@opengeni/sdk 0.57.0 → 2.2.0-canary.0

package/src/client.ts

@@ -163,14 +163,31 @@ import type {
   UninstallPluginResult,
   AddDocumentRequest,
   CreateKnowledgeDropRequest,
+  DocumentAuthorityReclassification,
+  DocumentDefaultCollectionBackfill,
+  ListDocumentAuthorityReclassificationsOptions,
+  ListDocumentAuthorityReclassificationsResponse,
   MoveDocumentRequest,
+  ReclassifyDocumentAuthorityRequest,
+  RunDocumentDefaultCollectionBackfillRequest,
   ClientConfig,
+  WorkspaceModelAccessPolicy,
   WorkspaceModelCatalogResponse,
   WorkspaceRealtimeModelCatalogResponse,
   ClientSessionEventInput,
+  UserMessageEventInput,
   CompactSessionContextResult,
   CompleteFileUploadResponse,
   ConnectionMetadata,
+  PersonalGitHubConnectionStatusResponse,
+  PersonalGitHubDisconnectRequest,
+  PersonalGitHubOAuthStartRequest,
+  PersonalGitHubOAuthStartResponse,
+  ListPersonalGitHubRepositoriesOptions,
+  ListPersonalGitHubRepositoriesResponse,
+  PersonalGitHubRepositorySelectionState,
+  ReplacePersonalGitHubRepositorySelectionsRequest,
+  VerifyPersonalGitHubRepositorySelectionsRequest,
   CreateApiKeyRequest,
   CreateApiKeyResponse,
   CreateCapabilityCatalogItemRequest,
@@ -178,6 +195,8 @@ import type {
   InstallLibrarySkillRequest,
   InstalledSkill,
   ListInstalledSkillsResponse,
+  CreateBillingPortalRequest,
+  CreateBillingPortalResponse,
   CreateCheckoutRequest,
   CreateCheckoutResponse,
   OpenGeniSlackBotInstallRequest,
@@ -201,6 +220,7 @@ import type {
   CreateWorkspaceRequest,
   // Enrollment UX (design 11): the click-Grant approve-page lookup/deny + headless
   // enroll-token mint.
+  DeviceEnrollmentApproveRequest,
   DeviceEnrollmentApproveResponse,
   DeviceEnrollmentDenyResponse,
   DeviceEnrollmentLookupResponse,
@@ -226,6 +246,29 @@ import type {
   KnowledgeMemorySearchRequest,
   ListApiKeysResponse,
   ListManagedOrganizationMembershipsResponse,
+  ListUserResourceAuthoritiesOptions,
+  ListUserResourceAuthoritiesResponse,
+  IssueUserResourceGrantRequest,
+  UserResourceGrantMutationResponse,
+  RevokeUserResourceGrantResponse,
+  ListOrganizationInvitationsPageResponse,
+  ListOrganizationMembersResponse,
+  AcceptOrganizationInvitationRequest,
+  AcceptOrganizationInvitationResponse,
+  AddOrganizationWorkspaceMemberRequest,
+  CreateOrganizationInvitationRequest,
+  CreateOrganizationRequest,
+  CreateOrganizationResponse,
+  CreateOrganizationWorkspaceRequest,
+  OrganizationInvitation,
+  OrganizationAdministrationOverview,
+  OrganizationMember,
+  OrganizationRetentionPolicy,
+  OrganizationSummary,
+  RevokeOrganizationInvitationRequest,
+  UpdateOrganizationMemberRequest,
+  UpdateOrganizationNameRequest,
+  UpdateOrganizationRetentionPolicyRequest,
   ListPacksResponse,
   // Bring-your-own-compute: the Machines dashboard + per-machine metrics (M10).
   MachinesResponse,
@@ -233,6 +276,9 @@ import type {
   MachineMetricsSeriesResponse,
   RemoveEnrollmentRequest,
   RemoveEnrollmentResponse,
+  MachineOperationPolicy,
+  UpdateMachineOperationPolicyRequest,
+  UpdateMachineAgentResponse,
   // Bring-your-own-compute: the user-authenticated active-sandbox swap (M7).
   SwapActiveSandboxRequest,
   SwapActiveSandboxResponse,
@@ -246,8 +292,6 @@ import type {
   ApproveSlackUserLinkAccessRequest,
   PackInstallation,
   PackUninstallPreview,
-  LatencyMode,
-  ReasoningEffort,
   RetainedScreenshotDownload,
   RetainedScreenshotDownloadOptions,
   RetainedArtifactDownload,
@@ -262,16 +306,24 @@ import type {
   VideoGenerationPolicy,
   WorkspaceVideoGenerationSettings,
   RegisterCapabilityPackRequest,
-  ResourceRef,
   PreviewPackInstallationRequest,
   PreviewSkillImportRequest,
   ScheduledTask,
   ScheduledTaskRun,
+  ForkSessionRequest,
+  ForkSessionResponse,
   Session,
+  SessionBackgroundCommandListResponse,
+  CancelSessionBackgroundCommandResult,
   SessionListResponse,
+  SessionTenancyCreateCapabilities,
   AgentTopologyPageResponse,
   UpdateSessionChannelRequest,
+  UpdateSessionAttentionRequest,
+  UpdateSessionArchiveRequest,
   UpdateSessionPinRequest,
+  UpdateSessionVisibilityRequest,
+  UpdateSessionVisibilityResponse,
   UninstallPackRequest,
   UninstallPackResult,
   SessionEvent,
@@ -281,24 +333,31 @@ import type {
   SessionEventPage,
   SessionGoal,
   SessionGoalRevision,
+  ListSessionGoalRevisionsOptions,
+  ListSessionGoalRevisionsResponse,
+  RejectSessionGoalRevisionRequest,
+  RejectSessionGoalRevisionResponse,
+  RollbackSessionGoalRevisionRequest,
   SessionHumanInputRequest,
   SessionLineageResponse,
   SessionRealtimeMutationResponse,
   SyncSessionRealtimeLedgerRequest,
   SyncSessionRealtimeLedgerResponse,
   RenewSessionRealtimeRequest,
-  SessionMcpCredentialUpdateInput,
-  SubmittedTimelineAnnotation,
   UpdateSessionMcpApprovalPolicyRequest,
   UpdateSessionMcpApprovalPolicyResponse,
   SessionQueueSnapshot,
   SessionQueueMutationResponse,
+  SessionCommandReceipt,
+  SessionPromptRouting,
   ComposerDraft,
   DeleteSessionQueueItemRequest,
   EditSessionQueueItemRequest,
   MoveSessionQueueItemRequest,
   NewSessionDraft,
   SaveComposerDraftRequest,
+  SubmitComposerDraftRequest,
+  SubmitComposerDraftResponse,
   SaveNewSessionDraftRequest,
   SteerSessionQueueItemRequest,
   SessionControlResponse,
@@ -321,6 +380,8 @@ import type {
   FsListBatchResponse,
   FsReadRequest,
   FsReadResponse,
+  PublishSandboxFileArtifactRequest,
+  SandboxFileArtifactReceipt,
   FsWriteRequest,
   FsWriteResponse,
   FsDeleteRequest,
@@ -349,7 +410,6 @@ import type {
   PtyWriteRequest,
   PtyResizeRequest,
   PtyCloseRequest,
-  ToolRef,
   TranscribeAudioResponse,
   TranscriptionRecordingListResponse,
   TranscriptionRecordingResponse,
@@ -364,6 +424,7 @@ import type {
   UpdateVariableSetRequest,
   UpdateRigRequest,
   UpdateWorkspaceMemberRequest,
+  UpdateWorkspaceModelAccessPolicyRequest,
   UpdateWorkspaceRequest,
   UpdateWorkspaceSettingsRequest,
   SetWorkspaceDefaultRigRequest,
@@ -373,6 +434,7 @@ import type {
   VariableSetVariableMetadata,
   Channel,
   CreateChannelRequest,
+  ReorderChannelsRequest,
   UpdateChannelRequest,
   Rig,
   RigVersion,
@@ -397,7 +459,10 @@ import type {
   UninstallSkillResult,
 } from "./types";
 import { GENERATED_VIDEO_MAX_BYTES } from "./types";
-import { parseRetainedGeneratedImageReference } from "./retained-artifacts";
+import {
+  parseRetainedGeneratedImageReference,
+  parseRetainedWorkspaceFileReference,
+} from "./retained-artifacts";
 import type {
   ActivateWorkspaceInstructionPolicyRequest,
   CreateWorkspaceInstructionPolicyDraftRequest,
@@ -414,6 +479,16 @@ import type {
   WorkspaceInstructionPolicyOnboardingProposalListResponse,
   WorkspaceInstructionPolicyRevision,
 } from "./workspace-instruction-policies";
+import type {
+  ActivateWorkspaceLearningPolicyRevisionRequest,
+  CreateWorkspaceLearningPolicyRevisionRequest,
+  GovernedLearningActivationUndoReceipt,
+  RollbackWorkspaceLearningPolicyRevisionRequest,
+  WorkspaceLearningHistoryOptions,
+  WorkspaceLearningHistoryResponse,
+  WorkspaceLearningPolicyMutationResponse,
+  WorkspaceLearningPolicyRevision,
+} from "./workspace-learning";
 import type {
   ActivateCompanyProfileRevisionRequest,
   CompanyProfileDiffRequest,
@@ -430,6 +505,7 @@ import type {
   WorkspaceStateGetOptions,
   WorkspaceStateResponse,
 } from "./workspace-state";
+import type { CompanyBrainOkfDownload, CompanyBrainOkfPackage } from "./company-brain";
 import type {
   ActivatePreferenceRegistryRevisionRequest,
   ChangePreferenceRegistryScopeRequest,
@@ -483,38 +559,42 @@ export type OpenGeniClientOptions = {
   headers?: Record<string, string> | (() => Record<string, string>);
   /** Custom fetch implementation. Defaults to the global `fetch`. */
   fetch?: FetchLike;
+  /** Positive deadline for interactive session commands. Defaults to 15 seconds. */
+  sessionCommandTimeoutMs?: number;
 };
 
 /** Per-request cancellation for operations whose caller owns an AbortSignal. */
 export type OpenGeniRequestOptions = {
   signal?: AbortSignal | undefined;
+  timeoutMs?: number | undefined;
 };
 
-export type SendMessageInput = {
-  text: string;
-  annotations?: SubmittedTimelineAnnotation[];
-  /** System instructions scoped to this exact turn; never visible timeline text. */
-  turnInstructions?: string;
-  resources?: ResourceRef[];
-  tools?: ToolRef[];
-  model?: string;
-  reasoningEffort?: ReasoningEffort;
-  latencyMode?: LatencyMode;
+/** Follow-up prompt fields accepted by both queue and Steer. Session tools are updated separately. */
+export type SendMessageInput = UserMessageEventInput["payload"] & {
   clientEventId?: string;
-  controlEtag?: string;
-  expectedDraftRevision?: number;
-  mcpCredentialUpdates?: SessionMcpCredentialUpdateInput[];
 };
 
+function assertNoMessageTools(input: object): void {
+  if (Object.prototype.hasOwnProperty.call(input, "tools")) {
+    throw new TypeError(
+      "Message-level tools are not supported; update the session tool policy before sending.",
+    );
+  }
+}
+
 export type SteerMessageResult = {
   /** The accepted `user.message` event. */
   accepted: SessionEvent;
   /** The exact turn created for this message in the same server transaction. */
   turn: SessionTurn;
+  /** Durable proof that this exact operation committed. */
+  receipt: SessionCommandReceipt;
+  /** Server-owned destination at admission time. */
+  routing: SessionPromptRouting;
   /** Number of live attempts durably asked to stop by this atomic Steer. */
-  interruptionCount?: number;
+  interruptionCount: number;
   /** True when this response came from the command's immutable idempotency receipt. */
-  replay?: boolean;
+  replay: boolean;
 };
 
 export type TranscribeAudioInput = {
@@ -555,6 +635,7 @@ export class OpenGeniClient {
   private readonly baseUrl: string;
   private readonly options: OpenGeniClientOptions;
   private readonly fetchImpl: FetchLike;
+  private readonly sessionCommandTimeoutMs: number;
   private readonly readInFlight = new Map<string, Promise<unknown>>();
   private readonly readTrailing = new Map<string, Promise<unknown>>();
   /** Resource-oriented Browser/Computer facade over this exact authenticated client. */
@@ -565,6 +646,11 @@ export class OpenGeniClient {
     this.options = options;
     // Bind lazily so variable sets that polyfill fetch after module load work.
     this.fetchImpl = options.fetch ?? ((input, init) => fetch(input, init));
+    const sessionCommandTimeoutMs = options.sessionCommandTimeoutMs ?? 15_000;
+    if (!Number.isFinite(sessionCommandTimeoutMs) || sessionCommandTimeoutMs <= 0) {
+      throw new RangeError("sessionCommandTimeoutMs must be a finite positive number");
+    }
+    this.sessionCommandTimeoutMs = sessionCommandTimeoutMs;
     this.interaction = new OpenGeniInteractionClient(this);
   }
 
@@ -836,6 +922,42 @@ export class OpenGeniClient {
     );
   }
 
+  /** Whether this exact authenticated principal may atomically create a private session. */
+  async getSessionTenancyCreateCapabilities(
+    workspaceId: string,
+  ): Promise<SessionTenancyCreateCapabilities> {
+    return await this.requestJson<SessionTenancyCreateCapabilities>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/session-tenancy/capabilities`,
+    );
+  }
+
+  /** Change an owned, fully quiescent session between private and workspace visibility. */
+  async updateSessionVisibility(
+    workspaceId: string,
+    sessionId: string,
+    request: UpdateSessionVisibilityRequest,
+  ): Promise<UpdateSessionVisibilityResponse> {
+    return await this.requestJson<UpdateSessionVisibilityResponse>(
+      "PUT",
+      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/visibility`,
+      request,
+    );
+  }
+
+  /** Create an independent same-workspace fork with explicit destination visibility. */
+  async forkSession(
+    workspaceId: string,
+    sessionId: string,
+    request: ForkSessionRequest,
+  ): Promise<ForkSessionResponse> {
+    return await this.requestJson<ForkSessionResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/forks`,
+      request,
+    );
+  }
+
   /** Replace the durable tool policy or explicitly adopt workspace defaults. */
   async updateSessionToolPolicy(
     workspaceId: string,
@@ -893,6 +1015,27 @@ export class OpenGeniClient {
     );
   }
 
+  async listSessionBackgroundCommands(
+    workspaceId: string,
+    sessionId: string,
+  ): Promise<SessionBackgroundCommandListResponse> {
+    return await this.requestJson<SessionBackgroundCommandListResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/background-commands`,
+    );
+  }
+
+  async cancelSessionBackgroundCommand(
+    workspaceId: string,
+    sessionId: string,
+    commandId: string,
+  ): Promise<CancelSessionBackgroundCommandResult> {
+    return await this.requestJson<CancelSessionBackgroundCommandResult>(
+      "DELETE",
+      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/background-commands/${commandId}`,
+    );
+  }
+
   /** Pin-aware ordinary-session page with a stable keyset cursor. */
   async listSessionPage(
     workspaceId: string,
@@ -903,6 +1046,8 @@ export class OpenGeniClient {
       search?: string;
       /** Return only the complete personal pinned projection. */
       pinsOnly?: boolean;
+      /** Return archived root chats instead of the active session list. */
+      archivedOnly?: boolean;
     } = {},
   ): Promise<SessionListResponse> {
     const search = options.search?.trim();
@@ -918,6 +1063,7 @@ export class OpenGeniClient {
           ...(options.cursor !== undefined ? { cursor: options.cursor } : {}),
           ...(search ? { search } : {}),
           ...(options.pinsOnly ? { pinsOnly: "true" } : {}),
+          ...(options.archivedOnly ? { archivedOnly: "true" } : {}),
         },
       );
     } catch (error) {
@@ -949,6 +1095,9 @@ export class OpenGeniClient {
       if (options.pinsOnly) {
         throw new Error("The connected OpenGeni API does not support pins-only session lists");
       }
+      if (options.archivedOnly) {
+        throw new Error("The connected OpenGeni API does not support archived session lists");
+      }
       return { pinned: [], sessions: response, nextCursor: null };
     }
     return response;
@@ -993,6 +1142,43 @@ export class OpenGeniClient {
     );
   }
 
+  /** Set this authenticated member's explicit read/actively-working state. */
+  async updateSessionAttention(
+    workspaceId: string,
+    sessionId: string,
+    request: UpdateSessionAttentionRequest,
+  ): Promise<Session> {
+    return await this.requestJson<Session>(
+      "PUT",
+      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/attention`,
+      request,
+    );
+  }
+
+  /** Archive or restore this authenticated member's root chat. */
+  async updateSessionArchive(
+    workspaceId: string,
+    sessionId: string,
+    request: UpdateSessionArchiveRequest,
+  ): Promise<Session> {
+    return await this.requestJson<Session>(
+      "PUT",
+      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/archive`,
+      request,
+    );
+  }
+
+  /** Permanently delete one quiescent root session and its full descendant tree. */
+  async deleteSession(
+    workspaceId: string,
+    sessionId: string,
+  ): Promise<{ deletedSessionCount: number }> {
+    return await this.requestJson<{ deletedSessionCount: number }>(
+      "DELETE",
+      `/v1/workspaces/${workspaceId}/sessions/${sessionId}`,
+    );
+  }
+
   async getSessionLineage(workspaceId: string, sessionId: string): Promise<SessionLineageResponse> {
     const path = `/v1/workspaces/${workspaceId}/sessions/${sessionId}/lineage`;
     return await this.singleFlightRead(path, () =>
@@ -1196,6 +1382,33 @@ export class OpenGeniClient {
     );
   }
 
+  /** Ask one authoritative Connected Machine runner to drain accepted work and
+   * install the exact signed version promoted for its channel. Progress is read
+   * from `listMachines`; completion requires the successor build identity. */
+  async updateMachineAgent(
+    workspaceId: string,
+    enrollmentId: string,
+  ): Promise<UpdateMachineAgentResponse> {
+    return await this.requestJson<UpdateMachineAgentResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/machines/${enrollmentId}/update`,
+    );
+  }
+
+  /** Revision-fenced update of a Connected Machine's optional command memory
+   * policy. Null byte limits preserve unrestricted machine access. */
+  async updateMachineOperationPolicy(
+    workspaceId: string,
+    enrollmentId: string,
+    request: UpdateMachineOperationPolicyRequest,
+  ): Promise<MachineOperationPolicy> {
+    return await this.requestJson<MachineOperationPolicy>(
+      "PATCH",
+      `/v1/workspaces/${workspaceId}/machines/${enrollmentId}/operation-policy`,
+      request,
+    );
+  }
+
   /**
    * Read the downsampled (~1/min) metrics series for ONE machine over a time
    * window (default 1h). The samples are oldest-first (a left-to-right chart).
@@ -1217,8 +1430,9 @@ export class OpenGeniClient {
   /**
    * Remove one connected self-hosted machine enrollment. The control-plane
    * operation works while the agent is offline, revokes future reconnects,
-   * retains history, and returns a typed blocker when active route/lease or
-   * recovery dependencies make removal unsafe. `idempotencyKey` is replay-safe.
+   * retains history, and atomically detaches idle dependent sessions (a
+   * machine-home session becomes `backend:none`). Active turns, live leases,
+   * and recovery work remain typed blockers. `idempotencyKey` is replay-safe.
    */
   async removeEnrollment(
     workspaceId: string,
@@ -1258,7 +1472,7 @@ export class OpenGeniClient {
    */
   async approveDeviceEnrollment(
     workspaceId: string,
-    request: { userCode: string; allowScreenControl?: boolean },
+    request: DeviceEnrollmentApproveRequest,
   ): Promise<DeviceEnrollmentApproveResponse> {
     return await this.requestJson<DeviceEnrollmentApproveResponse>(
       "POST",
@@ -1266,6 +1480,7 @@ export class OpenGeniClient {
       {
         userCode: request.userCode,
         allowScreenControl: request.allowScreenControl ?? false,
+        ...(request.scope ? { scope: request.scope } : {}),
       },
     );
   }
@@ -1498,7 +1713,7 @@ export class OpenGeniClient {
     sessionId: string,
     event: ClientSessionEventInput,
   ): Promise<SessionEvent> {
-    return await this.requestJson<SessionEvent>(
+    return await this.requestSessionCommand<SessionEvent>(
       "POST",
       `/v1/workspaces/${workspaceId}/sessions/${sessionId}/events`,
       event,
@@ -1511,6 +1726,7 @@ export class OpenGeniClient {
     message: string | SendMessageInput,
   ): Promise<SessionEvent> {
     const input = typeof message === "string" ? { text: message } : message;
+    assertNoMessageTools(input);
     const { clientEventId, ...payload } = input;
     return await this.sendEvent(workspaceId, sessionId, {
       type: "user.message",
@@ -1656,7 +1872,7 @@ export class OpenGeniClient {
   async getQueue(workspaceId: string, sessionId: string): Promise<SessionQueueSnapshot> {
     const path = `/v1/workspaces/${workspaceId}/sessions/${sessionId}/queue`;
     return await this.singleFlightRead(path, () =>
-      this.requestJson<SessionQueueSnapshot>("GET", path),
+      this.requestSessionCommand<SessionQueueSnapshot>("GET", path),
     );
   }
 
@@ -1666,7 +1882,7 @@ export class OpenGeniClient {
     turnId: string,
     request: MoveSessionQueueItemRequest,
   ): Promise<SessionQueueMutationResponse> {
-    return await this.requestJson<SessionQueueMutationResponse>(
+    return await this.requestSessionCommand<SessionQueueMutationResponse>(
       "POST",
       `/v1/workspaces/${workspaceId}/sessions/${sessionId}/queue/${turnId}/move`,
       request,
@@ -1679,7 +1895,7 @@ export class OpenGeniClient {
     turnId: string,
     request: EditSessionQueueItemRequest,
   ): Promise<SessionQueueMutationResponse> {
-    return await this.requestJson<SessionQueueMutationResponse>(
+    return await this.requestSessionCommand<SessionQueueMutationResponse>(
       "POST",
       `/v1/workspaces/${workspaceId}/sessions/${sessionId}/queue/${turnId}/edit`,
       request,
@@ -1692,7 +1908,7 @@ export class OpenGeniClient {
     turnId: string,
     request: SteerSessionQueueItemRequest,
   ): Promise<SessionQueueMutationResponse> {
-    return await this.requestJson<SessionQueueMutationResponse>(
+    return await this.requestSessionCommand<SessionQueueMutationResponse>(
       "POST",
       `/v1/workspaces/${workspaceId}/sessions/${sessionId}/queue/${turnId}/steer`,
       request,
@@ -1705,7 +1921,7 @@ export class OpenGeniClient {
     turnId: string,
     request: DeleteSessionQueueItemRequest,
   ): Promise<SessionQueueMutationResponse> {
-    return await this.requestJson<SessionQueueMutationResponse>(
+    return await this.requestSessionCommand<SessionQueueMutationResponse>(
       "POST",
       `/v1/workspaces/${workspaceId}/sessions/${sessionId}/queue/${turnId}/delete`,
       request,
@@ -1713,7 +1929,7 @@ export class OpenGeniClient {
   }
 
   async getComposerDraft(workspaceId: string, sessionId: string): Promise<ComposerDraft> {
-    return await this.requestJson<ComposerDraft>(
+    return await this.requestSessionCommand<ComposerDraft>(
       "GET",
       `/v1/workspaces/${workspaceId}/sessions/${sessionId}/composer-draft`,
     );
@@ -1724,13 +1940,25 @@ export class OpenGeniClient {
     sessionId: string,
     request: SaveComposerDraftRequest,
   ): Promise<ComposerDraft> {
-    return await this.requestJson<ComposerDraft>(
+    return await this.requestSessionCommand<ComposerDraft>(
       "PUT",
       `/v1/workspaces/${workspaceId}/sessions/${sessionId}/composer-draft`,
       request,
     );
   }
 
+  async submitComposerDraft(
+    workspaceId: string,
+    sessionId: string,
+    request: SubmitComposerDraftRequest,
+  ): Promise<SubmitComposerDraftResponse> {
+    return await this.requestSessionCommand<SubmitComposerDraftResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/composer-draft/submit`,
+      request,
+    );
+  }
+
   async controlSession(
     workspaceId: string,
     sessionId: string,
@@ -1741,7 +1969,7 @@ export class OpenGeniClient {
       expectedControlEtag?: string;
     },
   ): Promise<SessionControlResponse> {
-    return await this.requestJson<SessionControlResponse>(
+    return await this.requestSessionCommand<SessionControlResponse>(
       "POST",
       `/v1/workspaces/${workspaceId}/sessions/${sessionId}/control`,
       request,
@@ -1966,7 +2194,8 @@ export class OpenGeniClient {
     message: string | SendMessageInput,
   ): Promise<SteerMessageResult> {
     const input = typeof message === "string" ? { text: message } : message;
-    return await this.requestJson<SteerMessageResult>(
+    assertNoMessageTools(input);
+    return await this.requestSessionCommand<SteerMessageResult>(
       "POST",
       `/v1/workspaces/${workspaceId}/sessions/${sessionId}/steer`,
       input,
@@ -2000,6 +2229,47 @@ export class OpenGeniClient {
     );
   }
 
+  async listGoalRevisionPage(
+    workspaceId: string,
+    sessionId: string,
+    options: ListSessionGoalRevisionsOptions = {},
+  ): Promise<ListSessionGoalRevisionsResponse> {
+    const query = new URLSearchParams();
+    if (options.limit !== undefined) query.set("limit", String(options.limit));
+    if (options.before !== undefined) query.set("before", options.before);
+    const suffix = query.size > 0 ? `?${query.toString()}` : "";
+    return await this.requestJson<ListSessionGoalRevisionsResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/goal/revisions/page${suffix}`,
+    );
+  }
+
+  async rejectGoalRevision(
+    workspaceId: string,
+    sessionId: string,
+    revisionId: string,
+    request: RejectSessionGoalRevisionRequest,
+  ): Promise<RejectSessionGoalRevisionResponse> {
+    return await this.requestJson<RejectSessionGoalRevisionResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/goal/revisions/${revisionId}/reject`,
+      request,
+    );
+  }
+
+  async rollbackGoalRevision(
+    workspaceId: string,
+    sessionId: string,
+    revisionId: string,
+    request: RollbackSessionGoalRevisionRequest,
+  ): Promise<SessionGoal> {
+    return await this.requestJson<SessionGoal>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/goal/revisions/${revisionId}/rollback`,
+      request,
+    );
+  }
+
   async applyGoalRevision(
     workspaceId: string,
     sessionId: string,
@@ -2116,6 +2386,22 @@ export class OpenGeniClient {
     );
   }
 
+  /** Publish one exact sandbox file into permanent workspace artifact storage. */
+  async publishSandboxFileArtifact(
+    workspaceId: string,
+    sessionId: string,
+    request: PublishSandboxFileArtifactRequest,
+    options: OpenGeniRequestOptions = {},
+  ): Promise<SandboxFileArtifactReceipt> {
+    return await this.requestJson<SandboxFileArtifactReceipt>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/artifacts/publish`,
+      request,
+      {},
+      options,
+    );
+  }
+
   /** FileSystem: write a file (last-writer-wins; emits fs.changed). */
   async fsWrite(
     workspaceId: string,
@@ -3384,6 +3670,26 @@ export class OpenGeniClient {
     );
   }
 
+  /** Read the workspace's hard provider/model allowlist. */
+  async getWorkspaceModelAccessPolicy(workspaceId: string): Promise<WorkspaceModelAccessPolicy> {
+    return await this.requestJson<WorkspaceModelAccessPolicy>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/model-policy`,
+    );
+  }
+
+  /** Fully replace the workspace's hard provider/model allowlist. */
+  async updateWorkspaceModelAccessPolicy(
+    workspaceId: string,
+    request: UpdateWorkspaceModelAccessPolicyRequest,
+  ): Promise<WorkspaceModelAccessPolicy> {
+    return await this.requestJson<WorkspaceModelAccessPolicy>(
+      "PUT",
+      `/v1/workspaces/${workspaceId}/model-policy`,
+      request,
+    );
+  }
+
   /** Authenticated realtime voice models and credential readiness. */
   async getWorkspaceRealtimeModelCatalog(
     workspaceId: string,
@@ -3407,6 +3713,258 @@ export class OpenGeniClient {
     );
   }
 
+  /** Bounded owner-only personal-resource authority page for one exact resource kind. */
+  async listUserResourceAuthorities(
+    workspaceId: string,
+    options: ListUserResourceAuthoritiesOptions,
+  ): Promise<ListUserResourceAuthoritiesResponse> {
+    const query = new URLSearchParams({
+      scope: "user",
+      resourceKind: options.resourceKind,
+    });
+    if (options.cursor) query.set("cursor", options.cursor);
+    if (options.limit !== undefined) query.set("limit", String(options.limit));
+    return await this.requestJson<ListUserResourceAuthoritiesResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/user-resource-authorities?${query.toString()}`,
+    );
+  }
+
+  /** Issue an exact-session or standing personal-resource grant. */
+  async issueUserResourceGrant(
+    workspaceId: string,
+    authorityId: string,
+    request: IssueUserResourceGrantRequest,
+  ): Promise<UserResourceGrantMutationResponse> {
+    return await this.requestJson<UserResourceGrantMutationResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/user-resource-authorities/${authorityId}/grants`,
+      request,
+    );
+  }
+
+  /** Revoke an owner grant through the exact workspace it targets. */
+  async revokeUserResourceGrant(
+    workspaceId: string,
+    grantId: string,
+  ): Promise<RevokeUserResourceGrantResponse> {
+    return await this.requestJson<RevokeUserResourceGrantResponse>(
+      "DELETE",
+      `/v1/workspaces/${workspaceId}/user-resource-authorities/grants/${grantId}?scope=user`,
+    );
+  }
+
+  /** Create a new organization owned by the current managed human. */
+  async createOrganization(
+    request: CreateOrganizationRequest,
+  ): Promise<CreateOrganizationResponse> {
+    return await this.requestJson<CreateOrganizationResponse>("POST", "/v1/organizations", request);
+  }
+
+  /** Pending and historical invitations addressed to the current managed human. */
+  async listOrganizationInvitations(
+    options: { cursor?: string; limit?: number } = {},
+  ): Promise<ListOrganizationInvitationsPageResponse> {
+    const query = new URLSearchParams();
+    if (options.cursor) query.set("cursor", options.cursor);
+    if (options.limit !== undefined) query.set("limit", String(options.limit));
+    const suffix = query.size > 0 ? `?${query.toString()}` : "";
+    return await this.requestJson<ListOrganizationInvitationsPageResponse>(
+      "GET",
+      `/v1/organization-invitations${suffix}`,
+    );
+  }
+
+  /** Admin-only deterministic page of invitations for one organization. */
+  async listOrganizationInvitationsForOrganization(
+    organizationId: string,
+    options: { cursor?: string; limit?: number } = {},
+  ): Promise<ListOrganizationInvitationsPageResponse> {
+    const query = new URLSearchParams();
+    if (options.cursor) query.set("cursor", options.cursor);
+    if (options.limit !== undefined) query.set("limit", String(options.limit));
+    const suffix = query.size > 0 ? `?${query.toString()}` : "";
+    return await this.requestJson<ListOrganizationInvitationsPageResponse>(
+      "GET",
+      `/v1/organizations/${organizationId}/invitations${suffix}`,
+    );
+  }
+
+  async createOrganizationInvitation(
+    organizationId: string,
+    request: CreateOrganizationInvitationRequest,
+  ): Promise<OrganizationInvitation> {
+    return await this.requestJson<OrganizationInvitation>(
+      "POST",
+      `/v1/organizations/${organizationId}/invitations`,
+      request,
+    );
+  }
+
+  async acceptOrganizationInvitation(
+    invitationId: string,
+    request: AcceptOrganizationInvitationRequest,
+  ): Promise<AcceptOrganizationInvitationResponse> {
+    return await this.requestJson<AcceptOrganizationInvitationResponse>(
+      "POST",
+      `/v1/organization-invitations/${invitationId}/accept`,
+      request,
+    );
+  }
+
+  async revokeOrganizationInvitation(
+    organizationId: string,
+    invitationId: string,
+    request: RevokeOrganizationInvitationRequest,
+  ): Promise<OrganizationInvitation> {
+    return await this.requestJson<OrganizationInvitation>(
+      "POST",
+      `/v1/organizations/${organizationId}/invitations/${invitationId}/revoke`,
+      request,
+    );
+  }
+
+  async listOrganizationMembers(organizationId: string): Promise<ListOrganizationMembersResponse> {
+    return await this.requestJson<ListOrganizationMembersResponse>(
+      "GET",
+      `/v1/organizations/${organizationId}/members`,
+    );
+  }
+
+  /** Canonical organization identity and every non-personal workspace access roster. */
+  async getOrganizationAdministrationOverview(
+    organizationId: string,
+  ): Promise<OrganizationAdministrationOverview> {
+    return await this.requestJson<OrganizationAdministrationOverview>(
+      "GET",
+      `/v1/organizations/${organizationId}/overview`,
+    );
+  }
+
+  /** Rename the organization under an exact optimistic-concurrency fence. */
+  async updateOrganizationName(
+    organizationId: string,
+    request: UpdateOrganizationNameRequest,
+  ): Promise<OrganizationSummary> {
+    return await this.requestJson<OrganizationSummary>(
+      "PATCH",
+      `/v1/organizations/${organizationId}`,
+      request,
+    );
+  }
+
+  /**
+   * Organization control-plane update for a shared workspace. This does not
+   * require or create operational workspace access for the organization admin.
+   */
+  async updateOrganizationWorkspace(
+    organizationId: string,
+    workspaceId: string,
+    request: UpdateWorkspaceRequest,
+  ): Promise<Workspace> {
+    return await this.requestJson<Workspace>(
+      "PATCH",
+      `/v1/organizations/${organizationId}/workspaces/${workspaceId}`,
+      request,
+    );
+  }
+
+  /** Create a shared workspace without implicitly granting the actor access. */
+  async createOrganizationWorkspace(
+    organizationId: string,
+    request: CreateOrganizationWorkspaceRequest,
+  ): Promise<Workspace> {
+    return await this.requestJson<Workspace>(
+      "POST",
+      `/v1/organizations/${organizationId}/workspaces`,
+      request,
+    );
+  }
+
+  async updateOrganizationWorkspaceSettings(
+    organizationId: string,
+    workspaceId: string,
+    request: UpdateWorkspaceSettingsRequest,
+  ): Promise<Workspace> {
+    return await this.requestJson<Workspace>(
+      "PATCH",
+      `/v1/organizations/${organizationId}/workspaces/${workspaceId}/settings`,
+      request,
+    );
+  }
+
+  async addOrganizationWorkspaceMember(
+    organizationId: string,
+    workspaceId: string,
+    request: AddOrganizationWorkspaceMemberRequest,
+  ): Promise<WorkspaceMember> {
+    return await this.requestJson<WorkspaceMember>(
+      "POST",
+      `/v1/organizations/${organizationId}/workspaces/${workspaceId}/members`,
+      request,
+    );
+  }
+
+  async updateOrganizationWorkspaceMember(
+    organizationId: string,
+    workspaceId: string,
+    subjectId: string,
+    request: UpdateWorkspaceMemberRequest,
+  ): Promise<WorkspaceMember> {
+    return await this.requestJson<WorkspaceMember>(
+      "PATCH",
+      `/v1/organizations/${organizationId}/workspaces/${workspaceId}/members/${encodeURIComponent(
+        subjectId,
+      )}`,
+      request,
+    );
+  }
+
+  async removeOrganizationWorkspaceMember(
+    organizationId: string,
+    workspaceId: string,
+    subjectId: string,
+  ): Promise<void> {
+    await this.requestVoid(
+      "DELETE",
+      `/v1/organizations/${organizationId}/workspaces/${workspaceId}/members/${encodeURIComponent(
+        subjectId,
+      )}`,
+    );
+  }
+
+  async updateOrganizationMember(
+    organizationId: string,
+    membershipId: string,
+    request: UpdateOrganizationMemberRequest,
+  ): Promise<OrganizationMember> {
+    return await this.requestJson<OrganizationMember>(
+      "PATCH",
+      `/v1/organizations/${organizationId}/members/${membershipId}`,
+      request,
+    );
+  }
+
+  async getOrganizationRetentionPolicy(
+    organizationId: string,
+  ): Promise<OrganizationRetentionPolicy> {
+    return await this.requestJson<OrganizationRetentionPolicy>(
+      "GET",
+      `/v1/organizations/${organizationId}/retention-policy`,
+    );
+  }
+
+  async updateOrganizationRetentionPolicy(
+    organizationId: string,
+    request: UpdateOrganizationRetentionPolicyRequest,
+  ): Promise<OrganizationRetentionPolicy> {
+    return await this.requestJson<OrganizationRetentionPolicy>(
+      "PATCH",
+      `/v1/organizations/${organizationId}/retention-policy`,
+      request,
+    );
+  }
+
   async listWorkspaces(): Promise<Workspace[]> {
     return await this.requestJson<Workspace[]>("GET", "/v1/workspaces");
   }
@@ -3447,6 +4005,28 @@ export class OpenGeniClient {
     );
   }
 
+  /** Permission-filtered Company Brain package with authorized guidance bodies. */
+  getCompanyBrain(workspaceId: string): Promise<CompanyBrainOkfPackage> {
+    return this.requestJson<CompanyBrainOkfPackage>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/company-brain`,
+    );
+  }
+
+  /** Download the deterministic Markdown/YAML Company Brain package. */
+  async exportCompanyBrainOkf(workspaceId: string): Promise<CompanyBrainOkfDownload> {
+    const response = await this.requestResponse(
+      "GET",
+      `/v1/workspaces/${workspaceId}/company-brain/export`,
+    );
+    const headers = response.headers;
+    return {
+      content: await response.text(),
+      contentType: headers.get("content-type") ?? "text/markdown",
+      filename: headers.get("content-disposition")?.split('"')[1] ?? "company-brain.okf.md",
+    };
+  }
+
   async updateWorkspace(workspaceId: string, request: UpdateWorkspaceRequest): Promise<Workspace> {
     return await this.requestJson<Workspace>("PATCH", `/v1/workspaces/${workspaceId}`, request);
   }
@@ -3471,6 +4051,66 @@ export class OpenGeniClient {
     );
   }
 
+  /** Inspect the bounded, permission-filtered governed-learning timeline. */
+  async getWorkspaceLearningHistory(
+    workspaceId: string,
+    options: WorkspaceLearningHistoryOptions = {},
+  ): Promise<WorkspaceLearningHistoryResponse> {
+    const params = new URLSearchParams();
+    if (options.limit !== undefined) params.set("limit", String(options.limit));
+    const query = params.toString();
+    return await this.requestJson<WorkspaceLearningHistoryResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/learning${query ? `?${query}` : ""}`,
+    );
+  }
+
+  async createWorkspaceLearningPolicyRevision(
+    workspaceId: string,
+    request: CreateWorkspaceLearningPolicyRevisionRequest,
+  ): Promise<WorkspaceLearningPolicyRevision> {
+    return await this.requestJson<WorkspaceLearningPolicyRevision>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/learning/revisions`,
+      request,
+    );
+  }
+
+  async activateWorkspaceLearningPolicyRevision(
+    workspaceId: string,
+    revisionId: string,
+    request: ActivateWorkspaceLearningPolicyRevisionRequest,
+  ): Promise<WorkspaceLearningPolicyMutationResponse> {
+    return await this.requestJson<WorkspaceLearningPolicyMutationResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/learning/revisions/${encodeURIComponent(revisionId)}/activate`,
+      request,
+    );
+  }
+
+  async rollbackWorkspaceLearningPolicyRevision(
+    workspaceId: string,
+    request: RollbackWorkspaceLearningPolicyRevisionRequest,
+  ): Promise<WorkspaceLearningPolicyMutationResponse> {
+    return await this.requestJson<WorkspaceLearningPolicyMutationResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/learning/rollback`,
+      request,
+    );
+  }
+
+  async undoGovernedLearningActivation(
+    workspaceId: string,
+    activationReceiptId: string,
+    request: { operationId?: string } = {},
+  ): Promise<GovernedLearningActivationUndoReceipt> {
+    return await this.requestJson<GovernedLearningActivationUndoReceipt>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/learning/activations/${encodeURIComponent(activationReceiptId)}/undo`,
+      request,
+    );
+  }
+
   async getWorkspaceInstructionPolicyRevision(
     workspaceId: string,
     revisionId: string,
@@ -4092,6 +4732,14 @@ export class OpenGeniClient {
     );
   }
 
+  async reorderChannels(workspaceId: string, request: ReorderChannelsRequest): Promise<Channel[]> {
+    return await this.requestJson<Channel[]>(
+      "PUT",
+      `/v1/workspaces/${workspaceId}/channels/order`,
+      request,
+    );
+  }
+
   async deleteChannel(workspaceId: string, channelId: string): Promise<void> {
     await this.requestJson<unknown>(
       "DELETE",
@@ -4460,24 +5108,24 @@ export class OpenGeniClient {
     );
   }
 
-  /** Assemble one permanent generated-image receipt from bounded authenticated ranges. */
+  /** Assemble one permanent image or file artifact from bounded authenticated ranges. */
   async downloadRetainedArtifact(
     workspaceId: string,
     artifact: RetainedArtifactReference,
     options: RetainedArtifactDownloadOptions = {},
   ): Promise<RetainedArtifactDownload> {
-    assertRetainedGeneratedImageReceipt(workspaceId, artifact);
+    assertRetainedWorkspaceArtifactReceipt(workspaceId, artifact);
     const bytes = await this.downloadRetainedArtifactBytes(artifact, options);
     return { artifact, bytes };
   }
 
-  /** Mint a short-lived, zero-copy browser source for a validated generated image. */
+  /** Mint a short-lived, zero-copy browser source for a validated workspace artifact. */
   async createRetainedArtifactDownloadUrl(
     workspaceId: string,
     artifact: RetainedArtifactReference,
     options: OpenGeniRequestOptions = {},
   ): Promise<FileDownloadUrlResponse> {
-    assertRetainedGeneratedImageReceipt(workspaceId, artifact);
+    assertRetainedWorkspaceArtifactReceipt(workspaceId, artifact);
     const download = await this.createFileDownloadUrl(workspaceId, artifact.artifactId, options);
     assertSafeArtifactDownloadUrl(download);
     return download;
@@ -4741,6 +5389,34 @@ export class OpenGeniClient {
     );
   }
 
+  /**
+   * List every Document the current human can manage from this workspace,
+   * including portable personal and organization-scoped Documents whose
+   * immutable ingestion workspace is different.
+   */
+  async listAccessibleDocuments(workspaceId: string): Promise<Document[]> {
+    return await this.requestJson<Document[]>("GET", `/v1/workspaces/${workspaceId}/documents`);
+  }
+
+  /** Read the immutable source file through the Document's effective authority. */
+  async getDocumentOriginalFile(workspaceId: string, documentId: string): Promise<FileAsset> {
+    return await this.requestJson<FileAsset>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/documents/${documentId}/original-file`,
+    );
+  }
+
+  /** Mint a source-file URL through the Document's effective authority. */
+  async createDocumentOriginalFileDownloadUrl(
+    workspaceId: string,
+    documentId: string,
+  ): Promise<FileDownloadUrlResponse> {
+    return await this.requestJson<FileDownloadUrlResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/documents/${documentId}/original-file/download-url`,
+    );
+  }
+
   /**
    * Drop raw text or an already-uploaded file into the workspace's Default
    * base. When curation is enabled, it may name, summarize, categorize, and
@@ -4774,6 +5450,53 @@ export class OpenGeniClient {
     );
   }
 
+  /**
+   * Atomically reclassify a Document's authority and every indexed chunk.
+   * The operation is replay-safe and rejects a stale expected authority tuple.
+   */
+  async reclassifyDocumentAuthority(
+    workspaceId: string,
+    documentId: string,
+    request: ReclassifyDocumentAuthorityRequest,
+  ): Promise<DocumentAuthorityReclassification> {
+    return await this.requestJson<DocumentAuthorityReclassification>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/documents/${documentId}/authority-reclassifications`,
+      request,
+    );
+  }
+
+  /** List the current actor's durable authority-reclassification receipts. */
+  async listDocumentAuthorityReclassifications(
+    workspaceId: string,
+    documentId: string,
+    options: ListDocumentAuthorityReclassificationsOptions = {},
+  ): Promise<ListDocumentAuthorityReclassificationsResponse> {
+    const params = new URLSearchParams();
+    if (options.limit !== undefined) params.set("limit", String(options.limit));
+    if (options.cursor) params.set("cursor", options.cursor);
+    const query = params.size > 0 ? `?${params.toString()}` : "";
+    return await this.requestJson<ListDocumentAuthorityReclassificationsResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/documents/${documentId}/authority-reclassifications${query}`,
+    );
+  }
+
+  /**
+   * Advance one resumable, organization-scoped Default collection backfill.
+   * Reusing an operation ID is idempotent; keep the run ID across batches.
+   */
+  async runDocumentDefaultCollectionBackfill(
+    workspaceId: string,
+    request: RunDocumentDefaultCollectionBackfillRequest,
+  ): Promise<DocumentDefaultCollectionBackfill> {
+    return await this.requestJson<DocumentDefaultCollectionBackfill>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/document-default-collection-backfills`,
+      request,
+    );
+  }
+
   /** Retry indexing for a failed document. */
   async reindexDocument(
     workspaceId: string,
@@ -5389,6 +6112,96 @@ export class OpenGeniClient {
     return response.connections;
   }
 
+  /** Secret-free status for the caller's exact personal GitHub connection. */
+  async personalGitHubStatus(workspaceId: string): Promise<PersonalGitHubConnectionStatusResponse> {
+    return await this.requestJson<PersonalGitHubConnectionStatusResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/connections/github`,
+    );
+  }
+
+  /** Start the dedicated personal GitHub authorization-code + PKCE flow. */
+  async startPersonalGitHubOAuth(
+    workspaceId: string,
+    request: Omit<PersonalGitHubOAuthStartRequest, "connectionId"> = {},
+  ): Promise<PersonalGitHubOAuthStartResponse> {
+    return await this.requestJson<PersonalGitHubOAuthStartResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/connections/github/oauth/start`,
+      request,
+    );
+  }
+
+  /** Re-authorize one exact personal GitHub Connection generation in place. */
+  async reconnectPersonalGitHub(
+    workspaceId: string,
+    connectionId: string,
+    request: Omit<PersonalGitHubOAuthStartRequest, "connectionId"> = {},
+  ): Promise<PersonalGitHubOAuthStartResponse> {
+    return await this.requestJson<PersonalGitHubOAuthStartResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/connections/${connectionId}/github/reconnect`,
+      request,
+    );
+  }
+
+  /** Revoke one exact generation through an idempotent owner-only disconnect. */
+  async disconnectPersonalGitHub(
+    workspaceId: string,
+    connectionId: string,
+    request: PersonalGitHubDisconnectRequest,
+  ): Promise<ConnectionMetadata> {
+    const response = await this.requestJson<ConnectionResponse>(
+      "DELETE",
+      `/v1/workspaces/${workspaceId}/connections/${connectionId}`,
+      request,
+    );
+    return response.connection;
+  }
+
+  /** Browse one bounded page of repositories visible to one exact owner connection. */
+  async listPersonalGitHubRepositories(
+    workspaceId: string,
+    connectionId: string,
+    options: ListPersonalGitHubRepositoriesOptions = {},
+  ): Promise<ListPersonalGitHubRepositoriesResponse> {
+    return await this.requestJson<ListPersonalGitHubRepositoriesResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/connections/${connectionId}/github/repositories`,
+      undefined,
+      {
+        ...(options.cursor !== undefined ? { cursor: String(options.cursor) } : {}),
+        ...(options.limit !== undefined ? { limit: String(options.limit) } : {}),
+      },
+    );
+  }
+
+  /** Atomically replace the exact owner connection's selected repository set. */
+  async replacePersonalGitHubRepositorySelections(
+    workspaceId: string,
+    connectionId: string,
+    request: ReplacePersonalGitHubRepositorySelectionsRequest,
+  ): Promise<PersonalGitHubRepositorySelectionState> {
+    return await this.requestJson<PersonalGitHubRepositorySelectionState>(
+      "PUT",
+      `/v1/workspaces/${workspaceId}/connections/${connectionId}/github/repositories`,
+      request,
+    );
+  }
+
+  /** Revalidate every selected repository without accepting provider URLs from the caller. */
+  async verifyPersonalGitHubRepositorySelections(
+    workspaceId: string,
+    connectionId: string,
+    request: VerifyPersonalGitHubRepositorySelectionsRequest,
+  ): Promise<PersonalGitHubRepositorySelectionState> {
+    return await this.requestJson<PersonalGitHubRepositorySelectionState>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/connections/${connectionId}/github/repositories/verify`,
+      request,
+    );
+  }
+
   /** List the secret-free Slack team -> OpenGeni tenant routing authority. */
   async listSlackInstallationBindings(workspaceId: string): Promise<SlackInstallationBinding[]> {
     const response = await this.requestJson<ListSlackInstallationBindingsResponse>(
@@ -5705,6 +6518,17 @@ export class OpenGeniClient {
     return await this.requestJson<CreateCheckoutResponse>("POST", "/v1/billing/checkout", request);
   }
 
+  /** Open Stripe's hosted portal for invoices and payment information. */
+  async createBillingPortalSession(
+    request: CreateBillingPortalRequest = {},
+  ): Promise<CreateBillingPortalResponse> {
+    return await this.requestJson<CreateBillingPortalResponse>(
+      "POST",
+      "/v1/billing/portal",
+      request,
+    );
+  }
+
   // --- Internals -------------------------------------------------------------
 
   private headers(correlationId?: string): Record<string, string> {
@@ -5988,6 +6812,19 @@ export class OpenGeniClient {
     }>("DELETE", `/v1/workspaces/${workspaceId}/supergrok/accounts/${accountId}`, {});
   }
 
+  /** Contract-checked JSON transport shared by opt-in typed SDK clients. */
+  private async requestSessionCommand<T>(method: string, path: string, body?: unknown): Promise<T> {
+    return await this.requestJson<T>(
+      method,
+      path,
+      body,
+      {},
+      {
+        timeoutMs: this.sessionCommandTimeoutMs,
+      },
+    );
+  }
+
   /** Contract-checked JSON transport shared by opt-in typed SDK clients. */
   async requestJson<T>(
     method: string,
@@ -5997,36 +6834,46 @@ export class OpenGeniClient {
     options: OpenGeniRequestOptions = {},
   ): Promise<T> {
     const correlationId = crypto.randomUUID();
-    let response: Response;
+    const abort = requestAbortSignal(options);
     try {
-      response = await this.fetchImpl(this.url(path, query), {
-        method,
-        headers: {
-          ...this.headers(correlationId),
-          Accept: "application/json",
-          ...(body !== undefined ? { "Content-Type": "application/json" } : {}),
-        },
-        ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
-        ...(options.signal ? { signal: options.signal } : {}),
-      });
-    } catch (error) {
-      if (isMutationMethod(method)) {
-        throw mutationTransportError(correlationId);
+      let response: Response;
+      try {
+        response = await awaitWithAbort(
+          this.fetchImpl(this.url(path, query), {
+            method,
+            headers: {
+              ...this.headers(correlationId),
+              Accept: "application/json",
+              ...(body !== undefined ? { "Content-Type": "application/json" } : {}),
+            },
+            ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+            ...(abort.signal ? { signal: abort.signal } : {}),
+          }),
+          abort.signal,
+        );
+      } catch (error) {
+        if (options.signal?.aborted) throw error;
+        if (isMutationMethod(method)) {
+          throw mutationTransportError(correlationId);
+        }
+        throw error;
       }
-      throw error;
-    }
-    assertApiContractResponse(response);
-    if (!response.ok) {
-      throw await apiErrorFromResponse(response, { method, correlationId });
-    }
-    await assertJsonResponse(response, { method, correlationId });
-    try {
-      return (await response.json()) as T;
-    } catch (error) {
-      if (isMutationMethod(method)) {
-        throw mutationTransportError(correlationId);
+      assertApiContractResponse(response);
+      if (!response.ok) {
+        throw await apiErrorFromResponse(response, { method, correlationId });
       }
-      throw error;
+      await assertJsonResponse(response, { method, correlationId });
+      try {
+        return (await response.json()) as T;
+      } catch (error) {
+        if (options.signal?.aborted) throw error;
+        if (isMutationMethod(method)) {
+          throw mutationTransportError(correlationId);
+        }
+        throw error;
+      }
+    } finally {
+      abort.dispose();
     }
   }
 
@@ -6059,8 +6906,8 @@ export class OpenGeniClient {
     return response;
   }
 
-  /** Like `requestJson` for endpoints that respond with no body (204). */
-  private async requestVoid(method: string, path: string, body?: unknown): Promise<void> {
+  /** Contract-checked transport shared by opt-in typed SDK clients for 204 responses. */
+  async requestVoid(method: string, path: string, body?: unknown): Promise<void> {
     const correlationId = crypto.randomUUID();
     let response: Response;
     try {
@@ -6210,6 +7057,59 @@ function filenameForAudioMimeType(mimeType: string): string {
 
 const API_ERROR_MAX_BYTES = 16 * 1024;
 
+function requestAbortSignal(options: OpenGeniRequestOptions): {
+  signal: AbortSignal | undefined;
+  dispose: () => void;
+} {
+  const timeoutMs = options.timeoutMs ?? 0;
+  if (timeoutMs <= 0) {
+    return { signal: options.signal, dispose: () => undefined };
+  }
+  const controller = new AbortController();
+  const onCallerAbort = () => controller.abort(options.signal?.reason);
+  if (options.signal?.aborted) {
+    onCallerAbort();
+  } else {
+    options.signal?.addEventListener("abort", onCallerAbort, { once: true });
+  }
+  const timer = setTimeout(
+    () => controller.abort(new DOMException("Request timed out", "TimeoutError")),
+    timeoutMs,
+  );
+  return {
+    signal: controller.signal,
+    dispose: () => {
+      clearTimeout(timer);
+      options.signal?.removeEventListener("abort", onCallerAbort);
+    },
+  };
+}
+
+async function awaitWithAbort<T>(promise: Promise<T>, signal: AbortSignal | undefined): Promise<T> {
+  if (!signal) return await promise;
+  if (signal.aborted) {
+    throw signal.reason ?? new DOMException("Request aborted", "AbortError");
+  }
+  return await new Promise<T>((resolve, reject) => {
+    const onAbort = () => {
+      cleanup();
+      reject(signal.reason ?? new DOMException("Request aborted", "AbortError"));
+    };
+    const cleanup = () => signal.removeEventListener("abort", onAbort);
+    signal.addEventListener("abort", onAbort, { once: true });
+    promise.then(
+      (value) => {
+        cleanup();
+        resolve(value);
+      },
+      (cause) => {
+        cleanup();
+        reject(cause);
+      },
+    );
+  });
+}
+
 type ApiErrorRequestContext = {
   method: string;
   correlationId?: string | undefined;
@@ -6298,12 +7198,15 @@ async function cancelResponseBody(response: Response, reason: string): Promise<v
   await response.body?.cancel(reason).catch(() => undefined);
 }
 
-function assertRetainedGeneratedImageReceipt(
+function assertRetainedWorkspaceArtifactReceipt(
   workspaceId: string,
   artifact: RetainedArtifactReference,
 ): void {
-  if (!parseRetainedGeneratedImageReference(artifact, workspaceId)) {
-    throw new OpenGeniApiError(502, "retained generated image receipt is invalid");
+  if (
+    !parseRetainedGeneratedImageReference(artifact, workspaceId) &&
+    !parseRetainedWorkspaceFileReference(artifact, workspaceId)
+  ) {
+    throw new OpenGeniApiError(502, "retained workspace artifact receipt is invalid");
   }
 }