@opengeni/sdk 1.0.1 → 2.3.0-canary.0

package/src/types.ts

@@ -172,7 +172,11 @@ export type WorkspaceRealtimeModelCatalogResponse = {
   models: WorkspaceRealtimeModelCatalogItem[];
 };
 export type SessionRealtimeState = "active" | "ended";
-export type SessionRealtimeEndReason = "user_stop" | "browser_unload" | "lease_expired";
+export type SessionRealtimeEndReason =
+  | "user_stop"
+  | "browser_unload"
+  | "lease_expired"
+  | "authority_revoked";
 
 export type SessionRealtimeMode = {
   id: string;
@@ -222,7 +226,7 @@ export type SessionStatus =
   | "failed"
   | "cancelled";
 
-// Mirror of `@opengeni/contracts` SandboxBackend (11 values; every member is
+// Mirror of `@opengeni/contracts` SandboxBackend (12 values; every member is
 // additive at the end). 3-way enum parity is pinned by
 // `test/contract-parity.test.ts`.
 export type SandboxBackend =
@@ -236,7 +240,8 @@ export type SandboxBackend =
   | "blaxel"
   | "cloudflare"
   | "vercel"
-  | "selfhosted";
+  | "selfhosted"
+  | "opensandbox";
 
 // Mirror of `@opengeni/contracts` SandboxOs. Only "linux" is reachable in v1.
 export type SandboxOs = "linux" | "macos" | "windows";
@@ -449,6 +454,8 @@ export type RepositoryResourceRef = {
   kind: "repository";
   uri: string;
   ref: string;
+  /** Exact immutable commit that repository materialization must produce. */
+  expectedCommitSha?: string | undefined;
   /**
    * Optional workspace-relative override. When omitted, OpenGeni persists
    * `repos/<encoded-host>/<owner>/<repo>` so equal names on different Git
@@ -458,6 +465,7 @@ export type RepositoryResourceRef = {
   mountPath?: string | undefined;
   subpath?: string | undefined;
   provider?: GitCredentialProvider | undefined;
+  connectionType?: "github_personal" | undefined;
   credentialBindingId?: GitCredentialBindingId | undefined;
   access?: GitRepositoryAccess | undefined;
   repositoryId?: number | string | undefined;
@@ -484,6 +492,7 @@ export type ToolRef = {
   kind: "mcp";
   id: string;
   optional?: boolean | undefined;
+  eager?: boolean | undefined;
 };
 
 export type SessionToolPolicy = {
@@ -529,6 +538,7 @@ export type SessionEffectiveToolPolicy = {
 export type GoalSpec = {
   text: string;
   successCriteria?: string | undefined;
+  rootConstraints?: string[] | undefined;
   maxAutoContinuations?: number | undefined;
   mutationPolicy?: SessionGoalMutationPolicy | undefined;
 };
@@ -575,6 +585,27 @@ export type UpdateSessionMcpApprovalPolicyResponse = {
 export type ConnectionKind = "oauth2" | "api_key" | "app_install" | "delegated";
 export type ConnectionStatus = "active" | "needs_reauth" | "revoked" | "error";
 
+export type UserResourceDelegation = {
+  authorityId: string;
+  grantId: string;
+  organizationId: string;
+  workspaceId: string;
+  sessionId: string | null;
+  action: string;
+  mode: "once" | "session" | "always";
+  context: "user_private" | "workspace_shared";
+  authorityEpoch: number | null;
+  authorityGeneration: number;
+  grantGeneration: number;
+  resourceVersionId?: string | null | undefined;
+};
+
+export type McpConnectionAuthoritySelection = {
+  serverId: string;
+  connectionId: string;
+  userDelegation: UserResourceDelegation;
+};
+
 export type McpServerConnectionRef = {
   connectionId?: string | undefined;
   provider?: string | undefined;
@@ -639,6 +670,114 @@ export type CreateConnectionRequest = {
   metadata?: Record<string, unknown> | undefined;
 };
 
+export type PersonalGitHubConnectionMetadata = {
+  credentialRole: "opengeni_github_personal";
+  providerFamily: "github";
+  providerPrincipalId: string;
+  githubUserId: string;
+  githubLogin: string;
+  oauthEnvironment: string;
+  oauthClientMarker: string;
+  credentialBindingId: string;
+  connectedAt: string;
+  lastVerifiedAt: string;
+  refreshTokenExpiresAt?: string | null | undefined;
+  disconnectedAt?: string | null | undefined;
+  [key: string]: unknown;
+};
+
+export type PersonalGitHubOAuthStartRequest = {
+  connectionId?: string | undefined;
+  returnPath?: string | undefined;
+};
+
+export type PersonalGitHubOAuthStartResponse = {
+  authorizationUrl: string;
+  expiresAt: string;
+};
+
+export type PersonalGitHubConnectionStatusResponse = {
+  enabled: boolean;
+  connection: ConnectionMetadata | null;
+  reviewUrl: string | null;
+};
+
+export type PersonalGitHubDisconnectRequest = {
+  expectedVersion: number;
+  idempotencyKey: string;
+};
+
+export type PersonalGitHubRepositoryAccess = "read" | "write";
+
+export type PersonalGitHubRepositoryPermissions = {
+  pull: boolean;
+  push: boolean;
+  admin: boolean;
+  maintain: boolean;
+  triage: boolean;
+};
+
+export type PersonalGitHubRepository = {
+  repositoryId: string;
+  fullName: string;
+  canonicalUrl: string;
+  defaultBranch: string;
+  visibility: "public" | "private" | "internal";
+  private: boolean;
+  archived: boolean;
+  disabled: boolean;
+  permissions: PersonalGitHubRepositoryPermissions;
+};
+
+export type PersonalGitHubSelectedRepository = PersonalGitHubRepository & {
+  selectedAccess: PersonalGitHubRepositoryAccess;
+  selectionGeneration: number;
+  selectedAt: string;
+  lastVerifiedAt: string;
+};
+
+export type PersonalGitHubRepositorySelectionState = {
+  connectionAuthorityGeneration: number;
+  credentialBindingId: string;
+  providerPrincipalId: string;
+  selectionGeneration: number;
+  repositories: PersonalGitHubSelectedRepository[];
+};
+
+export type PersonalGitHubRepositoryCatalogItem = PersonalGitHubRepository & {
+  selectedAccess: PersonalGitHubRepositoryAccess | null;
+};
+
+export type ListPersonalGitHubRepositoriesOptions = {
+  cursor?: number | undefined;
+  limit?: number | undefined;
+};
+
+export type ListPersonalGitHubRepositoriesResponse = {
+  repositories: PersonalGitHubRepositoryCatalogItem[];
+  nextCursor: number | null;
+  selection: PersonalGitHubRepositorySelectionState;
+};
+
+export type PersonalGitHubRepositorySelectionInput = {
+  repositoryId: string;
+  fullName: string;
+  access: PersonalGitHubRepositoryAccess;
+};
+
+export type ReplacePersonalGitHubRepositorySelectionsRequest = {
+  expectedConnectionAuthorityGeneration: number;
+  expectedSelectionGeneration: number;
+  idempotencyKey: string;
+  repositories: PersonalGitHubRepositorySelectionInput[];
+};
+
+export type VerifyPersonalGitHubRepositorySelectionsRequest = {
+  expectedConnectionAuthorityGeneration: number;
+  expectedSelectionGeneration: number;
+  idempotencyKey: string;
+};
+
 export type OpenGeniSlackBotInstallRequest = {
   /** Existing OpenGeni Slack bot connection to reinstall in place. */
   connectionId?: string | undefined;
@@ -681,7 +820,7 @@ export type SlackInstallationBinding = {
   slackTeamName: string;
   botId: string;
   botUserId: string;
-  botDisplayName: "OpenGeni";
+  botDisplayName: "OpenGeni" | "OpenGeni Staging";
   state: SlackInstallationBindingState;
   quarantineReason: string | null;
   version: number;
@@ -1027,11 +1166,95 @@ export type IntegrationClientMetadata = {
   response_types: ["code"];
 };
 
+export type SessionVisibility = "private" | "workspace";
+
+export type SessionTenancyCreateCapabilities = {
+  activated: boolean;
+  canCreatePrivate: boolean;
+  reason: "available" | "not_activated" | "managed_session_required" | "unavailable";
+};
+
+export type SessionTenancyPublicProjection = {
+  visibility: SessionVisibility;
+  authorityEpoch: number;
+  ownedByCurrentUser: boolean;
+  fork: {
+    sourceVisibility: SessionVisibility;
+    sourceAuthorityEpoch: number;
+    forkedAt: string;
+  } | null;
+};
+
+export type UpdateSessionVisibilityRequest = {
+  visibility: SessionVisibility;
+  expectedAuthorityEpoch: number;
+  idempotencyKey: string;
+};
+
+export type UpdateSessionVisibilityResponse = {
+  operationId: string;
+  eventId: string | null;
+  eventSequence: number | null;
+  visibility: SessionVisibility;
+  authorityEpoch: number;
+  changed: boolean;
+  replay: boolean;
+  revokedGrantCount: number;
+};
+
+export type ForkSessionRequest = {
+  idempotencyKey: string;
+  visibility: SessionVisibility;
+  workspaceSharedAcknowledged: boolean;
+};
+
+export type ForkSessionResponse = {
+  operationId: string;
+  eventId: string;
+  eventSequence: number;
+  sessionId: string;
+  workspaceId: string;
+  visibility: SessionVisibility;
+  authorityEpoch: 1;
+  copiedHistoryItemCount: number;
+  replay: boolean;
+};
+
+export type SessionBackgroundCommandActivity = {
+  state: "running" | "stopping";
+  count: number;
+};
+
+export type SessionBackgroundCommand = {
+  id: string;
+  workspaceId: string;
+  sessionId: string;
+  provider: "managed" | "connected_machine";
+  state: "running" | "stopping" | "exited" | "lost";
+  commandPreview: string;
+  cancelRequestedAt: string | null;
+  exitCode: number | null;
+  settlementReason: string | null;
+  startedAt: string;
+  settledAt: string | null;
+  updatedAt: string;
+};
+
+export type SessionBackgroundCommandListResponse = {
+  commands: SessionBackgroundCommand[];
+};
+
+export type CancelSessionBackgroundCommandResult = {
+  command: SessionBackgroundCommand;
+  accepted: boolean;
+};
+
 export type Session = {
   id: string;
   workspaceId: string;
   accountId: string;
   status: SessionStatus;
+  backgroundCommandActivity?: SessionBackgroundCommandActivity | undefined;
   initialMessage: string;
   title: string | null;
   titleSource: "user" | "agent" | null;
@@ -1047,10 +1270,14 @@ export type Session = {
   toolPolicyVersion: number;
   effectiveToolPolicy?: SessionEffectiveToolPolicy | undefined;
   metadata: Record<string, unknown>;
+  /** Present only when session-tenancy product activation is enabled for the organization. */
+  tenancy?: SessionTenancyPublicProjection | undefined;
   /** Frozen creator fact; later turns carry their own independent initiator. */
   createdBy: TurnInitiator;
   createdByContext: Record<string, unknown>;
   model: string;
+  reasoningEffort: ReasoningEffort;
+  latencyMode: LatencyMode;
   sandboxBackend: SandboxBackend;
   sandboxOs: SandboxOs;
   sandboxGroupId: string;
@@ -1101,6 +1328,17 @@ export type Session = {
   pinnedAt?: string | null;
   /** Optimistic pin-state revision; zero represents an absent pin relation. */
   pinVersion?: number;
+  /** Personal explicit acknowledgment state. */
+  unread?: boolean;
+  /** Personal actively-working label. */
+  activelyWorking?: boolean;
+  /** Optimistic unread/actively-working revision. */
+  attentionVersion?: number;
+  /** Personal archive state. */
+  archived?: boolean;
+  archivedAt?: string | null;
+  /** Optimistic archive-state revision. */
+  archiveVersion?: number;
   /** Server-authoritative descendant counts populated by session-list reads. */
   treeStats?:
     | {
@@ -1111,10 +1349,22 @@ export type Session = {
         attentionDescendants: number;
         pausedDescendants: number;
         failedDescendants: number;
+        unreadDescendants?: number | undefined;
+        activelyWorkingDescendants?: number | undefined;
+        /**
+         * Earliest moment one of the counted `attentionDescendants` entered
+         * `requires_action`; null when none is waiting, absent on older servers.
+         */
+        attentionSince?: string | null | undefined;
         /** Counts are lower bounds rather than exact totals when true. */
         truncated: boolean;
       }
     | undefined;
+  /**
+   * When this session's own open turn entered `requires_action`. Populated by
+   * list and lineage reads for `requires_action` sessions; null otherwise.
+   */
+  requiresActionSince?: string | null | undefined;
   createdAt: string;
   updatedAt: string;
 };
@@ -1185,6 +1435,18 @@ export type UpdateSessionPinRequest = {
   expectedVersion?: number;
 };
 
+export type UpdateSessionAttentionRequest = {
+  unread?: boolean;
+  acknowledgedThroughSequence?: number;
+  activelyWorking?: boolean;
+  expectedVersion?: number;
+};
+
+export type UpdateSessionArchiveRequest = {
+  archived: boolean;
+  expectedVersion?: number;
+};
+
 export type LineageNode = {
   session: SessionSummary;
   children: LineageNode[];
@@ -1249,6 +1511,25 @@ export type TimelineAnnotation = DraftTimelineAnnotation & {
   ordinal: number;
 };
 
+export const PERSONAL_RESOURCE_SHARED_OUTPUT_WARNING_VERSION = 1 as const;
+export const PERSONAL_RESOURCE_SHARED_OUTPUT_WARNING =
+  "Personal resources used in a workspace-shared session may influence outputs visible to other workspace members. The underlying credentials and secret values are not shared by the attachment itself.";
+
+export type PersonalResourceAttachmentIntent = {
+  mode: "once" | "session" | "always";
+  expectedAuthorityEpoch?: number | undefined;
+  workspaceSharedAcknowledged?: boolean | undefined;
+  sharedOutputWarningVersion: 1;
+};
+
+export type PersonalResourceAttachmentSummary = {
+  mode: "once" | "session" | "always";
+  context: "user_private" | "workspace_shared";
+  resourceCount: number;
+  resourceKinds: Array<"variable_set" | "rig" | "connected_machine">;
+  sharedOutputWarningVersion: 1;
+};
+
 export type SessionTurn = {
   id: string;
   workspaceId: string;
@@ -1276,6 +1557,7 @@ export type SessionTurn = {
   initiator: TurnInitiator;
   initiatorContext: Record<string, unknown>;
   personalConnections?: McpPersonalConnectionSummary[] | undefined;
+  personalResources?: PersonalResourceAttachmentSummary | null | undefined;
   cancelledBy?: string | null;
   cancelReason?: string | null;
   startedAt: string | null;
@@ -1369,6 +1651,9 @@ export const SESSION_EVENT_TYPES = [
   "turn.superseded",
   "turn.recovery.requested",
   "turn.capacity_waiting",
+  "turn.startup.phase.started",
+  "turn.startup.phase.completed",
+  "turn.startup.phase.failed",
   "agent.message.delta",
   "agent.message.completed",
   "agent.reasoning.delta",
@@ -1386,6 +1671,8 @@ export const SESSION_EVENT_TYPES = [
   "sandbox.operation.started",
   "sandbox.operation.completed",
   "sandbox.operation.failed",
+  "session.command.backgrounded",
+  "session.command.finished",
   "sandbox.command.output.delta",
   "artifact.created",
   "goal.set",
@@ -1397,6 +1684,7 @@ export const SESSION_EVENT_TYPES = [
   "goal.paused",
   "goal.resumed",
   "goal.cleared",
+  "goal.held",
   "goal.continuation",
   "system.update.pending",
   "system.update.delivered",
@@ -1433,6 +1721,7 @@ export const SESSION_EVENT_TYPES = [
   "terminal.pty.exited",
   "session.title_set",
   "session.visibility.changed",
+  "session.personal_resources.attached",
   "session.mcp.approval_policy.updated",
   "session.tool_policy.updated",
   // Multi-account Codex (P1): the session's inference account changed.
@@ -1873,6 +2162,14 @@ export type FsReadResponse = {
   isBinary: boolean;
   revision: number;
 };
+export const SANDBOX_FILE_ARTIFACT_MAX_BYTES = 25 * 1024 * 1024 - 1;
+export type PublishSandboxFileArtifactRequest = { path: string };
+export type SandboxFileArtifactReceipt = {
+  type: "sandbox_file";
+  sandboxPath: string;
+  filename: string;
+  artifact: RetainedArtifactReference;
+};
 export type FsWriteRequest = {
   path: string;
   encoding?: FsEncoding;
@@ -2196,6 +2493,55 @@ export type ScheduledTaskScheduleSpec =
       daysOfWeek?: ScheduledTaskDayOfWeek[] | undefined;
     };
 
+export type IncidentTelemetrySeriesMetadata = {
+  metric: string;
+  labels: string[];
+};
+
+export type IncidentTelemetryDataRoute =
+  | { kind: "mcp"; serverId: string }
+  | { kind: "first_party"; tool: FirstPartyMcpToolName }
+  | { kind: "variable_set"; variableSetName: string; variableNames: string[] }
+  | { kind: "rig_credential_hook"; credentialHookId: string };
+
+export type IncidentTelemetryPreflight = {
+  requiredResources: ResourceRef[];
+  requiredMcpServerIds: string[];
+  requiredFirstPartyMcpTools: FirstPartyMcpToolName[];
+  requiredFirstPartyMcpPermissions: Permission[];
+  requiredRig: { name: string; credentialHookIds: string[] } | null;
+  requiredVariableSetNames: string[];
+  requiredVariableNames: string[];
+  dataSource: {
+    kind: "prometheus";
+    queryPath: "/api/v1/query" | "/api/v1/query_range";
+    workspaceLabel: string;
+    alertSelectorLabels: string[];
+    route: IncidentTelemetryDataRoute;
+    requiredSeries: IncidentTelemetrySeriesMetadata[];
+    availableSeries: IncidentTelemetrySeriesMetadata[];
+  };
+};
+
+export type IncidentTelemetryPreflightInput = Omit<
+  IncidentTelemetryPreflight,
+  | "requiredResources"
+  | "requiredMcpServerIds"
+  | "requiredFirstPartyMcpTools"
+  | "requiredFirstPartyMcpPermissions"
+  | "requiredRig"
+  | "requiredVariableSetNames"
+  | "requiredVariableNames"
+> & {
+  requiredResources?: ResourceRef[] | undefined;
+  requiredMcpServerIds?: string[] | undefined;
+  requiredFirstPartyMcpTools?: FirstPartyMcpToolName[] | undefined;
+  requiredFirstPartyMcpPermissions?: Permission[] | undefined;
+  requiredRig?: { name: string; credentialHookIds?: string[] | undefined } | null | undefined;
+  requiredVariableSetNames?: string[] | undefined;
+  requiredVariableNames?: string[] | undefined;
+};
+
 export type ScheduledTaskAgentConfig = {
   prompt: string;
   resources: ResourceRef[];
@@ -2206,6 +2552,8 @@ export type ScheduledTaskAgentConfig = {
   reasoningEffort?: ReasoningEffort | undefined;
   sandboxBackend?: SandboxBackend | undefined;
   goal?: GoalSpec | undefined;
+  executionClass?: "incident_telemetry" | undefined;
+  incidentTelemetryPreflight?: IncidentTelemetryPreflight | undefined;
   maxNestedAgentDepth?: number | undefined;
 };
 
@@ -2262,6 +2610,8 @@ export type ScheduledTask = {
   createdBy?: TurnInitiator | undefined;
   createdByContext?: TurnInitiatorContext | undefined;
   personalConnections?: McpPersonalConnectionSummary[] | undefined;
+  authorityRevision: number;
+  executionDigest: string;
   targetSessionId: string | null;
   reusableSessionId: string | null;
   variableSetId: string | null;
@@ -2279,6 +2629,7 @@ export type CreateSessionRequest = {
   // projection before OpenGeni admits the initial turn. Replays must retain the
   // same UUID and idempotency key.
   requestedSessionId?: string | undefined;
+  visibility?: SessionVisibility | undefined;
   initialMessage?: string | undefined;
   /** Create an idle session shell so realtime voice can be the first interaction. */
   startMode?: "realtime" | undefined;
@@ -2287,7 +2638,7 @@ export type CreateSessionRequest = {
   // Per-session agent persona/system instructions (org-visible metadata, not a
   // secret). Delivered system-level, composed AFTER the per-workspace persona —
   // how a host supplies per-agent-type prompts without leaking them into the
-  // user-visible timeline. Trimmed, non-empty, max 32768 chars.
+  // user-visible timeline. Trimmed, non-empty, max 65536 chars.
   instructions?: string | undefined;
   /** Immutable normalized prompt-policy role; distinct from membership roles. */
   policyRole?: string | undefined;
@@ -2325,6 +2676,8 @@ export type CreateSessionRequest = {
   firstPartyMcpPermissions?: string[] | undefined;
   firstPartyMcpTools?: FirstPartyMcpToolName[] | undefined;
   mcpServers?: SessionMcpServerInput[] | undefined;
+  /** Atomically attach the server-derived personal Variable Set/Rig closure to the initial turn. */
+  personalResourceAttachment?: PersonalResourceAttachmentIntent | undefined;
   // Shared-sandbox placement (mirror of `@opengeni/contracts` CreateSessionRequest.sandbox,
   // addendum 05 §D.1). Three-way union; OMITTED ⇒ the context-dependent server default
   // (from inside a session → "shared" with the creator's box, top-level → "new").
@@ -2374,6 +2727,7 @@ export const KNOWN_PERMISSIONS = [
   "variable-sets:read",
   "variable-sets:write",
   "variable-sets:manage",
+  "variable-sets:attach",
   "variable-sets:use",
   "secrets:list",
   "secrets:read",
@@ -2402,6 +2756,7 @@ export type FirstPartyMcpToolName =
   | "goal_set"
   | "goal_update"
   | "goal_progress"
+  | "goal_wait"
   | "goal_complete"
   | "goal_pause"
   | "memory_search"
@@ -2412,6 +2767,18 @@ export type FirstPartyMcpToolName =
   | "task_notes_list"
   | "task_note_save"
   | "task_note_archive"
+  | "task_note_replace"
+  | "knowledge_propose"
+  | "knowledge_correct"
+  | "task_note_promote_knowledge"
+  | "task_note_promote_instruction_policy"
+  | "task_note_promote_preference"
+  | "instruction_policy_propose"
+  | "preference_propose"
+  | "remember"
+  | "remember_confirm"
+  | "company_profile_propose"
+  | "company_profile_confirm"
   | "sandboxes_list"
   | "sandbox_attach"
   | "sandbox_swap"
@@ -2426,11 +2793,13 @@ export type FirstPartyMcpToolName =
   | "sessions_list"
   | "session_get"
   | "session_events"
+  | "session_wait"
   | "session_create"
   | "session_send_message"
   | "session_pause"
   | "session_resume"
   | "session_steer"
+  | "session_human_input_respond"
   | "set_other_session_title"
   | "interaction_discover"
   | "browser_open"
@@ -2489,6 +2858,7 @@ export type FirstPartyMcpToolName =
   | "scheduled_tasks_delete"
   | "scheduled_task_runs_list"
   | "slack_bot_list_channels"
+  | "slack_bot_search"
   | "slack_bot_channel_history"
   | "slack_bot_thread_replies"
   | "slack_bot_list_users"
@@ -2510,6 +2880,7 @@ export type FirstPartyMcpToolName =
   | "atlassian_sources_list"
   | "atlassian_search"
   | "atlassian_get"
+  | "sandbox_file_publish"
   | "artifacts_list"
   | "artifacts_get_source"
   | "artifacts_create"
@@ -2664,6 +3035,8 @@ export type ModelCredentialReadinessV1 = {
 
 export type WorkspaceModelCatalogModel = ClientModel & {
   credentialReadiness: ModelCredentialReadinessV1;
+  /** Exact workspace-policy verdict without exposing provider identity. */
+  policyAllowed?: boolean | undefined;
   availability: ModelAvailabilityV1;
 };
 
@@ -2671,6 +3044,21 @@ export type WorkspaceModelCatalogResponse = {
   models: WorkspaceModelCatalogModel[];
 };
 
+/**
+ * The workspace's hard model/provider allowlist. `null` means unrestricted for
+ * that dimension; an empty array is an explicit total block.
+ */
+export type WorkspaceModelAccessPolicy = {
+  allowedProviders: string[] | null;
+  allowedModels: string[] | null;
+};
+
+/** Full replacement body for `PUT /v1/workspaces/:id/model-policy`. */
+export type UpdateWorkspaceModelAccessPolicyRequest = {
+  allowedProviders?: string[] | null | undefined;
+  allowedModels?: string[] | null | undefined;
+};
+
 /**
  * Connection state of a workspace's Codex (ChatGPT) subscription, returned by
  * `GET /v1/workspaces/:id/codex/status`. `models` are the codex models the
@@ -2818,6 +3206,12 @@ export type CodexAccountOverview = {
     credits: CodexResetCredit[];
   };
   canRedeem: boolean;
+  /** Secret-free reason redemption is owner-actionable or view-only. */
+  redemptionAccess: {
+    ownership: "current_human" | "unowned" | "different_human" | "managed_human_unavailable";
+    /** A direct managed-cookie admin may claim only an unowned same-provider row by reconnecting. */
+    canClaimUnownedViaReconnect: boolean;
+  };
   /** Owning managed-cookie human may replay durable completion without a healthy provider token. */
   canResumeRedemption: boolean;
   /** Durable owner-scoped ambiguity/completion discovery; never redemption authority for agents. */
@@ -2992,11 +3386,16 @@ export type ClientAuthConfig =
   | { mode: "none" }
   | { mode: "deploymentKey"; headerName: "x-opengeni-access-key" }
   | { mode: "configuredToken"; headerName: "authorization"; scheme: "bearer" }
-  | { mode: "managedSession"; session: "cookie" };
+  | {
+      mode: "managedSession";
+      session: "cookie";
+      /** Defaults to true when omitted by an older deployment. */
+      emailVerificationRequired?: boolean;
+    };
 
 // Kept value-identical to @opengeni/contracts and pinned by the SDK contract
 // parity suite. The SDK has no runtime dependency on the Zod contracts package.
-export const OPENGENI_API_CONTRACT_REVISION = "2026-08-model-context-v1" as const;
+export const OPENGENI_API_CONTRACT_REVISION = "2026-08-atomic-session-fork-visibility-v1" as const;
 export const OPENGENI_API_CONTRACT_HEADER = "x-opengeni-api-contract" as const;
 /** Bounded request/response identifier shared by browser, ingress, and API diagnostics. */
 export const OPENGENI_CORRELATION_HEADER = "x-opengeni-correlation-id" as const;
@@ -3206,6 +3605,220 @@ export type ListManagedOrganizationMembershipsResponse = {
   memberships: ManagedOrganizationMembership[];
 };
 
+export type UserResourceKind =
+  | "connection"
+  | "document"
+  | "variable_set"
+  | "rig"
+  | "connected_machine";
+export type UserResourceGrantAction =
+  | "connection.use"
+  | "document.read"
+  | "variable_set.use"
+  | "rig.use"
+  | "connected_machine.use";
+export type UserResourceAuthorityGrant = {
+  grantId: string;
+  targetWorkspaceId: string;
+  targetSessionId: string | null;
+  action: UserResourceGrantAction;
+  mode: "once" | "session" | "always";
+  context: "user_private" | "workspace_shared";
+  authorityEpoch: number | null;
+  generation: number;
+  status: "active" | "consumed" | "revoked" | "expired";
+  expiresAt: string | null;
+  delegation: UserResourceDelegation;
+};
+export type UserResourceAuthoritySummary = {
+  authorityId: string;
+  resourceKind: UserResourceKind;
+  resourceId: string;
+  originWorkspaceId: string | null;
+  generation: number;
+  status: "active" | "retained" | "revoked";
+  grants: UserResourceAuthorityGrant[];
+};
+export type ListUserResourceAuthoritiesOptions = {
+  resourceKind: UserResourceKind;
+  cursor?: string | undefined;
+  limit?: number | undefined;
+};
+export type ListUserResourceAuthoritiesResponse = {
+  scope: "user";
+  authorities: UserResourceAuthoritySummary[];
+  nextCursor: string | null;
+};
+export type IssueUserResourceGrantRequest =
+  | {
+      scope: "user";
+      resourceKind: UserResourceKind;
+      mode: "session";
+      context: "user_private" | "workspace_shared";
+      sessionId: string;
+      expectedAuthorityEpoch: number;
+      workspaceSharedAcknowledged?: boolean | undefined;
+    }
+  | {
+      scope: "user";
+      resourceKind: UserResourceKind;
+      mode: "always";
+      context: "user_private" | "workspace_shared";
+      sessionId?: null | undefined;
+      expectedAuthorityEpoch?: null | undefined;
+      workspaceSharedAcknowledged?: boolean | undefined;
+    };
+export type UserResourceGrantMutationResponse = {
+  scope: "user";
+  grant: UserResourceAuthorityGrant;
+};
+export type RevokeUserResourceGrantResponse = {
+  scope: "user";
+  grant: {
+    grantId: string;
+    generation: number;
+    status: "revoked";
+    revokedAt: string;
+  };
+};
+
+export type OrganizationMembershipRole = "owner" | "admin" | "member";
+export type OrganizationInvitation = {
+  id: string;
+  organizationId: string;
+  targetEmail: string;
+  targetName: string | null;
+  initialWorkspaceIds: string[];
+  role: OrganizationMembershipRole;
+  status: "pending" | "accepted" | "revoked" | "expired";
+  revision: number;
+  expiresAt: string;
+  acceptedMembershipId: string | null;
+  createdAt: string;
+  updatedAt: string;
+};
+export type OrganizationMember = {
+  id: string;
+  organizationId: string;
+  subjectId: string;
+  name: string | null;
+  email: string | null;
+  role: OrganizationMembershipRole;
+  status: "provisioning" | "active" | "suspended" | "revoked";
+  authorizationRevision: number;
+  personalWorkspaceId: string | null;
+  revokedAt: string | null;
+  personalRetentionUntil: string | null;
+  createdAt: string;
+  updatedAt: string;
+};
+export type OrganizationSummary = {
+  id: string;
+  name: string;
+  createdAt: string;
+  updatedAt: string;
+};
+export type OrganizationWorkspaceAccessMember = {
+  membershipId: string;
+  subjectId: string;
+  subjectLabel: string | null;
+  principalKind: "human" | "service";
+  role: string;
+  permissions: string[];
+  createdAt: string;
+};
+export type OrganizationWorkspaceAccess = {
+  id: string;
+  name: string;
+  slug: string | null;
+  createdAt: string;
+  updatedAt: string;
+  members: OrganizationWorkspaceAccessMember[];
+};
+export type OrganizationAdministrationOverview = {
+  organization: OrganizationSummary;
+  workspaces: OrganizationWorkspaceAccess[];
+};
+export type OrganizationPrivateSessionSettings = {
+  organizationId: string;
+  enabled: boolean;
+  available: boolean;
+  version: number;
+  updatedAt: string;
+  changed?: boolean;
+};
+export type AddOrganizationWorkspaceMemberRequest = {
+  organizationMembershipId: string;
+  role?: string | undefined;
+  permissions: Permission[];
+};
+export type CreateOrganizationWorkspaceRequest = {
+  name: string;
+  slug?: string | null;
+  agentInstructions?: string | null;
+  operationId: string;
+};
+export type CreateOrganizationRequest = {
+  name: string;
+  operationId: string;
+};
+export type CreateOrganizationResponse = {
+  organization: OrganizationSummary;
+  workspaceId: string;
+};
+export type UpdateOrganizationNameRequest = {
+  name: string;
+  expectedUpdatedAt: string;
+  operationId: string;
+};
+export type UpdateOrganizationPrivateSessionSettingsRequest = {
+  enabled: boolean;
+  expectedVersion: number;
+  operationId: string;
+};
+export type OrganizationRetentionPolicy = {
+  organizationId: string;
+  mode: "retain" | "delete_after";
+  retentionDays: number | null;
+  version: number;
+  updatedAt: string;
+};
+export type CreateOrganizationInvitationRequest = {
+  email: string;
+  name?: string;
+  initialWorkspaceIds?: string[];
+  role?: OrganizationMembershipRole;
+  expiresAt: string;
+  operationId: string;
+};
+export type AcceptOrganizationInvitationRequest = {
+  expectedRevision: number;
+  operationId: string;
+};
+export type RevokeOrganizationInvitationRequest = AcceptOrganizationInvitationRequest;
+export type UpdateOrganizationMemberRequest = {
+  kind: "change_role" | "suspend" | "reactivate" | "offboard";
+  role?: OrganizationMembershipRole;
+  expectedAuthorizationRevision: number;
+  operationId: string;
+  reason?: string;
+};
+export type UpdateOrganizationRetentionPolicyRequest = {
+  mode: "retain" | "delete_after";
+  retentionDays: number | null;
+  expectedVersion: number;
+  operationId: string;
+};
+export type ListOrganizationInvitationsPageResponse = {
+  invitations: OrganizationInvitation[];
+  nextCursor: string | null;
+};
+export type ListOrganizationMembersResponse = { members: OrganizationMember[] };
+export type AcceptOrganizationInvitationResponse = {
+  invitation: OrganizationInvitation;
+  membership: OrganizationMember;
+};
+
 export type Workspace = {
   id: string;
   accountId: string;
@@ -3231,6 +3844,10 @@ export type WorkspaceSettings = {
   memoryEnabled?: boolean | undefined;
   /** Reversible Memory V1 prompt composition rollout. */
   memoryPromptMode?: "legacy_standing" | "retrieval_only" | undefined;
+  /** Model policy inherited by new chats and scheduled tasks. */
+  sessionDefaults?: WorkspaceSessionDefaults | undefined;
+  /** Exact capability selection inherited by new top-level sessions. */
+  sessionToolDefaults?: WorkspaceSessionToolDefaults | undefined;
   voiceInput?: WorkspaceVoiceInputSettings | undefined;
   transcription?: WorkspaceTranscriptionPolicy | undefined;
   maxNestedAgentDepth?: number | null | undefined;
@@ -3239,15 +3856,38 @@ export type WorkspaceSettings = {
   /** Whether agents may invoke the built-in structured human-input tool. */
   agentHumanInputEnabled?: boolean | undefined;
   slackReactionSummon?: WorkspaceSlackReactionSummonSettings | undefined;
+  /** Slack orchestration notices; both default off when absent or invalid. */
+  slackOrchestrationNotices?: WorkspaceSlackOrchestrationNoticeSettings | undefined;
   [key: string]: unknown;
 };
 
+export type WorkspaceSessionDefaults = {
+  model: string;
+  reasoningEffort: ReasoningEffort;
+};
+
+export type WorkspaceSessionToolDefaults = {
+  mcpServerIds: string[];
+  firstPartyMcpTools: FirstPartyMcpToolName[];
+};
+
 export type WorkspaceSlackReactionSummonSettings = {
   enabled: boolean;
   emoji: "genie";
   channelPolicy: { mode: "bot_member" } | { mode: "allowlist"; channelIds: string[] };
 };
 
+/**
+ * Per-workspace switches for the two Slack orchestration notices. Both are off
+ * unless the workspace explicitly turned them on.
+ */
+export type WorkspaceSlackOrchestrationNoticeSettings = {
+  /** Post a pointer card when a child worker blocks on input or an approval. */
+  childRequiresAction?: boolean | undefined;
+  /** Post one line when a goal pauses for budget or the continuation cap. */
+  goalPaused?: boolean | undefined;
+};
+
 export type SlackReactionChannel = {
   id: string;
   name: string | null;
@@ -3259,6 +3899,24 @@ export type SlackReactionChannelListResponse = {
   nextCursor: string | null;
 };
 
+export type SlackChannelRoute = {
+  slackChannelId: string;
+  targetWorkspaceId: string;
+  targetWorkspaceName: string | null;
+  source: "picker" | "admin";
+  updatedAt: string;
+};
+
+export type SlackChannelRouteListResponse = {
+  routes: SlackChannelRoute[];
+  routingEnabled: boolean;
+};
+
+export type UpdateSlackChannelRoutesRequest = {
+  connectionId: string;
+  routes: Array<{ slackChannelId: string; targetWorkspaceId: string | null }>;
+};
+
 export type WorkspaceVoiceInputSettings = {
   enabled: boolean;
 };
@@ -3266,12 +3924,15 @@ export type WorkspaceVoiceInputSettings = {
 export type UpdateWorkspaceSettingsRequest = {
   memoryEnabled?: boolean | undefined;
   memoryPromptMode?: "legacy_standing" | "retrieval_only" | undefined;
+  sessionDefaults?: WorkspaceSessionDefaults | undefined;
+  sessionToolDefaults?: WorkspaceSessionToolDefaults | undefined;
   voiceInput?: WorkspaceVoiceInputSettings | undefined;
   transcription?: WorkspaceTranscriptionPolicy | undefined;
   maxNestedAgentDepth?: number | null | undefined;
   codexCompactionDefault?: "remote_v2" | "portable" | undefined;
   agentHumanInputEnabled?: boolean | undefined;
   slackReactionSummon?: WorkspaceSlackReactionSummonSettings | undefined;
+  slackOrchestrationNotices?: WorkspaceSlackOrchestrationNoticeSettings | undefined;
   [key: string]: unknown;
 };
 
@@ -3299,6 +3960,7 @@ export type ApiKey = {
   accountId: string;
   workspaceId: string | null;
   name: string;
+  description: string | null;
   prefix: string;
   permissions: Permission[];
   expiresAt: string | null;
@@ -3310,6 +3972,7 @@ export type ApiKey = {
 
 export type CreateApiKeyRequest = {
   name: string;
+  description?: string | undefined;
   permissions: Permission[];
   expiresAt?: string | undefined;
 };
@@ -3417,12 +4080,14 @@ export type SessionGoalRevision = {
   resultObjectiveRevision: number | null;
   text: string;
   successCriteria: string | null;
+  rootConstraints: string[];
   mutationPolicy: SessionGoalMutationPolicy;
   rationale: string;
   actor: "agent" | "api" | "scheduled_task";
   actorTurnId: string | null;
   actorAttemptId: string | null;
   proposalId: string | null;
+  rollbackOfRevisionId: string | null;
   createdAt: string;
 };
 
@@ -3431,6 +4096,32 @@ export type ApplySessionGoalRevisionRequest = {
   rationale?: string | undefined;
 };
 
+export type ListSessionGoalRevisionsOptions = {
+  limit?: number | undefined;
+  before?: string | undefined;
+};
+
+export type ListSessionGoalRevisionsResponse = {
+  revisions: SessionGoalRevision[];
+  hasMore: boolean;
+  nextCursor: string | null;
+};
+
+export type RejectSessionGoalRevisionRequest = {
+  expectedObjectiveRevision: number;
+  rationale: string;
+};
+
+export type RejectSessionGoalRevisionResponse = {
+  revision: SessionGoalRevision;
+  replay: boolean;
+};
+
+export type RollbackSessionGoalRevisionRequest = {
+  expectedObjectiveRevision: number;
+  rationale: string;
+};
+
 export type SessionGoalContinuationState =
   | "inactive"
   | "scheduled"
@@ -3450,6 +4141,8 @@ export type SessionGoalContinuationReason =
   | "provider_backpressure"
   | "session_cancelled"
   | "system_work_pending"
+  | "held_for_input"
+  | "backoff_pending"
   | "missing_obligation";
 
 export type SessionGoalContinuation = {
@@ -3459,6 +4152,8 @@ export type SessionGoalContinuation = {
   observedRevision: number;
   nextAttemptAt: string | null;
   lastError: string | null;
+  /** Agent-stated reason for a `held_for_input` hold; null otherwise. */
+  holdReason?: string | null | undefined;
 };
 
 export type SessionGoal = {
@@ -3469,6 +4164,7 @@ export type SessionGoal = {
   status: SessionGoalStatus;
   text: string;
   successCriteria: string | null;
+  rootConstraints: string[];
   evidence: string | null;
   rationale: string | null;
   pausedReason: string | null;
@@ -3494,6 +4190,7 @@ export type UpdateSessionGoalRequest =
   | {
       text: string;
       successCriteria?: string | null | undefined;
+      rootConstraints?: string[] | undefined;
       mutationPolicy?: SessionGoalMutationPolicy | undefined;
       rationale: string;
       expectedObjectiveRevision: number;
@@ -3548,6 +4245,7 @@ export type EffectiveSessionControl = {
     interruptionPendingCount: number;
     quiescencePendingCount: number;
   } | null;
+  backgroundCommandSettlement?: { state: "stopping"; commandCount: number } | null | undefined;
 };
 
 export type SessionCommandReceipt = {
@@ -3563,6 +4261,11 @@ export type SessionCommandReceipt = {
   createdAt: string;
 };
 
+export type SessionPromptRouting =
+  | "accepted_for_execution"
+  | "queued_for_execution"
+  | "accepted_for_steering";
+
 export type ComposerDraft = {
   revision: number;
   text: string;
@@ -3570,13 +4273,14 @@ export type ComposerDraft = {
   resources: ResourceRef[];
   model: string;
   reasoningEffort: ReasoningEffort;
-  latencyMode?: LatencyMode | undefined;
+  latencyMode: LatencyMode;
   sourceTurnId: string | null;
   sourceTurnVersion: number | null;
   updatedAt: string | null;
 };
 
 export type NewSessionDraftOptions = {
+  visibility?: SessionVisibility | undefined;
   sandboxBackend?: SandboxBackend | undefined;
   targetSandboxId?: string | undefined;
   workingDir?: string | undefined;
@@ -3587,6 +4291,17 @@ export type NewSessionDraftOptions = {
   firstPartyMcpTools?: FirstPartyMcpToolName[] | undefined;
 };
 
+export type NewSessionSelectionHistory = {
+  /** Most-recently used project first. Null channelId is the Default project. */
+  projects: Array<{
+    channelId: string | null;
+    /** Null means the managed sandbox was used most recently in this project. */
+    targetSandboxId: string | null;
+    /** Most-recently used machine in this project first. */
+    machines: Array<{ sandboxId: string; workingDir: string | null }>;
+  }>;
+};
+
 export type NewSessionDraft = {
   revision: number;
   text: string;
@@ -3596,8 +4311,9 @@ export type NewSessionDraft = {
   toolsProvided: boolean;
   model: string;
   reasoningEffort: ReasoningEffort;
-  latencyMode?: LatencyMode | undefined;
+  latencyMode: LatencyMode;
   options: NewSessionDraftOptions;
+  selectionHistory: NewSessionSelectionHistory;
   updatedAt: string | null;
 };
 
@@ -3631,7 +4347,12 @@ export type SessionSystemUpdateKind =
   | "agent_message"
   | "agent_steer_instruction"
   | "child_terminal_result"
-  | "media_generation_result";
+  | "media_generation_result"
+  | "child_requires_action"
+  | "child_requires_action_resolved"
+  | "child_paused"
+  | "child_waiting_capacity"
+  | "child_progress";
 
 export type SessionSystemUpdateState =
   | "pending"
@@ -3746,7 +4467,31 @@ export type SaveComposerDraftRequest = Omit<
   "revision" | "sourceTurnId" | "sourceTurnVersion" | "updatedAt"
 > & { expectedRevision: number };
 
-export type SaveNewSessionDraftRequest = Omit<NewSessionDraft, "revision" | "updatedAt"> & {
+export type SubmitComposerDraftRequest = Omit<SaveComposerDraftRequest, "expectedRevision"> & {
+  expectedDraftRevision: number;
+  clientEventId: string;
+  delivery: "send" | "steer";
+  controlEtag?: string;
+  modelContext?: string;
+  mcpCredentialUpdates?: SessionMcpCredentialUpdateInput[];
+  connectionAuthorities?: McpConnectionAuthoritySelection[];
+  personalResourceAttachment?: PersonalResourceAttachmentIntent;
+};
+
+export type SubmitComposerDraftResponse = {
+  accepted: SessionEvent;
+  turn: SessionTurn;
+  draft: ComposerDraft;
+  receipt: SessionCommandReceipt;
+  routing: SessionPromptRouting;
+  interruptionCount: number;
+  replay: boolean;
+};
+
+export type SaveNewSessionDraftRequest = Omit<
+  NewSessionDraft,
+  "revision" | "selectionHistory" | "updatedAt"
+> & {
   expectedRevision: number;
 };
 
@@ -3763,6 +4508,8 @@ export type ScheduledTaskAgentConfigInput = {
   reasoningEffort?: ReasoningEffort | undefined;
   sandboxBackend?: SandboxBackend | undefined;
   goal?: GoalSpec | undefined;
+  executionClass?: "incident_telemetry" | undefined;
+  incidentTelemetryPreflight?: IncidentTelemetryPreflightInput | undefined;
   maxNestedAgentDepth?: number | undefined;
 };
 
@@ -3772,6 +4519,7 @@ export type CreateAgentScheduledTaskRequest = {
   action?: { kind: "agent_turn" } | undefined;
   runMode?: ScheduledTaskRunMode | undefined;
   targetSessionId?: string | null | undefined;
+  connectionAuthorities?: McpConnectionAuthoritySelection[] | undefined;
   overlapPolicy?: ScheduledTaskOverlapPolicy | undefined;
   agentConfig: ScheduledTaskAgentConfigInput;
   status?: ScheduledTaskStatus | undefined;
@@ -3801,6 +4549,7 @@ export type UpdateScheduledTaskRequest = {
   schedule?: ScheduledTaskScheduleSpec | undefined;
   runMode?: ScheduledTaskRunMode | undefined;
   targetSessionId?: string | null | undefined;
+  connectionAuthorities?: McpConnectionAuthoritySelection[] | undefined;
   overlapPolicy?: ScheduledTaskOverlapPolicy | undefined;
   action?: ScheduledTaskAction | undefined;
   agentConfig?: ScheduledTaskAgentConfigInput | undefined;
@@ -3863,6 +4612,8 @@ export type ScheduledTaskRun = {
   accountId: string;
   workspaceId: string;
   taskId: string;
+  taskAuthorityRevision: number | null;
+  taskExecutionDigest: string | null;
   status: ScheduledTaskRunStatus;
   triggerType: ScheduledTaskTriggerType;
   scheduledAt: string | null;
@@ -3900,6 +4651,9 @@ export type VariableSet = {
   id: string;
   accountId: string;
   workspaceId: string;
+  scope: "organization" | "workspace" | "user";
+  generation: number;
+  status: "active" | "revoked";
   name: string;
   description: string | null;
   variables: VariableSetVariableMetadata[];
@@ -3914,6 +4668,8 @@ export type WorkspaceEnvironmentVariableMetadata = VariableSetVariableMetadata;
 export type WorkspaceEnvironment = VariableSet;
 
 export type CreateVariableSetRequest = {
+  /** Omitted remains the legacy workspace-owned path. */
+  scope?: "organization" | "workspace" | "user" | undefined;
   name: string;
   description?: string | undefined;
   /** Initial variables. Values are write-only: they never come back on reads. */
@@ -4012,6 +4768,8 @@ export type Channel = {
   workspaceId: string;
   name: string;
   description: string | null;
+  pinned: boolean;
+  sortOrder: number;
   createdBy: string | null;
   createdAt: string;
   updatedAt: string;
@@ -4025,6 +4783,12 @@ export type CreateChannelRequest = {
 export type UpdateChannelRequest = {
   name?: string;
   description?: string | null;
+  pinned?: boolean;
+};
+
+/** Complete workspace project order. It is replaced atomically after a drag. */
+export type ReorderChannelsRequest = {
+  channelIds: string[];
 };
 
 /** Re-files one session; null moves it back to the unfiled inbox. */
@@ -4036,6 +4800,9 @@ export type Rig = {
   id: string;
   accountId: string;
   workspaceId: string;
+  scope: ResourceAuthorityScope;
+  generation: number;
+  status: "active" | "revoked";
   name: string;
   description: string | null;
   createdBy: string | null;
@@ -4080,6 +4847,7 @@ export type RigChange = {
 };
 
 export type CreateRigRequest = {
+  scope?: ResourceAuthorityScope;
   name: string;
   description?: string | undefined;
   image?: string | undefined;
@@ -4476,6 +5244,7 @@ export type Document = {
   authorityKind: DocumentAuthorityKind;
   authorityWorkspaceId: string | null;
   authoritySubjectId: string | null;
+  authorityId?: string | null | undefined;
   visibility: DocumentVisibility;
   createdBy: string | null;
   agentAccess: boolean;
@@ -4551,6 +5320,110 @@ export type MoveDocumentRequest = {
   targetBaseId?: string | undefined;
 };
 
+export type DocumentAuthorityTuple = {
+  kind: DocumentAuthorityKind;
+  workspaceId: string | null;
+  subjectId: string | null;
+  authorityId: string | null;
+};
+
+export type ReclassifyDocumentAuthorityRequest = {
+  operationId: string;
+  expectedAuthority: DocumentAuthorityTuple;
+  targetAuthorityKind: DocumentAuthorityKind;
+};
+
+export type DocumentAuthorityReclassification = {
+  operationId: string;
+  documentId: string;
+  previousAuthority: DocumentAuthorityTuple;
+  authority: DocumentAuthorityTuple;
+  createdAt: string;
+};
+
+export type ListDocumentAuthorityReclassificationsOptions = {
+  limit?: number | undefined;
+  cursor?: string | undefined;
+};
+
+export type ListDocumentAuthorityReclassificationsResponse = {
+  receipts: DocumentAuthorityReclassification[];
+  hasMore: boolean;
+  nextCursor: string | null;
+};
+
+export type RunDocumentDefaultCollectionBackfillRequest = {
+  runId: string;
+  operationId: string;
+  batchSize?: number | undefined;
+};
+
+export type DocumentDefaultCollectionBackfill = {
+  runId: string;
+  operationId: string;
+  status: "running" | "completed";
+  lastWorkspaceId: string | null;
+  processedCount: number;
+  createdCount: number;
+  adoptedCount: number;
+  completedAt: string | null;
+};
+
+export type DocumentDefaultCollectionBackfillRunAudit = Omit<
+  DocumentDefaultCollectionBackfill,
+  "operationId"
+> & {
+  actorSubjectId: string;
+  startedAt: string;
+  updatedAt: string;
+};
+
+export type DocumentDefaultCollectionBackfillOperationAudit = {
+  operationId: string;
+  result: DocumentDefaultCollectionBackfill;
+  createdAt: string;
+};
+
+export type DocumentDefaultCollectionBackfillReceiptAudit = {
+  workspaceId: string;
+  baseId: string;
+  outcome: "created" | "adopted";
+  createdAt: string;
+};
+
+export type ListDocumentDefaultCollectionBackfillRunsResponse = {
+  runs: DocumentDefaultCollectionBackfillRunAudit[];
+  hasMore: boolean;
+  nextCursor: string | null;
+};
+
+export type DocumentDefaultCollectionBackfillAudit = {
+  run: DocumentDefaultCollectionBackfillRunAudit;
+  operations: DocumentDefaultCollectionBackfillOperationAudit[];
+  receipts: DocumentDefaultCollectionBackfillReceiptAudit[];
+  operationsHasMore: boolean;
+  operationsNextCursor: string | null;
+  receiptsHasMore: boolean;
+  receiptsNextCursor: string | null;
+};
+
+export type GetDocumentDefaultCollectionBackfillAuditOptions = {
+  limit?: number | undefined;
+  operationCursor?: string | undefined;
+  receiptCursor?: string | undefined;
+};
+
+export type OrganizationDocumentAuthorityReclassification = DocumentAuthorityReclassification & {
+  actorSubjectId: string;
+  requestWorkspaceId: string;
+};
+
+export type ListOrganizationDocumentAuthorityReclassificationsResponse = {
+  receipts: OrganizationDocumentAuthorityReclassification[];
+  hasMore: boolean;
+  nextCursor: string | null;
+};
+
 export type DocumentSearchRequest = {
   query: string;
   baseIds?: string[] | undefined;
@@ -4701,6 +5574,30 @@ export type CapabilityPackScheduledTaskTemplate = {
   prompt?: string | undefined;
 };
 
+export type CapabilityPackAutomationTemplate = {
+  id: string;
+  name: string;
+  description: string;
+  adapterId: string;
+  eventTypes: string[];
+  sessionTemplate: {
+    prompt: string;
+    instructions: string | null;
+    resources: ResourceRef[];
+    skills: CapabilityPackSkill[];
+    tools: ToolRef[];
+    firstPartyMcpTools: string[];
+    firstPartyMcpPermissions: Permission[];
+    model: string | null;
+    reasoningEffort: ReasoningEffort | null;
+    sandboxBackend: SandboxBackend | null;
+    policyRole: string | null;
+    metadata: Record<string, unknown>;
+  };
+  configuration: Record<string, unknown>;
+  connectionRequirement: string | null;
+};
+
 export type CapabilityPackSkillFile = {
   path: string;
   content: string;
@@ -4783,6 +5680,7 @@ export type CapabilityPack = {
   connectors: CapabilityPackConnector[];
   knowledge: CapabilityPackKnowledge[];
   scheduledTaskTemplates: CapabilityPackScheduledTaskTemplate[];
+  automationTemplates?: CapabilityPackAutomationTemplate[] | undefined;
   variableSet?: CapabilityPackVariableSetSpec | undefined;
   metadata: Record<string, unknown>;
 };
@@ -4887,6 +5785,31 @@ export type RegisterCapabilityPackRequest = {
         prompt?: string | undefined;
       }[]
     | undefined;
+  automationTemplates?:
+    | {
+        id: string;
+        name: string;
+        description: string;
+        adapterId: string;
+        eventTypes: string[];
+        sessionTemplate: {
+          prompt: string;
+          instructions?: string | null | undefined;
+          resources?: ResourceRef[] | undefined;
+          skills?: CapabilityPackSkill[] | undefined;
+          tools?: ToolRef[] | undefined;
+          firstPartyMcpTools?: string[] | undefined;
+          firstPartyMcpPermissions?: Permission[] | undefined;
+          model?: string | null | undefined;
+          reasoningEffort?: ReasoningEffort | null | undefined;
+          sandboxBackend?: SandboxBackend | null | undefined;
+          policyRole?: string | null | undefined;
+          metadata?: Record<string, unknown> | undefined;
+        };
+        configuration?: Record<string, unknown> | undefined;
+        connectionRequirement?: string | null | undefined;
+      }[]
+    | undefined;
   variableSet?:
     | {
         description: string;
@@ -4923,6 +5846,100 @@ export type PackInstallation = {
   updatedAt: string;
 };
 
+// --- OpenGeni Review Bot ------------------------------------------------------------
+
+export type PrReviewProvider = GitCredentialProvider;
+export type PrReviewCredentialKind = "github_app" | "provider_token";
+export type PrReviewWebhookAuthKind = "hmac_sha256" | "shared_token" | "basic";
+
+export type CreatePrReviewAppRegistrationRequest = {
+  name: string;
+  provider: PrReviewProvider;
+  providerBaseUrl?: string | undefined;
+  appId?: string | undefined;
+  credentialKind: PrReviewCredentialKind;
+  privateKey?: string | undefined;
+  accessToken?: string | undefined;
+  accessTokenExpiresAt?: string | null | undefined;
+  webhookSecret: string;
+  webhookUsername?: string | undefined;
+};
+
+export type UpdatePrReviewAppRegistrationRequest = {
+  name?: string | undefined;
+  privateKey?: string | undefined;
+  accessToken?: string | undefined;
+  accessTokenExpiresAt?: string | null | undefined;
+  webhookSecret?: string | undefined;
+  webhookUsername?: string | undefined;
+  status?: "active" | "disabled" | undefined;
+};
+
+export type PrReviewAppRegistration = {
+  id: string;
+  sourceId: string;
+  accountId: string;
+  workspaceId: string;
+  name: string;
+  provider: PrReviewProvider;
+  providerBaseUrl: string;
+  appId: string | null;
+  credentialKind: PrReviewCredentialKind;
+  hasCredential: boolean;
+  accessTokenExpiresAt: string | null;
+  webhookAuthKind: PrReviewWebhookAuthKind;
+  hasWebhookSecret: boolean;
+  webhookUsername: string | null;
+  webhookPath: string;
+  status: "active" | "disabled";
+  createdBySubjectId: string;
+  createdAt: string;
+  updatedAt: string;
+};
+
+export type CreatePrReviewRepositoryBindingRequest = {
+  registrationId: string;
+  repositoryUri: string;
+  repositoryFullName: string;
+  providerRepositoryId: string | number;
+  installationId?: string | number | undefined;
+  projectId?: string | number | undefined;
+  model?: string | null | undefined;
+  additionalInstructions?: string | null | undefined;
+  status?: "active" | "disabled" | undefined;
+};
+
+export type UpdatePrReviewRepositoryBindingRequest = {
+  model?: string | null | undefined;
+  additionalInstructions?: string | null | undefined;
+  status?: "active" | "disabled" | undefined;
+};
+
+export type PrReviewRepositoryBinding = {
+  id: string;
+  triggerId: string;
+  accountId: string;
+  workspaceId: string;
+  registrationId: string;
+  provider: PrReviewProvider;
+  repositoryUri: string;
+  repositoryFullName: string;
+  providerRepositoryId: string;
+  installationId: string | null;
+  projectId: string | null;
+  model: string | null;
+  additionalInstructions: string | null;
+  status: "active" | "disabled";
+  createdBySubjectId: string;
+  createdAt: string;
+  updatedAt: string;
+};
+
+export type ListPrReviewConfigurationResponse = {
+  registrations: PrReviewAppRegistration[];
+  repositories: PrReviewRepositoryBinding[];
+};
+
 export type EnablePackRequest = {
   variableSetId?: string | undefined;
   /** @deprecated use variableSetId */
@@ -5326,6 +6343,8 @@ export type IntegrationFacetBindingSummary = {
   lastErrorCode: string | null;
   createdAt: string;
   updatedAt: string;
+  directlyOwned: boolean;
+  owners: CapabilityComponentOwner[];
 };
 
 export type IntegrationInstanceFacetsResponse = {
@@ -5368,6 +6387,20 @@ export type IntegrationFacetRemovalResult = {
   remainingOwners: CapabilityComponentOwner[];
 };
 
+/**
+ * Presentation-only consent copy served with an integration or connector.
+ * Never grants a scope or replaces server-side authorization; the UI keeps a
+ * generic fallback for any omitted field.
+ */
+export type IntegrationPresentation = {
+  providerName?: string | undefined;
+  icon?: "calendar" | "cloud" | "contacts" | "files" | "mail" | undefined;
+  introduction?: string | undefined;
+  capabilities?: { title: string; description: string }[] | undefined;
+  permissionSummary?: string | undefined;
+  scopeLabels?: Record<string, { label: string; description: string }> | undefined;
+};
+
 export type IntegrationDefinitionSummary = {
   id: string;
   name: string;
@@ -5381,6 +6414,7 @@ export type IntegrationDefinitionSummary = {
     kind: "oauth2";
     scopes: string[];
   };
+  presentation?: IntegrationPresentation | undefined;
   facets: IntegrationFacetDefinitionSummary[];
 };
 
@@ -5937,6 +6971,30 @@ export type InsightsModelCallRow = {
   pricingSource: InsightsPricingSource | null;
 };
 
+export type ModelContextContributionSource =
+  | "workspace_instruction_policy"
+  | "legacy_workspace_instructions"
+  | "preference_registry_descriptor"
+  | "company_profile"
+  | "legacy_memory_v1"
+  | "runtime_skill_catalog";
+
+export type InsightsPromptContributionRow = {
+  source: ModelContextContributionSource;
+  items: number;
+  utf8Bytes: number;
+  estimatedTokens: number;
+  calls: number;
+};
+
+export type InsightsPromptContributions = {
+  estimatedTokens: number;
+  utf8Bytes: number;
+  coveredCalls: number;
+  totalCalls: number;
+  sources: InsightsPromptContributionRow[];
+};
+
 export type WorkspaceInsightsSnapshot = {
   range: InsightsRange;
   rangeLabel: string;
@@ -5954,6 +7012,7 @@ export type WorkspaceInsightsSnapshot = {
   drivers: InsightsSpendDriver[];
   schedules: InsightsScheduleRow[];
   recentCalls: InsightsModelCallRow[];
+  promptContributions: InsightsPromptContributions;
   warmSeconds: number;
   priorWarmSeconds: number;
   warmGroups: InsightsWarmGroupRow[];
@@ -6012,6 +7071,16 @@ export type CreateCheckoutResponse = {
   url: string;
 };
 
+export type CreateBillingPortalRequest = {
+  accountId?: string | undefined;
+  returnUrl?: string | undefined;
+};
+
+export type CreateBillingPortalResponse = {
+  portalSessionId: string;
+  url: string;
+};
+
 export type UserMessageEventInput = {
   type: "user.message";
   clientEventId?: string | undefined;
@@ -6023,7 +7092,11 @@ export type UserMessageEventInput = {
     model?: string | undefined;
     reasoningEffort?: ReasoningEffort | undefined;
     latencyMode?: LatencyMode | undefined;
+    controlEtag?: string | undefined;
+    expectedDraftRevision?: number | undefined;
     mcpCredentialUpdates?: SessionMcpCredentialUpdateInput[] | undefined;
+    connectionAuthorities?: McpConnectionAuthoritySelection[] | undefined;
+    personalResourceAttachment?: PersonalResourceAttachmentIntent | undefined;
   };
 };
 
@@ -6085,13 +7158,92 @@ export type MachineState =
   | "display_unavailable"
   | "enrolling";
 
-export type MachineKind = "modal" | "selfhosted";
+export type MachineKind = "modal" | "selfhosted" | "opensandbox";
+
+export type MachineConnectionAuthority = {
+  state: "not_applicable" | "unclaimed" | "active" | "expired";
+  generation: number;
+  supersededCount: number;
+  leaseExpiresAt: string | null;
+  duplicateRunnerDeniedCount: number;
+  duplicateRunnerDeniedAt: string | null;
+};
+
+export type MachineRuntimeCapabilities = {
+  exec: boolean;
+  filesystem: boolean;
+  git: boolean;
+  pty: boolean;
+  desktop: boolean;
+  opStream: boolean;
+  browserBridge: boolean;
+  operationResourcePolicy: boolean;
+  operationCpuQuota: boolean;
+};
+
+export type MachineUpdateStatus =
+  | "requested"
+  | "accepted"
+  | "waiting_for_idle"
+  | "downloading"
+  | "verifying"
+  | "applying"
+  | "restarting"
+  | "succeeded"
+  | "failed";
+
+export type MachineUpdateState = {
+  operationId: string;
+  status: MachineUpdateStatus;
+  targetVersion: string;
+  expectedBinarySha256: string | null;
+  errorCode: string | null;
+  retryable: boolean;
+  rolledBack: boolean;
+  requestedAt: string;
+  updatedAt: string;
+  completedAt: string | null;
+};
+
+export type MachineRuntime = {
+  installedVersion: string | null;
+  binarySha256: string | null;
+  updateChannel: "stable" | "beta" | null;
+  desiredVersion: string | null;
+  versionState: "unknown" | "current" | "outdated" | "ahead" | "updating" | "update_failed";
+  capabilities: MachineRuntimeCapabilities;
+  update: MachineUpdateState | null;
+};
+
+export type UpdateMachineAgentResponse = {
+  operationId: string;
+  accepted: boolean;
+  targetVersion: string;
+};
+
+export type MachineOperationPolicy = {
+  memoryMaxBytes: number | null;
+  memoryHighBytes: number | null;
+  cpuMaxMillicores: number | null;
+  revision: number;
+  updatedAt: string | null;
+};
+
+export type UpdateMachineOperationPolicyRequest = {
+  memoryMaxBytes: number | null;
+  memoryHighBytes: number | null;
+  /** Omitted preserves the current CPU limit for older/partial clients; null clears. */
+  cpuMaxMillicores?: number | null;
+  expectedRevision: number;
+};
 
 /** A machine as the Machines dashboard renders it (an enrolled selfhosted machine
  *  or the session's synthetic Modal group box, `isSessionGroup: true`). */
 export type MachineView = {
   sandboxId: string;
   enrollmentId: string | null;
+  scope: ResourceAuthorityScope;
+  generation: number;
   name: string;
   kind: MachineKind;
   state: MachineState;
@@ -6110,6 +7262,14 @@ export type MachineView = {
   allowScreenControl: boolean;
   sharedSessionCount: number;
   lastSeenAt: string | null;
+  /** Secret-free single-runner authority diagnostics. */
+  connectionAuthority: MachineConnectionAuthority;
+  /** Exact build/update truth. Null means the runner predates runtime Hello
+   * reporting or this is a managed-session group without a connected agent. */
+  runtime: MachineRuntime | null;
+  /** Explicit per-enrollment command memory policy. Null only for managed
+   * session boxes; null limits on a real machine mean unrestricted. */
+  operationPolicy: MachineOperationPolicy | null;
   metrics: MetricSample | null;
 };
 
@@ -6191,6 +7351,7 @@ export type SwapActiveSandboxResponse = {
 
 /** Mirror of `@opengeni/contracts` EnrollmentOs. */
 export type EnrollmentOs = "linux" | "macos" | "windows";
+export type ResourceAuthorityScope = "organization" | "workspace" | "user";
 
 /** POST /v1/enrollments/device/lookup body. */
 export type DeviceEnrollmentLookupRequest = {
@@ -6218,6 +7379,7 @@ export type DeviceEnrollmentLookupResponse = {
 export type DeviceEnrollmentApproveRequest = {
   userCode: string;
   allowScreenControl?: boolean;
+  scope?: ResourceAuthorityScope;
 };
 
 /** POST /v1/workspaces/:ws/enrollments/device/approve response. */