@opengeni/sdk 3.3.2 → 3.4.0

package/dist/client.d.ts

@@ -1,16 +1,91 @@
+import type { ComputerNativeCallRequest, ComputerNativeReceipt } from "@opengeni/contracts";
+import type { InsightsSiteUsageQuery, InsightsSiteUsageResponse } from "@opengeni/contracts/insights-usage";
+import type { ClaudeSubscriptionAccountsResponse, ClaudeSubscriptionAccount, ClaudeSubscriptionOAuthStartRequest, ClaudeSubscriptionSetupTokenRequest, SubscriptionPoolSettings } from "@opengeni/contracts";
+import { type WorkspaceInsightsUsageOptions, type OrganizationInsightsUsageOptions, type WorkspaceInsightsCallsOptions, type OrganizationInsightsCallsOptions, type InsightsCallsScope, type InsightsUsageResponse, type InsightsCallsResponse } from "./insights-usage.js";
+import type { ArtifactCatalogKind, ArtifactCatalogListOptions, ArtifactCatalogListResponse, ArtifactPinResponse } from "./artifact-catalog.js";
+import type { ToolActionReview, ToolReviewDetailsPage } from "@opengeni/contracts";
+import type { SiteDataCollectionDefinitionRequest, SiteDataCollectionResponse, SiteDataDescribeResponse, SiteDataFileListResponse, SiteDataFileUrlResponse, SiteDataImportRequest, SiteDataImportResponse, SiteDataQueryRequest, SiteDataQueryResponse, SiteDataWriteRequest, SiteDataWriteResponse } from "@opengeni/contracts";
+import type { SiteSqlDescribeResponse, SiteSqlExportFormat, SiteSqlImportRequest, SiteSqlImportResponse, SiteSqlInspectResponse, SiteSqlMigrateResponse, SiteSqlMigrationRequest, SiteSqlQueryDefinitionRequest, SiteSqlQueryResponse, SiteSqlResetResponse, SiteSqlRunRequest, SiteSqlRunResponse, SiteSqlSettingsRequest, SiteSqlStatementRequest } from "@opengeni/contracts";
+import type { SiteAbuseReport, SiteAuthAuthorizeRequest, SiteAuthAuthorizeResponse, SiteHostnameAvailability, SiteLimitProfile, SitePlatformUsage, SitePublication, SitePublishWarningFix, SiteTakedownRequest, UpsertSitePublicationRequest } from "@opengeni/contracts";
+import type { SessionMessageSearchRequest, SessionMessageSearchResponse, SessionMessagePreview, SessionMessagePreviewReference } from "./session-message-search.js";
+import type { KnowledgeOriginalFileDownload, AgentLearningContext, AgentLearningSettingsRecord, AgentLearningOverrideRecord, SaveAgentLearningSettingsRequest, KnowledgeEntryListRequest, KnowledgeEntryListResponse, KnowledgeReviewBatchListRequest, KnowledgeReviewBatchListResponse, KnowledgeEntryRecord, KnowledgeEntrySaveRequest, KnowledgeEntryWriteReceipt, KnowledgeEntryReviewRequest, KnowledgeEntryBatchReviewRequest, KnowledgeEntryRestoreRequest, AgentInstructionReviewRequest, AgentInstructionReceipt, AgentInstructionReviewListResponse } from "./knowledge.js";
+import type { RollbackWorkspaceArtifactRequest, SetWorkspaceArtifactStatusRequest, UpdateWorkspaceArtifactVisibilityRequest, UpdateWorkspaceArtifactVisibilityResponse, WorkspaceArtifactDetailResponse, WorkspaceArtifactListOptions, WorkspaceArtifactListResponse, WorkspaceArtifactMutationResponse } from "./workspace-artifacts.js";
+import type { CreateFeedbackRequest, Feedback, FeedbackSubmissionResponse } from "./feedback.js";
+import type { CreateWorkspaceWebhookRequest, CreateWorkspaceWebhookResponse, GetWorkspaceCredentialProviderResponse, ListWorkspaceWebhookDeliveriesResponse, ListWorkspaceWebhooksResponse, PutWorkspaceCredentialProviderRequest, PutWorkspaceCredentialProviderResponse, UpdateWorkspaceWebhookRequest, WorkspaceSandboxImages, WorkspaceWebhook, WorkspaceWebhookDelivery } from "./workspace-integrations.js";
+import type { OpenGeniToolsFacade } from "./tools.js";
+import { type VaultsApi } from "./vaults-api.js";
 import { type SessionEventStreamTransport, type StreamSessionEventsOptions } from "./stream.js";
+import type { SessionModelContextResponse } from "./model-context.js";
+import { type OpenGeniDeprecationHandler } from "./deprecation.js";
+import type { SkillRecord, SkillSummary, SkillWriteReceipt, SaveWorkspaceSkillRequest, RemoveWorkspaceSkillRequest, ApplyWorkspaceSkillRevisionRequest } from "./skills.js";
 import { type WorkspaceControlStreamTransport } from "./workspace-control-stream.js";
 import { type WorkspaceInteractionRevisionStreamTransport } from "./interaction-revision-stream.js";
 import { type WorkspaceLiveStreamOptions, type WorkspaceLiveStreamTransport } from "./workspace-live-stream.js";
-import { OpenGeniInteractionClient, type AuthRun, type AuthRunListOptions, type AuthRunListResponse, type AuthRunMutationResponse, type AttachedBrowserDevice, type AttachedBrowserDeviceListOptions, type AttachedBrowserDeviceListResponse, type BrowserActionReceipt, type BrowserActionRequest, type BrowserClipboard, type BrowserDiagnosticBatch, type BrowserDiagnosticsOptions, type BrowserDownload, type BrowserDownloadListResponse, type BrowserDownloadSaveRequest, type BrowserDownloadSaveResponse, type BrowserIdentity, type BrowserIdentityListOptions, type BrowserIdentityListResponse, type BrowserIdentityMutationResponse, type BrowserObservation, type BrowserOpenTargetRequest, type BrowserSession, type BrowserSessionAttachment, type BrowserSessionAttachmentRequest, type BrowserSessionHeartbeatResponse, type BrowserSessionLifecycleRequest, type BrowserSessionListResponse, type BrowserSessionMutationResponse, type BrowserTargetListResponse, type BrowserRevisionListResponse, type ComputerActionReceipt, type ComputerActionRequest, type ComputerClipboard, type ComputerFrame, type ComputerObservation, type ComputerSession, type ComputerSessionAttachment, type ComputerSessionAttachmentRequest, type ComputerSessionHeartbeatResponse, type ComputerSessionLifecycleRequest, type ComputerSessionListResponse, type ComputerSessionMutationResponse, type ComputerTargetListResponse, type CreateBrowserIdentityRequest, type CreateBrowserSessionRequest, type CreateComputerSessionRequest, type CreateInteractionInterventionRequest, type CreateNetworkRouteRequest, type CreateSiteAuthConnectionRequest, type ExternalAuthInteractiveRequest, type ExternalAuthInteractiveResponse, type ExternalAuthRunRequest, type ExternalAuthRunResponse, type InteractionIntervention, type InteractionInterventionListOptions, type InteractionInterventionListResponse, type InteractionInterventionMutationResponse, type NetworkRoute, type NetworkRouteListOptions, type NetworkRouteListResponse, type NetworkRouteMutationResponse, type ProtectedAuthFillRequest, type ProtectedAuthFillResponse, type PublishBrowserRevisionRequest, type PublishBrowserRevisionResponse, type ReportAuthRunRequest, type ResolveInteractionInterventionRequest, type SiteAuthConnection, type SiteAuthConnectionListOptions, type SiteAuthConnectionListResponse, type SiteAuthConnectionMutationResponse, type StartAuthRunRequest, type UpdateNetworkRouteRequest, type UpdateBrowserIdentityRequest, type UpdateSiteAuthConnectionRequest, type VerifyAuthRunRequest, type WorkspaceInteractionRevisionEvent } from "./interaction.js";
-import type { AccessContext, ActivateCodexRealtimeConnectionRequest, AddWorkspaceMemberRequest, ApiKey, BillingEntitlementsResponse, CodexAccount, CodexAccountsResponse, CodexAppsUpdate, CodexRotationSettings, CodexOverviewResponse, CodexAllocatorUpdate, CodexConnectionStatus, CodexRealtimeWebrtcRequest, CodexRealtimeWebrtcResponse, GatewayRealtimeConnectRequest, GatewayRealtimeConnectResponse, CodexConnectPoll, CodexConnectStart, CodexUsage, CodexUsageMap, SuperGrokAccount, SuperGrokAccountsResponse, SuperGrokAccountScope, SuperGrokAllocatorUpdate, SuperGrokConnectionStatus, SuperGrokConnectPoll, SuperGrokConnectStart, SuperGrokRotationSettings, BillingSummary, BillingUsageResponse, InsightsRange, WorkspaceInsightsResponse, BeginSessionRealtimeRequest, CapabilityCatalogItem, CapabilityCatalogResponse, CapabilityInstallation, ApiIntegrationPreview, ApiIntegrationOAuthStartRequest, ApiIntegrationUninstallPreview, InstallApiIntegrationRequest, InstalledApiIntegration, IntegrationFacetMutationResult, IntegrationFacetRemovalResult, IntegrationInstanceFacetsResponse, ListIntegrationDefinitionsResponse, ListApiIntegrationsResponse, MutateIntegrationFacetRequest, PreviewApiIntegrationRequest, UninstallApiIntegrationRequest, UninstallApiIntegrationResult, UpsertIntegrationFacetRequest, PreviewPluginRequest, PluginPreview, InstallPluginRequest, InstalledPlugin, ListInstalledPluginsResponse, PluginUninstallPreview, UninstallPluginRequest, UninstallPluginResult, AddDocumentRequest, CreateKnowledgeDropRequest, MoveDocumentRequest, ClientConfig, WorkspaceModelAccessPolicy, WorkspaceModelCatalogResponse, WorkspaceRealtimeModelCatalogResponse, ClientSessionEventInput, UserMessageEventInput, CompactSessionContextResult, ConnectionMetadata, PersonalGitHubConnectionStatusResponse, PersonalGitHubDisconnectRequest, PersonalGitHubOAuthStartRequest, PersonalGitHubOAuthStartResponse, ListPersonalGitHubRepositoriesOptions, ListPersonalGitHubRepositoriesResponse, PersonalGitHubRepositorySelectionState, ReplacePersonalGitHubRepositorySelectionsRequest, VerifyPersonalGitHubRepositorySelectionsRequest, CreateApiKeyRequest, CreateApiKeyResponse, CreateOrganizationApiKeyRequest, CreateCapabilityCatalogItemRequest, InstallSkillRequest, InstallLibrarySkillRequest, InstalledSkill, ListInstalledSkillsResponse, CreateBillingPortalRequest, CreateBillingPortalResponse, CreateCheckoutRequest, CreateCheckoutResponse, OpenGeniSlackBotInstallRequest, OpenGeniSlackBotInstallStart, SlackChannelRouteListResponse, SlackReactionChannelListResponse, UpdateSlackChannelRoutesRequest, FikenInstallRequest, FikenOAuthStartRequest, FikenOAuthStartResponse, CreateConnectionRequest, CreateDocumentBaseRequest, CreateFileUploadRequest, CreateFileUploadResponse, CreateGitHubAppManifestRequest, CreateGitHubAppManifestResponse, CreateKnowledgeMemoryRequest, CreateScheduledTaskRequest, CreateSessionRequest, CreateSessionResponse, CreateVariableSetRequest, ResolveVariableSetAttachmentsRequest, ResolveVariableSetAttachmentsResponse, CreateRigRequest, CreateWorkspaceRequest, EnsureWorkspaceRequest, EnsureWorkspaceResponse, DeviceEnrollmentApproveRequest, DeviceEnrollmentApproveResponse, DeviceEnrollmentDenyResponse, DeviceEnrollmentLookupResponse, MintEnrollTokenResponse, EndSessionRealtimeRequest, DiscoverMcpCapabilitiesResponse, Document, DocumentBase, DocumentSearchRequest, DocumentSearchResponse, EnableCapabilityRequest, EnablePackRequest, FileAsset, FileDownloadUrlResponse, GetPackResponse, GitHubAppInfo, GitHubRepositoriesResponse, GoogleDriveBrowseResponse, GoogleDriveDisconnectRequest, SaveGoogleDriveIntegrationSourceRequest, GoogleDriveLifecycleActionRequest, KnowledgeMemory, KnowledgeMemorySearchRequest, ListManagedOrganizationMembershipsResponse, ListUserResourceAuthoritiesOptions, ListUserResourceAuthoritiesResponse, IssueUserResourceGrantRequest, UserResourceGrantMutationResponse, RevokeUserResourceGrantResponse, ListOrganizationInvitationsPageResponse, ListOrganizationAdministrationMembersResponse, AcceptOrganizationInvitationRequest, AcceptOrganizationInvitationResponse, AcceptOrganizationRecoveryCustodyRequest, ConfigureOrganizationRecoveryPolicyRequest, CreateOrganizationInvitationRequest, CreateOrganizationRequest, CreateOrganizationResponse, CreateOrganizationWorkspaceRequest, OrganizationInvitation, OrganizationAdministrationOverview, OrganizationMember, OrganizationRecoveryMutationResponse, OrganizationRecoveryOperationCommandRequest, OrganizationRecoveryOverview, OrganizationWorkspaceAccess, OrganizationWorkspaceAccessMember, OrganizationRetentionPolicy, OrganizationSummary, RevokeOrganizationInvitationRequest, RevokeOrganizationWorkspaceMemberRequest, RevokeOrganizationWorkspaceMemberResponse, PutOrganizationWorkspaceMemberRequest, UpdateOrganizationMemberRequest, UpdateOrganizationNameRequest, DisableOrganizationRecoveryPolicyRequest, StartOrganizationRecoveryOperationRequest, UpdateOrganizationWorkspaceRequest, UpdateOrganizationRetentionPolicyRequest, ListPacksResponse, MachinesResponse, MetricSample, RemoveEnrollmentRequest, RemoveEnrollmentResponse, MachineOperationPolicy, UpdateMachineOperationPolicyRequest, UpdateMachineAgentResponse, SwapActiveSandboxRequest, SwapActiveSandboxResponse, InstallPackRequest, PackInstallationPreview, PrepareSlackUserLinkAccessRequest, SlackUserLinkAccessMutationRequest, SlackUserLinkAccessRequest, ApproveSlackUserLinkAccessRequest, PackInstallation, PackUninstallPreview, RetainedScreenshotDownload, RetainedScreenshotDownloadOptions, RetainedArtifactDownload, RetainedArtifactDownloadOptions, RetainedArtifactReference, RetainedArtifactContent, RetainedArtifactContentOptions, RetainedArtifactMetadata, UpdateVideoGenerationPolicyRequest, VideoArtifactPlaybackSource, VideoGenerationOperationSummary, VideoGenerationPolicy, WorkspaceVideoGenerationSettings, RegisterCapabilityPackRequest, PreviewPackInstallationRequest, PreviewSkillImportRequest, ScheduledTask, ScheduledTaskRun, ForkSessionRequest, ForkSessionResponse, Session, SessionStatus, WorkClaimSubjectType, SessionBackgroundCommandListResponse, CancelSessionBackgroundCommandResult, SessionListResponse, SessionTenancyCreateCapabilities, AgentTopologyPageResponse, UpdateSessionChannelRequest, UpdateSessionAttentionRequest, UpdateSessionArchiveRequest, UpdateSessionPinRequest, UpdateSessionVisibilityRequest, UpdateSessionVisibilityResponse, UninstallPackRequest, UninstallPackResult, SessionEvent, SessionEventCompactResult, SessionEventCompactResultOptions, SessionEventListOptions, SessionEventPage, SessionGoal, SessionGoalRevision, ListSessionGoalRevisionsOptions, ListSessionGoalRevisionsResponse, RejectSessionGoalRevisionRequest, RejectSessionGoalRevisionResponse, RollbackSessionGoalRevisionRequest, SessionHumanInputRequest, SessionLineageResponse, SessionRealtimeMutationResponse, SyncSessionRealtimeLedgerRequest, SyncSessionRealtimeLedgerResponse, RenewSessionRealtimeRequest, UpdateSessionMcpApprovalPolicyRequest, UpdateSessionMcpApprovalPolicyResponse, SessionQueueSnapshot, SessionQueueMutationResponse, SessionCommandReceipt, SessionPromptRouting, ComposerDraft, DeleteSessionQueueItemRequest, EditSessionQueueItemRequest, MoveSessionQueueItemRequest, NewSessionDraft, SaveComposerDraftRequest, SubmitComposerDraftRequest, SubmitComposerDraftResponse, SaveNewSessionDraftRequest, SteerSessionQueueItemRequest, SessionControlResponse, WorkspaceInferenceControlResponse, WorkspaceControlEvent, SessionTurn, SubmitHumanInputResponseRequest, SessionCapabilities, AttachViewerRequest, AttachViewerResponse, AcknowledgeStreamRequest, AcknowledgeStreamResponse, ViewerHeartbeatRequest, ViewerHeartbeatResponse, FsListRequest, FsListResponse, FsListBatchRequest, FsListBatchResponse, FsReadRequest, FsReadResponse, PublishSandboxFileArtifactRequest, SandboxFileArtifactReceipt, FsWriteRequest, FsWriteResponse, FsDeleteRequest, FsDeleteResponse, FsMoveRequest, FsMoveResponse, FsMkdirRequest, FsMkdirResponse, GitStatusRequest, GitStatusResponse, GitDiffRequest, GitDiffResponse, GitReadBatchRequest, GitReadBatchResponse, GitLogRequest, GitLogResponse, GitShowRequest, GitShowResponse, GetWorkspaceCaptureResponse, GetWorkspaceCaptureFileResponse, TerminalExecRequest, TerminalExecResponse, PtyOpenRequest, PtyOpenResponse, PtyWriteRequest, PtyResizeRequest, PtyCloseRequest, TranscribeAudioResponse, TranscriptionRecordingListResponse, TranscriptionRecordingResponse, UploadTranscriptionRecordingChunkResponse, UpdateConnectionRequest, UpdateKnowledgeMemoryRequest, UpdateScheduledTaskRequest, UpdateSessionGoalRequest, ApplySessionGoalRevisionRequest, UpdateSessionRequest, UpdateSessionVariableSetsRequest, UpdateSessionToolPolicyRequest, UpdateVariableSetRequest, UpdateRigRequest, UpdateWorkspaceMemberRequest, UpdateWorkspaceModelAccessPolicyRequest, UpdateWorkspaceRequest, UpdateWorkspaceSettingsRequest, SetWorkspaceDefaultRigRequest, UploadFileInput, VariableSet, VariableSetSecret, VariableSetVariableMetadata, Channel, CreateChannelRequest, ReorderChannelsRequest, UpdateChannelRequest, Rig, RigVersion, RigChange, ProposeRigChangeRequest, WorkspaceMember, WorkspaceMemberCandidate, WorkspaceMemorySearchRequest, WorkspaceMemorySearchResponse, WorkspaceRegisteredPack, Workspace, SlackInstallationBinding, OAuthStartRequest, OAuthStartResponse, SocialConnection, SocialOAuthStartRequest, SkillImportPreview, SkillUninstallPreview, UninstallSkillRequest, UninstallSkillResult } from "./types.js";
+import { OpenGeniInteractionClient, type AuthRun, type AuthRunListOptions, type AuthRunListResponse, type AuthRunMutationResponse, type AttachedBrowserDevice, type AttachedBrowserDeviceListOptions, type AttachedBrowserDeviceListResponse, type BrowserActionReceipt, type BrowserActionRequest, type BrowserScreenshotOptions, type BrowserClipboard, type BrowserDiagnosticBatch, type BrowserDomReadRequest, type BrowserDomReadResponse, type BrowserDiagnosticsOptions, type BrowserDownload, type BrowserDownloadListResponse, type BrowserDownloadSaveRequest, type BrowserDownloadSaveResponse, type BrowserIdentity, type BrowserIdentityListOptions, type BrowserIdentityListResponse, type BrowserIdentityMutationResponse, type BrowserObservation, type BrowserFrame, type BrowserOpenTargetRequest, type BrowserSession, type BrowserSessionAttachment, type BrowserSessionAttachmentRequest, type BrowserSessionHeartbeatResponse, type BrowserSessionLifecycleRequest, type BrowserSessionListResponse, type BrowserSessionMutationResponse, type BrowserTargetState, type BrowserTargetListResponse, type BrowserWorkingCopyAdoptionRequest, type BrowserWorkingCopyAdoptionResponse, type BrowserWorkingCopyInspection, type BrowserRevisionListResponse, type ComputerActionReceipt, type ComputerActionRequest, type ComputerClipboard, type ComputerFrame, type ComputerObservation, type ComputerSession, type ComputerSessionAttachment, type ComputerSessionAttachmentRequest, type ComputerSessionHeartbeatResponse, type ComputerSessionInputPosture, type ComputerSessionLifecycleRequest, type ComputerSessionListResponse, type ComputerSessionMutationResponse, type ComputerTargetListResponse, type CreateBrowserIdentityRequest, type CreateBrowserSessionRequest, type CreateComputerSessionRequest, type CreateInteractionInterventionRequest, type CreateNetworkRouteRequest, type CreateSiteAuthConnectionRequest, type ExternalAuthInteractiveRequest, type ExternalAuthInteractiveResponse, type ExternalAuthRunRequest, type ExternalAuthRunResponse, type InteractionIntervention, type InteractionInterventionListOptions, type InteractionInterventionListResponse, type InteractionInterventionMutationResponse, type NetworkRoute, type NetworkRouteListOptions, type NetworkRouteListResponse, type NetworkRouteMutationResponse, type PublishBrowserRevisionRequest, type PublishBrowserRevisionResponse, type ReportAuthRunRequest, type ResolveInteractionInterventionRequest, type SiteAuthConnection, type SiteAuthConnectionListOptions, type SiteAuthConnectionListResponse, type SiteAuthConnectionMutationResponse, type StartAuthRunRequest, type UpdateNetworkRouteRequest, type UpdateBrowserIdentityRequest, type UpdateSiteAuthConnectionRequest, type VerifyAuthRunRequest, type WorkspaceInteractionRevisionEvent } from "./interaction.js";
+import type { AccessContext, ActivateCodexRealtimeConnectionRequest, AddWorkspaceMemberRequest, ApiKey, BillingEntitlementsResponse, CodexAccount, CodexAccountsResponse, SessionCodexAccountsResponse, CodexAppsUpdate, CodexRotationSettings, CodexOverviewResponse, CodexAllocatorUpdate, CodexConnectionStatus, CodexRealtimeWebrtcRequest, CodexRealtimeWebrtcResponse, GatewayRealtimeConnectRequest, GatewayRealtimeConnectResponse, CodexConnectPoll, CodexConnectStart, CodexUsage, CodexUsageMap, ModelConnectionAccessKind, ModelConnectionAccessPolicy, ModelConnectionAccessResponse, SuperGrokAccount, SuperGrokAccountsResponse, SuperGrokAccountScope, SuperGrokAllocatorUpdate, SuperGrokConnectionStatus, SuperGrokConnectPoll, SuperGrokConnectStart, SuperGrokRotationSettings, BillingSummary, BillingUsageResponse, InsightsRange, WorkspaceInsightsResponse, BeginSessionRealtimeRequest, CapabilityCatalogItem, CapabilityCatalogResponse, ConnectorToolPermissionsResponse, UpdateConnectorToolPermissionsRequest, SessionMcpToolPermissionsResponse, UpdateSessionMcpToolPermissionsRequest, CapabilityInstallation, ApiIntegrationPreview, ApiIntegrationOAuthStartRequest, ApiIntegrationUninstallPreview, InstallApiIntegrationRequest, InstalledApiIntegration, IntegrationFacetMutationResult, IntegrationFacetRemovalResult, IntegrationInstanceFacetsResponse, ListIntegrationDefinitionsResponse, ListApiIntegrationsResponse, MutateIntegrationFacetRequest, PreviewApiIntegrationRequest, UninstallApiIntegrationRequest, UninstallApiIntegrationResult, UpsertIntegrationFacetRequest, PreviewPluginRequest, PluginPreview, InstallPluginRequest, InstalledPlugin, ListInstalledPluginsResponse, PluginUninstallPreview, UninstallPluginRequest, UninstallPluginResult, AddDocumentRequest, CreateKnowledgeDropRequest, MoveDocumentRequest, ClientConfig, WorkspaceModelAccessPolicy, OrganizationModelDefaults, UpdateOrganizationModelDefaultsRequest, ModelAccountSettingsOverview, OrganizationModelAccountSettings, UpdateOrganizationModelAccountSettingsRequest, UpdateWorkspaceModelAccountSettingsRequest, WorkspaceModelAccountSettings, ModelAccountPreferences, SessionModelAccountChoiceResponse, SessionUsageLimit, SetSessionUsageLimitRequest, SetSessionModelAccountChoiceRequest, SetSessionModelAccountChoiceResponse, UpdateModelAccountPreferencesRequest, OrganizationAgentAdminAccess, UpdateOrganizationAgentAdminAccessRequest, OrganizationPrivacySettings, UpdateOrganizationPrivacySettingsRequest, SessionAdminAccess, GrantSessionAdminAccessRequest, WorkspaceModelCatalogResponse, WorkspaceGatewayCustomModel, WorkspaceGatewayCustomModelsResponse, CreateWorkspaceGatewayCustomModelRequest, DeleteWorkspaceGatewayCustomModelRequest, WorkspaceOpenRouterCustomModel, WorkspaceOpenRouterCustomModelsResponse, CreateWorkspaceOpenRouterCustomModelRequest, DeleteWorkspaceOpenRouterCustomModelRequest, WorkspaceOpperCustomModel, WorkspaceOpperCustomModelsResponse, CreateWorkspaceOpperCustomModelRequest, DeleteWorkspaceOpperCustomModelRequest, OrganizationModelProviderKind, ClaudeSubscriptionUsage, ClaudeSubscriptionOAuthStartResponse, ClaudeSubscriptionOAuthCompleteRequest, ClaudeSubscriptionOAuthCompleteResponse, OrganizationModelProviderConnection, UpsertOrganizationModelProviderConnectionRequest, RevokeOrganizationModelProviderConnectionRequest, OrganizationProviderCustomModel, OrganizationProviderCustomModelsResponse, CreateOrganizationProviderCustomModelRequest, DeleteOrganizationProviderCustomModelRequest, WorkspaceRealtimeModelCatalogResponse, ClientSessionEventInput, UserMessageEventInput, CompactSessionContextResult, ConnectionMetadata, PersonalGitHubConnectionStatusResponse, PersonalGitHubDisconnectRequest, PersonalGitHubOAuthStartRequest, PersonalGitHubOAuthStartResponse, ListPersonalGitHubRepositoriesOptions, ListPersonalGitHubRepositoriesResponse, PersonalGitHubRepositorySelectionState, ReplacePersonalGitHubRepositorySelectionsRequest, VerifyPersonalGitHubRepositorySelectionsRequest, CreateApiKeyRequest, CreateApiKeyResponse, CreateOrganizationApiKeyRequest, OrganizationMcpConnection, CreatePersonalApiKeyRequest, CreatePersonalApiKeyResponse, ListPersonalApiKeysResponse, OrganizationMcpConnectionList, OrganizationServiceAccount, ListOrganizationServiceAccountsResponse, CreateOrganizationServiceAccountRequest, UpdateOrganizationServiceAccountRequest, UpdateOrganizationMcpConnectionRequest, McpConnectionRequest, McpConnectionDecision, NativeAppAuthorizeInput, NativeAppTokenInput, NativeAppToken, InboxItem, InboxSettings, MemberNotificationsSetting, SessionInboxMute, ListInboxResponse, UpdateInboxItemInput, NativePushDevice, RegisterNativePushDeviceInput, CreateCapabilityCatalogItemRequest, InstallSkillRequest, InstallLibrarySkillRequest, InstalledSkill, ListInstalledSkillsResponse, CreateBillingPortalRequest, BillingSubscriptionCatalog, CreateSubscriptionCheckoutRequest, CreateSubscriptionCheckoutResponse, ChangeBillingSubscriptionRequest, CancelBillingSubscriptionRequest, BillingSubscriptionChange, CreateBillingPortalResponse, CreateCheckoutRequest, BillingCheckoutStatus, CreateCheckoutResponse, OpenGeniSlackBotInstallRequest, AvailableOpenGeniSlackBots, OpenGeniSlackBotOrganizationAccess, UpdateOpenGeniSlackBotOrganizationAccess, OpenGeniSlackBotInstallStart, SlackChannelRouteListResponse, SlackReactionChannelListResponse, UpdateSlackChannelRoutesRequest, FikenInstallRequest, FikenOAuthStartRequest, FikenOAuthStartResponse, CreateConnectionRequest, CreateDocumentBaseRequest, CreateFileUploadRequest, CreateFileUploadResponse, CreateGitHubAppManifestRequest, CreateGitHubAppManifestResponse, CreateScheduledTaskRequest, CreateSessionRequest, CreateSessionResponse, CreateRigRequest, CreateWorkspaceRequest, EnsureWorkspaceRequest, EnsureWorkspaceResponse, DeviceEnrollmentApproveRequest, DeviceEnrollmentApproveResponse, DeviceEnrollmentDenyResponse, DeviceEnrollmentLookupResponse, MintEnrollTokenRequest, MintEnrollTokenResponse, EndSessionRealtimeRequest, DiscoverMcpCapabilitiesResponse, Document, DocumentBase, EnableCapabilityRequest, FileAsset, FileDownloadUrlResponse, GitHubActionPoliciesResponse, GitHubActionPolicyActorState, GitHubAppInfo, GitHubRepositoriesResponse, GoogleDriveBrowseResponse, GoogleDriveDisconnectRequest, SaveGoogleDriveIntegrationSourceRequest, GoogleDriveLifecycleActionRequest, ListOrganizationSessionsOptions, ListManagedOrganizationMembershipsResponse, ListUserResourceAuthoritiesOptions, ListUserResourceAuthoritiesResponse, UpdateGitHubActionPolicyRequest, RevokeUserResourceGrantResponse, ListOrganizationInvitationsPageResponse, ListOrganizationAdministrationMembersResponse, AcceptOrganizationInvitationRequest, AcceptOrganizationInvitationResponse, AcceptOrganizationRecoveryCustodyRequest, ConfigureOrganizationRecoveryPolicyRequest, CreateOrganizationInvitationRequest, CreateAdditionalOrganizationRequest, CreateAdditionalOrganizationResponse, CreateOrganizationRequest, CreateOrganizationResponse, CreateOrganizationWorkspaceRequest, OrganizationInvitation, OrganizationAdministrationOverview, OrganizationMember, OrganizationRecoveryMutationResponse, OrganizationRecoveryOperationCommandRequest, OrganizationRecoveryOverview, OrganizationSessionListResponse, OrganizationWorkspaceAccess, OrganizationWorkspaceAccessMember, OrganizationRetentionPolicy, OrganizationSummary, RevokeOrganizationInvitationRequest, RevokeOrganizationWorkspaceMemberRequest, RevokeOrganizationWorkspaceMemberResponse, PutOrganizationWorkspaceMemberRequest, UpdateOrganizationMemberRequest, UpdateOrganizationNameRequest, DisableOrganizationRecoveryPolicyRequest, StartOrganizationRecoveryOperationRequest, UpdateOrganizationWorkspaceRequest, UpdateOrganizationRetentionPolicyRequest, MachinesResponse, MetricSample, RemoveEnrollmentRequest, RemoveEnrollmentResponse, MachineOperationPolicy, UpdateMachineOperationPolicyRequest, UpdateMachineAgentResponse, EnableMachineScreenControlResponse, ChangeMachineAudienceRequest, ChangeMachineAudienceResponse, MachineAudiencePreview, MachineAudiencePreviewRequest, OpenMachinePrivacySettingsRequest, OpenMachinePrivacySettingsResponse, SwapActiveSandboxRequest, SwapActiveSandboxResponse, PrepareSlackUserLinkAccessRequest, SlackUserLinkAccessMutationRequest, SlackUserLinkAccessRequest, ApproveSlackUserLinkAccessRequest, RetainedScreenshotDownload, RetainedScreenshotDownloadOptions, RetainedArtifactDownload, RetainedArtifactDownloadOptions, RetainedArtifactReference, RetainedArtifactContent, RetainedArtifactContentOptions, RetainedArtifactMetadata, UpdateVideoGenerationPolicyRequest, VideoArtifactPlaybackSource, VideoGenerationOperationSummary, VideoGenerationPolicy, WorkspaceVideoGenerationSettings, PreviewSkillImportRequest, PrivateScheduledTaskSummary, ScheduledTask, ScheduledTaskAccessAttention, ScheduledTaskRun, ForkSessionRequest, ForkSessionResponse, Session, SessionStatus, WorkClaimSubjectType, SessionBackgroundCommandListResponse, CancelSessionBackgroundCommandResult, SessionListResponse, SessionListEntryResponse, SessionTenancyCreateCapabilities, AgentTopologyPageResponse, UpdateSessionChannelRequest, UpdateSessionAttentionRequest, UpdateSessionArchiveRequest, UpdateSessionRetentionRequest, UpdateSessionPinRequest, UpdateSessionVisibilityRequest, UpdateSessionVisibilityResponse, SessionVisibility, SessionVisibilityChangePreview, SessionScopeSubjectId, SessionEvent, SessionEventCompactResult, SessionEventCompactResultOptions, SessionEventListOptions, SessionEventPage, SessionGoal, SessionGoalRevision, ListSessionGoalRevisionsOptions, ListSessionGoalRevisionsResponse, RejectSessionGoalRevisionRequest, RejectSessionGoalRevisionResponse, RollbackSessionGoalRevisionRequest, SessionHumanInputRequest, SessionLineageResponse, SessionRealtimeMutationResponse, SyncSessionRealtimeLedgerRequest, SyncSessionRealtimeLedgerResponse, RenewSessionRealtimeRequest, UpdateSessionMcpApprovalPolicyRequest, UpdateSessionMcpApprovalPolicyResponse, SessionQueueSnapshot, SessionQueueMutationResponse, SessionCommandReceipt, SessionPromptRouting, ComposerDraft, DeleteSessionQueueItemRequest, EditSessionQueueItemRequest, MoveSessionQueueItemRequest, NewSessionDraft, SaveComposerDraftRequest, SubmitComposerDraftRequest, SubmitComposerDraftResponse, SaveNewSessionDraftRequest, SteerSessionQueueItemRequest, SessionControlResponse, SessionRetryRequest, SandboxRecoveryProjection, SandboxRecoveryRequest, SandboxRecoveryResponse, SessionRetryResponse, WorkspaceInferenceControlResponse, WorkspaceControlEvent, SessionTurn, SubmitHumanInputResponseRequest, SessionCapabilities, AttachViewerRequest, AttachViewerResponse, AcknowledgeStreamRequest, AcknowledgeStreamResponse, ViewerHeartbeatRequest, ViewerHeartbeatResponse, FsListRequest, FsListResponse, FsListBatchRequest, FsListBatchResponse, FsReadRequest, FsReadResponse, PublishSandboxFileArtifactRequest, SandboxFileArtifactReceipt, FsWriteRequest, FsWriteResponse, FsDeleteRequest, FsDeleteResponse, FsMoveRequest, FsMoveResponse, FsMkdirRequest, FsMkdirResponse, GitStatusRequest, GitStatusResponse, GitDiffRequest, GitDiffResponse, GitReadBatchRequest, GitReadBatchResponse, GitLogRequest, GitLogResponse, GitShowRequest, GitShowResponse, GetWorkspaceCaptureResponse, GetWorkspaceCaptureFileResponse, TerminalExecRequest, TerminalExecResponse, PtyOpenRequest, PtyOpenResponse, PtyWriteRequest, PtyResizeRequest, PtyCloseRequest, TranscribeAudioResponse, TranscriptionRecordingListResponse, TranscriptionRecordingResponse, UploadTranscriptionRecordingChunkResponse, UpdateConnectionRequest, RefreshScheduledTaskAccessRequest, UpdateScheduledTaskRequest, UpdateSessionGoalRequest, ApplySessionGoalRevisionRequest, UpdateSessionRequest, UpdateSessionToolPolicyRequest, UpdateSessionAgentRequest, UpdateSessionSkillsRequest, UpdateRigRequest, UpdateWorkspaceMemberRequest, UpdateWorkspaceModelAccessPolicyRequest, UpdateWorkspaceRequest, UpdateWorkspaceSettingsRequest, SetWorkspaceDefaultRigRequest, UploadFileInput, Channel, CreateChannelRequest, ReorderChannelsRequest, UpdateChannelRequest, Rig, RigVersion, RigChange, ProposeRigChangeRequest, WorkspaceMember, WorkspaceMemberCandidate, Workspace, SlackInstallationBinding, OAuthStartRequest, OAuthStartResponse, SocialConnection, SocialOAuthStartRequest, SkillImportPreview, SkillUninstallPreview, UninstallSkillRequest, UninstallSkillResult } from "./types.js";
 import type { ActivateWorkspaceInstructionPolicyRequest, CreateWorkspaceInstructionPolicyDraftRequest, CreateWorkspaceInstructionPolicyOnboardingProposalRequest, ImportLegacyWorkspaceInstructionPolicyDraftRequest, RollbackWorkspaceInstructionPolicyRequest, WorkspaceInstructionPolicyActivationResponse, WorkspaceInstructionPolicyDiffRequest, WorkspaceInstructionPolicyDiffResponse, WorkspaceInstructionPolicyListOptions, WorkspaceInstructionPolicyListResponse, WorkspaceInstructionPolicyOnboardingProposal, WorkspaceInstructionPolicyOnboardingProposalListOptions, WorkspaceInstructionPolicyOnboardingProposalListResponse, WorkspaceInstructionPolicyRevision } from "./workspace-instruction-policies.js";
-import type { ActivateWorkspaceLearningPolicyRevisionRequest, CreateWorkspaceLearningPolicyRevisionRequest, GovernedLearningActivationUndoReceipt, RollbackWorkspaceLearningPolicyRevisionRequest, WorkspaceLearningHistoryOptions, WorkspaceLearningHistoryResponse, WorkspaceLearningPolicyMutationResponse, WorkspaceLearningPolicyRevision } from "./workspace-learning.js";
+import type { GovernedLearningActivationUndoReceipt, WorkspaceLearningHistoryOptions, WorkspaceLearningHistoryResponse } from "./workspace-learning.js";
 import type { ActivateCompanyProfileRevisionRequest, CompanyProfileAgentPolicy, CompanyProfileDiffRequest, CompanyProfileDiffResponse, CompanyProfileListOptions, CompanyProfileListResponse, CompanyProfileMutationResponse, CompanyProfileRevision, RollbackCompanyProfileRequest, UpdateCompanyProfileRequest, UpdateCompanyProfileAgentPolicyRequest } from "./company-profile.js";
 import type { WorkspaceStateExportResponse, WorkspaceStateGetOptions, WorkspaceStateResponse } from "./workspace-state.js";
-import type { CompanyBrainOkfDownload, CompanyBrainOkfPackage } from "./company-brain.js";
 import type { ActivatePreferenceRegistryRevisionRequest, ChangePreferenceRegistryScopeRequest, CorrectPreferenceRegistryRequest, CreatePreferenceRegistryProposalRequest, DeactivatePreferenceRegistryRequest, PreferenceRegistryDetailResponse, PreferenceRegistryFullContent, PreferenceRegistryListOptions, PreferenceRegistryListResponse, PreferenceRegistryMutationResponse, PreferenceRegistryRecord, PreferenceRegistrySnapshot, RejectPreferenceRegistryProposalRequest, SupersedePreferenceRegistryRequest } from "./preference-registry.js";
-export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+export type SessionListPageOptions = {
+    /** Complete content-free totals for an authorized root page. */
+    includeTotals?: boolean;
+    /** Filter attention rows before pagination. */
+    needsYouOnly?: boolean;
+    /** Only read-only sessions moved to the idle-session archive. */
+    contentArchivedOnly?: boolean;
+    /**
+     * Only workstreams the caller started or messaged directly (any session in
+     * the tree). Agent-relayed messages do not count.
+     */
+    mineOnly?: boolean;
+    /** Created through this Site. In a Site-bound client, "current" resolves to its own Site. */
+    originSiteId?: string;
+    limit?: number;
+    parentSessionId?: string | null;
+    /** Only sessions carrying this exact opaque end-user label. */
+    scopeSubjectId?: SessionScopeSubjectId;
+    cursor?: string;
+    search?: string;
+    /** Restrict rows to one workspace project; null selects unfiled rows. */
+    channelId?: string | null;
+    /** Restrict rows to the exact frozen session creator identity. */
+    createdBy?: {
+        kind: "subject" | "service";
+        subjectId: string;
+    };
+    /** Inclusive ISO-8601 activity lower bound. */
+    updatedFrom?: string;
+    /** Exclusive ISO-8601 activity upper bound. */
+    updatedBefore?: string;
+    /** Inclusive ISO-8601 creation lower bound. */
+    createdFrom?: string;
+    /** Exclusive ISO-8601 creation upper bound. */
+    createdBefore?: string;
+    /** Return only the complete personal pinned projection. */
+    pinsOnly?: boolean;
+    /** Skip pinned details when the pinned section is loaded separately. Defaults to true. */
+    includePinned?: boolean;
+    /** Return archived root chats instead of the active session list. */
+    archivedOnly?: boolean;
+    sortBy?: "updatedAt" | "createdAt" | "name";
+    archiveStatus?: "active" | "archived" | "all";
+    /** Stop this caller's finite page read when its owning route is abandoned. */
+    signal?: AbortSignal | undefined;
+};
+/**
+ * Web-standard fetch response accepted by the SDK.
+ *
+ * The project global `Response` type includes Bun's non-standard `textStream()`
+ * method and the newer `bytes()` method. Fetch implementations such as Expo do
+ * not necessarily provide either member, and the SDK does not use them, so
+ * they must not be part of the adapter boundary.
+ */
+export type FetchResponse = Omit<Response, "bytes" | "clone" | "textStream"> & {
+    clone(): FetchResponse;
+};
+export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<FetchResponse>;
 export type WorkspaceControlEventPage = {
     events: WorkspaceControlEvent[];
     bytes: number;
@@ -18,10 +93,18 @@ export type WorkspaceControlEventPage = {
     nextAfter: number | null;
 };
 export type OpenGeniClientOptions = {
-    /** Base URL of the OpenGeni API, e.g. `https://api.example.com`. */
+    /** Explicit compatibility for an API predating targeted tool calls. No automatic downgrade. */
+    toolGatewayMode?: "target" | "catalog";
+    /** Base URL of the Opengeni API, e.g. `https://api.example.com`. */
     baseUrl: string;
-    /** OpenGeni API key, sent as `Authorization: Bearer <apiKey>`. */
+    /** Opengeni API key, sent as `Authorization: Bearer <apiKey>`. */
     apiKey?: string;
+    /**
+     * Receives a notice (once per route per client) when the API advertises a
+     * `Deprecation`/`Sunset` header on a response. Defaults to a one-time
+     * `console.warn` per route; pass `false` to silence notices.
+     */
+    onDeprecation?: OpenGeniDeprecationHandler | false | undefined;
     /** Extra headers (static or computed per request) merged into every call. */
     headers?: Record<string, string> | (() => Record<string, string>);
     /** Custom fetch implementation. Defaults to the global `fetch`. */
@@ -33,11 +116,36 @@ export type OpenGeniClientOptions = {
     beginSharedRead?: (() => number) | undefined;
     /** Positive deadline for interactive session commands. Defaults to 15 seconds. */
     sessionCommandTimeoutMs?: number;
+    /**
+     * How this client treats an API that advertises a different
+     * `x-opengeni-api-contract` revision.
+     *
+     * - `"strict"`: fail with `OpenGeniApiContractMismatchError` so a browser
+     *   page served alongside the API can reload onto the matching bundle.
+     * - `"compatible"`: keep working. Within a major release train the API is
+     *   additive (see the compatibility policy), and the API admits bearer
+     *   (API key / delegated token) mutations from older SDK revisions, so a
+     *   backend pinned to an older SDK is not broken by every deployment.
+     *
+     * Defaults to `"strict"` in a browser client without an `apiKey`, and to
+     * `"compatible"` everywhere else.
+     */
+    apiContract?: "strict" | "compatible" | undefined;
 };
 /** Per-request cancellation for operations whose caller owns an AbortSignal. */
 export type OpenGeniRequestOptions = {
     signal?: AbortSignal | undefined;
     timeoutMs?: number | undefined;
+    /** Opt-in void response handling for focused helpers using the shared transport. */
+    responseType?: "json" | "void";
+};
+/** Narrowing filters for BrowserSession/ComputerSession inventories. Filters
+ *  never grant access; omitted filters return the complete workspace history. */
+export type InteractionSessionListOptions = OpenGeniRequestOptions & {
+    /** Only sessions associated with this agent session. */
+    associatedSessionId?: string | undefined;
+    /** false omits ended and failed sessions. */
+    includeTerminal?: boolean | undefined;
 };
 export type SharedSessionReadOptions = {
     /**
@@ -104,21 +212,23 @@ export type FinalizeTranscriptionRecordingInput = {
     totalDurationMilliseconds: number;
     signal?: AbortSignal | undefined;
 };
-/**
- * Typed client for the OpenGeni public API. Framework-agnostic: only needs
- * WHATWG `fetch` + streams, so it runs in Node 18+, Bun, Deno, browsers, and
- * edge runtimes.
- */
 export declare class OpenGeniClient {
+    get toolGatewayMode(): "target" | "catalog";
+    protected externalActorHeader?: string;
+    protected serviceInitiatorHeader?: string | undefined;
+    protected serviceContextHeader?: string | undefined;
     private readonly baseUrl;
-    private readonly options;
+    protected readonly options: OpenGeniClientOptions;
     private readonly fetchImpl;
     private readonly sessionCommandTimeoutMs;
+    private readonly apiContractStrict;
     private readonly active;
     private readonly generations;
     private readonly queued;
     /** Resource-oriented Browser/Computer facade over this exact authenticated client. */
     readonly interaction: OpenGeniInteractionClient;
+    /** Dynamic typed tool facade backed by the canonical workspace gateway. */
+    readonly tools: OpenGeniToolsFacade;
     constructor(options: OpenGeniClientOptions);
     /** Make one finalization attempt for a recording; callers may retry retained audio. */
     transcribeAudio(workspaceId: string, input: TranscribeAudioInput): Promise<TranscribeAudioResponse>;
@@ -138,46 +248,119 @@ export declare class OpenGeniClient {
         signal?: AbortSignal | undefined;
     }): Promise<TranscriptionRecordingResponse>;
     createSession(workspaceId: string, request: CreateSessionRequest): Promise<CreateSessionResponse>;
+    /**
+     * The task's usage limit and recorded API-equivalent model usage. A child
+     * session returns its root's state with `inherited: true`. Servers that
+     * predate usage limits return 404.
+     */
+    getSessionUsageLimit(workspaceId: string, sessionId: string, options?: OpenGeniRequestOptions): Promise<SessionUsageLimit>;
+    /**
+     * Set (`limitMicros`), lower, raise or clear (`limitMicros: null`) a root
+     * task's usage limit with compare-and-set on `expectedVersion`. Person or
+     * trusted host only; agents are refused. Changing the limit never resumes
+     * paused work. Returns the committed state; 409 on a stale version.
+     */
+    setSessionUsageLimit(workspaceId: string, sessionId: string, request: SetSessionUsageLimitRequest): Promise<SessionUsageLimit>;
     getNewSessionDraft(workspaceId: string, options?: OpenGeniRequestOptions): Promise<NewSessionDraft>;
     saveNewSessionDraft(workspaceId: string, request: SaveNewSessionDraftRequest): Promise<NewSessionDraft>;
+    /** The workspace's HTTP credential provider, or null when none is configured. */
+    getWorkspaceCredentialProvider(workspaceId: string): Promise<GetWorkspaceCredentialProviderResponse>;
+    /**
+     * Create or update the workspace credential provider. The signing secret is
+     * returned only when the provider is first created; store it then.
+     */
+    putWorkspaceCredentialProvider(workspaceId: string, request: PutWorkspaceCredentialProviderRequest): Promise<PutWorkspaceCredentialProviderResponse>;
+    deleteWorkspaceCredentialProvider(workspaceId: string): Promise<void>;
+    listWorkspaceWebhooks(workspaceId: string): Promise<ListWorkspaceWebhooksResponse>;
+    /** Create a webhook. The signing secret is returned only in this response. */
+    createWorkspaceWebhook(workspaceId: string, request: CreateWorkspaceWebhookRequest): Promise<CreateWorkspaceWebhookResponse>;
+    updateWorkspaceWebhook(workspaceId: string, webhookId: string, request: UpdateWorkspaceWebhookRequest): Promise<WorkspaceWebhook>;
+    deleteWorkspaceWebhook(workspaceId: string, webhookId: string): Promise<void>;
+    listWorkspaceWebhookDeliveries(workspaceId: string, webhookId: string, options?: {
+        limit?: number;
+    }): Promise<ListWorkspaceWebhookDeliveriesResponse>;
+    /** Queue a delivered or failed delivery again with a fresh attempt budget. */
+    redeliverWorkspaceWebhookDelivery(workspaceId: string, webhookId: string, deliveryId: string): Promise<WorkspaceWebhookDelivery>;
+    /** Images this deployment lets a workspace choose as its default sandbox image. */
+    listWorkspaceSandboxImages(workspaceId: string): Promise<WorkspaceSandboxImages>;
+    /** Submit general feedback or a session/turn rating. Retain the key when retrying. */
+    createFeedback(workspaceId: string, request: CreateFeedbackRequest): Promise<FeedbackSubmissionResponse>;
+    /** Only this principal's submissions. No session filter means general feedback only. */
+    listOwnFeedback(workspaceId: string, options?: {
+        sessionId?: string;
+        limit?: number;
+        includeTurns?: boolean;
+    }): Promise<{
+        feedback: Feedback[];
+    }>;
     getSession(workspaceId: string, sessionId: string, options?: GetSessionOptions): Promise<Session>;
+    getToolActionReview(workspaceId: string, sessionId: string, approvalId: string): Promise<ToolActionReview>;
+    getToolReviewDetails(workspaceId: string, sessionId: string, approvalId: string, options: {
+        actionDigest: string;
+        path?: string;
+        offset?: number;
+    }): Promise<ToolReviewDetailsPage>;
+    /** Exact model-visible prefix captured from the latest provider request. */
+    getSessionModelContext(workspaceId: string, sessionId: string): Promise<SessionModelContextResponse>;
     updateSession(workspaceId: string, sessionId: string, request: UpdateSessionRequest): Promise<Session>;
-    /** Replace the complete ordered Variable Set selection at a quiescent turn boundary. */
-    updateSessionVariableSets(workspaceId: string, sessionId: string, request: UpdateSessionVariableSetsRequest): Promise<Session>;
     /** Whether this exact authenticated principal may atomically create a private session. */
     getSessionTenancyCreateCapabilities(workspaceId: string): Promise<SessionTenancyCreateCapabilities>;
-    /** Change an owned, fully quiescent session between private and workspace visibility. */
+    /**
+     * Change an owned session between private and workspace visibility. Leftover
+     * records never block it; work in progress needs `stopActiveWork`.
+     */
     updateSessionVisibility(workspaceId: string, sessionId: string, request: UpdateSessionVisibilityRequest): Promise<UpdateSessionVisibilityResponse>;
+    /** Owner-only preview: what changing the audience would stop and what would still refuse it. */
+    previewSessionVisibilityChange(workspaceId: string, sessionId: string, visibility: SessionVisibility): Promise<SessionVisibilityChangePreview>;
     /** Create an independent same-workspace fork with explicit destination visibility. */
     forkSession(workspaceId: string, sessionId: string, request: ForkSessionRequest): Promise<ForkSessionResponse>;
     /** Replace the durable tool policy or explicitly adopt workspace defaults. */
     updateSessionToolPolicy(workspaceId: string, sessionId: string, request: UpdateSessionToolPolicyRequest): Promise<Session>;
+    /**
+     * Replace the session's agent configuration (capabilities, identity,
+     * instructions alias, renderer). Omitted fields keep their current values.
+     * Uses the tool-policy version (409 when stale) and applies from the next
+     * turn. A legacy session converts from its current effective state.
+     */
+    updateSessionAgent(workspaceId: string, sessionId: string, request: UpdateSessionAgentRequest): Promise<Session>;
+    /**
+     * Replace every Skill the session carries itself (an empty list removes
+     * them). Uses the tool-policy version (409 when stale) and applies from the
+     * next turn; a running turn keeps the Skills it started with.
+     */
+    updateSessionSkills(workspaceId: string, sessionId: string, request: UpdateSessionSkillsRequest): Promise<Session>;
     /**
      * Replace one attached MCP server's approval policy. The change is captured
      * by the next claimed attempt; already-claimed work keeps its immutable
      * policy snapshot.
      */
     updateSessionMcpApprovalPolicy(workspaceId: string, sessionId: string, serverId: string, request: UpdateSessionMcpApprovalPolicyRequest): Promise<UpdateSessionMcpApprovalPolicyResponse>;
+    /** Search durable visible user/assistant text, including unloaded history.
+     * Pages may be empty with hasMore=true. Never fall back to title search on
+     * older servers. Use listEventPage before/after the returned sequence for context.
+     */
+    searchSessionMessages(workspaceId: string, request: SessionMessageSearchRequest, options?: OpenGeniRequestOptions): Promise<SessionMessageSearchResponse>;
+    /** Read one selected search result's complete visible text when <=12,000
+     * UTF-16 units. Stale, duplicate or non-message references fail with 404.
+     * The response never includes audit payload fields such as modelContext.
+     */
+    getSessionMessagePreview(workspaceId: string, sessionId: string, reference: SessionMessagePreviewReference, options?: OpenGeniRequestOptions): Promise<SessionMessagePreview>;
     listSessions(workspaceId: string, options?: {
+        originSiteId?: string;
         limit?: number;
         parentSessionId?: string | null;
         search?: string;
+        /** Only sessions carrying this exact opaque end-user label. */
+        scopeSubjectId?: SessionScopeSubjectId;
     }): Promise<Session[]>;
-    listSessionBackgroundCommands(workspaceId: string, sessionId: string): Promise<SessionBackgroundCommandListResponse>;
+    /** Running and stopping commands only; settled results remain in session history. */
+    listSessionBackgroundCommands(workspaceId: string, sessionId: string, options?: OpenGeniRequestOptions): Promise<SessionBackgroundCommandListResponse>;
     cancelSessionBackgroundCommand(workspaceId: string, sessionId: string, commandId: string): Promise<CancelSessionBackgroundCommandResult>;
     /** Pin-aware ordinary-session page with a stable keyset cursor. */
-    listSessionPage(workspaceId: string, options?: {
-        limit?: number;
-        parentSessionId?: string | null;
-        cursor?: string;
-        search?: string;
-        /** Return only the complete personal pinned projection. */
-        pinsOnly?: boolean;
-        /** Return archived root chats instead of the active session list. */
-        archivedOnly?: boolean;
-        /** Stop this caller's finite page read when its owning route is abandoned. */
-        signal?: AbortSignal | undefined;
-    }): Promise<SessionListResponse>;
+    listSessionPage(workspaceId: string, options?: SessionListPageOptions): Promise<SessionListResponse>;
+    /** Compact rail records; safely projects full pages from older APIs. */
+    listSessionSummaryPage(workspaceId: string, options?: SessionListPageOptions): Promise<SessionListEntryResponse>;
+    private requestSessionPage;
     /** Compact, bounded workspace agent hierarchy page. */
     listAgentTopology(workspaceId: string, options?: {
         limit?: number;
@@ -203,6 +386,11 @@ export declare class OpenGeniClient {
     updateSessionAttention(workspaceId: string, sessionId: string, request: UpdateSessionAttentionRequest): Promise<Session>;
     /** Archive or restore this authenticated member's root chat. */
     updateSessionArchive(workspaceId: string, sessionId: string, request: UpdateSessionArchiveRequest): Promise<Session>;
+    /**
+     * Keep a session out of the idle-session archive (or allow archiving again).
+     * Fails with 409 SESSION_ARCHIVED_READ_ONLY once the session is archived.
+     */
+    updateSessionRetention(workspaceId: string, sessionId: string, request: UpdateSessionRetentionRequest): Promise<Session>;
     /** Permanently delete one quiescent root session and its full descendant tree. */
     deleteSession(workspaceId: string, sessionId: string): Promise<{
         deletedSessionCount: number;
@@ -258,6 +446,19 @@ export declare class OpenGeniClient {
      * install the exact signed version promoted for its channel. Progress is read
      * from `listMachines`; completion requires the successor build identity. */
     updateMachineAgent(workspaceId: string, enrollmentId: string): Promise<UpdateMachineAgentResponse>;
+    /** Turn screen control on for one connected machine, in place: the consent is
+     * recorded and the live agent refreshes its own credentials. Safe to repeat. */
+    enableMachineScreenControl(workspaceId: string, enrollmentId: string): Promise<EnableMachineScreenControlResponse>;
+    /** Open one macOS Privacy & Security pane on a connected Mac, so the person
+     * only has to flip the permission for Opengeni. */
+    openMachinePrivacySettings(workspaceId: string, enrollmentId: string, input: OpenMachinePrivacySettingsRequest): Promise<OpenMachinePrivacySettingsResponse>;
+    /** List what changing who can use a Connected Machine (Workspace or Only me)
+     * would affect, with the given chat choices applied. Reads only. */
+    previewMachineAudience(workspaceId: string, enrollmentId: string, input: MachineAudiencePreviewRequest): Promise<MachineAudiencePreview>;
+    /** Change who can use a Connected Machine in place, at the previewed
+     * generation. The machine keeps its sandbox ID, credentials and connection.
+     * A 409 means something changed or still needs a decision: preview again. */
+    changeMachineAudience(workspaceId: string, enrollmentId: string, input: ChangeMachineAudienceRequest): Promise<ChangeMachineAudienceResponse>;
     /** Revision-fenced update of a Connected Machine's optional command memory
      * policy. Null byte limits preserve unrestricted machine access. */
     updateMachineOperationPolicy(workspaceId: string, enrollmentId: string, request: UpdateMachineOperationPolicyRequest): Promise<MachineOperationPolicy>;
@@ -271,9 +472,10 @@ export declare class OpenGeniClient {
     /**
      * Remove one connected self-hosted machine enrollment. The control-plane
      * operation works while the agent is offline, revokes future reconnects,
-     * retains history, and atomically detaches idle dependent sessions (a
-     * machine-home session becomes `backend:none`). Active turns, live leases,
-     * and recovery work remain typed blockers. `idempotencyKey` is replay-safe.
+     * retains history, and atomically detaches the sessions that point at it,
+     * including ones with a queued, paused or recovering turn (a machine-home
+     * session becomes `backend:none`). Only a live machine lease or pending lease
+     * recovery remains a typed blocker. `idempotencyKey` is replay-safe.
      */
     removeEnrollment(workspaceId: string, enrollmentId: string, request?: RemoveEnrollmentRequest): Promise<RemoveEnrollmentResponse>;
     /**
@@ -300,11 +502,14 @@ export declare class OpenGeniClient {
      * Mint a short-TTL headless enroll token (the `oget_` token) for the fleet /
      * non-interactive enroll path. The returned `token` is SECRET — surface it once
      * with a copy-now warning; it cannot be re-read. `allowScreenControl` bakes the
-     * screen-control consent into the token.
+     * screen-control consent into the token. `scope: "user"` connects the signed-in
+     * person's own machine; `"workspace"` (or omitted) shares it with the workspace.
+     * Check the response's `scope` before showing a command: an older server ignores
+     * the request and mints a workspace-shared token.
      */
     mintEnrollToken(workspaceId: string, request?: {
         allowScreenControl?: boolean;
-    }): Promise<MintEnrollTokenResponse>;
+    } | MintEnrollTokenRequest): Promise<MintEnrollTokenResponse>;
     /**
      * Swap a session's active sandbox (the user-authenticated equivalent of the
      * M7 `sandbox_swap` MCP tool). `target` is a `MachineView.sandboxId` from
@@ -316,8 +521,15 @@ export declare class OpenGeniClient {
     swapActiveSandbox(workspaceId: string, sessionId: string, request: SwapActiveSandboxRequest): Promise<SwapActiveSandboxResponse>;
     listScheduledTasks(workspaceId: string, options?: {
         limit?: number;
+        offset?: number;
+        sessionId?: string;
     }): Promise<ScheduledTask[]>;
     getScheduledTask(workspaceId: string, taskId: string): Promise<ScheduledTask>;
+    /**
+     * Channels a person may choose as a scheduled task's fixed Slack destination:
+     * active, non-shared channels the selected Opengeni bot already belongs to.
+     */
+    listScheduledTaskSlackChannels(workspaceId: string, connectionId: string, cursor?: string): Promise<SlackReactionChannelListResponse>;
     /**
      * Return the events from one bounded page. With no cursor, this uses the safe
      * semantic monitoring tail; pass explicit forensic options and a cursor for
@@ -377,6 +589,12 @@ export declare class OpenGeniClient {
     getComposerDraft(workspaceId: string, sessionId: string, options?: OpenGeniRequestOptions): Promise<ComposerDraft>;
     saveComposerDraft(workspaceId: string, sessionId: string, request: SaveComposerDraftRequest): Promise<ComposerDraft>;
     submitComposerDraft(workspaceId: string, sessionId: string, request: SubmitComposerDraftRequest): Promise<SubmitComposerDraftResponse>;
+    /** Inspect bounded checkpoint recovery eligibility without changing session state. */
+    getSandboxRecovery(workspaceId: string, sessionId: string): Promise<SandboxRecoveryProjection>;
+    /** Restore only the explicitly selected checkpoint; never retry a command. */
+    recoverSandbox(workspaceId: string, sessionId: string, request: SandboxRecoveryRequest): Promise<SandboxRecoveryResponse>;
+    /** Retry the exact failed turn. Keep clientEventId unchanged on transport retries. */
+    retrySession(workspaceId: string, sessionId: string, request: SessionRetryRequest): Promise<SessionRetryResponse>;
     controlSession(workspaceId: string, sessionId: string, request: {
         action: "pause" | "resume" | "cancel";
         reason?: string;
@@ -398,6 +616,9 @@ export declare class OpenGeniClient {
         clientEventId?: string;
         expectedControlEtag?: string;
     }): Promise<SessionControlResponse>;
+    setWorkspacePauseTimer(workspaceId: string, request: import("./types.js").WorkspacePauseTimerRequest): Promise<{
+        ok: boolean;
+    }>;
     setWorkspaceInferenceState(workspaceId: string, request: {
         action: "pause" | "resume";
         reason?: string;
@@ -437,6 +658,14 @@ export declare class OpenGeniClient {
     steerMessage(workspaceId: string, sessionId: string, message: string | SendMessageInput): Promise<SteerMessageResult>;
     /** The session's goal. 404s when the session never had one. */
     getGoal(workspaceId: string, sessionId: string, options?: SharedSessionReadOptions): Promise<SessionGoal>;
+    /**
+     * The session's goal, or `null` when the session has none. Unlike
+     * {@link getGoal}, a goal-less session is a successful read (`?absent=null`
+     * answers 200 `null`), so browsers log no failed request. Servers that
+     * predate the opt-in ignore it and still answer 404; a missing session is
+     * always a 404.
+     */
+    findGoal(workspaceId: string, sessionId: string, options?: SharedSessionReadOptions): Promise<SessionGoal | null>;
     updateGoal(workspaceId: string, sessionId: string, request: UpdateSessionGoalRequest): Promise<SessionGoal>;
     listGoalRevisions(workspaceId: string, sessionId: string): Promise<SessionGoalRevision[]>;
     listGoalRevisionPage(workspaceId: string, sessionId: string, options?: ListSessionGoalRevisionsOptions): Promise<ListSessionGoalRevisionsResponse>;
@@ -548,7 +777,6 @@ export declare class OpenGeniClient {
     getAuthRun(workspaceId: string, authRunId: string, options?: OpenGeniRequestOptions): Promise<AuthRun>;
     startBrowserAuthRun(workspaceId: string, browserSessionId: string, request: StartAuthRunRequest, options?: OpenGeniRequestOptions): Promise<AuthRunMutationResponse>;
     reportBrowserAuthRun(workspaceId: string, browserSessionId: string, authRunId: string, request: ReportAuthRunRequest, options?: OpenGeniRequestOptions): Promise<AuthRunMutationResponse>;
-    protectedBrowserAuthFill(workspaceId: string, browserSessionId: string, authRunId: string, request: ProtectedAuthFillRequest, options?: OpenGeniRequestOptions): Promise<ProtectedAuthFillResponse>;
     advanceExternalBrowserAuthRun(workspaceId: string, browserSessionId: string, authRunId: string, request: ExternalAuthRunRequest, options?: OpenGeniRequestOptions): Promise<ExternalAuthRunResponse>;
     openExternalBrowserAuthFlow(workspaceId: string, browserSessionId: string, authRunId: string, request: ExternalAuthInteractiveRequest, options?: OpenGeniRequestOptions): Promise<ExternalAuthInteractiveResponse>;
     verifyBrowserAuthRun(workspaceId: string, browserSessionId: string, authRunId: string, request: VerifyAuthRunRequest, options?: OpenGeniRequestOptions): Promise<AuthRunMutationResponse>;
@@ -565,7 +793,7 @@ export declare class OpenGeniClient {
     listBrowserRevisions(workspaceId: string, identityId: string, options?: OpenGeniRequestOptions): Promise<BrowserRevisionListResponse>;
     /** Workspace-wide BrowserSession inventory. Associations express relevance,
      *  not access: peers and child agents intentionally remain discoverable. */
-    listBrowserSessions(workspaceId: string, options?: OpenGeniRequestOptions): Promise<BrowserSessionListResponse>;
+    listBrowserSessions(workspaceId: string, options?: OpenGeniRequestOptions | InteractionSessionListOptions): Promise<BrowserSessionListResponse>;
     getBrowserSession(workspaceId: string, browserSessionId: string, options?: OpenGeniRequestOptions): Promise<BrowserSession>;
     readBrowserClipboard(workspaceId: string, browserSessionId: string, options?: OpenGeniRequestOptions): Promise<BrowserClipboard>;
     listBrowserDownloads(workspaceId: string, browserSessionId: string, options?: OpenGeniRequestOptions): Promise<BrowserDownloadListResponse>;
@@ -574,9 +802,14 @@ export declare class OpenGeniClient {
     createBrowserSession(workspaceId: string, request: CreateBrowserSessionRequest, options?: OpenGeniRequestOptions): Promise<BrowserSessionMutationResponse>;
     listBrowserTargets(workspaceId: string, browserSessionId: string, options?: OpenGeniRequestOptions): Promise<BrowserTargetListResponse>;
     openBrowserTarget(workspaceId: string, browserSessionId: string, request?: BrowserOpenTargetRequest, options?: OpenGeniRequestOptions): Promise<BrowserObservation>;
+    /** Opens a tab and returns inventory without collecting page content. */
+    openBrowserTargetWithInventory(workspaceId: string, browserSessionId: string, request?: BrowserOpenTargetRequest, options?: OpenGeniRequestOptions): Promise<BrowserTargetListResponse>;
     selectBrowserTarget(workspaceId: string, browserSessionId: string, targetId: string, options?: OpenGeniRequestOptions): Promise<BrowserObservation>;
+    captureBrowserTarget(workspaceId: string, browserSessionId: string, targetId: string, options?: OpenGeniRequestOptions, captureOptions?: BrowserScreenshotOptions): Promise<BrowserFrame>;
     closeBrowserTarget(workspaceId: string, browserSessionId: string, targetId: string, options?: OpenGeniRequestOptions): Promise<BrowserTargetListResponse>;
     observeBrowserTarget(workspaceId: string, browserSessionId: string, targetId: string, options?: OpenGeniRequestOptions): Promise<BrowserObservation>;
+    getBrowserTargetState(workspaceId: string, browserSessionId: string, targetId: string, options?: OpenGeniRequestOptions): Promise<BrowserTargetState>;
+    readBrowserDom(workspaceId: string, browserSessionId: string, targetId: string, request: BrowserDomReadRequest, options?: OpenGeniRequestOptions): Promise<BrowserDomReadResponse>;
     actInBrowser(workspaceId: string, browserSessionId: string, request: BrowserActionRequest, options?: OpenGeniRequestOptions): Promise<BrowserActionReceipt>;
     getBrowserActionReceipt(workspaceId: string, browserSessionId: string, operationId: string, options?: OpenGeniRequestOptions): Promise<BrowserActionReceipt>;
     listBrowserDiagnostics(workspaceId: string, browserSessionId: string, targetId: string, options?: BrowserDiagnosticsOptions): Promise<BrowserDiagnosticBatch>;
@@ -586,16 +819,33 @@ export declare class OpenGeniClient {
     suspendBrowserSession(workspaceId: string, browserSessionId: string, request: BrowserSessionLifecycleRequest, options?: OpenGeniRequestOptions): Promise<BrowserSessionMutationResponse>;
     resumeBrowserSession(workspaceId: string, browserSessionId: string, request: BrowserSessionLifecycleRequest, options?: OpenGeniRequestOptions): Promise<BrowserSessionMutationResponse>;
     endBrowserSession(workspaceId: string, browserSessionId: string, request: BrowserSessionLifecycleRequest, options?: OpenGeniRequestOptions): Promise<BrowserSessionMutationResponse>;
+    /** Inspect an active browser's preserved working copy after its controller
+     * lost it, for example when its machine's disk was restored from a copy.
+     * Read-only; returns the exact manifest digest an adoption must name. */
+    inspectBrowserSessionWorkingCopy(workspaceId: string, browserSessionId: string, options?: OpenGeniRequestOptions): Promise<BrowserWorkingCopyInspection>;
+    /** Adopt the exact inspected bytes of a preserved working copy as the
+     * browser's state. If the reply is lost, read the recorded outcome of the
+     * same operationId instead of sending again. */
+    adoptBrowserSessionWorkingCopy(workspaceId: string, browserSessionId: string, request: BrowserWorkingCopyAdoptionRequest, options?: OpenGeniRequestOptions): Promise<BrowserWorkingCopyAdoptionResponse>;
+    getBrowserSessionWorkingCopyAdoption(workspaceId: string, browserSessionId: string, operationId: string, options?: OpenGeniRequestOptions): Promise<BrowserWorkingCopyAdoptionResponse>;
+    /** Revert an unfinished adoption: the browser's own directory goes back in
+     * place and the staged copy is kept, never used. The supported way out of
+     * a collision or of an adoption nobody wants finished. Retrying the same
+     * revert finishes one that stopped part way. */
+    revertBrowserSessionWorkingCopyAdoption(workspaceId: string, browserSessionId: string, operationId: string, options?: OpenGeniRequestOptions): Promise<BrowserWorkingCopyAdoptionResponse>;
     /** Workspace-wide ComputerSession inventory. Associations express
      * relevance, not access; peer sessions intentionally remain discoverable. */
-    listComputerSessions(workspaceId: string, options?: OpenGeniRequestOptions): Promise<ComputerSessionListResponse>;
+    listComputerSessions(workspaceId: string, options?: OpenGeniRequestOptions | InteractionSessionListOptions): Promise<ComputerSessionListResponse>;
     getComputerSession(workspaceId: string, computerSessionId: string, options?: OpenGeniRequestOptions): Promise<ComputerSession>;
     readComputerClipboard(workspaceId: string, computerSessionId: string, options?: OpenGeniRequestOptions): Promise<ComputerClipboard>;
+    getComputerInputPosture(workspaceId: string, computerSessionId: string, options?: OpenGeniRequestOptions): Promise<ComputerSessionInputPosture>;
     createComputerSession(workspaceId: string, request: CreateComputerSessionRequest, options?: OpenGeniRequestOptions): Promise<ComputerSessionMutationResponse>;
     listComputerTargets(workspaceId: string, computerSessionId: string, options?: OpenGeniRequestOptions): Promise<ComputerTargetListResponse>;
     observeComputerTarget(workspaceId: string, computerSessionId: string, targetId: string, options?: OpenGeniRequestOptions): Promise<ComputerObservation>;
     captureComputerTarget(workspaceId: string, computerSessionId: string, targetId: string, options?: OpenGeniRequestOptions): Promise<ComputerFrame>;
+    callNativeComputerTool(workspaceId: string, computerSessionId: string, request: ComputerNativeCallRequest, options?: OpenGeniRequestOptions): Promise<ComputerNativeReceipt>;
     actInComputer(workspaceId: string, computerSessionId: string, request: ComputerActionRequest, options?: OpenGeniRequestOptions): Promise<ComputerActionReceipt>;
+    getNativeComputerToolReceipt(workspaceId: string, computerSessionId: string, operationId: string, options?: OpenGeniRequestOptions): Promise<ComputerNativeReceipt>;
     getComputerActionReceipt(workspaceId: string, computerSessionId: string, operationId: string, options?: OpenGeniRequestOptions): Promise<ComputerActionReceipt>;
     attachComputerSession(workspaceId: string, computerSessionId: string, request: ComputerSessionAttachmentRequest, options?: OpenGeniRequestOptions): Promise<ComputerSessionAttachment>;
     heartbeatComputerSession(workspaceId: string, computerSessionId: string, options?: OpenGeniRequestOptions): Promise<ComputerSessionHeartbeatResponse>;
@@ -606,28 +856,173 @@ export declare class OpenGeniClient {
      * reasoning efforts, MCP servers, file-upload limits, and how the client is
      * expected to authenticate. Drives a composer's model picker without prior
      * knowledge of the host setup; safe to call before any auth is established.
+     * Authenticated calls resolve the caller's default workspace, or the exact
+     * `workspaceId` option, using the same selection rules as fresh session create.
      */
-    getClientConfig(options?: OpenGeniRequestOptions): Promise<ClientConfig>;
+    getClientConfig(options?: OpenGeniRequestOptions & {
+        workspaceId?: string;
+    }): Promise<ClientConfig>;
     /** Authenticated model definitions plus workspace-specific selectability. */
     getWorkspaceModelCatalog(workspaceId: string, options?: OpenGeniRequestOptions): Promise<WorkspaceModelCatalogResponse>;
+    /** List workspace-owned unpinned Vercel AI Gateway model slugs. */
+    listWorkspaceGatewayCustomModels(workspaceId: string): Promise<WorkspaceGatewayCustomModelsResponse>;
+    /** Add one exact upstream Vercel AI Gateway slug. */
+    createWorkspaceGatewayCustomModel(workspaceId: string, request: CreateWorkspaceGatewayCustomModelRequest): Promise<WorkspaceGatewayCustomModel>;
+    /** Remove one workspace custom Gateway model by its stable row id. */
+    deleteWorkspaceGatewayCustomModel(workspaceId: string, customModelId: string, request: DeleteWorkspaceGatewayCustomModelRequest): Promise<void>;
+    /** List workspace-owned unpinned OpenRouter model slugs. */
+    listWorkspaceOpenRouterCustomModels(workspaceId: string): Promise<WorkspaceOpenRouterCustomModelsResponse>;
+    /** Add one exact upstream OpenRouter slug. */
+    createWorkspaceOpenRouterCustomModel(workspaceId: string, request: CreateWorkspaceOpenRouterCustomModelRequest): Promise<WorkspaceOpenRouterCustomModel>;
+    /** Remove one workspace custom OpenRouter model by its stable row id. */
+    deleteWorkspaceOpenRouterCustomModel(workspaceId: string, customModelId: string, request: DeleteWorkspaceOpenRouterCustomModelRequest): Promise<void>;
+    /** List workspace-owned exact Opper model ids (pools or provider/model routes). */
+    listWorkspaceOpperCustomModels(workspaceId: string): Promise<WorkspaceOpperCustomModelsResponse>;
+    /** Add one exact upstream Opper model id. */
+    createWorkspaceOpperCustomModel(workspaceId: string, request: CreateWorkspaceOpperCustomModelRequest): Promise<WorkspaceOpperCustomModel>;
+    /** Remove one workspace custom Opper model by its stable row id. */
+    deleteWorkspaceOpperCustomModel(workspaceId: string, customModelId: string, request: DeleteWorkspaceOpperCustomModelRequest): Promise<void>;
+    /** Read metadata for one organization-owned model-provider connection. */
+    getWorkspaceClaudeSubscriptionUsage(workspaceId: string): Promise<ClaudeSubscriptionUsage>;
+    listClaudeSubscriptionAccounts(workspaceId: string): Promise<ClaudeSubscriptionAccountsResponse>;
+    activateClaudeSubscriptionAccount(workspaceId: string, accountId: string): Promise<{
+        activated: boolean;
+        accountId: string;
+    }>;
+    setClaudeSubscriptionRotationSettings(workspaceId: string, request: {
+        rotationEnabled: boolean;
+    }): Promise<SubscriptionPoolSettings>;
+    setClaudeSubscriptionAccountAllocator(workspaceId: string, accountId: string, request: {
+        enabled: boolean;
+        expectedVersion: number;
+    }): Promise<unknown>;
+    renameClaudeSubscriptionAccount(workspaceId: string, accountId: string, label: string | null): Promise<ClaudeSubscriptionAccount>;
+    disconnectClaudeSubscriptionAccount(workspaceId: string, accountId: string): Promise<unknown>;
+    getClaudeSubscriptionAccountUsage(workspaceId: string, accountId: string): Promise<ClaudeSubscriptionUsage>;
+    refreshClaudeSubscriptionAccountUsage(workspaceId: string, accountId: string): Promise<ClaudeSubscriptionUsage>;
+    listOrganizationClaudeSubscriptionAccounts(organizationId: string): Promise<ClaudeSubscriptionAccountsResponse>;
+    activateOrganizationClaudeSubscriptionAccount(organizationId: string, accountId: string): Promise<{
+        updated: boolean;
+    }>;
+    setOrganizationClaudeSubscriptionRotationSettings(organizationId: string, request: {
+        rotationEnabled: boolean;
+    }): Promise<SubscriptionPoolSettings>;
+    setOrganizationClaudeSubscriptionAccountAllocator(organizationId: string, accountId: string, request: {
+        enabled: boolean;
+        expectedVersion: number;
+    }): Promise<unknown>;
+    renameOrganizationClaudeSubscriptionAccount(organizationId: string, accountId: string, label: string | null): Promise<{
+        updated: boolean;
+    }>;
+    disconnectOrganizationClaudeSubscriptionAccount(organizationId: string, accountId: string): Promise<unknown>;
+    getOrganizationClaudeSubscriptionAccountUsage(organizationId: string, accountId: string): Promise<ClaudeSubscriptionUsage>;
+    refreshOrganizationClaudeSubscriptionAccountUsage(organizationId: string, accountId: string): Promise<ClaudeSubscriptionUsage>;
+    connectClaudeSubscriptionSetupToken(workspaceId: string, request: Omit<ClaudeSubscriptionSetupTokenRequest, "scope"> & {
+        scope?: "workspace" | "user";
+    }): Promise<ClaudeSubscriptionOAuthCompleteResponse>;
+    connectOrganizationClaudeSubscriptionSetupToken(organizationId: string, request: Omit<ClaudeSubscriptionSetupTokenRequest, "scope">): Promise<ClaudeSubscriptionOAuthCompleteResponse>;
+    /** Sign in with model and profile access; no inference request is made. */
+    startWorkspaceClaudeSubscriptionOAuth(workspaceId: string, request?: Partial<ClaudeSubscriptionOAuthStartRequest>): Promise<ClaudeSubscriptionOAuthStartResponse>;
+    completeWorkspaceClaudeSubscriptionOAuth(workspaceId: string, request: ClaudeSubscriptionOAuthCompleteRequest): Promise<ClaudeSubscriptionOAuthCompleteResponse>;
+    startOrganizationClaudeSubscriptionOAuth(organizationId: string, request?: Pick<ClaudeSubscriptionOAuthStartRequest, "reconnectAccountId">): Promise<ClaudeSubscriptionOAuthStartResponse>;
+    completeOrganizationClaudeSubscriptionOAuth(organizationId: string, request: ClaudeSubscriptionOAuthCompleteRequest): Promise<ClaudeSubscriptionOAuthCompleteResponse>;
+    refreshWorkspaceClaudeSubscriptionUsage(workspaceId: string): Promise<ClaudeSubscriptionUsage>;
+    getOrganizationClaudeSubscriptionUsage(organizationId: string): Promise<ClaudeSubscriptionUsage>;
+    refreshOrganizationClaudeSubscriptionUsage(organizationId: string): Promise<ClaudeSubscriptionUsage>;
+    /** Read metadata for one organization-owned model-provider connection. */
+    getOrganizationModelProviderConnection(organizationId: string, providerKind: OrganizationModelProviderKind): Promise<OrganizationModelProviderConnection | null>;
+    /** Connect or rotate one organization-owned provider credential. */
+    upsertOrganizationModelProviderConnection(organizationId: string, providerKind: OrganizationModelProviderKind, request: UpsertOrganizationModelProviderConnectionRequest): Promise<OrganizationModelProviderConnection>;
+    /** Revoke one organization-owned provider credential. */
+    revokeOrganizationModelProviderConnection(organizationId: string, providerKind: OrganizationModelProviderKind, request: RevokeOrganizationModelProviderConnectionRequest): Promise<OrganizationModelProviderConnection>;
+    /** List workspace-owned Claude model slugs. */
+    listWorkspaceClaudeCustomModels(workspaceId: string, providerKind: "anthropic" | "claude_subscription"): Promise<WorkspaceGatewayCustomModelsResponse>;
+    /** Add an immutable workspace-owned Claude model generation. */
+    createWorkspaceClaudeCustomModel(workspaceId: string, providerKind: "anthropic" | "claude_subscription", request: CreateWorkspaceGatewayCustomModelRequest): Promise<WorkspaceGatewayCustomModel>;
+    /** Retire a workspace-owned Claude model generation. */
+    deleteWorkspaceClaudeCustomModel(workspaceId: string, providerKind: "anthropic" | "claude_subscription", customModelId: string, request: DeleteWorkspaceGatewayCustomModelRequest): Promise<void>;
+    /** List organization-owned exact upstream model slugs. */
+    listOrganizationProviderCustomModels(organizationId: string, providerKind: OrganizationModelProviderKind): Promise<OrganizationProviderCustomModelsResponse>;
+    /** Add one organization-owned exact upstream model slug. */
+    createOrganizationProviderCustomModel(organizationId: string, providerKind: OrganizationModelProviderKind, request: CreateOrganizationProviderCustomModelRequest): Promise<OrganizationProviderCustomModel>;
+    /** Retire one organization-owned custom model. */
+    deleteOrganizationProviderCustomModel(organizationId: string, providerKind: OrganizationModelProviderKind, customModelId: string, request: DeleteOrganizationProviderCustomModelRequest): Promise<OrganizationProviderCustomModel>;
     /** Read the workspace's hard provider/model allowlist. */
     getWorkspaceModelAccessPolicy(workspaceId: string): Promise<WorkspaceModelAccessPolicy>;
+    /** Remove the workspace's own allowlist so it follows its organization's default. */
+    deleteWorkspaceModelAccessPolicy(workspaceId: string): Promise<WorkspaceModelAccessPolicy>;
+    /** The model defaults every workspace in the organization follows (owners and admins). */
+    getOrganizationModelDefaults(organizationId: string): Promise<OrganizationModelDefaults>;
+    /** Change organization model defaults, field by field (owners and admins). */
+    updateOrganizationModelDefaults(organizationId: string, request: UpdateOrganizationModelDefaultsRequest): Promise<OrganizationModelDefaults>;
+    /** Organization model-account settings and locks (owners and admins). */
+    getOrganizationModelAccountSettings(organizationId: string): Promise<OrganizationModelAccountSettings>;
+    /** Change organization model-account settings or locks (owners and admins). */
+    updateOrganizationModelAccountSettings(organizationId: string, request: UpdateOrganizationModelAccountSettingsRequest): Promise<OrganizationModelAccountSettings>;
+    /** Every shared workspace's effective model-account settings and their sources (owners and admins). */
+    getModelAccountSettingsOverview(organizationId: string, options?: {
+        after?: string;
+        limit?: number;
+    }): Promise<ModelAccountSettingsOverview>;
+    /** A workspace's effective model-account settings, sources and overrides. */
+    getWorkspaceModelAccountSettings(workspaceId: string): Promise<WorkspaceModelAccountSettings>;
+    /** Override, or follow again, the organization's unlocked settings (workspace admins). */
+    updateWorkspaceModelAccountSettings(workspaceId: string, request: UpdateWorkspaceModelAccountSettingsRequest): Promise<WorkspaceModelAccountSettings>;
+    /** The session's model account, the accounts it may switch to, and the personal settings. */
+    getSessionModelAccount(workspaceId: string, sessionId: string): Promise<SessionModelAccountChoiceResponse>;
+    /** Choose the session's model account, or `connectionId: null` for automatic selection. */
+    setSessionModelAccount(workspaceId: string, sessionId: string, request: SetSessionModelAccountChoiceRequest): Promise<SetSessionModelAccountChoiceResponse>;
+    /**
+     * Your own model-account preferences in an organization. For a person (a
+     * signed-in browser, or an agent acting as one); other callers get 404.
+     */
+    getModelAccountPreferences(organizationId: string): Promise<ModelAccountPreferences>;
+    /**
+     * Change your own personal-fallback opt-in in an organization. Only a person
+     * can: a same-origin browser, or an agent acting as one with full access.
+     */
+    updateModelAccountPreferences(organizationId: string, request: UpdateModelAccountPreferencesRequest): Promise<ModelAccountPreferences>;
+    /** Whether owners and admins may give agent sessions admin access (owners and admins). */
+    getOrganizationAgentAdminAccess(organizationId: string): Promise<OrganizationAgentAdminAccess>;
+    /**
+     * Allow or stop admin access for agent sessions. Turning it off ends every
+     * session's admin access. An owner or admin, in the app.
+     */
+    updateOrganizationAgentAdminAccess(organizationId: string, request: UpdateOrganizationAgentAdminAccessRequest): Promise<OrganizationAgentAdminAccess>;
+    /**
+     * The organization's privacy choices: who sees new chats and schedules by
+     * default, and whether admins see that other people's Only me schedules
+     * exist. `limits` reports what this deployment fixes. An owner or admin.
+     */
+    getOrganizationPrivacySettings(organizationId: string): Promise<OrganizationPrivacySettings>;
+    /** Change the organization's privacy choices, within the deployment's limits. */
+    updateOrganizationPrivacySettings(organizationId: string, request: UpdateOrganizationPrivacySettingsRequest): Promise<OrganizationPrivacySettings>;
     /** Fully replace the workspace's hard provider/model allowlist. */
     updateWorkspaceModelAccessPolicy(workspaceId: string, request: UpdateWorkspaceModelAccessPolicyRequest): Promise<WorkspaceModelAccessPolicy>;
     /** Authenticated realtime voice models and credential readiness. */
     getWorkspaceRealtimeModelCatalog(workspaceId: string, options?: OpenGeniRequestOptions): Promise<WorkspaceRealtimeModelCatalogResponse>;
-    /** The caller's access context: subject, account + workspace grants, defaults. */
+    /**
+     * The caller's subject, grants, defaults, and optional direct API-key authority.
+     * `credential.effectiveWorkspacePermissions` expands workspace admin only for
+     * legacy keys; explicit policies retain exactly their selected grants. Full
+     * organization keys can provision shared workspaces, external members, and
+     * `asUser` sessions; user requests additionally need live membership.
+     * Organization-key scope excludes Personal workspaces. Neither key kind bypasses
+     * session visibility or the explicit `secrets:read` permission requirement. Credential
+     * metadata is omitted for `asUser`/external actors, humans, delegated tokens,
+     * other caller contexts, and older servers.
+     */
     getAccessContext(): Promise<AccessContext>;
     /** Active organization memberships proven by the current managed-human session. */
     listOrganizationMemberships(): Promise<ListManagedOrganizationMembershipsResponse>;
     /** Bounded owner-only personal-resource authority page for one exact resource kind. */
     listUserResourceAuthorities(workspaceId: string, options: ListUserResourceAuthoritiesOptions): Promise<ListUserResourceAuthoritiesResponse>;
-    /** Issue an exact-session or standing personal-resource grant. */
-    issueUserResourceGrant(workspaceId: string, authorityId: string, request: IssueUserResourceGrantRequest): Promise<UserResourceGrantMutationResponse>;
     /** Revoke an owner grant through the exact workspace it targets. */
     revokeUserResourceGrant(workspaceId: string, grantId: string): Promise<RevokeUserResourceGrantResponse>;
     /** Create a new organization owned by the current managed human. */
     createOrganization(request: CreateOrganizationRequest): Promise<CreateOrganizationResponse>;
+    /** Create another organization owned by the current managed human. */
+    createAdditionalOrganization(request: CreateAdditionalOrganizationRequest): Promise<CreateAdditionalOrganizationResponse>;
     /** Pending and historical invitations addressed to the current managed human. */
     listOrganizationInvitations(options?: {
         cursor?: string;
@@ -646,11 +1041,17 @@ export declare class OpenGeniClient {
     listOrganizationMembers(organizationId: string): Promise<ListOrganizationAdministrationMembersResponse>;
     /** Canonical organization identity and every non-personal workspace access roster. */
     getOrganizationAdministrationOverview(organizationId: string): Promise<OrganizationAdministrationOverview>;
-    /** Create a shared workspace without implicitly granting the actor access. */
+    /** Create a shared workspace and grant its creator explicit workspace-admin access. */
     createOrganizationWorkspace(organizationId: string, request: CreateOrganizationWorkspaceRequest): Promise<OrganizationWorkspaceAccess>;
     /** Rename one shared workspace under an exact optimistic-concurrency fence. */
     updateOrganizationWorkspace(organizationId: string, workspaceId: string, request: UpdateOrganizationWorkspaceRequest): Promise<OrganizationWorkspaceAccess>;
     updateOrganizationWorkspaceSettings(organizationId: string, workspaceId: string, request: UpdateWorkspaceSettingsRequest): Promise<Workspace>;
+    /**
+     * Delete an organization (shared) workspace. Accepts an organization owner
+     * session or an organization API key with `workspace:admin` (for tenant
+     * offboarding); never deletes a Personal workspace. 409 until quiescent.
+     */
+    deleteOrganizationWorkspace(organizationId: string, workspaceId: string): Promise<void>;
     putOrganizationWorkspaceMember(organizationId: string, workspaceId: string, membershipId: string, request: PutOrganizationWorkspaceMemberRequest): Promise<OrganizationWorkspaceAccessMember>;
     revokeOrganizationWorkspaceMember(organizationId: string, workspaceId: string, membershipId: string, request: RevokeOrganizationWorkspaceMemberRequest): Promise<RevokeOrganizationWorkspaceMemberResponse>;
     /** Rename the organization under an exact optimistic-concurrency fence. */
@@ -666,7 +1067,37 @@ export declare class OpenGeniClient {
     approveOrganizationRecoveryOperation(organizationId: string, recoveryOperationId: string, request: OrganizationRecoveryOperationCommandRequest): Promise<OrganizationRecoveryMutationResponse>;
     cancelOrganizationRecoveryOperation(organizationId: string, recoveryOperationId: string, request: OrganizationRecoveryOperationCommandRequest): Promise<OrganizationRecoveryMutationResponse>;
     executeOrganizationRecoveryOperation(organizationId: string, recoveryOperationId: string, request: OrganizationRecoveryOperationCommandRequest): Promise<OrganizationRecoveryMutationResponse>;
+    searchPublicSkills(workspaceId: string, query: string): Promise<{
+        provider: "skills_sh";
+        query: string;
+        items: Array<{
+            id: string;
+            name: string;
+            source: string;
+            skillId: string;
+            url: string;
+            installs: number;
+        }>;
+        nextCursor: null;
+    }>;
     listWorkspaces(): Promise<Workspace[]>;
+    /** Uses this client's fixed actor and standard contract/error/abort handling.
+     * Disconnect revokes Opengeni connection access, not upstream provider consent. */
+    connectTransport(): import("@opengeni/connect").ConnectTransport;
+    /** Browse first-party Atlassian sources without choosing or starting sync. */
+    browseAtlassianSources(workspaceId: string, connectionId: string): Promise<import("@opengeni/contracts/atlassian").AtlassianBrowseResponse>;
+    saveAtlassianSources(workspaceId: string, connectionId: string, request: import("@opengeni/contracts/atlassian").SaveAtlassianSourcesRequest): Promise<import("./types.js").ConnectionResponse>;
+    setAtlassianLifecycle(workspaceId: string, connectionId: string, request: import("@opengeni/contracts/atlassian").AtlassianLifecycleActionRequest): Promise<import("./types.js").ConnectionResponse>;
+    /** Begin durable setup. Completion requirements are provider-specific. */
+    beginConnect(workspaceId: string, request: {
+        providerId: string;
+        ownership: "personal" | "workspace";
+        returnUrl: string;
+        idempotencyKey: string;
+        reconnectAccountId?: string;
+        installationTarget?: import("@opengeni/contracts/connect").ConnectInstallationTarget;
+    }): Promise<import("@opengeni/contracts/connect").ConnectAttempt>;
+    beginConnect(workspaceId: string, request: import("@opengeni/contracts/connect").BeginConnectRequest): Promise<import("@opengeni/contracts/connect").ConnectAttempt>;
     createWorkspace(request: CreateWorkspaceRequest): Promise<Workspace>;
     /**
      * Create an organization workspace once for a stable external tenant
@@ -678,23 +1109,16 @@ export declare class OpenGeniClient {
     getWorkspaceState(workspaceId: string, options?: WorkspaceStateGetOptions): Promise<WorkspaceStateResponse>;
     /** Download the canonical, explicitly sanitized Workspace State export. */
     exportWorkspaceState(workspaceId: string, options?: WorkspaceStateGetOptions): Promise<WorkspaceStateExportResponse>;
-    /** Permission-filtered Company Brain package with authorized guidance bodies. */
-    getCompanyBrain(workspaceId: string): Promise<CompanyBrainOkfPackage>;
-    /** Download the deterministic Markdown/YAML Company Brain package. */
-    exportCompanyBrainOkf(workspaceId: string): Promise<CompanyBrainOkfDownload>;
     updateWorkspace(workspaceId: string, request: UpdateWorkspaceRequest): Promise<Workspace>;
     /** Inspect immutable instruction-policy history, active heads, and activation audit evidence. */
     listWorkspaceInstructionPolicies(workspaceId: string, options?: WorkspaceInstructionPolicyListOptions): Promise<WorkspaceInstructionPolicyListResponse>;
     /** Inspect the bounded, permission-filtered governed-learning timeline. */
     getWorkspaceLearningHistory(workspaceId: string, options?: WorkspaceLearningHistoryOptions): Promise<WorkspaceLearningHistoryResponse>;
-    createWorkspaceLearningPolicyRevision(workspaceId: string, request: CreateWorkspaceLearningPolicyRevisionRequest): Promise<WorkspaceLearningPolicyRevision>;
-    activateWorkspaceLearningPolicyRevision(workspaceId: string, revisionId: string, request: ActivateWorkspaceLearningPolicyRevisionRequest): Promise<WorkspaceLearningPolicyMutationResponse>;
-    rollbackWorkspaceLearningPolicyRevision(workspaceId: string, request: RollbackWorkspaceLearningPolicyRevisionRequest): Promise<WorkspaceLearningPolicyMutationResponse>;
     undoGovernedLearningActivation(workspaceId: string, activationReceiptId: string, request?: {
         operationId?: string;
     }): Promise<GovernedLearningActivationUndoReceipt>;
     getWorkspaceInstructionPolicyRevision(workspaceId: string, revisionId: string): Promise<WorkspaceInstructionPolicyRevision>;
-    createWorkspaceInstructionPolicyDraft(workspaceId: string, request: CreateWorkspaceInstructionPolicyDraftRequest): Promise<WorkspaceInstructionPolicyRevision>;
+    createWorkspaceInstructionPolicyDraft(workspaceId: string, request: CreateWorkspaceInstructionPolicyDraftRequest, options?: OpenGeniRequestOptions): Promise<WorkspaceInstructionPolicyRevision>;
     /** List the newest immutable onboarding proposals and their inactive policy drafts. */
     listWorkspaceInstructionPolicyOnboardingProposals(workspaceId: string, options?: WorkspaceInstructionPolicyOnboardingProposalListOptions): Promise<WorkspaceInstructionPolicyOnboardingProposalListResponse>;
     /** Create one draft-only proposal against an exact active-policy baseline. */
@@ -702,7 +1126,7 @@ export declare class OpenGeniClient {
     /** Import the stored legacy workspace override as an inactive charter draft. */
     importLegacyWorkspaceInstructionPolicyDraft(workspaceId: string, request?: ImportLegacyWorkspaceInstructionPolicyDraftRequest): Promise<WorkspaceInstructionPolicyRevision>;
     diffWorkspaceInstructionPolicyRevisions(workspaceId: string, request: WorkspaceInstructionPolicyDiffRequest): Promise<WorkspaceInstructionPolicyDiffResponse>;
-    activateWorkspaceInstructionPolicyRevision(workspaceId: string, revisionId: string, request: ActivateWorkspaceInstructionPolicyRequest): Promise<WorkspaceInstructionPolicyActivationResponse>;
+    activateWorkspaceInstructionPolicyRevision(workspaceId: string, revisionId: string, request: ActivateWorkspaceInstructionPolicyRequest, options?: OpenGeniRequestOptions): Promise<WorkspaceInstructionPolicyActivationResponse>;
     rollbackWorkspaceInstructionPolicyRevision(workspaceId: string, request: RollbackWorkspaceInstructionPolicyRequest): Promise<WorkspaceInstructionPolicyActivationResponse>;
     /** Read the current organization profile plus immutable revision and activation history. */
     listCompanyProfile(workspaceId: string, options?: CompanyProfileListOptions): Promise<CompanyProfileListResponse>;
@@ -754,6 +1178,12 @@ export declare class OpenGeniClient {
     createScheduledTask(workspaceId: string, request: CreateScheduledTaskRequest): Promise<ScheduledTask>;
     updateScheduledTask(workspaceId: string, taskId: string, request: UpdateScheduledTaskRequest): Promise<ScheduledTask>;
     pauseScheduledTask(workspaceId: string, taskId: string): Promise<ScheduledTask>;
+    /** Admins: other people's Only me schedules, as summaries without names or prompts. */
+    listPrivateScheduledTaskSummaries(workspaceId: string): Promise<{
+        schedules: PrivateScheduledTaskSummary[];
+    }>;
+    /** Admins: pause someone else's Only me schedule. Only its owner can resume it. */
+    pausePrivateScheduledTask(workspaceId: string, taskId: string): Promise<PrivateScheduledTaskSummary>;
     resumeScheduledTask(workspaceId: string, taskId: string): Promise<ScheduledTask>;
     /**
      * Fire the task immediately (manual trigger), independent of its schedule.
@@ -767,17 +1197,16 @@ export declare class OpenGeniClient {
     listScheduledTaskRuns(workspaceId: string, taskId: string, options?: {
         limit?: number;
     }): Promise<ScheduledTaskRun[]>;
-    listVariableSets(workspaceId: string): Promise<VariableSet[]>;
-    /** Resolve only caller-supplied attachment ids without enumerating the catalog. */
-    resolveVariableSetAttachments(workspaceId: string, request: ResolveVariableSetAttachmentsRequest): Promise<ResolveVariableSetAttachmentsResponse>;
-    createVariableSet(workspaceId: string, request: CreateVariableSetRequest): Promise<VariableSet>;
-    getVariableSet(workspaceId: string, variableSetId: string): Promise<VariableSet>;
-    getVariableSetVariable(workspaceId: string, variableSetId: string, name: string): Promise<VariableSetSecret>;
-    updateVariableSet(workspaceId: string, variableSetId: string, request: UpdateVariableSetRequest): Promise<VariableSet>;
-    deleteVariableSet(workspaceId: string, variableSetId: string): Promise<void>;
-    /** Create or rotate a variable. Generic reads never return its value. */
-    setVariableSetVariable(workspaceId: string, variableSetId: string, name: string, value: string): Promise<VariableSetVariableMetadata>;
-    deleteVariableSetVariable(workspaceId: string, variableSetId: string, name: string): Promise<void>;
+    /**
+     * Re-freeze a task's connectors, connector accounts and Opengeni tool policy
+     * with the signed-in caller's current authority. Pass the `executionDigest`
+     * of the task whose `policyDrift` was reviewed; a changed task returns 409.
+     */
+    refreshScheduledTaskAccess(workspaceId: string, taskId: string, request: RefreshScheduledTaskAccessRequest): Promise<ScheduledTask>;
+    /** Schedules the caller can act on whose latest run could not use a connector. */
+    listScheduledTaskAccessAttention(workspaceId: string): Promise<ScheduledTaskAccessAttention[]>;
+    /** Vault, item, field-history, session-policy and 1Password routes for one workspace. */
+    vaults(workspaceId: string): VaultsApi;
     listChannels(workspaceId: string): Promise<Channel[]>;
     createChannel(workspaceId: string, request: CreateChannelRequest): Promise<Channel>;
     updateChannel(workspaceId: string, channelId: string, request: UpdateChannelRequest): Promise<Channel>;
@@ -818,20 +1247,6 @@ export declare class OpenGeniClient {
         ok: boolean;
         versionId: string;
     }>;
-    /** @deprecated use listVariableSets */
-    listEnvironments(workspaceId: string): Promise<VariableSet[]>;
-    /** @deprecated use createVariableSet */
-    createEnvironment(workspaceId: string, request: CreateVariableSetRequest): Promise<VariableSet>;
-    /** @deprecated use getVariableSet */
-    getEnvironment(workspaceId: string, environmentId: string): Promise<VariableSet>;
-    /** @deprecated use updateVariableSet */
-    updateEnvironment(workspaceId: string, environmentId: string, request: UpdateVariableSetRequest): Promise<VariableSet>;
-    /** @deprecated use deleteVariableSet */
-    deleteEnvironment(workspaceId: string, environmentId: string): Promise<void>;
-    /** @deprecated use setVariableSetVariable */
-    setEnvironmentVariable(workspaceId: string, environmentId: string, name: string, value: string): Promise<VariableSetVariableMetadata>;
-    /** @deprecated use deleteVariableSetVariable */
-    deleteEnvironmentVariable(workspaceId: string, environmentId: string, name: string): Promise<void>;
     /** Step 1 of the upload flow: returns the pre-signed PUT target. */
     beginFileUpload(workspaceId: string, request: CreateFileUploadRequest, options?: OpenGeniRequestOptions): Promise<CreateFileUploadResponse>;
     /** Step 3 of the upload flow: server verifies the object and marks it ready. */
@@ -842,7 +1257,10 @@ export declare class OpenGeniClient {
      * -> complete. Returns the ready `FileAsset`.
      */
     uploadFile(workspaceId: string, input: UploadFileInput): Promise<FileAsset>;
-    getFile(workspaceId: string, fileId: string, options?: OpenGeniRequestOptions): Promise<FileAsset>;
+    listFiles(workspaceId: string, options?: import("./types.js").FileListRequest): Promise<import("./types.js").FileListResponse>;
+    getFile(workspaceId: string, fileId: string, options?: OpenGeniRequestOptions & {
+        sessionId?: string | undefined;
+    }): Promise<FileAsset>;
     /** Read provider-neutral retained evidence metadata; never returns a storage location. */
     getRetainedArtifact(workspaceId: string, artifactId: string): Promise<RetainedArtifactMetadata>;
     /**
@@ -861,7 +1279,9 @@ export declare class OpenGeniClient {
     private downloadRetainedArtifactBytes;
     private getRetainedArtifactContentAtPath;
     /** Mint a short-lived signed download URL for a ready file. */
-    createFileDownloadUrl(workspaceId: string, fileId: string, options?: OpenGeniRequestOptions): Promise<FileDownloadUrlResponse>;
+    createFileDownloadUrl(workspaceId: string, fileId: string, options?: OpenGeniRequestOptions & {
+        sessionId?: string | undefined;
+    }): Promise<FileDownloadUrlResponse>;
     /** Read the effective workspace policy and executable Seedance capabilities. */
     getVideoGenerationSettings(workspaceId: string, options?: OpenGeniRequestOptions): Promise<WorkspaceVideoGenerationSettings>;
     /** Replace the enabled video models/default under optimistic policy revision control. */
@@ -871,21 +1291,12 @@ export declare class OpenGeniClient {
     /** Mint a short-lived zero-copy URL for native Range-based video playback. */
     createVideoArtifactPlaybackSource(workspaceId: string, artifactId: string, options?: OpenGeniRequestOptions): Promise<VideoArtifactPlaybackSource>;
     createDocumentBase(workspaceId: string, request: CreateDocumentBaseRequest): Promise<DocumentBase>;
-    listDocumentBases(workspaceId: string): Promise<DocumentBase[]>;
     getDocumentBase(workspaceId: string, baseId: string): Promise<DocumentBase>;
     /** Index an uploaded file into the base. The file must be `ready`. */
     addDocument(workspaceId: string, baseId: string, request: AddDocumentRequest): Promise<Document>;
     listDocuments(workspaceId: string, baseId: string): Promise<Document[]>;
-    /**
-     * List every Document the current human can manage from this workspace,
-     * including portable personal and organization-scoped Documents whose
-     * immutable ingestion workspace is different.
-     */
-    listAccessibleDocuments(workspaceId: string): Promise<Document[]>;
     /** Read the immutable source file through the Document's effective authority. */
     getDocumentOriginalFile(workspaceId: string, documentId: string): Promise<FileAsset>;
-    /** Mint a source-file URL through the Document's effective authority. */
-    createDocumentOriginalFileDownloadUrl(workspaceId: string, documentId: string): Promise<FileDownloadUrlResponse>;
     /**
      * Drop raw text or an already-uploaded file into the workspace's Default
      * base. When curation is enabled, it may name, summarize, categorize, and
@@ -898,51 +1309,330 @@ export declare class OpenGeniClient {
      * targetBaseId, applies the document's stored curation suggestion.
      */
     moveDocument(workspaceId: string, documentId: string, request?: MoveDocumentRequest): Promise<Document>;
-    /** Retry indexing for a failed document. */
-    reindexDocument(workspaceId: string, baseId: string, documentId: string): Promise<Document>;
     /**
      * Delete a document from a base. Removes the document row and its indexed
      * chunks while leaving the uploaded file asset available for other uses.
      */
     deleteDocument(workspaceId: string, baseId: string, documentId: string): Promise<void>;
-    searchDocuments(workspaceId: string, baseId: string, request: Omit<DocumentSearchRequest, "baseIds">): Promise<DocumentSearchResponse>;
-    searchKnowledge(workspaceId: string, request: DocumentSearchRequest): Promise<DocumentSearchResponse>;
-    listKnowledgeMemories(workspaceId: string, request?: KnowledgeMemorySearchRequest): Promise<KnowledgeMemory[]>;
-    getKnowledgeMemory(workspaceId: string, memoryId: string): Promise<KnowledgeMemory>;
-    createKnowledgeMemory(workspaceId: string, request: CreateKnowledgeMemoryRequest): Promise<KnowledgeMemory>;
-    updateKnowledgeMemory(workspaceId: string, memoryId: string, request: UpdateKnowledgeMemoryRequest): Promise<KnowledgeMemory>;
-    /** Hybrid (semantic + keyword) search over the workspace's agent-visible memory. */
-    searchWorkspaceMemories(workspaceId: string, request: WorkspaceMemorySearchRequest): Promise<WorkspaceMemorySearchResponse>;
+    /** Unified retained sources, findings and groups. Only published entries are returned by default. */
+    listKnowledgeEntries(workspaceId: string, request?: KnowledgeEntryListRequest): Promise<KnowledgeEntryListResponse>;
+    getKnowledgeEntry(workspaceId: string, entryId: string, options?: {
+        revisionId?: string;
+        view?: "published" | "needs_review" | "archived" | "rejected";
+    }): Promise<KnowledgeEntryRecord>;
+    /** Open the original file associated with an accessible retained source revision. */
+    createKnowledgeFileDownloadUrl(workspaceId: string, entryId: string, revisionId?: string): Promise<KnowledgeOriginalFileDownload>;
+    saveKnowledgeEntry(workspaceId: string, request: KnowledgeEntrySaveRequest): Promise<KnowledgeEntryWriteReceipt>;
+    reviewKnowledgeEntry(workspaceId: string, request: KnowledgeEntryReviewRequest): Promise<KnowledgeEntryWriteReceipt>;
+    listKnowledgeReviewBatches(workspaceId: string, options?: KnowledgeReviewBatchListRequest): Promise<KnowledgeReviewBatchListResponse>;
+    /** Atomically review up to 100 selected entries, including their pending dependencies. */
+    reviewKnowledgeEntries(workspaceId: string, request: KnowledgeEntryBatchReviewRequest): Promise<{
+        receipts: KnowledgeEntryWriteReceipt[];
+    }>;
+    listKnowledgeEntryHistory(workspaceId: string, entryId: string, beforeRevision?: number): Promise<{
+        entries: KnowledgeEntryListResponse["entries"];
+        beforeRevision: number | null;
+    }>;
+    restoreKnowledgeEntry(workspaceId: string, request: KnowledgeEntryRestoreRequest): Promise<KnowledgeEntryWriteReceipt>;
+    archiveKnowledgeEntry(workspaceId: string, entryId: string, request: {
+        operationId: string;
+        expectedVersion: number;
+    }): Promise<KnowledgeEntryWriteReceipt>;
+    getAgentLearningSettings(workspaceId: string, scope: "workspace" | "personal" | "context", source?: AgentLearningContext): Promise<AgentLearningSettingsRecord>;
+    saveAgentLearningSettings(workspaceId: string, request: SaveAgentLearningSettingsRequest): Promise<AgentLearningSettingsRecord>;
+    listAgentLearningOverrides(workspaceId: string, scope: "workspace" | "personal"): Promise<AgentLearningOverrideRecord[]>;
+    reviewAgentInstruction(workspaceId: string, request: AgentInstructionReviewRequest): Promise<AgentInstructionReceipt>;
+    listAgentInstructionReviews(workspaceId: string, cursor?: string): Promise<AgentInstructionReviewListResponse>;
     /** Deep-merge a settings patch into the workspace (preserves unknown keys). */
     updateWorkspaceSettings(workspaceId: string, request: UpdateWorkspaceSettingsRequest): Promise<Workspace>;
     setWorkspaceDefaultRig(workspaceId: string, request: SetWorkspaceDefaultRigRequest): Promise<Workspace>;
-    /** Built-in + registered packs, with the workspace's installations. */
-    listPacks(workspaceId: string): Promise<ListPacksResponse>;
-    /** Register (or replace) a workspace-scoped pack from a manifest. */
-    registerPack(workspaceId: string, manifest: RegisterCapabilityPackRequest): Promise<WorkspaceRegisteredPack>;
-    getPack(workspaceId: string, packId: string): Promise<GetPackResponse>;
-    enablePack(workspaceId: string, packId: string, request?: EnablePackRequest): Promise<PackInstallation>;
     /** Resolve pinned components, Variable Set, and Rig requirements before installation. */
-    previewPackInstallation(workspaceId: string, packId: string, request?: PreviewPackInstallationRequest): Promise<PackInstallationPreview>;
-    /** Install, update, or repair a Pack from an exact previewed manifest. */
-    installPack(workspaceId: string, packId: string, request: InstallPackRequest): Promise<PackInstallation>;
-    /** Preview which Pack-owned components will be retained by other owners. */
-    previewPackUninstall(workspaceId: string, packId: string): Promise<PackUninstallPreview>;
-    /** Safely release Pack ownership and disable only now-ownerless components. */
-    uninstallPack(workspaceId: string, packId: string, request: UninstallPackRequest): Promise<UninstallPackResult>;
-    /** Unregister a workspace-scoped pack (built-in packs cannot be deleted). */
-    deletePack(workspaceId: string, packId: string): Promise<void>;
-    listPackInstallations(workspaceId: string): Promise<PackInstallation[]>;
     listCapabilities(workspaceId: string): Promise<CapabilityCatalogResponse>;
     /** Add a manual capability catalog item (e.g. a remote MCP server). */
     createCapability(workspaceId: string, request: CreateCapabilityCatalogItemRequest): Promise<CapabilityCatalogItem>;
+    getConnectorToolPermissions(workspaceId: string, capabilityId: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<ConnectorToolPermissionsResponse>;
+    getConnectorToolPermissions(workspaceId: string, capabilityId: string, options?: {
+        signal?: AbortSignal;
+        connectionId?: string;
+        instanceKey?: string;
+    }): Promise<ConnectorToolPermissionsResponse>;
+    updateConnectorToolPermissions(workspaceId: string, capabilityId: string, request: UpdateConnectorToolPermissionsRequest, options?: {
+        signal?: AbortSignal;
+    }): Promise<{
+        saved: boolean;
+    }>;
+    /**
+     * Read the workspace's saved Allow/Ask/Block rules for a session MCP server
+     * this host attaches (same `id` and exact `url` as in `mcpServers`).
+     */
+    getSessionMcpToolPermissions(workspaceId: string, server: {
+        serverId: string;
+        url: string;
+    }, options?: {
+        signal?: AbortSignal;
+    }): Promise<SessionMcpToolPermissionsResponse>;
+    /**
+     * Set or reset Allow/Ask/Block for a session MCP server's default or named
+     * tools. Requires `capabilities:manage`; agents and service principals are
+     * refused. Rules apply from each session's next attempt.
+     */
+    updateSessionMcpToolPermissions(workspaceId: string, request: UpdateSessionMcpToolPermissionsRequest, options?: {
+        signal?: AbortSignal;
+    }): Promise<{
+        saved: boolean;
+    }>;
     enableCapability(workspaceId: string, capabilityId: string, request?: EnableCapabilityRequest): Promise<CapabilityInstallation>;
     disableCapability(workspaceId: string, capabilityId: string): Promise<CapabilityInstallation>;
+    /** Read-only, permission-filtered workspace or session output discovery. */
+    listArtifactCatalog(workspaceId: string, options?: ArtifactCatalogListOptions & {
+        signal?: AbortSignal;
+    }): Promise<ArtifactCatalogListResponse>;
+    /** Idempotently set a workspace-shared pin; refresh the catalog after completion. */
+    updateArtifactPin(workspaceId: string, kind: ArtifactCatalogKind, artifactId: string, pinned: boolean, options?: {
+        signal?: AbortSignal;
+    }): Promise<ArtifactPinResponse>;
+    listWorkspaceArtifacts(workspaceId: string, options?: WorkspaceArtifactListOptions & {
+        signal?: AbortSignal;
+    }): Promise<WorkspaceArtifactListResponse>;
+    getWorkspaceArtifact(workspaceId: string, artifactId: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<WorkspaceArtifactDetailResponse>;
+    /** Display-only HTML delivery: do not download the retained source bundle to render a Site. */
+    getWorkspaceArtifactHtml(workspaceId: string, artifactId: string, options: {
+        versionId: string;
+        signal?: AbortSignal;
+    }): Promise<string>;
+    rollbackWorkspaceArtifact(workspaceId: string, artifactId: string, request: RollbackWorkspaceArtifactRequest, options?: {
+        signal?: AbortSignal;
+    }): Promise<WorkspaceArtifactMutationResponse>;
+    setWorkspaceArtifactStatus(workspaceId: string, artifactId: string, request: SetWorkspaceArtifactStatusRequest, options?: {
+        signal?: AbortSignal;
+    }): Promise<WorkspaceArtifactMutationResponse>;
+    /** Change who can see a Site: the whole workspace, or only you. Only its owner can. */
+    updateWorkspaceArtifactVisibility(workspaceId: string, artifactId: string, request: UpdateWorkspaceArtifactVisibilityRequest, options?: {
+        signal?: AbortSignal;
+    }): Promise<UpdateWorkspaceArtifactVisibilityResponse>;
+    /** A Site's data collections, usage and limits. Needs a manager of the Site. */
+    getSiteData(workspaceId: string, siteId: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<SiteDataDescribeResponse>;
+    /** Create or change a Site Data collection. Needs a manager of the Site. */
+    defineSiteDataCollection(workspaceId: string, siteId: string, name: string, request: SiteDataCollectionDefinitionRequest, options?: {
+        signal?: AbortSignal;
+    }): Promise<SiteDataCollectionResponse>;
+    /** Delete a collection and all of its records. */
+    deleteSiteDataCollection(workspaceId: string, siteId: string, name: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<{
+        deletedRecords: number;
+    }>;
+    /** Remove every record from a collection and keep its definition. */
+    resetSiteDataCollection(workspaceId: string, siteId: string, name: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<{
+        deletedRecords: number;
+    }>;
+    /** Query records with the caller's access to the collection. */
+    querySiteData(workspaceId: string, siteId: string, request: SiteDataQueryRequest, options?: {
+        signal?: AbortSignal;
+    }): Promise<SiteDataQueryResponse>;
+    /** Apply up to 100 record operations together or not at all. */
+    writeSiteData(workspaceId: string, siteId: string, request: SiteDataWriteRequest, options?: {
+        signal?: AbortSignal;
+    }): Promise<SiteDataWriteResponse>;
+    /** Import JSON or CSV records into a collection. */
+    importSiteData(workspaceId: string, siteId: string, name: string, request: SiteDataImportRequest, options?: {
+        signal?: AbortSignal;
+    }): Promise<SiteDataImportResponse>;
+    /** Export a collection as JSON or CSV text (bounded; check `truncated`). */
+    exportSiteData(workspaceId: string, siteId: string, name: string, options?: {
+        format?: "json" | "csv";
+        signal?: AbortSignal;
+    }): Promise<{
+        content: string;
+        contentType: string;
+        truncated: boolean;
+    }>;
+    /** Files stored with a Site that the caller may see. */
+    listSiteDataFiles(workspaceId: string, siteId: string, options?: {
+        limit?: number;
+        cursor?: string;
+        signal?: AbortSignal;
+    }): Promise<SiteDataFileListResponse>;
+    /** A short-lived download URL for one Site file. */
+    getSiteDataFileUrl(workspaceId: string, siteId: string, fileId: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<SiteDataFileUrlResponse>;
+    deleteSiteDataFile(workspaceId: string, siteId: string, fileId: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<{
+        deleted: {
+            id: string;
+        };
+    }>;
+    /**
+     * A Site's SQL database (optional Cloudflare storage): availability, whether
+     * it is on, migrations, named queries, usage and limits. Needs a manager.
+     */
+    getSiteSql(workspaceId: string, siteId: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<SiteSqlDescribeResponse>;
+    /** Turn a Site's SQL database on or off; turning it off keeps its data. */
+    updateSiteSqlSettings(workspaceId: string, siteId: string, request: SiteSqlSettingsRequest, options?: {
+        signal?: AbortSignal;
+    }): Promise<SiteSqlDescribeResponse>;
+    /** Add a named schema migration to a Site's SQL database. */
+    migrateSiteSql(workspaceId: string, siteId: string, request: SiteSqlMigrationRequest, options?: {
+        signal?: AbortSignal;
+    }): Promise<SiteSqlMigrateResponse>;
+    /** Create or replace a named query Site pages run with site.sql.run. */
+    defineSiteSqlQuery(workspaceId: string, siteId: string, name: string, request: SiteSqlQueryDefinitionRequest, options?: {
+        signal?: AbortSignal;
+    }): Promise<SiteSqlQueryResponse>;
+    deleteSiteSqlQuery(workspaceId: string, siteId: string, name: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<{
+        deleted: boolean;
+    }>;
+    /** Run a named query with the caller's access (its audience decides who may). */
+    runSiteSqlQuery(workspaceId: string, siteId: string, name: string, request?: SiteSqlRunRequest, options?: {
+        signal?: AbortSignal;
+    }): Promise<SiteSqlRunResponse>;
+    /** Run one read-only statement on a Site's SQL database. Needs a manager. */
+    querySiteSql(workspaceId: string, siteId: string, request: SiteSqlStatementRequest, options?: {
+        signal?: AbortSignal;
+    }): Promise<SiteSqlRunResponse>;
+    /** Run one data-changing statement on a Site's SQL database. Needs a manager. */
+    executeSiteSql(workspaceId: string, siteId: string, request: SiteSqlStatementRequest, options?: {
+        signal?: AbortSignal;
+    }): Promise<SiteSqlRunResponse>;
+    /** Tables, columns, row counts and applied migrations of a Site's SQL database. */
+    inspectSiteSql(workspaceId: string, siteId: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<SiteSqlInspectResponse>;
+    /**
+     * Export a Site's SQL database as SQL, CSV (one table) or JSON. One call
+     * returns at most `maxBytes` (16 MiB at most); when `nextCursor` is set,
+     * call again with it as `cursor` and append the pieces in order.
+     */
+    exportSiteSql(workspaceId: string, siteId: string, options?: {
+        format?: SiteSqlExportFormat;
+        table?: string;
+        cursor?: string;
+        maxBytes?: number;
+        signal?: AbortSignal;
+    }): Promise<{
+        content: string;
+        contentType: string;
+        truncated: boolean;
+        nextCursor: string | null;
+    }>;
+    /** Import SQL statements, CSV or JSON rows into a Site's SQL database. */
+    importSiteSql(workspaceId: string, siteId: string, request: SiteSqlImportRequest, options?: {
+        signal?: AbortSignal;
+    }): Promise<SiteSqlImportResponse>;
+    /** Empty a Site's SQL database, keeping (rebuilding) or dropping its schema. */
+    resetSiteSql(workspaceId: string, siteId: string, request?: {
+        schema?: "keep" | "drop";
+    }, options?: {
+        signal?: AbortSignal;
+    }): Promise<SiteSqlResetResponse>;
+    /**
+     * A Site's web publication: hostname, access, embedded agent, limits,
+     * status and moderation. 404 when the Site was never published; 503
+     * `sites_publishing_disabled` when the deployment has no Sites domain.
+     */
+    getSitePublication(workspaceId: string, siteId: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<SitePublication>;
+    /**
+     * Publish a Site on its own hostname or change its publication. Omitted
+     * fields keep their current values. 409 `site_hostname_taken` when the
+     * label belongs to another Site; 403 when the Site is Only me or the
+     * caller cannot manage it.
+     */
+    updateSitePublication(workspaceId: string, siteId: string, request: UpsertSitePublicationRequest, options?: {
+        signal?: AbortSignal;
+    }): Promise<SitePublication>;
+    /** Stop serving a published Site. Its hostname stays held for the workspace. */
+    unpublishSite(workspaceId: string, siteId: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<SitePublication>;
+    /**
+     * Apply a readiness warning's one-click fix (`publication.warnings[].fix`):
+     * a Site Data collection's guest access or a Site SQL query's audience.
+     * Answers the publication with fresh warnings. 404
+     * `site_fix_target_missing` when the collection or query no longer exists.
+     */
+    applySitePublicationFix(workspaceId: string, siteId: string, fix: SitePublishWarningFix, options?: {
+        signal?: AbortSignal;
+    }): Promise<SitePublication>;
+    /**
+     * This month's Site platform usage of the workspace (gateway requests,
+     * Site SQL rows read and written, Site SQL and Site Data storage) against
+     * its monthly allowance, with the billing mode and the Opengeni-wide
+     * brake state.
+     */
+    getSitePlatformUsage(workspaceId: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<SitePlatformUsage>;
+    /** Whether a hostname label is valid and free for a Site in this workspace. */
+    checkSiteHostname(workspaceId: string, label: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<SiteHostnameAvailability>;
+    /** Take a published Site down at once; visitors see a takedown notice. */
+    takeDownSite(workspaceId: string, siteId: string, request: SiteTakedownRequest, options?: {
+        signal?: AbortSignal;
+    }): Promise<SitePublication>;
+    /** Serve a Site that was taken down again. */
+    restoreSite(workspaceId: string, siteId: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<SitePublication>;
+    /** Abuse reports visitors filed against a published Site. */
+    listSiteAbuseReports(workspaceId: string, siteId: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<{
+        reports: SiteAbuseReport[];
+    }>;
+    /** Close an abuse report as dismissed or actioned. */
+    updateSiteAbuseReport(workspaceId: string, siteId: string, reportId: string, request: {
+        status: "dismissed" | "actioned";
+    }, options?: {
+        signal?: AbortSignal;
+    }): Promise<SiteAbuseReport>;
+    /** The workspace's default limit profile for published Sites. */
+    getSiteLimitProfile(workspaceId: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<SiteLimitProfile>;
+    /** Change the workspace's default limit profile for published Sites. Needs a workspace admin. */
+    updateSiteLimitProfile(workspaceId: string, profile: SiteLimitProfile, options?: {
+        signal?: AbortSignal;
+    }): Promise<SiteLimitProfile>;
+    /**
+     * Let the signed-in person open a published Site: returns a one-time code,
+     * bound to the Site host, PKCE challenge and redirect, inside `redirectTo`.
+     * 403 `site_access_denied` when they may not open the Site.
+     */
+    authorizeSiteViewer(request: SiteAuthAuthorizeRequest, options?: {
+        signal?: AbortSignal;
+    }): Promise<SiteAuthAuthorizeResponse>;
     /** Search the official MCP registry for installable capabilities. */
     discoverMcpCapabilities(workspaceId: string, options?: {
         query?: string;
         limit?: number;
     }): Promise<DiscoverMcpCapabilitiesResponse>;
+    discoverPlugins(workspaceId: string, options?: {
+        id?: string;
+        query?: string;
+        provider?: string;
+        offset?: number;
+    }): Promise<import("@opengeni/contracts").PluginDiscoveryPage>;
+    inspectMcpAuthentication(workspaceId: string, url: string): Promise<{
+        kind: "oauth2" | "none" | "unknown";
+        message?: string;
+    }>;
     /** List installed protocol-neutral OpenAPI and GraphQL Integrations. */
     listApiIntegrations(workspaceId: string): Promise<ListApiIntegrationsResponse>;
     /** List curated provider definitions without exposing deployment OAuth credentials. */
@@ -972,6 +1662,7 @@ export declare class OpenGeniClient {
     removeIntegrationFacet(workspaceId: string, capabilityId: string, instanceKey: string, facetKey: string, request: MutateIntegrationFacetRequest): Promise<IntegrationFacetRemovalResult>;
     private mutateIntegrationFacetLifecycle;
     previewPlugin(workspaceId: string, request: PreviewPluginRequest): Promise<PluginPreview>;
+    getInstalledPluginDetails(workspaceId: string, pluginKey: string): Promise<import("@opengeni/contracts").PluginDiscoveryItem>;
     listInstalledPlugins(workspaceId: string): Promise<ListInstalledPluginsResponse>;
     installPlugin(workspaceId: string, request: InstallPluginRequest): Promise<InstalledPlugin>;
     previewPluginUninstall(workspaceId: string, pluginKey: string): Promise<PluginUninstallPreview>;
@@ -982,11 +1673,32 @@ export declare class OpenGeniClient {
     installSkill(workspaceId: string, request: InstallSkillRequest): Promise<InstalledSkill>;
     /** List Skills from the authoritative Plugin/Skill-Facet installation ledger. */
     listInstalledSkills(workspaceId: string): Promise<ListInstalledSkillsResponse>;
+    /** Shared authored/installed catalog metadata. File bodies are read on demand. */
+    listWorkspaceSkills(workspaceId: string, options?: {
+        cursor?: string;
+        limit?: number;
+        sessionId?: string;
+    }): Promise<{
+        skills: SkillSummary[];
+        nextCursor: string | null;
+    }>;
+    readWorkspaceSkill(workspaceId: string, skillId: string, revisionId?: string): Promise<SkillRecord>;
+    saveWorkspaceSkill(workspaceId: string, request: SaveWorkspaceSkillRequest): Promise<SkillWriteReceipt>;
+    /** Permanently remove a personal/workspace Skill and all its saved revisions. */
+    removeWorkspaceSkill(workspaceId: string, skillId: string, request: RemoveWorkspaceSkillRequest): Promise<SkillWriteReceipt>;
+    approveWorkspaceSkill(workspaceId: string, skillId: string, request: ApplyWorkspaceSkillRevisionRequest): Promise<SkillWriteReceipt>;
+    restoreWorkspaceSkill(workspaceId: string, skillId: string, request: ApplyWorkspaceSkillRevisionRequest): Promise<SkillWriteReceipt>;
+    rejectWorkspaceSkill(workspaceId: string, skillId: string, request: ApplyWorkspaceSkillRevisionRequest): Promise<SkillWriteReceipt>;
     /** Install one exact reviewed curated-library Skill through the Skill domain. */
     installLibrarySkill(workspaceId: string, libraryId: string, request: InstallLibrarySkillRequest): Promise<InstalledSkill>;
     previewSkillUninstall(workspaceId: string, capabilityId: string): Promise<SkillUninstallPreview>;
     /** Remove the direct owner under an optimistic installation-version fence. */
     uninstallSkill(workspaceId: string, capabilityId: string, request: UninstallSkillRequest): Promise<UninstallSkillResult>;
+    /** This authenticated user's accounts across the organization, plus current-workspace shared accounts.
+     * Inactive accounts are opt-in for settings display; execution pickers keep the active default. */
+    listOwnConnectionAccounts(workspaceId: string, options?: {
+        includeInactive?: boolean;
+    }): Promise<ConnectionMetadata[]>;
     listConnections(workspaceId: string): Promise<ConnectionMetadata[]>;
     /** Secret-free status for the caller's exact personal GitHub connection. */
     personalGitHubStatus(workspaceId: string): Promise<PersonalGitHubConnectionStatusResponse>;
@@ -1002,7 +1714,7 @@ export declare class OpenGeniClient {
     replacePersonalGitHubRepositorySelections(workspaceId: string, connectionId: string, request: ReplacePersonalGitHubRepositorySelectionsRequest): Promise<PersonalGitHubRepositorySelectionState>;
     /** Revalidate every selected repository without accepting provider URLs from the caller. */
     verifyPersonalGitHubRepositorySelections(workspaceId: string, connectionId: string, request: VerifyPersonalGitHubRepositorySelectionsRequest): Promise<PersonalGitHubRepositorySelectionState>;
-    /** List the secret-free Slack team -> OpenGeni tenant routing authority. */
+    /** List the secret-free Slack team -> Opengeni tenant routing authority. */
     listSlackInstallationBindings(workspaceId: string): Promise<SlackInstallationBinding[]>;
     createConnection(workspaceId: string, request: CreateConnectionRequest): Promise<ConnectionMetadata>;
     /**
@@ -1012,7 +1724,13 @@ export declare class OpenGeniClient {
     installFikenConnection(workspaceId: string, request: FikenInstallRequest): Promise<ConnectionMetadata>;
     /** Start the Fiken OAuth flow for the workspace-shared Fiken connection. */
     startFikenOAuth(workspaceId: string, request?: FikenOAuthStartRequest): Promise<FikenOAuthStartResponse>;
-    /** Start the public Slack installation flow for the workspace-shared OpenGeni bot. */
+    /** List verified local and explicitly organization-shared bots, excluding personal accounts. */
+    listAvailableOpenGeniSlackBots(workspaceId: string): Promise<AvailableOpenGeniSlackBots>;
+    /** Read configured sharing independently of installation credential health. */
+    getOpenGeniSlackBotOrganizationAccess(workspaceId: string, connectionId: string): Promise<OpenGeniSlackBotOrganizationAccess>;
+    /** An organization administrator may share an installed bot with authorized workspaces. */
+    setOpenGeniSlackBotOrganizationAccess(workspaceId: string, connectionId: string, request: UpdateOpenGeniSlackBotOrganizationAccess): Promise<OpenGeniSlackBotOrganizationAccess>;
+    /** Start the public Slack installation flow for the workspace-shared Opengeni bot. */
     startOpenGeniSlackBotInstall(workspaceId: string, request?: OpenGeniSlackBotInstallRequest): Promise<OpenGeniSlackBotInstallStart>;
     listOpenGeniSlackReactionChannels(workspaceId: string, connectionId: string, cursor?: string): Promise<SlackReactionChannelListResponse>;
     listOpenGeniSlackChannelRoutes(workspaceId: string, connectionId: string): Promise<SlackChannelRouteListResponse>;
@@ -1035,6 +1753,9 @@ export declare class OpenGeniClient {
     disconnectSocialConnection(workspaceId: string, connectionId: string): Promise<SocialConnection>;
     /** Public, immutably-cached URL for a catalog item's logo, or null when the item has none. */
     catalogAssetUrl(logoAssetPath: string | null): string | null;
+    /** Read a passive catalog mark through this client's authenticated transport.
+     * Useful when an embedding backend protects even public upstream assets. */
+    downloadCatalogAsset(logoAssetPath: string, options?: OpenGeniRequestOptions): Promise<Blob>;
     /** GitHub App server configuration plus truthful workspace binding status. */
     getGitHubApp(workspaceId: string, options?: {
         returnPath?: string;
@@ -1042,6 +1763,10 @@ export declare class OpenGeniClient {
     /** Build the GitHub owner-consent entry URL for fresh workspace-bound state. */
     githubConnectUrl(workspaceId: string, state: string): string;
     listGitHubRepositories(workspaceId: string): Promise<GitHubRepositoriesResponse>;
+    /** Effective confirmation policy for each GitHub identity available to this caller. */
+    getGitHubActionPolicies(workspaceId: string): Promise<GitHubActionPoliciesResponse>;
+    /** Change one GitHub action group without broadening review or merge policy. */
+    updateGitHubActionPolicy(workspaceId: string, request: UpdateGitHubActionPolicyRequest): Promise<GitHubActionPolicyActorState>;
     /** Re-sync the installation's repository list from GitHub. */
     syncGitHubRepositories(workspaceId: string): Promise<GitHubRepositoriesResponse>;
     /** Remove one workspace binding without uninstalling the GitHub App itself. */
@@ -1058,9 +1783,125 @@ export declare class OpenGeniClient {
     createOrganizationApiKey(organizationId: string, request: CreateOrganizationApiKeyRequest): Promise<CreateApiKeyResponse>;
     /** Revoke an organization-scoped API key. Returns the revoked key. */
     deleteOrganizationApiKey(organizationId: string, apiKeyId: string): Promise<ApiKey>;
+    /**
+     * Agents people connected to the organization MCP server (`/v1/mcp`).
+     * Everyone sees their own; owners and admins see everyone's. Browser only:
+     * keys and agents are refused, so an agent can't widen its own access.
+     */
+    listOrganizationMcpConnections(organizationId: string): Promise<OrganizationMcpConnectionList>;
+    /** Change what a connected agent can do and where; its next request uses it. Only its person. */
+    updateOrganizationMcpConnection(organizationId: string, connectionId: string, request: UpdateOrganizationMcpConnectionRequest): Promise<OrganizationMcpConnection>;
+    /** Disconnect an agent: every token it holds is refused from now on. */
+    deleteOrganizationMcpConnection(organizationId: string, connectionId: string): Promise<void>;
+    /**
+     * Keys that act as the person who created them, with their live access in
+     * this organization capped by each key's access setting. Everyone sees their
+     * own; owners and admins see everyone's.
+     */
+    listPersonalApiKeys(organizationId: string): Promise<ListPersonalApiKeysResponse>;
+    /** Create a key that acts as you. The token is returned once. */
+    createPersonalApiKey(organizationId: string, request: CreatePersonalApiKeyRequest): Promise<CreatePersonalApiKeyResponse>;
+    /** Revoke a personal key: its next request is refused. Its person, or an admin. */
+    revokePersonalApiKey(organizationId: string, apiKeyId: string): Promise<void>;
+    /** Service accounts: organization identities with no person behind them. */
+    listOrganizationServiceAccounts(organizationId: string): Promise<ListOrganizationServiceAccountsResponse>;
+    getOrganizationServiceAccount(organizationId: string, serviceAccountId: string): Promise<OrganizationServiceAccount>;
+    /** Create a service account; give it keys with `createOrganizationApiKey({ serviceAccountId })`. */
+    createOrganizationServiceAccount(organizationId: string, request: CreateOrganizationServiceAccountRequest): Promise<OrganizationServiceAccount>;
+    /** Rename it or change its role; making it a member narrows its keys at once. */
+    updateOrganizationServiceAccount(organizationId: string, serviceAccountId: string, request: UpdateOrganizationServiceAccountRequest): Promise<OrganizationServiceAccount>;
+    /** Delete a service account; every key it holds is revoked at once. */
+    deleteOrganizationServiceAccount(organizationId: string, serviceAccountId: string): Promise<void>;
+    /** The pending sign-in an agent started; read by the web app's sign-in page. */
+    getMcpConnectionRequest(requestToken: string): Promise<McpConnectionRequest>;
+    /** Allow or deny an agent's sign-in. Returns where to send the browser next. */
+    answerMcpConnectionRequest(requestToken: string, decision: McpConnectionDecision): Promise<{
+        redirectTo: string;
+    }>;
+    /**
+     * What waits on the signed-in person across their workspaces, newest first.
+     * Pass a workspace to see only its items.
+     */
+    listInbox(options?: {
+        workspaceId?: string;
+    }): Promise<ListInboxResponse>;
+    /** Mark an item seen, snooze it, or dismiss it. */
+    updateInboxItem(itemId: InboxItem["id"], input: UpdateInboxItemInput): Promise<void>;
+    getInboxSettings(): Promise<InboxSettings>;
+    updateInboxSettings(input: InboxSettings): Promise<InboxSettings>;
+    /** Whether other members' agents may notify the signed-in person in this workspace. */
+    getMemberNotifications(workspaceId: string): Promise<MemberNotificationsSetting>;
+    /** Let other members' agents notify the signed-in person in this workspace, or stop them. */
+    updateMemberNotifications(workspaceId: string, input: MemberNotificationsSetting): Promise<MemberNotificationsSetting>;
+    /** Whether the signed-in person muted this session's replies. */
+    getSessionInboxMute(workspaceId: string, sessionId: string): Promise<SessionInboxMute>;
+    /**
+     * Mute or unmute this session's replies for the signed-in person. Its
+     * notifications, questions and approvals still arrive.
+     */
+    setSessionInboxMute(workspaceId: string, sessionId: string, input: SessionInboxMute): Promise<SessionInboxMute>;
+    /** This session's admin access, and what the viewer may change about it. */
+    getSessionAdminAccess(workspaceId: string, sessionId: string): Promise<SessionAdminAccess>;
+    /**
+     * Give your own session admin access: its agent can then do what you can
+     * manage across the organization. An owner or admin, in the app, when the
+     * organization allows it. It lasts one hour unless `durationHours` says
+     * otherwise (1 to 720), or null for no time limit; giving it again while it
+     * is on sets a new time limit from now.
+     */
+    grantSessionAdminAccess(workspaceId: string, sessionId: string, input?: GrantSessionAdminAccessRequest): Promise<SessionAdminAccess>;
+    /** End this session's admin access. */
+    revokeSessionAdminAccess(workspaceId: string, sessionId: string): Promise<SessionAdminAccess>;
+    /**
+     * Approve a native app sign-in from the signed-in browser. Returns the app's
+     * callback (`<scheme>://auth/callback?code=…&state=…`) to navigate to.
+     */
+    authorizeNativeApp(input: NativeAppAuthorizeInput): Promise<{
+        redirectUrl: string;
+    }>;
+    /** Exchange a native app sign-in code and its PKCE verifier for the app's credential. */
+    exchangeNativeAppCode(input: NativeAppTokenInput): Promise<NativeAppToken>;
+    /** Revoke the native app credential this client signs in with. */
+    signOutNativeApp(): Promise<void>;
+    /** This app credential's push registration, or null when it gets no pushes. */
+    getNativePushDevice(): Promise<NativePushDevice | null>;
+    /** Register (or update) this device's push token and rules for this app credential. */
+    registerNativePushDevice(input: RegisterNativePushDeviceInput): Promise<NativePushDevice>;
+    /** Stop pushes to this device for this app credential. */
+    unregisterNativePushDevice(): Promise<void>;
+    /**
+     * One page of sessions across every shared workspace of the organization the
+     * caller may read within its live workspace scope (an organization API key or
+     * organization owner). Each row carries its `workspaceId`; read events,
+     * history, and files through the ordinary workspace methods. Personal
+     * workspaces are never included and private sessions stay invisible.
+     */
+    listOrganizationSessions(organizationId: string, options?: ListOrganizationSessionsOptions): Promise<OrganizationSessionListResponse>;
+    /**
+     * Every session `listOrganizationSessions` would return, following
+     * `nextCursor` page by page until the organization is exhausted. A page may
+     * be shorter than `limit` while more pages remain, so callers must not treat
+     * a short page as the end.
+     */
+    iterateOrganizationSessions(organizationId: string, options?: Omit<ListOrganizationSessionsOptions, "cursor">): AsyncGenerator<Session, void, undefined>;
     getBilling(options?: {
         accountId?: string;
     }): Promise<BillingSummary>;
+    getOrganizationUsageSummary(options: {
+        accountId: string;
+        period?: import("@opengeni/contracts").OrganizationUsagePeriod;
+    }, requestOptions?: OpenGeniRequestOptions): Promise<import("@opengeni/contracts").OrganizationUsageSummary>;
+    getOrganizationModelUsage(options: {
+        accountId: string;
+        period?: import("@opengeni/contracts").OrganizationUsagePeriod;
+        afterWorkspaceId?: string;
+    }, requestOptions?: OpenGeniRequestOptions): Promise<import("@opengeni/contracts/organization-model-usage").OrganizationModelUsage>;
+    getOrganizationUsageWorkspacePage(options: {
+        accountId: string;
+        period?: import("@opengeni/contracts").OrganizationUsagePeriod;
+        until: string;
+        afterWorkspaceId?: string;
+    }, requestOptions?: OpenGeniRequestOptions): Promise<import("@opengeni/contracts").OrganizationUsageWorkspacePage>;
     getBillingUsage(options?: {
         accountId?: string;
         workspaceId?: string;
@@ -1069,14 +1910,63 @@ export declare class OpenGeniClient {
         range?: InsightsRange;
         provider?: string;
         model?: string;
+        rootSessionId?: string;
+        sessionId?: string;
+        signal?: AbortSignal;
     }): Promise<WorkspaceInsightsResponse>;
+    /** Shared usage under the existing workspace access gate. */
+    getWorkspaceInsightsSiteUsage(workspaceId: string, options?: Partial<InsightsSiteUsageQuery>, requestOptions?: OpenGeniRequestOptions): Promise<InsightsSiteUsageResponse>;
+    /** Shared usage under the existing workspace access gate. */
+    getWorkspaceInsightsUsage(workspaceId: string, options?: WorkspaceInsightsUsageOptions, requestOptions?: OpenGeniRequestOptions): Promise<InsightsUsageResponse>;
+    /** Shared usage under the existing organization access gate. */
+    getOrganizationInsightsUsage(accountId: string, options?: OrganizationInsightsUsageOptions, requestOptions?: OpenGeniRequestOptions): Promise<InsightsUsageResponse>;
+    /** Visible calls only; a filter never grants access to hidden call facts. */
+    listInsightsCalls(scope: Extract<InsightsCallsScope, {
+        kind: "workspace";
+    }>, options?: WorkspaceInsightsCallsOptions, requestOptions?: OpenGeniRequestOptions): Promise<InsightsCallsResponse>;
+    listInsightsCalls(scope: Extract<InsightsCallsScope, {
+        kind: "organization";
+    }>, options?: OrganizationInsightsCallsOptions, requestOptions?: OpenGeniRequestOptions): Promise<InsightsCallsResponse>;
     getBillingEntitlements(options?: {
         accountId?: string;
     }): Promise<BillingEntitlementsResponse>;
     /** Start a Stripe checkout for prepaid credits. */
     createBillingCheckout(request: CreateCheckoutRequest): Promise<CreateCheckoutResponse>;
+    /**
+     * Where one checkout stands, and whether its credits reached the balance.
+     * Poll it after the customer returns from Stripe Checkout.
+     */
+    getBillingCheckout(checkoutSessionId: string, options?: {
+        accountId?: string;
+    }): Promise<BillingCheckoutStatus>;
     /** Open Stripe's hosted portal for invoices and payment information. */
     createBillingPortalSession(request?: CreateBillingPortalRequest): Promise<CreateBillingPortalResponse>;
+    /** Current runtime catalog, USD prices, self-service availability and plan balance. */
+    getBillingSubscriptionPlans(options?: {
+        accountId?: string;
+    }): Promise<BillingSubscriptionCatalog>;
+    createSubscriptionCheckout(request: CreateSubscriptionCheckoutRequest): Promise<CreateSubscriptionCheckoutResponse>;
+    /** Charge immediately, reset the monthly anchor and replace plan credit after payment. */
+    upgradeBillingSubscription(request: ChangeBillingSubscriptionRequest): Promise<BillingSubscriptionChange>;
+    /** Schedule a lower-priced plan at the end of the already-paid period. */
+    changeBillingSubscription(request: ChangeBillingSubscriptionRequest): Promise<BillingSubscriptionChange>;
+    cancelBillingSubscription(request: CancelBillingSubscriptionRequest): Promise<BillingSubscriptionChange>;
+    createSubscriptionPortalSession(request?: CreateBillingPortalRequest): Promise<CreateBillingPortalResponse>;
+    /** The URL of an API path on this client's base (relative when the base is relative). */
+    apiUrl(path: string): string;
+    /**
+     * A client of the same class that adds `headers` to every request, keeping
+     * this client's base URL, fetch, credentials, and actor attribution. Used to
+     * scope a surface (for example an artifact viewer) to one host context.
+     */
+    withHeaders(headers: Readonly<Record<string, string>>): this;
+    /**
+     * Fetch an absolute URL under this client's base URL through its fetch and
+     * headers. For transports the SDK builds itself (the editable-artifact live
+     * transport), so host authentication stays in one place. A URL outside the
+     * base is refused: credentials never leave the configured API.
+     */
+    fetchApi(input: string | URL, init?: RequestInit): Promise<Response>;
     private headers;
     private url;
     /** Connection state + the codex models the workspace may select (empty until connected). */
@@ -1089,6 +1979,8 @@ export declare class OpenGeniClient {
     codexUsage(workspaceId: string): Promise<CodexUsage>;
     /** Live per-account usage read (refreshes THIS account's bearer; writes the cache). */
     codexAccountUsage(workspaceId: string, accountId: string): Promise<CodexUsage>;
+    /** Inspect an organization account even when it is paused or assigned nowhere. */
+    organizationCodexAccountUsage(organizationId: string, accountId: string): Promise<CodexUsage>;
     /** Batched live refresh across every connected account, keyed by credential id. */
     refreshCodexUsage(workspaceId: string): Promise<{
         usage: CodexUsageMap;
@@ -1101,6 +1993,11 @@ export declare class OpenGeniClient {
     }>;
     /** List every connected Codex account + the workspace active pointer + settings. */
     listCodexAccounts(workspaceId: string): Promise<CodexAccountsResponse>;
+    /**
+     * Session-authorized Codex choices plus the current accepted account.
+     * @deprecated Use getSessionModelAccount for provider-neutral choices.
+     */
+    listSessionCodexAccounts(workspaceId: string, sessionId: string): Promise<SessionCodexAccountsResponse>;
     /** Switch the workspace ACTIVE Codex account (the one unpinned sessions use). */
     activateCodexAccount(workspaceId: string, accountId: string): Promise<{
         activated: boolean;
@@ -1128,12 +2025,63 @@ export declare class OpenGeniClient {
     }>;
     /** Rename a Codex account (label only in P1). */
     renameCodexAccount(workspaceId: string, accountId: string, label: string | null): Promise<CodexAccount>;
-    /** Pin (or unpin via "auto") a session's Codex account. Applies on the next turn. */
+    /**
+     * Pin/unpin a Codex account without changing another provider's binding.
+     * @deprecated Use setSessionModelAccount with provider: "codex" and
+     * connectionId: null for Automatic, or the selected account id.
+     */
     pinSessionCodexAccount(workspaceId: string, sessionId: string, target: string): Promise<{
         pinned: string;
+        appliedTo?: "waiting_turn" | "next_turn";
+    }>;
+    /** Organization subscription management requires an administrator browser session. */
+    getModelConnectionAccess(target: {
+        scope: "organizations" | "workspaces";
+        scopeId: string;
+        kind: "codex" | "supergrok" | "vercel_gateway" | "openrouter" | "anthropic" | "claude_subscription";
+        connectionId: string;
+    }): Promise<ModelConnectionAccessResponse>;
+    getModelConnectionAccess(target: {
+        scope: "organizations" | "workspaces";
+        scopeId: string;
+        kind: ModelConnectionAccessKind;
+        connectionId: string;
+    }): Promise<ModelConnectionAccessResponse>;
+    updateModelConnectionAccess(target: {
+        scope: "organizations" | "workspaces";
+        scopeId: string;
+        kind: "codex" | "supergrok" | "vercel_gateway" | "openrouter" | "anthropic" | "claude_subscription";
+        connectionId: string;
+    }, policy: ModelConnectionAccessPolicy): Promise<ModelConnectionAccessPolicy>;
+    updateModelConnectionAccess(target: {
+        scope: "organizations" | "workspaces";
+        scopeId: string;
+        kind: ModelConnectionAccessKind;
+        connectionId: string;
+    }, policy: ModelConnectionAccessPolicy): Promise<ModelConnectionAccessPolicy>;
+    listOrganizationSuperGrokAccounts(organizationId: string): Promise<SuperGrokAccountsResponse>;
+    organizationSupergrokConnectStart(organizationId: string): Promise<SuperGrokConnectStart>;
+    organizationSupergrokConnectPoll(organizationId: string, state: string): Promise<SuperGrokConnectPoll>;
+    activateOrganizationSuperGrokAccount(organizationId: string, accountId: string): Promise<{
+        updated: boolean;
+    }>;
+    setOrganizationSuperGrokRotationSettings(organizationId: string, patch: {
+        rotationEnabled: boolean;
+    }): Promise<SuperGrokRotationSettings>;
+    setOrganizationSuperGrokAccountAllocator(organizationId: string, accountId: string, input: {
+        enabled: boolean;
+        expectedVersion: number;
+    }): Promise<{
+        updated: boolean;
+    }>;
+    renameOrganizationSuperGrokAccount(organizationId: string, accountId: string, label: string | null): Promise<{
+        updated: boolean;
+    }>;
+    disconnectOrganizationSuperGrokAccount(organizationId: string, accountId: string): Promise<{
+        disconnected: boolean;
     }>;
     supergrokStatus(workspaceId: string): Promise<SuperGrokConnectionStatus>;
-    supergrokConnectStart(workspaceId: string, scope?: SuperGrokAccountScope): Promise<SuperGrokConnectStart>;
+    supergrokConnectStart(workspaceId: string, scope?: Exclude<SuperGrokAccountScope, "organization">): Promise<SuperGrokConnectStart>;
     supergrokConnectPoll(workspaceId: string, state: string): Promise<SuperGrokConnectPoll>;
     listSuperGrokAccounts(workspaceId: string): Promise<SuperGrokAccountsResponse>;
     activateSuperGrokAccount(workspaceId: string, accountId: string): Promise<{
@@ -1157,7 +2105,9 @@ export declare class OpenGeniClient {
     /** Contract-checked JSON transport shared by opt-in typed SDK clients. */
     requestJson<T>(method: string, path: string, body?: unknown, query?: Record<string, string>, options?: OpenGeniRequestOptions): Promise<T>;
     /** Authenticated, contract-checked response for bounded streaming downloads. */
-    protected requestResponse(method: string, path: string, query?: Record<string, string>, options?: OpenGeniRequestOptions): Promise<Response>;
+    protected requestResponse(method: string, path: string, query?: Record<string, string>, options?: OpenGeniRequestOptions & {
+        accept?: string;
+    }): Promise<FetchResponse>;
     /** Contract-checked transport shared by opt-in typed SDK clients for 204 responses. */
     requestVoid(method: string, path: string, body?: unknown): Promise<void>;
 }