@opengeni/sdk 0.46.0 → 0.52.1

package/src/client.ts

@@ -12,6 +12,48 @@ import {
   streamWorkspaceControlEvents,
   type WorkspaceControlStreamTransport,
 } from "./workspace-control-stream";
+import {
+  OpenGeniInteractionClient,
+  type AttachedBrowserDevice,
+  type AttachedBrowserDeviceListOptions,
+  type AttachedBrowserDeviceListResponse,
+  type BrowserActionReceipt,
+  type BrowserActionRequest,
+  type BrowserDiagnosticBatch,
+  type BrowserDiagnosticsOptions,
+  type BrowserIdentity,
+  type BrowserIdentityListOptions,
+  type BrowserIdentityListResponse,
+  type BrowserIdentityMutationResponse,
+  type BrowserObservation,
+  type BrowserOpenTargetRequest,
+  type BrowserSession,
+  type BrowserSessionAttachment,
+  type BrowserSessionAttachmentRequest,
+  type BrowserSessionHeartbeatResponse,
+  type BrowserSessionLifecycleRequest,
+  type BrowserSessionListResponse,
+  type BrowserSessionMutationResponse,
+  type BrowserTarget,
+  type BrowserTargetListResponse,
+  type BrowserRevisionListResponse,
+  type ComputerActionReceipt,
+  type ComputerActionRequest,
+  type ComputerObservation,
+  type ComputerSession,
+  type ComputerSessionAttachment,
+  type ComputerSessionAttachmentRequest,
+  type ComputerSessionHeartbeatResponse,
+  type ComputerSessionLifecycleRequest,
+  type ComputerSessionListResponse,
+  type ComputerSessionMutationResponse,
+  type ComputerTargetListResponse,
+  type CreateBrowserIdentityRequest,
+  type CreateBrowserSessionRequest,
+  type CreateComputerSessionRequest,
+  type PublishBrowserRevisionRequest,
+  type PublishBrowserRevisionResponse,
+} from "./interaction";
 import type {
   AccessContext,
   ActivateCodexRealtimeConnectionRequest,
@@ -41,6 +83,29 @@ import type {
   CapabilityCatalogItem,
   CapabilityCatalogResponse,
   CapabilityInstallation,
+  ApiIntegrationPreview,
+  ApiIntegrationOAuthStartRequest,
+  ApiIntegrationUninstallPreview,
+  InstallApiIntegrationRequest,
+  InstalledApiIntegration,
+  IntegrationFeatureMutationResult,
+  IntegrationFeatureRemovalResult,
+  IntegrationInstanceFeaturesResponse,
+  ListApiIntegrationPresetsResponse,
+  ListApiIntegrationsResponse,
+  MutateIntegrationFeatureRequest,
+  PreviewApiIntegrationRequest,
+  UninstallApiIntegrationRequest,
+  UninstallApiIntegrationResult,
+  UpsertIntegrationFeatureRequest,
+  PreviewPluginRequest,
+  PluginPreview,
+  InstallPluginRequest,
+  InstalledPlugin,
+  ListInstalledPluginsResponse,
+  PluginUninstallPreview,
+  UninstallPluginRequest,
+  UninstallPluginResult,
   AddDocumentRequest,
   CreateKnowledgeDropRequest,
   MoveDocumentRequest,
@@ -54,6 +119,8 @@ import type {
   CreateApiKeyRequest,
   CreateApiKeyResponse,
   CreateCapabilityCatalogItemRequest,
+  InstallSkillRequest,
+  InstalledSkill,
   CreateCheckoutRequest,
   CreateCheckoutResponse,
   OpenGeniSlackBotInstallRequest,
@@ -91,7 +158,9 @@ import type {
   GetPackResponse,
   GitHubAppInfo,
   GitHubRepositoriesResponse,
+  GoogleDriveBrowseResponse,
   GoogleDriveDisconnectRequest,
+  SaveGoogleDriveIntegrationSourceRequest,
   GoogleDriveLifecycleActionRequest,
   KnowledgeMemory,
   KnowledgeMemorySearchRequest,
@@ -101,23 +170,48 @@ import type {
   MachinesResponse,
   MetricSample,
   MachineMetricsSeriesResponse,
+  RemoveEnrollmentRequest,
+  RemoveEnrollmentResponse,
   // Bring-your-own-compute: the user-authenticated active-sandbox swap (M7).
   SwapActiveSandboxRequest,
   SwapActiveSandboxResponse,
   ListWorkspaceMembersResponse,
+  InstallPackRequest,
+  PackInstallationPreview,
+  ListSlackUserLinkAccessRequestsResponse,
+  PrepareSlackUserLinkAccessRequest,
+  SlackUserLinkAccessMutationRequest,
+  SlackUserLinkAccessRequest,
+  ApproveSlackUserLinkAccessRequest,
   PackInstallation,
+  PackUninstallPreview,
   LatencyMode,
   ReasoningEffort,
+  RetainedScreenshotDownload,
+  RetainedScreenshotDownloadOptions,
+  RetainedArtifactDownload,
+  RetainedArtifactDownloadOptions,
+  RetainedArtifactReference,
   RetainedArtifactContent,
   RetainedArtifactContentOptions,
   RetainedArtifactMetadata,
+  UpdateVideoGenerationPolicyRequest,
+  VideoArtifactPlaybackSource,
+  VideoGenerationOperationSummary,
+  VideoGenerationPolicy,
+  WorkspaceVideoGenerationSettings,
   RegisterCapabilityPackRequest,
   ResourceRef,
+  PreviewPackInstallationRequest,
+  PreviewSkillImportRequest,
   ScheduledTask,
   ScheduledTaskRun,
   Session,
   SessionListResponse,
+  AgentTopologyPageResponse,
   UpdateSessionPinRequest,
+  UninstallPackRequest,
+  UninstallPackResult,
   SessionEvent,
   SessionEventCompactResult,
   SessionEventCompactResultOptions,
@@ -131,6 +225,7 @@ import type {
   SyncSessionRealtimeLedgerResponse,
   RenewSessionRealtimeRequest,
   SessionMcpCredentialUpdateInput,
+  SubmittedTimelineAnnotation,
   UpdateSessionMcpApprovalPolicyRequest,
   UpdateSessionMcpApprovalPolicyResponse,
   SessionQueueSnapshot,
@@ -159,6 +254,8 @@ import type {
   // Channel-A structured services (P4.4).
   FsListRequest,
   FsListResponse,
+  FsListBatchRequest,
+  FsListBatchResponse,
   FsReadRequest,
   FsReadResponse,
   FsWriteRequest,
@@ -173,6 +270,8 @@ import type {
   GitStatusResponse,
   GitDiffRequest,
   GitDiffResponse,
+  GitReadBatchRequest,
+  GitReadBatchResponse,
   GitLogRequest,
   GitLogResponse,
   GitShowRequest,
@@ -206,6 +305,7 @@ import type {
   SetWorkspaceDefaultRigRequest,
   UploadFileInput,
   VariableSet,
+  VariableSetSecret,
   VariableSetVariableMetadata,
   Rig,
   RigVersion,
@@ -217,12 +317,20 @@ import type {
   WorkspaceRegisteredPack,
   Workspace,
   ListConnectionsResponse,
+  ListSlackInstallationBindingsResponse,
+  SlackInstallationBinding,
   ConnectionResponse,
   OAuthStartRequest,
   OAuthStartResponse,
   SocialConnection,
   SocialOAuthStartRequest,
+  SkillImportPreview,
+  SkillUninstallPreview,
+  UninstallSkillRequest,
+  UninstallSkillResult,
 } from "./types";
+import { GENERATED_VIDEO_MAX_BYTES } from "./types";
+import { parseRetainedGeneratedImageReference } from "./retained-artifacts";
 import type {
   ActivateWorkspaceInstructionPolicyRequest,
   CreateWorkspaceInstructionPolicyDraftRequest,
@@ -239,6 +347,17 @@ import type {
   WorkspaceInstructionPolicyOnboardingProposalListResponse,
   WorkspaceInstructionPolicyRevision,
 } from "./workspace-instruction-policies";
+import type {
+  ActivateCompanyProfileRevisionRequest,
+  CompanyProfileDiffRequest,
+  CompanyProfileDiffResponse,
+  CompanyProfileListOptions,
+  CompanyProfileListResponse,
+  CompanyProfileMutationResponse,
+  CompanyProfileRevision,
+  RollbackCompanyProfileRequest,
+  UpdateCompanyProfileRequest,
+} from "./company-profile";
 import type {
   WorkspaceStateExportResponse,
   WorkspaceStateGetOptions,
@@ -264,6 +383,7 @@ import {
   OPENGENI_API_CONTRACT_HEADER,
   OPENGENI_API_CONTRACT_REVISION,
   OPENGENI_CORRELATION_HEADER,
+  COMPUTER_SCREENSHOT_MAX_BYTES,
   RETAINED_OUTPUT_MAX_PAGE_BYTES,
 } from "./types";
 
@@ -305,6 +425,7 @@ export type OpenGeniRequestOptions = {
 
 export type SendMessageInput = {
   text: string;
+  annotations?: SubmittedTimelineAnnotation[];
   /** System instructions scoped to this exact turn; never visible timeline text. */
   turnInstructions?: string;
   resources?: ResourceRef[];
@@ -323,6 +444,10 @@ export type SteerMessageResult = {
   accepted: SessionEvent;
   /** The exact turn created for this message in the same server transaction. */
   turn: SessionTurn;
+  /** Number of live attempts durably asked to stop by this atomic Steer. */
+  interruptionCount?: number;
+  /** True when this response came from the command's immutable idempotency receipt. */
+  replay?: boolean;
 };
 
 export type TranscribeAudioInput = {
@@ -363,12 +488,17 @@ export class OpenGeniClient {
   private readonly baseUrl: string;
   private readonly options: OpenGeniClientOptions;
   private readonly fetchImpl: FetchLike;
+  private readonly readInFlight = new Map<string, Promise<unknown>>();
+  private readonly readTrailing = new Map<string, Promise<unknown>>();
+  /** Resource-oriented Browser/Computer facade over this exact authenticated client. */
+  readonly interaction: OpenGeniInteractionClient;
 
   constructor(options: OpenGeniClientOptions) {
     this.baseUrl = options.baseUrl.replace(/\/+$/, "");
     this.options = options;
     // Bind lazily so variable sets that polyfill fetch after module load work.
     this.fetchImpl = options.fetch ?? ((input, init) => fetch(input, init));
+    this.interaction = new OpenGeniInteractionClient(this);
   }
 
   // --- Session lifecycle ---------------------------------------------------
@@ -385,8 +515,12 @@ export class OpenGeniClient {
       input.audio instanceof File
         ? input.audio
         : input.audio instanceof Uint8Array
-          ? new File([Uint8Array.from(input.audio)], filename, { type: input.mimeType })
-          : new File([input.audio], filename, { type: input.mimeType || input.audio.type });
+          ? new File([Uint8Array.from(input.audio)], filename, {
+              type: input.mimeType,
+            })
+          : new File([input.audio], filename, {
+              type: input.mimeType || input.audio.type,
+            });
     form.append("audio", audio, filename);
     form.append("mimeType", input.mimeType);
     if (input.durationSeconds !== undefined) {
@@ -396,7 +530,10 @@ export class OpenGeniClient {
     try {
       response = await this.fetchImpl(this.url(`/v1/workspaces/${workspaceId}/transcriptions`), {
         method: "POST",
-        headers: { ...this.headers(correlationId), Accept: "application/json" },
+        headers: {
+          ...this.headers(correlationId),
+          Accept: "application/json",
+        },
         body: form,
         ...(input.signal ? { signal: input.signal } : {}),
       });
@@ -405,7 +542,11 @@ export class OpenGeniClient {
       throw mutationTransportError(correlationId);
     }
     assertApiContractResponse(response);
-    if (!response.ok) throw await apiErrorFromResponse(response, { method: "POST", correlationId });
+    if (!response.ok)
+      throw await apiErrorFromResponse(response, {
+        method: "POST",
+        correlationId,
+      });
     await assertJsonResponse(response, { method: "POST", correlationId });
     let body: unknown;
     try {
@@ -509,7 +650,11 @@ export class OpenGeniClient {
       throw mutationTransportError(correlationId);
     }
     assertApiContractResponse(response);
-    if (!response.ok) throw await apiErrorFromResponse(response, { method: "PUT", correlationId });
+    if (!response.ok)
+      throw await apiErrorFromResponse(response, {
+        method: "PUT",
+        correlationId,
+      });
     await assertJsonResponse(response, { method: "PUT", correlationId });
     const body = await response.json().catch(() => null);
     if (!isUploadTranscriptionRecordingChunkResponse(body)) {
@@ -603,11 +748,13 @@ export class OpenGeniClient {
     );
   }
 
-  async getSession(workspaceId: string, sessionId: string): Promise<Session> {
-    return await this.requestJson<Session>(
-      "GET",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}`,
-    );
+  async getSession(
+    workspaceId: string,
+    sessionId: string,
+    options: { fresh?: boolean } = {},
+  ): Promise<Session> {
+    const path = `/v1/workspaces/${workspaceId}/sessions/${sessionId}`;
+    return await this.singleFlightRead(path, () => this.requestJson<Session>("GET", path), options);
   }
 
   async updateSession(
@@ -740,6 +887,32 @@ export class OpenGeniClient {
     return response;
   }
 
+  /** Compact, bounded workspace agent hierarchy page. */
+  async listAgentTopology(
+    workspaceId: string,
+    options: {
+      limit?: number;
+      parentSessionId?: string | null;
+      cursor?: string;
+      search?: string;
+    } = {},
+  ): Promise<AgentTopologyPageResponse> {
+    const search = options.search?.trim();
+    return await this.requestJson<AgentTopologyPageResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/agent-topology`,
+      undefined,
+      {
+        ...(options.limit !== undefined ? { limit: String(options.limit) } : {}),
+        ...(options.parentSessionId === undefined
+          ? {}
+          : { parentSessionId: options.parentSessionId ?? "null" }),
+        ...(options.cursor ? { cursor: options.cursor } : {}),
+        ...(search ? { search } : {}),
+      },
+    );
+  }
+
   /** Set this authenticated member's personal workspace pin for a session. */
   async updateSessionPin(
     workspaceId: string,
@@ -754,12 +927,40 @@ export class OpenGeniClient {
   }
 
   async getSessionLineage(workspaceId: string, sessionId: string): Promise<SessionLineageResponse> {
-    return await this.requestJson<SessionLineageResponse>(
-      "GET",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/lineage`,
+    const path = `/v1/workspaces/${workspaceId}/sessions/${sessionId}/lineage`;
+    return await this.singleFlightRead(path, () =>
+      this.requestJson<SessionLineageResponse>("GET", path),
     );
   }
 
+  private singleFlightRead<T>(
+    key: string,
+    read: () => Promise<T>,
+    options: { fresh?: boolean } = {},
+  ): Promise<T> {
+    const existing = this.readInFlight.get(key);
+    if (existing) {
+      if (!options.fresh) return existing as Promise<T>;
+      const queued = this.readTrailing.get(key);
+      if (queued) return queued as Promise<T>;
+      const trailing = existing.then(
+        () => this.singleFlightRead(key, read),
+        () => this.singleFlightRead(key, read),
+      );
+      this.readTrailing.set(key, trailing);
+      const clear = () => {
+        if (this.readTrailing.get(key) === trailing) this.readTrailing.delete(key);
+      };
+      void trailing.then(clear, clear);
+      return trailing;
+    }
+    const promise = read().finally(() => {
+      if (this.readInFlight.get(key) === promise) this.readInFlight.delete(key);
+    });
+    this.readInFlight.set(key, promise);
+    return promise;
+  }
+
   /** Negotiate one server-mediated connected-Codex GPT-Live V3 WebRTC call. */
   async negotiateCodexRealtimeWebrtc(
     workspaceId: string,
@@ -883,7 +1084,9 @@ export class OpenGeniClient {
 
   /** Newest turn that durably emitted `turn.started`, or null before any admission. */
   async getLatestStartedTurn(workspaceId: string, sessionId: string): Promise<SessionTurn | null> {
-    const turns = await this.listTurns(workspaceId, sessionId, { latestStarted: true });
+    const turns = await this.listTurns(workspaceId, sessionId, {
+      latestStarted: true,
+    });
     return turns[0] ?? null;
   }
 
@@ -928,6 +1131,24 @@ export class OpenGeniClient {
     return response.samples;
   }
 
+  /**
+   * Remove one connected self-hosted machine enrollment. The control-plane
+   * operation works while the agent is offline, revokes future reconnects,
+   * retains history, and returns a typed blocker when active route/lease or
+   * recovery dependencies make removal unsafe. `idempotencyKey` is replay-safe.
+   */
+  async removeEnrollment(
+    workspaceId: string,
+    enrollmentId: string,
+    request: RemoveEnrollmentRequest = {},
+  ): Promise<RemoveEnrollmentResponse> {
+    return await this.requestJson<RemoveEnrollmentResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/enrollments/${enrollmentId}/revoke`,
+      request,
+    );
+  }
+
   // --- Self-hosted enrollment UX (design 11) --------------------------------
 
   /**
@@ -1350,9 +1571,9 @@ export class OpenGeniClient {
   // --- Turn queue ------------------------------------------------------------
 
   async getQueue(workspaceId: string, sessionId: string): Promise<SessionQueueSnapshot> {
-    return await this.requestJson<SessionQueueSnapshot>(
-      "GET",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/queue`,
+    const path = `/v1/workspaces/${workspaceId}/sessions/${sessionId}/queue`;
+    return await this.singleFlightRead(path, () =>
+      this.requestJson<SessionQueueSnapshot>("GET", path),
     );
   }
 
@@ -1469,7 +1690,11 @@ export class OpenGeniClient {
   async cancelSession(
     workspaceId: string,
     sessionId: string,
-    options: { reason?: string; clientEventId?: string; expectedControlEtag?: string } = {},
+    options: {
+      reason?: string;
+      clientEventId?: string;
+      expectedControlEtag?: string;
+    } = {},
   ): Promise<SessionControlResponse> {
     return await this.controlSession(workspaceId, sessionId, {
       action: "cancel",
@@ -1614,10 +1839,8 @@ export class OpenGeniClient {
 
   /** The session's goal. 404s when the session never had one. */
   async getGoal(workspaceId: string, sessionId: string): Promise<SessionGoal> {
-    return await this.requestJson<SessionGoal>(
-      "GET",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/goal`,
-    );
+    const path = `/v1/workspaces/${workspaceId}/sessions/${sessionId}/goal`;
+    return await this.singleFlightRead(path, () => this.requestJson<SessionGoal>("GET", path));
   }
 
   async updateGoal(
@@ -1703,6 +1926,22 @@ export class OpenGeniClient {
     );
   }
 
+  /** FileSystem: hydrate several independent directories behind one sandbox lease. */
+  async fsListBatch(
+    workspaceId: string,
+    sessionId: string,
+    request: FsListBatchRequest,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<FsListBatchResponse> {
+    return await this.requestJson<FsListBatchResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/fs/list-batch`,
+      request,
+      {},
+      options,
+    );
+  }
+
   /** FileSystem: read a file (text or base64; binary-safe, size-capped). */
   async fsRead(
     workspaceId: string,
@@ -1803,6 +2042,22 @@ export class OpenGeniClient {
     );
   }
 
+  /** Git: read status and optional diffs for several repositories behind one sandbox lease. */
+  async gitReadBatch(
+    workspaceId: string,
+    sessionId: string,
+    request: GitReadBatchRequest,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<GitReadBatchResponse> {
+    return await this.requestJson<GitReadBatchResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/git/read-batch`,
+      request,
+      {},
+      options,
+    );
+  }
+
   /** Git: commit log. */
   async gitLog(
     workspaceId: string,
@@ -1976,13 +2231,11 @@ export class OpenGeniClient {
   }
 
   /** Attach a viewer holder (refcounted liveness — keeps the box warm while
-   *  watched/used), spinning the box up in-process when cold, and mint the scoped
-   *  direct-to-provider URLs for the requested plane(s). `request.desktop:true`
-   *  opts into the un-redacted pixel plane and mints the noVNC URL — that plane
-   *  alone throws `OpenGeniApiError(409)` when the un-redacted/shared
-   *  acknowledgment is missing (the consent gate). A terminal-only attach
-   *  (`desktop` omitted/false) warms the box + mints the pty-ws terminal cell with
-   *  NO consent gate. An omitted `viewerId` mints a fresh one. */
+   *  watched/used), spinning the box up in-process when cold. Exact plane flags
+   *  mint only the requested short-lived credentials and enforce that plane's
+   *  permission. `desktop:true` alone carries the un-redacted/shared consent
+   *  gate. An entirely omitted plane set retains the legacy terminal-only
+   *  meaning; current clients should send all three flags. */
   async attachViewer(
     workspaceId: string,
     sessionId: string,
@@ -2019,184 +2272,669 @@ export class OpenGeniClient {
     );
   }
 
-  // --- Access + workspaces -----------------------------------------------------
-
-  /**
-   * The deployment's public client bootstrap config: the host-exposed models
-   * (provider-grouped in `models`, flat in `allowedModels` for back-compat),
-   * reasoning efforts, MCP servers, file-upload limits, and how the client is
-   * expected to authenticate. Drives a composer's model picker without prior
-   * knowledge of the host setup; safe to call before any auth is established.
-   */
-  async getClientConfig(): Promise<ClientConfig> {
-    const config = await this.requestJson<ClientConfig>("GET", "/v1/config/client");
-    if (config.apiContractRevision !== OPENGENI_API_CONTRACT_REVISION) {
-      throw new OpenGeniApiContractMismatchError(
-        OPENGENI_API_CONTRACT_REVISION,
-        String(config.apiContractRevision || "(missing)"),
-      );
-    }
-    return config;
-  }
+  // --- Browser / Computer interaction resources --------------------------------
 
-  /** Authenticated model definitions plus workspace-specific selectability. */
-  async getWorkspaceModelCatalog(workspaceId: string): Promise<WorkspaceModelCatalogResponse> {
-    return await this.requestJson<WorkspaceModelCatalogResponse>(
+  async listAttachedBrowsers(
+    workspaceId: string,
+    options: AttachedBrowserDeviceListOptions = {},
+  ): Promise<AttachedBrowserDeviceListResponse> {
+    return await this.requestJson<AttachedBrowserDeviceListResponse>(
       "GET",
-      `/v1/workspaces/${workspaceId}/model-catalog`,
+      `/v1/workspaces/${workspaceId}/attached-browsers`,
+      undefined,
+      options.includeDisconnected ? { includeDisconnected: "true" } : {},
+      options,
     );
   }
 
-  /** Authenticated realtime voice models and credential readiness. */
-  async getWorkspaceRealtimeModelCatalog(
+  async getAttachedBrowser(
     workspaceId: string,
-  ): Promise<WorkspaceRealtimeModelCatalogResponse> {
-    return await this.requestJson<WorkspaceRealtimeModelCatalogResponse>(
+    deviceId: string,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<AttachedBrowserDevice> {
+    return await this.requestJson<AttachedBrowserDevice>(
       "GET",
-      `/v1/workspaces/${workspaceId}/realtime-model-catalog`,
+      `/v1/workspaces/${workspaceId}/attached-browsers/${encodeURIComponent(deviceId)}`,
+      undefined,
+      {},
+      options,
     );
   }
 
-  /** The caller's access context: subject, account + workspace grants, defaults. */
-  async getAccessContext(): Promise<AccessContext> {
-    return await this.requestJson<AccessContext>("GET", "/v1/access/me");
-  }
-
-  async listWorkspaces(): Promise<Workspace[]> {
-    return await this.requestJson<Workspace[]>("GET", "/v1/workspaces");
-  }
-
-  async createWorkspace(request: CreateWorkspaceRequest): Promise<Workspace> {
-    return await this.requestJson<Workspace>("POST", "/v1/workspaces", request);
-  }
-
-  async getWorkspace(workspaceId: string): Promise<Workspace> {
-    return await this.requestJson<Workspace>("GET", `/v1/workspaces/${workspaceId}`);
+  async listBrowserIdentities(
+    workspaceId: string,
+    options: BrowserIdentityListOptions = {},
+  ): Promise<BrowserIdentityListResponse> {
+    return await this.requestJson<BrowserIdentityListResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/browser-identities`,
+      undefined,
+      options.includeArchived ? { includeArchived: "true" } : {},
+      options,
+    );
   }
 
-  /** Read-time, secret-safe inventory of policy heads and visible workspace knowledge. */
-  async getWorkspaceState(
+  async getBrowserIdentity(
     workspaceId: string,
-    options: WorkspaceStateGetOptions = {},
-  ): Promise<WorkspaceStateResponse> {
-    const params = new URLSearchParams();
-    if (options.attemptId) params.set("attemptId", options.attemptId);
-    const query = params.size > 0 ? `?${params.toString()}` : "";
-    return await this.requestJson<WorkspaceStateResponse>(
+    identityId: string,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<BrowserIdentity> {
+    return await this.requestJson<BrowserIdentity>(
       "GET",
-      `/v1/workspaces/${workspaceId}/workspace-state${query}`,
+      `/v1/workspaces/${workspaceId}/browser-identities/${encodeURIComponent(identityId)}`,
+      undefined,
+      {},
+      options,
     );
   }
 
-  /** Download the canonical, explicitly sanitized Workspace State export. */
-  async exportWorkspaceState(
+  async createBrowserIdentity(
     workspaceId: string,
-    options: WorkspaceStateGetOptions = {},
-  ): Promise<WorkspaceStateExportResponse> {
-    const params = new URLSearchParams();
-    if (options.attemptId) params.set("attemptId", options.attemptId);
-    const query = params.size > 0 ? `?${params.toString()}` : "";
-    return await this.requestJson<WorkspaceStateExportResponse>(
-      "GET",
-      `/v1/workspaces/${workspaceId}/workspace-state/export${query}`,
+    request: CreateBrowserIdentityRequest,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<BrowserIdentityMutationResponse> {
+    return await this.requestJson<BrowserIdentityMutationResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/browser-identities`,
+      request,
+      {},
+      options,
     );
   }
 
-  async updateWorkspace(workspaceId: string, request: UpdateWorkspaceRequest): Promise<Workspace> {
-    return await this.requestJson<Workspace>("PATCH", `/v1/workspaces/${workspaceId}`, request);
+  async listBrowserRevisions(
+    workspaceId: string,
+    identityId: string,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<BrowserRevisionListResponse> {
+    return await this.requestJson<BrowserRevisionListResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/browser-identities/${encodeURIComponent(identityId)}/revisions`,
+      undefined,
+      {},
+      options,
+    );
   }
 
-  /** Inspect immutable instruction-policy history, active heads, and activation audit evidence. */
-  async listWorkspaceInstructionPolicies(
+  /** Workspace-wide BrowserSession inventory. Associations express relevance,
+   *  not access: peers and child agents intentionally remain discoverable. */
+  async listBrowserSessions(
     workspaceId: string,
-    options: WorkspaceInstructionPolicyListOptions = {},
-  ): Promise<WorkspaceInstructionPolicyListResponse> {
-    const params = new URLSearchParams();
-    if (options.kind !== undefined) params.set("kind", options.kind);
-    if (options.scope !== undefined) params.set("scope", options.scope);
-    if (options.roleKey !== undefined) params.set("roleKey", options.roleKey);
-    if (options.afterRevision !== undefined) {
-      params.set("afterRevision", String(options.afterRevision));
-    }
-    if (options.limit !== undefined) params.set("limit", String(options.limit));
-    const query = params.toString();
-    return await this.requestJson<WorkspaceInstructionPolicyListResponse>(
+    options: OpenGeniRequestOptions = {},
+  ): Promise<BrowserSessionListResponse> {
+    return await this.requestJson<BrowserSessionListResponse>(
       "GET",
-      `/v1/workspaces/${workspaceId}/instruction-policies${query ? `?${query}` : ""}`,
+      `/v1/workspaces/${workspaceId}/browser-sessions`,
+      undefined,
+      {},
+      options,
     );
   }
 
-  async getWorkspaceInstructionPolicyRevision(
+  async getBrowserSession(
     workspaceId: string,
-    revisionId: string,
-  ): Promise<WorkspaceInstructionPolicyRevision> {
-    return await this.requestJson<WorkspaceInstructionPolicyRevision>(
+    browserSessionId: string,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<BrowserSession> {
+    return await this.requestJson<BrowserSession>(
       "GET",
-      `/v1/workspaces/${workspaceId}/instruction-policies/${encodeURIComponent(revisionId)}`,
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}`,
+      undefined,
+      {},
+      options,
     );
   }
 
-  async createWorkspaceInstructionPolicyDraft(
+  async createBrowserSession(
     workspaceId: string,
-    request: CreateWorkspaceInstructionPolicyDraftRequest,
-  ): Promise<WorkspaceInstructionPolicyRevision> {
-    return await this.requestJson<WorkspaceInstructionPolicyRevision>(
+    request: CreateBrowserSessionRequest,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<BrowserSessionMutationResponse> {
+    return await this.requestJson<BrowserSessionMutationResponse>(
       "POST",
-      `/v1/workspaces/${workspaceId}/instruction-policies/drafts`,
+      `/v1/workspaces/${workspaceId}/browser-sessions`,
       request,
+      {},
+      options,
     );
   }
 
-  /** List the newest immutable onboarding proposals and their inactive policy drafts. */
-  async listWorkspaceInstructionPolicyOnboardingProposals(
+  async listBrowserTargets(
     workspaceId: string,
-    options: WorkspaceInstructionPolicyOnboardingProposalListOptions = {},
-  ): Promise<WorkspaceInstructionPolicyOnboardingProposalListResponse> {
-    const params = new URLSearchParams();
-    if (options.limit !== undefined) params.set("limit", String(options.limit));
-    const query = params.toString();
-    return await this.requestJson<WorkspaceInstructionPolicyOnboardingProposalListResponse>(
+    browserSessionId: string,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<BrowserTargetListResponse> {
+    return await this.requestJson<BrowserTargetListResponse>(
       "GET",
-      `/v1/workspaces/${workspaceId}/instruction-policies/onboarding-proposals${query ? `?${query}` : ""}`,
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/targets`,
+      undefined,
+      {},
+      options,
     );
   }
 
-  /** Create one draft-only proposal against an exact active-policy baseline. */
-  async createWorkspaceInstructionPolicyOnboardingProposal(
+  async openBrowserTarget(
     workspaceId: string,
-    request: CreateWorkspaceInstructionPolicyOnboardingProposalRequest,
-  ): Promise<WorkspaceInstructionPolicyOnboardingProposal> {
-    return await this.requestJson<WorkspaceInstructionPolicyOnboardingProposal>(
+    browserSessionId: string,
+    request: BrowserOpenTargetRequest = {},
+    options: OpenGeniRequestOptions = {},
+  ): Promise<BrowserTarget> {
+    return await this.requestJson<BrowserTarget>(
       "POST",
-      `/v1/workspaces/${workspaceId}/instruction-policies/onboarding-proposals`,
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/targets`,
       request,
+      {},
+      options,
     );
   }
 
-  /** Import the stored legacy workspace override as an inactive charter draft. */
-  async importLegacyWorkspaceInstructionPolicyDraft(
+  async selectBrowserTarget(
     workspaceId: string,
-    request: ImportLegacyWorkspaceInstructionPolicyDraftRequest = {},
-  ): Promise<WorkspaceInstructionPolicyRevision> {
-    return await this.requestJson<WorkspaceInstructionPolicyRevision>(
+    browserSessionId: string,
+    targetId: string,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<BrowserTarget> {
+    return await this.requestJson<BrowserTarget>(
       "POST",
-      `/v1/workspaces/${workspaceId}/instruction-policies/import-legacy`,
-      request,
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/targets/${encodeURIComponent(targetId)}/select`,
+      {},
+      {},
+      options,
     );
   }
 
-  async diffWorkspaceInstructionPolicyRevisions(
+  async closeBrowserTarget(
     workspaceId: string,
-    request: WorkspaceInstructionPolicyDiffRequest,
-  ): Promise<WorkspaceInstructionPolicyDiffResponse> {
-    const params = new URLSearchParams({
-      fromRevisionId: request.fromRevisionId,
-      toRevisionId: request.toRevisionId,
-    });
-    return await this.requestJson<WorkspaceInstructionPolicyDiffResponse>(
-      "GET",
-      `/v1/workspaces/${workspaceId}/instruction-policies/diff?${params}`,
-    );
+    browserSessionId: string,
+    targetId: string,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<BrowserTargetListResponse> {
+    return await this.requestJson<BrowserTargetListResponse>(
+      "DELETE",
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/targets/${encodeURIComponent(targetId)}`,
+      undefined,
+      {},
+      options,
+    );
+  }
+
+  async observeBrowserTarget(
+    workspaceId: string,
+    browserSessionId: string,
+    targetId: string,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<BrowserObservation> {
+    return await this.requestJson<BrowserObservation>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/targets/${encodeURIComponent(targetId)}/observation`,
+      undefined,
+      {},
+      options,
+    );
+  }
+
+  async actInBrowser(
+    workspaceId: string,
+    browserSessionId: string,
+    request: BrowserActionRequest,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<BrowserActionReceipt> {
+    return await this.requestJson<BrowserActionReceipt>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/actions`,
+      request,
+      {},
+      options,
+    );
+  }
+
+  async getBrowserActionReceipt(
+    workspaceId: string,
+    browserSessionId: string,
+    operationId: string,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<BrowserActionReceipt> {
+    return await this.requestJson<BrowserActionReceipt>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/operations/${encodeURIComponent(operationId)}`,
+      undefined,
+      {},
+      options,
+    );
+  }
+
+  async listBrowserDiagnostics(
+    workspaceId: string,
+    browserSessionId: string,
+    targetId: string,
+    options: BrowserDiagnosticsOptions = {},
+  ): Promise<BrowserDiagnosticBatch> {
+    return await this.requestJson<BrowserDiagnosticBatch>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/targets/${encodeURIComponent(targetId)}/diagnostics`,
+      undefined,
+      {
+        ...(options.kinds?.length ? { kinds: options.kinds.join(",") } : {}),
+        ...(options.after !== undefined ? { after: String(options.after) } : {}),
+        ...(options.limit !== undefined ? { limit: String(options.limit) } : {}),
+      },
+      options.signal ? { signal: options.signal } : {},
+    );
+  }
+
+  async attachBrowserSession(
+    workspaceId: string,
+    browserSessionId: string,
+    request: BrowserSessionAttachmentRequest,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<BrowserSessionAttachment> {
+    return await this.requestJson<BrowserSessionAttachment>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/attachments`,
+      request,
+      {},
+      options,
+    );
+  }
+
+  async heartbeatBrowserSession(
+    workspaceId: string,
+    browserSessionId: string,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<BrowserSessionHeartbeatResponse> {
+    return await this.requestJson<BrowserSessionHeartbeatResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/heartbeat`,
+      {},
+      {},
+      options,
+    );
+  }
+
+  async publishBrowserRevision(
+    workspaceId: string,
+    browserSessionId: string,
+    request: PublishBrowserRevisionRequest,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<PublishBrowserRevisionResponse> {
+    return await this.requestJson<PublishBrowserRevisionResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/revisions`,
+      request,
+      {},
+      options,
+    );
+  }
+
+  async suspendBrowserSession(
+    workspaceId: string,
+    browserSessionId: string,
+    request: BrowserSessionLifecycleRequest,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<BrowserSessionMutationResponse> {
+    return await this.requestJson<BrowserSessionMutationResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/suspend`,
+      request,
+      {},
+      options,
+    );
+  }
+
+  async resumeBrowserSession(
+    workspaceId: string,
+    browserSessionId: string,
+    request: BrowserSessionLifecycleRequest,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<BrowserSessionMutationResponse> {
+    return await this.requestJson<BrowserSessionMutationResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/resume`,
+      request,
+      {},
+      options,
+    );
+  }
+
+  async endBrowserSession(
+    workspaceId: string,
+    browserSessionId: string,
+    request: BrowserSessionLifecycleRequest,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<BrowserSessionMutationResponse> {
+    return await this.requestJson<BrowserSessionMutationResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/end`,
+      request,
+      {},
+      options,
+    );
+  }
+
+  /** Workspace-wide ComputerSession inventory. Associations express
+   * relevance, not access; peer sessions intentionally remain discoverable. */
+  async listComputerSessions(
+    workspaceId: string,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<ComputerSessionListResponse> {
+    return await this.requestJson<ComputerSessionListResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/computer-sessions`,
+      undefined,
+      {},
+      options,
+    );
+  }
+
+  async getComputerSession(
+    workspaceId: string,
+    computerSessionId: string,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<ComputerSession> {
+    return await this.requestJson<ComputerSession>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/computer-sessions/${encodeURIComponent(computerSessionId)}`,
+      undefined,
+      {},
+      options,
+    );
+  }
+
+  async createComputerSession(
+    workspaceId: string,
+    request: CreateComputerSessionRequest,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<ComputerSessionMutationResponse> {
+    return await this.requestJson<ComputerSessionMutationResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/computer-sessions`,
+      request,
+      {},
+      options,
+    );
+  }
+
+  async listComputerTargets(
+    workspaceId: string,
+    computerSessionId: string,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<ComputerTargetListResponse> {
+    return await this.requestJson<ComputerTargetListResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/computer-sessions/${encodeURIComponent(computerSessionId)}/targets`,
+      undefined,
+      {},
+      options,
+    );
+  }
+
+  async observeComputerTarget(
+    workspaceId: string,
+    computerSessionId: string,
+    targetId: string,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<ComputerObservation> {
+    return await this.requestJson<ComputerObservation>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/computer-sessions/${encodeURIComponent(computerSessionId)}/targets/${encodeURIComponent(targetId)}/observation`,
+      undefined,
+      {},
+      options,
+    );
+  }
+
+  async actInComputer(
+    workspaceId: string,
+    computerSessionId: string,
+    request: ComputerActionRequest,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<ComputerActionReceipt> {
+    return await this.requestJson<ComputerActionReceipt>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/computer-sessions/${encodeURIComponent(computerSessionId)}/actions`,
+      request,
+      {},
+      options,
+    );
+  }
+
+  async getComputerActionReceipt(
+    workspaceId: string,
+    computerSessionId: string,
+    operationId: string,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<ComputerActionReceipt> {
+    return await this.requestJson<ComputerActionReceipt>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/computer-sessions/${encodeURIComponent(computerSessionId)}/operations/${encodeURIComponent(operationId)}`,
+      undefined,
+      {},
+      options,
+    );
+  }
+
+  async attachComputerSession(
+    workspaceId: string,
+    computerSessionId: string,
+    request: ComputerSessionAttachmentRequest,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<ComputerSessionAttachment> {
+    return await this.requestJson<ComputerSessionAttachment>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/computer-sessions/${encodeURIComponent(computerSessionId)}/attachments`,
+      request,
+      {},
+      options,
+    );
+  }
+
+  async heartbeatComputerSession(
+    workspaceId: string,
+    computerSessionId: string,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<ComputerSessionHeartbeatResponse> {
+    return await this.requestJson<ComputerSessionHeartbeatResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/computer-sessions/${encodeURIComponent(computerSessionId)}/heartbeat`,
+      {},
+      {},
+      options,
+    );
+  }
+
+  async endComputerSession(
+    workspaceId: string,
+    computerSessionId: string,
+    request: ComputerSessionLifecycleRequest,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<ComputerSessionMutationResponse> {
+    return await this.requestJson<ComputerSessionMutationResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/computer-sessions/${encodeURIComponent(computerSessionId)}/end`,
+      request,
+      {},
+      options,
+    );
+  }
+
+  // --- Access + workspaces -----------------------------------------------------
+
+  /**
+   * The deployment's public client bootstrap config: the host-exposed models
+   * (provider-grouped in `models`, flat in `allowedModels` for back-compat),
+   * reasoning efforts, MCP servers, file-upload limits, and how the client is
+   * expected to authenticate. Drives a composer's model picker without prior
+   * knowledge of the host setup; safe to call before any auth is established.
+   */
+  async getClientConfig(): Promise<ClientConfig> {
+    const config = await this.requestJson<ClientConfig>("GET", "/v1/config/client");
+    if (config.apiContractRevision !== OPENGENI_API_CONTRACT_REVISION) {
+      throw new OpenGeniApiContractMismatchError(
+        OPENGENI_API_CONTRACT_REVISION,
+        String(config.apiContractRevision || "(missing)"),
+      );
+    }
+    return config;
+  }
+
+  /** Authenticated model definitions plus workspace-specific selectability. */
+  async getWorkspaceModelCatalog(workspaceId: string): Promise<WorkspaceModelCatalogResponse> {
+    return await this.requestJson<WorkspaceModelCatalogResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/model-catalog`,
+    );
+  }
+
+  /** Authenticated realtime voice models and credential readiness. */
+  async getWorkspaceRealtimeModelCatalog(
+    workspaceId: string,
+  ): Promise<WorkspaceRealtimeModelCatalogResponse> {
+    return await this.requestJson<WorkspaceRealtimeModelCatalogResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/realtime-model-catalog`,
+    );
+  }
+
+  /** The caller's access context: subject, account + workspace grants, defaults. */
+  async getAccessContext(): Promise<AccessContext> {
+    return await this.requestJson<AccessContext>("GET", "/v1/access/me");
+  }
+
+  async listWorkspaces(): Promise<Workspace[]> {
+    return await this.requestJson<Workspace[]>("GET", "/v1/workspaces");
+  }
+
+  async createWorkspace(request: CreateWorkspaceRequest): Promise<Workspace> {
+    return await this.requestJson<Workspace>("POST", "/v1/workspaces", request);
+  }
+
+  async getWorkspace(workspaceId: string): Promise<Workspace> {
+    return await this.requestJson<Workspace>("GET", `/v1/workspaces/${workspaceId}`);
+  }
+
+  /** Read-time, secret-safe inventory of policy heads and visible workspace knowledge. */
+  async getWorkspaceState(
+    workspaceId: string,
+    options: WorkspaceStateGetOptions = {},
+  ): Promise<WorkspaceStateResponse> {
+    const params = new URLSearchParams();
+    if (options.attemptId) params.set("attemptId", options.attemptId);
+    const query = params.size > 0 ? `?${params.toString()}` : "";
+    return await this.requestJson<WorkspaceStateResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/workspace-state${query}`,
+    );
+  }
+
+  /** Download the canonical, explicitly sanitized Workspace State export. */
+  async exportWorkspaceState(
+    workspaceId: string,
+    options: WorkspaceStateGetOptions = {},
+  ): Promise<WorkspaceStateExportResponse> {
+    const params = new URLSearchParams();
+    if (options.attemptId) params.set("attemptId", options.attemptId);
+    const query = params.size > 0 ? `?${params.toString()}` : "";
+    return await this.requestJson<WorkspaceStateExportResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/workspace-state/export${query}`,
+    );
+  }
+
+  async updateWorkspace(workspaceId: string, request: UpdateWorkspaceRequest): Promise<Workspace> {
+    return await this.requestJson<Workspace>("PATCH", `/v1/workspaces/${workspaceId}`, request);
+  }
+
+  /** Inspect immutable instruction-policy history, active heads, and activation audit evidence. */
+  async listWorkspaceInstructionPolicies(
+    workspaceId: string,
+    options: WorkspaceInstructionPolicyListOptions = {},
+  ): Promise<WorkspaceInstructionPolicyListResponse> {
+    const params = new URLSearchParams();
+    if (options.kind !== undefined) params.set("kind", options.kind);
+    if (options.scope !== undefined) params.set("scope", options.scope);
+    if (options.roleKey !== undefined) params.set("roleKey", options.roleKey);
+    if (options.afterRevision !== undefined) {
+      params.set("afterRevision", String(options.afterRevision));
+    }
+    if (options.limit !== undefined) params.set("limit", String(options.limit));
+    const query = params.toString();
+    return await this.requestJson<WorkspaceInstructionPolicyListResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/instruction-policies${query ? `?${query}` : ""}`,
+    );
+  }
+
+  async getWorkspaceInstructionPolicyRevision(
+    workspaceId: string,
+    revisionId: string,
+  ): Promise<WorkspaceInstructionPolicyRevision> {
+    return await this.requestJson<WorkspaceInstructionPolicyRevision>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/instruction-policies/${encodeURIComponent(revisionId)}`,
+    );
+  }
+
+  async createWorkspaceInstructionPolicyDraft(
+    workspaceId: string,
+    request: CreateWorkspaceInstructionPolicyDraftRequest,
+  ): Promise<WorkspaceInstructionPolicyRevision> {
+    return await this.requestJson<WorkspaceInstructionPolicyRevision>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/instruction-policies/drafts`,
+      request,
+    );
+  }
+
+  /** List the newest immutable onboarding proposals and their inactive policy drafts. */
+  async listWorkspaceInstructionPolicyOnboardingProposals(
+    workspaceId: string,
+    options: WorkspaceInstructionPolicyOnboardingProposalListOptions = {},
+  ): Promise<WorkspaceInstructionPolicyOnboardingProposalListResponse> {
+    const params = new URLSearchParams();
+    if (options.limit !== undefined) params.set("limit", String(options.limit));
+    const query = params.toString();
+    return await this.requestJson<WorkspaceInstructionPolicyOnboardingProposalListResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/instruction-policies/onboarding-proposals${query ? `?${query}` : ""}`,
+    );
+  }
+
+  /** Create one draft-only proposal against an exact active-policy baseline. */
+  async createWorkspaceInstructionPolicyOnboardingProposal(
+    workspaceId: string,
+    request: CreateWorkspaceInstructionPolicyOnboardingProposalRequest,
+  ): Promise<WorkspaceInstructionPolicyOnboardingProposal> {
+    return await this.requestJson<WorkspaceInstructionPolicyOnboardingProposal>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/instruction-policies/onboarding-proposals`,
+      request,
+    );
+  }
+
+  /** Import the stored legacy workspace override as an inactive charter draft. */
+  async importLegacyWorkspaceInstructionPolicyDraft(
+    workspaceId: string,
+    request: ImportLegacyWorkspaceInstructionPolicyDraftRequest = {},
+  ): Promise<WorkspaceInstructionPolicyRevision> {
+    return await this.requestJson<WorkspaceInstructionPolicyRevision>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/instruction-policies/import-legacy`,
+      request,
+    );
+  }
+
+  async diffWorkspaceInstructionPolicyRevisions(
+    workspaceId: string,
+    request: WorkspaceInstructionPolicyDiffRequest,
+  ): Promise<WorkspaceInstructionPolicyDiffResponse> {
+    const params = new URLSearchParams({
+      fromRevisionId: request.fromRevisionId,
+      toRevisionId: request.toRevisionId,
+    });
+    return await this.requestJson<WorkspaceInstructionPolicyDiffResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/instruction-policies/diff?${params}`,
+    );
   }
 
   async activateWorkspaceInstructionPolicyRevision(
@@ -2222,6 +2960,77 @@ export class OpenGeniClient {
     );
   }
 
+  /** Read the current organization profile plus immutable revision and activation history. */
+  async listCompanyProfile(
+    workspaceId: string,
+    options: CompanyProfileListOptions = {},
+  ): Promise<CompanyProfileListResponse> {
+    const params = new URLSearchParams();
+    if (options.afterRevision !== undefined)
+      params.set("afterRevision", String(options.afterRevision));
+    if (options.limit !== undefined) params.set("limit", String(options.limit));
+    const query = params.toString();
+    return await this.requestJson<CompanyProfileListResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/company-profile${query ? `?${query}` : ""}`,
+    );
+  }
+
+  async getCompanyProfileRevision(
+    workspaceId: string,
+    revisionId: string,
+  ): Promise<CompanyProfileRevision> {
+    return await this.requestJson<CompanyProfileRevision>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/company-profile/revisions/${encodeURIComponent(revisionId)}`,
+    );
+  }
+
+  async updateCompanyProfile(
+    workspaceId: string,
+    request: UpdateCompanyProfileRequest,
+  ): Promise<CompanyProfileMutationResponse> {
+    return await this.requestJson<CompanyProfileMutationResponse>(
+      "PUT",
+      `/v1/workspaces/${workspaceId}/company-profile`,
+      request,
+    );
+  }
+
+  async diffCompanyProfileRevisions(
+    workspaceId: string,
+    request: CompanyProfileDiffRequest,
+  ): Promise<CompanyProfileDiffResponse> {
+    const params = new URLSearchParams(request);
+    return await this.requestJson<CompanyProfileDiffResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/company-profile/diff?${params}`,
+    );
+  }
+
+  async activateCompanyProfileRevision(
+    workspaceId: string,
+    revisionId: string,
+    request: ActivateCompanyProfileRevisionRequest,
+  ): Promise<CompanyProfileMutationResponse> {
+    return await this.requestJson<CompanyProfileMutationResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/company-profile/revisions/${encodeURIComponent(revisionId)}/activate`,
+      request,
+    );
+  }
+
+  async rollbackCompanyProfile(
+    workspaceId: string,
+    request: RollbackCompanyProfileRequest,
+  ): Promise<CompanyProfileMutationResponse> {
+    return await this.requestJson<CompanyProfileMutationResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/company-profile/rollback`,
+      request,
+    );
+  }
+
   async listPreferenceRegistry(
     workspaceId: string,
     options: PreferenceRegistryListOptions = {},
@@ -2405,6 +3214,86 @@ export class OpenGeniClient {
     );
   }
 
+  /** Exchange one signed Slack bearer for durable, token-free continuation state. */
+  async prepareSlackUserLinkAccess(
+    workspaceId: string,
+    request: PrepareSlackUserLinkAccessRequest,
+  ): Promise<SlackUserLinkAccessRequest> {
+    return await this.requestJson<SlackUserLinkAccessRequest>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/integrations/slack/user-link-intents`,
+      request,
+    );
+  }
+
+  async getSlackUserLinkAccess(
+    workspaceId: string,
+    requestId: string,
+  ): Promise<SlackUserLinkAccessRequest> {
+    return await this.requestJson<SlackUserLinkAccessRequest>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/integrations/slack/user-link-intents/${requestId}`,
+    );
+  }
+
+  async requestSlackUserLinkWorkspaceAccess(
+    workspaceId: string,
+    requestId: string,
+    request: SlackUserLinkAccessMutationRequest,
+  ): Promise<SlackUserLinkAccessRequest> {
+    return await this.requestJson<SlackUserLinkAccessRequest>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/integrations/slack/user-link-intents/${requestId}/request-access`,
+      request,
+    );
+  }
+
+  async cancelSlackUserLinkAccess(
+    workspaceId: string,
+    requestId: string,
+    request: SlackUserLinkAccessMutationRequest,
+  ): Promise<SlackUserLinkAccessRequest> {
+    return await this.requestJson<SlackUserLinkAccessRequest>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/integrations/slack/user-link-intents/${requestId}/cancel`,
+      request,
+    );
+  }
+
+  async listSlackUserLinkAccessRequests(
+    workspaceId: string,
+  ): Promise<SlackUserLinkAccessRequest[]> {
+    const response = await this.requestJson<ListSlackUserLinkAccessRequestsResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/members/access-requests/slack`,
+    );
+    return response.requests;
+  }
+
+  async approveSlackUserLinkAccessRequest(
+    workspaceId: string,
+    requestId: string,
+    request: ApproveSlackUserLinkAccessRequest,
+  ): Promise<SlackUserLinkAccessRequest> {
+    return await this.requestJson<SlackUserLinkAccessRequest>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/members/access-requests/slack/${requestId}/approve`,
+      request,
+    );
+  }
+
+  async denySlackUserLinkAccessRequest(
+    workspaceId: string,
+    requestId: string,
+    request: SlackUserLinkAccessMutationRequest,
+  ): Promise<SlackUserLinkAccessRequest> {
+    return await this.requestJson<SlackUserLinkAccessRequest>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/members/access-requests/slack/${requestId}/deny`,
+      request,
+    );
+  }
+
   // --- Scheduled tasks (write + runs) -------------------------------------------
 
   async createScheduledTask(
@@ -2484,7 +3373,8 @@ export class OpenGeniClient {
   }
 
   // --- VariableSets --------------------------------------------------------------
-  // Variable values are write-only: reads return name/version metadata only.
+  // Generic reads return name/version metadata only. Plaintext uses one
+  // dedicated permissioned endpoint.
 
   async listVariableSets(workspaceId: string): Promise<VariableSet[]> {
     return await this.requestJson<VariableSet[]>(
@@ -2511,6 +3401,17 @@ export class OpenGeniClient {
     );
   }
 
+  async getVariableSetVariable(
+    workspaceId: string,
+    variableSetId: string,
+    name: string,
+  ): Promise<VariableSetSecret> {
+    return await this.requestJson<VariableSetSecret>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/variable-sets/${variableSetId}/variables/${encodeURIComponent(name)}`,
+    );
+  }
+
   async updateVariableSet(
     workspaceId: string,
     variableSetId: string,
@@ -2530,7 +3431,7 @@ export class OpenGeniClient {
     );
   }
 
-  /** Create or rotate a variable. The value never comes back on any read. */
+  /** Create or rotate a variable. Generic reads never return its value. */
   async setVariableSetVariable(
     workspaceId: string,
     variableSetId: string,
@@ -2726,19 +3627,29 @@ export class OpenGeniClient {
   async beginFileUpload(
     workspaceId: string,
     request: CreateFileUploadRequest,
+    options: OpenGeniRequestOptions = {},
   ): Promise<CreateFileUploadResponse> {
     return await this.requestJson<CreateFileUploadResponse>(
       "POST",
       `/v1/workspaces/${workspaceId}/files/uploads`,
       request,
+      {},
+      options,
     );
   }
 
   /** Step 3 of the upload flow: server verifies the object and marks it ready. */
-  async completeFileUpload(workspaceId: string, uploadId: string): Promise<FileAsset> {
+  async completeFileUpload(
+    workspaceId: string,
+    uploadId: string,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<FileAsset> {
     const response = await this.requestJson<CompleteFileUploadResponse>(
       "POST",
       `/v1/workspaces/${workspaceId}/files/uploads/${uploadId}/complete`,
+      undefined,
+      {},
+      options,
     );
     return response.file;
   }
@@ -2749,6 +3660,30 @@ export class OpenGeniClient {
    * -> complete. Returns the ready `FileAsset`.
    */
   async uploadFile(workspaceId: string, input: UploadFileInput): Promise<FileAsset> {
+    if (
+      input.timeoutMs !== undefined &&
+      (!Number.isFinite(input.timeoutMs) || input.timeoutMs <= 0)
+    ) {
+      throw new Error("File upload timeout must be a positive number");
+    }
+    const withTimeout = async <T>(
+      timeoutMs: number,
+      operation: (signal: AbortSignal) => Promise<T>,
+    ): Promise<T> => {
+      const controller = new AbortController();
+      let timeout: ReturnType<typeof setTimeout> | undefined;
+      const timedOut = new Promise<never>((_resolve, reject) => {
+        timeout = setTimeout(() => {
+          controller.abort();
+          reject(new Error("File upload timed out. Retry the upload."));
+        }, timeoutMs);
+      });
+      try {
+        return await Promise.race([operation(controller.signal), timedOut]);
+      } finally {
+        if (timeout !== undefined) clearTimeout(timeout);
+      }
+    };
     // Snapshot mutable inputs before hashing so the digest always describes the
     // exact bytes later sent to object storage. Copy Uint8Array views into a
     // Blob so byte offsets/shared buffers can't leak surrounding bytes.
@@ -2765,32 +3700,52 @@ export class OpenGeniClient {
           ? body.size
           : body.byteLength;
     const sha256 = input.sha256 ?? (await sha256ForUpload(body));
-    const upload = await this.beginFileUpload(workspaceId, {
-      filename: input.filename,
-      contentType: input.contentType,
-      sizeBytes,
-      sha256,
-    });
-    const putResponse = await this.fetchImpl(upload.putUrl, {
-      method: "PUT",
-      // Signed object-storage URLs carry their own short-lived authority.
-      // Browser cookies and HTTP auth must never accompany this cross-origin
-      // request: credentialed fetches are incompatible with wildcard CORS and
-      // can leak ambient credentials to a caller-selected storage endpoint.
-      credentials: "omit",
-      // The backend's requiredHeaders already carry the canonical lowercase
-      // `content-type` for every storage backend (Azure/S3/GCS). Do NOT also set
-      // a `Content-Type` key here: WHATWG Headers treats the two casings as the
-      // same header and comma-joins their values (e.g. "text/plain, text/plain"),
-      // which the object store persists verbatim and COMPLETE then rejects (422),
-      // and which breaks S3's presigned-URL signature.
-      headers: { ...upload.requiredHeaders },
-      body,
-    });
+    const upload = await withTimeout(
+      30_000,
+      async (signal) =>
+        await this.beginFileUpload(
+          workspaceId,
+          {
+            filename: input.filename,
+            contentType: input.contentType,
+            sizeBytes,
+            sha256,
+          },
+          { signal },
+        ),
+    );
+    // Give large valid uploads enough time at a conservative 256 KiB/s while
+    // still bounding an object-storage request that never settles.
+    const transferTimeoutMs =
+      input.timeoutMs ?? Math.max(120_000, Math.ceil(sizeBytes / (256 * 1024)) * 1_000);
+    const putResponse = await withTimeout(
+      transferTimeoutMs,
+      async (signal) =>
+        await this.fetchImpl(upload.putUrl, {
+          method: "PUT",
+          // Signed object-storage URLs carry their own short-lived authority.
+          // Browser cookies and HTTP auth must never accompany this cross-origin
+          // request: credentialed fetches are incompatible with wildcard CORS and
+          // can leak ambient credentials to a caller-selected storage endpoint.
+          credentials: "omit",
+          // The backend's requiredHeaders already carry the canonical lowercase
+          // `content-type` for every storage backend (Azure/S3/GCS). Do NOT also set
+          // a `Content-Type` key here: WHATWG Headers treats the two casings as the
+          // same header and comma-joins their values (e.g. "text/plain, text/plain"),
+          // which the object store persists verbatim and COMPLETE then rejects (422),
+          // and which breaks S3's presigned-URL signature.
+          headers: { ...upload.requiredHeaders },
+          body,
+          signal,
+        }),
+    );
     if (!putResponse.ok) {
       throw await apiErrorFromResponse(putResponse, { method: "PUT" });
     }
-    return await this.completeFileUpload(workspaceId, upload.uploadId);
+    return await withTimeout(
+      30_000,
+      async (signal) => await this.completeFileUpload(workspaceId, upload.uploadId, { signal }),
+    );
   }
 
   async getFile(workspaceId: string, fileId: string): Promise<FileAsset> {
@@ -2819,23 +3774,150 @@ export class OpenGeniClient {
     workspaceId: string,
     artifactId: string,
     options: RetainedArtifactContentOptions = {},
+  ): Promise<RetainedArtifactContent> {
+    return await this.getRetainedArtifactContentAtPath(
+      `/v1/workspaces/${workspaceId}/artifacts/${artifactId}/content`,
+      options,
+    );
+  }
+
+  async getSessionRetainedArtifact(
+    workspaceId: string,
+    sessionId: string,
+    artifactId: string,
+  ): Promise<RetainedArtifactMetadata> {
+    return await this.requestJson<RetainedArtifactMetadata>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/artifacts/${artifactId}`,
+    );
+  }
+
+  async getSessionRetainedArtifactContent(
+    workspaceId: string,
+    sessionId: string,
+    artifactId: string,
+    options: RetainedArtifactContentOptions = {},
+  ): Promise<RetainedArtifactContent> {
+    return await this.getRetainedArtifactContentAtPath(
+      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/artifacts/${artifactId}/content`,
+      options,
+    );
+  }
+
+  /** Assemble one permanent generated-image receipt from bounded authenticated ranges. */
+  async downloadRetainedArtifact(
+    workspaceId: string,
+    artifact: RetainedArtifactReference,
+    options: RetainedArtifactDownloadOptions = {},
+  ): Promise<RetainedArtifactDownload> {
+    assertRetainedGeneratedImageReceipt(workspaceId, artifact);
+    const bytes = await this.downloadRetainedArtifactBytes(artifact, options);
+    return { artifact, bytes };
+  }
+
+  /** Mint a short-lived, zero-copy browser source for a validated generated image. */
+  async createRetainedArtifactDownloadUrl(
+    workspaceId: string,
+    artifact: RetainedArtifactReference,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<FileDownloadUrlResponse> {
+    assertRetainedGeneratedImageReceipt(workspaceId, artifact);
+    const download = await this.createFileDownloadUrl(workspaceId, artifact.artifactId, options);
+    assertSafeArtifactDownloadUrl(download);
+    return download;
+  }
+
+  /** Assemble one retained screenshot from bounded authenticated API ranges. */
+  async downloadRetainedScreenshot(
+    workspaceId: string,
+    sessionId: string,
+    artifactId: string,
+    options: RetainedScreenshotDownloadOptions = {},
+  ): Promise<RetainedScreenshotDownload> {
+    const metadata = await this.getSessionRetainedArtifact(workspaceId, sessionId, artifactId);
+    if (!metadata.available) return { metadata, bytes: null };
+    if (
+      metadata.kind !== "computer_screenshot" ||
+      metadata.contentType !== "image/png" ||
+      !metadata.dimensions ||
+      metadata.originalBytes <= 0 ||
+      metadata.originalBytes > COMPUTER_SCREENSHOT_MAX_BYTES
+    ) {
+      throw new OpenGeniApiError(502, "retained screenshot metadata is invalid");
+    }
+    const bytes = await this.downloadRetainedArtifactBytes(metadata, options);
+    return { metadata, bytes };
+  }
+
+  private async downloadRetainedArtifactBytes(
+    artifact: RetainedArtifactReference,
+    options: RetainedArtifactDownloadOptions,
+  ): Promise<Uint8Array> {
+    const maxRetries = options.maxRetries ?? 2;
+    if (!Number.isInteger(maxRetries) || maxRetries < 0 || maxRetries > 3) {
+      throw new RangeError("retained artifact maxRetries must be an integer from 0 to 3");
+    }
+    const bytes = new Uint8Array(artifact.originalBytes);
+    const pageBytes = Math.min(artifact.retrieval.maxRangeBytes, RETAINED_OUTPUT_MAX_PAGE_BYTES);
+    if (!Number.isSafeInteger(pageBytes) || pageBytes <= 0) {
+      throw new OpenGeniApiError(502, "retained artifact range metadata is invalid");
+    }
+    for (let start = 0; start < bytes.byteLength; start += pageBytes) {
+      options.signal?.throwIfAborted();
+      const end = Math.min(start + pageBytes, bytes.byteLength) - 1;
+      let page: RetainedArtifactContent | null = null;
+      for (let attempt = 0; attempt <= maxRetries; attempt += 1) {
+        try {
+          page = await this.getRetainedArtifactContentAtPath(artifact.retrieval.path, {
+            range: `bytes=${start}-${end}`,
+            ...(options.signal ? { signal: options.signal } : {}),
+          });
+          break;
+        } catch (error) {
+          options.signal?.throwIfAborted();
+          if (
+            attempt >= maxRetries ||
+            (error instanceof OpenGeniApiError && error.status >= 400 && error.status < 500)
+          ) {
+            throw error;
+          }
+        }
+      }
+      if (!page) throw new OpenGeniApiError(502, "retained artifact range retry exhausted");
+      const expectedLength = end - start + 1;
+      if (
+        page.status !== 206 ||
+        page.contentType !== artifact.contentType ||
+        page.contentLength !== expectedLength ||
+        page.contentRange !== `bytes ${start}-${end}/${artifact.originalBytes}`
+      ) {
+        throw new OpenGeniApiError(502, "retained artifact range response is invalid");
+      }
+      bytes.set(page.bytes, start);
+    }
+    if ((await sha256Hex(bytes)) !== artifact.sha256) {
+      throw new OpenGeniApiError(502, "retained artifact checksum mismatch");
+    }
+    return bytes;
+  }
+
+  private async getRetainedArtifactContentAtPath(
+    path: string,
+    options: RetainedArtifactContentOptions,
   ): Promise<RetainedArtifactContent> {
     if (options.range && (options.range.length > 128 || /[^\x20-\x7e]/.test(options.range))) {
       throw new RangeError("retained artifact range must be at most 128 printable ASCII bytes");
     }
     const correlationId = crypto.randomUUID();
-    const response = await this.fetchImpl(
-      this.url(`/v1/workspaces/${workspaceId}/artifacts/${artifactId}/content`),
-      {
-        method: "GET",
-        headers: {
-          ...this.headers(correlationId),
-          Accept: "application/octet-stream",
-          ...(options.range ? { Range: options.range } : {}),
-        },
-        ...(options.signal ? { signal: options.signal } : {}),
+    const response = await this.fetchImpl(this.url(path), {
+      method: "GET",
+      headers: {
+        ...this.headers(correlationId),
+        Accept: "application/octet-stream",
+        ...(options.range ? { Range: options.range } : {}),
       },
-    );
+      ...(options.signal ? { signal: options.signal } : {}),
+    });
     try {
       assertApiContractResponse(response);
     } catch (error) {
@@ -2868,25 +3950,92 @@ export class OpenGeniClient {
       RETAINED_OUTPUT_MAX_PAGE_BYTES,
       declaredLength,
     );
-    return {
-      bytes,
-      status: response.status,
-      contentType: response.headers.get("content-type") ?? "application/octet-stream",
-      contentLength: bytes.byteLength,
-      contentRange: response.headers.get("content-range"),
-      acceptRanges: "bytes",
-    };
+    return {
+      bytes,
+      status: response.status,
+      contentType: response.headers.get("content-type") ?? "application/octet-stream",
+      contentLength: bytes.byteLength,
+      contentRange: response.headers.get("content-range"),
+      acceptRanges: "bytes",
+    };
+  }
+
+  /** Mint a short-lived signed download URL for a ready file. */
+  async createFileDownloadUrl(
+    workspaceId: string,
+    fileId: string,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<FileDownloadUrlResponse> {
+    return await this.requestJson<FileDownloadUrlResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/files/${fileId}/download-url`,
+      undefined,
+      {},
+      options,
+    );
+  }
+
+  // --- Video generation ---------------------------------------------------------------
+
+  /** Read the effective workspace policy and executable Seedance capabilities. */
+  async getVideoGenerationSettings(
+    workspaceId: string,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<WorkspaceVideoGenerationSettings> {
+    return await this.requestJson<WorkspaceVideoGenerationSettings>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/video-generation`,
+      undefined,
+      {},
+      options,
+    );
+  }
+
+  /** Replace the enabled video models/default under optimistic policy revision control. */
+  async updateVideoGenerationPolicy(
+    workspaceId: string,
+    request: UpdateVideoGenerationPolicyRequest,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<VideoGenerationPolicy> {
+    return await this.requestJson<VideoGenerationPolicy>(
+      "PUT",
+      `/v1/workspaces/${workspaceId}/video-generation/policy`,
+      request,
+      {},
+      options,
+    );
   }
 
-  /** Mint a short-lived signed download URL for a ready file. */
-  async createFileDownloadUrl(
+  /** Read durable progress for one accepted video generation operation. */
+  async getVideoGenerationOperation(
     workspaceId: string,
-    fileId: string,
-  ): Promise<FileDownloadUrlResponse> {
-    return await this.requestJson<FileDownloadUrlResponse>(
+    operationId: string,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<VideoGenerationOperationSummary> {
+    return await this.requestJson<VideoGenerationOperationSummary>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/video-generation/operations/${operationId}`,
+      undefined,
+      {},
+      options,
+    );
+  }
+
+  /** Mint a short-lived zero-copy URL for native Range-based video playback. */
+  async createVideoArtifactPlaybackSource(
+    workspaceId: string,
+    artifactId: string,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<VideoArtifactPlaybackSource> {
+    const source = await this.requestJson<VideoArtifactPlaybackSource>(
       "POST",
-      `/v1/workspaces/${workspaceId}/files/${fileId}/download-url`,
+      `/v1/workspaces/${workspaceId}/artifacts/${artifactId}/playback-source`,
+      undefined,
+      {},
+      options,
     );
+    assertSafeVideoArtifactPlaybackSource(source, artifactId);
+    return source;
   }
 
   // --- Documents ----------------------------------------------------------------------
@@ -3135,6 +4284,53 @@ export class OpenGeniClient {
     );
   }
 
+  /** Resolve pinned components, Variable Set, and Rig requirements before installation. */
+  async previewPackInstallation(
+    workspaceId: string,
+    packId: string,
+    request: PreviewPackInstallationRequest = {},
+  ): Promise<PackInstallationPreview> {
+    return await this.requestJson<PackInstallationPreview>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/packs/${encodeURIComponent(packId)}/installation-preview`,
+      request,
+    );
+  }
+
+  /** Install, update, or repair a Pack from an exact previewed manifest. */
+  async installPack(
+    workspaceId: string,
+    packId: string,
+    request: InstallPackRequest,
+  ): Promise<PackInstallation> {
+    return await this.requestJson<PackInstallation>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/packs/${encodeURIComponent(packId)}/install`,
+      request,
+    );
+  }
+
+  /** Preview which Pack-owned components will be retained by other owners. */
+  async previewPackUninstall(workspaceId: string, packId: string): Promise<PackUninstallPreview> {
+    return await this.requestJson<PackUninstallPreview>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/packs/${encodeURIComponent(packId)}/uninstall-preview`,
+    );
+  }
+
+  /** Safely release Pack ownership and disable only now-ownerless components. */
+  async uninstallPack(
+    workspaceId: string,
+    packId: string,
+    request: UninstallPackRequest,
+  ): Promise<UninstallPackResult> {
+    return await this.requestJson<UninstallPackResult>(
+      "DELETE",
+      `/v1/workspaces/${workspaceId}/packs/${encodeURIComponent(packId)}/installation`,
+      request,
+    );
+  }
+
   /** Unregister a workspace-scoped pack (built-in packs cannot be deleted). */
   async deletePack(workspaceId: string, packId: string): Promise<void> {
     await this.requestVoid(
@@ -3209,6 +4405,298 @@ export class OpenGeniClient {
     );
   }
 
+  /** List installed protocol-neutral OpenAPI and GraphQL Integrations. */
+  async listApiIntegrations(workspaceId: string): Promise<ListApiIntegrationsResponse> {
+    return await this.requestJson<ListApiIntegrationsResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/integrations`,
+    );
+  }
+
+  /** List curated provider presets without exposing deployment OAuth credentials. */
+  async listApiIntegrationPresets(workspaceId: string): Promise<ListApiIntegrationPresetsResponse> {
+    return await this.requestJson<ListApiIntegrationPresetsResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/integrations/presets`,
+    );
+  }
+
+  /** Detect and compile an Integration without mutating workspace state. */
+  async previewApiIntegration(
+    workspaceId: string,
+    request: PreviewApiIntegrationRequest,
+  ): Promise<ApiIntegrationPreview> {
+    return await this.requestJson<ApiIntegrationPreview>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/integrations/preview`,
+      request,
+    );
+  }
+
+  /** Start a signed PKCE OAuth flow for a built-in Google or Microsoft preset. */
+  async startApiIntegrationOAuth(
+    workspaceId: string,
+    request: ApiIntegrationOAuthStartRequest,
+  ): Promise<OAuthStartResponse> {
+    return await this.requestJson<OAuthStartResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/integrations/oauth/start`,
+      request,
+    );
+  }
+
+  /** Install only the exact immutable revision and digest accepted in preview. */
+  async installApiIntegration(
+    workspaceId: string,
+    request: InstallApiIntegrationRequest,
+  ): Promise<InstalledApiIntegration> {
+    return await this.requestJson<InstalledApiIntegration>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/integrations/install`,
+      request,
+    );
+  }
+
+  async previewApiIntegrationUninstall(
+    workspaceId: string,
+    capabilityId: string,
+    instanceKey: string,
+  ): Promise<ApiIntegrationUninstallPreview> {
+    return await this.requestJson<ApiIntegrationUninstallPreview>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/integrations/${encodeURIComponent(capabilityId)}/instances/${encodeURIComponent(instanceKey)}/uninstall-preview`,
+    );
+  }
+
+  /** Remove one Integration instance without deleting its Connection or sibling instances. */
+  async uninstallApiIntegration(
+    workspaceId: string,
+    capabilityId: string,
+    instanceKey: string,
+    request: UninstallApiIntegrationRequest,
+  ): Promise<UninstallApiIntegrationResult> {
+    return await this.requestJson<UninstallApiIntegrationResult>(
+      "DELETE",
+      `/v1/workspaces/${workspaceId}/integrations/${encodeURIComponent(capabilityId)}/instances/${encodeURIComponent(instanceKey)}`,
+      request,
+    );
+  }
+
+  /** List immutable provider facets and their exact per-account bindings. */
+  async listIntegrationFeatures(
+    workspaceId: string,
+    capabilityId: string,
+    instanceKey: string,
+  ): Promise<IntegrationInstanceFeaturesResponse> {
+    return await this.requestJson<IntegrationInstanceFeaturesResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/integrations/${encodeURIComponent(capabilityId)}/instances/${encodeURIComponent(instanceKey)}/features`,
+    );
+  }
+
+  /** Configure or OCC-update one adapter-owned feature on an Integration instance. */
+  async configureIntegrationFeature(
+    workspaceId: string,
+    capabilityId: string,
+    instanceKey: string,
+    featureKey: string,
+    request: UpsertIntegrationFeatureRequest,
+  ): Promise<IntegrationFeatureMutationResult> {
+    return await this.requestJson<IntegrationFeatureMutationResult>(
+      "PUT",
+      `/v1/workspaces/${workspaceId}/integrations/${encodeURIComponent(capabilityId)}/instances/${encodeURIComponent(instanceKey)}/features/${encodeURIComponent(featureKey)}`,
+      request,
+    );
+  }
+
+  /** Browse source metadata through one exact Google Drive Integration instance. */
+  async browseGoogleDriveIntegrationSource(
+    workspaceId: string,
+    capabilityId: string,
+    instanceKey: string,
+    featureKey: string,
+    options: { parentId?: string | undefined; pageToken?: string | undefined } = {},
+  ): Promise<GoogleDriveBrowseResponse> {
+    const query = new URLSearchParams();
+    if (options.parentId) query.set("parentId", options.parentId);
+    if (options.pageToken) query.set("pageToken", options.pageToken);
+    const suffix = query.size > 0 ? `?${query}` : "";
+    return await this.requestJson<GoogleDriveBrowseResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/integrations/${encodeURIComponent(capabilityId)}/instances/${encodeURIComponent(instanceKey)}/features/${encodeURIComponent(featureKey)}/browse${suffix}`,
+    );
+  }
+
+  /** Verify and bind document sources to one exact Google Drive Integration instance. */
+  async saveGoogleDriveIntegrationSource(
+    workspaceId: string,
+    capabilityId: string,
+    instanceKey: string,
+    featureKey: string,
+    request: SaveGoogleDriveIntegrationSourceRequest,
+  ): Promise<IntegrationFeatureMutationResult> {
+    return await this.requestJson<IntegrationFeatureMutationResult>(
+      "PUT",
+      `/v1/workspaces/${workspaceId}/integrations/${encodeURIComponent(capabilityId)}/instances/${encodeURIComponent(instanceKey)}/features/${encodeURIComponent(featureKey)}/source`,
+      request,
+    );
+  }
+
+  async pauseIntegrationFeature(
+    workspaceId: string,
+    capabilityId: string,
+    instanceKey: string,
+    featureKey: string,
+    request: MutateIntegrationFeatureRequest,
+  ): Promise<IntegrationFeatureMutationResult> {
+    return await this.mutateIntegrationFeatureLifecycle(
+      workspaceId,
+      capabilityId,
+      instanceKey,
+      featureKey,
+      "pause",
+      request,
+    );
+  }
+
+  async resumeIntegrationFeature(
+    workspaceId: string,
+    capabilityId: string,
+    instanceKey: string,
+    featureKey: string,
+    request: MutateIntegrationFeatureRequest,
+  ): Promise<IntegrationFeatureMutationResult> {
+    return await this.mutateIntegrationFeatureLifecycle(
+      workspaceId,
+      capabilityId,
+      instanceKey,
+      featureKey,
+      "resume",
+      request,
+    );
+  }
+
+  async removeIntegrationFeature(
+    workspaceId: string,
+    capabilityId: string,
+    instanceKey: string,
+    featureKey: string,
+    request: MutateIntegrationFeatureRequest,
+  ): Promise<IntegrationFeatureRemovalResult> {
+    return await this.requestJson<IntegrationFeatureRemovalResult>(
+      "DELETE",
+      `/v1/workspaces/${workspaceId}/integrations/${encodeURIComponent(capabilityId)}/instances/${encodeURIComponent(instanceKey)}/features/${encodeURIComponent(featureKey)}`,
+      request,
+    );
+  }
+
+  private async mutateIntegrationFeatureLifecycle(
+    workspaceId: string,
+    capabilityId: string,
+    instanceKey: string,
+    featureKey: string,
+    action: "pause" | "resume",
+    request: MutateIntegrationFeatureRequest,
+  ): Promise<IntegrationFeatureMutationResult> {
+    return await this.requestJson<IntegrationFeatureMutationResult>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/integrations/${encodeURIComponent(capabilityId)}/instances/${encodeURIComponent(instanceKey)}/features/${encodeURIComponent(featureKey)}/${action}`,
+      request,
+    );
+  }
+
+  async previewPlugin(workspaceId: string, request: PreviewPluginRequest): Promise<PluginPreview> {
+    return await this.requestJson<PluginPreview>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/plugins/preview`,
+      request,
+    );
+  }
+
+  async listInstalledPlugins(workspaceId: string): Promise<ListInstalledPluginsResponse> {
+    return await this.requestJson<ListInstalledPluginsResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/plugins`,
+    );
+  }
+
+  async installPlugin(
+    workspaceId: string,
+    request: InstallPluginRequest,
+  ): Promise<InstalledPlugin> {
+    return await this.requestJson<InstalledPlugin>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/plugins/install`,
+      request,
+    );
+  }
+
+  async previewPluginUninstall(
+    workspaceId: string,
+    pluginKey: string,
+  ): Promise<PluginUninstallPreview> {
+    return await this.requestJson<PluginUninstallPreview>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/plugins/${encodeURIComponent(pluginKey)}/uninstall-preview`,
+    );
+  }
+
+  async uninstallPlugin(
+    workspaceId: string,
+    pluginKey: string,
+    request: UninstallPluginRequest,
+  ): Promise<UninstallPluginResult> {
+    return await this.requestJson<UninstallPluginResult>(
+      "DELETE",
+      `/v1/workspaces/${workspaceId}/plugins/${encodeURIComponent(pluginKey)}`,
+      request,
+    );
+  }
+
+  /** Resolve one public skills.sh or GitHub Skill folder to an immutable review preview. */
+  async previewSkillImport(
+    workspaceId: string,
+    request: PreviewSkillImportRequest,
+  ): Promise<SkillImportPreview> {
+    return await this.requestJson<SkillImportPreview>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/skills/preview`,
+      request,
+    );
+  }
+
+  /** Install only the exact commit and full-content digest accepted during preview. */
+  async installSkill(workspaceId: string, request: InstallSkillRequest): Promise<InstalledSkill> {
+    return await this.requestJson<InstalledSkill>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/skills/install`,
+      request,
+    );
+  }
+
+  async previewSkillUninstall(
+    workspaceId: string,
+    capabilityId: string,
+  ): Promise<SkillUninstallPreview> {
+    return await this.requestJson<SkillUninstallPreview>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/skills/${encodeURIComponent(capabilityId)}/uninstall-preview`,
+    );
+  }
+
+  /** Remove the direct owner under an optimistic installation-version fence. */
+  async uninstallSkill(
+    workspaceId: string,
+    capabilityId: string,
+    request: UninstallSkillRequest,
+  ): Promise<UninstallSkillResult> {
+    return await this.requestJson<UninstallSkillResult>(
+      "DELETE",
+      `/v1/workspaces/${workspaceId}/skills/${encodeURIComponent(capabilityId)}`,
+      request,
+    );
+  }
+
   // --- Connections -------------------------------------------------------------------------------
 
   async listConnections(workspaceId: string): Promise<ConnectionMetadata[]> {
@@ -3219,6 +4707,15 @@ export class OpenGeniClient {
     return response.connections;
   }
 
+  /** List the secret-free Slack team -> OpenGeni tenant routing authority. */
+  async listSlackInstallationBindings(workspaceId: string): Promise<SlackInstallationBinding[]> {
+    const response = await this.requestJson<ListSlackInstallationBindingsResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/connections/slack-bot/bindings`,
+    );
+    return response.bindings;
+  }
+
   async createConnection(
     workspaceId: string,
     request: CreateConnectionRequest,
@@ -3361,8 +4858,16 @@ export class OpenGeniClient {
   // --- GitHub ----------------------------------------------------------------------------------
 
   /** GitHub App server configuration plus truthful workspace binding status. */
-  async getGitHubApp(workspaceId: string): Promise<GitHubAppInfo> {
-    return await this.requestJson<GitHubAppInfo>("GET", `/v1/workspaces/${workspaceId}/github/app`);
+  async getGitHubApp(
+    workspaceId: string,
+    options: { returnPath?: string } = {},
+  ): Promise<GitHubAppInfo> {
+    return await this.requestJson<GitHubAppInfo>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/github/app`,
+      undefined,
+      options.returnPath ? { returnPath: options.returnPath } : undefined,
+    );
   }
 
   /** Build the GitHub owner-consent entry URL for fresh workspace-bound state. */
@@ -3682,7 +5187,8 @@ export class OpenGeniClient {
     );
   }
 
-  protected async requestJson<T>(
+  /** Contract-checked JSON transport shared by opt-in typed SDK clients. */
+  async requestJson<T>(
     method: string,
     path: string,
     body?: unknown,
@@ -3723,6 +5229,35 @@ export class OpenGeniClient {
     }
   }
 
+  /** Authenticated, contract-checked response for bounded streaming downloads. */
+  protected async requestResponse(
+    method: string,
+    path: string,
+    query: Record<string, string> = {},
+    options: OpenGeniRequestOptions = {},
+  ): Promise<Response> {
+    const correlationId = crypto.randomUUID();
+    let response: Response;
+    try {
+      response = await this.fetchImpl(this.url(path, query), {
+        method,
+        headers: {
+          ...this.headers(correlationId),
+          Accept: "application/octet-stream",
+        },
+        ...(options.signal ? { signal: options.signal } : {}),
+      });
+    } catch (error) {
+      if (isMutationMethod(method)) throw mutationTransportError(correlationId);
+      throw error;
+    }
+    assertApiContractResponse(response);
+    if (!response.ok) {
+      throw await apiErrorFromResponse(response, { method, correlationId });
+    }
+    return response;
+  }
+
   /** Like `requestJson` for endpoints that respond with no body (204). */
   private async requestVoid(method: string, path: string, body?: unknown): Promise<void> {
     const correlationId = crypto.randomUUID();
@@ -3772,7 +5307,12 @@ function isUploadTranscriptionRecordingChunkResponse(
 ): value is UploadTranscriptionRecordingChunkResponse {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
   const record = value as Record<string, unknown>;
-  if (!isTranscriptionRecordingResponse({ recording: record.recording, segments: [] })) {
+  if (
+    !isTranscriptionRecordingResponse({
+      recording: record.recording,
+      segments: [],
+    })
+  ) {
     return false;
   }
   if (!record.chunk || typeof record.chunk !== "object" || Array.isArray(record.chunk)) {
@@ -3947,10 +5487,65 @@ async function sha256ForUpload(body: Blob | ArrayBuffer | string): Promise<strin
   return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 
+async function sha256Hex(bytes: Uint8Array): Promise<string> {
+  const owned = Uint8Array.from(bytes);
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", owned.buffer);
+  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+
 async function cancelResponseBody(response: Response, reason: string): Promise<void> {
   await response.body?.cancel(reason).catch(() => undefined);
 }
 
+function assertRetainedGeneratedImageReceipt(
+  workspaceId: string,
+  artifact: RetainedArtifactReference,
+): void {
+  if (!parseRetainedGeneratedImageReference(artifact, workspaceId)) {
+    throw new OpenGeniApiError(502, "retained generated image receipt is invalid");
+  }
+}
+
+function assertSafeArtifactDownloadUrl(value: FileDownloadUrlResponse): void {
+  if (
+    !value ||
+    typeof value.url !== "string" ||
+    typeof value.expiresAt !== "string" ||
+    !Number.isFinite(Date.parse(value.expiresAt))
+  ) {
+    throw new OpenGeniApiError(502, "retained artifact download URL is invalid");
+  }
+  let parsed: URL;
+  try {
+    parsed = new URL(value.url);
+  } catch {
+    throw new OpenGeniApiError(502, "retained artifact download URL is invalid");
+  }
+  if (!["http:", "https:"].includes(parsed.protocol) || parsed.username || parsed.password) {
+    throw new OpenGeniApiError(502, "retained artifact download URL is unsafe");
+  }
+}
+
+function assertSafeVideoArtifactPlaybackSource(
+  value: VideoArtifactPlaybackSource,
+  expectedArtifactId: string,
+): void {
+  if (
+    !value ||
+    value.schemaVersion !== 1 ||
+    value.artifactId !== expectedArtifactId ||
+    value.contentType !== "video/mp4" ||
+    value.acceptRanges !== "bytes" ||
+    !Number.isSafeInteger(value.sizeBytes) ||
+    value.sizeBytes <= 0 ||
+    value.sizeBytes > GENERATED_VIDEO_MAX_BYTES ||
+    !/^[0-9a-f]{64}$/.test(value.sha256)
+  ) {
+    throw new OpenGeniApiError(502, "generated-video playback source is invalid");
+  }
+  assertSafeArtifactDownloadUrl({ url: value.url, expiresAt: value.expiresAt });
+}
+
 function parseBoundedContentLength(value: string | null): number | null {
   if (value === null) return null;
   if (!/^\d+$/.test(value)) {