@opengeni/sdk 0.46.0 → 0.52.1

package/dist/{chunk-QKV5OCLJ.js → chunk-ILQZR5N6.js}

@@ -6,6 +6,17 @@ import {
   isAbortError,
   isRetryableStreamError
 } from "./chunk-V5F253OG.js";
+import {
+  OpenGeniInteractionClient
+} from "./chunk-MZWTWOX6.js";
+import {
+  COMPUTER_SCREENSHOT_MAX_BYTES,
+  GENERATED_VIDEO_MAX_BYTES,
+  OPENGENI_API_CONTRACT_HEADER,
+  OPENGENI_API_CONTRACT_REVISION,
+  OPENGENI_CORRELATION_HEADER,
+  RETAINED_OUTPUT_MAX_PAGE_BYTES
+} from "./chunk-FRJFNDIR.js";
 
 // src/sse.ts
 async function* parseSseStream(stream) {
@@ -82,6 +93,9 @@ async function* streamSessionEvents(transport, options = {}) {
   const reconnect = options.reconnect ?? true;
   const baseDelayMs = options.reconnectDelayMs ?? 500;
   const maxDelayMs = options.maxReconnectDelayMs ?? 1e4;
+  const jitterRatio = options.reconnectJitterRatio ?? 0.2;
+  const beforeLiveTimeoutMs = options.beforeLiveTimeoutMs ?? 15e3;
+  const heartbeatTimeoutMs = options.heartbeatTimeoutMs ?? 45e3;
   const maxAttempts = options.maxReconnectAttempts ?? Number.POSITIVE_INFINITY;
   let cursor = options.after ?? 0;
   let failedAttempts = 0;
@@ -96,9 +110,15 @@ async function* streamSessionEvents(transport, options = {}) {
       everConnected = true;
       failedAttempts = 0;
       delayMs = baseDelayMs;
-      await options.beforeLive?.();
+      try {
+        options.onOpen?.();
+      } catch {
+      }
+      await runBeforeLive(options.beforeLive, beforeLiveTimeoutMs, signal);
       options.onStateChange?.("live");
-      for await (const message of parseSseStream(body)) {
+      for await (const message of parseSseStream(
+        withStreamInactivityTimeout(body, heartbeatTimeoutMs, signal)
+      )) {
         if (signal?.aborted) {
           return;
         }
@@ -122,7 +142,7 @@ async function* streamSessionEvents(transport, options = {}) {
         return;
       }
       if (cursor === cursorAtOpen) {
-        await sleep(baseDelayMs, signal);
+        await sleep(jitteredDelay(baseDelayMs, jitterRatio), signal);
       }
       continue;
     } catch (error) {
@@ -139,10 +159,76 @@ async function* streamSessionEvents(transport, options = {}) {
         );
       }
     }
-    await sleep(delayMs, signal);
+    await sleep(jitteredDelay(delayMs, jitterRatio), signal);
     delayMs = Math.min(Math.max(delayMs * 2, baseDelayMs), maxDelayMs);
   }
 }
+async function runBeforeLive(beforeLive, timeoutMs, signal) {
+  if (!beforeLive) return;
+  let timer;
+  let abortListener;
+  const timeout = new Promise((_resolve, reject) => {
+    timer = setTimeout(
+      () => reject(new TypeError(`stream reconciliation timed out after ${timeoutMs}ms`)),
+      timeoutMs
+    );
+    if (signal) {
+      abortListener = () => reject(new DOMException("Aborted", "AbortError"));
+      signal.addEventListener("abort", abortListener, { once: true });
+    }
+  });
+  try {
+    await Promise.race([Promise.resolve().then(beforeLive), timeout]);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+    if (signal && abortListener) signal.removeEventListener("abort", abortListener);
+  }
+}
+function jitteredDelay(delayMs, ratio) {
+  if (delayMs <= 0 || ratio <= 0) return delayMs;
+  const boundedRatio = Math.min(ratio, 1);
+  const spread = delayMs * boundedRatio;
+  return Math.max(0, delayMs - spread + Math.random() * spread * 2);
+}
+function withStreamInactivityTimeout(stream, timeoutMs, signal) {
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) {
+    throw new RangeError("stream heartbeat timeout must be a positive safe integer");
+  }
+  const reader = stream.getReader();
+  return new ReadableStream({
+    pull: async (controller) => {
+      let timer;
+      let abortListener;
+      try {
+        const result = await Promise.race([
+          reader.read(),
+          new Promise((_resolve, reject) => {
+            timer = setTimeout(
+              () => reject(new TypeError(`event stream heartbeat timed out after ${timeoutMs}ms`)),
+              timeoutMs
+            );
+            if (signal) {
+              abortListener = () => reject(new DOMException("Aborted", "AbortError"));
+              signal.addEventListener("abort", abortListener, { once: true });
+            }
+          })
+        ]);
+        if (result.done) controller.close();
+        else controller.enqueue(result.value);
+      } catch (error) {
+        void reader.cancel(error).catch(() => {
+        });
+        controller.error(error);
+      } finally {
+        if (timer !== void 0) clearTimeout(timer);
+        if (signal && abortListener) signal.removeEventListener("abort", abortListener);
+      }
+    },
+    cancel: async (reason) => {
+      await reader.cancel(reason);
+    }
+  });
+}
 async function* backfillEvents(transport, fromExclusive, toInclusive) {
   let cursor = fromExclusive;
   while (cursor < toInclusive) {
@@ -197,6 +283,9 @@ async function* streamWorkspaceControlEvents(transport, options = {}) {
   const reconnect = options.reconnect ?? true;
   const baseDelayMs = options.reconnectDelayMs ?? 500;
   const maxDelayMs = options.maxReconnectDelayMs ?? 1e4;
+  const jitterRatio = options.reconnectJitterRatio ?? 0.2;
+  const beforeLiveTimeoutMs = options.beforeLiveTimeoutMs ?? 15e3;
+  const heartbeatTimeoutMs = options.heartbeatTimeoutMs ?? 45e3;
   const maxAttempts = options.maxReconnectAttempts ?? Number.POSITIVE_INFINITY;
   let cursor = options.after ?? 0;
   let failures = 0;
@@ -211,9 +300,11 @@ async function* streamWorkspaceControlEvents(transport, options = {}) {
       everConnected = true;
       failures = 0;
       delayMs = baseDelayMs;
-      await options.beforeLive?.();
+      await runBeforeLive(options.beforeLive, beforeLiveTimeoutMs, signal);
       options.onStateChange?.("live");
-      for await (const message of parseSseStream(body)) {
+      for await (const message of parseSseStream(
+        withStreamInactivityTimeout(body, heartbeatTimeoutMs, signal)
+      )) {
         if (signal?.aborted) return;
         const event = parseWorkspaceControlEvent(message.data);
         if (!event || event.sequence <= cursor) continue;
@@ -221,7 +312,7 @@ async function* streamWorkspaceControlEvents(transport, options = {}) {
         yield event;
       }
       if (!reconnect) return;
-      if (cursor === cursorAtOpen) await sleep2(baseDelayMs, signal);
+      if (cursor === cursorAtOpen) await sleep2(jitteredDelay(baseDelayMs, jitterRatio), signal);
       continue;
     } catch (error) {
       if (signal?.aborted || isAbortError(error)) return;
@@ -233,7 +324,7 @@ async function* streamWorkspaceControlEvents(transport, options = {}) {
         );
       }
     }
-    await sleep2(delayMs, signal);
+    await sleep2(jitteredDelay(delayMs, jitterRatio), signal);
     delayMs = Math.min(Math.max(delayMs * 2, baseDelayMs), maxDelayMs);
   }
 }
@@ -262,196 +353,177 @@ async function sleep2(delayMs, signal) {
   });
 }
 
-// src/types.ts
-var DEFAULT_FILE_RESOURCE_MOUNT_ROOT = ".opengeni/files";
-var SESSION_EVENT_TYPES = [
-  "session.created",
-  // Defensive bounded projection for malformed/legacy oversized envelopes.
-  "session.event.envelope_omitted",
-  "session.status.changed",
-  "session.realtime.started",
-  "session.realtime.ended",
-  "session.requiresAction",
-  "session.humanInput.requested",
-  "session.context.compaction.requested",
-  "session.context.compaction.started",
-  "session.context.compacted",
-  "session.context.compaction.skipped",
-  "session.context.cleared",
-  "user.message",
-  "user.pause",
-  "user.approvalDecision",
-  "user.humanInputResponse",
-  "turn.queued",
-  "turn.started",
-  "turn.completed",
-  "turn.failed",
-  "turn.cancelled",
-  "turn.superseded",
-  "turn.recovery.requested",
-  "turn.capacity_waiting",
-  "agent.message.delta",
-  "agent.message.completed",
-  "agent.reasoning.delta",
-  "agent.toolCall.created",
-  "agent.toolCall.output",
-  "agent.model.request",
-  "agent.model.usage",
-  "tool.auth_needed",
-  "credential.auth_needed",
-  "agent.updated",
-  "rig.setup.started",
-  "rig.setup.completed",
-  "rig.setup.skipped",
-  "rig.setup.failed",
-  "sandbox.operation.started",
-  "sandbox.operation.completed",
-  "sandbox.operation.failed",
-  "sandbox.command.output.delta",
-  "artifact.created",
-  "goal.set",
-  "goal.updated",
-  "goal.completed",
-  "goal.paused",
-  "goal.resumed",
-  "goal.cleared",
-  "goal.continuation",
-  "system.update.pending",
-  "system.update.delivered",
-  "system.update.superseded",
-  "system.update.cancelled",
-  "system.update.settled",
-  "session.control.paused",
-  "session.control.resumed",
-  "session.control.steer_requested",
-  "workspace.inference.paused",
-  "workspace.inference.resumed",
-  "session.queue.changed",
-  "session.queue.prompt.cancelled",
-  "session.queue.history",
-  "turn.event.rejected_late",
-  "memory.saved",
-  "memory.corrected",
-  // Channel-B desktop pixel-plane signals (mirror of contracts SessionEventType;
-  // the contract-parity test asserts sorted equality).
-  "stream.url.rotated",
-  "stream.opened",
-  "stream.closed",
-  "stream.revoked",
-  // Channel-B recording signals (P4.3 — "agent films itself proving the fix").
-  "recording.started",
-  "recording.available",
-  "recording.failed",
-  // Channel-A structured-service notifications (P4.4; mirror of contracts
-  // SessionEventType — the contract-parity test asserts sorted equality).
-  "fs.changed",
-  "git.changed",
-  "terminal.pty.started",
-  "terminal.pty.output.delta",
-  "terminal.pty.exited",
-  "session.title_set",
-  "session.mcp.approval_policy.updated",
-  "session.tool_policy.updated",
-  // Multi-account Codex (P1): the session's inference account changed.
-  "codex.account.switched",
-  // credential allocator metadata-only per-turn credential selection audit.
-  "codex.credential.selected",
-  // Bounded, identity-free deterministic shadow/replay decision.
-  "codex.fleet.decision",
-  // credential allocator durable zero-capacity wait lifecycle. These are system/runtime
-  // events, never synthetic user messages.
-  "codex.capacity.waiting",
-  "codex.capacity.resumed",
-  "codex.capacity.superseded",
-  // Sandbox durability observability (mirror of contracts SessionEventType):
-  // box lifecycle + manifest-env drift, attributable from the DB alone.
-  "sandbox.box.created",
-  "sandbox.box.lost",
-  "sandbox.box.terminated",
-  "sandbox.box.snapshot",
-  "sandbox.env.drift",
-  // Active-sandbox pointer reconcile (issue #341; announce-only; mirror of contracts
-  // SessionEventType — the contract-parity test asserts sorted equality).
-  "session.route.reconciled",
-  // Workbench v2 turn-end workspace capture (announce-only; mirror of contracts
-  // SessionEventType — the contract-parity test asserts sorted equality).
-  "workspace.revision.captured",
-  "workspace.revision.degraded",
-  // Connected Machine op-outcome observability (announce-only, quiet; mirror of
-  // contracts SessionEventType — the contract-parity test asserts sorted equality).
-  "machine.op.failed",
-  "machine.op.recovered",
-  // Connected Machine link-plane observability (announce-only, quiet; mirror of
-  // contracts SessionEventType — the contract-parity test asserts sorted equality).
-  "machine.link.lost",
-  "machine.link.restored",
-  "machine.runner.restarted"
-];
-var KNOWN_PERMISSIONS = [
-  "account:read",
-  "account:admin",
-  "members:manage",
-  "workspace:create",
-  "billing:read",
-  "billing:manage",
-  "workspace:read",
-  "workspace:admin",
-  "sessions:create",
-  "sessions:read",
-  "sessions:control",
-  // sandbox workspace (mirror of @opengeni/contracts Permission). stream:view is
-  // strictly broader than sessions:read (un-redacted pixels); stream:control is
-  // the never-granted-v1 raw-input plane; stream:acknowledge is the secret-leak
-  // consent gate.
-  "stream:view",
-  "stream:control",
-  "stream:acknowledge",
-  "files:upload",
-  "files:read",
-  "files:write",
-  "terminal:attach",
-  "documents:manage",
-  "documents:search",
-  "scheduled_tasks:manage",
-  "scheduled_tasks:run",
-  "github:manage",
-  "github:use",
-  "api_keys:manage",
-  "connections:read",
-  "connections:write",
-  "environments:manage",
-  "environments:use",
-  "variable-sets:manage",
-  "variable-sets:use",
-  "mcp_servers:attach",
-  "toolspace:call",
-  "goals:manage",
-  "enrollments:read",
-  "enrollments:manage",
-  "rigs:use",
-  "rigs:manage",
-  "artifacts:read",
-  "artifacts:publish"
-];
-var OPENGENI_API_CONTRACT_REVISION = "2026-07-workspace-artifacts-v1";
-var OPENGENI_API_CONTRACT_HEADER = "x-opengeni-api-contract";
-var OPENGENI_CORRELATION_HEADER = "x-opengeni-correlation-id";
-var RETAINED_OUTPUT_DEFAULT_PAGE_BYTES = 256 * 1024;
-var RETAINED_OUTPUT_MAX_PAGE_BYTES = 1024 * 1024;
-var KNOWN_USAGE_EVENT_TYPES = [
-  "agent_run.created",
-  "agent_run.completed",
-  "model.tokens",
-  "model.cost",
-  "file.uploaded",
-  "file.deleted",
-  "document.indexed",
-  "scheduled_task.fired",
-  "api_key.request",
-  // sandbox warm-time metering (P2.1) — mirrors contracts UsageEventType.
-  "sandbox.warm_seconds",
-  "sandbox.warm_cost"
-];
+// src/retained-artifacts.ts
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+var SHA256 = /^[0-9a-f]{64}$/;
+var ISO_DATETIME_WITH_OFFSET = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/;
+var WORKSPACE_PATH = /^\/v1\/workspaces\/([0-9a-f-]+)\/artifacts\/([0-9a-f-]+)\/content$/;
+var MAX_BYTES = 64 * 1024 * 1024;
+var MAX_VIDEO_BYTES = 512 * 1024 * 1024;
+var MAX_DIMENSION = 16384;
+var MAX_PIXELS = 67108864;
+var MAX_RANGE_BYTES = 1024 * 1024;
+function parseRetainedGeneratedImageReference(value, expectedWorkspaceId) {
+  if (!recordWithKeys(value, GENERATED_IMAGE_REFERENCE_KEYS)) return null;
+  const artifact = value;
+  if (artifact.available !== true || artifact.kind !== "generated_image" || typeof artifact.artifactId !== "string" || !UUID.test(artifact.artifactId) || !["image/png", "image/jpeg", "image/webp"].includes(String(artifact.contentType)) || !safeIntegerBetween(artifact.originalBytes, 1, MAX_BYTES) || typeof artifact.sha256 !== "string" || !SHA256.test(artifact.sha256) || typeof artifact.retainedAt !== "string" || artifact.retainedAt.length > 64 || !ISO_DATETIME_WITH_OFFSET.test(artifact.retainedAt) || !Number.isFinite(Date.parse(artifact.retainedAt)) || !recordWithKeys(artifact.dimensions, DIMENSION_KEYS) || !recordWithKeys(artifact.retention, RETENTION_KEYS) || !recordWithKeys(artifact.retrieval, RETRIEVAL_KEYS)) {
+    return null;
+  }
+  const dimensions = artifact.dimensions;
+  if (!safeIntegerBetween(dimensions.width, 1, MAX_DIMENSION) || !safeIntegerBetween(dimensions.height, 1, MAX_DIMENSION) || Number(dimensions.width) * Number(dimensions.height) > MAX_PIXELS) {
+    return null;
+  }
+  const retention = artifact.retention;
+  if (retention.policy !== "workspace_file" || retention.expiresAt !== null) return null;
+  const retrieval = artifact.retrieval;
+  if (retrieval.method !== "GET" || retrieval.acceptRanges !== "bytes" || retrieval.maxRangeBytes !== MAX_RANGE_BYTES || typeof retrieval.path !== "string" || retrieval.path.length > 256) {
+    return null;
+  }
+  const match = WORKSPACE_PATH.exec(retrieval.path);
+  if (!match || !UUID.test(match[1] ?? "") || match[2] !== artifact.artifactId || expectedWorkspaceId !== void 0 && match[1] !== expectedWorkspaceId) {
+    return null;
+  }
+  return value;
+}
+function generatedImageSandboxPathMatches(artifact, sandboxPath) {
+  if (typeof sandboxPath !== "string") return false;
+  const extension = artifact.contentType === "image/png" ? "png" : artifact.contentType === "image/jpeg" ? "jpg" : artifact.contentType === "image/webp" ? "webp" : null;
+  return extension !== null && sandboxPath === `/workspace/generated-images/generated-image-${artifact.artifactId}.${extension}`;
+}
+function parseGeneratedImageReceipt(value, expectedWorkspaceId) {
+  if (typeof value === "string" && value.length <= 4096) {
+    try {
+      return parseGeneratedImageReceipt(JSON.parse(value), expectedWorkspaceId);
+    } catch {
+      return null;
+    }
+  }
+  if (!recordWithKeys(value, GENERATED_IMAGE_RECEIPT_KEYS)) return null;
+  if (value.type !== "generated_image") return null;
+  const artifact = parseRetainedGeneratedImageReference(value.artifact, expectedWorkspaceId);
+  if (!artifact || !generatedImageSandboxPathMatches(artifact, value.sandboxPath)) return null;
+  return { type: "generated_image", artifact, sandboxPath: value.sandboxPath };
+}
+function parseRetainedGeneratedVideoReference(value, expectedWorkspaceId) {
+  if (!recordWithKeys(value, GENERATED_IMAGE_REFERENCE_KEYS)) return null;
+  const artifact = value;
+  if (artifact.available !== true || artifact.kind !== "generated_video" || typeof artifact.artifactId !== "string" || !UUID.test(artifact.artifactId) || artifact.contentType !== "video/mp4" || !safeIntegerBetween(artifact.originalBytes, 1, MAX_VIDEO_BYTES) || typeof artifact.sha256 !== "string" || !SHA256.test(artifact.sha256) || typeof artifact.retainedAt !== "string" || artifact.retainedAt.length > 64 || !ISO_DATETIME_WITH_OFFSET.test(artifact.retainedAt) || !Number.isFinite(Date.parse(artifact.retainedAt)) || !recordWithKeys(artifact.dimensions, DIMENSION_KEYS) || !recordWithKeys(artifact.retention, RETENTION_KEYS) || !recordWithKeys(artifact.retrieval, RETRIEVAL_KEYS)) {
+    return null;
+  }
+  const dimensions = artifact.dimensions;
+  if (!safeIntegerBetween(dimensions.width, 1, 8192) || !safeIntegerBetween(dimensions.height, 1, 8192)) {
+    return null;
+  }
+  const retention = artifact.retention;
+  if (retention.policy !== "workspace_file" || retention.expiresAt !== null) return null;
+  const retrieval = artifact.retrieval;
+  if (retrieval.method !== "GET" || retrieval.acceptRanges !== "bytes" || retrieval.maxRangeBytes !== MAX_RANGE_BYTES || typeof retrieval.path !== "string" || retrieval.path.length > 256) {
+    return null;
+  }
+  const match = WORKSPACE_PATH.exec(retrieval.path);
+  if (!match || !UUID.test(match[1] ?? "") || match[2] !== artifact.artifactId || expectedWorkspaceId !== void 0 && match[1] !== expectedWorkspaceId) {
+    return null;
+  }
+  return value;
+}
+function parseGeneratedVideoReceipt(value, expectedWorkspaceId) {
+  if (typeof value === "string" && value.length <= 8192) {
+    try {
+      return parseGeneratedVideoReceipt(JSON.parse(value), expectedWorkspaceId);
+    } catch {
+      return null;
+    }
+  }
+  if (!recordWithKeys(value, GENERATED_VIDEO_RECEIPT_KEYS)) return null;
+  if (value.type !== "generated_video" || value.schemaVersion !== 1 || typeof value.operationId !== "string" || !UUID.test(value.operationId) || !recordWithKeys(value.video, GENERATED_VIDEO_FACT_KEYS)) {
+    return null;
+  }
+  const artifact = parseRetainedGeneratedVideoReference(value.artifact, expectedWorkspaceId);
+  const video = value.video;
+  if (!artifact || typeof value.sandboxPath !== "string" || value.sandboxPath !== `/workspace/generated-videos/generated-video-${artifact.artifactId}.mp4` || typeof video.durationSeconds !== "number" || !Number.isFinite(video.durationSeconds) || video.durationSeconds <= 0 || video.durationSeconds > 120 || video.width !== artifact.dimensions?.width || video.height !== artifact.dimensions?.height || typeof video.fps !== "number" || !Number.isFinite(video.fps) || video.fps <= 0 || video.fps > 120 || typeof video.hasAudio !== "boolean" || video.videoCodec !== "h264" || video.audioCodec !== null && video.audioCodec !== "aac") {
+    return null;
+  }
+  return value;
+}
+function parseMediaGenerationResult(value, expectedWorkspaceId) {
+  if (typeof value === "string" && value.length <= 12e3) {
+    try {
+      return parseMediaGenerationResult(JSON.parse(value), expectedWorkspaceId);
+    } catch {
+      return null;
+    }
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const result = value;
+  if (result.type !== "media_generation_result" || result.schemaVersion !== 1 || typeof result.operationId !== "string" || !UUID.test(result.operationId)) {
+    return null;
+  }
+  if (result.status === "ready") {
+    if (!recordWithKeys(result, MEDIA_RESULT_READY_KEYS)) return null;
+    const receipt = parseGeneratedVideoReceipt(result.receipt, expectedWorkspaceId);
+    if (!receipt || receipt.operationId !== result.operationId) return null;
+    return value;
+  }
+  if (!["provider_failed", "retention_failed", "cancelled_before_submit", "outcome_unknown"].includes(
+    String(result.status)
+  ) || !recordWithKeys(result, MEDIA_RESULT_FAILURE_KEYS) || typeof result.boundedPublicReason !== "string" || result.boundedPublicReason.length < 1 || result.boundedPublicReason.length > 1e3) {
+    return null;
+  }
+  return value;
+}
+var GENERATED_IMAGE_REFERENCE_KEYS = /* @__PURE__ */ new Set([
+  "available",
+  "artifactId",
+  "kind",
+  "contentType",
+  "originalBytes",
+  "sha256",
+  "retainedAt",
+  "dimensions",
+  "retention",
+  "retrieval"
+]);
+var DIMENSION_KEYS = /* @__PURE__ */ new Set(["width", "height"]);
+var RETENTION_KEYS = /* @__PURE__ */ new Set(["policy", "expiresAt"]);
+var RETRIEVAL_KEYS = /* @__PURE__ */ new Set(["method", "path", "acceptRanges", "maxRangeBytes"]);
+var GENERATED_IMAGE_RECEIPT_KEYS = /* @__PURE__ */ new Set(["type", "artifact", "sandboxPath"]);
+var GENERATED_VIDEO_RECEIPT_KEYS = /* @__PURE__ */ new Set([
+  "type",
+  "schemaVersion",
+  "operationId",
+  "artifact",
+  "video",
+  "sandboxPath"
+]);
+var GENERATED_VIDEO_FACT_KEYS = /* @__PURE__ */ new Set([
+  "durationSeconds",
+  "width",
+  "height",
+  "fps",
+  "hasAudio",
+  "videoCodec",
+  "audioCodec"
+]);
+var MEDIA_RESULT_READY_KEYS = /* @__PURE__ */ new Set([
+  "type",
+  "schemaVersion",
+  "status",
+  "operationId",
+  "receipt"
+]);
+var MEDIA_RESULT_FAILURE_KEYS = /* @__PURE__ */ new Set([
+  "type",
+  "schemaVersion",
+  "status",
+  "operationId",
+  "boundedPublicReason"
+]);
+function recordWithKeys(value, allowed) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === allowed.size && Object.keys(value).every((key) => allowed.has(key));
+}
+function safeIntegerBetween(value, min, max) {
+  return Number.isSafeInteger(value) && Number(value) >= min && Number(value) <= max;
+}
 
 // src/client.ts
 function sessionListQuery(options) {
@@ -465,10 +537,15 @@ var OpenGeniClient = class {
   baseUrl;
   options;
   fetchImpl;
+  readInFlight = /* @__PURE__ */ new Map();
+  readTrailing = /* @__PURE__ */ new Map();
+  /** Resource-oriented Browser/Computer facade over this exact authenticated client. */
+  interaction;
   constructor(options) {
     this.baseUrl = options.baseUrl.replace(/\/+$/, "");
     this.options = options;
     this.fetchImpl = options.fetch ?? ((input, init) => fetch(input, init));
+    this.interaction = new OpenGeniInteractionClient(this);
   }
   // --- Session lifecycle ---------------------------------------------------
   /** Make one finalization attempt for a recording; callers may retry retained audio. */
@@ -476,7 +553,11 @@ var OpenGeniClient = class {
     const correlationId = crypto.randomUUID();
     const form = new FormData();
     const filename = filenameForAudioMimeType(input.mimeType);
-    const audio = input.audio instanceof File ? input.audio : input.audio instanceof Uint8Array ? new File([Uint8Array.from(input.audio)], filename, { type: input.mimeType }) : new File([input.audio], filename, { type: input.mimeType || input.audio.type });
+    const audio = input.audio instanceof File ? input.audio : input.audio instanceof Uint8Array ? new File([Uint8Array.from(input.audio)], filename, {
+      type: input.mimeType
+    }) : new File([input.audio], filename, {
+      type: input.mimeType || input.audio.type
+    });
     form.append("audio", audio, filename);
     form.append("mimeType", input.mimeType);
     if (input.durationSeconds !== void 0) {
@@ -486,7 +567,10 @@ var OpenGeniClient = class {
     try {
       response = await this.fetchImpl(this.url(`/v1/workspaces/${workspaceId}/transcriptions`), {
         method: "POST",
-        headers: { ...this.headers(correlationId), Accept: "application/json" },
+        headers: {
+          ...this.headers(correlationId),
+          Accept: "application/json"
+        },
         body: form,
         ...input.signal ? { signal: input.signal } : {}
       });
@@ -495,7 +579,11 @@ var OpenGeniClient = class {
       throw mutationTransportError(correlationId);
     }
     assertApiContractResponse(response);
-    if (!response.ok) throw await apiErrorFromResponse(response, { method: "POST", correlationId });
+    if (!response.ok)
+      throw await apiErrorFromResponse(response, {
+        method: "POST",
+        correlationId
+      });
     await assertJsonResponse(response, { method: "POST", correlationId });
     let body;
     try {
@@ -580,7 +668,11 @@ var OpenGeniClient = class {
       throw mutationTransportError(correlationId);
     }
     assertApiContractResponse(response);
-    if (!response.ok) throw await apiErrorFromResponse(response, { method: "PUT", correlationId });
+    if (!response.ok)
+      throw await apiErrorFromResponse(response, {
+        method: "PUT",
+        correlationId
+      });
     await assertJsonResponse(response, { method: "PUT", correlationId });
     const body = await response.json().catch(() => null);
     if (!isUploadTranscriptionRecordingChunkResponse(body)) {
@@ -649,11 +741,9 @@ var OpenGeniClient = class {
       request
     );
   }
-  async getSession(workspaceId, sessionId) {
-    return await this.requestJson(
-      "GET",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}`
-    );
+  async getSession(workspaceId, sessionId, options = {}) {
+    const path = `/v1/workspaces/${workspaceId}/sessions/${sessionId}`;
+    return await this.singleFlightRead(path, () => this.requestJson("GET", path), options);
   }
   async updateSession(workspaceId, sessionId, request) {
     return await this.requestJson(
@@ -737,6 +827,21 @@ var OpenGeniClient = class {
     }
     return response;
   }
+  /** Compact, bounded workspace agent hierarchy page. */
+  async listAgentTopology(workspaceId, options = {}) {
+    const search = options.search?.trim();
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/agent-topology`,
+      void 0,
+      {
+        ...options.limit !== void 0 ? { limit: String(options.limit) } : {},
+        ...options.parentSessionId === void 0 ? {} : { parentSessionId: options.parentSessionId ?? "null" },
+        ...options.cursor ? { cursor: options.cursor } : {},
+        ...search ? { search } : {}
+      }
+    );
+  }
   /** Set this authenticated member's personal workspace pin for a session. */
   async updateSessionPin(workspaceId, sessionId, request) {
     return await this.requestJson(
@@ -746,10 +851,34 @@ var OpenGeniClient = class {
     );
   }
   async getSessionLineage(workspaceId, sessionId) {
-    return await this.requestJson(
-      "GET",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/lineage`
-    );
+    const path = `/v1/workspaces/${workspaceId}/sessions/${sessionId}/lineage`;
+    return await this.singleFlightRead(
+      path,
+      () => this.requestJson("GET", path)
+    );
+  }
+  singleFlightRead(key, read, options = {}) {
+    const existing = this.readInFlight.get(key);
+    if (existing) {
+      if (!options.fresh) return existing;
+      const queued = this.readTrailing.get(key);
+      if (queued) return queued;
+      const trailing = existing.then(
+        () => this.singleFlightRead(key, read),
+        () => this.singleFlightRead(key, read)
+      );
+      this.readTrailing.set(key, trailing);
+      const clear = () => {
+        if (this.readTrailing.get(key) === trailing) this.readTrailing.delete(key);
+      };
+      void trailing.then(clear, clear);
+      return trailing;
+    }
+    const promise = read().finally(() => {
+      if (this.readInFlight.get(key) === promise) this.readInFlight.delete(key);
+    });
+    this.readInFlight.set(key, promise);
+    return promise;
   }
   /** Negotiate one server-mediated connected-Codex GPT-Live V3 WebRTC call. */
   async negotiateCodexRealtimeWebrtc(workspaceId, sessionId, request, options = {}) {
@@ -826,7 +955,9 @@ var OpenGeniClient = class {
   }
   /** Newest turn that durably emitted `turn.started`, or null before any admission. */
   async getLatestStartedTurn(workspaceId, sessionId) {
-    const turns = await this.listTurns(workspaceId, sessionId, { latestStarted: true });
+    const turns = await this.listTurns(workspaceId, sessionId, {
+      latestStarted: true
+    });
     return turns[0] ?? null;
   }
   // --- Bring-your-own-compute: Machines dashboard + metrics (M10) ------------
@@ -860,6 +991,19 @@ var OpenGeniClient = class {
     );
     return response.samples;
   }
+  /**
+   * Remove one connected self-hosted machine enrollment. The control-plane
+   * operation works while the agent is offline, revokes future reconnects,
+   * retains history, and returns a typed blocker when active route/lease or
+   * recovery dependencies make removal unsafe. `idempotencyKey` is replay-safe.
+   */
+  async removeEnrollment(workspaceId, enrollmentId, request = {}) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/enrollments/${enrollmentId}/revoke`,
+      request
+    );
+  }
   // --- Self-hosted enrollment UX (design 11) --------------------------------
   /**
    * Resolve a pending device-enrollment flow by its user_code for the click-Grant
@@ -1144,9 +1288,10 @@ var OpenGeniClient = class {
   }
   // --- Turn queue ------------------------------------------------------------
   async getQueue(workspaceId, sessionId) {
-    return await this.requestJson(
-      "GET",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/queue`
+    const path = `/v1/workspaces/${workspaceId}/sessions/${sessionId}/queue`;
+    return await this.singleFlightRead(
+      path,
+      () => this.requestJson("GET", path)
     );
   }
   async moveQueueItem(workspaceId, sessionId, turnId, request) {
@@ -1314,10 +1459,8 @@ var OpenGeniClient = class {
   // --- Goals -------------------------------------------------------------------
   /** The session's goal. 404s when the session never had one. */
   async getGoal(workspaceId, sessionId) {
-    return await this.requestJson(
-      "GET",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/goal`
-    );
+    const path = `/v1/workspaces/${workspaceId}/sessions/${sessionId}/goal`;
+    return await this.singleFlightRead(path, () => this.requestJson("GET", path));
   }
   async updateGoal(workspaceId, sessionId, request) {
     return await this.requestJson(
@@ -1377,6 +1520,16 @@ var OpenGeniClient = class {
       options
     );
   }
+  /** FileSystem: hydrate several independent directories behind one sandbox lease. */
+  async fsListBatch(workspaceId, sessionId, request, options = {}) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/fs/list-batch`,
+      request,
+      {},
+      options
+    );
+  }
   /** FileSystem: read a file (text or base64; binary-safe, size-capped). */
   async fsRead(workspaceId, sessionId, request, options = {}) {
     return await this.requestJson(
@@ -1439,6 +1592,16 @@ var OpenGeniClient = class {
       options
     );
   }
+  /** Git: read status and optional diffs for several repositories behind one sandbox lease. */
+  async gitReadBatch(workspaceId, sessionId, request, options = {}) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/git/read-batch`,
+      request,
+      {},
+      options
+    );
+  }
   /** Git: commit log. */
   async gitLog(workspaceId, sessionId, request = {}) {
     return await this.requestJson(
@@ -1554,13 +1717,11 @@ var OpenGeniClient = class {
     );
   }
   /** Attach a viewer holder (refcounted liveness — keeps the box warm while
-   *  watched/used), spinning the box up in-process when cold, and mint the scoped
-   *  direct-to-provider URLs for the requested plane(s). `request.desktop:true`
-   *  opts into the un-redacted pixel plane and mints the noVNC URL — that plane
-   *  alone throws `OpenGeniApiError(409)` when the un-redacted/shared
-   *  acknowledgment is missing (the consent gate). A terminal-only attach
-   *  (`desktop` omitted/false) warms the box + mints the pty-ws terminal cell with
-   *  NO consent gate. An omitted `viewerId` mints a fresh one. */
+   *  watched/used), spinning the box up in-process when cold. Exact plane flags
+   *  mint only the requested short-lived credentials and enforce that plane's
+   *  permission. `desktop:true` alone carries the un-redacted/shared consent
+   *  gate. An entirely omitted plane set retains the legacy terminal-only
+   *  meaning; current clients should send all three flags. */
   async attachViewer(workspaceId, sessionId, request = {}) {
     return await this.requestJson(
       "POST",
@@ -1585,132 +1746,438 @@ var OpenGeniClient = class {
       `/v1/workspaces/${workspaceId}/sessions/${sessionId}/viewers/${viewerId}`
     );
   }
-  // --- Access + workspaces -----------------------------------------------------
-  /**
-   * The deployment's public client bootstrap config: the host-exposed models
-   * (provider-grouped in `models`, flat in `allowedModels` for back-compat),
-   * reasoning efforts, MCP servers, file-upload limits, and how the client is
-   * expected to authenticate. Drives a composer's model picker without prior
-   * knowledge of the host setup; safe to call before any auth is established.
-   */
-  async getClientConfig() {
-    const config = await this.requestJson("GET", "/v1/config/client");
-    if (config.apiContractRevision !== OPENGENI_API_CONTRACT_REVISION) {
-      throw new OpenGeniApiContractMismatchError(
-        OPENGENI_API_CONTRACT_REVISION,
-        String(config.apiContractRevision || "(missing)")
-      );
-    }
-    return config;
-  }
-  /** Authenticated model definitions plus workspace-specific selectability. */
-  async getWorkspaceModelCatalog(workspaceId) {
+  // --- Browser / Computer interaction resources --------------------------------
+  async listAttachedBrowsers(workspaceId, options = {}) {
     return await this.requestJson(
       "GET",
-      `/v1/workspaces/${workspaceId}/model-catalog`
+      `/v1/workspaces/${workspaceId}/attached-browsers`,
+      void 0,
+      options.includeDisconnected ? { includeDisconnected: "true" } : {},
+      options
     );
   }
-  /** Authenticated realtime voice models and credential readiness. */
-  async getWorkspaceRealtimeModelCatalog(workspaceId) {
+  async getAttachedBrowser(workspaceId, deviceId, options = {}) {
     return await this.requestJson(
       "GET",
-      `/v1/workspaces/${workspaceId}/realtime-model-catalog`
+      `/v1/workspaces/${workspaceId}/attached-browsers/${encodeURIComponent(deviceId)}`,
+      void 0,
+      {},
+      options
     );
   }
-  /** The caller's access context: subject, account + workspace grants, defaults. */
-  async getAccessContext() {
-    return await this.requestJson("GET", "/v1/access/me");
-  }
-  async listWorkspaces() {
-    return await this.requestJson("GET", "/v1/workspaces");
-  }
-  async createWorkspace(request) {
-    return await this.requestJson("POST", "/v1/workspaces", request);
-  }
-  async getWorkspace(workspaceId) {
-    return await this.requestJson("GET", `/v1/workspaces/${workspaceId}`);
-  }
-  /** Read-time, secret-safe inventory of policy heads and visible workspace knowledge. */
-  async getWorkspaceState(workspaceId, options = {}) {
-    const params = new URLSearchParams();
-    if (options.attemptId) params.set("attemptId", options.attemptId);
-    const query = params.size > 0 ? `?${params.toString()}` : "";
+  async listBrowserIdentities(workspaceId, options = {}) {
     return await this.requestJson(
       "GET",
-      `/v1/workspaces/${workspaceId}/workspace-state${query}`
+      `/v1/workspaces/${workspaceId}/browser-identities`,
+      void 0,
+      options.includeArchived ? { includeArchived: "true" } : {},
+      options
     );
   }
-  /** Download the canonical, explicitly sanitized Workspace State export. */
-  async exportWorkspaceState(workspaceId, options = {}) {
-    const params = new URLSearchParams();
-    if (options.attemptId) params.set("attemptId", options.attemptId);
-    const query = params.size > 0 ? `?${params.toString()}` : "";
+  async getBrowserIdentity(workspaceId, identityId, options = {}) {
     return await this.requestJson(
       "GET",
-      `/v1/workspaces/${workspaceId}/workspace-state/export${query}`
+      `/v1/workspaces/${workspaceId}/browser-identities/${encodeURIComponent(identityId)}`,
+      void 0,
+      {},
+      options
     );
   }
-  async updateWorkspace(workspaceId, request) {
-    return await this.requestJson("PATCH", `/v1/workspaces/${workspaceId}`, request);
+  async createBrowserIdentity(workspaceId, request, options = {}) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/browser-identities`,
+      request,
+      {},
+      options
+    );
   }
-  /** Inspect immutable instruction-policy history, active heads, and activation audit evidence. */
-  async listWorkspaceInstructionPolicies(workspaceId, options = {}) {
-    const params = new URLSearchParams();
-    if (options.kind !== void 0) params.set("kind", options.kind);
-    if (options.scope !== void 0) params.set("scope", options.scope);
-    if (options.roleKey !== void 0) params.set("roleKey", options.roleKey);
-    if (options.afterRevision !== void 0) {
-      params.set("afterRevision", String(options.afterRevision));
-    }
-    if (options.limit !== void 0) params.set("limit", String(options.limit));
-    const query = params.toString();
+  async listBrowserRevisions(workspaceId, identityId, options = {}) {
     return await this.requestJson(
       "GET",
-      `/v1/workspaces/${workspaceId}/instruction-policies${query ? `?${query}` : ""}`
+      `/v1/workspaces/${workspaceId}/browser-identities/${encodeURIComponent(identityId)}/revisions`,
+      void 0,
+      {},
+      options
     );
   }
-  async getWorkspaceInstructionPolicyRevision(workspaceId, revisionId) {
+  /** Workspace-wide BrowserSession inventory. Associations express relevance,
+   *  not access: peers and child agents intentionally remain discoverable. */
+  async listBrowserSessions(workspaceId, options = {}) {
     return await this.requestJson(
       "GET",
-      `/v1/workspaces/${workspaceId}/instruction-policies/${encodeURIComponent(revisionId)}`
+      `/v1/workspaces/${workspaceId}/browser-sessions`,
+      void 0,
+      {},
+      options
     );
   }
-  async createWorkspaceInstructionPolicyDraft(workspaceId, request) {
+  async getBrowserSession(workspaceId, browserSessionId, options = {}) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}`,
+      void 0,
+      {},
+      options
+    );
+  }
+  async createBrowserSession(workspaceId, request, options = {}) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/instruction-policies/drafts`,
-      request
+      `/v1/workspaces/${workspaceId}/browser-sessions`,
+      request,
+      {},
+      options
     );
   }
-  /** List the newest immutable onboarding proposals and their inactive policy drafts. */
-  async listWorkspaceInstructionPolicyOnboardingProposals(workspaceId, options = {}) {
-    const params = new URLSearchParams();
-    if (options.limit !== void 0) params.set("limit", String(options.limit));
-    const query = params.toString();
+  async listBrowserTargets(workspaceId, browserSessionId, options = {}) {
     return await this.requestJson(
       "GET",
-      `/v1/workspaces/${workspaceId}/instruction-policies/onboarding-proposals${query ? `?${query}` : ""}`
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/targets`,
+      void 0,
+      {},
+      options
     );
   }
-  /** Create one draft-only proposal against an exact active-policy baseline. */
-  async createWorkspaceInstructionPolicyOnboardingProposal(workspaceId, request) {
+  async openBrowserTarget(workspaceId, browserSessionId, request = {}, options = {}) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/instruction-policies/onboarding-proposals`,
-      request
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/targets`,
+      request,
+      {},
+      options
     );
   }
-  /** Import the stored legacy workspace override as an inactive charter draft. */
-  async importLegacyWorkspaceInstructionPolicyDraft(workspaceId, request = {}) {
+  async selectBrowserTarget(workspaceId, browserSessionId, targetId, options = {}) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/instruction-policies/import-legacy`,
-      request
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/targets/${encodeURIComponent(targetId)}/select`,
+      {},
+      {},
+      options
     );
   }
-  async diffWorkspaceInstructionPolicyRevisions(workspaceId, request) {
-    const params = new URLSearchParams({
-      fromRevisionId: request.fromRevisionId,
+  async closeBrowserTarget(workspaceId, browserSessionId, targetId, options = {}) {
+    return await this.requestJson(
+      "DELETE",
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/targets/${encodeURIComponent(targetId)}`,
+      void 0,
+      {},
+      options
+    );
+  }
+  async observeBrowserTarget(workspaceId, browserSessionId, targetId, options = {}) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/targets/${encodeURIComponent(targetId)}/observation`,
+      void 0,
+      {},
+      options
+    );
+  }
+  async actInBrowser(workspaceId, browserSessionId, request, options = {}) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/actions`,
+      request,
+      {},
+      options
+    );
+  }
+  async getBrowserActionReceipt(workspaceId, browserSessionId, operationId, options = {}) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/operations/${encodeURIComponent(operationId)}`,
+      void 0,
+      {},
+      options
+    );
+  }
+  async listBrowserDiagnostics(workspaceId, browserSessionId, targetId, options = {}) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/targets/${encodeURIComponent(targetId)}/diagnostics`,
+      void 0,
+      {
+        ...options.kinds?.length ? { kinds: options.kinds.join(",") } : {},
+        ...options.after !== void 0 ? { after: String(options.after) } : {},
+        ...options.limit !== void 0 ? { limit: String(options.limit) } : {}
+      },
+      options.signal ? { signal: options.signal } : {}
+    );
+  }
+  async attachBrowserSession(workspaceId, browserSessionId, request, options = {}) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/attachments`,
+      request,
+      {},
+      options
+    );
+  }
+  async heartbeatBrowserSession(workspaceId, browserSessionId, options = {}) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/heartbeat`,
+      {},
+      {},
+      options
+    );
+  }
+  async publishBrowserRevision(workspaceId, browserSessionId, request, options = {}) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/revisions`,
+      request,
+      {},
+      options
+    );
+  }
+  async suspendBrowserSession(workspaceId, browserSessionId, request, options = {}) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/suspend`,
+      request,
+      {},
+      options
+    );
+  }
+  async resumeBrowserSession(workspaceId, browserSessionId, request, options = {}) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/resume`,
+      request,
+      {},
+      options
+    );
+  }
+  async endBrowserSession(workspaceId, browserSessionId, request, options = {}) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/end`,
+      request,
+      {},
+      options
+    );
+  }
+  /** Workspace-wide ComputerSession inventory. Associations express
+   * relevance, not access; peer sessions intentionally remain discoverable. */
+  async listComputerSessions(workspaceId, options = {}) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/computer-sessions`,
+      void 0,
+      {},
+      options
+    );
+  }
+  async getComputerSession(workspaceId, computerSessionId, options = {}) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/computer-sessions/${encodeURIComponent(computerSessionId)}`,
+      void 0,
+      {},
+      options
+    );
+  }
+  async createComputerSession(workspaceId, request, options = {}) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/computer-sessions`,
+      request,
+      {},
+      options
+    );
+  }
+  async listComputerTargets(workspaceId, computerSessionId, options = {}) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/computer-sessions/${encodeURIComponent(computerSessionId)}/targets`,
+      void 0,
+      {},
+      options
+    );
+  }
+  async observeComputerTarget(workspaceId, computerSessionId, targetId, options = {}) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/computer-sessions/${encodeURIComponent(computerSessionId)}/targets/${encodeURIComponent(targetId)}/observation`,
+      void 0,
+      {},
+      options
+    );
+  }
+  async actInComputer(workspaceId, computerSessionId, request, options = {}) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/computer-sessions/${encodeURIComponent(computerSessionId)}/actions`,
+      request,
+      {},
+      options
+    );
+  }
+  async getComputerActionReceipt(workspaceId, computerSessionId, operationId, options = {}) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/computer-sessions/${encodeURIComponent(computerSessionId)}/operations/${encodeURIComponent(operationId)}`,
+      void 0,
+      {},
+      options
+    );
+  }
+  async attachComputerSession(workspaceId, computerSessionId, request, options = {}) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/computer-sessions/${encodeURIComponent(computerSessionId)}/attachments`,
+      request,
+      {},
+      options
+    );
+  }
+  async heartbeatComputerSession(workspaceId, computerSessionId, options = {}) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/computer-sessions/${encodeURIComponent(computerSessionId)}/heartbeat`,
+      {},
+      {},
+      options
+    );
+  }
+  async endComputerSession(workspaceId, computerSessionId, request, options = {}) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/computer-sessions/${encodeURIComponent(computerSessionId)}/end`,
+      request,
+      {},
+      options
+    );
+  }
+  // --- Access + workspaces -----------------------------------------------------
+  /**
+   * The deployment's public client bootstrap config: the host-exposed models
+   * (provider-grouped in `models`, flat in `allowedModels` for back-compat),
+   * reasoning efforts, MCP servers, file-upload limits, and how the client is
+   * expected to authenticate. Drives a composer's model picker without prior
+   * knowledge of the host setup; safe to call before any auth is established.
+   */
+  async getClientConfig() {
+    const config = await this.requestJson("GET", "/v1/config/client");
+    if (config.apiContractRevision !== OPENGENI_API_CONTRACT_REVISION) {
+      throw new OpenGeniApiContractMismatchError(
+        OPENGENI_API_CONTRACT_REVISION,
+        String(config.apiContractRevision || "(missing)")
+      );
+    }
+    return config;
+  }
+  /** Authenticated model definitions plus workspace-specific selectability. */
+  async getWorkspaceModelCatalog(workspaceId) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/model-catalog`
+    );
+  }
+  /** Authenticated realtime voice models and credential readiness. */
+  async getWorkspaceRealtimeModelCatalog(workspaceId) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/realtime-model-catalog`
+    );
+  }
+  /** The caller's access context: subject, account + workspace grants, defaults. */
+  async getAccessContext() {
+    return await this.requestJson("GET", "/v1/access/me");
+  }
+  async listWorkspaces() {
+    return await this.requestJson("GET", "/v1/workspaces");
+  }
+  async createWorkspace(request) {
+    return await this.requestJson("POST", "/v1/workspaces", request);
+  }
+  async getWorkspace(workspaceId) {
+    return await this.requestJson("GET", `/v1/workspaces/${workspaceId}`);
+  }
+  /** Read-time, secret-safe inventory of policy heads and visible workspace knowledge. */
+  async getWorkspaceState(workspaceId, options = {}) {
+    const params = new URLSearchParams();
+    if (options.attemptId) params.set("attemptId", options.attemptId);
+    const query = params.size > 0 ? `?${params.toString()}` : "";
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/workspace-state${query}`
+    );
+  }
+  /** Download the canonical, explicitly sanitized Workspace State export. */
+  async exportWorkspaceState(workspaceId, options = {}) {
+    const params = new URLSearchParams();
+    if (options.attemptId) params.set("attemptId", options.attemptId);
+    const query = params.size > 0 ? `?${params.toString()}` : "";
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/workspace-state/export${query}`
+    );
+  }
+  async updateWorkspace(workspaceId, request) {
+    return await this.requestJson("PATCH", `/v1/workspaces/${workspaceId}`, request);
+  }
+  /** Inspect immutable instruction-policy history, active heads, and activation audit evidence. */
+  async listWorkspaceInstructionPolicies(workspaceId, options = {}) {
+    const params = new URLSearchParams();
+    if (options.kind !== void 0) params.set("kind", options.kind);
+    if (options.scope !== void 0) params.set("scope", options.scope);
+    if (options.roleKey !== void 0) params.set("roleKey", options.roleKey);
+    if (options.afterRevision !== void 0) {
+      params.set("afterRevision", String(options.afterRevision));
+    }
+    if (options.limit !== void 0) params.set("limit", String(options.limit));
+    const query = params.toString();
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/instruction-policies${query ? `?${query}` : ""}`
+    );
+  }
+  async getWorkspaceInstructionPolicyRevision(workspaceId, revisionId) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/instruction-policies/${encodeURIComponent(revisionId)}`
+    );
+  }
+  async createWorkspaceInstructionPolicyDraft(workspaceId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/instruction-policies/drafts`,
+      request
+    );
+  }
+  /** List the newest immutable onboarding proposals and their inactive policy drafts. */
+  async listWorkspaceInstructionPolicyOnboardingProposals(workspaceId, options = {}) {
+    const params = new URLSearchParams();
+    if (options.limit !== void 0) params.set("limit", String(options.limit));
+    const query = params.toString();
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/instruction-policies/onboarding-proposals${query ? `?${query}` : ""}`
+    );
+  }
+  /** Create one draft-only proposal against an exact active-policy baseline. */
+  async createWorkspaceInstructionPolicyOnboardingProposal(workspaceId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/instruction-policies/onboarding-proposals`,
+      request
+    );
+  }
+  /** Import the stored legacy workspace override as an inactive charter draft. */
+  async importLegacyWorkspaceInstructionPolicyDraft(workspaceId, request = {}) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/instruction-policies/import-legacy`,
+      request
+    );
+  }
+  async diffWorkspaceInstructionPolicyRevisions(workspaceId, request) {
+    const params = new URLSearchParams({
+      fromRevisionId: request.fromRevisionId,
       toRevisionId: request.toRevisionId
     });
     return await this.requestJson(
@@ -1732,6 +2199,52 @@ var OpenGeniClient = class {
       request
     );
   }
+  /** Read the current organization profile plus immutable revision and activation history. */
+  async listCompanyProfile(workspaceId, options = {}) {
+    const params = new URLSearchParams();
+    if (options.afterRevision !== void 0)
+      params.set("afterRevision", String(options.afterRevision));
+    if (options.limit !== void 0) params.set("limit", String(options.limit));
+    const query = params.toString();
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/company-profile${query ? `?${query}` : ""}`
+    );
+  }
+  async getCompanyProfileRevision(workspaceId, revisionId) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/company-profile/revisions/${encodeURIComponent(revisionId)}`
+    );
+  }
+  async updateCompanyProfile(workspaceId, request) {
+    return await this.requestJson(
+      "PUT",
+      `/v1/workspaces/${workspaceId}/company-profile`,
+      request
+    );
+  }
+  async diffCompanyProfileRevisions(workspaceId, request) {
+    const params = new URLSearchParams(request);
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/company-profile/diff?${params}`
+    );
+  }
+  async activateCompanyProfileRevision(workspaceId, revisionId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/company-profile/revisions/${encodeURIComponent(revisionId)}/activate`,
+      request
+    );
+  }
+  async rollbackCompanyProfile(workspaceId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/company-profile/rollback`,
+      request
+    );
+  }
   async listPreferenceRegistry(workspaceId, options = {}) {
     const params = new URLSearchParams();
     if (options.scope) params.set("scope", options.scope);
@@ -1855,6 +2368,55 @@ var OpenGeniClient = class {
       `/v1/workspaces/${workspaceId}/members/${encodeURIComponent(subjectId)}`
     );
   }
+  /** Exchange one signed Slack bearer for durable, token-free continuation state. */
+  async prepareSlackUserLinkAccess(workspaceId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/integrations/slack/user-link-intents`,
+      request
+    );
+  }
+  async getSlackUserLinkAccess(workspaceId, requestId) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/integrations/slack/user-link-intents/${requestId}`
+    );
+  }
+  async requestSlackUserLinkWorkspaceAccess(workspaceId, requestId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/integrations/slack/user-link-intents/${requestId}/request-access`,
+      request
+    );
+  }
+  async cancelSlackUserLinkAccess(workspaceId, requestId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/integrations/slack/user-link-intents/${requestId}/cancel`,
+      request
+    );
+  }
+  async listSlackUserLinkAccessRequests(workspaceId) {
+    const response = await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/members/access-requests/slack`
+    );
+    return response.requests;
+  }
+  async approveSlackUserLinkAccessRequest(workspaceId, requestId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/members/access-requests/slack/${requestId}/approve`,
+      request
+    );
+  }
+  async denySlackUserLinkAccessRequest(workspaceId, requestId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/members/access-requests/slack/${requestId}/deny`,
+      request
+    );
+  }
   // --- Scheduled tasks (write + runs) -------------------------------------------
   async createScheduledTask(workspaceId, request) {
     return await this.requestJson(
@@ -1911,7 +2473,8 @@ var OpenGeniClient = class {
     );
   }
   // --- VariableSets --------------------------------------------------------------
-  // Variable values are write-only: reads return name/version metadata only.
+  // Generic reads return name/version metadata only. Plaintext uses one
+  // dedicated permissioned endpoint.
   async listVariableSets(workspaceId) {
     return await this.requestJson(
       "GET",
@@ -1931,6 +2494,12 @@ var OpenGeniClient = class {
       `/v1/workspaces/${workspaceId}/variable-sets/${variableSetId}`
     );
   }
+  async getVariableSetVariable(workspaceId, variableSetId, name) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/variable-sets/${variableSetId}/variables/${encodeURIComponent(name)}`
+    );
+  }
   async updateVariableSet(workspaceId, variableSetId, request) {
     return await this.requestJson(
       "PATCH",
@@ -1944,7 +2513,7 @@ var OpenGeniClient = class {
       `/v1/workspaces/${workspaceId}/variable-sets/${variableSetId}`
     );
   }
-  /** Create or rotate a variable. The value never comes back on any read. */
+  /** Create or rotate a variable. Generic reads never return its value. */
   async setVariableSetVariable(workspaceId, variableSetId, name, value) {
     return await this.requestJson(
       "PUT",
@@ -2076,18 +2645,23 @@ var OpenGeniClient = class {
   }
   // --- Files -----------------------------------------------------------------------
   /** Step 1 of the upload flow: returns the pre-signed PUT target. */
-  async beginFileUpload(workspaceId, request) {
+  async beginFileUpload(workspaceId, request, options = {}) {
     return await this.requestJson(
       "POST",
       `/v1/workspaces/${workspaceId}/files/uploads`,
-      request
+      request,
+      {},
+      options
     );
   }
   /** Step 3 of the upload flow: server verifies the object and marks it ready. */
-  async completeFileUpload(workspaceId, uploadId) {
+  async completeFileUpload(workspaceId, uploadId, options = {}) {
     const response = await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/files/uploads/${uploadId}/complete`
+      `/v1/workspaces/${workspaceId}/files/uploads/${uploadId}/complete`,
+      void 0,
+      {},
+      options
     );
     return response.file;
   }
@@ -2097,35 +2671,68 @@ var OpenGeniClient = class {
    * -> complete. Returns the ready `FileAsset`.
    */
   async uploadFile(workspaceId, input) {
+    if (input.timeoutMs !== void 0 && (!Number.isFinite(input.timeoutMs) || input.timeoutMs <= 0)) {
+      throw new Error("File upload timeout must be a positive number");
+    }
+    const withTimeout = async (timeoutMs, operation) => {
+      const controller = new AbortController();
+      let timeout;
+      const timedOut = new Promise((_resolve, reject) => {
+        timeout = setTimeout(() => {
+          controller.abort();
+          reject(new Error("File upload timed out. Retry the upload."));
+        }, timeoutMs);
+      });
+      try {
+        return await Promise.race([operation(controller.signal), timedOut]);
+      } finally {
+        if (timeout !== void 0) clearTimeout(timeout);
+      }
+    };
     const body = input.data instanceof Uint8Array ? new Blob([input.data.slice()]) : input.data instanceof ArrayBuffer ? input.data.slice(0) : input.data;
     const sizeBytes = typeof body === "string" ? new TextEncoder().encode(body).byteLength : body instanceof Blob ? body.size : body.byteLength;
     const sha256 = input.sha256 ?? await sha256ForUpload(body);
-    const upload = await this.beginFileUpload(workspaceId, {
-      filename: input.filename,
-      contentType: input.contentType,
-      sizeBytes,
-      sha256
-    });
-    const putResponse = await this.fetchImpl(upload.putUrl, {
-      method: "PUT",
-      // Signed object-storage URLs carry their own short-lived authority.
-      // Browser cookies and HTTP auth must never accompany this cross-origin
-      // request: credentialed fetches are incompatible with wildcard CORS and
-      // can leak ambient credentials to a caller-selected storage endpoint.
-      credentials: "omit",
-      // The backend's requiredHeaders already carry the canonical lowercase
-      // `content-type` for every storage backend (Azure/S3/GCS). Do NOT also set
-      // a `Content-Type` key here: WHATWG Headers treats the two casings as the
-      // same header and comma-joins their values (e.g. "text/plain, text/plain"),
-      // which the object store persists verbatim and COMPLETE then rejects (422),
-      // and which breaks S3's presigned-URL signature.
-      headers: { ...upload.requiredHeaders },
-      body
-    });
+    const upload = await withTimeout(
+      3e4,
+      async (signal) => await this.beginFileUpload(
+        workspaceId,
+        {
+          filename: input.filename,
+          contentType: input.contentType,
+          sizeBytes,
+          sha256
+        },
+        { signal }
+      )
+    );
+    const transferTimeoutMs = input.timeoutMs ?? Math.max(12e4, Math.ceil(sizeBytes / (256 * 1024)) * 1e3);
+    const putResponse = await withTimeout(
+      transferTimeoutMs,
+      async (signal) => await this.fetchImpl(upload.putUrl, {
+        method: "PUT",
+        // Signed object-storage URLs carry their own short-lived authority.
+        // Browser cookies and HTTP auth must never accompany this cross-origin
+        // request: credentialed fetches are incompatible with wildcard CORS and
+        // can leak ambient credentials to a caller-selected storage endpoint.
+        credentials: "omit",
+        // The backend's requiredHeaders already carry the canonical lowercase
+        // `content-type` for every storage backend (Azure/S3/GCS). Do NOT also set
+        // a `Content-Type` key here: WHATWG Headers treats the two casings as the
+        // same header and comma-joins their values (e.g. "text/plain, text/plain"),
+        // which the object store persists verbatim and COMPLETE then rejects (422),
+        // and which breaks S3's presigned-URL signature.
+        headers: { ...upload.requiredHeaders },
+        body,
+        signal
+      })
+    );
     if (!putResponse.ok) {
       throw await apiErrorFromResponse(putResponse, { method: "PUT" });
     }
-    return await this.completeFileUpload(workspaceId, upload.uploadId);
+    return await withTimeout(
+      3e4,
+      async (signal) => await this.completeFileUpload(workspaceId, upload.uploadId, { signal })
+    );
   }
   async getFile(workspaceId, fileId) {
     return await this.requestJson(
@@ -2145,22 +2752,100 @@ var OpenGeniClient = class {
    * deliberately does not use the ordinary signed file-download URL.
    */
   async getRetainedArtifactContent(workspaceId, artifactId, options = {}) {
+    return await this.getRetainedArtifactContentAtPath(
+      `/v1/workspaces/${workspaceId}/artifacts/${artifactId}/content`,
+      options
+    );
+  }
+  async getSessionRetainedArtifact(workspaceId, sessionId, artifactId) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/artifacts/${artifactId}`
+    );
+  }
+  async getSessionRetainedArtifactContent(workspaceId, sessionId, artifactId, options = {}) {
+    return await this.getRetainedArtifactContentAtPath(
+      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/artifacts/${artifactId}/content`,
+      options
+    );
+  }
+  /** Assemble one permanent generated-image receipt from bounded authenticated ranges. */
+  async downloadRetainedArtifact(workspaceId, artifact, options = {}) {
+    assertRetainedGeneratedImageReceipt(workspaceId, artifact);
+    const bytes = await this.downloadRetainedArtifactBytes(artifact, options);
+    return { artifact, bytes };
+  }
+  /** Mint a short-lived, zero-copy browser source for a validated generated image. */
+  async createRetainedArtifactDownloadUrl(workspaceId, artifact, options = {}) {
+    assertRetainedGeneratedImageReceipt(workspaceId, artifact);
+    const download = await this.createFileDownloadUrl(workspaceId, artifact.artifactId, options);
+    assertSafeArtifactDownloadUrl(download);
+    return download;
+  }
+  /** Assemble one retained screenshot from bounded authenticated API ranges. */
+  async downloadRetainedScreenshot(workspaceId, sessionId, artifactId, options = {}) {
+    const metadata = await this.getSessionRetainedArtifact(workspaceId, sessionId, artifactId);
+    if (!metadata.available) return { metadata, bytes: null };
+    if (metadata.kind !== "computer_screenshot" || metadata.contentType !== "image/png" || !metadata.dimensions || metadata.originalBytes <= 0 || metadata.originalBytes > COMPUTER_SCREENSHOT_MAX_BYTES) {
+      throw new OpenGeniApiError(502, "retained screenshot metadata is invalid");
+    }
+    const bytes = await this.downloadRetainedArtifactBytes(metadata, options);
+    return { metadata, bytes };
+  }
+  async downloadRetainedArtifactBytes(artifact, options) {
+    const maxRetries = options.maxRetries ?? 2;
+    if (!Number.isInteger(maxRetries) || maxRetries < 0 || maxRetries > 3) {
+      throw new RangeError("retained artifact maxRetries must be an integer from 0 to 3");
+    }
+    const bytes = new Uint8Array(artifact.originalBytes);
+    const pageBytes = Math.min(artifact.retrieval.maxRangeBytes, RETAINED_OUTPUT_MAX_PAGE_BYTES);
+    if (!Number.isSafeInteger(pageBytes) || pageBytes <= 0) {
+      throw new OpenGeniApiError(502, "retained artifact range metadata is invalid");
+    }
+    for (let start = 0; start < bytes.byteLength; start += pageBytes) {
+      options.signal?.throwIfAborted();
+      const end = Math.min(start + pageBytes, bytes.byteLength) - 1;
+      let page = null;
+      for (let attempt = 0; attempt <= maxRetries; attempt += 1) {
+        try {
+          page = await this.getRetainedArtifactContentAtPath(artifact.retrieval.path, {
+            range: `bytes=${start}-${end}`,
+            ...options.signal ? { signal: options.signal } : {}
+          });
+          break;
+        } catch (error) {
+          options.signal?.throwIfAborted();
+          if (attempt >= maxRetries || error instanceof OpenGeniApiError && error.status >= 400 && error.status < 500) {
+            throw error;
+          }
+        }
+      }
+      if (!page) throw new OpenGeniApiError(502, "retained artifact range retry exhausted");
+      const expectedLength = end - start + 1;
+      if (page.status !== 206 || page.contentType !== artifact.contentType || page.contentLength !== expectedLength || page.contentRange !== `bytes ${start}-${end}/${artifact.originalBytes}`) {
+        throw new OpenGeniApiError(502, "retained artifact range response is invalid");
+      }
+      bytes.set(page.bytes, start);
+    }
+    if (await sha256Hex(bytes) !== artifact.sha256) {
+      throw new OpenGeniApiError(502, "retained artifact checksum mismatch");
+    }
+    return bytes;
+  }
+  async getRetainedArtifactContentAtPath(path, options) {
     if (options.range && (options.range.length > 128 || /[^\x20-\x7e]/.test(options.range))) {
       throw new RangeError("retained artifact range must be at most 128 printable ASCII bytes");
     }
     const correlationId = crypto.randomUUID();
-    const response = await this.fetchImpl(
-      this.url(`/v1/workspaces/${workspaceId}/artifacts/${artifactId}/content`),
-      {
-        method: "GET",
-        headers: {
-          ...this.headers(correlationId),
-          Accept: "application/octet-stream",
-          ...options.range ? { Range: options.range } : {}
-        },
-        ...options.signal ? { signal: options.signal } : {}
-      }
-    );
+    const response = await this.fetchImpl(this.url(path), {
+      method: "GET",
+      headers: {
+        ...this.headers(correlationId),
+        Accept: "application/octet-stream",
+        ...options.range ? { Range: options.range } : {}
+      },
+      ...options.signal ? { signal: options.signal } : {}
+    });
     try {
       assertApiContractResponse(response);
     } catch (error) {
@@ -2203,11 +2888,57 @@ var OpenGeniClient = class {
     };
   }
   /** Mint a short-lived signed download URL for a ready file. */
-  async createFileDownloadUrl(workspaceId, fileId) {
+  async createFileDownloadUrl(workspaceId, fileId, options = {}) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/files/${fileId}/download-url`,
+      void 0,
+      {},
+      options
+    );
+  }
+  // --- Video generation ---------------------------------------------------------------
+  /** Read the effective workspace policy and executable Seedance capabilities. */
+  async getVideoGenerationSettings(workspaceId, options = {}) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/video-generation`,
+      void 0,
+      {},
+      options
+    );
+  }
+  /** Replace the enabled video models/default under optimistic policy revision control. */
+  async updateVideoGenerationPolicy(workspaceId, request, options = {}) {
     return await this.requestJson(
+      "PUT",
+      `/v1/workspaces/${workspaceId}/video-generation/policy`,
+      request,
+      {},
+      options
+    );
+  }
+  /** Read durable progress for one accepted video generation operation. */
+  async getVideoGenerationOperation(workspaceId, operationId, options = {}) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/video-generation/operations/${operationId}`,
+      void 0,
+      {},
+      options
+    );
+  }
+  /** Mint a short-lived zero-copy URL for native Range-based video playback. */
+  async createVideoArtifactPlaybackSource(workspaceId, artifactId, options = {}) {
+    const source = await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/files/${fileId}/download-url`
+      `/v1/workspaces/${workspaceId}/artifacts/${artifactId}/playback-source`,
+      void 0,
+      {},
+      options
     );
+    assertSafeVideoArtifactPlaybackSource(source, artifactId);
+    return source;
   }
   // --- Documents ----------------------------------------------------------------------
   async createDocumentBase(workspaceId, request) {
@@ -2380,6 +3111,37 @@ var OpenGeniClient = class {
       request
     );
   }
+  /** Resolve pinned components, Variable Set, and Rig requirements before installation. */
+  async previewPackInstallation(workspaceId, packId, request = {}) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/packs/${encodeURIComponent(packId)}/installation-preview`,
+      request
+    );
+  }
+  /** Install, update, or repair a Pack from an exact previewed manifest. */
+  async installPack(workspaceId, packId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/packs/${encodeURIComponent(packId)}/install`,
+      request
+    );
+  }
+  /** Preview which Pack-owned components will be retained by other owners. */
+  async previewPackUninstall(workspaceId, packId) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/packs/${encodeURIComponent(packId)}/uninstall-preview`
+    );
+  }
+  /** Safely release Pack ownership and disable only now-ownerless components. */
+  async uninstallPack(workspaceId, packId, request) {
+    return await this.requestJson(
+      "DELETE",
+      `/v1/workspaces/${workspaceId}/packs/${encodeURIComponent(packId)}/installation`,
+      request
+    );
+  }
   /** Unregister a workspace-scoped pack (built-in packs cannot be deleted). */
   async deletePack(workspaceId, packId) {
     await this.requestVoid(
@@ -2433,6 +3195,189 @@ var OpenGeniClient = class {
       }
     );
   }
+  /** List installed protocol-neutral OpenAPI and GraphQL Integrations. */
+  async listApiIntegrations(workspaceId) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/integrations`
+    );
+  }
+  /** List curated provider presets without exposing deployment OAuth credentials. */
+  async listApiIntegrationPresets(workspaceId) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/integrations/presets`
+    );
+  }
+  /** Detect and compile an Integration without mutating workspace state. */
+  async previewApiIntegration(workspaceId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/integrations/preview`,
+      request
+    );
+  }
+  /** Start a signed PKCE OAuth flow for a built-in Google or Microsoft preset. */
+  async startApiIntegrationOAuth(workspaceId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/integrations/oauth/start`,
+      request
+    );
+  }
+  /** Install only the exact immutable revision and digest accepted in preview. */
+  async installApiIntegration(workspaceId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/integrations/install`,
+      request
+    );
+  }
+  async previewApiIntegrationUninstall(workspaceId, capabilityId, instanceKey) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/integrations/${encodeURIComponent(capabilityId)}/instances/${encodeURIComponent(instanceKey)}/uninstall-preview`
+    );
+  }
+  /** Remove one Integration instance without deleting its Connection or sibling instances. */
+  async uninstallApiIntegration(workspaceId, capabilityId, instanceKey, request) {
+    return await this.requestJson(
+      "DELETE",
+      `/v1/workspaces/${workspaceId}/integrations/${encodeURIComponent(capabilityId)}/instances/${encodeURIComponent(instanceKey)}`,
+      request
+    );
+  }
+  /** List immutable provider facets and their exact per-account bindings. */
+  async listIntegrationFeatures(workspaceId, capabilityId, instanceKey) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/integrations/${encodeURIComponent(capabilityId)}/instances/${encodeURIComponent(instanceKey)}/features`
+    );
+  }
+  /** Configure or OCC-update one adapter-owned feature on an Integration instance. */
+  async configureIntegrationFeature(workspaceId, capabilityId, instanceKey, featureKey, request) {
+    return await this.requestJson(
+      "PUT",
+      `/v1/workspaces/${workspaceId}/integrations/${encodeURIComponent(capabilityId)}/instances/${encodeURIComponent(instanceKey)}/features/${encodeURIComponent(featureKey)}`,
+      request
+    );
+  }
+  /** Browse source metadata through one exact Google Drive Integration instance. */
+  async browseGoogleDriveIntegrationSource(workspaceId, capabilityId, instanceKey, featureKey, options = {}) {
+    const query = new URLSearchParams();
+    if (options.parentId) query.set("parentId", options.parentId);
+    if (options.pageToken) query.set("pageToken", options.pageToken);
+    const suffix = query.size > 0 ? `?${query}` : "";
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/integrations/${encodeURIComponent(capabilityId)}/instances/${encodeURIComponent(instanceKey)}/features/${encodeURIComponent(featureKey)}/browse${suffix}`
+    );
+  }
+  /** Verify and bind document sources to one exact Google Drive Integration instance. */
+  async saveGoogleDriveIntegrationSource(workspaceId, capabilityId, instanceKey, featureKey, request) {
+    return await this.requestJson(
+      "PUT",
+      `/v1/workspaces/${workspaceId}/integrations/${encodeURIComponent(capabilityId)}/instances/${encodeURIComponent(instanceKey)}/features/${encodeURIComponent(featureKey)}/source`,
+      request
+    );
+  }
+  async pauseIntegrationFeature(workspaceId, capabilityId, instanceKey, featureKey, request) {
+    return await this.mutateIntegrationFeatureLifecycle(
+      workspaceId,
+      capabilityId,
+      instanceKey,
+      featureKey,
+      "pause",
+      request
+    );
+  }
+  async resumeIntegrationFeature(workspaceId, capabilityId, instanceKey, featureKey, request) {
+    return await this.mutateIntegrationFeatureLifecycle(
+      workspaceId,
+      capabilityId,
+      instanceKey,
+      featureKey,
+      "resume",
+      request
+    );
+  }
+  async removeIntegrationFeature(workspaceId, capabilityId, instanceKey, featureKey, request) {
+    return await this.requestJson(
+      "DELETE",
+      `/v1/workspaces/${workspaceId}/integrations/${encodeURIComponent(capabilityId)}/instances/${encodeURIComponent(instanceKey)}/features/${encodeURIComponent(featureKey)}`,
+      request
+    );
+  }
+  async mutateIntegrationFeatureLifecycle(workspaceId, capabilityId, instanceKey, featureKey, action, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/integrations/${encodeURIComponent(capabilityId)}/instances/${encodeURIComponent(instanceKey)}/features/${encodeURIComponent(featureKey)}/${action}`,
+      request
+    );
+  }
+  async previewPlugin(workspaceId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/plugins/preview`,
+      request
+    );
+  }
+  async listInstalledPlugins(workspaceId) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/plugins`
+    );
+  }
+  async installPlugin(workspaceId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/plugins/install`,
+      request
+    );
+  }
+  async previewPluginUninstall(workspaceId, pluginKey) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/plugins/${encodeURIComponent(pluginKey)}/uninstall-preview`
+    );
+  }
+  async uninstallPlugin(workspaceId, pluginKey, request) {
+    return await this.requestJson(
+      "DELETE",
+      `/v1/workspaces/${workspaceId}/plugins/${encodeURIComponent(pluginKey)}`,
+      request
+    );
+  }
+  /** Resolve one public skills.sh or GitHub Skill folder to an immutable review preview. */
+  async previewSkillImport(workspaceId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/skills/preview`,
+      request
+    );
+  }
+  /** Install only the exact commit and full-content digest accepted during preview. */
+  async installSkill(workspaceId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/skills/install`,
+      request
+    );
+  }
+  async previewSkillUninstall(workspaceId, capabilityId) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/skills/${encodeURIComponent(capabilityId)}/uninstall-preview`
+    );
+  }
+  /** Remove the direct owner under an optimistic installation-version fence. */
+  async uninstallSkill(workspaceId, capabilityId, request) {
+    return await this.requestJson(
+      "DELETE",
+      `/v1/workspaces/${workspaceId}/skills/${encodeURIComponent(capabilityId)}`,
+      request
+    );
+  }
   // --- Connections -------------------------------------------------------------------------------
   async listConnections(workspaceId) {
     const response = await this.requestJson(
@@ -2441,6 +3386,14 @@ var OpenGeniClient = class {
     );
     return response.connections;
   }
+  /** List the secret-free Slack team -> OpenGeni tenant routing authority. */
+  async listSlackInstallationBindings(workspaceId) {
+    const response = await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/connections/slack-bot/bindings`
+    );
+    return response.bindings;
+  }
   async createConnection(workspaceId, request) {
     const response = await this.requestJson(
       "POST",
@@ -2538,8 +3491,13 @@ var OpenGeniClient = class {
   }
   // --- GitHub ----------------------------------------------------------------------------------
   /** GitHub App server configuration plus truthful workspace binding status. */
-  async getGitHubApp(workspaceId) {
-    return await this.requestJson("GET", `/v1/workspaces/${workspaceId}/github/app`);
+  async getGitHubApp(workspaceId, options = {}) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/github/app`,
+      void 0,
+      options.returnPath ? { returnPath: options.returnPath } : void 0
+    );
   }
   /** Build the GitHub owner-consent entry URL for fresh workspace-bound state. */
   githubConnectUrl(workspaceId, state) {
@@ -2769,6 +3727,7 @@ var OpenGeniClient = class {
       { target }
     );
   }
+  /** Contract-checked JSON transport shared by opt-in typed SDK clients. */
   async requestJson(method, path, body, query = {}, options = {}) {
     const correlationId = crypto.randomUUID();
     let response;
@@ -2803,6 +3762,29 @@ var OpenGeniClient = class {
       throw error;
     }
   }
+  /** Authenticated, contract-checked response for bounded streaming downloads. */
+  async requestResponse(method, path, query = {}, options = {}) {
+    const correlationId = crypto.randomUUID();
+    let response;
+    try {
+      response = await this.fetchImpl(this.url(path, query), {
+        method,
+        headers: {
+          ...this.headers(correlationId),
+          Accept: "application/octet-stream"
+        },
+        ...options.signal ? { signal: options.signal } : {}
+      });
+    } catch (error) {
+      if (isMutationMethod(method)) throw mutationTransportError(correlationId);
+      throw error;
+    }
+    assertApiContractResponse(response);
+    if (!response.ok) {
+      throw await apiErrorFromResponse(response, { method, correlationId });
+    }
+    return response;
+  }
   /** Like `requestJson` for endpoints that respond with no body (204). */
   async requestVoid(method, path, body) {
     const correlationId = crypto.randomUUID();
@@ -2843,7 +3825,10 @@ function isTranscribeAudioResponse(value) {
 function isUploadTranscriptionRecordingChunkResponse(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
   const record = value;
-  if (!isTranscriptionRecordingResponse({ recording: record.recording, segments: [] })) {
+  if (!isTranscriptionRecordingResponse({
+    recording: record.recording,
+    segments: []
+  })) {
     return false;
   }
   if (!record.chunk || typeof record.chunk !== "object" || Array.isArray(record.chunk)) {
@@ -2947,9 +3932,39 @@ async function sha256ForUpload(body) {
   const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes);
   return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
+async function sha256Hex(bytes) {
+  const owned = Uint8Array.from(bytes);
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", owned.buffer);
+  return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+}
 async function cancelResponseBody(response, reason) {
   await response.body?.cancel(reason).catch(() => void 0);
 }
+function assertRetainedGeneratedImageReceipt(workspaceId, artifact) {
+  if (!parseRetainedGeneratedImageReference(artifact, workspaceId)) {
+    throw new OpenGeniApiError(502, "retained generated image receipt is invalid");
+  }
+}
+function assertSafeArtifactDownloadUrl(value) {
+  if (!value || typeof value.url !== "string" || typeof value.expiresAt !== "string" || !Number.isFinite(Date.parse(value.expiresAt))) {
+    throw new OpenGeniApiError(502, "retained artifact download URL is invalid");
+  }
+  let parsed;
+  try {
+    parsed = new URL(value.url);
+  } catch {
+    throw new OpenGeniApiError(502, "retained artifact download URL is invalid");
+  }
+  if (!["http:", "https:"].includes(parsed.protocol) || parsed.username || parsed.password) {
+    throw new OpenGeniApiError(502, "retained artifact download URL is unsafe");
+  }
+}
+function assertSafeVideoArtifactPlaybackSource(value, expectedArtifactId) {
+  if (!value || value.schemaVersion !== 1 || value.artifactId !== expectedArtifactId || value.contentType !== "video/mp4" || value.acceptRanges !== "bytes" || !Number.isSafeInteger(value.sizeBytes) || value.sizeBytes <= 0 || value.sizeBytes > GENERATED_VIDEO_MAX_BYTES || !/^[0-9a-f]{64}$/.test(value.sha256)) {
+    throw new OpenGeniApiError(502, "generated-video playback source is invalid");
+  }
+  assertSafeArtifactDownloadUrl({ url: value.url, expiresAt: value.expiresAt });
+}
 function parseBoundedContentLength(value) {
   if (value === null) return null;
   if (!/^\d+$/.test(value)) {
@@ -2997,246 +4012,16 @@ async function readBoundedResponseBytes(response, maxBytes, expectedBytes) {
   return bytes;
 }
 
-// src/transcription.ts
-var DEFAULT_WORKSPACE_TRANSCRIPTION_POLICY = {
-  enabled: false,
-  acceptanceId: null,
-  primary: null,
-  language: null,
-  autoDetectLanguage: false,
-  diarization: { enabled: false, maxSpeakers: null },
-  retention: { mode: "none", maxDays: null },
-  privacy: { allowProviderLogging: false, allowProviderTraining: false },
-  fallback: { mode: "disabled", targets: [] },
-  cost: { currency: "USD", maxPerHour: null, maxPerMonth: null }
-};
-function resolveWorkspaceVoiceInputEnabled(settings) {
-  if (!isRecord(settings)) return null;
-  const voiceInput = settings.voiceInput;
-  if (isRecord(voiceInput) && typeof voiceInput.enabled === "boolean") {
-    return voiceInput.enabled;
-  }
-  const legacy = settings.transcription;
-  return isRecord(legacy) && typeof legacy.enabled === "boolean" ? legacy.enabled : null;
-}
-function resolveWorkspaceTranscriptionPolicy(settings) {
-  if (!isRecord(settings)) return cloneDefaultPolicy();
-  const candidate = settings.transcription;
-  if (!isWorkspaceTranscriptionPolicy(candidate)) return cloneDefaultPolicy();
-  return {
-    ...candidate,
-    primary: candidate.primary ? normalizeTarget(candidate.primary) : null,
-    language: candidate.language?.trim() ?? null,
-    diarization: { ...candidate.diarization },
-    retention: { ...candidate.retention },
-    privacy: { ...candidate.privacy },
-    fallback: {
-      mode: candidate.fallback.mode,
-      targets: candidate.fallback.targets.map(normalizeTarget)
-    },
-    cost: { ...candidate.cost }
-  };
-}
-function authorizeTranscriptionAdapter(policy, descriptor, selection = { kind: "primary" }) {
-  if (!isWorkspaceTranscriptionPolicy(policy)) {
-    return { authorized: false, reason: "unaccepted" };
-  }
-  if (!policy.enabled) return { authorized: false, reason: "disabled" };
-  if (!policy.acceptanceId) return { authorized: false, reason: "unaccepted" };
-  let target;
-  if (selection.kind === "primary") {
-    target = policy.primary;
-  } else {
-    if (policy.fallback.mode !== "explicit") {
-      return { authorized: false, reason: "fallback_disabled" };
-    }
-    target = policy.fallback.targets[selection.index];
-    if (!target) return { authorized: false, reason: "fallback_unaccepted" };
-  }
-  if (!target) return { authorized: false, reason: "target_missing" };
-  const acceptedTarget = normalizeTarget(target);
-  if (acceptedTarget.provider !== descriptor.provider) {
-    return { authorized: false, reason: "provider_mismatch" };
-  }
-  if (acceptedTarget.model !== descriptor.model) {
-    return { authorized: false, reason: "model_mismatch" };
-  }
-  if (acceptedTarget.credentialMode !== descriptor.credentialMode) {
-    return { authorized: false, reason: "credential_mode_mismatch" };
-  }
-  if (acceptedTarget.region !== descriptor.region) {
-    return { authorized: false, reason: "region_mismatch" };
-  }
-  return {
-    authorized: true,
-    acceptanceId: policy.acceptanceId,
-    target: acceptedTarget,
-    selection
-  };
-}
-function createTranscriptionSessionRequest(input) {
-  const sequenceFloor = input.sequenceFloor ?? 0;
-  if (!Number.isSafeInteger(sequenceFloor) || sequenceFloor < 0) return null;
-  const authorization = authorizeTranscriptionAdapter(
-    input.policy,
-    input.adapter.descriptor,
-    input.selection
-  );
-  if (!authorization.authorized) return null;
-  return {
-    localSessionId: input.localSessionId,
-    policyAcceptanceId: authorization.acceptanceId,
-    selection: authorization.selection,
-    target: { ...authorization.target },
-    language: input.policy.language?.trim() ?? null,
-    autoDetectLanguage: input.policy.autoDetectLanguage,
-    diarization: { ...input.policy.diarization },
-    retention: { ...input.policy.retention },
-    privacy: { ...input.policy.privacy },
-    cost: { ...input.policy.cost },
-    sequenceFloor
-  };
-}
-function cloneDefaultPolicy() {
-  return {
-    ...DEFAULT_WORKSPACE_TRANSCRIPTION_POLICY,
-    diarization: { ...DEFAULT_WORKSPACE_TRANSCRIPTION_POLICY.diarization },
-    retention: { ...DEFAULT_WORKSPACE_TRANSCRIPTION_POLICY.retention },
-    privacy: { ...DEFAULT_WORKSPACE_TRANSCRIPTION_POLICY.privacy },
-    fallback: { mode: "disabled", targets: [] },
-    cost: { ...DEFAULT_WORKSPACE_TRANSCRIPTION_POLICY.cost }
-  };
-}
-function isWorkspaceTranscriptionPolicy(value) {
-  if (!isRecord(value) || typeof value.enabled !== "boolean") return false;
-  if (!hasOnlyKeys(value, [
-    "enabled",
-    "acceptanceId",
-    "primary",
-    "language",
-    "autoDetectLanguage",
-    "diarization",
-    "retention",
-    "privacy",
-    "fallback",
-    "cost"
-  ])) {
-    return false;
-  }
-  if (!(value.acceptanceId === null || isUuid(value.acceptanceId))) return false;
-  if (!(value.primary === null || isTarget(value.primary))) return false;
-  if (!(value.language === null || isBoundedString(value.language, 64))) return false;
-  if (typeof value.autoDetectLanguage !== "boolean") return false;
-  if (!isRecord(value.diarization) || !hasOnlyKeys(value.diarization, ["enabled", "maxSpeakers"]) || typeof value.diarization.enabled !== "boolean" || !(value.diarization.maxSpeakers === null || isBoundedInteger(value.diarization.maxSpeakers, 100) && value.diarization.maxSpeakers >= 2)) {
-    return false;
-  }
-  if (!value.diarization.enabled && value.diarization.maxSpeakers !== null) return false;
-  if (!isRecord(value.retention) || !hasOnlyKeys(value.retention, ["mode", "maxDays"])) {
-    return false;
-  }
-  if (value.retention.mode !== "none" && value.retention.mode !== "provider-policy") return false;
-  if (!(value.retention.maxDays === null || isBoundedInteger(value.retention.maxDays, 3650))) {
-    return false;
-  }
-  if (!isRecord(value.privacy) || !hasOnlyKeys(value.privacy, ["allowProviderLogging", "allowProviderTraining"]) || typeof value.privacy.allowProviderLogging !== "boolean" || typeof value.privacy.allowProviderTraining !== "boolean") {
-    return false;
-  }
-  if (!isRecord(value.fallback) || !hasOnlyKeys(value.fallback, ["mode", "targets"])) {
-    return false;
-  }
-  if (value.fallback.mode !== "disabled" && value.fallback.mode !== "explicit") return false;
-  if (!Array.isArray(value.fallback.targets) || value.fallback.targets.length > 8 || !value.fallback.targets.every(isTarget)) {
-    return false;
-  }
-  if (value.fallback.mode === "disabled" && value.fallback.targets.length !== 0) return false;
-  if (value.fallback.mode === "explicit" && value.fallback.targets.length === 0) return false;
-  if (!isRecord(value.cost) || !hasOnlyKeys(value.cost, ["currency", "maxPerHour", "maxPerMonth"]) || value.cost.currency !== "USD") {
-    return false;
-  }
-  if (!isNullableBoundedNumber(value.cost.maxPerHour, 1e4)) return false;
-  if (!isNullableBoundedNumber(value.cost.maxPerMonth, 1e6)) return false;
-  if (value.enabled && (!value.acceptanceId || !value.primary)) return false;
-  if (value.enabled && !value.autoDetectLanguage && value.language === null) return false;
-  if (value.autoDetectLanguage && value.language !== null) return false;
-  const targets = [value.primary, ...value.fallback.targets].filter(
-    (target) => target !== null
-  );
-  if (new Set(targets.map(targetKey)).size !== targets.length) return false;
-  return true;
-}
-function targetKey(target) {
-  return [
-    target.provider.trim(),
-    target.model?.trim() ?? "",
-    target.credentialMode,
-    target.credentialConnectionId ?? "",
-    target.region?.trim() ?? ""
-  ].join("\0");
-}
-function isTarget(value) {
-  if (!isRecord(value)) return false;
-  if (!hasOnlyKeys(value, ["provider", "model", "credentialMode", "credentialConnectionId", "region"])) {
-    return false;
-  }
-  if (!isBoundedString(value.provider, 128)) return false;
-  if (!(value.model === null || isBoundedString(value.model, 256))) return false;
-  if (value.credentialMode !== "managed" && value.credentialMode !== "byok") return false;
-  if (value.provider.trim() === "azure-speech" && value.credentialMode !== "byok") return false;
-  if (!(value.credentialConnectionId === null || isUuid(value.credentialConnectionId))) {
-    return false;
-  }
-  if (!(value.region === null || isBoundedString(value.region, 128))) return false;
-  if (value.credentialMode === "byok" && value.credentialConnectionId === null) return false;
-  if (value.credentialMode === "managed" && value.credentialConnectionId !== null) return false;
-  return true;
-}
-function normalizeTarget(target) {
-  return {
-    provider: target.provider.trim(),
-    model: target.model?.trim() ?? null,
-    credentialMode: target.credentialMode,
-    credentialConnectionId: target.credentialConnectionId,
-    region: target.region?.trim() ?? null
-  };
-}
-function isRecord(value) {
-  return typeof value === "object" && value !== null;
-}
-function hasOnlyKeys(value, keys) {
-  const accepted = new Set(keys);
-  return Object.keys(value).every((key) => accepted.has(key));
-}
-function isBoundedString(value, maximum) {
-  return typeof value === "string" && value.trim().length > 0 && value.length <= maximum;
-}
-function isUuid(value) {
-  return typeof value === "string" && /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value);
-}
-function isBoundedInteger(value, maximum) {
-  return Number.isInteger(value) && value >= 0 && value <= maximum;
-}
-function isNullableBoundedNumber(value, maximum) {
-  return value === null || typeof value === "number" && Number.isFinite(value) && value >= 0 && value <= maximum;
-}
-
 export {
   parseSseStream,
   streamSessionEvents,
   streamWorkspaceControlEvents,
-  DEFAULT_FILE_RESOURCE_MOUNT_ROOT,
-  SESSION_EVENT_TYPES,
-  KNOWN_PERMISSIONS,
-  OPENGENI_API_CONTRACT_REVISION,
-  OPENGENI_API_CONTRACT_HEADER,
-  OPENGENI_CORRELATION_HEADER,
-  RETAINED_OUTPUT_DEFAULT_PAGE_BYTES,
-  RETAINED_OUTPUT_MAX_PAGE_BYTES,
-  KNOWN_USAGE_EVENT_TYPES,
-  OpenGeniClient,
-  DEFAULT_WORKSPACE_TRANSCRIPTION_POLICY,
-  resolveWorkspaceVoiceInputEnabled,
-  resolveWorkspaceTranscriptionPolicy,
-  authorizeTranscriptionAdapter,
-  createTranscriptionSessionRequest
+  parseRetainedGeneratedImageReference,
+  generatedImageSandboxPathMatches,
+  parseGeneratedImageReceipt,
+  parseRetainedGeneratedVideoReference,
+  parseGeneratedVideoReceipt,
+  parseMediaGenerationResult,
+  OpenGeniClient
 };
-//# sourceMappingURL=chunk-QKV5OCLJ.js.map
+//# sourceMappingURL=chunk-ILQZR5N6.js.map