@opengeni/sdk 0.57.0 → 1.0.0

package/dist/{chunk-PKQ377ED.js → chunk-FG3OO5LM.js}

@@ -1,3 +1,10 @@
+import {
+  jitteredDelay,
+  parseSseStream,
+  runBeforeLive,
+  streamSessionEvents,
+  withStreamInactivityTimeout
+} from "./chunk-APXVSSSY.js";
 import {
   COMPUTER_SCREENSHOT_MAX_BYTES,
   GENERATED_VIDEO_MAX_BYTES,
@@ -5,276 +12,105 @@ import {
   OPENGENI_API_CONTRACT_REVISION,
   OPENGENI_CORRELATION_HEADER,
   RETAINED_OUTPUT_MAX_PAGE_BYTES
-} from "./chunk-HJ3HHUT5.js";
+} from "./chunk-YIKA2QT4.js";
+import {
+  OpenGeniInteractionClient,
+  decodeComputerFrameMetadataHeader,
+  parseBrowserFrameMetadata
+} from "./chunk-NC57YMUO.js";
 import {
+  OpenGeniAllowanceExhaustedError,
   OpenGeniApiContractMismatchError,
   OpenGeniApiError,
+  OpenGeniSecureContextRequiredError,
   OpenGeniSessionListCursorError,
+  OpenGeniSetupError,
   OpenGeniStreamError,
+  allowanceExhaustedFields,
   isAbortError,
   isRetryableStreamError
-} from "./chunk-GU6JF75T.js";
-import {
-  OpenGeniInteractionClient
-} from "./chunk-ST5DDKJP.js";
-
-// src/sse.ts
-async function* parseSseStream(stream) {
-  const reader = stream.getReader();
-  const decoder = new TextDecoder();
-  let buffer = "";
-  let id;
-  let event;
-  let dataLines = null;
-  const dispatch = () => {
-    const message = dataLines === null ? null : {
-      ...id !== void 0 ? { id } : {},
-      ...event !== void 0 ? { event } : {},
-      data: dataLines.join("\n")
-    };
-    id = void 0;
-    event = void 0;
-    dataLines = null;
-    return message;
-  };
-  const handleLine = (line) => {
-    if (line === "") {
-      return dispatch();
-    }
-    if (line.startsWith(":")) {
-      return null;
-    }
-    const colon = line.indexOf(":");
-    const field = colon === -1 ? line : line.slice(0, colon);
-    let value = colon === -1 ? "" : line.slice(colon + 1);
-    if (value.startsWith(" ")) {
-      value = value.slice(1);
-    }
-    if (field === "data") {
-      (dataLines ??= []).push(value);
-    } else if (field === "event") {
-      event = value;
-    } else if (field === "id") {
-      id = value;
-    }
-    return null;
-  };
-  try {
-    while (true) {
-      const { done, value } = await reader.read();
-      if (done) {
-        break;
-      }
-      buffer += decoder.decode(value, { stream: true });
-      let newline = buffer.indexOf("\n");
-      while (newline !== -1) {
-        let line = buffer.slice(0, newline);
-        buffer = buffer.slice(newline + 1);
-        if (line.endsWith("\r")) {
-          line = line.slice(0, -1);
-        }
-        const message = handleLine(line);
-        if (message) {
-          yield message;
-        }
-        newline = buffer.indexOf("\n");
-      }
-    }
-  } finally {
-    await reader.cancel().catch(() => {
-    });
-    reader.releaseLock();
-  }
-}
+} from "./chunk-V6GIY62B.js";
 
-// src/stream.ts
-async function* streamSessionEvents(transport, options = {}) {
-  const signal = options.signal;
-  const reconnect = options.reconnect ?? true;
-  const baseDelayMs = options.reconnectDelayMs ?? 500;
-  const maxDelayMs = options.maxReconnectDelayMs ?? 1e4;
-  const jitterRatio = options.reconnectJitterRatio ?? 0.2;
-  const beforeLiveTimeoutMs = options.beforeLiveTimeoutMs ?? 15e3;
-  const heartbeatTimeoutMs = options.heartbeatTimeoutMs ?? 45e3;
-  const maxAttempts = options.maxReconnectAttempts ?? Number.POSITIVE_INFINITY;
-  let cursor = options.after ?? 0;
-  let failedAttempts = 0;
-  let delayMs = baseDelayMs;
-  let everConnected = false;
-  while (true) {
-    if (signal?.aborted) break;
-    options.onStateChange?.(everConnected || failedAttempts > 0 ? "reconnecting" : "connecting");
-    const cursorAtOpen = cursor;
-    try {
-      const body = await transport.openStream(cursor, signal);
-      everConnected = true;
-      failedAttempts = 0;
-      delayMs = baseDelayMs;
-      try {
-        options.onOpen?.();
-      } catch {
-      }
-      await runBeforeLive(options.beforeLive, beforeLiveTimeoutMs, signal);
-      options.onStateChange?.("live");
-      for await (const message of parseSseStream(
-        withStreamInactivityTimeout(body, heartbeatTimeoutMs, signal)
-      )) {
-        if (signal?.aborted) {
-          return;
-        }
-        const event = parseSessionEvent(message.data);
-        if (!event || event.sequence <= cursor) {
-          continue;
-        }
-        if (event.sequence > cursor + 1) {
-          for await (const missed of backfillEvents(transport, cursor, event.sequence - 1)) {
-            cursor = missed.sequence;
-            yield missed;
-            if (signal?.aborted) {
-              return;
-            }
-          }
-        }
-        cursor = event.sequence;
-        yield event;
-      }
-      if (!reconnect) {
-        return;
-      }
-      if (cursor === cursorAtOpen) {
-        await sleep(jitteredDelay(baseDelayMs, jitterRatio), signal);
-      }
-      continue;
-    } catch (error) {
-      if (signal?.aborted || isAbortError(error)) {
-        return;
-      }
-      if (!reconnect || !isRetryableStreamError(error)) {
-        throw error;
-      }
-      failedAttempts += 1;
-      if (failedAttempts > maxAttempts) {
-        throw new OpenGeniStreamError(
-          `event stream gave up after ${maxAttempts} consecutive failed reconnect attempts: ${error instanceof Error ? error.message : String(error)}`
-        );
-      }
-    }
-    await sleep(jitteredDelay(delayMs, jitterRatio), signal);
-    delayMs = Math.min(Math.max(delayMs * 2, baseDelayMs), maxDelayMs);
-  }
-}
-async function runBeforeLive(beforeLive, timeoutMs, signal) {
-  if (!beforeLive) return;
-  let timer;
-  let abortListener;
-  const timeout = new Promise((_resolve, reject) => {
-    timer = setTimeout(
-      () => reject(new TypeError(`stream reconciliation timed out after ${timeoutMs}ms`)),
-      timeoutMs
-    );
-    if (signal) {
-      abortListener = () => reject(new DOMException("Aborted", "AbortError"));
-      signal.addEventListener("abort", abortListener, { once: true });
-    }
-  });
-  try {
-    await Promise.race([Promise.resolve().then(beforeLive), timeout]);
-  } finally {
-    if (timer !== void 0) clearTimeout(timer);
-    if (signal && abortListener) signal.removeEventListener("abort", abortListener);
-  }
+// src/deprecation.ts
+var ID_SEGMENT = /^(?:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|\d+|[A-Za-z0-9_-]{20,})$/i;
+function routeKey(path) {
+  return path.split("/").map((segment) => ID_SEGMENT.test(segment) ? ":id" : segment).join("/");
 }
-function jitteredDelay(delayMs, ratio) {
-  if (delayMs <= 0 || ratio <= 0) return delayMs;
-  const boundedRatio = Math.min(ratio, 1);
-  const spread = delayMs * boundedRatio;
-  return Math.max(0, delayMs - spread + Math.random() * spread * 2);
+function parseDeprecationDate(value) {
+  const trimmed = value.trim();
+  const structured = /^@(-?\d+)$/.exec(trimmed);
+  if (structured) return new Date(Number(structured[1]) * 1e3);
+  const parsed = Date.parse(trimmed);
+  return Number.isNaN(parsed) ? null : new Date(parsed);
 }
-function withStreamInactivityTimeout(stream, timeoutMs, signal) {
-  if (!Number.isSafeInteger(timeoutMs) || timeoutMs <= 0) {
-    throw new RangeError("stream heartbeat timeout must be a positive safe integer");
-  }
-  const reader = stream.getReader();
-  return new ReadableStream({
-    pull: async (controller) => {
-      let timer;
-      let abortListener;
-      try {
-        const result = await Promise.race([
-          reader.read(),
-          new Promise((_resolve, reject) => {
-            timer = setTimeout(
-              () => reject(new TypeError(`event stream heartbeat timed out after ${timeoutMs}ms`)),
-              timeoutMs
-            );
-            if (signal) {
-              abortListener = () => reject(new DOMException("Aborted", "AbortError"));
-              signal.addEventListener("abort", abortListener, { once: true });
-            }
-          })
-        ]);
-        if (result.done) controller.close();
-        else controller.enqueue(result.value);
-      } catch (error) {
-        void reader.cancel(error).catch(() => {
-        });
-        controller.error(error);
-      } finally {
-        if (timer !== void 0) clearTimeout(timer);
-        if (signal && abortListener) signal.removeEventListener("abort", abortListener);
-      }
-    },
-    cancel: async (reason) => {
-      await reader.cancel(reason);
-    }
-  });
-}
-async function* backfillEvents(transport, fromExclusive, toInclusive) {
-  let cursor = fromExclusive;
-  while (cursor < toInclusive) {
-    const page = await transport.listEvents(cursor, Math.min(500, toInclusive - cursor));
-    const advancing = page.filter((event) => event.sequence > cursor && event.sequence <= toInclusive).sort((a, b) => a.sequence - b.sequence);
-    if (advancing.length === 0) {
-      throw new OpenGeniStreamError(
-        `event replay backfill stalled: expected sequences ${cursor + 1}..${toInclusive} but the replay endpoint returned none of them`
-      );
-    }
-    for (const event of advancing) {
-      if (event.sequence !== cursor + 1) {
-        throw new OpenGeniStreamError(
-          `event replay backfill is missing sequence ${cursor + 1} (replay endpoint skipped to ${event.sequence}); refusing to deliver with a gap`
-        );
-      }
-      cursor = event.sequence;
-      yield event;
+function parseLinks(value) {
+  const links = /* @__PURE__ */ new Map();
+  if (!value) return links;
+  for (const match of value.matchAll(/<([^>]*)>\s*((?:;\s*[^;,]+)*)/g)) {
+    const rel = /;\s*rel="?([^";,]+)"?/i.exec(match[2] ?? "")?.[1];
+    if (!rel) continue;
+    for (const name of rel.toLowerCase().split(/\s+/)) {
+      if (!links.has(name)) links.set(name, match[1]);
     }
   }
+  return links;
 }
-function parseSessionEvent(data) {
-  let parsed;
+function parseDeprecationNotice(method, url, headers) {
+  const deprecation = headers.get("deprecation");
+  const sunsetHeader = headers.get("sunset");
+  if (!deprecation && !sunsetHeader) return null;
+  let path = url;
   try {
-    parsed = JSON.parse(data);
+    path = new URL(url, "http://opengeni.invalid").pathname;
   } catch {
-    return null;
-  }
-  if (typeof parsed !== "object" || parsed === null || typeof parsed.sequence !== "number" || typeof parsed.type !== "string" || typeof parsed.id !== "string") {
-    return null;
   }
-  return parsed;
+  const sunset = sunsetHeader ? Date.parse(sunsetHeader) : Number.NaN;
+  const links = parseLinks(headers.get("link"));
+  return {
+    method: method.toUpperCase(),
+    route: routeKey(path),
+    path,
+    deprecatedAt: deprecation ? parseDeprecationDate(deprecation) : null,
+    sunset: Number.isNaN(sunset) ? null : new Date(sunset),
+    link: links.get("deprecation") ?? links.get("sunset") ?? null,
+    successor: links.get("successor-version") ?? null
+  };
 }
-async function sleep(delayMs, signal) {
-  if (signal?.aborted || delayMs <= 0) {
-    return;
-  }
-  await new Promise((resolve) => {
-    const timer = setTimeout(done, delayMs);
-    function done() {
-      clearTimeout(timer);
-      signal?.removeEventListener("abort", done);
-      resolve();
+var warnedRoutes = /* @__PURE__ */ new Set();
+function warnDeprecationOnce(notice) {
+  const key = `${notice.method} ${notice.route}`;
+  if (warnedRoutes.has(key)) return;
+  warnedRoutes.add(key);
+  const sunset = notice.sunset ? ` and will be removed after ${notice.sunset.toISOString()}` : "";
+  const notes = notice.link ? ` Migration notes: ${notice.link}.` : "";
+  console.warn(
+    `[@opengeni/sdk] ${key} is deprecated${sunset}.${notes} Upgrade @opengeni/sdk, or pass onDeprecation to handle this notice.`
+  );
+}
+function withDeprecationNotices(fetchImpl, handler) {
+  if (handler === false) return fetchImpl;
+  const notify = handler ?? warnDeprecationOnce;
+  const seen = /* @__PURE__ */ new Set();
+  return async (input, init) => {
+    const response = await fetchImpl(input, init);
+    try {
+      const headers = response.headers;
+      if (headers && (headers.get("deprecation") || headers.get("sunset"))) {
+        const method = init?.method ?? (typeof Request !== "undefined" && input instanceof Request ? input.method : "GET");
+        const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+        const notice = parseDeprecationNotice(method, url, headers);
+        if (notice) {
+          const key = `${notice.method} ${notice.route}`;
+          if (!seen.has(key)) {
+            seen.add(key);
+            notify(notice);
+          }
+        }
+      }
+    } catch {
     }
-    signal?.addEventListener("abort", done, { once: true });
-  });
+    return response;
+  };
 }
 
 // src/workspace-control-stream.ts
@@ -312,7 +148,7 @@ async function* streamWorkspaceControlEvents(transport, options = {}) {
         yield event;
       }
       if (!reconnect) return;
-      if (cursor === cursorAtOpen) await sleep2(jitteredDelay(baseDelayMs, jitterRatio), signal);
+      if (cursor === cursorAtOpen) await sleep(jitteredDelay(baseDelayMs, jitterRatio), signal);
       continue;
     } catch (error) {
       if (signal?.aborted || isAbortError(error)) return;
@@ -324,7 +160,7 @@ async function* streamWorkspaceControlEvents(transport, options = {}) {
         );
       }
     }
-    await sleep2(jitteredDelay(delayMs, jitterRatio), signal);
+    await sleep(jitteredDelay(delayMs, jitterRatio), signal);
     delayMs = Math.min(Math.max(delayMs * 2, baseDelayMs), maxDelayMs);
   }
 }
@@ -340,7 +176,7 @@ function parseWorkspaceControlEvent(data) {
   }
   return value;
 }
-async function sleep2(delayMs, signal) {
+async function sleep(delayMs, signal) {
   if (signal?.aborted || delayMs <= 0) return;
   await new Promise((resolve) => {
     const timer = setTimeout(done, delayMs);
@@ -388,7 +224,7 @@ async function* streamWorkspaceInteractionRevisions(transport, options = {}) {
         yield event;
       }
       if (!reconnect) return;
-      if (cursor === cursorAtOpen) await sleep3(jitteredDelay(baseDelayMs, jitterRatio), signal);
+      if (cursor === cursorAtOpen) await sleep2(jitteredDelay(baseDelayMs, jitterRatio), signal);
       continue;
     } catch (error) {
       if (signal?.aborted || isAbortError(error)) return;
@@ -400,7 +236,7 @@ async function* streamWorkspaceInteractionRevisions(transport, options = {}) {
         );
       }
     }
-    await sleep3(jitteredDelay(delayMs, jitterRatio), signal);
+    await sleep2(jitteredDelay(delayMs, jitterRatio), signal);
     delayMs = Math.min(Math.max(delayMs * 2, baseDelayMs), maxDelayMs);
   }
 }
@@ -419,7 +255,7 @@ function parseWorkspaceInteractionRevision(data) {
 function isRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-async function sleep3(delayMs, signal) {
+async function sleep2(delayMs, signal) {
   if (signal?.aborted || delayMs <= 0) return;
   await new Promise((resolve) => {
     const timer = setTimeout(done, delayMs);
@@ -475,7 +311,7 @@ async function* streamWorkspaceLiveEvents(transport, options = {}) {
       }
       if (!reconnect) return;
       if (`${controlCursor}:${interactionCursor}` === cursorsAtOpen) {
-        await sleep4(jitteredDelay(baseDelayMs, jitterRatio), signal);
+        await sleep3(jitteredDelay(baseDelayMs, jitterRatio), signal);
       }
       continue;
     } catch (error) {
@@ -488,7 +324,7 @@ async function* streamWorkspaceLiveEvents(transport, options = {}) {
         );
       }
     }
-    await sleep4(jitteredDelay(delayMs, jitterRatio), signal);
+    await sleep3(jitteredDelay(delayMs, jitterRatio), signal);
     delayMs = Math.min(Math.max(delayMs * 2, baseDelayMs), maxDelayMs);
   }
 }
@@ -511,7 +347,7 @@ function parseWorkspaceLiveEvent(data) {
 function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
-async function sleep4(delayMs, signal) {
+async function sleep3(delayMs, signal) {
   if (signal?.aborted || delayMs <= 0) return;
   await new Promise((resolve) => {
     const timer = setTimeout(done, delayMs);
@@ -534,6 +370,45 @@ var MAX_VIDEO_BYTES = 512 * 1024 * 1024;
 var MAX_DIMENSION = 16384;
 var MAX_PIXELS = 67108864;
 var MAX_RANGE_BYTES = 1024 * 1024;
+var MAX_SANDBOX_FILE_BYTES = 25 * 1024 * 1024 - 1;
+function parseRetainedWorkspaceFileReference(value, expectedWorkspaceId) {
+  if (!recordWithKeys(value, WORKSPACE_FILE_REFERENCE_KEYS)) return null;
+  const artifact = value;
+  if (artifact.available !== true || artifact.kind !== "file" || typeof artifact.artifactId !== "string" || !UUID.test(artifact.artifactId) || typeof artifact.contentType !== "string" || !/^[a-z0-9][a-z0-9!#$&^_.+-]{0,62}\/[a-z0-9][a-z0-9!#$&^_.+-]{0,62}$/.test(
+    artifact.contentType
+  ) || !safeIntegerBetween(artifact.originalBytes, 1, MAX_SANDBOX_FILE_BYTES) || typeof artifact.sha256 !== "string" || !SHA256.test(artifact.sha256) || typeof artifact.retainedAt !== "string" || artifact.retainedAt.length > 64 || !ISO_DATETIME_WITH_OFFSET.test(artifact.retainedAt) || !Number.isFinite(Date.parse(artifact.retainedAt)) || !recordWithKeys(artifact.retention, RETENTION_KEYS) || !recordWithKeys(artifact.retrieval, RETRIEVAL_KEYS)) {
+    return null;
+  }
+  const retention = artifact.retention;
+  if (retention.policy !== "workspace_file" || retention.expiresAt !== null) return null;
+  const retrieval = artifact.retrieval;
+  if (retrieval.method !== "GET" || retrieval.acceptRanges !== "bytes" || retrieval.maxRangeBytes !== MAX_RANGE_BYTES || typeof retrieval.path !== "string" || retrieval.path.length > 256) {
+    return null;
+  }
+  const match = WORKSPACE_PATH.exec(retrieval.path);
+  if (!match || !UUID.test(match[1] ?? "") || match[2] !== artifact.artifactId || expectedWorkspaceId !== void 0 && match[1] !== expectedWorkspaceId) {
+    return null;
+  }
+  return value;
+}
+function parseSandboxFileArtifactReceipt(value, expectedWorkspaceId) {
+  if (typeof value === "string" && value.length <= 8192) {
+    try {
+      return parseSandboxFileArtifactReceipt(JSON.parse(value), expectedWorkspaceId);
+    } catch {
+      return null;
+    }
+  }
+  if (!recordWithKeys(value, SANDBOX_FILE_RECEIPT_KEYS)) return null;
+  const artifact = parseRetainedWorkspaceFileReference(value.artifact, expectedWorkspaceId);
+  const pathSegments = typeof value.sandboxPath === "string" ? value.sandboxPath.split("/") : [];
+  if (value.type !== "sandbox_file" || typeof value.sandboxPath !== "string" || !value.sandboxPath.startsWith("/workspace/") || value.sandboxPath.length > 4096 || value.sandboxPath.includes("\0") || pathSegments.some(
+    (segment, index) => index > 1 && (!segment || segment === "." || segment === "..")
+  ) || typeof value.filename !== "string" || value.filename.length < 1 || value.filename.length > 1024 || pathSegments.at(-1) !== value.filename || !artifact) {
+    return null;
+  }
+  return value;
+}
 function parseRetainedGeneratedImageReference(value, expectedWorkspaceId) {
   if (!recordWithKeys(value, GENERATED_IMAGE_REFERENCE_KEYS)) return null;
   const artifact = value;
@@ -654,10 +529,22 @@ var GENERATED_IMAGE_REFERENCE_KEYS = /* @__PURE__ */ new Set([
   "retention",
   "retrieval"
 ]);
+var WORKSPACE_FILE_REFERENCE_KEYS = /* @__PURE__ */ new Set([
+  "available",
+  "artifactId",
+  "kind",
+  "contentType",
+  "originalBytes",
+  "sha256",
+  "retainedAt",
+  "retention",
+  "retrieval"
+]);
 var DIMENSION_KEYS = /* @__PURE__ */ new Set(["width", "height"]);
 var RETENTION_KEYS = /* @__PURE__ */ new Set(["policy", "expiresAt"]);
 var RETRIEVAL_KEYS = /* @__PURE__ */ new Set(["method", "path", "acceptRanges", "maxRangeBytes"]);
 var GENERATED_IMAGE_RECEIPT_KEYS = /* @__PURE__ */ new Set(["type", "artifact", "sandboxPath"]);
+var SANDBOX_FILE_RECEIPT_KEYS = /* @__PURE__ */ new Set(["type", "sandboxPath", "filename", "artifact"]);
 var GENERATED_VIDEO_RECEIPT_KEYS = /* @__PURE__ */ new Set([
   "type",
   "schemaVersion",
@@ -698,25 +585,158 @@ function safeIntegerBetween(value, min, max) {
 
 // src/client.ts
 function sessionListQuery(options) {
-  const { limit, parentSessionId } = options;
+  const { limit, parentSessionId, scopeSubjectId } = options;
+  const query = {};
+  if (options.originSiteId) query.originSiteId = options.originSiteId;
+  if (limit !== void 0) query.limit = String(limit);
+  if (parentSessionId !== void 0) query.parentSessionId = parentSessionId ?? "null";
+  if (scopeSubjectId !== void 0) query.scopeSubjectId = scopeSubjectId;
+  return query;
+}
+var SESSION_PAGE_FILTER_KEYS = [
+  "originSiteId",
+  "channelId",
+  "createdBy",
+  "updatedFrom",
+  "updatedBefore",
+  "createdFrom",
+  "createdBefore"
+];
+var SESSION_PAGE_STRING_QUERY_KEYS = [
+  "updatedFrom",
+  "updatedBefore",
+  "createdFrom",
+  "createdBefore",
+  "sortBy",
+  "archiveStatus"
+];
+function hasSessionPageFilters(options) {
+  return Boolean(options.needsYouOnly) || SESSION_PAGE_FILTER_KEYS.some((key) => options[key] !== void 0);
+}
+function unsupportedSessionPage(feature) {
+  return new Error(`The connected Opengeni API does not support ${feature}`);
+}
+function sessionPath(workspaceId, sessionId) {
+  return `/v1/workspaces/${workspaceId}/sessions/${sessionId}`;
+}
+function defaultApiContractMode(options) {
+  if (options.apiContract) return options.apiContract;
+  const browser = typeof window !== "undefined" && typeof document !== "undefined";
+  return browser && !options.apiKey ? "strict" : "compatible";
+}
+function createSingleFlightReadEntry(generation, onRequestStart) {
+  let resolve;
+  let reject;
+  const promise = new Promise((entryResolve, entryReject) => {
+    resolve = entryResolve;
+    reject = entryReject;
+  });
+  return {
+    controller: new AbortController(),
+    consumers: 0,
+    generation,
+    promise,
+    resolve,
+    reject,
+    started: false,
+    listeners: new Set(onRequestStart ? [onRequestStart] : [])
+  };
+}
+function assertNoMessageTools(input) {
+  if (Object.prototype.hasOwnProperty.call(input, "tools")) {
+    throw new TypeError(
+      "Message-level tools are not supported; update the session tool policy before sending."
+    );
+  }
+}
+function normalizeScheduledTaskMachineTarget(request) {
+  if (!("agentConfig" in request) || !request.agentConfig?.machineTarget) {
+    return request;
+  }
+  const { workingDir, ...machineTarget } = request.agentConfig.machineTarget;
+  if (workingDir === void 0) {
+    return request;
+  }
+  const normalizedWorkingDir = workingDir.trim();
+  return {
+    ...request,
+    agentConfig: {
+      ...request.agentConfig,
+      machineTarget: {
+        ...machineTarget,
+        ...normalizedWorkingDir ? { workingDir: normalizedWorkingDir } : {}
+      }
+    }
+  };
+}
+function createLazyToolsFacade(transport) {
   return {
-    ...limit === void 0 ? {} : { limit: String(limit) },
-    ...parentSessionId === void 0 ? {} : { parentSessionId: parentSessionId ?? "null" }
+    forWorkspace(workspaceId) {
+      const normalizedWorkspaceId = workspaceId.trim();
+      if (!normalizedWorkspaceId) throw new TypeError("workspaceId is required");
+      let workspaceTools;
+      const load = () => workspaceTools ??= import("./tools-FXBLUWAE.js").then(
+        ({ OpenGeniToolsClient }) => new OpenGeniToolsClient(transport).forWorkspace(normalizedWorkspaceId)
+      );
+      const node = (path) => new Proxy(
+        async (...args) => {
+          let target = await load();
+          for (const segment of path) {
+            target = target[segment];
+          }
+          if (typeof target !== "function")
+            throw new TypeError("Opengeni tool path is not callable");
+          return await Reflect.apply(target, void 0, args);
+        },
+        {
+          get: (_target, property) => {
+            if (property === "then") return void 0;
+            if (typeof property !== "string") return void 0;
+            return node([...path, property]);
+          }
+        }
+      );
+      return new Proxy(/* @__PURE__ */ Object.create(null), {
+        get: (_target, property) => {
+          if (property === "then") return void 0;
+          if (typeof property !== "string") return void 0;
+          return node([property]);
+        }
+      });
+    }
   };
 }
 var OpenGeniClient = class {
+  externalActorHeader;
+  serviceInitiatorHeader;
+  serviceContextHeader;
   baseUrl;
   options;
   fetchImpl;
-  readInFlight = /* @__PURE__ */ new Map();
-  readTrailing = /* @__PURE__ */ new Map();
+  sessionCommandTimeoutMs;
+  apiContractStrict;
+  active = /* @__PURE__ */ new Map();
+  generations = /* @__PURE__ */ new Map();
+  queued = /* @__PURE__ */ new Map();
   /** Resource-oriented Browser/Computer facade over this exact authenticated client. */
   interaction;
+  /** Dynamic typed tool facade backed by the canonical workspace gateway. */
+  tools;
   constructor(options) {
     this.baseUrl = options.baseUrl.replace(/\/+$/, "");
     this.options = options;
-    this.fetchImpl = options.fetch ?? ((input, init) => fetch(input, init));
+    this.fetchImpl = withDeprecationNotices(
+      options.fetch ?? ((input, init) => fetch(input, init)),
+      options.onDeprecation
+    );
+    const sessionCommandTimeoutMs = options.sessionCommandTimeoutMs ?? 15e3;
+    if (!Number.isFinite(sessionCommandTimeoutMs) || sessionCommandTimeoutMs <= 0) {
+      throw new RangeError("sessionCommandTimeoutMs must be a finite positive number");
+    }
+    this.sessionCommandTimeoutMs = sessionCommandTimeoutMs;
+    this.apiContractStrict = defaultApiContractMode(options) === "strict";
     this.interaction = new OpenGeniInteractionClient(this);
+    this.tools = createLazyToolsFacade(this);
   }
   // --- Session lifecycle ---------------------------------------------------
   /** Make one finalization attempt for a recording; callers may retry retained audio. */
@@ -749,7 +769,7 @@ var OpenGeniClient = class {
       if (input.signal?.aborted) throw error;
       throw mutationTransportError(correlationId);
     }
-    assertApiContractResponse(response);
+    assertApiContractResponse(response, this.apiContractStrict);
     if (!response.ok)
       throw await apiErrorFromResponse(response, {
         method: "POST",
@@ -838,7 +858,7 @@ var OpenGeniClient = class {
       if (input.signal?.aborted) throw error;
       throw mutationTransportError(correlationId);
     }
-    assertApiContractResponse(response);
+    assertApiContractResponse(response, this.apiContractStrict);
     if (!response.ok)
       throw await apiErrorFromResponse(response, {
         method: "PUT",
@@ -895,14 +915,17 @@ var OpenGeniClient = class {
   async createSession(workspaceId, request) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions`,
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/sessions`,
       request
     );
   }
-  async getNewSessionDraft(workspaceId) {
+  async getNewSessionDraft(workspaceId, options = {}) {
     return await this.requestJson(
       "GET",
-      `/v1/workspaces/${workspaceId}/new-session-draft`
+      `/v1/workspaces/${workspaceId}/new-session-draft`,
+      void 0,
+      {},
+      options
     );
   }
   async saveNewSessionDraft(workspaceId, request) {
@@ -912,14 +935,117 @@ var OpenGeniClient = class {
       request
     );
   }
+  /** The workspace's HTTP credential provider, or null when none is configured. */
+  async getWorkspaceCredentialProvider(workspaceId) {
+    return this.requestJson("GET", `/v1/workspaces/${workspaceId}/credential-provider`);
+  }
+  /**
+   * Create or update the workspace credential provider. The signing secret is
+   * returned only when the provider is first created; store it then.
+   */
+  async putWorkspaceCredentialProvider(workspaceId, request) {
+    return this.requestJson("PUT", `/v1/workspaces/${workspaceId}/credential-provider`, request);
+  }
+  async deleteWorkspaceCredentialProvider(workspaceId) {
+    await this.requestVoid("DELETE", `/v1/workspaces/${workspaceId}/credential-provider`);
+  }
+  async listWorkspaceWebhooks(workspaceId) {
+    return this.requestJson("GET", `/v1/workspaces/${workspaceId}/webhooks`);
+  }
+  /** Create a webhook. The signing secret is returned only in this response. */
+  async createWorkspaceWebhook(workspaceId, request) {
+    return this.requestJson("POST", `/v1/workspaces/${workspaceId}/webhooks`, request);
+  }
+  async updateWorkspaceWebhook(workspaceId, webhookId, request) {
+    return this.requestJson(
+      "PATCH",
+      `/v1/workspaces/${workspaceId}/webhooks/${webhookId}`,
+      request
+    );
+  }
+  async deleteWorkspaceWebhook(workspaceId, webhookId) {
+    await this.requestVoid("DELETE", `/v1/workspaces/${workspaceId}/webhooks/${webhookId}`);
+  }
+  async listWorkspaceWebhookDeliveries(workspaceId, webhookId, options = {}) {
+    return this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/webhooks/${webhookId}/deliveries`,
+      void 0,
+      options.limit !== void 0 ? { limit: String(options.limit) } : {}
+    );
+  }
+  /** Queue a delivered or failed delivery again with a fresh attempt budget. */
+  async redeliverWorkspaceWebhookDelivery(workspaceId, webhookId, deliveryId) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/webhooks/${webhookId}/deliveries/${deliveryId}/redeliver`
+    );
+  }
+  /** Images this deployment lets a workspace choose as its default sandbox image. */
+  async listWorkspaceSandboxImages(workspaceId) {
+    return this.requestJson("GET", `/v1/workspaces/${workspaceId}/sandbox-images`);
+  }
+  /** Submit general feedback or a session/turn rating. Retain the key when retrying. */
+  async createFeedback(workspaceId, request) {
+    return this.requestJson("POST", `/v1/workspaces/${workspaceId}/feedback`, request);
+  }
+  /** Only this principal's submissions. No session filter means general feedback only. */
+  async listOwnFeedback(workspaceId, options = {}) {
+    const query = new URLSearchParams();
+    if (options.sessionId) query.set("sessionId", options.sessionId);
+    if (options.limit !== void 0) query.set("limit", String(options.limit));
+    if (options.includeTurns !== void 0) query.set("includeTurns", String(options.includeTurns));
+    return this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/feedback${query.size ? `?${query}` : ""}`
+    );
+  }
   async getSession(workspaceId, sessionId, options = {}) {
-    const path = `/v1/workspaces/${workspaceId}/sessions/${sessionId}`;
-    return await this.singleFlightRead(path, () => this.requestJson("GET", path), options);
+    const path = sessionPath(workspaceId, sessionId);
+    return await this.sharedRead(
+      path,
+      (signal) => this.requestJson("GET", path, void 0, {}, { signal }),
+      options
+    );
+  }
+  /** Exact model-visible prefix captured from the latest provider request. */
+  async getSessionModelContext(workspaceId, sessionId) {
+    return await this.requestJson(
+      "GET",
+      `${sessionPath(workspaceId, sessionId)}/model-context`
+    );
   }
   async updateSession(workspaceId, sessionId, request) {
+    return await this.requestJson("PATCH", sessionPath(workspaceId, sessionId), request);
+  }
+  /** Replace the complete ordered Variable Set selection at a quiescent turn boundary. */
+  async updateSessionVariableSets(workspaceId, sessionId, request) {
     return await this.requestJson(
-      "PATCH",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}`,
+      "PUT",
+      `${sessionPath(workspaceId, sessionId)}/variable-sets`,
+      request
+    );
+  }
+  /** Whether this exact authenticated principal may atomically create a private session. */
+  async getSessionTenancyCreateCapabilities(workspaceId) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/session-tenancy/capabilities`
+    );
+  }
+  /** Change an owned, fully quiescent session between private and workspace visibility. */
+  async updateSessionVisibility(workspaceId, sessionId, request) {
+    return await this.requestJson(
+      "PUT",
+      `${sessionPath(workspaceId, sessionId)}/visibility`,
+      request
+    );
+  }
+  /** Create an independent same-workspace fork with explicit destination visibility. */
+  async forkSession(workspaceId, sessionId, request) {
+    return await this.requestJson(
+      "POST",
+      `${sessionPath(workspaceId, sessionId)}/forks`,
       request
     );
   }
@@ -927,7 +1053,20 @@ var OpenGeniClient = class {
   async updateSessionToolPolicy(workspaceId, sessionId, request) {
     return await this.requestJson(
       "PUT",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/tool-policy`,
+      `${sessionPath(workspaceId, sessionId)}/tool-policy`,
+      request
+    );
+  }
+  /**
+   * Replace the session's agent configuration (capabilities, identity,
+   * instructions alias, renderer). Omitted fields keep their current values.
+   * Uses the tool-policy version (409 when stale) and applies from the next
+   * turn. A legacy session converts from its current effective state.
+   */
+  async updateSessionAgent(workspaceId, sessionId, request) {
+    return await this.requestJson(
+      "PUT",
+      `${sessionPath(workspaceId, sessionId)}/agent`,
       request
     );
   }
@@ -939,12 +1078,45 @@ var OpenGeniClient = class {
   async updateSessionMcpApprovalPolicy(workspaceId, sessionId, serverId, request) {
     return await this.requestJson(
       "PATCH",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/mcp-servers/${encodeURIComponent(serverId)}/approval-policy`,
+      `${sessionPath(workspaceId, sessionId)}/mcp-servers/${encodeURIComponent(serverId)}/approval-policy`,
       request
     );
   }
+  /** Search durable visible user/assistant text, including unloaded history.
+   * Pages may be empty with hasMore=true. Never fall back to title search on
+   * older servers. Use listEventPage before/after the returned sequence for context.
+   */
+  async searchSessionMessages(workspaceId, request, options = {}) {
+    return this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/session-message-search`,
+      void 0,
+      {
+        query: request.query,
+        ...request.sessionId !== void 0 ? { sessionId: request.sessionId } : {},
+        ...request.groupBy !== void 0 ? { groupBy: request.groupBy } : {},
+        ...request.archiveStatus !== void 0 ? { archiveStatus: request.archiveStatus } : {},
+        ...request.limit !== void 0 ? { limit: String(request.limit) } : {},
+        ...request.cursor !== void 0 ? { cursor: request.cursor } : {}
+      },
+      options
+    );
+  }
+  /** Read one selected search result's complete visible text when <=12,000
+   * UTF-16 units. Stale, duplicate or non-message references fail with 404.
+   * The response never includes audit payload fields such as modelContext.
+   */
+  async getSessionMessagePreview(workspaceId, sessionId, reference, options = {}) {
+    return this.requestJson(
+      "GET",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/sessions/${encodeURIComponent(sessionId)}/events/${encodeURIComponent(reference.eventId)}/message-preview`,
+      void 0,
+      { sequence: String(reference.sequence) },
+      options
+    );
+  }
   async listSessions(workspaceId, options = {}) {
-    if (options.search?.trim()) {
+    if (options.search?.trim() || options.originSiteId) {
       const page = await this.listSessionPage(workspaceId, options);
       return [...page.pinned, ...page.sessions];
     }
@@ -955,22 +1127,75 @@ var OpenGeniClient = class {
       sessionListQuery(options)
     );
   }
+  /** Running and stopping commands only; settled results remain in session history. */
+  async listSessionBackgroundCommands(workspaceId, sessionId, options = {}) {
+    return await this.requestJson(
+      "GET",
+      `${sessionPath(workspaceId, sessionId)}/background-commands`,
+      void 0,
+      {},
+      options
+    );
+  }
+  async cancelSessionBackgroundCommand(workspaceId, sessionId, commandId) {
+    return await this.requestJson(
+      "DELETE",
+      `${sessionPath(workspaceId, sessionId)}/background-commands/${commandId}`
+    );
+  }
   /** Pin-aware ordinary-session page with a stable keyset cursor. */
   async listSessionPage(workspaceId, options = {}) {
+    const response = await this.requestSessionPage(
+      `/v1/workspaces/${workspaceId}/sessions`,
+      options
+    );
+    if ("projection" in response) throw unsupportedSessionPage("full session details");
+    return response;
+  }
+  /** Compact rail records; safely projects full pages from older APIs. */
+  async listSessionSummaryPage(workspaceId, options = {}) {
+    const response = await this.requestSessionPage(
+      `/v1/workspaces/${workspaceId}/sessions`,
+      options,
+      true
+    );
+    if ("projection" in response) return response;
+    const { sessionListEntry } = await import("./session-list-entries.js");
+    return {
+      ...response,
+      projection: "summary",
+      pinned: response.pinned.map(sessionListEntry),
+      sessions: response.sessions.map(sessionListEntry)
+    };
+  }
+  async requestSessionPage(path, options, summary = false) {
     const search = options.search?.trim();
-    let response;
+    let result;
     try {
-      response = await this.requestJson(
+      const query = { view: "page", ...sessionListQuery(options) };
+      if (summary) query.projection = "summary";
+      if (options.cursor !== void 0) query.cursor = options.cursor;
+      if (search) query.search = search;
+      if (options.channelId !== void 0) query.channelId = options.channelId ?? "null";
+      if (options.createdBy) {
+        query.createdByKind = options.createdBy.kind;
+        query.createdBySubjectId = options.createdBy.subjectId;
+      }
+      for (const key of SESSION_PAGE_STRING_QUERY_KEYS) {
+        const value = options[key];
+        if (value) query[key] = value;
+      }
+      if (options.pinsOnly) query.pinsOnly = "true";
+      if (options.includeTotals) query.includeTotals = "true";
+      if (options.needsYouOnly) query.needsYouOnly = "true";
+      if (options.includePinned === false) query.includePinned = "false";
+      if (options.archivedOnly) query.archivedOnly = "true";
+      result = await this.requestJson(
         "GET",
-        `/v1/workspaces/${workspaceId}/sessions`,
+        path,
         void 0,
-        {
-          view: "page",
-          ...sessionListQuery(options),
-          ...options.cursor !== void 0 ? { cursor: options.cursor } : {},
-          ...search ? { search } : {},
-          ...options.pinsOnly ? { pinsOnly: "true" } : {}
-        }
+        query,
+        { signal: options.signal }
       );
     } catch (error) {
       if (error instanceof OpenGeniApiError && error.status === 410) {
@@ -984,78 +1209,222 @@ var OpenGeniClient = class {
       }
       throw error;
     }
-    if (Array.isArray(response)) {
-      if (options.cursor) {
-        throw new Error("The connected OpenGeni API does not support stable session-page cursors");
-      }
-      if (search) {
-        throw new Error("The connected OpenGeni API does not support session search");
-      }
-      if (options.pinsOnly) {
-        throw new Error("The connected OpenGeni API does not support pins-only session lists");
-      }
+    const response = result;
+    const legacy = Array.isArray(response);
+    const filtered = hasSessionPageFilters(options);
+    if (options.sortBy !== void 0 && (legacy || response.sortBy !== options.sortBy) || options.archiveStatus !== void 0 && (legacy || response.archiveStatus !== options.archiveStatus)) {
+      throw unsupportedSessionPage("the requested session sorting/archive filter");
+    }
+    if (legacy) {
+      const unsupported = options.includeTotals ? "complete session totals" : options.cursor ? "stable session-page cursors" : search ? "session search" : options.pinsOnly ? "pins-only session lists" : options.archivedOnly ? "archived session lists" : filtered ? "filtered session lists" : null;
+      if (unsupported) throw unsupportedSessionPage(unsupported);
       return { pinned: [], sessions: response, nextCursor: null };
     }
+    if (options.includeTotals && response.totals === void 0)
+      throw unsupportedSessionPage("complete session totals");
+    if (options.needsYouOnly && response.needsYouOnly !== true)
+      throw unsupportedSessionPage("attention session filtering");
+    if (filtered && response.filtersApplied !== true) {
+      throw unsupportedSessionPage("filtered session lists");
+    }
+    if (options.originSiteId && (!response.originSiteId || options.originSiteId !== "current" && response.originSiteId !== options.originSiteId)) {
+      throw unsupportedSessionPage("Site-filtered session lists");
+    }
     return response;
   }
   /** Compact, bounded workspace agent hierarchy page. */
   async listAgentTopology(workspaceId, options = {}) {
-    const search = options.search?.trim();
+    const query = options.query?.trim() || options.search?.trim();
+    if (query && options.subject) {
+      throw new TypeError("listAgentTopology query cannot be combined with an exact subject");
+    }
+    const params = sessionListQuery(options);
+    if (options.rootSessionId) params.rootSessionId = options.rootSessionId;
+    if (options.cursor) params.cursor = options.cursor;
+    if (query) params.query = query;
+    if (options.statuses?.length) params.statuses = options.statuses.join(",");
+    if (options.activeOnly !== void 0) params.activeOnly = options.activeOnly ? "true" : "false";
+    if (options.recentHours !== void 0) params.recentHours = String(options.recentHours);
+    if (options.subject) {
+      params.subjectNamespace = options.subject.namespace;
+      params.subjectType = options.subject.type;
+      params.subjectKey = options.subject.canonicalKey;
+    }
+    if (options.claimLimit !== void 0) params.claimLimit = String(options.claimLimit);
     return await this.requestJson(
       "GET",
       `/v1/workspaces/${workspaceId}/agent-topology`,
       void 0,
-      {
-        ...options.limit !== void 0 ? { limit: String(options.limit) } : {},
-        ...options.parentSessionId === void 0 ? {} : { parentSessionId: options.parentSessionId ?? "null" },
-        ...options.cursor ? { cursor: options.cursor } : {},
-        ...search ? { search } : {}
-      }
+      params
     );
   }
   /** Set this authenticated member's personal workspace pin for a session. */
   async updateSessionPin(workspaceId, sessionId, request) {
     return await this.requestJson(
       "PUT",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/pin`,
+      `${sessionPath(workspaceId, sessionId)}/pin`,
+      request
+    );
+  }
+  /** Set this authenticated member's explicit read/actively-working state. */
+  async updateSessionAttention(workspaceId, sessionId, request) {
+    return await this.requestJson(
+      "PUT",
+      `${sessionPath(workspaceId, sessionId)}/attention`,
+      request
+    );
+  }
+  /** Archive or restore this authenticated member's root chat. */
+  async updateSessionArchive(workspaceId, sessionId, request) {
+    return await this.requestJson(
+      "PUT",
+      `${sessionPath(workspaceId, sessionId)}/archive`,
       request
     );
   }
-  async getSessionLineage(workspaceId, sessionId) {
-    const path = `/v1/workspaces/${workspaceId}/sessions/${sessionId}/lineage`;
-    return await this.singleFlightRead(
+  /** Permanently delete one quiescent root session and its full descendant tree. */
+  async deleteSession(workspaceId, sessionId) {
+    return await this.requestJson(
+      "DELETE",
+      sessionPath(workspaceId, sessionId)
+    );
+  }
+  async getSessionLineage(workspaceId, sessionId, options = {}) {
+    const path = `${sessionPath(workspaceId, sessionId)}/lineage`;
+    return await this.sharedRead(
       path,
-      () => this.requestJson("GET", path)
+      (signal) => this.requestJson("GET", path, void 0, {}, { signal }),
+      options
     );
   }
-  singleFlightRead(key, read, options = {}) {
-    const existing = this.readInFlight.get(key);
-    if (existing) {
-      if (!options.fresh) return existing;
-      const queued = this.readTrailing.get(key);
-      if (queued) return queued;
-      const trailing = existing.then(
-        () => this.singleFlightRead(key, read),
-        () => this.singleFlightRead(key, read)
+  sharedRead(key, read, options = {}) {
+    if (options.signal?.aborted) {
+      return Promise.reject(
+        options.signal.reason ?? new DOMException("Request aborted", "AbortError")
       );
-      this.readTrailing.set(key, trailing);
-      const clear = () => {
-        if (this.readTrailing.get(key) === trailing) this.readTrailing.delete(key);
-      };
-      void trailing.then(clear, clear);
-      return trailing;
     }
-    const promise = read().finally(() => {
-      if (this.readInFlight.get(key) === promise) this.readInFlight.delete(key);
+    const existing = this.active.get(key);
+    if (existing) {
+      if (!options.fresh) {
+        this.observeRead(existing, options.onRequestStart);
+        return this.consumeSharedRead(key, existing, options.signal);
+      }
+      const requiredGeneration = existing.generation + 1;
+      const queued2 = this.queued.get(key);
+      if (queued2 && queued2.generation >= requiredGeneration) {
+        this.observeRead(queued2, options.onRequestStart);
+        return this.consumeSharedRead(key, queued2, options.signal);
+      }
+      const predecessor = queued2?.promise ?? existing.promise;
+      return this.queueRead(key, predecessor, requiredGeneration, read, options);
+    }
+    const queued = this.queued.get(key);
+    if (queued && (!options.fresh || !queued.started)) {
+      this.observeRead(queued, options.onRequestStart);
+      return this.consumeSharedRead(key, queued, options.signal);
+    }
+    if (queued) {
+      return this.queueRead(key, queued.promise, queued.generation + 1, read, options);
+    }
+    const generation = (this.generations.get(key) ?? 0) + 1;
+    const entry = createSingleFlightReadEntry(generation, options.onRequestStart);
+    const consumed = this.consumeSharedRead(key, entry, options.signal);
+    this.launchRead(key, entry, read);
+    return consumed;
+  }
+  queueRead(key, predecessor, generation, read, options) {
+    const entry = createSingleFlightReadEntry(generation, options.onRequestStart);
+    const consumed = this.consumeSharedRead(key, entry, options.signal);
+    this.queued.set(key, entry);
+    const launch = () => this.launchRead(key, entry, read);
+    void predecessor.then(launch, launch);
+    const clear = () => {
+      if (this.queued.get(key) !== entry) return;
+      this.queued.delete(key);
+      if (!this.active.has(key)) this.generations.delete(key);
+    };
+    void entry.promise.then(clear, clear);
+    return consumed;
+  }
+  launchRead(key, entry, read) {
+    if (entry.controller.signal.aborted) return;
+    entry.started = true;
+    this.generations.set(key, entry.generation);
+    this.active.set(key, entry);
+    try {
+      entry.stamp = this.options.beginSharedRead?.();
+    } catch {
+    }
+    for (const listener of entry.listeners) {
+      try {
+        listener(entry.stamp);
+      } catch {
+      }
+    }
+    entry.listeners.clear();
+    const settle = () => {
+      if (this.active.get(key) !== entry) return;
+      this.active.delete(key);
+      if (!this.queued.has(key)) this.generations.delete(key);
+    };
+    let request;
+    try {
+      request = read(entry.controller.signal);
+    } catch (error) {
+      settle();
+      entry.reject(error);
+      return;
+    }
+    void request.then(
+      (value) => {
+        settle();
+        entry.resolve(value);
+      },
+      (error) => {
+        settle();
+        entry.reject(error);
+      }
+    );
+  }
+  consumeSharedRead(key, entry, signal) {
+    entry.consumers += 1;
+    let released = false;
+    const release = () => {
+      if (released) return;
+      released = true;
+      entry.consumers -= 1;
+      if (!signal?.aborted || entry.consumers > 0) return;
+      const reason = signal.reason;
+      entry.controller.abort(reason);
+      if (this.active.get(key) === entry) this.active.delete(key);
+      if (this.queued.get(key) === entry) this.queued.delete(key);
+      if (!this.active.has(key) && !this.queued.has(key)) this.generations.delete(key);
+      entry.reject(reason);
+    };
+    signal?.addEventListener("abort", release, { once: true });
+    const consumed = awaitWithAbort(entry.promise, signal);
+    return consumed.finally(() => {
+      signal?.removeEventListener("abort", release);
+      release();
     });
-    this.readInFlight.set(key, promise);
-    return promise;
+  }
+  observeRead(entry, listener) {
+    if (!listener) return;
+    if (!entry.started) {
+      entry.listeners.add(listener);
+      return;
+    }
+    if (entry.stamp === void 0) return;
+    try {
+      listener(entry.stamp);
+    } catch {
+    }
   }
   /** Negotiate one server-mediated connected-Codex GPT-Live V3 WebRTC call. */
   async negotiateCodexRealtimeWebrtc(workspaceId, sessionId, request, options = {}) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/realtime/webrtc`,
+      `${sessionPath(workspaceId, sessionId)}/realtime/webrtc`,
       request,
       {},
       { signal: options.signal }
@@ -1065,7 +1434,7 @@ var OpenGeniClient = class {
   async negotiateGatewayRealtime(workspaceId, sessionId, request, options = {}) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/realtime/gateway`,
+      `${sessionPath(workspaceId, sessionId)}/realtime/gateway`,
       request,
       {},
       { signal: options.signal }
@@ -1075,7 +1444,7 @@ var OpenGeniClient = class {
   async negotiateXaiSubscriptionRealtime(workspaceId, sessionId, request, options = {}) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/realtime/supergrok`,
+      `${sessionPath(workspaceId, sessionId)}/realtime/supergrok`,
       request,
       {},
       { signal: options.signal }
@@ -1085,7 +1454,7 @@ var OpenGeniClient = class {
   async activateCodexRealtimeConnection(workspaceId, sessionId, realtimeId, connectionId, request, options = {}) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/realtime/${realtimeId}/connections/${connectionId}/activate`,
+      `${sessionPath(workspaceId, sessionId)}/realtime/${realtimeId}/connections/${connectionId}/activate`,
       request,
       {},
       { signal: options.signal }
@@ -1095,7 +1464,7 @@ var OpenGeniClient = class {
   async beginSessionRealtime(workspaceId, sessionId, request) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/realtime`,
+      `${sessionPath(workspaceId, sessionId)}/realtime`,
       request
     );
   }
@@ -1103,7 +1472,7 @@ var OpenGeniClient = class {
   async heartbeatSessionRealtime(workspaceId, sessionId, realtimeId, request) {
     return await this.requestJson(
       "PATCH",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/realtime/${realtimeId}/heartbeat`,
+      `${sessionPath(workspaceId, sessionId)}/realtime/${realtimeId}/heartbeat`,
       request
     );
   }
@@ -1111,7 +1480,7 @@ var OpenGeniClient = class {
   async syncSessionRealtimeLedger(workspaceId, sessionId, realtimeId, request) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/realtime/${realtimeId}/sync`,
+      `${sessionPath(workspaceId, sessionId)}/realtime/${realtimeId}/sync`,
       request
     );
   }
@@ -1119,25 +1488,27 @@ var OpenGeniClient = class {
   async endSessionRealtime(workspaceId, sessionId, realtimeId, request) {
     return await this.requestJson(
       "DELETE",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/realtime/${realtimeId}`,
+      `${sessionPath(workspaceId, sessionId)}/realtime/${realtimeId}`,
       request
     );
   }
   async listTurns(workspaceId, sessionId, options = {}) {
     return await this.requestJson(
       "GET",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/turns`,
+      `${sessionPath(workspaceId, sessionId)}/turns`,
       void 0,
       {
         ...options.limit !== void 0 ? { limit: String(options.limit) } : {},
         ...options.latestStarted ? { latestStarted: "1" } : {}
-      }
+      },
+      { signal: options.signal }
     );
   }
   /** Newest turn that durably emitted `turn.started`, or null before any admission. */
-  async getLatestStartedTurn(workspaceId, sessionId) {
+  async getLatestStartedTurn(workspaceId, sessionId, options = {}) {
     const turns = await this.listTurns(workspaceId, sessionId, {
-      latestStarted: true
+      latestStarted: true,
+      signal: options.signal
     });
     return turns[0] ?? null;
   }
@@ -1159,6 +1530,24 @@ var OpenGeniClient = class {
       { signal: options.signal }
     );
   }
+  /** Ask one authoritative Connected Machine runner to drain accepted work and
+   * install the exact signed version promoted for its channel. Progress is read
+   * from `listMachines`; completion requires the successor build identity. */
+  async updateMachineAgent(workspaceId, enrollmentId) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/machines/${enrollmentId}/update`
+    );
+  }
+  /** Revision-fenced update of a Connected Machine's optional command memory
+   * policy. Null byte limits preserve unrestricted machine access. */
+  async updateMachineOperationPolicy(workspaceId, enrollmentId, request) {
+    return await this.requestJson(
+      "PATCH",
+      `/v1/workspaces/${workspaceId}/machines/${enrollmentId}/operation-policy`,
+      request
+    );
+  }
   /**
    * Read the downsampled (~1/min) metrics series for ONE machine over a time
    * window (default 1h). The samples are oldest-first (a left-to-right chart).
@@ -1175,8 +1564,9 @@ var OpenGeniClient = class {
   /**
    * Remove one connected self-hosted machine enrollment. The control-plane
    * operation works while the agent is offline, revokes future reconnects,
-   * retains history, and returns a typed blocker when active route/lease or
-   * recovery dependencies make removal unsafe. `idempotencyKey` is replay-safe.
+   * retains history, and atomically detaches idle dependent sessions (a
+   * machine-home session becomes `backend:none`). Active turns, live leases,
+   * and recovery work remain typed blockers. `idempotencyKey` is replay-safe.
    */
   async removeEnrollment(workspaceId, enrollmentId, request = {}) {
     return await this.requestJson(
@@ -1213,7 +1603,8 @@ var OpenGeniClient = class {
       `/v1/workspaces/${workspaceId}/enrollments/device/approve`,
       {
         userCode: request.userCode,
-        allowScreenControl: request.allowScreenControl ?? false
+        allowScreenControl: request.allowScreenControl ?? false,
+        ...request.scope ? { scope: request.scope } : {}
       }
     );
   }
@@ -1249,7 +1640,7 @@ var OpenGeniClient = class {
   async swapActiveSandbox(workspaceId, sessionId, request) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/active-sandbox`,
+      `${sessionPath(workspaceId, sessionId)}/active-sandbox`,
       request
     );
   }
@@ -1260,6 +1651,8 @@ var OpenGeniClient = class {
       `/v1/workspaces/${workspaceId}/scheduled-tasks`,
       void 0,
       {
+        ...options.offset !== void 0 ? { offset: String(options.offset) } : {},
+        ...options.sessionId ? { sessionId: options.sessionId } : {},
         ...options.limit !== void 0 ? { limit: String(options.limit) } : {}
       }
     );
@@ -1270,6 +1663,18 @@ var OpenGeniClient = class {
       `/v1/workspaces/${workspaceId}/scheduled-tasks/${taskId}`
     );
   }
+  /**
+   * Channels a person may choose as a scheduled task's fixed Slack destination:
+   * active, non-shared channels the selected OpenGeni bot already belongs to.
+   */
+  async listScheduledTaskSlackChannels(workspaceId, connectionId, cursor) {
+    const query = new URLSearchParams({ connectionId });
+    if (cursor) query.set("cursor", cursor);
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/scheduled-task-slack-channels?${query}`
+    );
+  }
   // --- Events: replay, send, stream ----------------------------------------
   /**
    * Return the events from one bounded page. With no cursor, this uses the safe
@@ -1292,7 +1697,7 @@ var OpenGeniClient = class {
     const listOptions = options.resultMode === "compact" ? null : options;
     const correlationId = crypto.randomUUID();
     const response = await this.fetchImpl(
-      this.url(`/v1/workspaces/${workspaceId}/sessions/${sessionId}/events`, {
+      this.url(`${sessionPath(workspaceId, sessionId)}/events`, {
         ...listOptions?.after !== void 0 ? { after: String(listOptions.after) } : {},
         ...listOptions?.before !== void 0 ? { before: String(listOptions.before) } : {},
         ...listOptions?.limit !== void 0 ? { limit: String(listOptions.limit) } : {},
@@ -1312,7 +1717,7 @@ var OpenGeniClient = class {
         headers: { ...this.headers(correlationId), Accept: "application/json" }
       }
     );
-    assertApiContractResponse(response);
+    assertApiContractResponse(response, this.apiContractStrict);
     if (!response.ok) {
       throw await apiErrorFromResponse(response, {
         method: "GET",
@@ -1373,14 +1778,15 @@ var OpenGeniClient = class {
   }
   /** POST a user/control event to the session. Returns the accepted event. */
   async sendEvent(workspaceId, sessionId, event) {
-    return await this.requestJson(
+    return await this.requestSessionCommand(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/events`,
+      `${sessionPath(workspaceId, sessionId)}/events`,
       event
     );
   }
   async sendMessage(workspaceId, sessionId, message) {
     const input = typeof message === "string" ? { text: message } : message;
+    assertNoMessageTools(input);
     const { clientEventId, ...payload } = input;
     return await this.sendEvent(workspaceId, sessionId, {
       type: "user.message",
@@ -1407,7 +1813,7 @@ var OpenGeniClient = class {
   async listHumanInputRequests(workspaceId, sessionId, options = {}) {
     const result = await this.requestJson(
       "GET",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/human-input-requests`,
+      `${sessionPath(workspaceId, sessionId)}/human-input-requests`,
       void 0,
       options.status ? { status: options.status } : void 0
     );
@@ -1416,7 +1822,7 @@ var OpenGeniClient = class {
   async getHumanInputRequest(workspaceId, sessionId, requestId) {
     return await this.requestJson(
       "GET",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/human-input-requests/${requestId}`
+      `${sessionPath(workspaceId, sessionId)}/human-input-requests/${requestId}`
     );
   }
   async submitHumanInputResponse(workspaceId, sessionId, requestId, response, options = {}) {
@@ -1446,7 +1852,7 @@ var OpenGeniClient = class {
   }
   /** Open one raw SSE connection (no reconnect). Most callers want `streamEvents`. */
   async openEventStream(workspaceId, sessionId, options = {}) {
-    const url = this.url(`/v1/workspaces/${workspaceId}/sessions/${sessionId}/events/stream`, {
+    const url = this.url(`${sessionPath(workspaceId, sessionId)}/events/stream`, {
       after: String(options.after ?? 0)
     });
     const correlationId = crypto.randomUUID();
@@ -1455,7 +1861,7 @@ var OpenGeniClient = class {
       headers: { ...this.headers(correlationId), Accept: "text/event-stream" },
       ...options.signal ? { signal: options.signal } : {}
     });
-    assertApiContractResponse(response);
+    assertApiContractResponse(response, this.apiContractStrict);
     if (!response.ok) {
       throw await apiErrorFromResponse(response, {
         method: "GET",
@@ -1469,57 +1875,86 @@ var OpenGeniClient = class {
   }
   // --- Turn queue ------------------------------------------------------------
   async getQueue(workspaceId, sessionId) {
-    const path = `/v1/workspaces/${workspaceId}/sessions/${sessionId}/queue`;
-    return await this.singleFlightRead(
+    const path = `${sessionPath(workspaceId, sessionId)}/queue`;
+    return await this.sharedRead(
       path,
-      () => this.requestJson("GET", path)
+      () => this.requestSessionCommand("GET", path)
     );
   }
   async moveQueueItem(workspaceId, sessionId, turnId, request) {
-    return await this.requestJson(
+    return await this.requestSessionCommand(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/queue/${turnId}/move`,
+      `${sessionPath(workspaceId, sessionId)}/queue/${turnId}/move`,
       request
     );
   }
   async editQueueItem(workspaceId, sessionId, turnId, request) {
-    return await this.requestJson(
+    return await this.requestSessionCommand(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/queue/${turnId}/edit`,
+      `${sessionPath(workspaceId, sessionId)}/queue/${turnId}/edit`,
       request
     );
   }
   async steerQueueItem(workspaceId, sessionId, turnId, request) {
-    return await this.requestJson(
+    return await this.requestSessionCommand(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/queue/${turnId}/steer`,
+      `${sessionPath(workspaceId, sessionId)}/queue/${turnId}/steer`,
       request
     );
   }
   async deleteQueueItem(workspaceId, sessionId, turnId, request) {
-    return await this.requestJson(
+    return await this.requestSessionCommand(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/queue/${turnId}/delete`,
+      `${sessionPath(workspaceId, sessionId)}/queue/${turnId}/delete`,
       request
     );
   }
-  async getComposerDraft(workspaceId, sessionId) {
-    return await this.requestJson(
+  async getComposerDraft(workspaceId, sessionId, options = {}) {
+    return await this.requestSessionCommand(
       "GET",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/composer-draft`
+      `${sessionPath(workspaceId, sessionId)}/composer-draft`,
+      void 0,
+      options
     );
   }
   async saveComposerDraft(workspaceId, sessionId, request) {
-    return await this.requestJson(
+    return await this.requestSessionCommand(
       "PUT",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/composer-draft`,
+      `${sessionPath(workspaceId, sessionId)}/composer-draft`,
+      request
+    );
+  }
+  async submitComposerDraft(workspaceId, sessionId, request) {
+    return await this.requestSessionCommand(
+      "POST",
+      `${sessionPath(workspaceId, sessionId)}/composer-draft/submit`,
+      request
+    );
+  }
+  /** Inspect bounded checkpoint recovery eligibility without changing session state. */
+  async getSandboxRecovery(workspaceId, sessionId) {
+    return this.requestJson("GET", `${sessionPath(workspaceId, sessionId)}/sandbox-recovery`);
+  }
+  /** Restore only the explicitly selected checkpoint; never retry a command. */
+  async recoverSandbox(workspaceId, sessionId, request) {
+    return this.requestSessionCommand(
+      "POST",
+      `${sessionPath(workspaceId, sessionId)}/sandbox-recovery`,
+      request
+    );
+  }
+  /** Retry the exact failed turn. Keep clientEventId unchanged on transport retries. */
+  async retrySession(workspaceId, sessionId, request) {
+    return await this.requestSessionCommand(
+      "POST",
+      `${sessionPath(workspaceId, sessionId)}/retry`,
       request
     );
   }
   async controlSession(workspaceId, sessionId, request) {
-    return await this.requestJson(
+    return await this.requestSessionCommand(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/control`,
+      `${sessionPath(workspaceId, sessionId)}/control`,
       request
     );
   }
@@ -1544,6 +1979,9 @@ var OpenGeniClient = class {
       ...options.expectedControlEtag ? { expectedControlEtag: options.expectedControlEtag } : {}
     });
   }
+  async setWorkspacePauseTimer(workspaceId, request) {
+    return await this.requestJson("POST", `/v1/workspaces/${workspaceId}/pause-timer`, request);
+  }
   async setWorkspaceInferenceState(workspaceId, request) {
     return await this.requestJson(
       "POST",
@@ -1567,7 +2005,7 @@ var OpenGeniClient = class {
         headers: { ...this.headers(correlationId), Accept: "application/json" }
       }
     );
-    assertApiContractResponse(response);
+    assertApiContractResponse(response, this.apiContractStrict);
     if (!response.ok) {
       throw await apiErrorFromResponse(response, {
         method: "GET",
@@ -1622,7 +2060,7 @@ var OpenGeniClient = class {
         ...options.signal ? { signal: options.signal } : {}
       }
     );
-    assertApiContractResponse(response);
+    assertApiContractResponse(response, this.apiContractStrict);
     if (!response.ok) {
       throw await apiErrorFromResponse(response, {
         method: "GET",
@@ -1657,7 +2095,7 @@ var OpenGeniClient = class {
         ...options.signal ? { signal: options.signal } : {}
       }
     );
-    assertApiContractResponse(response);
+    assertApiContractResponse(response, this.apiContractStrict);
     if (!response.ok) {
       throw await apiErrorFromResponse(response, {
         method: "GET",
@@ -1675,40 +2113,69 @@ var OpenGeniClient = class {
    */
   async steerMessage(workspaceId, sessionId, message) {
     const input = typeof message === "string" ? { text: message } : message;
-    return await this.requestJson(
+    assertNoMessageTools(input);
+    return await this.requestSessionCommand(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/steer`,
+      `${sessionPath(workspaceId, sessionId)}/steer`,
       input
     );
   }
   // --- Goals -------------------------------------------------------------------
   /** The session's goal. 404s when the session never had one. */
-  async getGoal(workspaceId, sessionId) {
-    const path = `/v1/workspaces/${workspaceId}/sessions/${sessionId}/goal`;
-    return await this.singleFlightRead(path, () => this.requestJson("GET", path));
+  async getGoal(workspaceId, sessionId, options = {}) {
+    const path = `${sessionPath(workspaceId, sessionId)}/goal`;
+    return await this.sharedRead(
+      path,
+      (signal) => this.requestJson("GET", path, void 0, {}, { signal }),
+      options
+    );
   }
   async updateGoal(workspaceId, sessionId, request) {
     return await this.requestJson(
       "PATCH",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/goal`,
+      `${sessionPath(workspaceId, sessionId)}/goal`,
       request
     );
   }
   async listGoalRevisions(workspaceId, sessionId) {
     return await this.requestJson(
       "GET",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/goal/revisions`
+      `${sessionPath(workspaceId, sessionId)}/goal/revisions`
+    );
+  }
+  async listGoalRevisionPage(workspaceId, sessionId, options = {}) {
+    const query = new URLSearchParams();
+    if (options.limit !== void 0) query.set("limit", String(options.limit));
+    if (options.before !== void 0) query.set("before", options.before);
+    const suffix = query.size > 0 ? `?${query.toString()}` : "";
+    return await this.requestJson(
+      "GET",
+      `${sessionPath(workspaceId, sessionId)}/goal/revisions/page${suffix}`
+    );
+  }
+  async rejectGoalRevision(workspaceId, sessionId, revisionId, request) {
+    return await this.requestJson(
+      "POST",
+      `${sessionPath(workspaceId, sessionId)}/goal/revisions/${revisionId}/reject`,
+      request
+    );
+  }
+  async rollbackGoalRevision(workspaceId, sessionId, revisionId, request) {
+    return await this.requestJson(
+      "POST",
+      `${sessionPath(workspaceId, sessionId)}/goal/revisions/${revisionId}/rollback`,
+      request
     );
   }
   async applyGoalRevision(workspaceId, sessionId, revisionId, request) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/goal/revisions/${revisionId}/apply`,
+      `${sessionPath(workspaceId, sessionId)}/goal/revisions/${revisionId}/apply`,
       request
     );
   }
   async deleteGoal(workspaceId, sessionId) {
-    await this.requestVoid("DELETE", `/v1/workspaces/${workspaceId}/sessions/${sessionId}/goal`);
+    await this.requestVoid("DELETE", `${sessionPath(workspaceId, sessionId)}/goal`);
   }
   /** Pause the goal loop: the session stops self-continuing until resumed. */
   async pauseGoal(workspaceId, sessionId, options = {}) {
@@ -1730,17 +2197,15 @@ var OpenGeniClient = class {
    * context — the destructive intent is explicit on the wire.
    */
   async clearSessionContext(workspaceId, sessionId) {
-    await this.requestVoid(
-      "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/context/clear`,
-      { confirm: true }
-    );
+    await this.requestVoid("POST", `${sessionPath(workspaceId, sessionId)}/context/clear`, {
+      confirm: true
+    });
   }
   /** Request one durable portable compaction at the next safe model boundary. */
   async compactSessionContext(workspaceId, sessionId) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/context/compact`,
+      `${sessionPath(workspaceId, sessionId)}/context/compact`,
       {}
     );
   }
@@ -1752,7 +2217,7 @@ var OpenGeniClient = class {
   async fsList(workspaceId, sessionId, request = {}, options = {}) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/fs/list`,
+      `${sessionPath(workspaceId, sessionId)}/fs/list`,
       request,
       {},
       options
@@ -1762,7 +2227,7 @@ var OpenGeniClient = class {
   async fsListBatch(workspaceId, sessionId, request, options = {}) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/fs/list-batch`,
+      `${sessionPath(workspaceId, sessionId)}/fs/list-batch`,
       request,
       {},
       options
@@ -1772,7 +2237,17 @@ var OpenGeniClient = class {
   async fsRead(workspaceId, sessionId, request, options = {}) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/fs/read`,
+      request.workspaceOnly ? `${sessionPath(workspaceId, sessionId)}/fs/read-workspace` : `${sessionPath(workspaceId, sessionId)}/fs/read`,
+      request,
+      {},
+      options
+    );
+  }
+  /** Publish one exact sandbox file into permanent workspace artifact storage. */
+  async publishSandboxFileArtifact(workspaceId, sessionId, request, options = {}) {
+    return await this.requestJson(
+      "POST",
+      `${sessionPath(workspaceId, sessionId)}/artifacts/publish`,
       request,
       {},
       options
@@ -1782,7 +2257,7 @@ var OpenGeniClient = class {
   async fsWrite(workspaceId, sessionId, request) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/fs/write`,
+      `${sessionPath(workspaceId, sessionId)}/fs/write`,
       request
     );
   }
@@ -1790,7 +2265,7 @@ var OpenGeniClient = class {
   async fsDelete(workspaceId, sessionId, request) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/fs/delete`,
+      `${sessionPath(workspaceId, sessionId)}/fs/delete`,
       request
     );
   }
@@ -1798,7 +2273,7 @@ var OpenGeniClient = class {
   async fsMove(workspaceId, sessionId, request) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/fs/move`,
+      `${sessionPath(workspaceId, sessionId)}/fs/move`,
       request
     );
   }
@@ -1806,7 +2281,7 @@ var OpenGeniClient = class {
   async fsMkdir(workspaceId, sessionId, request) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/fs/mkdir`,
+      `${sessionPath(workspaceId, sessionId)}/fs/mkdir`,
       request
     );
   }
@@ -1814,7 +2289,7 @@ var OpenGeniClient = class {
   async gitStatus(workspaceId, sessionId, request = {}, options = {}) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/git/status`,
+      `${sessionPath(workspaceId, sessionId)}/git/status`,
       request,
       {},
       options
@@ -1824,7 +2299,7 @@ var OpenGeniClient = class {
   async gitDiff(workspaceId, sessionId, request = {}, options = {}) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/git/diff`,
+      `${sessionPath(workspaceId, sessionId)}/git/diff`,
       request,
       {},
       options
@@ -1834,7 +2309,7 @@ var OpenGeniClient = class {
   async gitReadBatch(workspaceId, sessionId, request, options = {}) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/git/read-batch`,
+      `${sessionPath(workspaceId, sessionId)}/git/read-batch`,
       request,
       {},
       options
@@ -1844,7 +2319,7 @@ var OpenGeniClient = class {
   async gitLog(workspaceId, sessionId, request = {}) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/git/log`,
+      `${sessionPath(workspaceId, sessionId)}/git/log`,
       request
     );
   }
@@ -1852,7 +2327,7 @@ var OpenGeniClient = class {
   async gitShow(workspaceId, sessionId, request) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/git/show`,
+      `${sessionPath(workspaceId, sessionId)}/git/show`,
       request
     );
   }
@@ -1863,7 +2338,7 @@ var OpenGeniClient = class {
   async getWorkspaceCapture(workspaceId, sessionId, options = {}) {
     return await this.requestJson(
       "GET",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/workspace/capture`,
+      `${sessionPath(workspaceId, sessionId)}/workspace/capture`,
       void 0,
       {},
       options
@@ -1877,7 +2352,7 @@ var OpenGeniClient = class {
     if (revision !== void 0) query.revision = String(revision);
     return await this.requestJson(
       "GET",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/workspace/capture/file`,
+      `${sessionPath(workspaceId, sessionId)}/workspace/capture/file`,
       void 0,
       query,
       options
@@ -1887,7 +2362,7 @@ var OpenGeniClient = class {
   async terminalExec(workspaceId, sessionId, request) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/terminal/exec`,
+      `${sessionPath(workspaceId, sessionId)}/terminal/exec`,
       request
     );
   }
@@ -1896,7 +2371,7 @@ var OpenGeniClient = class {
   async terminalPtyOpen(workspaceId, sessionId, request = {}) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/terminal/pty`,
+      `${sessionPath(workspaceId, sessionId)}/terminal/pty`,
       request
     );
   }
@@ -1904,7 +2379,7 @@ var OpenGeniClient = class {
   async terminalPtyWrite(workspaceId, sessionId, request) {
     await this.requestVoid(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/terminal/pty/write`,
+      `${sessionPath(workspaceId, sessionId)}/terminal/pty/write`,
       request
     );
   }
@@ -1912,7 +2387,7 @@ var OpenGeniClient = class {
   async terminalPtyResize(workspaceId, sessionId, request) {
     await this.requestVoid(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/terminal/pty/resize`,
+      `${sessionPath(workspaceId, sessionId)}/terminal/pty/resize`,
       request
     );
   }
@@ -1920,7 +2395,7 @@ var OpenGeniClient = class {
   async terminalPtyClose(workspaceId, sessionId, request) {
     await this.requestVoid(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/terminal/pty/close`,
+      `${sessionPath(workspaceId, sessionId)}/terminal/pty/close`,
       request
     );
   }
@@ -1938,7 +2413,7 @@ var OpenGeniClient = class {
   async getStreamCapabilities(workspaceId, sessionId, options = {}) {
     return await this.requestJson(
       "GET",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/stream-capabilities`,
+      `${sessionPath(workspaceId, sessionId)}/stream-capabilities`,
       void 0,
       {},
       options
@@ -1950,7 +2425,7 @@ var OpenGeniClient = class {
   async acknowledgeStream(workspaceId, sessionId, request = {}) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/stream-capabilities/acknowledge`,
+      `${sessionPath(workspaceId, sessionId)}/stream-capabilities/acknowledge`,
       request
     );
   }
@@ -1963,7 +2438,7 @@ var OpenGeniClient = class {
   async attachViewer(workspaceId, sessionId, request = {}) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/viewers`,
+      `${sessionPath(workspaceId, sessionId)}/viewers`,
       request
     );
   }
@@ -1973,16 +2448,13 @@ var OpenGeniClient = class {
   async heartbeatViewer(workspaceId, sessionId, viewerId, request) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/viewers/${viewerId}/heartbeat`,
+      `${sessionPath(workspaceId, sessionId)}/viewers/${viewerId}/heartbeat`,
       request
     );
   }
   /** Detach a viewer (delete this holder; idempotent delete-my-row). */
   async detachViewer(workspaceId, sessionId, viewerId) {
-    await this.requestVoid(
-      "DELETE",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/viewers/${viewerId}`
-    );
+    await this.requestVoid("DELETE", `${sessionPath(workspaceId, sessionId)}/viewers/${viewerId}`);
   }
   // --- Browser / Computer interaction resources --------------------------------
   streamWorkspaceInteractionRevisions(workspaceId, options = {}) {
@@ -2014,7 +2486,7 @@ var OpenGeniClient = class {
         ...options.signal ? { signal: options.signal } : {}
       }
     );
-    assertApiContractResponse(response);
+    assertApiContractResponse(response, this.apiContractStrict);
     if (!response.ok) {
       throw await apiErrorFromResponse(response, {
         method: "GET",
@@ -2369,6 +2841,54 @@ var OpenGeniClient = class {
       options
     );
   }
+  async captureBrowserTarget(workspaceId, browserSessionId, targetId, options = {}, captureOptions = {}) {
+    const query = new URLSearchParams();
+    if (captureOptions.fullPage !== void 0) {
+      if (typeof captureOptions.fullPage !== "boolean") {
+        throw new TypeError("browser screenshot fullPage must be a boolean");
+      }
+      query.set("fullPage", String(captureOptions.fullPage));
+    }
+    if (captureOptions.format !== void 0) {
+      if (captureOptions.format !== "jpeg" && captureOptions.format !== "png") {
+        throw new TypeError("browser screenshot format must be jpeg or png");
+      }
+      query.set("format", captureOptions.format);
+    }
+    if (captureOptions.quality !== void 0) {
+      if (!Number.isSafeInteger(captureOptions.quality) || captureOptions.quality < 1 || captureOptions.quality > 100) {
+        throw new RangeError("browser screenshot quality must be an integer from 1 to 100");
+      }
+      query.set("quality", String(captureOptions.quality));
+    }
+    const suffix = query.size > 0 ? `?${query}` : "";
+    const response = await this.requestResponse(
+      "GET",
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/targets/${encodeURIComponent(targetId)}/screenshot${suffix}`,
+      {},
+      options
+    );
+    const mediaType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+    const header = response.headers.get("x-opengeni-browser-frame");
+    if (mediaType !== "image/jpeg" && mediaType !== "image/png" || !header || header.length > 64 * 1024) {
+      await cancelResponseBody(response, "browser frame metadata is invalid");
+      throw new OpenGeniApiError(502, "browser frame metadata is invalid");
+    }
+    let metadata;
+    try {
+      metadata = parseBrowserFrameMetadata(
+        JSON.parse(atob(header.replace(/-/gu, "+").replace(/_/gu, "/")))
+      );
+    } catch {
+      await cancelResponseBody(response, "browser frame metadata is invalid");
+      throw new OpenGeniApiError(502, "browser frame metadata is invalid");
+    }
+    const data = await readBoundedResponseBytes(response, 24 * 1024 * 1024, null);
+    if (metadata.browserSessionId !== browserSessionId || metadata.targetId !== targetId || metadata.mediaType !== mediaType) {
+      throw new OpenGeniApiError(502, "browser frame evidence does not match its request");
+    }
+    return { ...metadata, data };
+  }
   async closeBrowserTarget(workspaceId, browserSessionId, targetId, options = {}) {
     return await this.requestJson(
       "DELETE",
@@ -2387,6 +2907,32 @@ var OpenGeniClient = class {
       options
     );
   }
+  async getBrowserTargetState(workspaceId, browserSessionId, targetId, options = {}) {
+    const state = await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/targets/${encodeURIComponent(targetId)}/state`,
+      void 0,
+      {},
+      options
+    );
+    if (state.browserSessionId !== browserSessionId || state.targetId !== targetId) {
+      throw new OpenGeniApiError(502, "browser target state belongs to another binding");
+    }
+    return state;
+  }
+  async readBrowserDom(workspaceId, browserSessionId, targetId, request, options = {}) {
+    const result = await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/browser-sessions/${encodeURIComponent(browserSessionId)}/targets/${encodeURIComponent(targetId)}/dom-read`,
+      request,
+      {},
+      options
+    );
+    if (result.browserSessionId !== browserSessionId || result.targetId !== targetId || result.kind !== request.kind || result.targetGeneration !== request.expectedTargetGeneration || result.documentGeneration !== request.expectedDocumentGeneration || result.frameId !== request.expectedFrameId) {
+      throw new OpenGeniApiError(502, "browser DOM read belongs to another binding");
+    }
+    return result;
+  }
   async actInBrowser(workspaceId, browserSessionId, request, options = {}) {
     return await this.requestJson(
       "POST",
@@ -2501,6 +3047,15 @@ var OpenGeniClient = class {
       options
     );
   }
+  async getComputerInputPosture(workspaceId, computerSessionId, options = {}) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/computer-sessions/${encodeURIComponent(computerSessionId)}/input-posture`,
+      void 0,
+      {},
+      options
+    );
+  }
   async createComputerSession(workspaceId, request, options = {}) {
     return await this.requestJson(
       "POST",
@@ -2528,6 +3083,42 @@ var OpenGeniClient = class {
       options
     );
   }
+  async captureComputerTarget(workspaceId, computerSessionId, targetId, options = {}) {
+    const response = await this.requestResponse(
+      "GET",
+      `/v1/workspaces/${workspaceId}/computer-sessions/${encodeURIComponent(computerSessionId)}/targets/${encodeURIComponent(targetId)}/screenshot`,
+      {},
+      options
+    );
+    const mediaType = response.headers.get("content-type")?.split(";", 1)[0]?.trim().toLowerCase();
+    if (mediaType !== "image/jpeg" && mediaType !== "image/png") {
+      await cancelResponseBody(response, "computer frame media type is invalid");
+      throw new OpenGeniApiError(502, "computer frame media type is invalid");
+    }
+    const metadataHeader = response.headers.get("x-opengeni-computer-frame");
+    if (!metadataHeader || metadataHeader.length > 32 * 1024) {
+      await cancelResponseBody(response, "computer frame metadata is invalid");
+      throw new OpenGeniApiError(502, "computer frame metadata is invalid");
+    }
+    let metadata;
+    try {
+      metadata = decodeComputerFrameMetadataHeader(metadataHeader);
+    } catch {
+      await cancelResponseBody(response, "computer frame metadata is invalid");
+      throw new OpenGeniApiError(502, "computer frame metadata is invalid");
+    }
+    const bytes = await readBoundedResponseBytes(response, 256 * 1024, null);
+    const mismatchReason = computerFrameEvidenceMismatchReason(metadata, {
+      computerSessionId,
+      targetId,
+      mediaType,
+      sha256: await sha256Hex(bytes)
+    });
+    if (mismatchReason) {
+      throw new OpenGeniApiError(502, "computer frame evidence does not match its request");
+    }
+    return { ...metadata, data: bytes };
+  }
   async actInComputer(workspaceId, computerSessionId, request, options = {}) {
     return await this.requestJson(
       "POST",
@@ -2547,13 +3138,20 @@ var OpenGeniClient = class {
     );
   }
   async attachComputerSession(workspaceId, computerSessionId, request, options = {}) {
-    return await this.requestJson(
+    const attachment = await this.requestJson(
       "POST",
       `/v1/workspaces/${workspaceId}/computer-sessions/${encodeURIComponent(computerSessionId)}/attachments`,
       request,
       {},
       options
     );
+    if (attachment.stream.kind === "direct_rfb") {
+      return {
+        ...attachment,
+        stream: { ...attachment.stream, inputAllowed: attachment.stream.inputAllowed === true }
+      };
+    }
+    return attachment;
   }
   async heartbeatComputerSession(workspaceId, computerSessionId, options = {}) {
     return await this.requestJson(
@@ -2580,10 +3178,18 @@ var OpenGeniClient = class {
    * reasoning efforts, MCP servers, file-upload limits, and how the client is
    * expected to authenticate. Drives a composer's model picker without prior
    * knowledge of the host setup; safe to call before any auth is established.
+   * Authenticated calls resolve the caller's default workspace, or the exact
+   * `workspaceId` option, using the same selection rules as fresh session create.
    */
-  async getClientConfig() {
-    const config = await this.requestJson("GET", "/v1/config/client");
-    if (config.apiContractRevision !== OPENGENI_API_CONTRACT_REVISION) {
+  async getClientConfig(options = {}) {
+    const config = await this.requestJson(
+      "GET",
+      "/v1/config/client",
+      void 0,
+      options.workspaceId === void 0 ? {} : { workspaceId: options.workspaceId },
+      options
+    );
+    if (this.apiContractStrict && config.apiContractRevision !== OPENGENI_API_CONTRACT_REVISION) {
       throw new OpenGeniApiContractMismatchError(
         OPENGENI_API_CONTRACT_REVISION,
         String(config.apiContractRevision || "(missing)")
@@ -2592,36 +3198,712 @@ var OpenGeniClient = class {
     return config;
   }
   /** Authenticated model definitions plus workspace-specific selectability. */
-  async getWorkspaceModelCatalog(workspaceId) {
+  async getWorkspaceModelCatalog(workspaceId, options = {}) {
     return await this.requestJson(
       "GET",
-      `/v1/workspaces/${workspaceId}/model-catalog`
+      `/v1/workspaces/${workspaceId}/model-catalog`,
+      void 0,
+      {},
+      options
     );
   }
-  /** Authenticated realtime voice models and credential readiness. */
-  async getWorkspaceRealtimeModelCatalog(workspaceId) {
+  /** List workspace-owned unpinned Vercel AI Gateway model slugs. */
+  async listWorkspaceGatewayCustomModels(workspaceId) {
     return await this.requestJson(
       "GET",
-      `/v1/workspaces/${workspaceId}/realtime-model-catalog`
+      `/v1/workspaces/${workspaceId}/gateway-custom-models`
     );
   }
-  /** The caller's access context: subject, account + workspace grants, defaults. */
-  async getAccessContext() {
-    return await this.requestJson("GET", "/v1/access/me");
+  /** Add one exact upstream Vercel AI Gateway slug. */
+  async createWorkspaceGatewayCustomModel(workspaceId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/gateway-custom-models`,
+      request
+    );
   }
-  /** Active organization memberships proven by the current managed-human session. */
-  async listOrganizationMemberships() {
+  /** Remove one workspace custom Gateway model by its stable row id. */
+  async deleteWorkspaceGatewayCustomModel(workspaceId, customModelId, request) {
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(
+      customModelId
+    )) {
+      throw new TypeError("customModelId must be a UUID");
+    }
+    await this.requestVoid(
+      "DELETE",
+      `/v1/workspaces/${workspaceId}/gateway-custom-models/${encodeURIComponent(customModelId)}`,
+      request
+    );
+  }
+  /** List workspace-owned unpinned OpenRouter model slugs. */
+  async listWorkspaceOpenRouterCustomModels(workspaceId) {
     return await this.requestJson(
       "GET",
-      "/v1/organization-memberships"
+      `/v1/workspaces/${workspaceId}/openrouter-custom-models`
     );
   }
-  async listWorkspaces() {
-    return await this.requestJson("GET", "/v1/workspaces");
+  /** Add one exact upstream OpenRouter slug. */
+  async createWorkspaceOpenRouterCustomModel(workspaceId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/openrouter-custom-models`,
+      request
+    );
+  }
+  /** Remove one workspace custom OpenRouter model by its stable row id. */
+  async deleteWorkspaceOpenRouterCustomModel(workspaceId, customModelId, request) {
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(
+      customModelId
+    )) {
+      throw new TypeError("customModelId must be a UUID");
+    }
+    await this.requestVoid(
+      "DELETE",
+      `/v1/workspaces/${workspaceId}/openrouter-custom-models/${encodeURIComponent(customModelId)}`,
+      request
+    );
+  }
+  /** Read metadata for one organization-owned model-provider connection. */
+  async getWorkspaceClaudeSubscriptionUsage(workspaceId) {
+    return this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/model-providers/claude_subscription/usage`
+    );
+  }
+  async listClaudeSubscriptionAccounts(workspaceId) {
+    return this.requestJson("GET", `/v1/workspaces/${workspaceId}/claude/accounts`);
+  }
+  async activateClaudeSubscriptionAccount(workspaceId, accountId) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/claude/accounts/${encodeURIComponent(accountId)}/activate`,
+      {}
+    );
+  }
+  async setClaudeSubscriptionRotationSettings(workspaceId, request) {
+    return this.requestJson("PATCH", `/v1/workspaces/${workspaceId}/claude/settings`, request);
+  }
+  async setClaudeSubscriptionAccountAllocator(workspaceId, accountId, request) {
+    return this.requestJson(
+      "PATCH",
+      `/v1/workspaces/${workspaceId}/claude/accounts/${encodeURIComponent(accountId)}/allocator`,
+      request
+    );
+  }
+  async renameClaudeSubscriptionAccount(workspaceId, accountId, label) {
+    return this.requestJson(
+      "PATCH",
+      `/v1/workspaces/${workspaceId}/claude/accounts/${encodeURIComponent(accountId)}`,
+      { label }
+    );
+  }
+  async disconnectClaudeSubscriptionAccount(workspaceId, accountId) {
+    return this.requestJson(
+      "DELETE",
+      `/v1/workspaces/${workspaceId}/claude/accounts/${encodeURIComponent(accountId)}`,
+      {}
+    );
+  }
+  async getClaudeSubscriptionAccountUsage(workspaceId, accountId) {
+    return this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/claude/accounts/${encodeURIComponent(accountId)}/usage`
+    );
+  }
+  async refreshClaudeSubscriptionAccountUsage(workspaceId, accountId) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/claude/accounts/${encodeURIComponent(accountId)}/usage/refresh`,
+      {}
+    );
+  }
+  async listOrganizationClaudeSubscriptionAccounts(organizationId) {
+    return this.requestJson("GET", `/v1/organizations/${organizationId}/claude/accounts`);
+  }
+  async activateOrganizationClaudeSubscriptionAccount(organizationId, accountId) {
+    return this.requestJson(
+      "POST",
+      `/v1/organizations/${organizationId}/claude/accounts/${encodeURIComponent(accountId)}/activate`,
+      {}
+    );
+  }
+  async setOrganizationClaudeSubscriptionRotationSettings(organizationId, request) {
+    return this.requestJson(
+      "PATCH",
+      `/v1/organizations/${organizationId}/claude/settings`,
+      request
+    );
+  }
+  async setOrganizationClaudeSubscriptionAccountAllocator(organizationId, accountId, request) {
+    return this.requestJson(
+      "PATCH",
+      `/v1/organizations/${organizationId}/claude/accounts/${encodeURIComponent(accountId)}/allocator`,
+      request
+    );
+  }
+  async renameOrganizationClaudeSubscriptionAccount(organizationId, accountId, label) {
+    return this.requestJson(
+      "PATCH",
+      `/v1/organizations/${organizationId}/claude/accounts/${encodeURIComponent(accountId)}`,
+      { label }
+    );
+  }
+  async disconnectOrganizationClaudeSubscriptionAccount(organizationId, accountId) {
+    return this.requestJson(
+      "DELETE",
+      `/v1/organizations/${organizationId}/claude/accounts/${encodeURIComponent(accountId)}`,
+      {}
+    );
+  }
+  async getOrganizationClaudeSubscriptionAccountUsage(organizationId, accountId) {
+    return this.requestJson(
+      "GET",
+      `/v1/organizations/${organizationId}/claude/accounts/${encodeURIComponent(accountId)}/usage`
+    );
+  }
+  async refreshOrganizationClaudeSubscriptionAccountUsage(organizationId, accountId) {
+    return this.requestJson(
+      "POST",
+      `/v1/organizations/${organizationId}/claude/accounts/${encodeURIComponent(accountId)}/usage/refresh`,
+      {}
+    );
+  }
+  async connectClaudeSubscriptionSetupToken(workspaceId, request) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/claude/accounts/setup-token`,
+      request
+    );
+  }
+  async connectOrganizationClaudeSubscriptionSetupToken(organizationId, request) {
+    return this.requestJson(
+      "POST",
+      `/v1/organizations/${organizationId}/claude/accounts/setup-token`,
+      request
+    );
+  }
+  /** Sign in with model and profile access; no inference request is made. */
+  async startWorkspaceClaudeSubscriptionOAuth(workspaceId, request = {}) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/model-providers/claude_subscription/oauth/start`,
+      request
+    );
+  }
+  async completeWorkspaceClaudeSubscriptionOAuth(workspaceId, request) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/model-providers/claude_subscription/oauth/complete`,
+      request
+    );
+  }
+  async startOrganizationClaudeSubscriptionOAuth(organizationId, request = {}) {
+    return this.requestJson(
+      "POST",
+      `/v1/organizations/${organizationId}/model-providers/claude_subscription/oauth/start`,
+      request
+    );
+  }
+  async completeOrganizationClaudeSubscriptionOAuth(organizationId, request) {
+    return this.requestJson(
+      "POST",
+      `/v1/organizations/${organizationId}/model-providers/claude_subscription/oauth/complete`,
+      request
+    );
+  }
+  async refreshWorkspaceClaudeSubscriptionUsage(workspaceId) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/model-providers/claude_subscription/usage/refresh`,
+      {}
+    );
+  }
+  async getOrganizationClaudeSubscriptionUsage(organizationId) {
+    return this.requestJson(
+      "GET",
+      `/v1/organizations/${organizationId}/model-providers/claude_subscription/usage`
+    );
+  }
+  async refreshOrganizationClaudeSubscriptionUsage(organizationId) {
+    return this.requestJson(
+      "POST",
+      `/v1/organizations/${organizationId}/model-providers/claude_subscription/usage/refresh`,
+      {}
+    );
+  }
+  /** Read metadata for one organization-owned model-provider connection. */
+  async getOrganizationModelProviderConnection(organizationId, providerKind) {
+    return await this.requestJson(
+      "GET",
+      `/v1/organizations/${organizationId}/model-providers/${providerKind}`
+    );
+  }
+  /** Connect or rotate one organization-owned provider credential. */
+  async upsertOrganizationModelProviderConnection(organizationId, providerKind, request) {
+    return await this.requestJson(
+      "PUT",
+      `/v1/organizations/${organizationId}/model-providers/${providerKind}`,
+      request
+    );
+  }
+  /** Revoke one organization-owned provider credential. */
+  async revokeOrganizationModelProviderConnection(organizationId, providerKind, request) {
+    return await this.requestJson(
+      "DELETE",
+      `/v1/organizations/${organizationId}/model-providers/${providerKind}`,
+      request
+    );
+  }
+  /** List workspace-owned Claude model slugs. */
+  async listWorkspaceClaudeCustomModels(workspaceId, providerKind) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/model-providers/${providerKind}/custom-models`
+    );
+  }
+  /** Add an immutable workspace-owned Claude model generation. */
+  async createWorkspaceClaudeCustomModel(workspaceId, providerKind, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/model-providers/${providerKind}/custom-models`,
+      request
+    );
+  }
+  /** Retire a workspace-owned Claude model generation. */
+  async deleteWorkspaceClaudeCustomModel(workspaceId, providerKind, customModelId, request) {
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(
+      customModelId
+    ))
+      throw new TypeError("customModelId must be a UUID");
+    await this.requestVoid(
+      "DELETE",
+      `/v1/workspaces/${workspaceId}/model-providers/${providerKind}/custom-models/${encodeURIComponent(customModelId)}`,
+      request
+    );
+  }
+  /** List organization-owned exact upstream model slugs. */
+  async listOrganizationProviderCustomModels(organizationId, providerKind) {
+    return await this.requestJson(
+      "GET",
+      `/v1/organizations/${organizationId}/model-providers/${providerKind}/custom-models`
+    );
+  }
+  /** Add one organization-owned exact upstream model slug. */
+  async createOrganizationProviderCustomModel(organizationId, providerKind, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/organizations/${organizationId}/model-providers/${providerKind}/custom-models`,
+      request
+    );
+  }
+  /** Retire one organization-owned custom model. */
+  async deleteOrganizationProviderCustomModel(organizationId, providerKind, customModelId, request) {
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/iu.test(
+      customModelId
+    )) {
+      throw new TypeError("customModelId must be a UUID");
+    }
+    return await this.requestJson(
+      "DELETE",
+      `/v1/organizations/${organizationId}/model-providers/${providerKind}/custom-models/${encodeURIComponent(customModelId)}`,
+      request
+    );
+  }
+  /** Read the workspace's hard provider/model allowlist. */
+  async getWorkspaceModelAccessPolicy(workspaceId) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/model-policy`
+    );
+  }
+  /** Fully replace the workspace's hard provider/model allowlist. */
+  async updateWorkspaceModelAccessPolicy(workspaceId, request) {
+    return await this.requestJson(
+      "PUT",
+      `/v1/workspaces/${workspaceId}/model-policy`,
+      request
+    );
+  }
+  /** Authenticated realtime voice models and credential readiness. */
+  async getWorkspaceRealtimeModelCatalog(workspaceId, options = {}) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/realtime-model-catalog`,
+      void 0,
+      {},
+      options
+    );
+  }
+  /**
+   * The caller's subject, grants, defaults, and optional direct API-key authority.
+   * `credential.effectiveWorkspacePermissions` expands workspace admin only for
+   * legacy keys; explicit policies retain exactly their selected grants. Full
+   * organization keys can provision shared workspaces, external members, and
+   * `asUser` sessions; user requests additionally need live membership.
+   * Organization-key scope excludes Personal workspaces. Neither key kind bypasses
+   * session visibility or the explicit `secrets:read` permission requirement. Credential
+   * metadata is omitted for `asUser`/external actors, humans, delegated tokens,
+   * other caller contexts, and older servers.
+   */
+  async getAccessContext() {
+    return await this.requestJson("GET", "/v1/access/me");
+  }
+  /** Active organization memberships proven by the current managed-human session. */
+  async listOrganizationMemberships() {
+    return await this.requestJson(
+      "GET",
+      "/v1/organization-memberships"
+    );
+  }
+  /** Bounded owner-only personal-resource authority page for one exact resource kind. */
+  async listUserResourceAuthorities(workspaceId, options) {
+    const query = new URLSearchParams({
+      scope: "user",
+      resourceKind: options.resourceKind
+    });
+    if (options.cursor) query.set("cursor", options.cursor);
+    if (options.limit !== void 0) query.set("limit", String(options.limit));
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/user-resource-authorities?${query.toString()}`
+    );
+  }
+  /** Revoke an owner grant through the exact workspace it targets. */
+  async revokeUserResourceGrant(workspaceId, grantId) {
+    return await this.requestJson(
+      "DELETE",
+      `/v1/workspaces/${workspaceId}/user-resource-authorities/grants/${grantId}?scope=user`
+    );
+  }
+  /** Create a new organization owned by the current managed human. */
+  async createOrganization(request) {
+    return await this.requestJson("POST", "/v1/organizations", request);
+  }
+  /** Create another organization owned by the current managed human. */
+  async createAdditionalOrganization(request) {
+    return await this.requestJson(
+      "POST",
+      "/v1/organizations/additional",
+      request
+    );
+  }
+  /** Pending and historical invitations addressed to the current managed human. */
+  async listOrganizationInvitations(options = {}) {
+    const query = new URLSearchParams();
+    if (options.cursor) query.set("cursor", options.cursor);
+    if (options.limit !== void 0) query.set("limit", String(options.limit));
+    const suffix = query.size > 0 ? `?${query.toString()}` : "";
+    return await this.requestJson(
+      "GET",
+      `/v1/organization-invitations${suffix}`
+    );
+  }
+  /** Admin-only deterministic page of invitations for one organization. */
+  async listOrganizationInvitationsForOrganization(organizationId, options = {}) {
+    const query = new URLSearchParams();
+    if (options.cursor) query.set("cursor", options.cursor);
+    if (options.limit !== void 0) query.set("limit", String(options.limit));
+    const suffix = query.size > 0 ? `?${query.toString()}` : "";
+    return await this.requestJson(
+      "GET",
+      `/v1/organizations/${organizationId}/invitations${suffix}`
+    );
+  }
+  async createOrganizationInvitation(organizationId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/organizations/${organizationId}/invitations`,
+      request
+    );
+  }
+  async acceptOrganizationInvitation(invitationId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/organization-invitations/${invitationId}/accept`,
+      request
+    );
+  }
+  async revokeOrganizationInvitation(organizationId, invitationId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/organizations/${organizationId}/invitations/${invitationId}/revoke`,
+      request
+    );
+  }
+  async listOrganizationAdministrationMembers(organizationId) {
+    return await this.requestJson(
+      "GET",
+      `/v1/organizations/${organizationId}/members`
+    );
+  }
+  /** @deprecated Use listOrganizationAdministrationMembers for its privacy-safe projection. */
+  async listOrganizationMembers(organizationId) {
+    return await this.listOrganizationAdministrationMembers(organizationId);
+  }
+  /** Canonical organization identity and every non-personal workspace access roster. */
+  async getOrganizationAdministrationOverview(organizationId) {
+    return await this.requestJson(
+      "GET",
+      `/v1/organizations/${organizationId}/overview`
+    );
+  }
+  /** Create a shared workspace and grant its creator explicit workspace-admin access. */
+  async createOrganizationWorkspace(organizationId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/organizations/${organizationId}/workspaces`,
+      request
+    );
+  }
+  /** Rename one shared workspace under an exact optimistic-concurrency fence. */
+  async updateOrganizationWorkspace(organizationId, workspaceId, request) {
+    return await this.requestJson(
+      "PATCH",
+      `/v1/organizations/${organizationId}/workspaces/${workspaceId}`,
+      request
+    );
+  }
+  async updateOrganizationWorkspaceSettings(organizationId, workspaceId, request) {
+    return await this.requestJson(
+      "PATCH",
+      `/v1/organizations/${organizationId}/workspaces/${workspaceId}/settings`,
+      request
+    );
+  }
+  /**
+   * Delete an organization (shared) workspace. Accepts an organization owner
+   * session or an organization API key with `workspace:admin` (for tenant
+   * offboarding); never deletes a Personal workspace. 409 until quiescent.
+   */
+  async deleteOrganizationWorkspace(organizationId, workspaceId) {
+    await this.requestVoid(
+      "DELETE",
+      `/v1/organizations/${organizationId}/workspaces/${workspaceId}`
+    );
+  }
+  async putOrganizationWorkspaceMember(organizationId, workspaceId, membershipId, request) {
+    return await this.requestJson(
+      "PUT",
+      `/v1/organizations/${organizationId}/workspaces/${workspaceId}/members/${membershipId}`,
+      request
+    );
+  }
+  async revokeOrganizationWorkspaceMember(organizationId, workspaceId, membershipId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/organizations/${organizationId}/workspaces/${workspaceId}/members/${membershipId}/revoke`,
+      request
+    );
+  }
+  /** Rename the organization under an exact optimistic-concurrency fence. */
+  async updateOrganizationName(organizationId, request) {
+    return await this.requestJson(
+      "PATCH",
+      `/v1/organizations/${organizationId}`,
+      request
+    );
+  }
+  async updateOrganizationMember(organizationId, membershipId, request) {
+    return await this.requestJson(
+      "PATCH",
+      `/v1/organizations/${organizationId}/members/${membershipId}`,
+      request
+    );
+  }
+  async getOrganizationRetentionPolicy(organizationId) {
+    return await this.requestJson(
+      "GET",
+      `/v1/organizations/${organizationId}/retention-policy`
+    );
+  }
+  async updateOrganizationRetentionPolicy(organizationId, request) {
+    return await this.requestJson(
+      "PATCH",
+      `/v1/organizations/${organizationId}/retention-policy`,
+      request
+    );
+  }
+  async getOrganizationRecovery(organizationId) {
+    return await this.requestJson(
+      "GET",
+      `/v1/organizations/${organizationId}/recovery`
+    );
+  }
+  async configureOrganizationRecoveryPolicy(organizationId, request) {
+    return await this.requestJson(
+      "PUT",
+      `/v1/organizations/${organizationId}/recovery/policy`,
+      request
+    );
+  }
+  async acceptOrganizationRecoveryCustody(organizationId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/organizations/${organizationId}/recovery/policy/accept`,
+      request
+    );
+  }
+  async disableOrganizationRecoveryPolicy(organizationId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/organizations/${organizationId}/recovery/policy/disable`,
+      request
+    );
+  }
+  async startOrganizationRecoveryOperation(organizationId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/organizations/${organizationId}/recovery/operations`,
+      request
+    );
+  }
+  async approveOrganizationRecoveryOperation(organizationId, recoveryOperationId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/organizations/${organizationId}/recovery/operations/${recoveryOperationId}/approve`,
+      request
+    );
+  }
+  async cancelOrganizationRecoveryOperation(organizationId, recoveryOperationId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/organizations/${organizationId}/recovery/operations/${recoveryOperationId}/cancel`,
+      request
+    );
+  }
+  async executeOrganizationRecoveryOperation(organizationId, recoveryOperationId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/organizations/${organizationId}/recovery/operations/${recoveryOperationId}/execute`,
+      request
+    );
+  }
+  async searchPublicSkills(workspaceId, query) {
+    return this.requestJson(
+      "GET",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/skills/search?q=${encodeURIComponent(query)}`
+    );
+  }
+  async listWorkspaces() {
+    return await this.requestJson("GET", "/v1/workspaces");
+  }
+  /** Uses this client's fixed actor and standard contract/error/abort handling.
+   * Disconnect revokes OpenGeni connection access, not upstream provider consent. */
+  connectTransport() {
+    const root = (workspaceId) => `/v1/workspaces/${encodeURIComponent(workspaceId)}/connect`;
+    return {
+      catalog: (workspaceId, options) => this.requestJson("GET", `${root(workspaceId)}/catalog`, void 0, void 0, options),
+      accounts: (workspaceId, options) => this.requestJson("GET", `${root(workspaceId)}/accounts`, void 0, void 0, options),
+      pending: (workspaceId, options) => this.requestJson("GET", `${root(workspaceId)}/attempts`, void 0, void 0, options),
+      begin: (workspaceId, input, options) => this.requestJson("POST", `${root(workspaceId)}/attempts`, input, void 0, options),
+      get: (workspaceId, id, options) => this.requestJson(
+        "GET",
+        `${root(workspaceId)}/attempts/${encodeURIComponent(id)}`,
+        void 0,
+        void 0,
+        options
+      ),
+      advance: (workspaceId, id, input, options) => this.requestJson(
+        "POST",
+        `${root(workspaceId)}/attempts/${encodeURIComponent(id)}/advance`,
+        input,
+        void 0,
+        options
+      ),
+      cancel: (workspaceId, id, input, options) => this.requestJson(
+        "POST",
+        `${root(workspaceId)}/attempts/${encodeURIComponent(id)}/cancel`,
+        input,
+        void 0,
+        options
+      ),
+      disconnect: async (workspaceId, id, options) => {
+        if (id.startsWith("social:")) {
+          const connectionId = id.slice("social:".length);
+          if (!/^[0-9a-f-]{36}$/i.test(connectionId)) throw new Error("Invalid social account ID");
+          await this.disconnectSocialConnection(workspaceId, connectionId);
+          return;
+        }
+        if (id.startsWith("lens-registration:")) {
+          const registrationId = id.slice("lens-registration:".length);
+          if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(registrationId))
+            throw new Error("Invalid Lens registration ID");
+          await this.requestJson(
+            "DELETE",
+            `/v1/workspaces/${encodeURIComponent(workspaceId)}/pr-review/registrations/${registrationId}`,
+            void 0,
+            void 0,
+            options
+          );
+          return;
+        }
+        if (id.startsWith("github-installation:")) {
+          const installationId = id.slice("github-installation:".length);
+          if (!/^[1-9][0-9]*$/.test(installationId) || !Number.isSafeInteger(Number(installationId)))
+            throw new Error("Invalid GitHub installation ID");
+          await this.requestJson(
+            "DELETE",
+            `/v1/workspaces/${encodeURIComponent(workspaceId)}/github/installations/${installationId}`,
+            void 0,
+            void 0,
+            options
+          );
+          return;
+        }
+        const expectedVersion = options?.expectedVersion;
+        if (expectedVersion !== void 0 && (!Number.isSafeInteger(expectedVersion) || expectedVersion < 1)) {
+          throw new Error("invalid expected connection version");
+        }
+        const query = expectedVersion === void 0 ? "" : `?expectedVersion=${expectedVersion}`;
+        await this.requestJson(
+          "DELETE",
+          `/v1/workspaces/${encodeURIComponent(workspaceId)}/connections/${encodeURIComponent(id)}${query}`,
+          void 0,
+          void 0,
+          options
+        );
+      }
+    };
+  }
+  /** Browse first-party Atlassian sources without choosing or starting sync. */
+  async browseAtlassianSources(workspaceId, connectionId) {
+    return this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/connections/atlassian/${connectionId}/browse`
+    );
+  }
+  async saveAtlassianSources(workspaceId, connectionId, request) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/connections/atlassian/${connectionId}/source`,
+      request
+    );
+  }
+  async setAtlassianLifecycle(workspaceId, connectionId, request) {
+    return this.requestJson(
+      "PATCH",
+      `/v1/workspaces/${workspaceId}/connections/atlassian/${connectionId}/lifecycle`,
+      request
+    );
+  }
+  /** Begin durable setup. Completion requirements are provider-specific. */
+  async beginConnect(workspaceId, request) {
+    return this.requestJson("POST", `/v1/workspaces/${workspaceId}/connect/attempts`, request);
   }
   async createWorkspace(request) {
     return await this.requestJson("POST", "/v1/workspaces", request);
   }
+  /**
+   * Create an organization workspace once for a stable external tenant
+   * identity, or return the existing workspace without overwriting it.
+   */
+  async ensureWorkspace(request) {
+    return await this.requestJson(
+      "PUT",
+      "/v1/workspaces/external",
+      request
+    );
+  }
   async getWorkspace(workspaceId) {
     return await this.requestJson("GET", `/v1/workspaces/${workspaceId}`);
   }
@@ -2660,8 +3942,25 @@ var OpenGeniClient = class {
     if (options.limit !== void 0) params.set("limit", String(options.limit));
     const query = params.toString();
     return await this.requestJson(
-      "GET",
-      `/v1/workspaces/${workspaceId}/instruction-policies${query ? `?${query}` : ""}`
+      "GET",
+      `/v1/workspaces/${workspaceId}/instruction-policies${query ? `?${query}` : ""}`
+    );
+  }
+  /** Inspect the bounded, permission-filtered governed-learning timeline. */
+  async getWorkspaceLearningHistory(workspaceId, options = {}) {
+    const params = new URLSearchParams();
+    if (options.limit !== void 0) params.set("limit", String(options.limit));
+    const query = params.toString();
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/learning${query ? `?${query}` : ""}`
+    );
+  }
+  async undoGovernedLearningActivation(workspaceId, activationReceiptId, request = {}) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/learning/activations/${encodeURIComponent(activationReceiptId)}/undo`,
+      request
     );
   }
   async getWorkspaceInstructionPolicyRevision(workspaceId, revisionId) {
@@ -2670,11 +3969,12 @@ var OpenGeniClient = class {
       `/v1/workspaces/${workspaceId}/instruction-policies/${encodeURIComponent(revisionId)}`
     );
   }
-  async createWorkspaceInstructionPolicyDraft(workspaceId, request) {
-    return await this.requestJson(
+  async createWorkspaceInstructionPolicyDraft(workspaceId, request, options = {}) {
+    return await this.requestSessionCommand(
       "POST",
       `/v1/workspaces/${workspaceId}/instruction-policies/drafts`,
-      request
+      request,
+      options
     );
   }
   /** List the newest immutable onboarding proposals and their inactive policy drafts. */
@@ -2713,11 +4013,12 @@ var OpenGeniClient = class {
       `/v1/workspaces/${workspaceId}/instruction-policies/diff?${params}`
     );
   }
-  async activateWorkspaceInstructionPolicyRevision(workspaceId, revisionId, request) {
-    return await this.requestJson(
+  async activateWorkspaceInstructionPolicyRevision(workspaceId, revisionId, request, options = {}) {
+    return await this.requestSessionCommand(
       "POST",
       `/v1/workspaces/${workspaceId}/instruction-policies/${encodeURIComponent(revisionId)}/activate`,
-      request
+      request,
+      options
     );
   }
   async rollbackWorkspaceInstructionPolicyRevision(workspaceId, request) {
@@ -2745,6 +4046,19 @@ var OpenGeniClient = class {
       `/v1/workspaces/${workspaceId}/company-profile/revisions/${encodeURIComponent(revisionId)}`
     );
   }
+  async getCompanyProfileAgentPolicy(workspaceId) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/company-profile/agent-policy`
+    );
+  }
+  async updateCompanyProfileAgentPolicy(workspaceId, request) {
+    return await this.requestJson(
+      "PATCH",
+      `/v1/workspaces/${workspaceId}/company-profile/agent-policy`,
+      request
+    );
+  }
   async updateCompanyProfile(workspaceId, request) {
     return await this.requestJson(
       "PUT",
@@ -2868,9 +4182,16 @@ var OpenGeniClient = class {
     );
     return response.members;
   }
+  /** Active organization members who can be added to this workspace. */
+  async listWorkspaceMemberCandidates(workspaceId) {
+    const response = await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/member-candidates`
+    );
+    return response.members;
+  }
   /**
-   * Add an already-registered user by email. 404s when no user with that email
-   * exists (email invites for unknown users are deferred).
+   * Add one active member selected from the workspace candidate inventory.
    */
   async addWorkspaceMember(workspaceId, request) {
     return await this.requestJson(
@@ -2950,14 +4271,14 @@ var OpenGeniClient = class {
     return await this.requestJson(
       "POST",
       `/v1/workspaces/${workspaceId}/scheduled-tasks`,
-      request
+      normalizeScheduledTaskMachineTarget(request)
     );
   }
   async updateScheduledTask(workspaceId, taskId, request) {
     return await this.requestJson(
       "PATCH",
       `/v1/workspaces/${workspaceId}/scheduled-tasks/${taskId}`,
-      request
+      normalizeScheduledTaskMachineTarget(request)
     );
   }
   async pauseScheduledTask(workspaceId, taskId) {
@@ -3000,6 +4321,23 @@ var OpenGeniClient = class {
       }
     );
   }
+  /**
+   * Re-freeze a task's connectors, connector accounts and OpenGeni tool policy
+   * with the signed-in caller's current authority. Pass the `executionDigest`
+   * of the task whose `policyDrift` was reviewed; a changed task returns 409.
+   */
+  async refreshScheduledTaskAccess(workspaceId, taskId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/scheduled-tasks/${taskId}/refresh-access`,
+      request
+    );
+  }
+  /** Schedules the caller can act on whose latest run could not use a connector. */
+  async listScheduledTaskAccessAttention(workspaceId) {
+    const response = await this.requestJson("GET", `/v1/workspaces/${workspaceId}/scheduled-tasks/attention`);
+    return response.tasks;
+  }
   // --- VariableSets --------------------------------------------------------------
   // Generic reads return name/version metadata only. Plaintext uses one
   // dedicated permissioned endpoint.
@@ -3009,6 +4347,14 @@ var OpenGeniClient = class {
       `/v1/workspaces/${workspaceId}/variable-sets`
     );
   }
+  /** Resolve only caller-supplied attachment ids without enumerating the catalog. */
+  async resolveVariableSetAttachments(workspaceId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/variable-sets/resolve-attachments`,
+      request
+    );
+  }
   async createVariableSet(workspaceId, request) {
     return await this.requestJson(
       "POST",
@@ -3076,6 +4422,13 @@ var OpenGeniClient = class {
       request
     );
   }
+  async reorderChannels(workspaceId, request) {
+    return await this.requestJson(
+      "PUT",
+      `/v1/workspaces/${workspaceId}/channels/order`,
+      request
+    );
+  }
   async deleteChannel(workspaceId, channelId) {
     await this.requestJson(
       "DELETE",
@@ -3086,7 +4439,7 @@ var OpenGeniClient = class {
   async updateSessionChannel(workspaceId, sessionId, request) {
     return await this.requestJson(
       "PUT",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/channel`,
+      `${sessionPath(workspaceId, sessionId)}/channel`,
       request
     );
   }
@@ -3237,6 +4590,7 @@ var OpenGeniClient = class {
     if (input.timeoutMs !== void 0 && (!Number.isFinite(input.timeoutMs) || input.timeoutMs <= 0)) {
       throw new Error("File upload timeout must be a positive number");
     }
+    assertBrowserFileUploadSecureContext();
     const withTimeout = async (timeoutMs, operation) => {
       const controller = new AbortController();
       let timeout;
@@ -3262,6 +4616,7 @@ var OpenGeniClient = class {
         {
           filename: input.filename,
           contentType: input.contentType,
+          ...input.scope ? { scope: input.scope } : {},
           sizeBytes,
           sha256
         },
@@ -3297,10 +4652,23 @@ var OpenGeniClient = class {
       async (signal) => await this.completeFileUpload(workspaceId, upload.uploadId, { signal })
     );
   }
-  async getFile(workspaceId, fileId) {
+  async listFiles(workspaceId, options = {}) {
+    const query = new URLSearchParams();
+    if (options.scope) query.set("scope", options.scope);
+    if (options.limit !== void 0) query.set("limit", String(options.limit));
+    if (options.cursor) query.set("cursor", options.cursor);
+    return this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/files${query.size ? `?${query}` : ""}`
+    );
+  }
+  async getFile(workspaceId, fileId, options = {}) {
     return await this.requestJson(
       "GET",
-      `/v1/workspaces/${workspaceId}/files/${fileId}`
+      `/v1/workspaces/${workspaceId}/files/${fileId}${options.sessionId ? `?sessionId=${encodeURIComponent(options.sessionId)}` : ""}`,
+      void 0,
+      {},
+      options
     );
   }
   /** Read provider-neutral retained evidence metadata; never returns a storage location. */
@@ -3323,24 +4691,24 @@ var OpenGeniClient = class {
   async getSessionRetainedArtifact(workspaceId, sessionId, artifactId) {
     return await this.requestJson(
       "GET",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/artifacts/${artifactId}`
+      `${sessionPath(workspaceId, sessionId)}/artifacts/${artifactId}`
     );
   }
   async getSessionRetainedArtifactContent(workspaceId, sessionId, artifactId, options = {}) {
     return await this.getRetainedArtifactContentAtPath(
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/artifacts/${artifactId}/content`,
+      `${sessionPath(workspaceId, sessionId)}/artifacts/${artifactId}/content`,
       options
     );
   }
-  /** Assemble one permanent generated-image receipt from bounded authenticated ranges. */
+  /** Assemble one permanent image or file artifact from bounded authenticated ranges. */
   async downloadRetainedArtifact(workspaceId, artifact, options = {}) {
-    assertRetainedGeneratedImageReceipt(workspaceId, artifact);
+    assertRetainedWorkspaceArtifactReceipt(workspaceId, artifact);
     const bytes = await this.downloadRetainedArtifactBytes(artifact, options);
     return { artifact, bytes };
   }
-  /** Mint a short-lived, zero-copy browser source for a validated generated image. */
+  /** Mint a short-lived, zero-copy browser source for a validated workspace artifact. */
   async createRetainedArtifactDownloadUrl(workspaceId, artifact, options = {}) {
-    assertRetainedGeneratedImageReceipt(workspaceId, artifact);
+    assertRetainedWorkspaceArtifactReceipt(workspaceId, artifact);
     const download = await this.createFileDownloadUrl(workspaceId, artifact.artifactId, options);
     assertSafeArtifactDownloadUrl(download);
     return download;
@@ -3349,7 +4717,8 @@ var OpenGeniClient = class {
   async downloadRetainedScreenshot(workspaceId, sessionId, artifactId, options = {}) {
     const metadata = await this.getSessionRetainedArtifact(workspaceId, sessionId, artifactId);
     if (!metadata.available) return { metadata, bytes: null };
-    if (metadata.kind !== "computer_screenshot" || metadata.contentType !== "image/png" || !metadata.dimensions || metadata.originalBytes <= 0 || metadata.originalBytes > COMPUTER_SCREENSHOT_MAX_BYTES) {
+    const supportedScreenshot = (metadata.kind === "computer_screenshot" || metadata.kind === "browser_screenshot") && ["image/png", "image/jpeg", "image/webp"].includes(metadata.contentType);
+    if (!supportedScreenshot || !metadata.dimensions || metadata.originalBytes <= 0 || metadata.originalBytes > COMPUTER_SCREENSHOT_MAX_BYTES) {
       throw new OpenGeniApiError(502, "retained screenshot metadata is invalid");
     }
     const bytes = await this.downloadRetainedArtifactBytes(metadata, options);
@@ -3410,7 +4779,7 @@ var OpenGeniClient = class {
       ...options.signal ? { signal: options.signal } : {}
     });
     try {
-      assertApiContractResponse(response);
+      assertApiContractResponse(response, this.apiContractStrict);
     } catch (error) {
       await cancelResponseBody(response, "retained artifact API contract mismatch");
       throw error;
@@ -3454,7 +4823,7 @@ var OpenGeniClient = class {
   async createFileDownloadUrl(workspaceId, fileId, options = {}) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/files/${fileId}/download-url`,
+      `/v1/workspaces/${workspaceId}/files/${fileId}/download-url${options.sessionId ? `?sessionId=${encodeURIComponent(options.sessionId)}` : ""}`,
       void 0,
       {},
       options
@@ -3511,12 +4880,6 @@ var OpenGeniClient = class {
       request
     );
   }
-  async listDocumentBases(workspaceId) {
-    return await this.requestJson(
-      "GET",
-      `/v1/workspaces/${workspaceId}/document-bases`
-    );
-  }
   async getDocumentBase(workspaceId, baseId) {
     return await this.requestJson(
       "GET",
@@ -3537,6 +4900,13 @@ var OpenGeniClient = class {
       `/v1/workspaces/${workspaceId}/document-bases/${baseId}/documents`
     );
   }
+  /** Read the immutable source file through the Document's effective authority. */
+  async getDocumentOriginalFile(workspaceId, documentId) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/documents/${documentId}/original-file`
+    );
+  }
   /**
    * Drop raw text or an already-uploaded file into the workspace's Default
    * base. When curation is enabled, it may name, summarize, categorize, and
@@ -3561,13 +4931,6 @@ var OpenGeniClient = class {
       request
     );
   }
-  /** Retry indexing for a failed document. */
-  async reindexDocument(workspaceId, baseId, documentId) {
-    return await this.requestJson(
-      "POST",
-      `/v1/workspaces/${workspaceId}/document-bases/${baseId}/documents/${documentId}/reindex`
-    );
-  }
   /**
    * Delete a document from a base. Removes the document row and its indexed
    * chunks while leaving the uploaded file asset available for other uses.
@@ -3578,61 +4941,109 @@ var OpenGeniClient = class {
       `/v1/workspaces/${workspaceId}/document-bases/${baseId}/documents/${documentId}`
     );
   }
-  async searchDocuments(workspaceId, baseId, request) {
-    return await this.requestJson(
+  /** Unified retained sources, findings and groups. Only published entries are returned by default. */
+  async listKnowledgeEntries(workspaceId, request = {}) {
+    return this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/document-bases/${baseId}/search`,
+      `/v1/workspaces/${workspaceId}/knowledge/entries/search`,
       request
     );
   }
-  async searchKnowledge(workspaceId, request) {
-    return await this.requestJson(
+  async getKnowledgeEntry(workspaceId, entryId, options = {}) {
+    const search = new URLSearchParams();
+    if (options.revisionId !== void 0) search.set("revisionId", options.revisionId);
+    if (options.view !== void 0) search.set("view", options.view);
+    const query = search.toString();
+    return this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/knowledge/entries/${entryId}${query ? `?${query}` : ""}`
+    );
+  }
+  /** Open the original file associated with an accessible retained source revision. */
+  async createKnowledgeFileDownloadUrl(workspaceId, entryId, revisionId) {
+    return this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/knowledge/search`,
-      request
+      `/v1/workspaces/${workspaceId}/knowledge/entries/${entryId}/file/download-url`,
+      revisionId ? { revisionId } : {}
     );
   }
-  async listKnowledgeMemories(workspaceId, request = {}) {
-    const params = new URLSearchParams();
-    if (request.query) params.set("query", request.query);
-    if (request.status) params.set("status", request.status);
-    if (request.kind) params.set("kind", request.kind);
-    if (request.scope) params.set("scope", request.scope);
-    if (request.limit) params.set("limit", String(request.limit));
-    const query = params.toString();
-    return await this.requestJson(
-      "GET",
-      `/v1/workspaces/${workspaceId}/knowledge/memories${query ? `?${query}` : ""}`
+  async saveKnowledgeEntry(workspaceId, request) {
+    return this.requestJson("POST", `/v1/workspaces/${workspaceId}/knowledge/entries`, request);
+  }
+  async reviewKnowledgeEntry(workspaceId, request) {
+    const { entryId, ...body } = request;
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/knowledge/entries/${entryId}/review`,
+      body
     );
   }
-  async getKnowledgeMemory(workspaceId, memoryId) {
-    return await this.requestJson(
+  async listKnowledgeReviewBatches(workspaceId, options = {}) {
+    const query = new URLSearchParams();
+    for (const [key, value] of Object.entries(options))
+      if (value !== void 0) query.set(key, String(value));
+    return this.requestJson(
       "GET",
-      `/v1/workspaces/${workspaceId}/knowledge/memories/${memoryId}`
+      `/v1/workspaces/${workspaceId}/knowledge/review-groups?${query}`
     );
   }
-  async createKnowledgeMemory(workspaceId, request) {
-    return await this.requestJson(
+  /** Atomically review up to 100 selected entries, including their pending dependencies. */
+  async reviewKnowledgeEntries(workspaceId, request) {
+    return this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/knowledge/memories`,
+      `/v1/workspaces/${workspaceId}/knowledge/entries/review`,
       request
     );
   }
-  async updateKnowledgeMemory(workspaceId, memoryId, request) {
-    return await this.requestJson(
-      "PATCH",
-      `/v1/workspaces/${workspaceId}/knowledge/memories/${memoryId}`,
+  async listKnowledgeEntryHistory(workspaceId, entryId, beforeRevision) {
+    return this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/knowledge/entries/${entryId}/history${beforeRevision ? `?beforeRevision=${beforeRevision}` : ""}`
+    );
+  }
+  async restoreKnowledgeEntry(workspaceId, request) {
+    const { entryId, ...body } = request;
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/knowledge/entries/${entryId}/restore`,
+      body
+    );
+  }
+  async archiveKnowledgeEntry(workspaceId, entryId, request) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/knowledge/entries/${entryId}/archive`,
       request
     );
   }
-  /** Hybrid (semantic + keyword) search over the workspace's agent-visible memory. */
-  async searchWorkspaceMemories(workspaceId, request) {
-    return await this.requestJson(
+  async getAgentLearningSettings(workspaceId, scope, source) {
+    return this.requestJson("POST", `/v1/workspaces/${workspaceId}/agent-learning/read`, {
+      scope,
+      source
+    });
+  }
+  async saveAgentLearningSettings(workspaceId, request) {
+    return this.requestJson("POST", `/v1/workspaces/${workspaceId}/agent-learning`, request);
+  }
+  async listAgentLearningOverrides(workspaceId, scope) {
+    return this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/agent-learning/overrides?scope=${scope}`
+    );
+  }
+  async reviewAgentInstruction(workspaceId, request) {
+    return this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/knowledge/memories/search`,
+      `/v1/workspaces/${workspaceId}/agent-learning/instructions/review`,
       request
     );
   }
+  async listAgentInstructionReviews(workspaceId, cursor) {
+    return this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/agent-learning/instructions/reviews${cursor ? `?cursor=${encodeURIComponent(cursor)}` : ""}`
+    );
+  }
   /** Deep-merge a settings patch into the workspace (preserves unknown keys). */
   async updateWorkspaceSettings(workspaceId, request) {
     return await this.requestJson(
@@ -3648,102 +5059,126 @@ var OpenGeniClient = class {
       request
     );
   }
-  // --- Capability packs ------------------------------------------------------------------
-  /** Built-in + registered packs, with the workspace's installations. */
-  async listPacks(workspaceId) {
-    return await this.requestJson("GET", `/v1/workspaces/${workspaceId}/packs`);
+  /** Resolve pinned components, Variable Set, and Rig requirements before installation. */
+  // --- Capabilities -------------------------------------------------------------------------
+  async listCapabilities(workspaceId) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/capabilities`
+    );
   }
-  /** Register (or replace) a workspace-scoped pack from a manifest. */
-  async registerPack(workspaceId, manifest) {
+  /** Add a manual capability catalog item (e.g. a remote MCP server). */
+  async createCapability(workspaceId, request) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/packs`,
-      manifest
+      `/v1/workspaces/${workspaceId}/capabilities`,
+      request
     );
   }
-  async getPack(workspaceId, packId) {
+  async getConnectorToolPermissions(workspaceId, capabilityId, options = {}) {
     return await this.requestJson(
       "GET",
-      `/v1/workspaces/${workspaceId}/packs/${encodeURIComponent(packId)}`
+      `/v1/workspaces/${workspaceId}/capabilities/${encodeURIComponent(capabilityId)}/tool-permissions`,
+      void 0,
+      {},
+      options
     );
   }
-  async enablePack(workspaceId, packId, request = {}) {
+  async updateConnectorToolPermissions(workspaceId, capabilityId, request, options = {}) {
     return await this.requestJson(
-      "POST",
-      `/v1/workspaces/${workspaceId}/packs/${encodeURIComponent(packId)}/enable`,
-      request
+      "PATCH",
+      `/v1/workspaces/${workspaceId}/capabilities/${encodeURIComponent(capabilityId)}/tool-permissions`,
+      request,
+      {},
+      options
     );
   }
-  /** Resolve pinned components, Variable Set, and Rig requirements before installation. */
-  async previewPackInstallation(workspaceId, packId, request = {}) {
+  async enableCapability(workspaceId, capabilityId, request = {}) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/packs/${encodeURIComponent(packId)}/installation-preview`,
+      `/v1/workspaces/${workspaceId}/capabilities/${encodeURIComponent(capabilityId)}/enable`,
       request
     );
   }
-  /** Install, update, or repair a Pack from an exact previewed manifest. */
-  async installPack(workspaceId, packId, request) {
+  async disableCapability(workspaceId, capabilityId) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/packs/${encodeURIComponent(packId)}/install`,
-      request
+      `/v1/workspaces/${workspaceId}/capabilities/${encodeURIComponent(capabilityId)}/disable`
     );
   }
-  /** Preview which Pack-owned components will be retained by other owners. */
-  async previewPackUninstall(workspaceId, packId) {
-    return await this.requestJson(
+  /** Read-only, permission-filtered workspace or session output discovery. */
+  async listArtifactCatalog(workspaceId, options = {}) {
+    const query = new URLSearchParams();
+    for (const key of [
+      "sourceSessionId",
+      "q",
+      "kind",
+      "sort",
+      "status",
+      "limit",
+      "cursor"
+    ]) {
+      if (options[key] !== void 0) query.set(key, String(options[key]));
+    }
+    const suffix = query.size ? `?${query.toString()}` : "";
+    return this.requestJson(
       "GET",
-      `/v1/workspaces/${workspaceId}/packs/${encodeURIComponent(packId)}/uninstall-preview`
-    );
-  }
-  /** Safely release Pack ownership and disable only now-ownerless components. */
-  async uninstallPack(workspaceId, packId, request) {
-    return await this.requestJson(
-      "DELETE",
-      `/v1/workspaces/${workspaceId}/packs/${encodeURIComponent(packId)}/installation`,
-      request
-    );
-  }
-  /** Unregister a workspace-scoped pack (built-in packs cannot be deleted). */
-  async deletePack(workspaceId, packId) {
-    await this.requestVoid(
-      "DELETE",
-      `/v1/workspaces/${workspaceId}/packs/${encodeURIComponent(packId)}`
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/artifact-catalog${suffix}`,
+      void 0,
+      void 0,
+      options
     );
   }
-  async listPackInstallations(workspaceId) {
+  async listWorkspaceArtifacts(workspaceId, options = {}) {
+    const query = new URLSearchParams();
+    if (options.limit !== void 0) query.set("limit", String(options.limit));
+    if (options.cursor) query.set("cursor", options.cursor);
+    if (options.status) query.set("status", options.status);
+    if (options.sourceSessionId) query.set("sourceSessionId", options.sourceSessionId);
+    const suffix = query.size > 0 ? `?${query.toString()}` : "";
     return await this.requestJson(
       "GET",
-      `/v1/workspaces/${workspaceId}/packs/installations`
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/published-artifacts${suffix}`,
+      void 0,
+      void 0,
+      options
     );
   }
-  // --- Capabilities -------------------------------------------------------------------------
-  async listCapabilities(workspaceId) {
+  async getWorkspaceArtifact(workspaceId, artifactId, options = {}) {
     return await this.requestJson(
       "GET",
-      `/v1/workspaces/${workspaceId}/capabilities`
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/published-artifacts/${encodeURIComponent(artifactId)}`,
+      void 0,
+      void 0,
+      options
     );
   }
-  /** Add a manual capability catalog item (e.g. a remote MCP server). */
-  async createCapability(workspaceId, request) {
-    return await this.requestJson(
-      "POST",
-      `/v1/workspaces/${workspaceId}/capabilities`,
-      request
+  /** Display-only HTML delivery: do not download the retained source bundle to render a Site. */
+  async getWorkspaceArtifactHtml(workspaceId, artifactId, options) {
+    const response = await this.requestResponse(
+      "GET",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/published-artifacts/${encodeURIComponent(artifactId)}/html`,
+      { versionId: options.versionId },
+      options
     );
+    return response.text();
   }
-  async enableCapability(workspaceId, capabilityId, request = {}) {
+  async rollbackWorkspaceArtifact(workspaceId, artifactId, request, options = {}) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/capabilities/${encodeURIComponent(capabilityId)}/enable`,
-      request
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/published-artifacts/${encodeURIComponent(artifactId)}/rollback`,
+      request,
+      void 0,
+      options
     );
   }
-  async disableCapability(workspaceId, capabilityId) {
+  async setWorkspaceArtifactStatus(workspaceId, artifactId, request, options = {}) {
     return await this.requestJson(
-      "POST",
-      `/v1/workspaces/${workspaceId}/capabilities/${encodeURIComponent(capabilityId)}/disable`
+      "PATCH",
+      `/v1/workspaces/${encodeURIComponent(workspaceId)}/published-artifacts/${encodeURIComponent(artifactId)}/status`,
+      request,
+      void 0,
+      options
     );
   }
   /** Search the official MCP registry for installable capabilities. */
@@ -3758,6 +5193,26 @@ var OpenGeniClient = class {
       }
     );
   }
+  async discoverPlugins(workspaceId, options = {}) {
+    return this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/capabilities/discovery/plugins`,
+      void 0,
+      {
+        ...options.id ? { id: options.id } : {},
+        ...options.query ? { query: options.query } : {},
+        ...options.provider ? { provider: options.provider } : {},
+        ...options.offset !== void 0 ? { offset: String(options.offset) } : {}
+      }
+    );
+  }
+  async inspectMcpAuthentication(workspaceId, url) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/capabilities/discovery/mcp-auth`,
+      { url }
+    );
+  }
   /** List installed protocol-neutral OpenAPI and GraphQL Integrations. */
   async listApiIntegrations(workspaceId) {
     return await this.requestJson(
@@ -3885,6 +5340,11 @@ var OpenGeniClient = class {
       request
     );
   }
+  async getInstalledPluginDetails(workspaceId, pluginKey) {
+    return this.requestJson("GET", `/v1/workspaces/${workspaceId}/plugins/details`, void 0, {
+      pluginKey
+    });
+  }
   async listInstalledPlugins(workspaceId) {
     return await this.requestJson(
       "GET",
@@ -3934,6 +5394,54 @@ var OpenGeniClient = class {
       `/v1/workspaces/${workspaceId}/skills`
     );
   }
+  /** Shared authored/installed catalog metadata. File bodies are read on demand. */
+  async listWorkspaceSkills(workspaceId, options = {}) {
+    const query = new URLSearchParams();
+    if (options.cursor !== void 0) query.set("cursor", options.cursor);
+    if (options.limit !== void 0) query.set("limit", String(options.limit));
+    if (options.sessionId !== void 0) query.set("sessionId", options.sessionId);
+    const suffix = query.size ? `?${query.toString()}` : "";
+    return this.requestJson("GET", `/v1/workspaces/${workspaceId}/skills/content${suffix}`);
+  }
+  async readWorkspaceSkill(workspaceId, skillId, revisionId) {
+    const query = revisionId ? `?revisionId=${encodeURIComponent(revisionId)}` : "";
+    return this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/skills/content/${encodeURIComponent(skillId)}${query}`
+    );
+  }
+  async saveWorkspaceSkill(workspaceId, request) {
+    return this.requestJson("POST", `/v1/workspaces/${workspaceId}/skills/content/save`, request);
+  }
+  /** Permanently remove a personal/workspace Skill and all its saved revisions. */
+  async removeWorkspaceSkill(workspaceId, skillId, request) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/skills/content/${encodeURIComponent(skillId)}/remove`,
+      request
+    );
+  }
+  async approveWorkspaceSkill(workspaceId, skillId, request) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/skills/content/${encodeURIComponent(skillId)}/approve`,
+      request
+    );
+  }
+  async restoreWorkspaceSkill(workspaceId, skillId, request) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/skills/content/${encodeURIComponent(skillId)}/restore`,
+      request
+    );
+  }
+  async rejectWorkspaceSkill(workspaceId, skillId, request) {
+    return this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/skills/content/${encodeURIComponent(skillId)}/reject`,
+      request
+    );
+  }
   /** Install one exact reviewed curated-library Skill through the Skill domain. */
   async installLibrarySkill(workspaceId, libraryId, request) {
     return await this.requestJson(
@@ -3957,6 +5465,17 @@ var OpenGeniClient = class {
     );
   }
   // --- Connections -------------------------------------------------------------------------------
+  /** This authenticated user's accounts across the organization, plus current-workspace shared accounts.
+   * Inactive accounts are opt-in for settings display; execution pickers keep the active default. */
+  async listOwnConnectionAccounts(workspaceId, options = {}) {
+    const response = await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/connections/accounts`,
+      void 0,
+      options.includeInactive === true ? { includeInactive: "true" } : {}
+    );
+    return response.connections;
+  }
   async listConnections(workspaceId) {
     const response = await this.requestJson(
       "GET",
@@ -3964,6 +5483,66 @@ var OpenGeniClient = class {
     );
     return response.connections;
   }
+  /** Secret-free status for the caller's exact personal GitHub connection. */
+  async personalGitHubStatus(workspaceId) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/connections/github`
+    );
+  }
+  /** Start the dedicated personal GitHub authorization-code + PKCE flow. */
+  async startPersonalGitHubOAuth(workspaceId, request = {}) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/connections/github/oauth/start`,
+      request
+    );
+  }
+  /** Re-authorize one exact personal GitHub Connection generation in place. */
+  async reconnectPersonalGitHub(workspaceId, connectionId, request = {}) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/connections/${connectionId}/github/reconnect`,
+      request
+    );
+  }
+  /** Revoke one exact generation through an idempotent owner-only disconnect. */
+  async disconnectPersonalGitHub(workspaceId, connectionId, request) {
+    const response = await this.requestJson(
+      "DELETE",
+      `/v1/workspaces/${workspaceId}/connections/${connectionId}`,
+      request
+    );
+    return response.connection;
+  }
+  /** Browse one bounded page of repositories visible to one exact owner connection. */
+  async listPersonalGitHubRepositories(workspaceId, connectionId, options = {}) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/connections/${connectionId}/github/repositories`,
+      void 0,
+      {
+        ...options.cursor !== void 0 ? { cursor: String(options.cursor) } : {},
+        ...options.limit !== void 0 ? { limit: String(options.limit) } : {}
+      }
+    );
+  }
+  /** Atomically replace the exact owner connection's selected repository set. */
+  async replacePersonalGitHubRepositorySelections(workspaceId, connectionId, request) {
+    return await this.requestJson(
+      "PUT",
+      `/v1/workspaces/${workspaceId}/connections/${connectionId}/github/repositories`,
+      request
+    );
+  }
+  /** Revalidate every selected repository without accepting provider URLs from the caller. */
+  async verifyPersonalGitHubRepositorySelections(workspaceId, connectionId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/workspaces/${workspaceId}/connections/${connectionId}/github/repositories/verify`,
+      request
+    );
+  }
   /** List the secret-free Slack team -> OpenGeni tenant routing authority. */
   async listSlackInstallationBindings(workspaceId) {
     const response = await this.requestJson(
@@ -4016,6 +5595,20 @@ var OpenGeniClient = class {
       `/v1/workspaces/${workspaceId}/integrations/slack/reaction-channels?${query}`
     );
   }
+  async listOpenGeniSlackChannelRoutes(workspaceId, connectionId) {
+    const query = new URLSearchParams({ connectionId });
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/integrations/slack/channel-routes?${query}`
+    );
+  }
+  async updateOpenGeniSlackChannelRoutes(workspaceId, request) {
+    await this.requestJson(
+      "PUT",
+      `/v1/workspaces/${workspaceId}/integrations/slack/channel-routes`,
+      request
+    );
+  }
   async updateConnection(workspaceId, connectionId, request) {
     const response = await this.requestJson(
       "PATCH",
@@ -4087,6 +5680,20 @@ var OpenGeniClient = class {
   catalogAssetUrl(logoAssetPath) {
     return logoAssetPath ? `${this.baseUrl}/v1/${logoAssetPath}` : null;
   }
+  /** Read a passive catalog mark through this client's authenticated transport.
+   * Useful when an embedding backend protects even public upstream assets. */
+  async downloadCatalogAsset(logoAssetPath, options = {}) {
+    if (!/^catalog-assets\/[a-zA-Z0-9_./-]+$/.test(logoAssetPath) || logoAssetPath.split("/").some((part) => !part || part === "." || part === ".."))
+      throw new TypeError("A catalog asset path is required");
+    const response = await this.requestResponse("GET", `/v1/${logoAssetPath}`, {}, options);
+    const type = response.headers.get("content-type")?.split(";")[0] ?? "";
+    if (!type.startsWith("image/")) {
+      await response.body?.cancel();
+      throw new Error("The catalog asset is not an image");
+    }
+    const bytes = await readBoundedResponseBytes(response, 2e6, null);
+    return new Blob([Uint8Array.from(bytes)], { type });
+  }
   // --- GitHub ----------------------------------------------------------------------------------
   /** GitHub App server configuration plus truthful workspace binding status. */
   async getGitHubApp(workspaceId, options = {}) {
@@ -4107,6 +5714,21 @@ var OpenGeniClient = class {
       `/v1/workspaces/${workspaceId}/github/repositories`
     );
   }
+  /** Effective confirmation policy for each GitHub identity available to this caller. */
+  async getGitHubActionPolicies(workspaceId) {
+    return await this.requestJson(
+      "GET",
+      `/v1/workspaces/${workspaceId}/github/action-policies`
+    );
+  }
+  /** Change one GitHub action group without broadening review or merge policy. */
+  async updateGitHubActionPolicy(workspaceId, request) {
+    return await this.requestJson(
+      "PATCH",
+      `/v1/workspaces/${workspaceId}/github/action-policies`,
+      request
+    );
+  }
   /** Re-sync the installation's repository list from GitHub. */
   async syncGitHubRepositories(workspaceId) {
     return await this.requestJson(
@@ -4152,12 +5774,192 @@ var OpenGeniClient = class {
       `/v1/workspaces/${workspaceId}/api-keys/${apiKeyId}`
     );
   }
+  async listOrganizationApiKeys(organizationId) {
+    const response = await this.requestJson(
+      "GET",
+      `/v1/organizations/${organizationId}/api-keys`
+    );
+    return response.apiKeys;
+  }
+  /** The returned `token` is shown once; only its prefix is stored. */
+  async createOrganizationApiKey(organizationId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/organizations/${organizationId}/api-keys`,
+      request
+    );
+  }
+  /** Revoke an organization-scoped API key. Returns the revoked key. */
+  async deleteOrganizationApiKey(organizationId, apiKeyId) {
+    return await this.requestJson(
+      "DELETE",
+      `/v1/organizations/${organizationId}/api-keys/${apiKeyId}`
+    );
+  }
+  // --- Connected agents (organization MCP server) ------------------------------------------------
+  /**
+   * Agents people connected to the organization MCP server (`/v1/mcp`).
+   * Everyone sees their own; owners and admins see everyone's. Browser only:
+   * keys and agents are refused, so an agent can't widen its own access.
+   */
+  async listOrganizationMcpConnections(organizationId) {
+    return await this.requestJson(
+      "GET",
+      `/v1/organizations/${organizationId}/mcp-connections`
+    );
+  }
+  /** Change what a connected agent can do and where; its next request uses it. Only its person. */
+  async updateOrganizationMcpConnection(organizationId, connectionId, request) {
+    return await this.requestJson(
+      "PATCH",
+      `/v1/organizations/${organizationId}/mcp-connections/${connectionId}`,
+      request
+    );
+  }
+  /** Disconnect an agent: every token it holds is refused from now on. */
+  async deleteOrganizationMcpConnection(organizationId, connectionId) {
+    await this.requestVoid(
+      "DELETE",
+      `/v1/organizations/${organizationId}/mcp-connections/${connectionId}`
+    );
+  }
+  /** Service accounts: organization identities with no person behind them. */
+  async listOrganizationServiceAccounts(organizationId) {
+    return await this.requestJson(
+      "GET",
+      `/v1/organizations/${organizationId}/service-accounts`
+    );
+  }
+  async getOrganizationServiceAccount(organizationId, serviceAccountId) {
+    return await this.requestJson(
+      "GET",
+      `/v1/organizations/${organizationId}/service-accounts/${serviceAccountId}`
+    );
+  }
+  /** Create a service account; give it keys with `createOrganizationApiKey({ serviceAccountId })`. */
+  async createOrganizationServiceAccount(organizationId, request) {
+    return await this.requestJson(
+      "POST",
+      `/v1/organizations/${organizationId}/service-accounts`,
+      request
+    );
+  }
+  /** Rename it or change its role; making it a member narrows its keys at once. */
+  async updateOrganizationServiceAccount(organizationId, serviceAccountId, request) {
+    return await this.requestJson(
+      "PATCH",
+      `/v1/organizations/${organizationId}/service-accounts/${serviceAccountId}`,
+      request
+    );
+  }
+  /** Delete a service account; every key it holds is revoked at once. */
+  async deleteOrganizationServiceAccount(organizationId, serviceAccountId) {
+    await this.requestVoid(
+      "DELETE",
+      `/v1/organizations/${organizationId}/service-accounts/${serviceAccountId}`
+    );
+  }
+  /** The pending sign-in an agent started; read by the web app's sign-in page. */
+  async getMcpConnectionRequest(requestToken) {
+    return await this.requestJson(
+      "GET",
+      `/v1/mcp-connections/requests/${encodeURIComponent(requestToken)}`
+    );
+  }
+  /** Allow or deny an agent's sign-in. Returns where to send the browser next. */
+  async answerMcpConnectionRequest(requestToken, decision) {
+    return await this.requestJson(
+      "POST",
+      `/v1/mcp-connections/requests/${encodeURIComponent(requestToken)}`,
+      decision
+    );
+  }
+  // --- Organization-wide sessions ----------------------------------------------------------------
+  /**
+   * One page of sessions across every shared workspace of the organization the
+   * caller may read within its live workspace scope (an organization API key or
+   * organization owner). Each row carries its `workspaceId`; read events,
+   * history, and files through the ordinary workspace methods. Personal
+   * workspaces are never included and private sessions stay invisible.
+   */
+  async listOrganizationSessions(organizationId, options = {}) {
+    return await this.requestJson(
+      "GET",
+      `/v1/organizations/${organizationId}/sessions`,
+      void 0,
+      {
+        ...options.limit === void 0 ? {} : { limit: String(options.limit) },
+        ...options.cursor === void 0 ? {} : { cursor: options.cursor },
+        ...options.scopeSubjectId ? { scopeSubjectId: options.scopeSubjectId } : {},
+        ...options.status === void 0 ? {} : { status: options.status }
+      },
+      { signal: options.signal }
+    );
+  }
+  /**
+   * Every session `listOrganizationSessions` would return, following
+   * `nextCursor` page by page until the organization is exhausted. A page may
+   * be shorter than `limit` while more pages remain, so callers must not treat
+   * a short page as the end.
+   */
+  async *iterateOrganizationSessions(organizationId, options = {}) {
+    let cursor;
+    do {
+      const page = await this.listOrganizationSessions(
+        organizationId,
+        { ...options, ...cursor === void 0 ? {} : { cursor } }
+      );
+      for (const session of page.sessions) {
+        yield session;
+      }
+      cursor = page.nextCursor ?? void 0;
+    } while (cursor !== void 0);
+  }
   // --- Billing (account-scoped) --------------------------------------------------------------------
   async getBilling(options = {}) {
     return await this.requestJson("GET", "/v1/billing", void 0, {
       ...options.accountId !== void 0 ? { accountId: options.accountId } : {}
     });
   }
+  async getOrganizationUsageSummary(options, requestOptions = {}) {
+    return await this.requestJson(
+      "GET",
+      "/v1/billing/usage-summary",
+      void 0,
+      {
+        accountId: options.accountId,
+        period: options.period ?? "month"
+      },
+      requestOptions
+    );
+  }
+  async getOrganizationModelUsage(options, requestOptions = {}) {
+    return await this.requestJson(
+      "GET",
+      "/v1/billing/usage-models",
+      void 0,
+      {
+        accountId: options.accountId,
+        period: options.period ?? "month",
+        ...options.afterWorkspaceId ? { afterWorkspaceId: options.afterWorkspaceId } : {}
+      },
+      requestOptions
+    );
+  }
+  async getOrganizationUsageWorkspacePage(options, requestOptions = {}) {
+    return await this.requestJson(
+      "GET",
+      "/v1/billing/usage-workspaces",
+      void 0,
+      {
+        accountId: options.accountId,
+        period: options.period ?? "month",
+        until: options.until,
+        ...options.afterWorkspaceId ? { afterWorkspaceId: options.afterWorkspaceId } : {}
+      },
+      requestOptions
+    );
+  }
   async getBillingUsage(options = {}) {
     return await this.requestJson("GET", "/v1/billing/usage", void 0, {
       ...options.accountId !== void 0 ? { accountId: options.accountId } : {},
@@ -4172,8 +5974,11 @@ var OpenGeniClient = class {
       {
         range: options.range ?? "week",
         ...options.provider !== void 0 ? { provider: options.provider } : {},
-        ...options.model !== void 0 ? { model: options.model } : {}
-      }
+        ...options.model !== void 0 ? { model: options.model } : {},
+        ...options.rootSessionId !== void 0 ? { rootSessionId: options.rootSessionId } : {},
+        ...options.sessionId !== void 0 ? { sessionId: options.sessionId } : {}
+      },
+      { signal: options.signal }
     );
   }
   async getBillingEntitlements(options = {}) {
@@ -4190,15 +5995,104 @@ var OpenGeniClient = class {
   async createBillingCheckout(request) {
     return await this.requestJson("POST", "/v1/billing/checkout", request);
   }
+  /**
+   * Where one checkout stands, and whether its credits reached the balance.
+   * Poll it after the customer returns from Stripe Checkout.
+   */
+  async getBillingCheckout(checkoutSessionId, options = {}) {
+    return await this.requestJson(
+      "GET",
+      `/v1/billing/checkout/${encodeURIComponent(checkoutSessionId)}`,
+      void 0,
+      {
+        ...options.accountId !== void 0 ? { accountId: options.accountId } : {}
+      }
+    );
+  }
+  /** Open Stripe's hosted portal for invoices and payment information. */
+  async createBillingPortalSession(request = {}) {
+    return await this.requestJson(
+      "POST",
+      "/v1/billing/portal",
+      request
+    );
+  }
+  // --- Embedding transport -----------------------------------------------------
+  /** The URL of an API path on this client's base (relative when the base is relative). */
+  apiUrl(path) {
+    if (!path.startsWith("/")) throw new TypeError("API path must start with /");
+    return `${this.baseUrl}${path}`;
+  }
+  /**
+   * A client of the same class that adds `headers` to every request, keeping
+   * this client's base URL, fetch, credentials, and actor attribution. Used to
+   * scope a surface (for example an artifact viewer) to one host context.
+   */
+  withHeaders(headers) {
+    const extra = { ...headers };
+    const base = this.options.headers;
+    const Client = this.constructor;
+    const client = new Client({
+      ...this.options,
+      headers: () => ({ ...typeof base === "function" ? base() : base, ...extra })
+    });
+    if (this.externalActorHeader !== void 0) {
+      client.externalActorHeader = this.externalActorHeader;
+    }
+    client.serviceInitiatorHeader = this.serviceInitiatorHeader;
+    client.serviceContextHeader = this.serviceContextHeader;
+    return client;
+  }
+  /**
+   * Fetch an absolute URL under this client's base URL through its fetch and
+   * headers. For transports the SDK builds itself (the editable-artifact live
+   * transport), so host authentication stays in one place. A URL outside the
+   * base is refused: credentials never leave the configured API.
+   */
+  async fetchApi(input, init = {}) {
+    const origin = typeof globalThis.location?.href === "string" ? globalThis.location.href : void 0;
+    const base = new URL(this.baseUrl.endsWith("/") ? this.baseUrl : `${this.baseUrl}/`, origin);
+    const target = new URL(input, base);
+    if (target.origin !== base.origin || !`${target.pathname}/`.startsWith(base.pathname)) {
+      throw new TypeError("fetchApi only reaches this client's API base URL");
+    }
+    const headers = new Headers(init.headers);
+    for (const [name, value] of Object.entries(this.headers())) {
+      if (!headers.has(name)) headers.set(name, value);
+    }
+    return await this.fetchImpl(target.href, { ...init, headers });
+  }
   // --- Internals -------------------------------------------------------------
   headers(correlationId) {
     const extra = typeof this.options.headers === "function" ? this.options.headers() : this.options.headers;
-    return {
+    const headers = {
       ...this.options.apiKey ? { Authorization: `Bearer ${this.options.apiKey}` } : {},
       ...extra,
       [OPENGENI_API_CONTRACT_HEADER]: OPENGENI_API_CONTRACT_REVISION,
       ...correlationId ? { [OPENGENI_CORRELATION_HEADER]: correlationId } : {}
     };
+    const headerNames = Object.keys(headers).map((key) => key.toLowerCase());
+    const hasUser = this.externalActorHeader !== void 0 || headerNames.includes("x-opengeni-external-actor");
+    const hasService = this.serviceInitiatorHeader !== void 0 || headerNames.includes("x-opengeni-service-initiator") || headerNames.includes("x-opengeni-service-context");
+    if (hasUser && hasService)
+      throw new Error("asUser and asService attribution headers are mutually exclusive");
+    if (this.externalActorHeader) {
+      for (const key of Object.keys(headers)) {
+        if (key.toLowerCase() === "x-opengeni-external-actor") delete headers[key];
+      }
+      headers["x-opengeni-external-actor"] = this.externalActorHeader;
+    }
+    if (this.serviceInitiatorHeader !== void 0) {
+      for (const key of Object.keys(headers)) {
+        const name = key.toLowerCase();
+        if (name === "x-opengeni-service-initiator" || name === "x-opengeni-service-context")
+          delete headers[key];
+      }
+      headers["x-opengeni-service-initiator"] = this.serviceInitiatorHeader;
+      if (this.serviceContextHeader !== void 0)
+        headers["x-opengeni-service-context"] = this.serviceContextHeader;
+    }
+    return headers;
   }
   url(path, query = {}) {
     const params = new URLSearchParams(query).toString();
@@ -4266,6 +6160,13 @@ var OpenGeniClient = class {
       `/v1/workspaces/${workspaceId}/codex/accounts`
     );
   }
+  /** Session-authorized retry choices plus the current accepted account. */
+  async listSessionCodexAccounts(workspaceId, sessionId) {
+    return await this.requestJson(
+      "GET",
+      `${sessionPath(workspaceId, sessionId)}/codex-accounts`
+    );
+  }
   /** Switch the workspace ACTIVE Codex account (the one unpinned sessions use). */
   async activateCodexAccount(workspaceId, accountId) {
     return await this.requestJson(
@@ -4317,15 +6218,77 @@ var OpenGeniClient = class {
       { label }
     );
   }
-  /** Pin (or unpin via "auto") a session's Codex account. Applies on the next turn. */
+  /** Pin/unpin a Codex account. Overrides a capacity-blocked turn; otherwise applies next turn. */
   async pinSessionCodexAccount(workspaceId, sessionId, target) {
+    return await this.requestJson("POST", `${sessionPath(workspaceId, sessionId)}/codex-account`, { target });
+  }
+  // --- SuperGrok/xAI connected subscriptions ------------------------------------------------------
+  /** Organization subscription management requires an administrator browser session. */
+  async getModelConnectionAccess(target) {
+    return await this.requestJson(
+      "GET",
+      `/v1/${target.scope}/${encodeURIComponent(target.scopeId)}/model-connections/${target.kind}/${encodeURIComponent(target.connectionId)}/access`
+    );
+  }
+  async updateModelConnectionAccess(target, policy) {
+    return await this.requestJson(
+      "PUT",
+      `/v1/${target.scope}/${encodeURIComponent(target.scopeId)}/model-connections/${target.kind}/${encodeURIComponent(target.connectionId)}/access`,
+      policy
+    );
+  }
+  async listOrganizationSuperGrokAccounts(organizationId) {
+    return await this.requestJson("GET", `/v1/organizations/${organizationId}/supergrok/accounts`);
+  }
+  async organizationSupergrokConnectStart(organizationId) {
     return await this.requestJson(
       "POST",
-      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/codex-account`,
-      { target }
+      `/v1/organizations/${organizationId}/supergrok/connect/start`,
+      {}
+    );
+  }
+  async organizationSupergrokConnectPoll(organizationId, state) {
+    return await this.requestJson(
+      "POST",
+      `/v1/organizations/${organizationId}/supergrok/connect/poll`,
+      { state }
+    );
+  }
+  async activateOrganizationSuperGrokAccount(organizationId, accountId) {
+    return await this.requestJson(
+      "POST",
+      `/v1/organizations/${organizationId}/supergrok/accounts/${accountId}/activate`,
+      {}
+    );
+  }
+  async setOrganizationSuperGrokRotationSettings(organizationId, patch) {
+    return await this.requestJson(
+      "PATCH",
+      `/v1/organizations/${organizationId}/supergrok/settings`,
+      patch
+    );
+  }
+  async setOrganizationSuperGrokAccountAllocator(organizationId, accountId, input) {
+    return await this.requestJson(
+      "PATCH",
+      `/v1/organizations/${organizationId}/supergrok/accounts/${accountId}/allocator`,
+      input
+    );
+  }
+  async renameOrganizationSuperGrokAccount(organizationId, accountId, label) {
+    return await this.requestJson(
+      "PATCH",
+      `/v1/organizations/${organizationId}/supergrok/accounts/${accountId}`,
+      { label }
+    );
+  }
+  async disconnectOrganizationSuperGrokAccount(organizationId, accountId) {
+    return await this.requestJson(
+      "DELETE",
+      `/v1/organizations/${organizationId}/supergrok/accounts/${accountId}`,
+      {}
     );
   }
-  // --- SuperGrok/xAI connected subscriptions ------------------------------------------------------
   async supergrokStatus(workspaceId) {
     return await this.requestJson(
       "GET",
@@ -4384,50 +6347,89 @@ var OpenGeniClient = class {
     return await this.requestJson("DELETE", `/v1/workspaces/${workspaceId}/supergrok/accounts/${accountId}`, {});
   }
   /** Contract-checked JSON transport shared by opt-in typed SDK clients. */
+  async requestSessionCommand(method, path, body, options = {}) {
+    return await this.requestJson(
+      method,
+      path,
+      body,
+      {},
+      {
+        signal: options.signal,
+        timeoutMs: options.timeoutMs ?? this.sessionCommandTimeoutMs
+      }
+    );
+  }
+  /** Contract-checked JSON transport shared by opt-in typed SDK clients. */
   async requestJson(method, path, body, query = {}, options = {}) {
     const correlationId = crypto.randomUUID();
-    let response;
+    const abort = requestAbortSignal(options);
     try {
-      response = await this.fetchImpl(this.url(path, query), {
-        method,
-        headers: {
-          ...this.headers(correlationId),
-          Accept: "application/json",
-          ...body !== void 0 ? { "Content-Type": "application/json" } : {}
-        },
-        ...body !== void 0 ? { body: JSON.stringify(body) } : {},
-        ...options.signal ? { signal: options.signal } : {}
-      });
-    } catch (error) {
-      if (isMutationMethod(method)) {
-        throw mutationTransportError(correlationId);
+      if (abort.signal?.aborted) {
+        throw abort.signal.reason ?? new DOMException("Request aborted", "AbortError");
       }
-      throw error;
-    }
-    assertApiContractResponse(response);
-    if (!response.ok) {
-      throw await apiErrorFromResponse(response, { method, correlationId });
-    }
-    await assertJsonResponse(response, { method, correlationId });
-    try {
-      return await response.json();
-    } catch (error) {
-      if (isMutationMethod(method)) {
-        throw mutationTransportError(correlationId);
+      const headers = this.headers(correlationId);
+      let response;
+      try {
+        response = await awaitWithAbort(
+          this.fetchImpl(this.url(path, query), {
+            method,
+            headers: {
+              ...headers,
+              Accept: "application/json",
+              ...body !== void 0 ? { "Content-Type": "application/json" } : {}
+            },
+            ...body !== void 0 ? { body: JSON.stringify(body) } : {},
+            ...abort.signal ? { signal: abort.signal } : {}
+          }),
+          abort.signal
+        );
+      } catch (error) {
+        if (options.signal?.aborted) throw error;
+        if (isMutationMethod(method)) {
+          throw mutationTransportError(correlationId);
+        }
+        throw error;
       }
-      throw error;
+      assertApiContractResponse(response, this.apiContractStrict);
+      try {
+        if (!response.ok) {
+          throw await awaitWithAbort(
+            apiErrorFromResponse(response, { method, correlationId }),
+            abort.signal
+          );
+        }
+        if (options.responseType === "void") {
+          await awaitWithAbort(
+            cancelResponseBody(response, "discarding void API response"),
+            abort.signal
+          );
+          return void 0;
+        }
+        await awaitWithAbort(assertJsonResponse(response, { method, correlationId }), abort.signal);
+        return await awaitWithAbort(response.json(), abort.signal);
+      } catch (error) {
+        if (options.signal?.aborted) throw error;
+        if (error instanceof OpenGeniApiError) throw error;
+        if (isMutationMethod(method)) {
+          throw mutationTransportError(correlationId);
+        }
+        throw error;
+      }
+    } finally {
+      abort.dispose();
     }
   }
   /** Authenticated, contract-checked response for bounded streaming downloads. */
   async requestResponse(method, path, query = {}, options = {}) {
     const correlationId = crypto.randomUUID();
+    const headers = this.headers(correlationId);
     let response;
     try {
       response = await this.fetchImpl(this.url(path, query), {
         method,
         headers: {
-          ...this.headers(correlationId),
-          Accept: "application/octet-stream"
+          ...headers,
+          Accept: options.accept ?? "application/octet-stream"
         },
         ...options.signal ? { signal: options.signal } : {}
       });
@@ -4435,21 +6437,22 @@ var OpenGeniClient = class {
       if (isMutationMethod(method)) throw mutationTransportError(correlationId);
       throw error;
     }
-    assertApiContractResponse(response);
+    assertApiContractResponse(response, this.apiContractStrict);
     if (!response.ok) {
       throw await apiErrorFromResponse(response, { method, correlationId });
     }
     return response;
   }
-  /** Like `requestJson` for endpoints that respond with no body (204). */
+  /** Contract-checked transport shared by opt-in typed SDK clients for 204 responses. */
   async requestVoid(method, path, body) {
     const correlationId = crypto.randomUUID();
+    const headers = this.headers(correlationId);
     let response;
     try {
       response = await this.fetchImpl(this.url(path), {
         method,
         headers: {
-          ...this.headers(correlationId),
+          ...headers,
           Accept: "application/json",
           ...body !== void 0 ? { "Content-Type": "application/json" } : {}
         },
@@ -4461,13 +6464,14 @@ var OpenGeniClient = class {
       }
       throw error;
     }
-    assertApiContractResponse(response);
+    assertApiContractResponse(response, this.apiContractStrict);
     if (!response.ok) {
       throw await apiErrorFromResponse(response, { method, correlationId });
     }
   }
 };
-function assertApiContractResponse(response) {
+function assertApiContractResponse(response, strict) {
+  if (!strict) return;
   const actual = response.headers.get(OPENGENI_API_CONTRACT_HEADER);
   if (actual && actual !== OPENGENI_API_CONTRACT_REVISION) {
     throw new OpenGeniApiContractMismatchError(OPENGENI_API_CONTRACT_REVISION, actual);
@@ -4533,11 +6537,62 @@ function filenameForAudioMimeType(mimeType) {
   }
 }
 var API_ERROR_MAX_BYTES = 16 * 1024;
+function requestAbortSignal(options) {
+  const timeoutMs = options.timeoutMs ?? 0;
+  if (timeoutMs <= 0) {
+    return { signal: options.signal, dispose: () => void 0 };
+  }
+  const controller = new AbortController();
+  const onCallerAbort = () => controller.abort(options.signal?.reason);
+  if (options.signal?.aborted) {
+    onCallerAbort();
+  } else {
+    options.signal?.addEventListener("abort", onCallerAbort, { once: true });
+  }
+  const timer = setTimeout(
+    () => controller.abort(new DOMException("Request timed out", "TimeoutError")),
+    timeoutMs
+  );
+  return {
+    signal: controller.signal,
+    dispose: () => {
+      clearTimeout(timer);
+      options.signal?.removeEventListener("abort", onCallerAbort);
+    }
+  };
+}
+async function awaitWithAbort(promise, signal) {
+  if (!signal) return await promise;
+  if (signal.aborted) {
+    throw signal.reason ?? new DOMException("Request aborted", "AbortError");
+  }
+  return await new Promise((resolve, reject) => {
+    const onAbort = () => {
+      cleanup();
+      reject(signal.reason ?? new DOMException("Request aborted", "AbortError"));
+    };
+    const cleanup = () => signal.removeEventListener("abort", onAbort);
+    signal.addEventListener("abort", onAbort, { once: true });
+    promise.then(
+      (value) => {
+        cleanup();
+        resolve(value);
+      },
+      (cause) => {
+        cleanup();
+        reject(cause);
+      }
+    );
+  });
+}
 async function apiErrorFromResponse(response, context) {
-  return new OpenGeniApiError(response.status, await readBoundedJsonErrorBody(response), {
+  const body = await readBoundedJsonErrorBody(response);
+  const ErrorType = allowanceExhaustedFields(body) ? OpenGeniAllowanceExhaustedError : OpenGeniApiError;
+  const error = new ErrorType(response.status, body, {
     correlationId: response.headers.get(OPENGENI_CORRELATION_HEADER) ?? context.correlationId,
     mutation: isMutationMethod(context.method)
   });
+  return error.status >= 400 && error.status < 500 && (error.code === "SESSION_TENANCY_NOT_ACTIVATED" || error.code === "OPENGENI_SETUP_REQUIRED") ? new OpenGeniSetupError(error) : error;
 }
 async function assertJsonResponse(response, context) {
   if (isJsonContentType(response.headers.get("content-type"))) return;
@@ -4547,7 +6602,7 @@ async function assertJsonResponse(response, context) {
     retryable: true,
     correlationId: response.headers.get(OPENGENI_CORRELATION_HEADER) ?? context.correlationId,
     outcomeUnknown: isMutationMethod(context.method),
-    displayMessage: "OpenGeni is temporarily unavailable \u2014 retry."
+    displayMessage: "Opengeni is temporarily unavailable \u2014 retry."
   });
 }
 async function readBoundedJsonErrorBody(response) {
@@ -4580,9 +6635,19 @@ function mutationTransportError(correlationId) {
     correlationId,
     outcomeUnknown: true,
     mutation: true,
-    displayMessage: "OpenGeni could not confirm the request \u2014 reconcile before retrying."
+    displayMessage: "Opengeni could not confirm the request \u2014 reconcile before retrying."
   });
 }
+function assertBrowserFileUploadSecureContext() {
+  const secureContext = typeof window !== "undefined" ? window.isSecureContext : typeof globalThis.isSecureContext === "boolean" ? globalThis.isSecureContext : void 0;
+  if (secureContext === void 0) return;
+  if (!secureContext) {
+    throw new OpenGeniSecureContextRequiredError("insecure_context");
+  }
+  if (typeof globalThis.crypto === "undefined" || typeof globalThis.crypto.subtle?.digest !== "function") {
+    throw new OpenGeniSecureContextRequiredError("web_crypto_unavailable");
+  }
+}
 async function sha256ForUpload(body) {
   const bytes = typeof body === "string" ? new TextEncoder().encode(body) : body instanceof Blob ? new Uint8Array(await body.arrayBuffer()) : new Uint8Array(body);
   const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes);
@@ -4593,12 +6658,21 @@ async function sha256Hex(bytes) {
   const digest = await globalThis.crypto.subtle.digest("SHA-256", owned.buffer);
   return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
+function computerFrameEvidenceMismatchReason(metadata, expected) {
+  if (metadata.computerSessionId !== expected.computerSessionId) {
+    return "frame_session_mismatch";
+  }
+  if (metadata.targetId !== expected.targetId) return "frame_target_mismatch";
+  if (metadata.mediaType !== expected.mediaType) return "frame_media_mismatch";
+  if (metadata.sha256 !== expected.sha256) return "frame_digest_mismatch";
+  return null;
+}
 async function cancelResponseBody(response, reason) {
   await response.body?.cancel(reason).catch(() => void 0);
 }
-function assertRetainedGeneratedImageReceipt(workspaceId, artifact) {
-  if (!parseRetainedGeneratedImageReference(artifact, workspaceId)) {
-    throw new OpenGeniApiError(502, "retained generated image receipt is invalid");
+function assertRetainedWorkspaceArtifactReceipt(workspaceId, artifact) {
+  if (!parseRetainedGeneratedImageReference(artifact, workspaceId) && !parseRetainedWorkspaceFileReference(artifact, workspaceId)) {
+    throw new OpenGeniApiError(502, "retained workspace artifact receipt is invalid");
   }
 }
 function assertSafeArtifactDownloadUrl(value) {
@@ -4669,12 +6743,13 @@ async function readBoundedResponseBytes(response, maxBytes, expectedBytes) {
 }
 
 export {
-  parseSseStream,
-  streamSessionEvents,
+  parseDeprecationNotice,
   streamWorkspaceControlEvents,
   streamWorkspaceInteractionRevisions,
   streamWorkspaceLiveEvents,
   parseWorkspaceLiveEvent,
+  parseRetainedWorkspaceFileReference,
+  parseSandboxFileArtifactReceipt,
   parseRetainedGeneratedImageReference,
   generatedImageSandboxPathMatches,
   parseGeneratedImageReceipt,
@@ -4683,4 +6758,4 @@ export {
   parseMediaGenerationResult,
   OpenGeniClient
 };
-//# sourceMappingURL=chunk-PKQ377ED.js.map
+//# sourceMappingURL=chunk-FG3OO5LM.js.map