change is captured
-     * by the next claimed attempt; already-claimed work keeps its immutable
-     * policy snapshot.
-     */
-    updateSessionMcpApprovalPolicy(workspaceId: string, sessionId: string, serverId: string, request: UpdateSessionMcpApprovalPolicyRequest): Promise<UpdateSessionMcpApprovalPolicyResponse>;
-    listSessions(workspaceId: string, options?: {
-        limit?: number;
-        parentSessionId?: string | null;
-        search?: string;
-    }): Promise<Session[]>;
-    /** Pin-aware ordinary-session page with a stable keyset cursor. */
-    listSessionPage(workspaceId: string, options?: {
-        limit?: number;
-        parentSessionId?: string | null;
-        cursor?: string;
-        search?: string;
-        /** Return only the complete personal pinned projection. */
-        pinsOnly?: boolean;
-    }): Promise<SessionListResponse>;
-    /** Set this authenticated member's personal workspace pin for a session. */
-    updateSessionPin(workspaceId: string, sessionId: string, request: UpdateSessionPinRequest): Promise<Session>;
-    getSessionLineage(workspaceId: string, sessionId: string): Promise<SessionLineageResponse>;
-    listTurns(workspaceId: string, sessionId: string, options?: {
-        limit?: number;
-    }): Promise<SessionTurn[]>;
-    /**
-     * List the workspace's machines (the Machines dashboard). Each enrolled
-     * selfhosted machine carries its derived state + latest metrics +
-     * sharedSessionCount. Pass `sessionId` for an in-session view, which adds the
-     * session's synthetic Modal group box + the active-sandbox pointer.
-     */
-    listMachines(workspaceId: string, options?: {
-        sessionId?: string;
-        signal?: AbortSignal;
-    }): Promise<MachinesResponse>;
-    /**
-     * Read the downsampled (~1/min) metrics series for ONE machine over a time
-     * window (default 1h). The samples are oldest-first (a left-to-right chart).
-     */
-    machineMetricsSeries(workspaceId: string, enrollmentId: string, options?: {
-        window?: "15m" | "1h" | "6h" | "24h";
-    }): Promise<MetricSample[]>;
-    /**
-     * Resolve a pending device-enrollment flow by its user_code for the click-Grant
-     * approve page (EnrollmentConsent). NO workspace in the path — the server
-     * resolves the workspace from the (globally-unique-among-pending) code, then
-     * authorizes the caller against it (enrollments:read). Rejects (404) when the
-     * code is unknown/expired OR the caller lacks the grant — the two are
-     * indistinguishable by design (no cross-workspace disclosure). Does not consume
-     * the request.
-     */
-    lookupDeviceEnrollment(userCode: string): Promise<DeviceEnrollmentLookupResponse>;
-    /**
-     * Approve a pending device-enrollment flow (the LOUD consent step). `allowScreenControl`
-     * is the authoritative screen-control consent (whole-machine is mandatory/implicit).
-     * Lands an enrollment + a selfhosted sandbox and unblocks the agent's poll.
-     */
-    approveDeviceEnrollment(workspaceId: string, request: {
-        userCode: string;
-        allowScreenControl?: boolean;
-    }): Promise<DeviceEnrollmentApproveResponse>;
-    /** Deny a pending device-enrollment flow (the explicit "no" at the approve page). */
-    denyDeviceEnrollment(workspaceId: string, request: {
-        userCode: string;
-    }): Promise<DeviceEnrollmentDenyResponse>;
-    /**
-     * Mint a short-TTL headless enroll token (the `oget_` token) for the fleet /
-     * non-interactive enroll path. The returned `token` is SECRET — surface it once
-     * with a copy-now warning; it cannot be re-read. `allowScreenControl` bakes the
-     * screen-control consent into the token.
-     */
-    mintEnrollToken(workspaceId: string, request?: {
-        allowScreenControl?: boolean;
-    }): Promise<MintEnrollTokenResponse>;
-    /**
-     * Swap a session's active sandbox (the user-authenticated equivalent of the
-     * M7 `sandbox_swap` MCP tool). `target` is a `MachineView.sandboxId` from
-     * `listMachines`, or "session"/"default" to swap back to the session's own
-     * group box. Validation (ownership/liveness/epoch fence) is server-side; the
-     * result echoes the resulting pointer (`swapped: false` + `reason` on a
-     * rejected target or a lost epoch fence).
-     */
-    swapActiveSandbox(workspaceId: string, sessionId: string, request: SwapActiveSandboxRequest): Promise<SwapActiveSandboxResponse>;
-    listScheduledTasks(workspaceId: string, options?: {
-        limit?: number;
-    }): Promise<ScheduledTask[]>;
-    getScheduledTask(workspaceId: string, taskId: string): Promise<ScheduledTask>;
-    /**
-     * Return the events from one bounded page. With no cursor, this uses the safe
-     * semantic monitoring tail; pass explicit forensic options and a cursor for
-     * retained audit replay. Use `listEventPage` when projection, coverage, or
-     * resume-cursor facts are required.
-     */
-    listEvents(workspaceId: string, sessionId: string, options?: SessionEventListOptions): Promise<SessionEvent[]>;
-    /** Bounded durable/monitoring page plus exact projection and cursor facts. */
-    listEventPage(workspaceId: string, sessionId: string, options: SessionEventCompactResultOptions): Promise<SessionEventCompactResult | null>;
-    listEventPage(workspaceId: string, sessionId: string, options?: SessionEventListOptions): Promise<SessionEventPage>;
-    /**
-     * Fetch the authoritative newest-sequence semantic result directly. This is
-     * the callback-loss recovery path: it reads one compact durable result and
-     * never creates a model turn. `latest: "receipt"` aliases `tool_receipt`;
-     * turn generation remains scoped retry metadata.
-     */
-    getLatestEventResult(workspaceId: string, sessionId: string, options?: Omit<SessionEventCompactResultOptions, "resultMode">): Promise<SessionEventCompactResult | null>;
-    /** POST a user/control event to the session. Returns the accepted event. */
-    sendEvent(workspaceId: string, sessionId: string, event: ClientSessionEventInput): Promise<SessionEvent>;
-    sendMessage(workspaceId: string, sessionId: string, message: string | SendMessageInput): Promise<SessionEvent>;
-    pauseSession(workspaceId: string, sessionId: string, options?: {
-        reason?: string;
-        clientEventId?: string;
-        expectedControlEtag?: string;
-    }): Promise<SessionControlResponse>;
-    sendApprovalDecision(workspaceId: string, sessionId: string, decision: {
-        approvalId: string;
-        decision: "approve" | "reject";
-        message?: string;
-        clientEventId?: string;
-    }): Promise<SessionEvent>;
-    listHumanInputRequests(workspaceId: string, sessionId: string, options?: {
-        status?: SessionHumanInputRequest["status"];
-    }): Promise<SessionHumanInputRequest[]>;
-    getHumanInputRequest(workspaceId: string, sessionId: string, requestId: string): Promise<SessionHumanInputRequest>;
-    submitHumanInputResponse(workspaceId: string, sessionId: string, requestId: string, response: SubmitHumanInputResponseRequest, options?: {
-        clientEventId?: string;
-    }): Promise<SessionEvent>;
-    /**
-     * Live-stream a session's events with automatic reconnect, resume from the
-     * last seen sequence, gap backfill, and duplicate suppression. See
-     * {@link streamSessionEvents} for the delivery guarantees.
-     */
-    streamEvents(workspaceId: string, sessionId: string, options?: StreamSessionEventsOptions): AsyncGenerator<SessionEvent, void, void>;
-    /** The transport `streamEvents` runs on; useful for custom streaming layers. */
-    eventStreamTransport(workspaceId: string, sessionId: string): SessionEventStreamTransport;
-    /** Open one raw SSE connection (no reconnect). Most callers want `streamEvents`. */
-    openEventStream(workspaceId: string, sessionId: string, options?: {
-        after?: number;
-        signal?: AbortSignal;
-    }): Promise<ReadableStream<Uint8Array>>;
-    getQueue(workspaceId: string, sessionId: string): Promise<SessionQueueSnapshot>;
-    moveQueueItem(workspaceId: string, sessionId: string, turnId: string, request: MoveSessionQueueItemRequest): Promise<SessionQueueMutationResponse>;
-    editQueueItem(workspaceId: string, sessionId: string, turnId: string, request: EditSessionQueueItemRequest): Promise<SessionQueueMutationResponse>;
-    steerQueueItem(workspaceId: string, sessionId: string, turnId: string, request: SteerSessionQueueItemRequest): Promise<SessionQueueMutationResponse>;
-    deleteQueueItem(workspaceId: string, sessionId: string, turnId: string, request: DeleteSessionQueueItemRequest): Promise<SessionQueueMutationResponse>;
-    getComposerDraft(workspaceId: string, sessionId: string): Promise<ComposerDraft>;
-    saveComposerDraft(workspaceId: string, sessionId: string, request: SaveComposerDraftRequest): Promise<ComposerDraft>;
-    controlSession(workspaceId: string, sessionId: string, request: {
-        action: "pause" | "resume";
-        reason?: string;
-        clientEventId: string;
-        expectedControlEtag?: string;
-    }): Promise<SessionControlResponse>;
-    resumeSession(workspaceId: string, sessionId: string, options?: {
-        reason?: string;
-        clientEventId?: string;
-        expectedControlEtag?: string;
-    }): Promise<SessionControlResponse>;
-    setWorkspaceInferenceState(workspaceId: string, request: {
-        action: "pause" | "resume";
-        reason?: string;
-        clientEventId: string;
-        expectedRevision?: number;
-    }): Promise<WorkspaceInferenceControlResponse>;
-    listWorkspaceControlEvents(workspaceId: string, options?: {
-        after?: number;
-        limit?: number;
-    }): Promise<WorkspaceControlEvent[]>;
-    /** Count/byte-bounded page plus an explicit continuation cursor. */
-    listWorkspaceControlEventPage(workspaceId: string, options?: {
-        after?: number;
-        limit?: number;
-    }): Promise<WorkspaceControlEventPage>;
-    streamWorkspaceControlEvents(workspaceId: string, options?: StreamSessionEventsOptions): AsyncGenerator<WorkspaceControlEvent, void, void>;
-    workspaceControlStreamTransport(workspaceId: string): WorkspaceControlStreamTransport;
-    openWorkspaceControlEventStream(workspaceId: string, options?: {
-        after?: number;
-        signal?: AbortSignal;
-    }): Promise<ReadableStream<Uint8Array>>;
-    /**
-     * Steer: atomically put this prompt at the head and supersede the current
-     * inference. The client performs one request and renders server order.
-     */
-    steerMessage(workspaceId: string, sessionId: string, message: string | SendMessageInput): Promise<SteerMessageResult>;
-    /** The session's goal. 404s when the session never had one. */
-    getGoal(workspaceId: string, sessionId: string): Promise<SessionGoal>;
-    updateGoal(workspaceId: string, sessionId: string, request: UpdateSessionGoalRequest): Promise<SessionGoal>;
-    deleteGoal(workspaceId: string, sessionId: string): Promise<void>;
-    /** Pause the goal loop: the session stops self-continuing until resumed. */
-    pauseGoal(workspaceId: string, sessionId: string, options?: {
-        rationale?: string;
-    }): Promise<SessionGoal>;
-    /** Resume a paused goal: resets counters and re-arms the continuation loop. */
-    resumeGoal(workspaceId: string, sessionId: string): Promise<SessionGoal>;
-    /**
-     * Clear the session's conversation context. Destructive and audit-preserving:
-     * the server supersedes (never deletes) the live history and emits a
-     * `session.context.cleared` event. Refused (409) while a turn is in flight or
-     * awaiting action. `confirm:true` is sent so an accidental call cannot wipe
-     * context — the destructive intent is explicit on the wire.
-     */
-    clearSessionContext(workspaceId: string, sessionId: string): Promise<void>;
-    /** Request one durable portable compaction at the next safe model boundary. */
-    compactSessionContext(workspaceId: string, sessionId: string): Promise<CompactSessionContextResult>;
-    /** FileSystem: list a directory tree (feeds the Pierre file tree). */
-    fsList(workspaceId: string, sessionId: string, request?: FsListRequest, options?: OpenGeniRequestOptions): Promise<FsListResponse>;
-    /** FileSystem: read a file (text or base64; binary-safe, size-capped). */
-    fsRead(workspaceId: string, sessionId: string, request: FsReadRequest, options?: OpenGeniRequestOptions): Promise<FsReadResponse>;
-    /** FileSystem: write a file (last-writer-wins; emits fs.changed). */
-    fsWrite(workspaceId: string, sessionId: string, request: FsWriteRequest): Promise<FsWriteResponse>;
-    /** FileSystem: delete a path (emits fs.changed). */
-    fsDelete(workspaceId: string, sessionId: string, request: FsDeleteRequest): Promise<FsDeleteResponse>;
-    /** FileSystem: move/rename a path (emits fs.changed; 409 if destination exists and overwrite is false). */
-    fsMove(workspaceId: string, sessionId: string, request: FsMoveRequest): Promise<FsMoveResponse>;
-    /** FileSystem: create a directory (emits fs.changed; recursive defaults to true). */
-    fsMkdir(workspaceId: string, sessionId: string, request: FsMkdirRequest): Promise<FsMkdirResponse>;
-    /** Git: working-tree/index status (the Pierre file-status feed). */
-    gitStatus(workspaceId: string, sessionId: string, request?: GitStatusRequest, options?: OpenGeniRequestOptions): Promise<GitStatusResponse>;
-    /** Git: structured diff hunks (the Pierre diff feed). */
-    gitDiff(workspaceId: string, sessionId: string, request?: GitDiffRequest, options?: OpenGeniRequestOptions): Promise<GitDiffResponse>;
-    /** Git: commit log. */
-    gitLog(workspaceId: string, sessionId: string, request?: GitLogRequest): Promise<GitLogResponse>;
-    /** Git: show a commit (diff vs first parent) or fetch a raw blob at a ref. */
-    gitShow(workspaceId: string, sessionId: string, request: GitShowRequest): Promise<GitShowResponse>;
-    /** Workspace capture: the latest turn-end snapshot of the session's workspace
-     *  (tree + per-repo diff + file after-image refs), served from durable storage
-     *  WITHOUT warming a machine — the workbench cold-paint source. Returns
-     *  `{available:false}` when no capture exists yet (fall back to the live path). */
-    getWorkspaceCapture(workspaceId: string, sessionId: string, options?: OpenGeniRequestOptions): Promise<GetWorkspaceCaptureResponse>;
-    /** Workspace capture: a single file's after-image from the capture (revision
-     *  pins a specific one; omitted → latest). Content is inline for small files,
-     *  else a short-TTL signed URL; a tooLarge file returns metadata only. */
-    getWorkspaceCaptureFile(workspaceId: string, sessionId: string, path: string, revision?: number, options?: OpenGeniRequestOptions): Promise<GetWorkspaceCaptureFileResponse>;
-    /** Terminal: run a bounded command, returning buffered stdout/stderr inline. */
-    terminalExec(workspaceId: string, sessionId: string, request: TerminalExecRequest): Promise<TerminalExecResponse>;
-    /** Terminal: open an interactive PTY. Output streams on the event SSE as
-     *  terminal.pty.output.delta; drive it with terminalPtyWrite. */
-    terminalPtyOpen(workspaceId: string, sessionId: string, request?: PtyOpenRequest): Promise<PtyOpenResponse>;
-    /** Terminal: send stdin to an open PTY (output rides A1). */
-    terminalPtyWrite(workspaceId: string, sessionId: string, request: PtyWriteRequest): Promise<void>;
-    /** Terminal: resize an open PTY. */
-    terminalPtyResize(workspaceId: string, sessionId: string, request: PtyResizeRequest): Promise<void>;
-    /** Terminal: close an open PTY (idempotent). */
-    terminalPtyClose(workspaceId: string, sessionId: string, request: PtyCloseRequest): Promise<void>;
-    /** Read the negotiated capability doc for a session WITHOUT acquiring a viewer
-     *  holder (no warm, no spawn). Drives capability-gated rendering: which
-     *  surfaces mount, the per-surface unavailability reasons, and the lease
-     *  liveness the client polls on while `cold`/`warming`. The desktop URL/token
-     *  are minted in-process only when the box is warm AND the principal has
-     *  acknowledged the un-redacted plane. */
-    getStreamCapabilities(workspaceId: string, sessionId: string, options?: OpenGeniRequestOptions): Promise<SessionCapabilities>;
-    /** Record the calling principal's acknowledgment of the un-redacted desktop
-     *  pixel plane (and, when the box is shared, the shared-exposure disclosure).
-     *  The desktop viewer-attach path returns 409 until this is recorded. */
-    acknowledgeStream(workspaceId: string, sessionId: string, request?: AcknowledgeStreamRequest): Promise<AcknowledgeStreamResponse>;
-    /** Attach a viewer holder (refcounted liveness — keeps the box warm while
-     *  watched/used), spinning the box up in-process when cold, and mint the scoped
-     *  direct-to-provider URLs for the requested plane(s). `request.desktop:true`
-     *  opts into the un-redacted pixel plane and mints the noVNC URL — that plane
-     *  alone throws `OpenGeniApiError(409)` when the un-redacted/shared
-     *  acknowledgment is missing (the consent gate). A terminal-only attach
-     *  (`desktop` omitted/false) warms the box + mints the pty-ws terminal cell with
-     *  NO consent gate. An omitted `viewerId` mints a fresh one. */
-    attachViewer(workspaceId: string, sessionId: string, request?: AttachViewerRequest): Promise<AttachViewerResponse>;
-    /** Heartbeat a viewer holder (Channel-A app-level liveness). A closed laptop
-     *  stops sending these → the reaper drops the holder within ~90s. Echoes
-     *  `leaseEpoch` so a superseded epoch is rejected (`alive:false` → re-attach). */
-    heartbeatViewer(workspaceId: string, sessionId: string, viewerId: string, request: ViewerHeartbeatRequest): Promise<ViewerHeartbeatResponse>;
-    /** Detach a viewer (delete this holder; idempotent delete-my-row). */
-    detachViewer(workspaceId: string, sessionId: string, viewerId: string): Promise<void>;
-    /**
-     * The deployment's public client bootstrap config: the host-exposed models
-     * (provider-grouped in `models`, flat in `allowedModels` for back-compat),
-     * reasoning efforts, MCP servers, file-upload limits, and how the client is
-     * expected to authenticate. Drives a composer's model picker without prior
-     * knowledge of the host setup; safe to call before any auth is established.
-     */
-    getClientConfig(): Promise<ClientConfig>;
-    /** Authenticated model definitions plus workspace-specific selectability. */
-    getWorkspaceModelCatalog(workspaceId: string): Promise<WorkspaceModelCatalogResponse>;
-    /** The caller's access context: subject, account + workspace grants, defaults. */
-    getAccessContext(): Promise<AccessContext>;
-    listWorkspaces(): Promise<Workspace[]>;
-    createWorkspace(request: CreateWorkspaceRequest): Promise<Workspace>;
-    getWorkspace(workspaceId: string): Promise<Workspace>;
-    updateWorkspace(workspaceId: string, request: UpdateWorkspaceRequest): Promise<Workspace>;
-    /** Inspect immutable instruction-policy history, active heads, and activation audit evidence. */
-    listWorkspaceInstructionPolicies(workspaceId: string, options?: WorkspaceInstructionPolicyListOptions): Promise<WorkspaceInstructionPolicyListResponse>;
-    getWorkspaceInstructionPolicyRevision(workspaceId: string, revisionId: string): Promise<WorkspaceInstructionPolicyRevision>;
-    createWorkspaceInstructionPolicyDraft(workspaceId: string, request: CreateWorkspaceInstructionPolicyDraftRequest): Promise<WorkspaceInstructionPolicyRevision>;
-    /** Import the stored legacy workspace override as an inactive charter draft. */
-    importLegacyWorkspaceInstructionPolicyDraft(workspaceId: string, request?: ImportLegacyWorkspaceInstructionPolicyDraftRequest): Promise<WorkspaceInstructionPolicyRevision>;
-    diffWorkspaceInstructionPolicyRevisions(workspaceId: string, request: WorkspaceInstructionPolicyDiffRequest): Promise<WorkspaceInstructionPolicyDiffResponse>;
-    activateWorkspaceInstructionPolicyRevision(workspaceId: string, revisionId: string, request: ActivateWorkspaceInstructionPolicyRequest): Promise<WorkspaceInstructionPolicyActivationResponse>;
-    rollbackWorkspaceInstructionPolicyRevision(workspaceId: string, request: RollbackWorkspaceInstructionPolicyRequest): Promise<WorkspaceInstructionPolicyActivationResponse>;
-    /**
-     * Delete a workspace and everything in it. Refused (409) for the account's
-     * only workspace and while it still has a running session. Irreversible.
-     */
-    deleteWorkspace(workspaceId: string): Promise<void>;
-    /** The workspace's members (user + api_key subjects). */
-    listWorkspaceMembers(workspaceId: string): Promise<WorkspaceMember[]>;
-    /**
-     * Add an already-registered user by email. 404s when no user with that email
-     * exists (email invites for unknown users are deferred).
-     */
-    addWorkspaceMember(workspaceId: string, request: AddWorkspaceMemberRequest): Promise<WorkspaceMember>;
-    updateWorkspaceMember(workspaceId: string, subjectId: string, request: UpdateWorkspaceMemberRequest): Promise<WorkspaceMember>;
-    /**
-     * Remove a member. Refused (409) for your own membership and for the last
-     * member who can still manage the workspace.
-     */
-    removeWorkspaceMember(workspaceId: string, subjectId: string): Promise<void>;
-    createScheduledTask(workspaceId: string, request: CreateScheduledTaskRequest): Promise<ScheduledTask>;
-    updateScheduledTask(workspaceId: string, taskId: string, request: UpdateScheduledTaskRequest): Promise<ScheduledTask>;
-    pauseScheduledTask(workspaceId: string, taskId: string): Promise<ScheduledTask>;
-    resumeScheduledTask(workspaceId: string, taskId: string): Promise<ScheduledTask>;
-    /**
-     * Fire the task immediately (manual trigger), independent of its schedule.
-     * Pass a stable `triggerId` to make a retried trigger idempotent — the same
-     * token charges once and starts one run. Omit it and each call is distinct.
-     */
-    triggerScheduledTask(workspaceId: string, taskId: string, options?: {
-        triggerId?: string;
-    }): Promise<ScheduledTask>;
-    deleteScheduledTask(workspaceId: string, taskId: string): Promise<void>;
-    listScheduledTaskRuns(workspaceId: string, taskId: string, options?: {
-        limit?: number;
-    }): Promise<ScheduledTaskRun[]>;
-    listVariableSets(workspaceId: string): Promise<VariableSet[]>;
-    createVariableSet(workspaceId: string, request: CreateVariableSetRequest): Promise<VariableSet>;
-    getVariableSet(workspaceId: string, variableSetId: string): Promise<VariableSet>;
-    updateVariableSet(workspaceId: string, variableSetId: string, request: UpdateVariableSetRequest): Promise<VariableSet>;
-    deleteVariableSet(workspaceId: string, variableSetId: string): Promise<void>;
-    /** Create or rotate a variable. The value never comes back on any read. */
-    setVariableSetVariable(workspaceId: string, variableSetId: string, name: string, value: string): Promise<VariableSetVariableMetadata>;
-    deleteVariableSetVariable(workspaceId: string, variableSetId: string, name: string): Promise<void>;
-    listRigs(workspaceId: string): Promise<Rig[]>;
-    createRig(workspaceId: string, request: CreateRigRequest): Promise<Rig>;
-    getRig(workspaceId: string, rigId: string): Promise<Rig>;
-    updateRig(workspaceId: string, rigId: string, request: UpdateRigRequest): Promise<Rig>;
-    deleteRig(workspaceId: string, rigId: string): Promise<void>;
-    listRigVersions(workspaceId: string, rigId: string): Promise<RigVersion[]>;
-    /** Roll the active version to an existing one (rollback / promote-activate). */
-    activateRigVersion(workspaceId: string, rigId: string, versionId: string): Promise<RigVersion>;
-    listRigChanges(workspaceId: string, rigId: string): Promise<RigChange[]>;
-    /** Propose a change against the rig's active version (rigs:use). */
-    proposeRigChange(workspaceId: string, rigId: string, request: ProposeRigChangeRequest): Promise<RigChange>;
-    getRigChange(workspaceId: string, rigId: string, changeId: string): Promise<RigChange>;
-    /**
-     * Re-run verification for a change (rigs:use). Verification is asynchronous:
-     * this returns the change immediately with status `verifying`; poll
-     * `getRigChange`/`listRigChanges` for the terminal outcome + logs.
-     */
-    verifyRigChange(workspaceId: string, rigId: string, changeId: string): Promise<RigChange>;
-    /**
-     * Promote a verified `definition_edit` change into a new active rig version
-     * (rigs:manage). Only valid once the change's verification passed; returns the
-     * newly minted version.
-     */
-    promoteRigChange(workspaceId: string, rigId: string, changeId: string): Promise<RigVersion>;
-    /**
-     * Re-run the active version's checks in a clean throwaway sandbox (rigs:use).
-     * Asynchronous — returns the version id being verified; the outcome lands on
-     * the version's audit trail.
-     */
-    verifyRig(workspaceId: string, rigId: string): Promise<{
-        ok: boolean;
-        versionId: string;
-    }>;
-    /** @deprecated use listVariableSets */
-    listEnvironments(workspaceId: string): Promise<VariableSet[]>;
-    /** @deprecated use createVariableSet */
-    createEnvironment(workspaceId: string, request: CreateVariableSetRequest): Promise<VariableSet>;
-    /** @deprecated use getVariableSet */
-    getEnvironment(workspaceId: string, environmentId: string): Promise<VariableSet>;
-    /** @deprecated use updateVariableSet */
-    updateEnvironment(workspaceId: string, environmentId: string, request: UpdateVariableSetRequest): Promise<VariableSet>;
-    /** @deprecated use deleteVariableSet */
-    deleteEnvironment(workspaceId: string, environmentId: string): Promise<void>;
-    /** @deprecated use setVariableSetVariable */
-    setEnvironmentVariable(workspaceId: string, environmentId: string, name: string, value: string): Promise<VariableSetVariableMetadata>;
-    /** @deprecated use deleteVariableSetVariable */
-    deleteEnvironmentVariable(workspaceId: string, environmentId: string, name: string): Promise<void>;
-    /** Step 1 of the upload flow: returns the pre-signed PUT target. */
-    beginFileUpload(workspaceId: string, request: CreateFileUploadRequest): Promise<CreateFileUploadResponse>;
-    /** Step 3 of the upload flow: server verifies the object and marks it ready. */
-    completeFileUpload(workspaceId: string, uploadId: string): Promise<FileAsset>;
-    /**
-     * The whole upload flow as one call: begin -> PUT the bytes to the signed
-     * URL (with its required headers; no API auth is sent to object storage)
-     * -> complete. Returns the ready `FileAsset`.
-     */
-    uploadFile(workspaceId: string, input: UploadFileInput): Promise<FileAsset>;
-    getFile(workspaceId: string, fileId: string): Promise<FileAsset>;
-    /** Read provider-neutral retained evidence metadata; never returns a storage location. */
-    getRetainedArtifact(workspaceId: string, artifactId: string): Promise<RetainedArtifactMetadata>;
-    /**
-     * Read at most one authenticated retained-evidence range from the API. This
-     * deliberately does not use the ordinary signed file-download URL.
-     */
-    getRetainedArtifactContent(workspaceId: string, artifactId: string, options?: RetainedArtifactContentOptions): Promise<RetainedArtifactContent>;
-    /** Mint a short-lived signed download URL for a ready file. */
-    createFileDownloadUrl(workspaceId: string, fileId: string): Promise<FileDownloadUrlResponse>;
-    createDocumentBase(workspaceId: string, request: CreateDocumentBaseRequest): Promise<DocumentBase>;
-    listDocumentBases(workspaceId: string): Promise<DocumentBase[]>;
-    getDocumentBase(workspaceId: string, baseId: string): Promise<DocumentBase>;
-    /** Index an uploaded file into the base. The file must be `ready`. */
-    addDocument(workspaceId: string, baseId: string, request: AddDocumentRequest): Promise<Document>;
-    listDocuments(workspaceId: string, baseId: string): Promise<Document[]>;
-    /**
-     * Drop raw text or an already-uploaded file into the workspace's Default
-     * base. When curation is enabled, it may name, summarize, categorize, and
-     * (confidence permitting) file the document into the best-matching base;
-     * provider=none leaves caller metadata and Default placement unchanged.
-     */
-    createKnowledgeDrop(workspaceId: string, request: CreateKnowledgeDropRequest): Promise<Document>;
-    /**
-     * Move a document (and its indexed chunks) to another base. With no
-     * targetBaseId, applies the document's stored curation suggestion.
-     */
-    moveDocument(workspaceId: string, documentId: string, request?: MoveDocumentRequest): Promise<Document>;
-    /** Retry indexing for a failed document. */
-    reindexDocument(workspaceId: string, baseId: string, documentId: string): Promise<Document>;
-    /**
-     * Delete a document from a base. Removes the document row and its indexed
-     * chunks while leaving the uploaded file asset available for other uses.
-     */
-    deleteDocument(workspaceId: string, baseId: string, documentId: string): Promise<void>;
-    searchDocuments(workspaceId: string, baseId: string, request: Omit<DocumentSearchRequest, "baseIds">): Promise<DocumentSearchResponse>;
-    searchKnowledge(workspaceId: string, request: DocumentSearchRequest): Promise<DocumentSearchResponse>;
-    listKnowledgeMemories(workspaceId: string, request?: KnowledgeMemorySearchRequest): Promise<KnowledgeMemory[]>;
-    getKnowledgeMemory(workspaceId: string, memoryId: string): Promise<KnowledgeMemory>;
-    createKnowledgeMemory(workspaceId: string, request: CreateKnowledgeMemoryRequest): Promise<KnowledgeMemory>;
-    updateKnowledgeMemory(workspaceId: string, memoryId: string, request: UpdateKnowledgeMemoryRequest): Promise<KnowledgeMemory>;
-    /** Hybrid (semantic + keyword) search over the workspace's agent-visible memory. */
-    searchWorkspaceMemories(workspaceId: string, request: WorkspaceMemorySearchRequest): Promise<WorkspaceMemorySearchResponse>;
-    /** Deep-merge a settings patch into the workspace (preserves unknown keys). */
-    updateWorkspaceSettings(workspaceId: string, request: UpdateWorkspaceSettingsRequest): Promise<Workspace>;
-    setWorkspaceDefaultRig(workspaceId: string, request: SetWorkspaceDefaultRigRequest): Promise<Workspace>;
-    /** Built-in + registered packs, with the workspace's installations. */
-    listPacks(workspaceId: string): Promise<ListPacksResponse>;
-    /** Register (or replace) a workspace-scoped pack from a manifest. */
-    registerPack(workspaceId: string, manifest: RegisterCapabilityPackRequest): Promise<WorkspaceRegisteredPack>;
-    getPack(workspaceId: string, packId: string): Promise<GetPackResponse>;
-    enablePack(workspaceId: string, packId: string, request?: EnablePackRequest): Promise<PackInstallation>;
-    /** Unregister a workspace-scoped pack (built-in packs cannot be deleted). */
-    deletePack(workspaceId: string, packId: string): Promise<void>;
-    listPackInstallations(workspaceId: string): Promise<PackInstallation[]>;
-    listCapabilities(workspaceId: string): Promise<CapabilityCatalogResponse>;
-    /** Add a manual capability catalog item (e.g. a remote MCP server). */
-    createCapability(workspaceId: string, request: CreateCapabilityCatalogItemRequest): Promise<CapabilityCatalogItem>;
-    enableCapability(workspaceId: string, capabilityId: string, request?: EnableCapabilityRequest): Promise<CapabilityInstallation>;
-    disableCapability(workspaceId: string, capabilityId: string): Promise<CapabilityInstallation>;
-    /** Search the official MCP registry for installable capabilities. */
-    discoverMcpCapabilities(workspaceId: string, options?: {
-        query?: string;
-        limit?: number;
-    }): Promise<DiscoverMcpCapabilitiesResponse>;
-    listConnections(workspaceId: string): Promise<ConnectionMetadata[]>;
-    createConnection(workspaceId: string, request: CreateConnectionRequest): Promise<ConnectionMetadata>;
-    /** Start the public Slack installation flow for the workspace-shared OpenGeni bot. */
-    startOpenGeniSlackBotInstall(workspaceId: string, request?: OpenGeniSlackBotInstallRequest): Promise<OpenGeniSlackBotInstallStart>;
-    updateConnection(workspaceId: string, connectionId: string, request: UpdateConnectionRequest): Promise<ConnectionMetadata>;
-    deleteConnection(workspaceId: string, connectionId: string): Promise<ConnectionMetadata>;
-    /** Start an OAuth connection flow; redirect the user to the returned `authorizationUrl`. */
-    startConnectionOAuth(workspaceId: string, request: OAuthStartRequest): Promise<OAuthStartResponse>;
-    /** Public, immutably-cached URL for a catalog item's logo, or null when the item has none. */
-    catalogAssetUrl(logoAssetPath: string | null): string | null;
-    /** GitHub App server configuration plus truthful workspace binding status. */
-    getGitHubApp(workspaceId: string): Promise<GitHubAppInfo>;
-    /** Build the GitHub owner-consent entry URL for fresh workspace-bound state. */
-    githubConnectUrl(workspaceId: string, state: string): string;
-    listGitHubRepositories(workspaceId: string): Promise<GitHubRepositoriesResponse>;
-    /** Re-sync the installation's repository list from GitHub. */
-    syncGitHubRepositories(workspaceId: string): Promise<GitHubRepositoriesResponse>;
-    /** Remove one workspace binding without uninstalling the GitHub App itself. */
-    unlinkGitHubInstallation(workspaceId: string, installationId: number): Promise<void>;
-    /** Build a GitHub App manifest + the GitHub URL to submit it to. */
-    createGitHubAppManifest(workspaceId: string, request?: CreateGitHubAppManifestRequest): Promise<CreateGitHubAppManifestResponse>;
-    listApiKeys(workspaceId: string): Promise<ApiKey[]>;
-    /** The returned `token` is shown once; only its prefix is stored. */
-    createApiKey(workspaceId: string, request: CreateApiKeyRequest): Promise<CreateApiKeyResponse>;
-    /** Revoke an API key. Returns the revoked key. */
-    deleteApiKey(workspaceId: string, apiKeyId: string): Promise<ApiKey>;
-    getBilling(options?: {
-        accountId?: string;
-    }): Promise<BillingSummary>;
-    getBillingUsage(options?: {
-        accountId?: string;
-        workspaceId?: string;
-    }): Promise<BillingUsageResponse>;
-    getBillingEntitlements(options?: {
-        accountId?: string;
-    }): Promise<BillingEntitlementsResponse>;
-    /** Start a Stripe checkout for prepaid credits. */
-    createBillingCheckout(request: CreateCheckoutRequest): Promise<CreateCheckoutResponse>;
-    private headers;
-    private url;
-    /** Connection state + the codex models the workspace may select (empty until connected). */
-    codexStatus(workspaceId: string): Promise<CodexConnectionStatus>;
-    /** Begin device-code login: show `userCode` at `verificationUri`, then poll with `state`. */
-    codexConnectStart(workspaceId: string): Promise<CodexConnectStart>;
-    /** Poll device-code authorization with the `state` from {@link codexConnectStart}. */
-    codexConnectPoll(workspaceId: string, state: string): Promise<CodexConnectPoll>;
-    /** Remaining usage / limits for the connected (ACTIVE) subscription. Back-compat. */
-    codexUsage(workspaceId: string): Promise<CodexUsage>;
-    /** Live per-account usage read (refreshes THIS account's bearer; writes the cache). */
-    codexAccountUsage(workspaceId: string, accountId: string): Promise<CodexUsage>;
-    /** Batched live refresh across every connected account, keyed by credential id. */
-    refreshCodexUsage(workspaceId: string): Promise<{
-        usage: CodexUsageMap;
-    }>;
-    /** Live independently-settled quota + reset-credit overview for every account. */
-    codexOverview(workspaceId: string): Promise<CodexOverviewResponse>;
-    /** Disconnect ALL accounts (legacy workspace-wide). Prefer `disconnectCodexAccount`. */
-    codexDisconnect(workspaceId: string): Promise<{
-        disconnected: boolean;
-    }>;
-    /** List every connected Codex account + the workspace active pointer + settings. */
-    listCodexAccounts(workspaceId: string): Promise<CodexAccountsResponse>;
-    /** Switch the workspace ACTIVE Codex account (the one unpinned sessions use). */
-    activateCodexAccount(workspaceId: string, accountId: string): Promise<{
-        activated: boolean;
-        accountId: string;
-    }>;
-    /** P3: enable/disable Codex auto-rotation and/or pick the strategy. Returns the effective settings. */
-    setCodexRotationSettings(workspaceId: string, patch: {
-        rotationEnabled?: boolean;
-        rotationStrategy?: CodexRotationSettings["rotationStrategy"];
-    }): Promise<CodexRotationSettings>;
-    /** Toggle only NEW automatic allocations under independent allocator OCC. */
-    setCodexAccountAllocator(workspaceId: string, accountId: string, input: {
-        enabled: boolean;
-        expectedVersion: number;
-    }): Promise<CodexAllocatorUpdate>;
-    /** Disconnect ONE Codex account by id (re-picks active when the removed one was active). */
-    disconnectCodexAccount(workspaceId: string, accountId: string): Promise<{
-        disconnected: boolean;
-        newActiveId: string | null;
-    }>;
-    /** Rename a Codex account (label only in P1). */
-    renameCodexAccount(workspaceId: string, accountId: string, label: string | null): Promise<CodexAccount>;
-    /** Pin (or unpin via "auto") a session's Codex account. Applies on the next turn. */
-    pinSessionCodexAccount(workspaceId: string, sessionId: string, target: string): Promise<{
-        pinned: string;
-    }>;
-    private requestJson;
-    /** Like `requestJson` for endpoints that respond with no body (204). */
-    private requestVoid;
-}
-
-/** Error for a non-2xx OpenGeni API response. */
-declare class OpenGeniApiError extends Error {
-    readonly status: number;
-    readonly code: string | undefined;
-    readonly retryable: boolean;
-    readonly correlationId: string | undefined;
-    /** True only when an uncontrolled transport failed after a mutation may have been accepted. */
-    readonly outcomeUnknown: boolean;
-    readonly body: string;
-    constructor(status: number, body: string, options?: {
-        code?: string | undefined;
-        retryable?: boolean | undefined;
-        correlationId?: string | undefined;
-        outcomeUnknown?: boolean | undefined;
-        displayMessage?: string | undefined;
-        mutation?: boolean | undefined;
-    });
-}
-/** A short-lived session-list snapshot cursor can no longer be continued. */
-declare class OpenGeniSessionListCursorError extends OpenGeniApiError {
-}
-/** The browser bundle and API disagree about their state-changing wire contract. */
-declare class OpenGeniApiContractMismatchError extends Error {
-    readonly expected: string;
-    readonly actual: string;
-    constructor(expected: string, actual: string);
-}
-/** Error for an unrecoverable event-stream condition (not a transient drop). */
-declare class OpenGeniStreamError extends Error {
-    constructor(message: string);
-}
-/**
- * Transient conditions worth a reconnect: network-level failures (`fetch`
- * rejects with `TypeError`) and HTTP statuses that signal a temporary server
- * or contention condition. Auth/validation failures (401/403/404/...) are
- * permanent and surface to the caller instead.
- */
-declare function isRetryableStreamError(error: unknown): boolean;
-
-/**
- * Proxy-through-your-own-API helpers.
- *
- * The intended pattern: a customer's server consumes the OpenGeni event
- * stream with its own API key (`client.streamEvents(...)`) and re-emits it to
- * its browser clients over its own authenticated endpoint — the OpenGeni key
- * never reaches the browser. The re-emitted wire format is identical to
- * OpenGeni's own SSE stream (`id: <sequence>`, `event: <type>`,
- * `data: <event JSON>`), so the browser side can consume it with this same
- * SDK's streaming core (or a plain `EventSource`), including resume via
- * `?after=` / `Last-Event-ID`.
- */
-/** Format one event exactly as OpenGeni's API emits it over SSE. */
-declare function formatSseEvent(event: SessionEvent): string;
-type SseReStreamOptions = {
-    /**
-     * Emit `: ping` comment lines at this interval, keeping intermediaries from
-     * idling the connection out. Disabled when omitted.
-     */
-    heartbeatMs?: number;
-    /**
-     * Called when the downstream consumer cancels (e.g. the browser
-     * disconnected). Use it to abort the upstream OpenGeni stream — an async
-     * iterator that is mid-`await` cannot be interrupted by `return()` alone.
-     */
-    onCancel?: () => void;
-};
-/**
- * Re-emit a stream of session events as an SSE byte stream. Pull-based, so
- * upstream consumption follows downstream demand; cancelling the returned
- * stream fires `onCancel` and ends the upstream iterator.
- */
-declare function sessionEventsToSseStream(events: AsyncIterable<SessionEvent>, options?: SseReStreamOptions): ReadableStream<Uint8Array>;
-/** Wrap an event stream in a ready-to-return SSE `Response`. */
-declare function sessionEventsToSseResponse(events: AsyncIterable<SessionEvent>, options?: SseReStreamOptions): Response;
-/**
- * Read the resume cursor a reconnecting SSE client sent: the `after` query
- * parameter, or the standard `Last-Event-ID` header (the re-emitted stream
- * sets `id:` to the sequence). Returns 0 (full replay) when absent.
- */
-declare function resumeSequenceFromRequest(request: Request): number;
-type ProxySessionEventStreamOptions = Omit<StreamSessionEventsOptions, "after"> & {
-    /**
-     * Resume cursor. Pass a number, or the incoming browser `Request` to
-     * honor its `?after=` / `Last-Event-ID` automatically.
-     */
-    after?: number | Request;
-    /** See {@link SseReStreamOptions.heartbeatMs}. */
-    heartbeatMs?: number;
-};
-/**
- * One-call proxy: consume the OpenGeni stream server-side and return an SSE
- * `Response` for your own browser clients. Works anywhere WHATWG `Response`
- * is the handler return type (Hono, Next.js route handlers, Bun.serve,
- * Cloudflare Workers, ...).
- *
- * The upstream OpenGeni connection is torn down when the downstream client
- * disconnects, and also when `options.signal` (e.g. the incoming request's
- * signal) aborts.
- */
-declare function proxySessionEventStream(client: OpenGeniClient, workspaceId: string, sessionId: string, options?: ProxySessionEventStreamOptions): Response;
-
-/**
- * Minimal incremental Server-Sent Events parser over a byte stream.
- *
- * Implements the parts of the SSE wire format OpenGeni uses: `id`, `event`,
- * and `data` fields, multi-line data, comment lines, and both LF and CRLF
- * line endings. Messages without any `data` (comments, id-only blocks) are
- * not emitted.
- */
-type SseMessage = {
-    id?: string;
-    event?: string;
-    data: string;
-};
-declare function parseSseStream(stream: ReadableStream<Uint8Array>): AsyncGenerator<SseMessage, void, void>;
-
-/**
- * A transport-tolerant MCP tool result.
- *
- * `value` is the canonical machine-readable payload after recognized MCP/JSON
- * envelopes are removed. `text` is the best presentation string without
- * discarding structured data. `raw` always retains the original evidence.
- */
-type NormalizedMcpOutput = Readonly<{
-    raw: unknown;
-    value: unknown;
-    text: string;
-    isError: boolean;
-}>;
-/** Normalize common direct, JSON, and standard MCP result envelopes without throwing. */
-declare function normalizeMcpOutput(output: unknown): NormalizedMcpOutput;
-
-/**
- * Translate the negotiated desktop capability into the WebSocket URL the noVNC
- * RFB client connects to. The scoped provider token is ALREADY embedded in the
- * minted `url` (Modal tunnel host, Blaxel `bl_preview_token`, Daytona signed
- * preview) by `session.resolveExposedPort(6080)` — we do NOT append `cap.token`
- * as a query param (that double-auth was an adversarial-review bug: the box runs
- * `-nopw` in v1, so the RFB password is meaningless and the real auth is the
- * tunnel token in the host). We only normalize the scheme to `ws`/`wss` and, when
- * the minted URL points at a `vnc.html` viewer page, rewrite it to the
- * websockify socket path noVNC actually dials.
- */
-declare function desktopSocketUrl(cap: Pick<DesktopStreamCapability, "url">): string;
-/**
- * The minimal RFB surface the React component drives. Lets tests (and 3rd
- * parties swapping noVNC for a WebRTC client in v3) provide a fake without the
- * DOM. Matches `@novnc/novnc`'s RFB constructor + lifecycle.
- */
-interface DesktopRfbLike {
-    viewOnly: boolean;
-    scaleViewport: boolean;
-    /**
-     * 1:1 viewport clipping. We always drive this FALSE: with clipping on, noVNC
-     * paints the framebuffer pixel-for-pixel and scrolls/crops to the container
-     * (the "zoomed in" look). FALSE lets `scaleViewport` shrink the 1280x800 frame
-     * to fit the panel (aspect-preserved). Declared so the hook can pin it instead
-     * of relying on noVNC's default — `scaleViewport=true` forces clip off
-     * internally, but a stale/partial state on reconnect could leave it on.
-     */
-    clipViewport: boolean;
-    addEventListener(type: "connect" | "disconnect" | "securityfailure", cb: (e?: unknown) => void): void;
-    removeEventListener?: (type: "connect" | "disconnect" | "securityfailure", cb: (e?: unknown) => void) => void;
-    disconnect(): void;
-}
-type DesktopRfbFactory = (target: HTMLElement, url: string, opts: {
-    credentials?: {
-        password?: string | undefined;
-    } | undefined;
-}) => DesktopRfbLike;
-type DesktopConnectionState = "idle" | "negotiating" | "connecting" | "connected" | "rotating" | "reconnecting" | "error" | "ended";
-type DesktopStreamEvent = {
-    type: "negotiated";
-} | {
-    type: "connected";
-} | {
-    type: "disconnected";
-} | {
-    type: "rotate";
-} | {
-    type: "fail";
-} | {
-    type: "abort";
-};
-/**
- * Pure reducer for the desktop connection lifecycle. The component owns the RFB
- * object + DOM; this owns the transitions so they are unit-testable. Mirrors the
- * Channel-A stream reducer discipline.
- */
-declare function nextDesktopState(current: DesktopConnectionState, ev: DesktopStreamEvent): DesktopConnectionState;
-type DesktopStreamCapabilityLike = {
-    url: string | null;
-    token: string | null;
-    expiresAt: string | null;
-};
-/**
- * Apply a `stream.url.rotated` event onto a desktop capability, fencing on
- * leaseEpoch (split-brain). A rotation minted under an epoch the client has
- * already advanced PAST is from a superseded owner and is dropped (returns
- * null); otherwise the fresh url/token/expiresAt are folded in.
- */
-declare function applyUrlRotation<T extends DesktopStreamCapabilityLike>(cap: T, payload: StreamUrlRotatedPayload, knownEpoch: number): T | null;
-
-/**
- * Translate the negotiated `pty-ws` Terminal capability into the WebSocket URL
- * the ttyd client dials. The scoped provider token is ALREADY embedded in the
- * minted `url` (the Modal tunnel host) by `session.resolveExposedPort(7681)` —
- * we do NOT append `cap.token` (identical posture to the desktop: the gate is the
- * unguessable short-TTL tunnel URL + the server-recorded scoped stream token; ttyd
- * runs `--writable` with no `-c` credential in v1). We only normalize the scheme
- * to `ws`/`wss`; a bare host is already the ttyd websocket endpoint.
- */
-declare function terminalSocketUrl(cap: Pick<TerminalCapability, "url">): string;
-/** ttyd subprotocol — REQUIRED on the WebSocket handshake or ttyd refuses it. */
-declare const TTYD_SUBPROTOCOL = "tty";
-/** Client→server command bytes (the first char of each outbound text frame). */
-declare const TtydClientCommand: {
-    /** stdin: "0" + raw input bytes. */
-    readonly INPUT: "0";
-    /** window resize: "1" + JSON.stringify({ columns, rows }). */
-    readonly RESIZE: "1";
-    /** flow-control pause (back-pressure): "2". */
-    readonly PAUSE: "2";
-    /** flow-control resume: "3". */
-    readonly RESUME: "3";
-};
-/** Server→client command bytes (the first char of each inbound frame). */
-declare const TtydServerCommand: {
-    /** stdout/stderr: "0" + raw output bytes (write the rest into xterm). */
-    readonly OUTPUT: "0";
-    /** set the window title: "1" + title string. */
-    readonly SET_WINDOW_TITLE: "1";
-    /** ttyd client preferences JSON: "2" + json (ignored by us). */
-    readonly SET_PREFERENCES: "2";
-};
-/**
- * The ttyd handshake's first frame: an auth message. ttyd expects
- * `JSON.stringify({ AuthToken })` as the FIRST text frame on the socket. We send
- * an empty token — our gate is the tunnel URL + scoped stream token, NOT a ttyd
- * `-c` basic-auth credential (which the box does not set in v1). Optional ttyd
- * `columns`/`rows` can ride this frame to seed the PTY size before the first
- * resize. Pure (string-building only) so it stays unit-testable in the SDK.
- */
-declare function ttydAuthFrame(opts?: {
-    columns?: number;
-    rows?: number;
-}): string;
-/** Build a client→server INPUT (stdin) frame: "0" + data. */
-declare function ttydInputFrame(data: string): string;
-/** Build a client→server RESIZE frame: "1" + JSON.stringify({ columns, rows }). */
-declare function ttydResizeFrame(columns: number, rows: number): string;
-
-export { type AccessContext, type AccessGrant, type AccountGrant, type AccountRole, type AcknowledgeStreamRequest, type AcknowledgeStreamResponse, type ActivateWorkspaceInstructionPolicyRequest, type AddDocumentRequest, type AddWorkspaceMemberRequest, type AgentMessageCompletedPayload, type AgentTextDeltaPayload, type AgentToolCallCreatedPayload, type AgentToolCallOutputPayload, type ApiKey, type AttachViewerRequest, type AttachViewerResponse, type BillingBalance, type BillingEntitlementsResponse, type BillingMode, type BillingSummary, type BillingUsageResponse, type CapabilityCatalogItem, type CapabilityCatalogResponse, type CapabilityInstallation, type CapabilityInstallationStatus, type CapabilityKind, type CapabilityPack, type CapabilityPackConnector, type CapabilityPackConnectorAuthModel, type CapabilityPackKnowledge, type CapabilityPackScheduledTaskTemplate, type CapabilityPackSkill, type CapabilityPackSkillFile, type CapabilityPackVariableSetSpec, type CapabilityRuntime, type CapabilitySource, type CapabilityUnavailableReason, type ClientAuthConfig, type ClientConfig, type ClientModel, type ClientSessionEventInput, type CodexAccount, type CodexAccountOverview, type CodexAccountSwitchedPayload, type CodexAccountsResponse, type CodexAllocatorUpdate, type CodexConnectPoll, type CodexConnectStart, type CodexConnectionStatus, type CodexFleetCacheState, type CodexFleetConfidence, type CodexFleetDecisionEventPayload, type CodexFleetDecisionScore, type CodexFleetShadowComparison, type CodexOverviewResponse, type CodexResetCredit, type CodexResetRedemptionRecovery, type CodexRotationSettings, type CodexUsage, type CodexUsageMap, type CodexUsagePayload, type CodexUsageWindow, type CompactSessionContextResult, type CompleteFileUploadResponse, type ComposerDraft, type ComputerUseCapability, type ConnectionKind, type ConnectionMetadata, type ConnectionResponse, type ConnectionStatus, type CreateApiKeyRequest, type CreateApiKeyResponse, type CreateCapabilityCatalogItemRequest, type CreateCheckoutRequest, type CreateCheckoutResponse, type CreateConnectionRequest, type CreateDocumentBaseRequest, type CreateFileUploadRequest, type CreateFileUploadResponse, type CreateGitHubAppManifestRequest, type CreateGitHubAppManifestResponse, type CreateKnowledgeDropRequest, type CreateKnowledgeMemoryRequest, type CreateRigRequest, type CreateScheduledTaskRequest, type CreateSessionRequest, type CreateVariableSetRequest, type CreateWorkspaceEnvironmentRequest, type CreateWorkspaceInstructionPolicyDraftRequest, type CreateWorkspaceRequest, DEFAULT_WORKSPACE_TRANSCRIPTION_POLICY, type DeleteSessionQueueItemRequest, type DesktopConnectionState, type DesktopRfbFactory, type DesktopRfbLike, type DesktopStreamCapability, type DesktopStreamEvent, type DeviceEnrollmentApproveRequest, type DeviceEnrollmentApproveResponse, type DeviceEnrollmentDenyRequest, type DeviceEnrollmentDenyResponse, type DeviceEnrollmentLookupMachine, type DeviceEnrollmentLookupRequest, type DeviceEnrollmentLookupResponse, type DiscoverMcpCapabilitiesResponse, type Document, type DocumentBase, type DocumentCuration, type DocumentCurationStatus, type DocumentSearchMode, type DocumentSearchRequest, type DocumentSearchResponse, type DocumentSearchResult, type DocumentStatus, type DocumentVisibility, type EditSessionQueueItemRequest, type EffectiveControlBlocker, type EffectiveControlResumeOption, type EffectiveSessionControl, type EnableCapabilityRequest, type EnablePackRequest, type EnrollTokenExchangeRequest, type EnrollTokenExchangeResponse, type EnrollmentCredentials, type EnrollmentOs, type EntitlementValue, type Entitlements, type EntitlementsMode, type FetchLike, type FileAsset, type FileDownloadUrlResponse, type FileResourceRef, type FileStatus, type FileSystemCapability, type FileUploadData, type FirstPartyMcpToolName, type FsChangeKind, type FsChangedPayload, type FsDeleteRequest, type FsDeleteResponse, type FsEncoding, type FsListRequest, type FsListResponse, type FsMkdirRequest, type FsMkdirResponse, type FsMoveRequest, type FsMoveResponse, type FsNodeType, type FsReadRequest, type FsReadResponse, type FsTreeNode, type FsWriteRequest, type FsWriteResponse, type GetPackResponse, type GetWorkspaceCaptureFileResponse, type GetWorkspaceCaptureResponse, type GitCapability, type GitChangedPayload, type GitCommit, type GitCredentialBindingId, type GitCredentialProvider, type GitDiffHunk, type GitDiffLine, type GitDiffLineType, type GitDiffRequest, type GitDiffResponse, type GitFileDiff, type GitFileStatus, type GitFileStatusCode, type GitHubAppInfo, type GitHubAppSetupMode, type GitHubBindingStatus, type GitHubInstallationBinding, type GitHubInstallationLifecycle, type GitHubRepositoriesResponse, type GitHubRepository, type GitHubRepositoryScope, type GitLogRequest, type GitLogResponse, type GitRepositoryAccess, type GitShowRequest, type GitShowResponse, type GitStatusRequest, type GitStatusResponse, type GoalSpec, type HumanInputAnswer, type HumanInputOption, type HumanInputQuestion, type HumanInputQuestionKind, type HumanInputResponse, type ImportLegacyWorkspaceInstructionPolicyDraftRequest, type IntegrationClientMetadata, KNOWN_PERMISSIONS, KNOWN_USAGE_EVENT_TYPES, type KnowledgeMemory, type KnowledgeMemoryKind, type KnowledgeMemorySearchRequest, type KnowledgeMemoryStatus, type KnowledgeSourceKind, type KnowledgeSourceRef, type KnownPermission, type KnownSessionEventType, type KnownUsageEventType, type LineageNode, type ListApiKeysResponse, type ListConnectionsResponse, type ListPacksResponse, type ListWorkspaceMembersResponse, type MachineKind, type MachineMetricsSeriesResponse, type MachineState, type MachineView, type MachinesResponse, type McpServerConnectionRef, type MetricSample, type MintEnrollTokenRequest, type MintEnrollTokenResponse, type ModelAvailabilityV1, type ModelBillingAttributionV1, type ModelCapabilitiesV1, type ModelCapabilityStateV1, type ModelCapabilitySupportV1, type ModelCredentialReadinessV1, type ModelCredentialSourceV1, type ModelPricingScheduleV1, type ModelPricingV1, type MoveDocumentRequest, type MoveSessionQueueItemRequest, type NewSessionDraft, type NewSessionDraftOptions, type NormalizedMcpOutput, type OAuthStartRequest, type OAuthStartResponse, OPENGENI_API_CONTRACT_HEADER, OPENGENI_API_CONTRACT_REVISION, OPENGENI_CORRELATION_HEADER, OpenGeniApiContractMismatchError, OpenGeniApiError, OpenGeniClient, type OpenGeniClientOptions, type OpenGeniRequestOptions, OpenGeniSessionListCursorError, type OpenGeniSlackBotInstallRequest, type OpenGeniSlackBotInstallStart, OpenGeniStreamError, type PackInstallation, type PackInstallationStatus, type Permission, type ProductAccessMode, type ProposeRigChangeRequest, type ProxySessionEventStreamOptions, type PtyCloseRequest, type PtyOpenRequest, type PtyOpenResponse, type PtyResizeRequest, type PtyWriteRequest, RETAINED_OUTPUT_DEFAULT_PAGE_BYTES, RETAINED_OUTPUT_MAX_PAGE_BYTES, type ReasoningEffort, type RecordingAvailablePayload, type RecordingCapability, type RecordingCodec, type RecordingContentType, type RecordingFailedPayload, type RecordingFailedReason, type RecordingMode, type RecordingStartedPayload, type RegisterCapabilityPackRequest, type RepositoryResourceRef, type ResourceRef, type RetainedArtifactContent, type RetainedArtifactContentOptions, type RetainedArtifactMetadata, type RetainedArtifactReference, type RetainedArtifactUnavailable, type RetainedOutputKind, type RetainedOutputUnavailableReason, type Rig, type RigChange, type RigChangeKind, type RigChangeStatus, type RigChangeVerification, type RigCheck, type RigCheckResult, type RigDefinitionEditPayload, type RigSetupAppendPayload, type RigVersion, type RollbackWorkspaceInstructionPolicyRequest, SESSION_EVENT_TYPES, type SandboxBackend, type SandboxCapabilityName, type SandboxCommandOutputDeltaPayload, type SandboxOs, type SaveComposerDraftRequest, type SaveNewSessionDraftRequest, type ScheduledTask, type ScheduledTaskAgentConfig, type ScheduledTaskAgentConfigInput, type ScheduledTaskDayOfWeek, type ScheduledTaskOverlapPolicy, type ScheduledTaskRun, type ScheduledTaskRunMode, type ScheduledTaskRunStatus, type ScheduledTaskScheduleSpec, type ScheduledTaskStatus, type ScheduledTaskTriggerType, type SendMessageInput, type ServiceTurnInitiator, type ServiceTurnInitiatorContext, type Session, type SessionCapabilities, type SessionCommandReceipt, type SessionControlResponse, type SessionEffectiveToolPolicy, type SessionEvent, type SessionEventCompactResult, type SessionEventCompactResultOptions, type SessionEventLatestClass, type SessionEventListOptions, type SessionEventPage, type SessionEventPayloadMode, type SessionEventReadDirection, type SessionEventReadMode, type SessionEventResultMode, type SessionEventSemanticClass, type SessionEventStreamTransport, type SessionEventType, type SessionGoal, type SessionGoalCreatedBy, type SessionGoalStatus, type SessionHumanInputRequest, type SessionLineageResponse, type SessionListResponse, type SessionMcpApprovalPolicy, type SessionMcpCredentialUpdateInput, type SessionMcpServerInput, type SessionMcpServerMetadata, type SessionPendingInputPreview, type SessionQueueMutationResponse, type SessionQueueSnapshot, type SessionStatus, type SessionStatusChangedPayload, type SessionStructuredCapabilities, type SessionSummary, type SessionSystemUpdate, type SessionSystemUpdateKind, type SessionSystemUpdateState, type SessionToolPolicy, type SessionTurn, type SessionTurnSource, type SessionTurnStatus, type SetWorkspaceEnvironmentVariableRequest, type SseMessage, type SseReStreamOptions, type SteerMessageResult, type SteerSessionQueueItemRequest, type StreamClosedPayload, type StreamConnectionState, type StreamOpenedPayload, type StreamRevokedPayload, type StreamSessionEventsOptions, type StreamUrlRotatedPayload, type SubmitHumanInputResponseRequest, type SwapActiveSandboxRequest, type SwapActiveSandboxResponse, TTYD_SUBPROTOCOL, type TerminalCapability, type TerminalExecRequest, type TerminalExecResponse, type TerminalPtyExitedPayload, type TerminalPtyOutputDeltaPayload, type TerminalPtyStartedPayload, type ToolAuthNeededPayload, type ToolRef, type TranscriptionAdapter, type TranscriptionAdapterDescriptor, type TranscriptionAdapterStartContext, type TranscriptionAuthorization, type TranscriptionCredentialMode, type TranscriptionDiagnostic, type TranscriptionErrorCode, type TranscriptionEvent, type TranscriptionEventListener, type TranscriptionLifecycleStatus, type TranscriptionPolicyBlockReason, type TranscriptionResultMetadata, type TranscriptionSession, type TranscriptionSessionRequest, type TranscriptionSpeaker, type TranscriptionTargetSelection, type TranscriptionTimeSpan, type TranscriptionWord, TtydClientCommand, TtydServerCommand, type TurnInitiator, type UpdateConnectionRequest, type UpdateKnowledgeMemoryRequest, type UpdateRigRequest, type UpdateScheduledTaskRequest, type UpdateSessionGoalRequest, type UpdateSessionMcpApprovalPolicyRequest, type UpdateSessionMcpApprovalPolicyResponse, type UpdateSessionPinRequest, type UpdateSessionRequest, type UpdateSessionToolPolicyRequest, type UpdateVariableSetRequest, type UpdateWorkspaceEnvironmentRequest, type UpdateWorkspaceMemberRequest, type UpdateWorkspaceRequest, type UpdateWorkspaceSettingsRequest, type UploadFileInput, type UsageEvent, type UsageEventType, type UserApprovalDecisionEventInput, type UserHumanInputResponseEventInput, type UserMessageEventInput, type VariableSet, type VariableSetVariableMetadata, type ViewerHeartbeatRequest, type ViewerHeartbeatResponse, type ViewerHolder, type Workspace, type WorkspaceCaptureDegradedReason, type WorkspaceCaptureFile, type WorkspaceCaptureManifest, type WorkspaceCaptureRepo, type WorkspaceCaptureSignedUrl, type WorkspaceCaptureStats, type WorkspaceControlEvent, type WorkspaceControlEventPage, type WorkspaceControlStreamTransport, type WorkspaceEnvironment, type WorkspaceEnvironmentVariableMetadata, type WorkspaceInferenceControlResponse, type WorkspaceInstructionPolicyActivationEvent, type WorkspaceInstructionPolicyActivationResponse, type WorkspaceInstructionPolicyActivationType, type WorkspaceInstructionPolicyConflictResponse, type WorkspaceInstructionPolicyDiffRequest, type WorkspaceInstructionPolicyDiffResponse, type WorkspaceInstructionPolicyDraftProvenanceSource, type WorkspaceInstructionPolicyHead, type WorkspaceInstructionPolicyKind, type WorkspaceInstructionPolicyListOptions, type WorkspaceInstructionPolicyListResponse, type WorkspaceInstructionPolicyProvenanceSource, type WorkspaceInstructionPolicyRevision, type WorkspaceInstructionPolicyRevisionIdentity, type WorkspaceInstructionPolicyScope, type WorkspaceInstructionPolicyTarget, type WorkspaceMember, type WorkspaceMemorySearchMode, type WorkspaceMemorySearchRequest, type WorkspaceMemorySearchResponse, type WorkspaceMemorySearchResult, type WorkspaceModelCatalogModel, type WorkspaceModelCatalogResponse, type WorkspaceRegisteredPack, type WorkspaceRevisionCapturedPayload, type WorkspaceRevisionDegradedPayload, type WorkspaceSettings, type WorkspaceTranscriptionPolicy, type WorkspaceTranscriptionTarget, applyUrlRotation, authorizeTranscriptionAdapter, createTranscriptionSessionRequest, desktopSocketUrl, formatSseEvent, isRetryableStreamError, nextDesktopState, normalizeMcpOutput, normalizeWorkspaceInstructionPolicyRoleKey, parseSseStream, proxySessionEventStream, resolveWorkspaceTranscriptionPolicy, resumeSequenceFromRequest, sessionEventsToSseResponse, sessionEventsToSseStream, streamSessionEvents, streamWorkspaceControlEvents, terminalSocketUrl, ttydAuthFrame, ttydInputFrame, ttydResizeFrame };
+export { OpenGeniClient } from "./client";
+export type { FetchLike, OpenGeniClientOptions, OpenGeniRequestOptions, SendMessageInput, SteerMessageResult, TranscribeAudioInput, WorkspaceControlEventPage, } from "./client";
+export { OpenGeniApiContractMismatchError, OpenGeniApiError, OpenGeniSessionListCursorError, OpenGeniStreamError, isRetryableStreamError, } from "./errors";
+export { formatSseEvent, proxySessionEventStream, resumeSequenceFromRequest, sessionEventsToSseResponse, sessionEventsToSseStream, } from "./proxy";
+export type { ProxySessionEventStreamOptions, SseReStreamOptions } from "./proxy";
+export { parseSseStream } from "./sse";
+export type { SseMessage } from "./sse";
+export { normalizeMcpOutput } from "./mcp-output";
+export type { NormalizedMcpOutput } from "./mcp-output";
+export { desktopSocketUrl, nextDesktopState, applyUrlRotation } from "./desktop";
+export type { DesktopRfbLike, DesktopRfbFactory, DesktopConnectionState, DesktopStreamEvent, } from "./desktop";
+export { terminalSocketUrl, ttydAuthFrame, ttydInputFrame, ttydResizeFrame, TTYD_SUBPROTOCOL, TtydClientCommand, TtydServerCommand, } from "./terminal";
+export { streamSessionEvents } from "./stream";
+export type { SessionEventStreamTransport, StreamConnectionState, StreamSessionEventsOptions, } from "./stream";
+export { streamWorkspaceControlEvents } from "./workspace-control-stream";
+export type { WorkspaceControlStreamTransport } from "./workspace-control-stream";
+export { normalizeWorkspaceInstructionPolicyRoleKey } from "./workspace-instruction-policies";
+export type { ActivateWorkspaceInstructionPolicyRequest, CreateWorkspaceInstructionPolicyDraftRequest, ImportLegacyWorkspaceInstructionPolicyDraftRequest, RollbackWorkspaceInstructionPolicyRequest, WorkspaceInstructionPolicyActivationEvent, WorkspaceInstructionPolicyActivationResponse, WorkspaceInstructionPolicyActivationType, WorkspaceInstructionPolicyConflictResponse, WorkspaceInstructionPolicyDiffRequest, WorkspaceInstructionPolicyDiffResponse, WorkspaceInstructionPolicyDraftProvenanceSource, WorkspaceInstructionPolicyHead, WorkspaceInstructionPolicyKind, WorkspaceInstructionPolicyListOptions, WorkspaceInstructionPolicyListResponse, WorkspaceInstructionPolicyProvenanceSource, WorkspaceInstructionPolicyRevision, WorkspaceInstructionPolicyRevisionIdentity, WorkspaceInstructionPolicyScope, WorkspaceInstructionPolicyTarget, } from "./workspace-instruction-policies";
+export type { WorkspaceStateDocumentStatusCounts, WorkspaceStateGapCode, WorkspaceStateMemoryKindCounts, WorkspaceStateMemoryStatusCounts, WorkspaceStateResponse, WorkspaceStateSourceKindCounts, } from "./workspace-state";
+export { normalizePreferenceRegistryStableKey } from "./preference-registry";
+export type { ActivatePreferenceRegistryRevisionRequest, ChangePreferenceRegistryScopeRequest, CorrectPreferenceRegistryRequest, CreatePreferenceRegistryProposalRequest, DeactivatePreferenceRegistryRequest, PreferenceRegistryConflictStrategy, PreferenceRegistryDescriptor, PreferenceRegistryDescriptorProvenance, PreferenceRegistryDetailResponse, PreferenceRegistryEvent, PreferenceRegistryFullContent, PreferenceRegistryListOptions, PreferenceRegistryListResponse, PreferenceRegistryMutationResponse, PreferenceRegistryPrecedence, PreferenceRegistryProvenanceSource, PreferenceRegistryRecord, PreferenceRegistryRevisionSummary, PreferenceRegistryScope, PreferenceRegistryScopeTarget, PreferenceRegistrySnapshot, PreferenceRegistryStatus, PreferenceRegistryTrust, RejectPreferenceRegistryProposalRequest, SupersedePreferenceRegistryRequest, } from "./preference-registry";
+export { DEFAULT_WORKSPACE_TRANSCRIPTION_POLICY, authorizeTranscriptionAdapter, createTranscriptionSessionRequest, resolveWorkspaceVoiceInputEnabled, resolveWorkspaceTranscriptionPolicy, } from "./transcription";
+export type { TranscriptionAdapter, TranscriptionAdapterDescriptor, TranscriptionAdapterStartContext, TranscriptionAuthorization, TranscriptionCredentialMode, TranscriptionDiagnostic, TranscriptionErrorCode, TranscriptionEvent, TranscriptionEventListener, TranscriptionLifecycleStatus, TranscriptionPolicyBlockReason, TranscriptionResultMetadata, TranscriptionSession, TranscriptionSessionRequest, TranscriptionSpeaker, TranscriptionTargetSelection, TranscriptionTimeSpan, TranscriptionWord, WorkspaceTranscriptionPolicy, WorkspaceTranscriptionTarget, } from "./transcription";
+export { KNOWN_PERMISSIONS, KNOWN_USAGE_EVENT_TYPES, OPENGENI_API_CONTRACT_HEADER, OPENGENI_API_CONTRACT_REVISION, OPENGENI_CORRELATION_HEADER, RETAINED_OUTPUT_DEFAULT_PAGE_BYTES, RETAINED_OUTPUT_MAX_PAGE_BYTES, SESSION_EVENT_TYPES, } from "./types";
+export type { AccessContext, AccessGrant, AccountGrant, AccountRole, AddWorkspaceMemberRequest, AgentMessageCompletedPayload, AgentTextDeltaPayload, AgentToolCallCreatedPayload, AgentToolCallOutputPayload, ApiKey, BillingBalance, BillingEntitlementsResponse, BillingMode, BillingSummary, BillingUsageResponse, InsightsRange, InsightsBillingPath, InsightsModelUsageRow, InsightsSeriesPoint, InsightsDepthBucket, InsightsModelFacet, InsightsSpendDriver, InsightsWarmGroupRow, InsightsLiveWarmLease, InsightsFloorSession, InsightsScheduleRow, WorkspaceInsightsSnapshot, WorkspaceInsightsResponse, CapabilityCatalogItem, CapabilityCatalogResponse, CapabilityInstallation, CapabilityInstallationStatus, CapabilityKind, CapabilityPack, CapabilityPackConnector, CapabilityPackConnectorAuthModel, CapabilityPackVariableSetSpec, CapabilityPackKnowledge, CapabilityPackScheduledTaskTemplate, CapabilityPackSkill, CapabilityPackSkillFile, CapabilityRuntime, CapabilitySource, CapabilityUnavailableReason, ClientConfig, ClientVoiceInputConfig, ClientModel, ModelAvailabilityV1, ModelBillingAttributionV1, ModelCapabilitiesV1, ModelCapabilityStateV1, ModelCapabilitySupportV1, ModelCredentialReadinessV1, ModelCredentialSourceV1, ModelPricingScheduleV1, ModelPricingV1, WorkspaceModelCatalogModel, WorkspaceModelCatalogResponse, CodexAccount, CodexAccountOverview, CodexAccountsResponse, CodexAllocatorUpdate, CodexAccountSwitchedPayload, CodexConnectionStatus, CodexConnectStart, CodexConnectPoll, CodexFleetConfidence, CodexFleetCacheState, CodexFleetDecisionEventPayload, CodexFleetDecisionScore, CodexFleetShadowComparison, CodexOverviewResponse, CodexResetCredit, CodexResetRedemptionRecovery, CodexRotationSettings, CodexUsage, CodexUsageMap, CodexUsagePayload, CodexUsageWindow, CompactSessionContextResult, ClientSessionEventInput, CompleteFileUploadResponse, ConnectionKind, ConnectionMetadata, ConnectionResponse, ConnectionStatus, AddDocumentRequest, CreateApiKeyRequest, CreateApiKeyResponse, CreateCapabilityCatalogItemRequest, OpenGeniSlackBotInstallRequest, OpenGeniSlackBotInstallStart, CreateConnectionRequest, CreateCheckoutRequest, CreateCheckoutResponse, CreateDocumentBaseRequest, CreateFileUploadRequest, CreateFileUploadResponse, CreateGitHubAppManifestRequest, CreateGitHubAppManifestResponse, CreateKnowledgeDropRequest, CreateKnowledgeMemoryRequest, CreateScheduledTaskRequest, CreateSessionRequest, CreateVariableSetRequest, CreateWorkspaceEnvironmentRequest, CreateWorkspaceRequest, DiscoverMcpCapabilitiesResponse, Document, DocumentBase, DocumentCuration, DocumentCurationStatus, DocumentSearchMode, DocumentSearchRequest, DocumentSearchResponse, DocumentSearchResult, DocumentStatus, DocumentVisibility, MoveDocumentRequest, EnableCapabilityRequest, EnablePackRequest, Entitlements, EntitlementValue, EntitlementsMode, FileAsset, HumanInputAnswer, HumanInputOption, HumanInputQuestion, HumanInputQuestionKind, HumanInputResponse, FileDownloadUrlResponse, FileResourceRef, FileStatus, FileUploadData, FirstPartyMcpToolName, GetPackResponse, GitHubAppInfo, GitHubAppSetupMode, GitHubBindingStatus, GitHubInstallationBinding, GitHubInstallationLifecycle, GitHubRepositoriesResponse, GoogleDriveBrowseItem, GoogleDriveBrowseResponse, GoogleDriveConnectionMetadata, GoogleDriveOAuthStartRequest, GoogleDriveOAuthStartResponse, GoogleDriveReadPolicy, GoogleDriveSelectedSource, GoogleDriveSyncCadence, GoogleDriveTargetScope, GitHubRepository, GitHubRepositoryScope, GoalSpec, IntegrationClientMetadata, KnownPermission, KnownSessionEventType, KnownUsageEventType, KnowledgeMemory, KnowledgeMemoryKind, KnowledgeMemorySearchRequest, KnowledgeMemoryStatus, KnowledgeSourceKind, KnowledgeSourceRef, GitCredentialProvider, GitCredentialBindingId, GitRepositoryAccess, ListApiKeysResponse, ListConnectionsResponse, ListPacksResponse, ListWorkspaceMembersResponse, McpServerConnectionRef, OAuthStartRequest, OAuthStartResponse, PackInstallation, PackInstallationStatus, Permission, ProductAccessMode, LatencyMode, ReasoningEffort, RetainedArtifactContent, RetainedArtifactContentOptions, RetainedArtifactMetadata, RetainedArtifactReference, RetainedArtifactUnavailable, RetainedOutputKind, RetainedOutputUnavailableReason, RecordingAvailablePayload, RecordingCodec, RecordingContentType, RecordingFailedPayload, RecordingFailedReason, RecordingMode, RecordingStartedPayload, RegisterCapabilityPackRequest, RepositoryResourceRef, ResourceRef, SaveGoogleDriveSourceRequest, SandboxBackend, SandboxCapabilityName, SandboxOs, ScheduledTask, ScheduledTaskAgentConfig, ScheduledTaskAgentConfigInput, ScheduledTaskDayOfWeek, ScheduledTaskOverlapPolicy, ScheduledTaskRun, ScheduledTaskRunMode, ScheduledTaskRunStatus, ScheduledTaskScheduleSpec, ScheduledTaskStatus, ScheduledTaskTriggerType, Session, SessionCapabilities, SessionListResponse, SessionLineageResponse, SessionEffectiveToolPolicy, SessionQueueMutationResponse, SessionQueueSnapshot, SessionControlResponse, ComposerDraft, DeleteSessionQueueItemRequest, EditSessionQueueItemRequest, EffectiveControlBlocker, EffectiveControlResumeOption, EffectiveSessionControl, MoveSessionQueueItemRequest, NewSessionDraft, NewSessionDraftOptions, SaveComposerDraftRequest, SaveNewSessionDraftRequest, SessionCommandReceipt, SteerSessionQueueItemRequest, WorkspaceInferenceControlResponse, SessionPendingInputPreview, SessionSystemUpdate, SessionSystemUpdateKind, SessionSystemUpdateState, SessionSummary, LineageNode, SessionMcpCredentialUpdateInput, SessionMcpApprovalPolicy, SessionMcpServerInput, SessionMcpServerMetadata, SessionToolPolicy, FileSystemCapability, TerminalCapability, GitCapability, DesktopStreamCapability, RecordingCapability, ComputerUseCapability, ClientAuthConfig, StreamUrlRotatedPayload, StreamOpenedPayload, StreamClosedPayload, StreamRevokedPayload, AttachViewerRequest, AttachViewerResponse, ViewerHolder, AcknowledgeStreamRequest, AcknowledgeStreamResponse, ViewerHeartbeatRequest, ViewerHeartbeatResponse, SessionEvent, SessionEventCompactResult, SessionEventCompactResultOptions, SessionEventListOptions, SessionEventLatestClass, SessionEventPage, SessionEventPayloadMode, SessionEventReadDirection, SessionEventReadMode, SessionEventResultMode, SessionEventSemanticClass, SessionEventType, SessionGoal, SessionGoalCreatedBy, SessionGoalStatus, SessionHumanInputRequest, SessionStatus, SessionStatusChangedPayload, SessionStructuredCapabilities, SessionTurn, ServiceTurnInitiator, ServiceTurnInitiatorContext, SessionTurnSource, SessionTurnStatus, SubmitHumanInputResponseRequest, TurnInitiator, ToolAuthNeededPayload, UpdateConnectionRequest, SandboxCommandOutputDeltaPayload, FsChangeKind, FsChangedPayload, GitChangedPayload, TerminalPtyStartedPayload, TerminalPtyOutputDeltaPayload, TerminalPtyExitedPayload, FsNodeType, FsTreeNode, FsEncoding, FsListRequest, FsListResponse, FsReadRequest, FsReadResponse, FsWriteRequest, FsWriteResponse, FsDeleteRequest, FsDeleteResponse, FsMoveRequest, FsMoveResponse, FsMkdirRequest, FsMkdirResponse, GitFileStatusCode, GitFileStatus, GitStatusRequest, GitStatusResponse, GitDiffLineType, GitDiffLine, GitDiffHunk, GitFileDiff, GitDiffRequest, GitDiffResponse, GitLogRequest, GitCommit, GitLogResponse, GitShowRequest, GitShowResponse, SetWorkspaceEnvironmentVariableRequest, WorkspaceCaptureFile, WorkspaceCaptureRepo, WorkspaceCaptureDegradedReason, WorkspaceCaptureStats, WorkspaceCaptureManifest, WorkspaceRevisionCapturedPayload, WorkspaceRevisionDegradedPayload, WorkspaceCaptureSignedUrl, GetWorkspaceCaptureResponse, GetWorkspaceCaptureFileResponse, TerminalExecRequest, TerminalExecResponse, PtyOpenRequest, PtyOpenResponse, PtyWriteRequest, PtyResizeRequest, PtyCloseRequest, ToolRef, UpdateKnowledgeMemoryRequest, UpdateScheduledTaskRequest, UpdateSessionGoalRequest, UpdateSessionMcpApprovalPolicyRequest, UpdateSessionMcpApprovalPolicyResponse, UpdateSessionPinRequest, UpdateSessionRequest, UpdateSessionToolPolicyRequest, UpdateVariableSetRequest, UpdateWorkspaceEnvironmentRequest, UpdateWorkspaceMemberRequest, UpdateWorkspaceRequest, UpdateWorkspaceSettingsRequest, TranscribeAudioResponse, UploadFileInput, UsageEvent, UsageEventType, UserApprovalDecisionEventInput, UserHumanInputResponseEventInput, UserMessageEventInput, Workspace, WorkspaceControlEvent, VariableSet, VariableSetVariableMetadata, Rig, RigVersion, RigCheck, RigChange, RigChangeKind, RigChangeStatus, RigCheckResult, RigChangeVerification, CreateRigRequest, UpdateRigRequest, RigSetupAppendPayload, RigDefinitionEditPayload, ProposeRigChangeRequest, WorkspaceEnvironment, WorkspaceEnvironmentVariableMetadata, WorkspaceMember, WorkspaceMemorySearchMode, WorkspaceMemorySearchRequest, WorkspaceMemorySearchResult, WorkspaceMemorySearchResponse, WorkspaceSettings, WorkspaceVoiceInputSettings, WorkspaceRegisteredPack, MetricSample, MachineState, MachineKind, MachineView, MachinesResponse, MachineMetricsSeriesResponse, SwapActiveSandboxRequest, SwapActiveSandboxResponse, EnrollmentOs, DeviceEnrollmentLookupRequest, DeviceEnrollmentLookupResponse, DeviceEnrollmentLookupMachine, DeviceEnrollmentApproveRequest, DeviceEnrollmentApproveResponse, DeviceEnrollmentDenyRequest, DeviceEnrollmentDenyResponse, MintEnrollTokenRequest, MintEnrollTokenResponse, EnrollmentCredentials, EnrollTokenExchangeRequest, EnrollTokenExchangeResponse, } from "./types";