@opengeni/sdk 1.0.1 → 2.3.0-canary.0

package/dist/types.d.ts

@@ -128,7 +128,7 @@ export type WorkspaceRealtimeModelCatalogResponse = {
     models: WorkspaceRealtimeModelCatalogItem[];
 };
 export type SessionRealtimeState = "active" | "ended";
-export type SessionRealtimeEndReason = "user_stop" | "browser_unload" | "lease_expired";
+export type SessionRealtimeEndReason = "user_stop" | "browser_unload" | "lease_expired" | "authority_revoked";
 export type SessionRealtimeMode = {
     id: string;
     sessionId: string;
@@ -163,7 +163,7 @@ export type SessionRealtimeMutationResponse = {
     replay: boolean;
 };
 export type SessionStatus = "queued" | "running" | "idle" | "requires_action" | "recovering" | "waiting_capacity" | "failed" | "cancelled";
-export type SandboxBackend = "docker" | "modal" | "local" | "none" | "daytona" | "runloop" | "e2b" | "blaxel" | "cloudflare" | "vercel" | "selfhosted";
+export type SandboxBackend = "docker" | "modal" | "local" | "none" | "daytona" | "runloop" | "e2b" | "blaxel" | "cloudflare" | "vercel" | "selfhosted" | "opensandbox";
 export type SandboxOs = "linux" | "macos" | "windows";
 export type SandboxCapabilityName = "FileSystem" | "Terminal" | "Git" | "DesktopStream" | "Recording";
 export type CapabilityUnavailableReason = "backend_unsupported" | "os_unsupported" | "not_provisioned" | "disabled_by_policy" | "lease_cold" | "tier_headless" | "agent_offline" | "agent_reconnecting" | "consent_required" | "display_unavailable";
@@ -306,6 +306,8 @@ export type RepositoryResourceRef = {
     kind: "repository";
     uri: string;
     ref: string;
+    /** Exact immutable commit that repository materialization must produce. */
+    expectedCommitSha?: string | undefined;
     /**
      * Optional workspace-relative override. When omitted, OpenGeni persists
      * `repos/<encoded-host>/<owner>/<repo>` so equal names on different Git
@@ -315,6 +317,7 @@ export type RepositoryResourceRef = {
     mountPath?: string | undefined;
     subpath?: string | undefined;
     provider?: GitCredentialProvider | undefined;
+    connectionType?: "github_personal" | undefined;
     credentialBindingId?: GitCredentialBindingId | undefined;
     access?: GitRepositoryAccess | undefined;
     repositoryId?: number | string | undefined;
@@ -337,6 +340,7 @@ export type ToolRef = {
     kind: "mcp";
     id: string;
     optional?: boolean | undefined;
+    eager?: boolean | undefined;
 };
 export type SessionToolPolicy = {
     mode: "workspace_default" | "explicit" | "inherited";
@@ -376,6 +380,7 @@ export type SessionEffectiveToolPolicy = {
 export type GoalSpec = {
     text: string;
     successCriteria?: string | undefined;
+    rootConstraints?: string[] | undefined;
     maxAutoContinuations?: number | undefined;
     mutationPolicy?: SessionGoalMutationPolicy | undefined;
 };
@@ -414,6 +419,25 @@ export type UpdateSessionMcpApprovalPolicyResponse = {
 };
 export type ConnectionKind = "oauth2" | "api_key" | "app_install" | "delegated";
 export type ConnectionStatus = "active" | "needs_reauth" | "revoked" | "error";
+export type UserResourceDelegation = {
+    authorityId: string;
+    grantId: string;
+    organizationId: string;
+    workspaceId: string;
+    sessionId: string | null;
+    action: string;
+    mode: "once" | "session" | "always";
+    context: "user_private" | "workspace_shared";
+    authorityEpoch: number | null;
+    authorityGeneration: number;
+    grantGeneration: number;
+    resourceVersionId?: string | null | undefined;
+};
+export type McpConnectionAuthoritySelection = {
+    serverId: string;
+    connectionId: string;
+    userDelegation: UserResourceDelegation;
+};
 export type McpServerConnectionRef = {
     connectionId?: string | undefined;
     provider?: string | undefined;
@@ -468,6 +492,98 @@ export type CreateConnectionRequest = {
     expiresAt?: string | null | undefined;
     metadata?: Record<string, unknown> | undefined;
 };
+export type PersonalGitHubConnectionMetadata = {
+    credentialRole: "opengeni_github_personal";
+    providerFamily: "github";
+    providerPrincipalId: string;
+    githubUserId: string;
+    githubLogin: string;
+    oauthEnvironment: string;
+    oauthClientMarker: string;
+    credentialBindingId: string;
+    connectedAt: string;
+    lastVerifiedAt: string;
+    refreshTokenExpiresAt?: string | null | undefined;
+    disconnectedAt?: string | null | undefined;
+    [key: string]: unknown;
+};
+export type PersonalGitHubOAuthStartRequest = {
+    connectionId?: string | undefined;
+    returnPath?: string | undefined;
+};
+export type PersonalGitHubOAuthStartResponse = {
+    authorizationUrl: string;
+    expiresAt: string;
+};
+export type PersonalGitHubConnectionStatusResponse = {
+    enabled: boolean;
+    connection: ConnectionMetadata | null;
+    reviewUrl: string | null;
+};
+export type PersonalGitHubDisconnectRequest = {
+    expectedVersion: number;
+    idempotencyKey: string;
+};
+export type PersonalGitHubRepositoryAccess = "read" | "write";
+export type PersonalGitHubRepositoryPermissions = {
+    pull: boolean;
+    push: boolean;
+    admin: boolean;
+    maintain: boolean;
+    triage: boolean;
+};
+export type PersonalGitHubRepository = {
+    repositoryId: string;
+    fullName: string;
+    canonicalUrl: string;
+    defaultBranch: string;
+    visibility: "public" | "private" | "internal";
+    private: boolean;
+    archived: boolean;
+    disabled: boolean;
+    permissions: PersonalGitHubRepositoryPermissions;
+};
+export type PersonalGitHubSelectedRepository = PersonalGitHubRepository & {
+    selectedAccess: PersonalGitHubRepositoryAccess;
+    selectionGeneration: number;
+    selectedAt: string;
+    lastVerifiedAt: string;
+};
+export type PersonalGitHubRepositorySelectionState = {
+    connectionAuthorityGeneration: number;
+    credentialBindingId: string;
+    providerPrincipalId: string;
+    selectionGeneration: number;
+    repositories: PersonalGitHubSelectedRepository[];
+};
+export type PersonalGitHubRepositoryCatalogItem = PersonalGitHubRepository & {
+    selectedAccess: PersonalGitHubRepositoryAccess | null;
+};
+export type ListPersonalGitHubRepositoriesOptions = {
+    cursor?: number | undefined;
+    limit?: number | undefined;
+};
+export type ListPersonalGitHubRepositoriesResponse = {
+    repositories: PersonalGitHubRepositoryCatalogItem[];
+    nextCursor: number | null;
+    selection: PersonalGitHubRepositorySelectionState;
+};
+export type PersonalGitHubRepositorySelectionInput = {
+    repositoryId: string;
+    fullName: string;
+    access: PersonalGitHubRepositoryAccess;
+};
+export type ReplacePersonalGitHubRepositorySelectionsRequest = {
+    expectedConnectionAuthorityGeneration: number;
+    expectedSelectionGeneration: number;
+    idempotencyKey: string;
+    repositories: PersonalGitHubRepositorySelectionInput[];
+};
+export type VerifyPersonalGitHubRepositorySelectionsRequest = {
+    expectedConnectionAuthorityGeneration: number;
+    expectedSelectionGeneration: number;
+    idempotencyKey: string;
+};
 export type OpenGeniSlackBotInstallRequest = {
     /** Existing OpenGeni Slack bot connection to reinstall in place. */
     connectionId?: string | undefined;
@@ -504,7 +620,7 @@ export type SlackInstallationBinding = {
     slackTeamName: string;
     botId: string;
     botUserId: string;
-    botDisplayName: "OpenGeni";
+    botDisplayName: "OpenGeni" | "OpenGeni Staging";
     state: SlackInstallationBindingState;
     quarantineReason: string | null;
     version: number;
@@ -796,11 +912,84 @@ export type IntegrationClientMetadata = {
     grant_types: Array<"authorization_code" | "refresh_token">;
     response_types: ["code"];
 };
+export type SessionVisibility = "private" | "workspace";
+export type SessionTenancyCreateCapabilities = {
+    activated: boolean;
+    canCreatePrivate: boolean;
+    reason: "available" | "not_activated" | "managed_session_required" | "unavailable";
+};
+export type SessionTenancyPublicProjection = {
+    visibility: SessionVisibility;
+    authorityEpoch: number;
+    ownedByCurrentUser: boolean;
+    fork: {
+        sourceVisibility: SessionVisibility;
+        sourceAuthorityEpoch: number;
+        forkedAt: string;
+    } | null;
+};
+export type UpdateSessionVisibilityRequest = {
+    visibility: SessionVisibility;
+    expectedAuthorityEpoch: number;
+    idempotencyKey: string;
+};
+export type UpdateSessionVisibilityResponse = {
+    operationId: string;
+    eventId: string | null;
+    eventSequence: number | null;
+    visibility: SessionVisibility;
+    authorityEpoch: number;
+    changed: boolean;
+    replay: boolean;
+    revokedGrantCount: number;
+};
+export type ForkSessionRequest = {
+    idempotencyKey: string;
+    visibility: SessionVisibility;
+    workspaceSharedAcknowledged: boolean;
+};
+export type ForkSessionResponse = {
+    operationId: string;
+    eventId: string;
+    eventSequence: number;
+    sessionId: string;
+    workspaceId: string;
+    visibility: SessionVisibility;
+    authorityEpoch: 1;
+    copiedHistoryItemCount: number;
+    replay: boolean;
+};
+export type SessionBackgroundCommandActivity = {
+    state: "running" | "stopping";
+    count: number;
+};
+export type SessionBackgroundCommand = {
+    id: string;
+    workspaceId: string;
+    sessionId: string;
+    provider: "managed" | "connected_machine";
+    state: "running" | "stopping" | "exited" | "lost";
+    commandPreview: string;
+    cancelRequestedAt: string | null;
+    exitCode: number | null;
+    settlementReason: string | null;
+    startedAt: string;
+    settledAt: string | null;
+    updatedAt: string;
+};
+export type SessionBackgroundCommandListResponse = {
+    commands: SessionBackgroundCommand[];
+};
+export type CancelSessionBackgroundCommandResult = {
+    command: SessionBackgroundCommand;
+    accepted: boolean;
+};
 export type Session = {
     id: string;
     workspaceId: string;
     accountId: string;
     status: SessionStatus;
+    backgroundCommandActivity?: SessionBackgroundCommandActivity | undefined;
     initialMessage: string;
     title: string | null;
     titleSource: "user" | "agent" | null;
@@ -814,10 +1003,14 @@ export type Session = {
     toolPolicyVersion: number;
     effectiveToolPolicy?: SessionEffectiveToolPolicy | undefined;
     metadata: Record<string, unknown>;
+    /** Present only when session-tenancy product activation is enabled for the organization. */
+    tenancy?: SessionTenancyPublicProjection | undefined;
     /** Frozen creator fact; later turns carry their own independent initiator. */
     createdBy: TurnInitiator;
     createdByContext: Record<string, unknown>;
     model: string;
+    reasoningEffort: ReasoningEffort;
+    latencyMode: LatencyMode;
     sandboxBackend: SandboxBackend;
     sandboxOs: SandboxOs;
     sandboxGroupId: string;
@@ -866,6 +1059,17 @@ export type Session = {
     pinnedAt?: string | null;
     /** Optimistic pin-state revision; zero represents an absent pin relation. */
     pinVersion?: number;
+    /** Personal explicit acknowledgment state. */
+    unread?: boolean;
+    /** Personal actively-working label. */
+    activelyWorking?: boolean;
+    /** Optimistic unread/actively-working revision. */
+    attentionVersion?: number;
+    /** Personal archive state. */
+    archived?: boolean;
+    archivedAt?: string | null;
+    /** Optimistic archive-state revision. */
+    archiveVersion?: number;
     /** Server-authoritative descendant counts populated by session-list reads. */
     treeStats?: {
         directChildren: number;
@@ -875,9 +1079,21 @@ export type Session = {
         attentionDescendants: number;
         pausedDescendants: number;
         failedDescendants: number;
+        unreadDescendants?: number | undefined;
+        activelyWorkingDescendants?: number | undefined;
+        /**
+         * Earliest moment one of the counted `attentionDescendants` entered
+         * `requires_action`; null when none is waiting, absent on older servers.
+         */
+        attentionSince?: string | null | undefined;
         /** Counts are lower bounds rather than exact totals when true. */
         truncated: boolean;
     } | undefined;
+    /**
+     * When this session's own open turn entered `requires_action`. Populated by
+     * list and lineage reads for `requires_action` sessions; null otherwise.
+     */
+    requiresActionSince?: string | null | undefined;
     createdAt: string;
     updatedAt: string;
 };
@@ -941,6 +1157,16 @@ export type UpdateSessionPinRequest = {
     pinned: boolean;
     expectedVersion?: number;
 };
+export type UpdateSessionAttentionRequest = {
+    unread?: boolean;
+    acknowledgedThroughSequence?: number;
+    activelyWorking?: boolean;
+    expectedVersion?: number;
+};
+export type UpdateSessionArchiveRequest = {
+    archived: boolean;
+    expectedVersion?: number;
+};
 export type LineageNode = {
     session: SessionSummary;
     children: LineageNode[];
@@ -976,6 +1202,21 @@ export type SubmittedTimelineAnnotation = DraftTimelineAnnotation;
 export type TimelineAnnotation = DraftTimelineAnnotation & {
     ordinal: number;
 };
+export declare const PERSONAL_RESOURCE_SHARED_OUTPUT_WARNING_VERSION: 1;
+export declare const PERSONAL_RESOURCE_SHARED_OUTPUT_WARNING = "Personal resources used in a workspace-shared session may influence outputs visible to other workspace members. The underlying credentials and secret values are not shared by the attachment itself.";
+export type PersonalResourceAttachmentIntent = {
+    mode: "once" | "session" | "always";
+    expectedAuthorityEpoch?: number | undefined;
+    workspaceSharedAcknowledged?: boolean | undefined;
+    sharedOutputWarningVersion: 1;
+};
+export type PersonalResourceAttachmentSummary = {
+    mode: "once" | "session" | "always";
+    context: "user_private" | "workspace_shared";
+    resourceCount: number;
+    resourceKinds: Array<"variable_set" | "rig" | "connected_machine">;
+    sharedOutputWarningVersion: 1;
+};
 export type SessionTurn = {
     id: string;
     workspaceId: string;
@@ -1003,6 +1244,7 @@ export type SessionTurn = {
     initiator: TurnInitiator;
     initiatorContext: Record<string, unknown>;
     personalConnections?: McpPersonalConnectionSummary[] | undefined;
+    personalResources?: PersonalResourceAttachmentSummary | null | undefined;
     cancelledBy?: string | null;
     cancelReason?: string | null;
     startedAt: string | null;
@@ -1065,7 +1307,7 @@ export type SessionHumanInputRequest = {
     createdAt: string;
     updatedAt: string;
 };
-export declare const SESSION_EVENT_TYPES: readonly ["session.created", "session.event.envelope_omitted", "session.status.changed", "session.realtime.started", "session.realtime.ended", "session.requiresAction", "session.humanInput.requested", "session.context.compaction.requested", "session.context.compaction.started", "session.context.compacted", "session.context.compaction.skipped", "session.context.cleared", "user.message", "user.pause", "user.approvalDecision", "user.humanInputResponse", "turn.queued", "turn.started", "turn.completed", "turn.failed", "turn.cancelled", "turn.superseded", "turn.recovery.requested", "turn.capacity_waiting", "agent.message.delta", "agent.message.completed", "agent.reasoning.delta", "agent.toolCall.created", "agent.toolCall.output", "agent.model.request", "agent.model.usage", "tool.auth_needed", "credential.auth_needed", "agent.updated", "rig.setup.started", "rig.setup.completed", "rig.setup.skipped", "rig.setup.failed", "sandbox.operation.started", "sandbox.operation.completed", "sandbox.operation.failed", "sandbox.command.output.delta", "artifact.created", "goal.set", "goal.updated", "goal.progress", "goal.rewrite.proposed", "goal.rewrite.rejected", "goal.completed", "goal.paused", "goal.resumed", "goal.cleared", "goal.continuation", "system.update.pending", "system.update.delivered", "system.update.superseded", "system.update.cancelled", "system.update.settled", "session.control.paused", "session.control.resumed", "session.control.steer_requested", "workspace.inference.paused", "workspace.inference.resumed", "session.queue.changed", "session.queue.prompt.cancelled", "session.queue.history", "turn.event.rejected_late", "memory.saved", "memory.corrected", "stream.url.rotated", "stream.opened", "stream.closed", "stream.revoked", "recording.started", "recording.available", "recording.failed", "fs.changed", "git.changed", "terminal.pty.started", "terminal.pty.output.delta", "terminal.pty.exited", "session.title_set", "session.visibility.changed", "session.mcp.approval_policy.updated", "session.tool_policy.updated", "codex.account.switched", "codex.credential.selected", "codex.fleet.decision", "codex.capacity.waiting", "codex.capacity.resumed", "codex.capacity.superseded", "sandbox.box.created", "sandbox.box.lost", "sandbox.box.terminated", "sandbox.box.snapshot", "sandbox.env.drift", "session.route.reconciled", "workspace.revision.captured", "workspace.revision.degraded", "machine.op.failed", "machine.op.recovered", "machine.link.lost", "machine.link.restored", "machine.runner.restarted"];
+export declare const SESSION_EVENT_TYPES: readonly ["session.created", "session.event.envelope_omitted", "session.status.changed", "session.realtime.started", "session.realtime.ended", "session.requiresAction", "session.humanInput.requested", "session.context.compaction.requested", "session.context.compaction.started", "session.context.compacted", "session.context.compaction.skipped", "session.context.cleared", "user.message", "user.pause", "user.approvalDecision", "user.humanInputResponse", "turn.queued", "turn.started", "turn.completed", "turn.failed", "turn.cancelled", "turn.superseded", "turn.recovery.requested", "turn.capacity_waiting", "turn.startup.phase.started", "turn.startup.phase.completed", "turn.startup.phase.failed", "agent.message.delta", "agent.message.completed", "agent.reasoning.delta", "agent.toolCall.created", "agent.toolCall.output", "agent.model.request", "agent.model.usage", "tool.auth_needed", "credential.auth_needed", "agent.updated", "rig.setup.started", "rig.setup.completed", "rig.setup.skipped", "rig.setup.failed", "sandbox.operation.started", "sandbox.operation.completed", "sandbox.operation.failed", "session.command.backgrounded", "session.command.finished", "sandbox.command.output.delta", "artifact.created", "goal.set", "goal.updated", "goal.progress", "goal.rewrite.proposed", "goal.rewrite.rejected", "goal.completed", "goal.paused", "goal.resumed", "goal.cleared", "goal.held", "goal.continuation", "system.update.pending", "system.update.delivered", "system.update.superseded", "system.update.cancelled", "system.update.settled", "session.control.paused", "session.control.resumed", "session.control.steer_requested", "workspace.inference.paused", "workspace.inference.resumed", "session.queue.changed", "session.queue.prompt.cancelled", "session.queue.history", "turn.event.rejected_late", "memory.saved", "memory.corrected", "stream.url.rotated", "stream.opened", "stream.closed", "stream.revoked", "recording.started", "recording.available", "recording.failed", "fs.changed", "git.changed", "terminal.pty.started", "terminal.pty.output.delta", "terminal.pty.exited", "session.title_set", "session.visibility.changed", "session.personal_resources.attached", "session.mcp.approval_policy.updated", "session.tool_policy.updated", "codex.account.switched", "codex.credential.selected", "codex.fleet.decision", "codex.capacity.waiting", "codex.capacity.resumed", "codex.capacity.superseded", "sandbox.box.created", "sandbox.box.lost", "sandbox.box.terminated", "sandbox.box.snapshot", "sandbox.env.drift", "session.route.reconciled", "workspace.revision.captured", "workspace.revision.degraded", "machine.op.failed", "machine.op.recovered", "machine.link.lost", "machine.link.restored", "machine.runner.restarted"];
 export type KnownSessionEventType = (typeof SESSION_EVENT_TYPES)[number];
 /**
  * Event types the SDK knows about today, kept open so a newer OpenGeni server
@@ -1407,6 +1649,16 @@ export type FsReadResponse = {
     isBinary: boolean;
     revision: number;
 };
+export declare const SANDBOX_FILE_ARTIFACT_MAX_BYTES: number;
+export type PublishSandboxFileArtifactRequest = {
+    path: string;
+};
+export type SandboxFileArtifactReceipt = {
+    type: "sandbox_file";
+    sandboxPath: string;
+    filename: string;
+    artifact: RetainedArtifactReference;
+};
 export type FsWriteRequest = {
     path: string;
     encoding?: FsEncoding;
@@ -1748,6 +2000,57 @@ export type ScheduledTaskScheduleSpec = {
     minute: number;
     daysOfWeek?: ScheduledTaskDayOfWeek[] | undefined;
 };
+export type IncidentTelemetrySeriesMetadata = {
+    metric: string;
+    labels: string[];
+};
+export type IncidentTelemetryDataRoute = {
+    kind: "mcp";
+    serverId: string;
+} | {
+    kind: "first_party";
+    tool: FirstPartyMcpToolName;
+} | {
+    kind: "variable_set";
+    variableSetName: string;
+    variableNames: string[];
+} | {
+    kind: "rig_credential_hook";
+    credentialHookId: string;
+};
+export type IncidentTelemetryPreflight = {
+    requiredResources: ResourceRef[];
+    requiredMcpServerIds: string[];
+    requiredFirstPartyMcpTools: FirstPartyMcpToolName[];
+    requiredFirstPartyMcpPermissions: Permission[];
+    requiredRig: {
+        name: string;
+        credentialHookIds: string[];
+    } | null;
+    requiredVariableSetNames: string[];
+    requiredVariableNames: string[];
+    dataSource: {
+        kind: "prometheus";
+        queryPath: "/api/v1/query" | "/api/v1/query_range";
+        workspaceLabel: string;
+        alertSelectorLabels: string[];
+        route: IncidentTelemetryDataRoute;
+        requiredSeries: IncidentTelemetrySeriesMetadata[];
+        availableSeries: IncidentTelemetrySeriesMetadata[];
+    };
+};
+export type IncidentTelemetryPreflightInput = Omit<IncidentTelemetryPreflight, "requiredResources" | "requiredMcpServerIds" | "requiredFirstPartyMcpTools" | "requiredFirstPartyMcpPermissions" | "requiredRig" | "requiredVariableSetNames" | "requiredVariableNames"> & {
+    requiredResources?: ResourceRef[] | undefined;
+    requiredMcpServerIds?: string[] | undefined;
+    requiredFirstPartyMcpTools?: FirstPartyMcpToolName[] | undefined;
+    requiredFirstPartyMcpPermissions?: Permission[] | undefined;
+    requiredRig?: {
+        name: string;
+        credentialHookIds?: string[] | undefined;
+    } | null | undefined;
+    requiredVariableSetNames?: string[] | undefined;
+    requiredVariableNames?: string[] | undefined;
+};
 export type ScheduledTaskAgentConfig = {
     prompt: string;
     resources: ResourceRef[];
@@ -1758,6 +2061,8 @@ export type ScheduledTaskAgentConfig = {
     reasoningEffort?: ReasoningEffort | undefined;
     sandboxBackend?: SandboxBackend | undefined;
     goal?: GoalSpec | undefined;
+    executionClass?: "incident_telemetry" | undefined;
+    incidentTelemetryPreflight?: IncidentTelemetryPreflight | undefined;
     maxNestedAgentDepth?: number | undefined;
 };
 export type ScopedKnowledgeScope = {
@@ -1819,6 +2124,8 @@ export type ScheduledTask = {
     createdBy?: TurnInitiator | undefined;
     createdByContext?: TurnInitiatorContext | undefined;
     personalConnections?: McpPersonalConnectionSummary[] | undefined;
+    authorityRevision: number;
+    executionDigest: string;
     targetSessionId: string | null;
     reusableSessionId: string | null;
     variableSetId: string | null;
@@ -1831,6 +2138,7 @@ export type ScheduledTask = {
 };
 export type CreateSessionRequest = {
     requestedSessionId?: string | undefined;
+    visibility?: SessionVisibility | undefined;
     initialMessage?: string | undefined;
     /** Create an idle session shell so realtime voice can be the first interaction. */
     startMode?: "realtime" | undefined;
@@ -1862,18 +2170,20 @@ export type CreateSessionRequest = {
     firstPartyMcpPermissions?: string[] | undefined;
     firstPartyMcpTools?: FirstPartyMcpToolName[] | undefined;
     mcpServers?: SessionMcpServerInput[] | undefined;
+    /** Atomically attach the server-derived personal Variable Set/Rig closure to the initial turn. */
+    personalResourceAttachment?: PersonalResourceAttachmentIntent | undefined;
     sandbox?: "shared" | "new" | {
         groupId: string;
     } | undefined;
 };
-export declare const KNOWN_PERMISSIONS: readonly ["account:read", "account:admin", "members:manage", "workspace:create", "billing:read", "billing:manage", "workspace:read", "workspace:admin", "sessions:create", "sessions:read", "sessions:control", "stream:view", "stream:control", "stream:acknowledge", "files:upload", "files:read", "files:write", "terminal:attach", "documents:manage", "documents:search", "scheduled_tasks:manage", "scheduled_tasks:run", "github:manage", "github:use", "api_keys:manage", "connections:read", "connections:write", "environments:manage", "environments:use", "variable-sets:list", "variable-sets:read", "variable-sets:write", "variable-sets:manage", "variable-sets:use", "secrets:list", "secrets:read", "secrets:write", "mcp_servers:attach", "codemode:call", "goals:manage", "enrollments:read", "enrollments:manage", "rigs:use", "rigs:manage", "artifacts:read", "artifacts:publish"];
+export declare const KNOWN_PERMISSIONS: readonly ["account:read", "account:admin", "members:manage", "workspace:create", "billing:read", "billing:manage", "workspace:read", "workspace:admin", "sessions:create", "sessions:read", "sessions:control", "stream:view", "stream:control", "stream:acknowledge", "files:upload", "files:read", "files:write", "terminal:attach", "documents:manage", "documents:search", "scheduled_tasks:manage", "scheduled_tasks:run", "github:manage", "github:use", "api_keys:manage", "connections:read", "connections:write", "environments:manage", "environments:use", "variable-sets:list", "variable-sets:read", "variable-sets:write", "variable-sets:manage", "variable-sets:attach", "variable-sets:use", "secrets:list", "secrets:read", "secrets:write", "mcp_servers:attach", "codemode:call", "goals:manage", "enrollments:read", "enrollments:manage", "rigs:use", "rigs:manage", "artifacts:read", "artifacts:publish"];
 export type KnownPermission = (typeof KNOWN_PERMISSIONS)[number];
 /**
  * Permissions the SDK knows about today, kept open so a newer OpenGeni server
  * can introduce permissions without breaking older SDK consumers.
  */
 export type Permission = KnownPermission | (string & {});
-export type FirstPartyMcpToolName = "set_session_title" | "goal_set" | "goal_update" | "goal_progress" | "goal_complete" | "goal_pause" | "memory_search" | "memory_save" | "memory_correct" | "preference_registry_summary" | "preference_registry_get" | "task_notes_list" | "task_note_save" | "task_note_archive" | "sandboxes_list" | "sandbox_attach" | "sandbox_swap" | "run_on" | "sandbox_provision" | "connected_machine_remove" | "rig_list" | "rig_get" | "rig_propose_change" | "rig_verify" | "rig_promote" | "sessions_list" | "session_get" | "session_events" | "session_create" | "session_send_message" | "session_pause" | "session_resume" | "session_steer" | "set_other_session_title" | "interaction_discover" | "browser_open" | "browser_tabs" | "browser_observe" | "browser_act" | "browser_clipboard" | "browser_debug" | "browser_auth" | "interaction_request_human" | "browser_identity" | "browser_publish" | "browser_lifecycle" | "computer_open" | "computer_targets" | "computer_observe" | "computer_clipboard" | "computer_act" | "computer_lifecycle" | "variable_set_list" | "environment_list" | "variable_set_get_variable" | "variable_set_set_variable" | "environment_set_variable" | "capability_catalog_search" | "capability_authorization_request" | "github_connect_link" | "github_repositories_list" | "social_connections_list" | "social_posts_recent" | "social_daily_analysis_context" | "social_search_live" | "social_mentions_live" | "social_thread_fetch" | "social_posts_sync" | "social_post_reply" | "x_accounts_list" | "x_search_live" | "x_mentions_live" | "x_thread_fetch" | "x_posts_sync" | "x_post_reply" | "reddit_accounts_list" | "reddit_search_live" | "reddit_mentions_live" | "reddit_thread_fetch" | "reddit_posts_sync" | "reddit_post_reply" | "scheduled_tasks_list" | "scheduled_tasks_get" | "scheduled_tasks_create" | "scheduled_tasks_update" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_delete" | "scheduled_task_runs_list" | "slack_bot_list_channels" | "slack_bot_channel_history" | "slack_bot_thread_replies" | "slack_bot_list_users" | "slack_bot_list_files" | "slack_bot_file_info" | "slack_bot_file_content" | "slack_bot_post_message" | "slack_bot_delete_message" | "fiken_companies_list" | "fiken_contacts_list" | "fiken_contact_create" | "fiken_products_list" | "fiken_invoices_list" | "fiken_invoice_get" | "fiken_invoice_draft_create" | "fiken_bank_accounts_list" | "fiken_purchases_list" | "fiken_sales_list" | "atlassian_sources_list" | "atlassian_search" | "atlassian_get" | "artifacts_list" | "artifacts_get_source" | "artifacts_create" | "artifacts_publish" | "artifacts_rollback" | "editable_artifact_list" | "editable_artifact_create" | "editable_artifact_import" | "editable_artifact_get" | "editable_artifact_inspect" | "editable_artifact_apply" | "editable_artifact_export" | "editable_artifact_export_status";
+export type FirstPartyMcpToolName = "set_session_title" | "goal_set" | "goal_update" | "goal_progress" | "goal_wait" | "goal_complete" | "goal_pause" | "memory_search" | "memory_save" | "memory_correct" | "preference_registry_summary" | "preference_registry_get" | "task_notes_list" | "task_note_save" | "task_note_archive" | "task_note_replace" | "knowledge_propose" | "knowledge_correct" | "task_note_promote_knowledge" | "task_note_promote_instruction_policy" | "task_note_promote_preference" | "instruction_policy_propose" | "preference_propose" | "remember" | "remember_confirm" | "company_profile_propose" | "company_profile_confirm" | "sandboxes_list" | "sandbox_attach" | "sandbox_swap" | "run_on" | "sandbox_provision" | "connected_machine_remove" | "rig_list" | "rig_get" | "rig_propose_change" | "rig_verify" | "rig_promote" | "sessions_list" | "session_get" | "session_events" | "session_wait" | "session_create" | "session_send_message" | "session_pause" | "session_resume" | "session_steer" | "session_human_input_respond" | "set_other_session_title" | "interaction_discover" | "browser_open" | "browser_tabs" | "browser_observe" | "browser_act" | "browser_clipboard" | "browser_debug" | "browser_auth" | "interaction_request_human" | "browser_identity" | "browser_publish" | "browser_lifecycle" | "computer_open" | "computer_targets" | "computer_observe" | "computer_clipboard" | "computer_act" | "computer_lifecycle" | "variable_set_list" | "environment_list" | "variable_set_get_variable" | "variable_set_set_variable" | "environment_set_variable" | "capability_catalog_search" | "capability_authorization_request" | "github_connect_link" | "github_repositories_list" | "social_connections_list" | "social_posts_recent" | "social_daily_analysis_context" | "social_search_live" | "social_mentions_live" | "social_thread_fetch" | "social_posts_sync" | "social_post_reply" | "x_accounts_list" | "x_search_live" | "x_mentions_live" | "x_thread_fetch" | "x_posts_sync" | "x_post_reply" | "reddit_accounts_list" | "reddit_search_live" | "reddit_mentions_live" | "reddit_thread_fetch" | "reddit_posts_sync" | "reddit_post_reply" | "scheduled_tasks_list" | "scheduled_tasks_get" | "scheduled_tasks_create" | "scheduled_tasks_update" | "scheduled_tasks_pause" | "scheduled_tasks_resume" | "scheduled_tasks_trigger" | "scheduled_tasks_delete" | "scheduled_task_runs_list" | "slack_bot_list_channels" | "slack_bot_search" | "slack_bot_channel_history" | "slack_bot_thread_replies" | "slack_bot_list_users" | "slack_bot_list_files" | "slack_bot_file_info" | "slack_bot_file_content" | "slack_bot_post_message" | "slack_bot_delete_message" | "fiken_companies_list" | "fiken_contacts_list" | "fiken_contact_create" | "fiken_products_list" | "fiken_invoices_list" | "fiken_invoice_get" | "fiken_invoice_draft_create" | "fiken_bank_accounts_list" | "fiken_purchases_list" | "fiken_sales_list" | "atlassian_sources_list" | "atlassian_search" | "atlassian_get" | "sandbox_file_publish" | "artifacts_list" | "artifacts_get_source" | "artifacts_create" | "artifacts_publish" | "artifacts_rollback" | "editable_artifact_list" | "editable_artifact_create" | "editable_artifact_import" | "editable_artifact_get" | "editable_artifact_inspect" | "editable_artifact_apply" | "editable_artifact_export" | "editable_artifact_export_status";
 export type ProductAccessMode = "local" | "configured" | "managed";
 export type ModelCapabilitySupportV1 = "supported" | "unsupported" | "unknown";
 export type ModelCapabilityStateV1 = {
@@ -1987,11 +2297,26 @@ export type ModelCredentialReadinessV1 = {
 };
 export type WorkspaceModelCatalogModel = ClientModel & {
     credentialReadiness: ModelCredentialReadinessV1;
+    /** Exact workspace-policy verdict without exposing provider identity. */
+    policyAllowed?: boolean | undefined;
     availability: ModelAvailabilityV1;
 };
 export type WorkspaceModelCatalogResponse = {
     models: WorkspaceModelCatalogModel[];
 };
+/**
+ * The workspace's hard model/provider allowlist. `null` means unrestricted for
+ * that dimension; an empty array is an explicit total block.
+ */
+export type WorkspaceModelAccessPolicy = {
+    allowedProviders: string[] | null;
+    allowedModels: string[] | null;
+};
+/** Full replacement body for `PUT /v1/workspaces/:id/model-policy`. */
+export type UpdateWorkspaceModelAccessPolicyRequest = {
+    allowedProviders?: string[] | null | undefined;
+    allowedModels?: string[] | null | undefined;
+};
 /**
  * Connection state of a workspace's Codex (ChatGPT) subscription, returned by
  * `GET /v1/workspaces/:id/codex/status`. `models` are the codex models the
@@ -2132,6 +2457,12 @@ export type CodexAccountOverview = {
         credits: CodexResetCredit[];
     };
     canRedeem: boolean;
+    /** Secret-free reason redemption is owner-actionable or view-only. */
+    redemptionAccess: {
+        ownership: "current_human" | "unowned" | "different_human" | "managed_human_unavailable";
+        /** A direct managed-cookie admin may claim only an unowned same-provider row by reconnecting. */
+        canClaimUnownedViaReconnect: boolean;
+    };
     /** Owning managed-cookie human may replay durable completion without a healthy provider token. */
     canResumeRedemption: boolean;
     /** Durable owner-scoped ambiguity/completion discovery; never redemption authority for agents. */
@@ -2298,8 +2629,10 @@ export type ClientAuthConfig = {
 } | {
     mode: "managedSession";
     session: "cookie";
+    /** Defaults to true when omitted by an older deployment. */
+    emailVerificationRequired?: boolean;
 };
-export declare const OPENGENI_API_CONTRACT_REVISION: "2026-08-model-context-v1";
+export declare const OPENGENI_API_CONTRACT_REVISION: "2026-08-atomic-session-fork-visibility-v1";
 export declare const OPENGENI_API_CONTRACT_HEADER: "x-opengeni-api-contract";
 /** Bounded request/response identifier shared by browser, ingress, and API diagnostics. */
 export declare const OPENGENI_CORRELATION_HEADER: "x-opengeni-correlation-id";
@@ -2467,6 +2800,208 @@ export type ManagedOrganizationMembership = {
 export type ListManagedOrganizationMembershipsResponse = {
     memberships: ManagedOrganizationMembership[];
 };
+export type UserResourceKind = "connection" | "document" | "variable_set" | "rig" | "connected_machine";
+export type UserResourceGrantAction = "connection.use" | "document.read" | "variable_set.use" | "rig.use" | "connected_machine.use";
+export type UserResourceAuthorityGrant = {
+    grantId: string;
+    targetWorkspaceId: string;
+    targetSessionId: string | null;
+    action: UserResourceGrantAction;
+    mode: "once" | "session" | "always";
+    context: "user_private" | "workspace_shared";
+    authorityEpoch: number | null;
+    generation: number;
+    status: "active" | "consumed" | "revoked" | "expired";
+    expiresAt: string | null;
+    delegation: UserResourceDelegation;
+};
+export type UserResourceAuthoritySummary = {
+    authorityId: string;
+    resourceKind: UserResourceKind;
+    resourceId: string;
+    originWorkspaceId: string | null;
+    generation: number;
+    status: "active" | "retained" | "revoked";
+    grants: UserResourceAuthorityGrant[];
+};
+export type ListUserResourceAuthoritiesOptions = {
+    resourceKind: UserResourceKind;
+    cursor?: string | undefined;
+    limit?: number | undefined;
+};
+export type ListUserResourceAuthoritiesResponse = {
+    scope: "user";
+    authorities: UserResourceAuthoritySummary[];
+    nextCursor: string | null;
+};
+export type IssueUserResourceGrantRequest = {
+    scope: "user";
+    resourceKind: UserResourceKind;
+    mode: "session";
+    context: "user_private" | "workspace_shared";
+    sessionId: string;
+    expectedAuthorityEpoch: number;
+    workspaceSharedAcknowledged?: boolean | undefined;
+} | {
+    scope: "user";
+    resourceKind: UserResourceKind;
+    mode: "always";
+    context: "user_private" | "workspace_shared";
+    sessionId?: null | undefined;
+    expectedAuthorityEpoch?: null | undefined;
+    workspaceSharedAcknowledged?: boolean | undefined;
+};
+export type UserResourceGrantMutationResponse = {
+    scope: "user";
+    grant: UserResourceAuthorityGrant;
+};
+export type RevokeUserResourceGrantResponse = {
+    scope: "user";
+    grant: {
+        grantId: string;
+        generation: number;
+        status: "revoked";
+        revokedAt: string;
+    };
+};
+export type OrganizationMembershipRole = "owner" | "admin" | "member";
+export type OrganizationInvitation = {
+    id: string;
+    organizationId: string;
+    targetEmail: string;
+    targetName: string | null;
+    initialWorkspaceIds: string[];
+    role: OrganizationMembershipRole;
+    status: "pending" | "accepted" | "revoked" | "expired";
+    revision: number;
+    expiresAt: string;
+    acceptedMembershipId: string | null;
+    createdAt: string;
+    updatedAt: string;
+};
+export type OrganizationMember = {
+    id: string;
+    organizationId: string;
+    subjectId: string;
+    name: string | null;
+    email: string | null;
+    role: OrganizationMembershipRole;
+    status: "provisioning" | "active" | "suspended" | "revoked";
+    authorizationRevision: number;
+    personalWorkspaceId: string | null;
+    revokedAt: string | null;
+    personalRetentionUntil: string | null;
+    createdAt: string;
+    updatedAt: string;
+};
+export type OrganizationSummary = {
+    id: string;
+    name: string;
+    createdAt: string;
+    updatedAt: string;
+};
+export type OrganizationWorkspaceAccessMember = {
+    membershipId: string;
+    subjectId: string;
+    subjectLabel: string | null;
+    principalKind: "human" | "service";
+    role: string;
+    permissions: string[];
+    createdAt: string;
+};
+export type OrganizationWorkspaceAccess = {
+    id: string;
+    name: string;
+    slug: string | null;
+    createdAt: string;
+    updatedAt: string;
+    members: OrganizationWorkspaceAccessMember[];
+};
+export type OrganizationAdministrationOverview = {
+    organization: OrganizationSummary;
+    workspaces: OrganizationWorkspaceAccess[];
+};
+export type OrganizationPrivateSessionSettings = {
+    organizationId: string;
+    enabled: boolean;
+    available: boolean;
+    version: number;
+    updatedAt: string;
+    changed?: boolean;
+};
+export type AddOrganizationWorkspaceMemberRequest = {
+    organizationMembershipId: string;
+    role?: string | undefined;
+    permissions: Permission[];
+};
+export type CreateOrganizationWorkspaceRequest = {
+    name: string;
+    slug?: string | null;
+    agentInstructions?: string | null;
+    operationId: string;
+};
+export type CreateOrganizationRequest = {
+    name: string;
+    operationId: string;
+};
+export type CreateOrganizationResponse = {
+    organization: OrganizationSummary;
+    workspaceId: string;
+};
+export type UpdateOrganizationNameRequest = {
+    name: string;
+    expectedUpdatedAt: string;
+    operationId: string;
+};
+export type UpdateOrganizationPrivateSessionSettingsRequest = {
+    enabled: boolean;
+    expectedVersion: number;
+    operationId: string;
+};
+export type OrganizationRetentionPolicy = {
+    organizationId: string;
+    mode: "retain" | "delete_after";
+    retentionDays: number | null;
+    version: number;
+    updatedAt: string;
+};
+export type CreateOrganizationInvitationRequest = {
+    email: string;
+    name?: string;
+    initialWorkspaceIds?: string[];
+    role?: OrganizationMembershipRole;
+    expiresAt: string;
+    operationId: string;
+};
+export type AcceptOrganizationInvitationRequest = {
+    expectedRevision: number;
+    operationId: string;
+};
+export type RevokeOrganizationInvitationRequest = AcceptOrganizationInvitationRequest;
+export type UpdateOrganizationMemberRequest = {
+    kind: "change_role" | "suspend" | "reactivate" | "offboard";
+    role?: OrganizationMembershipRole;
+    expectedAuthorizationRevision: number;
+    operationId: string;
+    reason?: string;
+};
+export type UpdateOrganizationRetentionPolicyRequest = {
+    mode: "retain" | "delete_after";
+    retentionDays: number | null;
+    expectedVersion: number;
+    operationId: string;
+};
+export type ListOrganizationInvitationsPageResponse = {
+    invitations: OrganizationInvitation[];
+    nextCursor: string | null;
+};
+export type ListOrganizationMembersResponse = {
+    members: OrganizationMember[];
+};
+export type AcceptOrganizationInvitationResponse = {
+    invitation: OrganizationInvitation;
+    membership: OrganizationMember;
+};
 export type Workspace = {
     id: string;
     accountId: string;
@@ -2491,6 +3026,10 @@ export type WorkspaceSettings = {
     memoryEnabled?: boolean | undefined;
     /** Reversible Memory V1 prompt composition rollout. */
     memoryPromptMode?: "legacy_standing" | "retrieval_only" | undefined;
+    /** Model policy inherited by new chats and scheduled tasks. */
+    sessionDefaults?: WorkspaceSessionDefaults | undefined;
+    /** Exact capability selection inherited by new top-level sessions. */
+    sessionToolDefaults?: WorkspaceSessionToolDefaults | undefined;
     voiceInput?: WorkspaceVoiceInputSettings | undefined;
     transcription?: WorkspaceTranscriptionPolicy | undefined;
     maxNestedAgentDepth?: number | null | undefined;
@@ -2499,8 +3038,18 @@ export type WorkspaceSettings = {
     /** Whether agents may invoke the built-in structured human-input tool. */
     agentHumanInputEnabled?: boolean | undefined;
     slackReactionSummon?: WorkspaceSlackReactionSummonSettings | undefined;
+    /** Slack orchestration notices; both default off when absent or invalid. */
+    slackOrchestrationNotices?: WorkspaceSlackOrchestrationNoticeSettings | undefined;
     [key: string]: unknown;
 };
+export type WorkspaceSessionDefaults = {
+    model: string;
+    reasoningEffort: ReasoningEffort;
+};
+export type WorkspaceSessionToolDefaults = {
+    mcpServerIds: string[];
+    firstPartyMcpTools: FirstPartyMcpToolName[];
+};
 export type WorkspaceSlackReactionSummonSettings = {
     enabled: boolean;
     emoji: "genie";
@@ -2511,6 +3060,16 @@ export type WorkspaceSlackReactionSummonSettings = {
         channelIds: string[];
     };
 };
+/**
+ * Per-workspace switches for the two Slack orchestration notices. Both are off
+ * unless the workspace explicitly turned them on.
+ */
+export type WorkspaceSlackOrchestrationNoticeSettings = {
+    /** Post a pointer card when a child worker blocks on input or an approval. */
+    childRequiresAction?: boolean | undefined;
+    /** Post one line when a goal pauses for budget or the continuation cap. */
+    goalPaused?: boolean | undefined;
+};
 export type SlackReactionChannel = {
     id: string;
     name: string | null;
@@ -2520,18 +3079,39 @@ export type SlackReactionChannelListResponse = {
     channels: SlackReactionChannel[];
     nextCursor: string | null;
 };
+export type SlackChannelRoute = {
+    slackChannelId: string;
+    targetWorkspaceId: string;
+    targetWorkspaceName: string | null;
+    source: "picker" | "admin";
+    updatedAt: string;
+};
+export type SlackChannelRouteListResponse = {
+    routes: SlackChannelRoute[];
+    routingEnabled: boolean;
+};
+export type UpdateSlackChannelRoutesRequest = {
+    connectionId: string;
+    routes: Array<{
+        slackChannelId: string;
+        targetWorkspaceId: string | null;
+    }>;
+};
 export type WorkspaceVoiceInputSettings = {
     enabled: boolean;
 };
 export type UpdateWorkspaceSettingsRequest = {
     memoryEnabled?: boolean | undefined;
     memoryPromptMode?: "legacy_standing" | "retrieval_only" | undefined;
+    sessionDefaults?: WorkspaceSessionDefaults | undefined;
+    sessionToolDefaults?: WorkspaceSessionToolDefaults | undefined;
     voiceInput?: WorkspaceVoiceInputSettings | undefined;
     transcription?: WorkspaceTranscriptionPolicy | undefined;
     maxNestedAgentDepth?: number | null | undefined;
     codexCompactionDefault?: "remote_v2" | "portable" | undefined;
     agentHumanInputEnabled?: boolean | undefined;
     slackReactionSummon?: WorkspaceSlackReactionSummonSettings | undefined;
+    slackOrchestrationNotices?: WorkspaceSlackOrchestrationNoticeSettings | undefined;
     [key: string]: unknown;
 };
 export type SetWorkspaceDefaultRigRequest = {
@@ -2555,6 +3135,7 @@ export type ApiKey = {
     accountId: string;
     workspaceId: string | null;
     name: string;
+    description: string | null;
     prefix: string;
     permissions: Permission[];
     expiresAt: string | null;
@@ -2565,6 +3146,7 @@ export type ApiKey = {
 };
 export type CreateApiKeyRequest = {
     name: string;
+    description?: string | undefined;
     permissions: Permission[];
     expiresAt?: string | undefined;
 };
@@ -2641,20 +3223,43 @@ export type SessionGoalRevision = {
     resultObjectiveRevision: number | null;
     text: string;
     successCriteria: string | null;
+    rootConstraints: string[];
     mutationPolicy: SessionGoalMutationPolicy;
     rationale: string;
     actor: "agent" | "api" | "scheduled_task";
     actorTurnId: string | null;
     actorAttemptId: string | null;
     proposalId: string | null;
+    rollbackOfRevisionId: string | null;
     createdAt: string;
 };
 export type ApplySessionGoalRevisionRequest = {
     expectedObjectiveRevision: number;
     rationale?: string | undefined;
 };
+export type ListSessionGoalRevisionsOptions = {
+    limit?: number | undefined;
+    before?: string | undefined;
+};
+export type ListSessionGoalRevisionsResponse = {
+    revisions: SessionGoalRevision[];
+    hasMore: boolean;
+    nextCursor: string | null;
+};
+export type RejectSessionGoalRevisionRequest = {
+    expectedObjectiveRevision: number;
+    rationale: string;
+};
+export type RejectSessionGoalRevisionResponse = {
+    revision: SessionGoalRevision;
+    replay: boolean;
+};
+export type RollbackSessionGoalRevisionRequest = {
+    expectedObjectiveRevision: number;
+    rationale: string;
+};
 export type SessionGoalContinuationState = "inactive" | "scheduled" | "running" | "blocked" | "invariant_broken";
-export type SessionGoalContinuationReason = "goal_inactive" | "wake_pending" | "continuation_pending" | "human_work_pending" | "goal_turn_running" | "human_turn_running" | "workstream_paused" | "approval_required" | "provider_backpressure" | "session_cancelled" | "system_work_pending" | "missing_obligation";
+export type SessionGoalContinuationReason = "goal_inactive" | "wake_pending" | "continuation_pending" | "human_work_pending" | "goal_turn_running" | "human_turn_running" | "workstream_paused" | "approval_required" | "provider_backpressure" | "session_cancelled" | "system_work_pending" | "held_for_input" | "backoff_pending" | "missing_obligation";
 export type SessionGoalContinuation = {
     state: SessionGoalContinuationState;
     reason: SessionGoalContinuationReason;
@@ -2662,6 +3267,8 @@ export type SessionGoalContinuation = {
     observedRevision: number;
     nextAttemptAt: string | null;
     lastError: string | null;
+    /** Agent-stated reason for a `held_for_input` hold; null otherwise. */
+    holdReason?: string | null | undefined;
 };
 export type SessionGoal = {
     id: string;
@@ -2671,6 +3278,7 @@ export type SessionGoal = {
     status: SessionGoalStatus;
     text: string;
     successCriteria: string | null;
+    rootConstraints: string[];
     evidence: string | null;
     rationale: string | null;
     pausedReason: string | null;
@@ -2693,6 +3301,7 @@ export type UpdateSessionGoalRequest = {
 } | {
     text: string;
     successCriteria?: string | null | undefined;
+    rootConstraints?: string[] | undefined;
     mutationPolicy?: SessionGoalMutationPolicy | undefined;
     rationale: string;
     expectedObjectiveRevision: number;
@@ -2741,6 +3350,10 @@ export type EffectiveSessionControl = {
         interruptionPendingCount: number;
         quiescencePendingCount: number;
     } | null;
+    backgroundCommandSettlement?: {
+        state: "stopping";
+        commandCount: number;
+    } | null | undefined;
 };
 export type SessionCommandReceipt = {
     id: string;
@@ -2754,6 +3367,7 @@ export type SessionCommandReceipt = {
     appliedDraftRevision: number | null;
     createdAt: string;
 };
+export type SessionPromptRouting = "accepted_for_execution" | "queued_for_execution" | "accepted_for_steering";
 export type ComposerDraft = {
     revision: number;
     text: string;
@@ -2761,12 +3375,13 @@ export type ComposerDraft = {
     resources: ResourceRef[];
     model: string;
     reasoningEffort: ReasoningEffort;
-    latencyMode?: LatencyMode | undefined;
+    latencyMode: LatencyMode;
     sourceTurnId: string | null;
     sourceTurnVersion: number | null;
     updatedAt: string | null;
 };
 export type NewSessionDraftOptions = {
+    visibility?: SessionVisibility | undefined;
     sandboxBackend?: SandboxBackend | undefined;
     targetSandboxId?: string | undefined;
     workingDir?: string | undefined;
@@ -2776,6 +3391,19 @@ export type NewSessionDraftOptions = {
     firstPartyMcpPermissions?: Permission[] | undefined;
     firstPartyMcpTools?: FirstPartyMcpToolName[] | undefined;
 };
+export type NewSessionSelectionHistory = {
+    /** Most-recently used project first. Null channelId is the Default project. */
+    projects: Array<{
+        channelId: string | null;
+        /** Null means the managed sandbox was used most recently in this project. */
+        targetSandboxId: string | null;
+        /** Most-recently used machine in this project first. */
+        machines: Array<{
+            sandboxId: string;
+            workingDir: string | null;
+        }>;
+    }>;
+};
 export type NewSessionDraft = {
     revision: number;
     text: string;
@@ -2785,8 +3413,9 @@ export type NewSessionDraft = {
     toolsProvided: boolean;
     model: string;
     reasoningEffort: ReasoningEffort;
-    latencyMode?: LatencyMode | undefined;
+    latencyMode: LatencyMode;
     options: NewSessionDraftOptions;
+    selectionHistory: NewSessionSelectionHistory;
     updatedAt: string | null;
 };
 export type SessionQueueSnapshot = {
@@ -2807,7 +3436,7 @@ export type SessionQueueSnapshot = {
 };
 export type SessionPendingInputPreview = Pick<SessionSystemUpdate, "id" | "sessionId" | "kind" | "classification" | "sourceId" | "summary" | "createdAt">;
 export type SystemUpdateClassification = "success" | "failure" | "action_required" | "info";
-export type SessionSystemUpdateKind = "scheduled_occurrence" | "goal_continuation" | "agent_message" | "agent_steer_instruction" | "child_terminal_result" | "media_generation_result";
+export type SessionSystemUpdateKind = "scheduled_occurrence" | "goal_continuation" | "agent_message" | "agent_steer_instruction" | "child_terminal_result" | "media_generation_result" | "child_requires_action" | "child_requires_action_resolved" | "child_paused" | "child_waiting_capacity" | "child_progress";
 export type SessionSystemUpdateState = "pending" | "delivered" | "cancelled" | "superseded" | "failed";
 export type SessionSystemUpdate = {
     id: string;
@@ -2899,7 +3528,26 @@ export type DeleteSessionQueueItemRequest = {
 export type SaveComposerDraftRequest = Omit<ComposerDraft, "revision" | "sourceTurnId" | "sourceTurnVersion" | "updatedAt"> & {
     expectedRevision: number;
 };
-export type SaveNewSessionDraftRequest = Omit<NewSessionDraft, "revision" | "updatedAt"> & {
+export type SubmitComposerDraftRequest = Omit<SaveComposerDraftRequest, "expectedRevision"> & {
+    expectedDraftRevision: number;
+    clientEventId: string;
+    delivery: "send" | "steer";
+    controlEtag?: string;
+    modelContext?: string;
+    mcpCredentialUpdates?: SessionMcpCredentialUpdateInput[];
+    connectionAuthorities?: McpConnectionAuthoritySelection[];
+    personalResourceAttachment?: PersonalResourceAttachmentIntent;
+};
+export type SubmitComposerDraftResponse = {
+    accepted: SessionEvent;
+    turn: SessionTurn;
+    draft: ComposerDraft;
+    receipt: SessionCommandReceipt;
+    routing: SessionPromptRouting;
+    interruptionCount: number;
+    replay: boolean;
+};
+export type SaveNewSessionDraftRequest = Omit<NewSessionDraft, "revision" | "selectionHistory" | "updatedAt"> & {
     expectedRevision: number;
 };
 /** Input shape for agent config on create/update (server applies defaults). */
@@ -2913,6 +3561,8 @@ export type ScheduledTaskAgentConfigInput = {
     reasoningEffort?: ReasoningEffort | undefined;
     sandboxBackend?: SandboxBackend | undefined;
     goal?: GoalSpec | undefined;
+    executionClass?: "incident_telemetry" | undefined;
+    incidentTelemetryPreflight?: IncidentTelemetryPreflightInput | undefined;
     maxNestedAgentDepth?: number | undefined;
 };
 export type CreateAgentScheduledTaskRequest = {
@@ -2923,6 +3573,7 @@ export type CreateAgentScheduledTaskRequest = {
     } | undefined;
     runMode?: ScheduledTaskRunMode | undefined;
     targetSessionId?: string | null | undefined;
+    connectionAuthorities?: McpConnectionAuthoritySelection[] | undefined;
     overlapPolicy?: ScheduledTaskOverlapPolicy | undefined;
     agentConfig: ScheduledTaskAgentConfigInput;
     status?: ScheduledTaskStatus | undefined;
@@ -2948,6 +3599,7 @@ export type UpdateScheduledTaskRequest = {
     schedule?: ScheduledTaskScheduleSpec | undefined;
     runMode?: ScheduledTaskRunMode | undefined;
     targetSessionId?: string | null | undefined;
+    connectionAuthorities?: McpConnectionAuthoritySelection[] | undefined;
     overlapPolicy?: ScheduledTaskOverlapPolicy | undefined;
     action?: ScheduledTaskAction | undefined;
     agentConfig?: ScheduledTaskAgentConfigInput | undefined;
@@ -2988,6 +3640,8 @@ export type ScheduledTaskRun = {
     accountId: string;
     workspaceId: string;
     taskId: string;
+    taskAuthorityRevision: number | null;
+    taskExecutionDigest: string | null;
     status: ScheduledTaskRunStatus;
     triggerType: ScheduledTaskTriggerType;
     scheduledAt: string | null;
@@ -3020,6 +3674,9 @@ export type VariableSet = {
     id: string;
     accountId: string;
     workspaceId: string;
+    scope: "organization" | "workspace" | "user";
+    generation: number;
+    status: "active" | "revoked";
     name: string;
     description: string | null;
     variables: VariableSetVariableMetadata[];
@@ -3031,6 +3688,8 @@ export type WorkspaceEnvironmentVariableMetadata = VariableSetVariableMetadata;
 /** @deprecated use VariableSet */
 export type WorkspaceEnvironment = VariableSet;
 export type CreateVariableSetRequest = {
+    /** Omitted remains the legacy workspace-owned path. */
+    scope?: "organization" | "workspace" | "user" | undefined;
     name: string;
     description?: string | undefined;
     /** Initial variables. Values are write-only: they never come back on reads. */
@@ -3115,6 +3774,8 @@ export type Channel = {
     workspaceId: string;
     name: string;
     description: string | null;
+    pinned: boolean;
+    sortOrder: number;
     createdBy: string | null;
     createdAt: string;
     updatedAt: string;
@@ -3126,6 +3787,11 @@ export type CreateChannelRequest = {
 export type UpdateChannelRequest = {
     name?: string;
     description?: string | null;
+    pinned?: boolean;
+};
+/** Complete workspace project order. It is replaced atomically after a drag. */
+export type ReorderChannelsRequest = {
+    channelIds: string[];
 };
 /** Re-files one session; null moves it back to the unfiled inbox. */
 export type UpdateSessionChannelRequest = {
@@ -3135,6 +3801,9 @@ export type Rig = {
     id: string;
     accountId: string;
     workspaceId: string;
+    scope: ResourceAuthorityScope;
+    generation: number;
+    status: "active" | "revoked";
     name: string;
     description: string | null;
     createdBy: string | null;
@@ -3173,6 +3842,7 @@ export type RigChange = {
     updatedAt: string;
 };
 export type CreateRigRequest = {
+    scope?: ResourceAuthorityScope;
     name: string;
     description?: string | undefined;
     image?: string | undefined;
@@ -3472,6 +4142,7 @@ export type Document = {
     authorityKind: DocumentAuthorityKind;
     authorityWorkspaceId: string | null;
     authoritySubjectId: string | null;
+    authorityId?: string | null | undefined;
     visibility: DocumentVisibility;
     createdBy: string | null;
     agentAccess: boolean;
@@ -3541,6 +4212,92 @@ export type CreateKnowledgeDropRequest = {
 export type MoveDocumentRequest = {
     targetBaseId?: string | undefined;
 };
+export type DocumentAuthorityTuple = {
+    kind: DocumentAuthorityKind;
+    workspaceId: string | null;
+    subjectId: string | null;
+    authorityId: string | null;
+};
+export type ReclassifyDocumentAuthorityRequest = {
+    operationId: string;
+    expectedAuthority: DocumentAuthorityTuple;
+    targetAuthorityKind: DocumentAuthorityKind;
+};
+export type DocumentAuthorityReclassification = {
+    operationId: string;
+    documentId: string;
+    previousAuthority: DocumentAuthorityTuple;
+    authority: DocumentAuthorityTuple;
+    createdAt: string;
+};
+export type ListDocumentAuthorityReclassificationsOptions = {
+    limit?: number | undefined;
+    cursor?: string | undefined;
+};
+export type ListDocumentAuthorityReclassificationsResponse = {
+    receipts: DocumentAuthorityReclassification[];
+    hasMore: boolean;
+    nextCursor: string | null;
+};
+export type RunDocumentDefaultCollectionBackfillRequest = {
+    runId: string;
+    operationId: string;
+    batchSize?: number | undefined;
+};
+export type DocumentDefaultCollectionBackfill = {
+    runId: string;
+    operationId: string;
+    status: "running" | "completed";
+    lastWorkspaceId: string | null;
+    processedCount: number;
+    createdCount: number;
+    adoptedCount: number;
+    completedAt: string | null;
+};
+export type DocumentDefaultCollectionBackfillRunAudit = Omit<DocumentDefaultCollectionBackfill, "operationId"> & {
+    actorSubjectId: string;
+    startedAt: string;
+    updatedAt: string;
+};
+export type DocumentDefaultCollectionBackfillOperationAudit = {
+    operationId: string;
+    result: DocumentDefaultCollectionBackfill;
+    createdAt: string;
+};
+export type DocumentDefaultCollectionBackfillReceiptAudit = {
+    workspaceId: string;
+    baseId: string;
+    outcome: "created" | "adopted";
+    createdAt: string;
+};
+export type ListDocumentDefaultCollectionBackfillRunsResponse = {
+    runs: DocumentDefaultCollectionBackfillRunAudit[];
+    hasMore: boolean;
+    nextCursor: string | null;
+};
+export type DocumentDefaultCollectionBackfillAudit = {
+    run: DocumentDefaultCollectionBackfillRunAudit;
+    operations: DocumentDefaultCollectionBackfillOperationAudit[];
+    receipts: DocumentDefaultCollectionBackfillReceiptAudit[];
+    operationsHasMore: boolean;
+    operationsNextCursor: string | null;
+    receiptsHasMore: boolean;
+    receiptsNextCursor: string | null;
+};
+export type GetDocumentDefaultCollectionBackfillAuditOptions = {
+    limit?: number | undefined;
+    operationCursor?: string | undefined;
+    receiptCursor?: string | undefined;
+};
+export type OrganizationDocumentAuthorityReclassification = DocumentAuthorityReclassification & {
+    actorSubjectId: string;
+    requestWorkspaceId: string;
+};
+export type ListOrganizationDocumentAuthorityReclassificationsResponse = {
+    receipts: OrganizationDocumentAuthorityReclassification[];
+    hasMore: boolean;
+    nextCursor: string | null;
+};
 export type DocumentSearchRequest = {
     query: string;
     baseIds?: string[] | undefined;
@@ -3658,6 +4415,29 @@ export type CapabilityPackScheduledTaskTemplate = {
     defaultOverlapPolicy: ScheduledTaskOverlapPolicy;
     prompt?: string | undefined;
 };
+export type CapabilityPackAutomationTemplate = {
+    id: string;
+    name: string;
+    description: string;
+    adapterId: string;
+    eventTypes: string[];
+    sessionTemplate: {
+        prompt: string;
+        instructions: string | null;
+        resources: ResourceRef[];
+        skills: CapabilityPackSkill[];
+        tools: ToolRef[];
+        firstPartyMcpTools: string[];
+        firstPartyMcpPermissions: Permission[];
+        model: string | null;
+        reasoningEffort: ReasoningEffort | null;
+        sandboxBackend: SandboxBackend | null;
+        policyRole: string | null;
+        metadata: Record<string, unknown>;
+    };
+    configuration: Record<string, unknown>;
+    connectionRequirement: string | null;
+};
 export type CapabilityPackSkillFile = {
     path: string;
     content: string;
@@ -3730,6 +4510,7 @@ export type CapabilityPack = {
     connectors: CapabilityPackConnector[];
     knowledge: CapabilityPackKnowledge[];
     scheduledTaskTemplates: CapabilityPackScheduledTaskTemplate[];
+    automationTemplates?: CapabilityPackAutomationTemplate[] | undefined;
     variableSet?: CapabilityPackVariableSetSpec | undefined;
     metadata: Record<string, unknown>;
 };
@@ -3816,6 +4597,29 @@ export type RegisterCapabilityPackRequest = {
         defaultOverlapPolicy?: ScheduledTaskOverlapPolicy | undefined;
         prompt?: string | undefined;
     }[] | undefined;
+    automationTemplates?: {
+        id: string;
+        name: string;
+        description: string;
+        adapterId: string;
+        eventTypes: string[];
+        sessionTemplate: {
+            prompt: string;
+            instructions?: string | null | undefined;
+            resources?: ResourceRef[] | undefined;
+            skills?: CapabilityPackSkill[] | undefined;
+            tools?: ToolRef[] | undefined;
+            firstPartyMcpTools?: string[] | undefined;
+            firstPartyMcpPermissions?: Permission[] | undefined;
+            model?: string | null | undefined;
+            reasoningEffort?: ReasoningEffort | null | undefined;
+            sandboxBackend?: SandboxBackend | null | undefined;
+            policyRole?: string | null | undefined;
+            metadata?: Record<string, unknown> | undefined;
+        };
+        configuration?: Record<string, unknown> | undefined;
+        connectionRequirement?: string | null | undefined;
+    }[] | undefined;
     variableSet?: {
         description: string;
         requiredVariables?: string[] | undefined;
@@ -3846,6 +4650,90 @@ export type PackInstallation = {
     enabledAt: string;
     updatedAt: string;
 };
+export type PrReviewProvider = GitCredentialProvider;
+export type PrReviewCredentialKind = "github_app" | "provider_token";
+export type PrReviewWebhookAuthKind = "hmac_sha256" | "shared_token" | "basic";
+export type CreatePrReviewAppRegistrationRequest = {
+    name: string;
+    provider: PrReviewProvider;
+    providerBaseUrl?: string | undefined;
+    appId?: string | undefined;
+    credentialKind: PrReviewCredentialKind;
+    privateKey?: string | undefined;
+    accessToken?: string | undefined;
+    accessTokenExpiresAt?: string | null | undefined;
+    webhookSecret: string;
+    webhookUsername?: string | undefined;
+};
+export type UpdatePrReviewAppRegistrationRequest = {
+    name?: string | undefined;
+    privateKey?: string | undefined;
+    accessToken?: string | undefined;
+    accessTokenExpiresAt?: string | null | undefined;
+    webhookSecret?: string | undefined;
+    webhookUsername?: string | undefined;
+    status?: "active" | "disabled" | undefined;
+};
+export type PrReviewAppRegistration = {
+    id: string;
+    sourceId: string;
+    accountId: string;
+    workspaceId: string;
+    name: string;
+    provider: PrReviewProvider;
+    providerBaseUrl: string;
+    appId: string | null;
+    credentialKind: PrReviewCredentialKind;
+    hasCredential: boolean;
+    accessTokenExpiresAt: string | null;
+    webhookAuthKind: PrReviewWebhookAuthKind;
+    hasWebhookSecret: boolean;
+    webhookUsername: string | null;
+    webhookPath: string;
+    status: "active" | "disabled";
+    createdBySubjectId: string;
+    createdAt: string;
+    updatedAt: string;
+};
+export type CreatePrReviewRepositoryBindingRequest = {
+    registrationId: string;
+    repositoryUri: string;
+    repositoryFullName: string;
+    providerRepositoryId: string | number;
+    installationId?: string | number | undefined;
+    projectId?: string | number | undefined;
+    model?: string | null | undefined;
+    additionalInstructions?: string | null | undefined;
+    status?: "active" | "disabled" | undefined;
+};
+export type UpdatePrReviewRepositoryBindingRequest = {
+    model?: string | null | undefined;
+    additionalInstructions?: string | null | undefined;
+    status?: "active" | "disabled" | undefined;
+};
+export type PrReviewRepositoryBinding = {
+    id: string;
+    triggerId: string;
+    accountId: string;
+    workspaceId: string;
+    registrationId: string;
+    provider: PrReviewProvider;
+    repositoryUri: string;
+    repositoryFullName: string;
+    providerRepositoryId: string;
+    installationId: string | null;
+    projectId: string | null;
+    model: string | null;
+    additionalInstructions: string | null;
+    status: "active" | "disabled";
+    createdBySubjectId: string;
+    createdAt: string;
+    updatedAt: string;
+};
+export type ListPrReviewConfigurationResponse = {
+    registrations: PrReviewAppRegistration[];
+    repositories: PrReviewRepositoryBinding[];
+};
 export type EnablePackRequest = {
     variableSetId?: string | undefined;
     /** @deprecated use variableSetId */
@@ -4169,6 +5057,8 @@ export type IntegrationFacetBindingSummary = {
     lastErrorCode: string | null;
     createdAt: string;
     updatedAt: string;
+    directlyOwned: boolean;
+    owners: CapabilityComponentOwner[];
 };
 export type IntegrationInstanceFacetsResponse = {
     capabilityId: string;
@@ -4205,6 +5095,25 @@ export type IntegrationFacetRemovalResult = {
     binding: IntegrationFacetBindingSummary | null;
     remainingOwners: CapabilityComponentOwner[];
 };
+/**
+ * Presentation-only consent copy served with an integration or connector.
+ * Never grants a scope or replaces server-side authorization; the UI keeps a
+ * generic fallback for any omitted field.
+ */
+export type IntegrationPresentation = {
+    providerName?: string | undefined;
+    icon?: "calendar" | "cloud" | "contacts" | "files" | "mail" | undefined;
+    introduction?: string | undefined;
+    capabilities?: {
+        title: string;
+        description: string;
+    }[] | undefined;
+    permissionSummary?: string | undefined;
+    scopeLabels?: Record<string, {
+        label: string;
+        description: string;
+    }> | undefined;
+};
 export type IntegrationDefinitionSummary = {
     id: string;
     name: string;
@@ -4218,6 +5127,7 @@ export type IntegrationDefinitionSummary = {
         kind: "oauth2";
         scopes: string[];
     };
+    presentation?: IntegrationPresentation | undefined;
     facets: IntegrationFacetDefinitionSummary[];
 };
 export type ListIntegrationDefinitionsResponse = {
@@ -4719,6 +5629,21 @@ export type InsightsModelCallRow = {
     estimatedProviderUsd: number | null;
     pricingSource: InsightsPricingSource | null;
 };
+export type ModelContextContributionSource = "workspace_instruction_policy" | "legacy_workspace_instructions" | "preference_registry_descriptor" | "company_profile" | "legacy_memory_v1" | "runtime_skill_catalog";
+export type InsightsPromptContributionRow = {
+    source: ModelContextContributionSource;
+    items: number;
+    utf8Bytes: number;
+    estimatedTokens: number;
+    calls: number;
+};
+export type InsightsPromptContributions = {
+    estimatedTokens: number;
+    utf8Bytes: number;
+    coveredCalls: number;
+    totalCalls: number;
+    sources: InsightsPromptContributionRow[];
+};
 export type WorkspaceInsightsSnapshot = {
     range: InsightsRange;
     rangeLabel: string;
@@ -4736,6 +5661,7 @@ export type WorkspaceInsightsSnapshot = {
     drivers: InsightsSpendDriver[];
     schedules: InsightsScheduleRow[];
     recentCalls: InsightsModelCallRow[];
+    promptContributions: InsightsPromptContributions;
     warmSeconds: number;
     priorWarmSeconds: number;
     warmGroups: InsightsWarmGroupRow[];
@@ -4789,6 +5715,14 @@ export type CreateCheckoutResponse = {
     checkoutSessionId: string;
     url: string;
 };
+export type CreateBillingPortalRequest = {
+    accountId?: string | undefined;
+    returnUrl?: string | undefined;
+};
+export type CreateBillingPortalResponse = {
+    portalSessionId: string;
+    url: string;
+};
 export type UserMessageEventInput = {
     type: "user.message";
     clientEventId?: string | undefined;
@@ -4800,7 +5734,11 @@ export type UserMessageEventInput = {
         model?: string | undefined;
         reasoningEffort?: ReasoningEffort | undefined;
         latencyMode?: LatencyMode | undefined;
+        controlEtag?: string | undefined;
+        expectedDraftRevision?: number | undefined;
         mcpCredentialUpdates?: SessionMcpCredentialUpdateInput[] | undefined;
+        connectionAuthorities?: McpConnectionAuthoritySelection[] | undefined;
+        personalResourceAttachment?: PersonalResourceAttachmentIntent | undefined;
     };
 };
 export type UserApprovalDecisionEventInput = {
@@ -4842,12 +5780,74 @@ export type MetricSample = {
 /** The derived dashboard state of a machine (M3 liveness + consent/display
  *  reasons + the in-flight device-flow). */
 export type MachineState = "online" | "reconnecting" | "offline" | "consent_required" | "display_unavailable" | "enrolling";
-export type MachineKind = "modal" | "selfhosted";
+export type MachineKind = "modal" | "selfhosted" | "opensandbox";
+export type MachineConnectionAuthority = {
+    state: "not_applicable" | "unclaimed" | "active" | "expired";
+    generation: number;
+    supersededCount: number;
+    leaseExpiresAt: string | null;
+    duplicateRunnerDeniedCount: number;
+    duplicateRunnerDeniedAt: string | null;
+};
+export type MachineRuntimeCapabilities = {
+    exec: boolean;
+    filesystem: boolean;
+    git: boolean;
+    pty: boolean;
+    desktop: boolean;
+    opStream: boolean;
+    browserBridge: boolean;
+    operationResourcePolicy: boolean;
+    operationCpuQuota: boolean;
+};
+export type MachineUpdateStatus = "requested" | "accepted" | "waiting_for_idle" | "downloading" | "verifying" | "applying" | "restarting" | "succeeded" | "failed";
+export type MachineUpdateState = {
+    operationId: string;
+    status: MachineUpdateStatus;
+    targetVersion: string;
+    expectedBinarySha256: string | null;
+    errorCode: string | null;
+    retryable: boolean;
+    rolledBack: boolean;
+    requestedAt: string;
+    updatedAt: string;
+    completedAt: string | null;
+};
+export type MachineRuntime = {
+    installedVersion: string | null;
+    binarySha256: string | null;
+    updateChannel: "stable" | "beta" | null;
+    desiredVersion: string | null;
+    versionState: "unknown" | "current" | "outdated" | "ahead" | "updating" | "update_failed";
+    capabilities: MachineRuntimeCapabilities;
+    update: MachineUpdateState | null;
+};
+export type UpdateMachineAgentResponse = {
+    operationId: string;
+    accepted: boolean;
+    targetVersion: string;
+};
+export type MachineOperationPolicy = {
+    memoryMaxBytes: number | null;
+    memoryHighBytes: number | null;
+    cpuMaxMillicores: number | null;
+    revision: number;
+    updatedAt: string | null;
+};
+export type UpdateMachineOperationPolicyRequest = {
+    memoryMaxBytes: number | null;
+    memoryHighBytes: number | null;
+    /** Omitted preserves the current CPU limit for older/partial clients; null clears. */
+    cpuMaxMillicores?: number | null;
+    expectedRevision: number;
+};
 /** A machine as the Machines dashboard renders it (an enrolled selfhosted machine
  *  or the session's synthetic Modal group box, `isSessionGroup: true`). */
 export type MachineView = {
     sandboxId: string;
     enrollmentId: string | null;
+    scope: ResourceAuthorityScope;
+    generation: number;
     name: string;
     kind: MachineKind;
     state: MachineState;
@@ -4866,6 +5866,14 @@ export type MachineView = {
     allowScreenControl: boolean;
     sharedSessionCount: number;
     lastSeenAt: string | null;
+    /** Secret-free single-runner authority diagnostics. */
+    connectionAuthority: MachineConnectionAuthority;
+    /** Exact build/update truth. Null means the runner predates runtime Hello
+     * reporting or this is a managed-session group without a connected agent. */
+    runtime: MachineRuntime | null;
+    /** Explicit per-enrollment command memory policy. Null only for managed
+     * session boxes; null limits on a real machine mean unrestricted. */
+    operationPolicy: MachineOperationPolicy | null;
     metrics: MetricSample | null;
 };
 /** GET /v1/workspaces/:ws/machines — the dashboard list + the active-sandbox
@@ -4920,6 +5928,7 @@ export type SwapActiveSandboxResponse = {
 };
 /** Mirror of `@opengeni/contracts` EnrollmentOs. */
 export type EnrollmentOs = "linux" | "macos" | "windows";
+export type ResourceAuthorityScope = "organization" | "workspace" | "user";
 /** POST /v1/enrollments/device/lookup body. */
 export type DeviceEnrollmentLookupRequest = {
     userCode: string;
@@ -4943,6 +5952,7 @@ export type DeviceEnrollmentLookupResponse = {
 export type DeviceEnrollmentApproveRequest = {
     userCode: string;
     allowScreenControl?: boolean;
+    scope?: ResourceAuthorityScope;
 };
 /** POST /v1/workspaces/:ws/enrollments/device/approve response. */
 export type DeviceEnrollmentApproveResponse = {