@opengeni/sdk 3.3.2 → 3.4.0

package/dist/external-vault-receiver.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/external-vault-receiver.ts"],"sourcesContent":["/**\n * Server-only receiver for Opengeni's signed remote vault protocol\n * (`opengeni.vault.v1`). Import from `@opengeni/sdk/external-vault-receiver`\n * in the server that owns the customer's secrets; never in a browser bundle.\n *\n * Order of checks for every request: bounded body, connection lookup, exact\n * body signature, strict schema, request age and replay, native authority\n * bindings, then the host's own `authorize` mapping (a MAC is not an\n * authorization decision), then the handler. Handler output is projected to\n * the known wire fields and validated before it is signed, so metadata can\n * never carry values and reads return only requested fields.\n *\n * Mutations are claimed in the caller-owned durable store under an\n * idempotency key and an operation digest. A repeated key with the same\n * digest returns the recorded result; a different digest is refused; an\n * unfinished or uncertain claim reports `provider_outcome_unknown` until the\n * host reconciles it. Nothing here retries a mutation.\n */\nimport {\n  OPENGENI_SIGNATURE_HEADER,\n  signOpenGeniPayload,\n  verifyOpenGeniSignature,\n} from \"@opengeni/contracts/workspace-integration-wire\";\nimport {\n  VAULT_PROVIDER_WIRE_LIMITS,\n  VAULT_PROVIDER_WIRE_RESPONSE_SIGNATURE_HEADER,\n  VAULT_PROVIDER_WIRE_VERSION,\n  VaultProviderWireFreshness,\n  VaultProviderWireRequest,\n  VaultProviderWireResults,\n  isVaultProviderWireMutation,\n  vaultProviderWireNameKey,\n  vaultProviderWireResponseKey,\n  vaultProviderWireUtf8Bytes,\n  type VaultProviderWireAuthority,\n  type VaultProviderWireErrorCode,\n  type VaultProviderWireFailure,\n  type VaultProviderWireOperation,\n  type VaultProviderWireOperationName,\n  type VaultProviderWireOperationOf,\n  type VaultProviderWirePage,\n  type VaultProviderWireProvider,\n  type VaultProviderWireResult,\n  type VaultProviderWireSuccess,\n  type VaultProviderWireWriteItem,\n} from \"@opengeni/contracts/vault-provider-wire\";\n\nexport {\n  VAULT_PROVIDER_WIRE_ERROR_CODES,\n  VAULT_PROVIDER_WIRE_LIMITS,\n  VAULT_PROVIDER_WIRE_RESPONSE_SIGNATURE_HEADER,\n  VAULT_PROVIDER_WIRE_VERSION,\n  vaultProviderWireResponseKey,\n} from \"@opengeni/contracts/vault-provider-wire\";\nexport type {\n  VaultProviderWireAuthority,\n  VaultProviderWireDescribeResult,\n  VaultProviderWireErrorCode,\n  VaultProviderWireFieldMeta,\n  VaultProviderWireFieldValue,\n  VaultProviderWireFreshness,\n  VaultProviderWireItemMeta,\n  VaultProviderWireOperation,\n  VaultProviderWireOperationName,\n  VaultProviderWirePage,\n  VaultProviderWireProvider,\n  VaultProviderWireRequest,\n  VaultProviderWireResponse,\n  VaultProviderWireResult,\n  VaultProviderWireVault,\n  VaultProviderWireWriteField,\n  VaultProviderWireWriteItem,\n} from \"@opengeni/contracts/vault-provider-wire\";\n\n/** A definite, safe receiver failure. Its message is never sent to Opengeni. */\nexport class ExternalVaultReceiverError extends Error {\n  readonly code: VaultProviderWireErrorCode;\n  readonly retryAfterMs: number | null;\n  readonly freshness: VaultProviderWireFreshness | null;\n  constructor(\n    code: VaultProviderWireErrorCode,\n    options: {\n      retryAfterMs?: number;\n      freshness?: VaultProviderWireFreshness;\n      message?: string;\n    } = {},\n  ) {\n    super(options.message ?? code);\n    this.name = \"ExternalVaultReceiverError\";\n    this.code = code;\n    this.retryAfterMs =\n      options.retryAfterMs === undefined\n        ? null\n        : Math.min(Math.max(Math.trunc(options.retryAfterMs), 0), 86_400_000);\n    this.freshness = options.freshness ?? null;\n  }\n}\n\nexport interface ExternalVaultReceiverConnection<TConnection> {\n  provider: VaultProviderWireProvider;\n  /**\n   * Accepted signing secrets: the current one first, then a previous one\n   * during rotation. Responses are signed with the secret that verified.\n   */\n  signingSecrets: readonly string[];\n  /** When set, requests for any other Opengeni account are refused. */\n  accountId?: string;\n  /** When set, requests for a connection owned by another workspace are refused. */\n  connectionWorkspaceId?: string;\n  /** Host data for this connection: its fixed inventory scope, not a user. */\n  context: TConnection;\n}\n\nexport type ExternalVaultMutationClaim =\n  | { state: \"claimed\" }\n  | { state: \"completed\"; result: unknown }\n  /** In flight, or uncertain after a failure: report an unknown outcome. */\n  | { state: \"pending\" }\n  /** Same key, different operation or caller. */\n  | { state: \"mismatch\" };\n\n/**\n * Caller-owned replay and idempotency storage. Use durable shared storage\n * (for example a database table with unique keys) when the receiver runs in\n * more than one process or must survive restarts.\n */\nexport interface ExternalVaultReceiverStore {\n  /** Atomically record a request id. False when it was already recorded. */\n  rememberRequest(input: {\n    connectionId: string;\n    requestId: string;\n    expiresAt: Date;\n  }): Promise<boolean>;\n  /** Atomically claim a mutation key, or report its existing state. */\n  claimMutation(input: {\n    connectionId: string;\n    idempotencyKey: string;\n    digest: string;\n    expiresAt: Date;\n  }): Promise<ExternalVaultMutationClaim>;\n  /** Record the metadata-only result of a confirmed mutation. */\n  completeMutation(input: {\n    connectionId: string;\n    idempotencyKey: string;\n    digest: string;\n    result: unknown;\n  }): Promise<void>;\n  /** The handler definitely changed nothing: allow the key to be claimed again. */\n  releaseMutation(input: {\n    connectionId: string;\n    idempotencyKey: string;\n    digest: string;\n  }): Promise<void>;\n}\n\nexport interface ExternalVaultHandlerOutput<R> {\n  result: R;\n  freshness?: VaultProviderWireFreshness | null;\n}\n\ntype ReadContext = { forceRefresh: boolean; cacheEpoch: string | null };\n\nexport interface ExternalVaultCallContext<TConnection, TPrincipal> {\n  connectionId: string;\n  connection: TConnection;\n  /** The host principal returned by `authorize` for this exact request. */\n  principal: TPrincipal;\n  authority: VaultProviderWireAuthority;\n  requestId: string;\n  signal?: AbortSignal;\n}\n\n/**\n * Inventory handlers receive the connection, not the acting principal: one\n * connection has one fixed inventory, so listings must not vary by subject.\n */\nexport interface ExternalVaultInventoryContext<TConnection> {\n  connectionId: string;\n  connection: TConnection;\n  requestId: string;\n  signal?: AbortSignal;\n}\n\nexport interface ExternalVaultReceiverHandlers<TConnection, TPrincipal> {\n  describe(\n    ctx: ExternalVaultInventoryContext<TConnection>,\n  ): Promise<ExternalVaultHandlerOutput<VaultProviderWireResult<\"describe\">>>;\n  /** Deliberate upstream refresh; omit when the store is always live. */\n  refresh?(\n    ctx: ExternalVaultInventoryContext<TConnection>,\n  ): Promise<ExternalVaultHandlerOutput<VaultProviderWireResult<\"refresh\">>>;\n  listVaults(\n    ctx: ExternalVaultInventoryContext<TConnection>,\n    input: { page: VaultProviderWirePage } & ReadContext,\n  ): Promise<ExternalVaultHandlerOutput<VaultProviderWireResult<\"list_vaults\">>>;\n  listItems(\n    ctx: ExternalVaultInventoryContext<TConnection>,\n    input: { externalVaultId: string; page: VaultProviderWirePage } & ReadContext,\n  ): Promise<ExternalVaultHandlerOutput<VaultProviderWireResult<\"list_items\">>>;\n  readFields(\n    ctx: ExternalVaultCallContext<TConnection, TPrincipal>,\n    input: {\n      externalVaultId: string;\n      externalItemId: string;\n      externalFieldIds: readonly string[];\n    } & ReadContext,\n  ): Promise<ExternalVaultHandlerOutput<VaultProviderWireResult<\"read_fields\">>>;\n  /** Omit when the connection is read-only. Throw only definite failures. */\n  writeItem?(\n    ctx: ExternalVaultCallContext<TConnection, TPrincipal>,\n    input: { externalVaultId: string; item: VaultProviderWireWriteItem; idempotencyKey: string },\n  ): Promise<ExternalVaultHandlerOutput<VaultProviderWireResult<\"write_item\">>>;\n  archiveItem?(\n    ctx: ExternalVaultCallContext<TConnection, TPrincipal>,\n    input: { externalVaultId: string; externalItemId: string; idempotencyKey: string },\n  ): Promise<ExternalVaultHandlerOutput<VaultProviderWireResult<\"archive_item\">>>;\n}\n\nexport interface ExternalVaultAuthorizeInput<TConnection> {\n  connectionId: string;\n  connection: TConnection;\n  authority: VaultProviderWireAuthority;\n  operation: {\n    op: VaultProviderWireOperationName;\n    externalVaultId?: string;\n    externalItemId?: string;\n  };\n  requestId: string;\n}\n\nexport interface ExternalVaultReceiverOptions<TConnection, TPrincipal> {\n  /** Unknown connections are indistinguishable from bad signatures. */\n  resolveConnection(\n    connectionId: string,\n  ): Promise<ExternalVaultReceiverConnection<TConnection> | null>;\n  /**\n   * Map Opengeni's native account/workspace/subject to the host tenant and\n   * user and recheck access for this operation. Return null to refuse.\n   * Called for every request, including inventory reads.\n   */\n  authorize(input: ExternalVaultAuthorizeInput<TConnection>): Promise<TPrincipal | null>;\n  handlers: ExternalVaultReceiverHandlers<TConnection, TPrincipal>;\n  store: ExternalVaultReceiverStore;\n  /** How long mutation results stay replayable. Default 24 hours. */\n  mutationRetentionMs?: number;\n  now?: () => number;\n  /** Host diagnostics. Never forward these errors to Opengeni. */\n  onError?(event: {\n    stage: \"authorize\" | \"handler\" | \"store\" | \"output\";\n    op: VaultProviderWireOperationName;\n    connectionId: string;\n    error: unknown;\n  }): void;\n}\n\nexport interface ExternalVaultReceiverHttpRequest {\n  /** The exact raw request body; parse nothing before calling `handle`. */\n  body: string;\n  headers: Headers | Record<string, string | string[] | undefined>;\n  signal?: AbortSignal;\n}\n\nexport interface ExternalVaultReceiverHttpResponse {\n  status: number;\n  headers: Record<string, string>;\n  body: string;\n}\n\nexport interface ExternalVaultReceiver {\n  handle(request: ExternalVaultReceiverHttpRequest): Promise<ExternalVaultReceiverHttpResponse>;\n  /** Fetch-style adapter: POST only, bounded body, then `handle`. */\n  fetch(request: Request): Promise<Response>;\n}\n\nconst JSON_HEADERS = { \"content-type\": \"application/json\", \"cache-control\": \"no-store\" };\nconst UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\n\nfunction plain(status: number, error: string): ExternalVaultReceiverHttpResponse {\n  return { status, headers: { ...JSON_HEADERS }, body: JSON.stringify({ error }) };\n}\n\nfunction headerValue(headers: ExternalVaultReceiverHttpRequest[\"headers\"], name: string) {\n  if (headers instanceof Headers) return headers.get(name);\n  const wanted = name.toLowerCase();\n  for (const [key, value] of Object.entries(headers)) {\n    if (key.toLowerCase() === wanted) {\n      return Array.isArray(value)\n        ? value.length === 1\n          ? (value[0] ?? null)\n          : null\n        : (value ?? null);\n    }\n  }\n  return null;\n}\n\nfunction canonicalJson(value: unknown): string {\n  if (value === null || typeof value !== \"object\") return JSON.stringify(value);\n  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(\",\")}]`;\n  const entries = Object.entries(value as Record<string, unknown>)\n    .filter(([, entry]) => entry !== undefined)\n    .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));\n  return `{${entries.map(([key, entry]) => `${JSON.stringify(key)}:${canonicalJson(entry)}`).join(\",\")}}`;\n}\n\nasync function hmacHex(key: string, message: string): Promise<string> {\n  const encoder = new TextEncoder();\n  const cryptoKey = await crypto.subtle.importKey(\n    \"raw\",\n    encoder.encode(key),\n    { name: \"HMAC\", hash: \"SHA-256\" },\n    false,\n    [\"sign\"],\n  );\n  const mac = new Uint8Array(await crypto.subtle.sign(\"HMAC\", cryptoKey, encoder.encode(message)));\n  return Array.from(mac, (byte) => byte.toString(16).padStart(2, \"0\")).join(\"\");\n}\n\n/**\n * Keyed digest of one mutation's exact scope: connection, provider, trusted\n * caller tuple and operation (without its idempotency key). Keyed so the\n * store never holds a plain hash of submitted secret values.\n */\nexport async function externalVaultMutationDigest(input: {\n  signingSecret: string;\n  request: VaultProviderWireRequest;\n}): Promise<string> {\n  const { request } = input;\n  const { idempotencyKey: _ignored, ...operation } = request.operation as Extract<\n    VaultProviderWireOperation,\n    { idempotencyKey: string }\n  >;\n  return hmacHex(\n    `${input.signingSecret}\\u0000${VAULT_PROVIDER_WIRE_VERSION}.idempotency`,\n    canonicalJson({\n      connectionId: request.connectionId.toLowerCase(),\n      provider: request.provider,\n      accountId: request.authority.accountId,\n      workspaceId: request.authority.workspaceId,\n      subjectId: request.authority.subjectId,\n      connectionWorkspaceId: request.authority.connectionWorkspaceId,\n      operation,\n    }),\n  );\n}\n\nfunction pick<T extends object, K extends keyof T>(value: T, keys: readonly K[]): Pick<T, K> {\n  const out = {} as Pick<T, K>;\n  for (const key of keys) if (value[key] !== undefined) out[key] = value[key];\n  return out;\n}\n\n/** Project handler output to known wire keys only; values never ride along. */\nfunction project(op: VaultProviderWireOperationName, raw: unknown): unknown {\n  if (!raw || typeof raw !== \"object\") return raw;\n  const result = raw as Record<string, any>;\n  const field = (f: any) =>\n    f && typeof f === \"object\" ? pick(f, [\"externalFieldId\", \"name\", \"kind\"]) : f;\n  const item = (i: any) =>\n    i && typeof i === \"object\"\n      ? {\n          ...pick(i, [\"externalItemId\", \"name\", \"type\", \"websites\", \"version\", \"updatedAt\"]),\n          fields: Array.isArray(i.fields) ? i.fields.map(field) : i.fields,\n        }\n      : i;\n  const vault = (v: any) =>\n    v && typeof v === \"object\"\n      ? pick(v, [\n          \"externalVaultId\",\n          \"name\",\n          \"contentVersion\",\n          \"itemCount\",\n          \"writeAccess\",\n          \"operations\",\n        ])\n      : v;\n  switch (op) {\n    case \"describe\":\n      return pick(result, [\n        \"accountId\",\n        \"accountName\",\n        \"operations\",\n        \"capabilities\",\n        \"inventoryScope\",\n      ]);\n    case \"refresh\":\n      return pick(result, [\"refreshed\"]);\n    case \"list_vaults\":\n    case \"list_items\":\n      return {\n        ...pick(result, [\"nextCursor\", \"snapshot\"]),\n        items: Array.isArray(result.items)\n          ? result.items.map(op === \"list_vaults\" ? vault : item)\n          : result.items,\n      };\n    case \"read_fields\":\n      return {\n        fields: Array.isArray(result.fields)\n          ? result.fields.map((f: any) =>\n              f && typeof f === \"object\" ? pick(f, [\"externalFieldId\", \"value\"]) : f,\n            )\n          : result.fields,\n      };\n    case \"write_item\":\n      return { item: item(result.item) };\n    case \"archive_item\":\n      return pick(result, [\"archived\"]);\n  }\n}\n\n/** Mirrors Opengeni's secret-name rule: usable item/field names from upstream titles. */\nexport function safeExternalVaultName(raw: string, fallback = \"Untitled\"): string {\n  // oxlint-disable-next-line no-control-regex\n  const forbidden = /[/{}#\\\\\\u0000-\\u001f\\u007f-\\u009f]/g;\n  const clean = (value: string) =>\n    [...value.replace(forbidden, \"-\").trim()].slice(0, 120).join(\"\").trim();\n  let name = clean(typeof raw === \"string\" ? raw : \"\");\n  if (!name) name = clean(fallback) || \"Untitled\";\n  if (/^id:/i.test(name)) name = `id-${name.slice(3)}`;\n  return name;\n}\n\n/** A safe field name, unique case-insensitively within `taken` (which it updates). */\nexport function uniqueExternalVaultFieldName(raw: string, taken: Set<string>, fallback = \"field\") {\n  let base = safeExternalVaultName(raw, fallback);\n  if (vaultProviderWireNameKey(base) === \"otp\") base = \"otp-code\";\n  let candidate = base;\n  for (let n = 2; taken.has(vaultProviderWireNameKey(candidate)); n += 1) {\n    const suffix = ` (${n})`;\n    candidate = `${[...base].slice(0, 120 - suffix.length).join(\"\")}${suffix}`;\n  }\n  taken.add(vaultProviderWireNameKey(candidate));\n  return candidate;\n}\n\n/**\n * Process-local store for tests, development and a single-process bridge\n * that accepts losing replay/idempotency memory on restart. It is not durable.\n */\nexport function createInMemoryExternalVaultReceiverStore(\n  options: { maxEntries?: number; now?: () => number } = {},\n): ExternalVaultReceiverStore & { size(): number } {\n  const maxEntries = options.maxEntries ?? 10_000;\n  const now = options.now ?? (() => Date.now());\n  const requests = new Map<string, number>();\n  const mutations = new Map<\n    string,\n    { digest: string; expiresAt: number; state: \"pending\" | \"completed\"; result?: unknown }\n  >();\n  const prune = () => {\n    const t = now();\n    for (const [key, expiresAt] of requests) if (expiresAt <= t) requests.delete(key);\n    for (const [key, entry] of mutations) if (entry.expiresAt <= t) mutations.delete(key);\n  };\n  const full = () => requests.size + mutations.size >= maxEntries;\n  return {\n    size: () => requests.size + mutations.size,\n    async rememberRequest({ connectionId, requestId, expiresAt }) {\n      prune();\n      const key = `${connectionId}\\u0000${requestId}`;\n      if (requests.has(key)) return false;\n      // Refuse rather than forget: forgetting would reopen a replay window.\n      if (full()) throw new ExternalVaultReceiverError(\"provider_rate_limited\");\n      requests.set(key, expiresAt.getTime());\n      return true;\n    },\n    async claimMutation({ connectionId, idempotencyKey, digest, expiresAt }) {\n      prune();\n      const key = `${connectionId}\\u0000${idempotencyKey}`;\n      const existing = mutations.get(key);\n      if (existing) {\n        if (existing.digest !== digest) return { state: \"mismatch\" };\n        return existing.state === \"completed\"\n          ? { state: \"completed\", result: structuredClone(existing.result) }\n          : { state: \"pending\" };\n      }\n      if (full()) throw new ExternalVaultReceiverError(\"provider_rate_limited\");\n      mutations.set(key, { digest, expiresAt: expiresAt.getTime(), state: \"pending\" });\n      return { state: \"claimed\" };\n    },\n    async completeMutation({ connectionId, idempotencyKey, digest, result }) {\n      const entry = mutations.get(`${connectionId}\\u0000${idempotencyKey}`);\n      if (!entry || entry.digest !== digest) throw new Error(\"mutation claim missing\");\n      entry.state = \"completed\";\n      entry.result = structuredClone(result);\n    },\n    async releaseMutation({ connectionId, idempotencyKey, digest }) {\n      const key = `${connectionId}\\u0000${idempotencyKey}`;\n      if (mutations.get(key)?.digest === digest) mutations.delete(key);\n    },\n  };\n}\n\nfunction operationTarget(operation: VaultProviderWireOperation) {\n  return {\n    op: operation.op,\n    ...(\"externalVaultId\" in operation ? { externalVaultId: operation.externalVaultId } : {}),\n    ...(\"externalItemId\" in operation ? { externalItemId: operation.externalItemId } : {}),\n    ...(operation.op === \"write_item\" && operation.item.externalItemId\n      ? { externalItemId: operation.item.externalItemId }\n      : {}),\n  };\n}\n\nexport function createExternalVaultReceiver<TConnection, TPrincipal>(\n  options: ExternalVaultReceiverOptions<TConnection, TPrincipal>,\n): ExternalVaultReceiver {\n  const now = options.now ?? (() => Date.now());\n  const tolerance = VAULT_PROVIDER_WIRE_LIMITS.signatureToleranceSeconds;\n  const retentionMs = Math.max(options.mutationRetentionMs ?? 86_400_000, tolerance * 2_000);\n  const report = (\n    stage: \"authorize\" | \"handler\" | \"store\" | \"output\",\n    op: VaultProviderWireOperationName,\n    connectionId: string,\n    error: unknown,\n  ) => {\n    try {\n      options.onError?.({ stage, op, connectionId, error });\n    } catch {\n      // Diagnostics never change the protocol outcome.\n    }\n  };\n\n  async function signed(\n    secret: string,\n    response: VaultProviderWireSuccess | VaultProviderWireFailure,\n  ): Promise<ExternalVaultReceiverHttpResponse> {\n    const body = JSON.stringify(response);\n    const signature = await signOpenGeniPayload(\n      vaultProviderWireResponseKey(secret),\n      body,\n      Math.floor(now() / 1000),\n    );\n    return {\n      status: 200,\n      headers: { ...JSON_HEADERS, [VAULT_PROVIDER_WIRE_RESPONSE_SIGNATURE_HEADER]: signature },\n      body,\n    };\n  }\n\n  async function handle(\n    request: ExternalVaultReceiverHttpRequest,\n  ): Promise<ExternalVaultReceiverHttpResponse> {\n    if (typeof request.body !== \"string\") return plain(400, \"invalid_request\");\n    if (vaultProviderWireUtf8Bytes(request.body) > VAULT_PROVIDER_WIRE_LIMITS.maxRequestBytes) {\n      return plain(413, \"request_too_large\");\n    }\n    const signature = headerValue(request.headers, OPENGENI_SIGNATURE_HEADER);\n    if (!signature) return plain(401, \"unauthorized\");\n    let raw: unknown;\n    try {\n      raw = JSON.parse(request.body);\n    } catch {\n      return plain(400, \"invalid_request\");\n    }\n    const claimedConnectionId =\n      raw && typeof raw === \"object\" ? (raw as { connectionId?: unknown }).connectionId : undefined;\n    if (typeof claimedConnectionId !== \"string\" || !UUID.test(claimedConnectionId)) {\n      return plain(401, \"unauthorized\");\n    }\n    const connectionId = claimedConnectionId.toLowerCase();\n    let connection: ExternalVaultReceiverConnection<TConnection> | null;\n    try {\n      connection = await options.resolveConnection(connectionId);\n    } catch (error) {\n      report(\"store\", \"describe\", connectionId, error);\n      return plain(503, \"unavailable\");\n    }\n    if (!connection || connection.signingSecrets.length === 0) return plain(401, \"unauthorized\");\n    let secret: string | null = null;\n    for (const candidate of connection.signingSecrets.slice(0, 4)) {\n      if (\n        await verifyOpenGeniSignature({\n          secret: candidate,\n          body: request.body,\n          signature,\n          toleranceSeconds: tolerance,\n          nowSeconds: Math.floor(now() / 1000),\n        })\n      ) {\n        secret = candidate;\n        break;\n      }\n    }\n    if (!secret) return plain(401, \"unauthorized\");\n    const parsed = VaultProviderWireRequest.safeParse(raw);\n    if (!parsed.success) return plain(400, \"invalid_request\");\n    const wire = parsed.data;\n    const op = wire.operation.op;\n    const sentAt = Date.parse(wire.sentAt);\n    if (!Number.isFinite(sentAt) || Math.abs(now() - sentAt) > tolerance * 1000) {\n      return plain(401, \"unauthorized\");\n    }\n\n    const failure = (\n      code: VaultProviderWireErrorCode,\n      extra: { retryAfterMs?: number | null; freshness?: VaultProviderWireFreshness | null } = {},\n    ) =>\n      signed(secret!, {\n        version: VAULT_PROVIDER_WIRE_VERSION,\n        type: \"response\",\n        requestId: wire.requestId,\n        ok: false,\n        op,\n        error: { code, retryAfterMs: extra.retryAfterMs ?? null },\n        // Host-supplied freshness is validated like handler output; invalid is dropped.\n        freshness:\n          extra.freshness == null\n            ? null\n            : (VaultProviderWireFreshness.safeParse(extra.freshness).data ?? null),\n      });\n\n    try {\n      const fresh = await options.store.rememberRequest({\n        connectionId,\n        requestId: wire.requestId,\n        expiresAt: new Date(now() + tolerance * 2_000),\n      });\n      if (!fresh) return plain(409, \"replayed_request\");\n    } catch (error) {\n      report(\"store\", op, connectionId, error);\n      if (error instanceof ExternalVaultReceiverError) return failure(error.code);\n      return failure(\"provider_unavailable\");\n    }\n\n    if (\n      wire.provider !== connection.provider ||\n      (connection.accountId !== undefined && wire.authority.accountId !== connection.accountId) ||\n      (connection.connectionWorkspaceId !== undefined &&\n        wire.authority.connectionWorkspaceId !== connection.connectionWorkspaceId)\n    ) {\n      return failure(\"provider_permission_denied\");\n    }\n\n    let principal: TPrincipal | null;\n    try {\n      principal = await options.authorize({\n        connectionId,\n        connection: connection.context,\n        authority: wire.authority,\n        operation: operationTarget(wire.operation),\n        requestId: wire.requestId,\n      });\n    } catch (error) {\n      report(\"authorize\", op, connectionId, error);\n      if (error instanceof ExternalVaultReceiverError) return failure(error.code);\n      return failure(\"provider_unavailable\");\n    }\n    if (principal === null || principal === undefined) {\n      return failure(\"provider_permission_denied\");\n    }\n\n    const inventory: ExternalVaultInventoryContext<TConnection> = {\n      connectionId,\n      connection: connection.context,\n      requestId: wire.requestId,\n      ...(request.signal ? { signal: request.signal } : {}),\n    };\n    const call: ExternalVaultCallContext<TConnection, TPrincipal> = {\n      ...inventory,\n      principal,\n      authority: wire.authority,\n    };\n\n    const respond = async (\n      output: ExternalVaultHandlerOutput<unknown>,\n    ): Promise<\n      | { ok: true; response: ExternalVaultReceiverHttpResponse; result: unknown }\n      | { ok: false; code: VaultProviderWireErrorCode }\n    > => {\n      const projected = project(op, output?.result);\n      const result = VaultProviderWireResults[op].safeParse(projected);\n      const freshness =\n        output?.freshness == null ? null : VaultProviderWireFreshness.safeParse(output.freshness);\n      if (!result.success || (freshness && !freshness.success)) {\n        report(\"output\", op, connectionId, result.error ?? freshness?.error);\n        return { ok: false, code: \"provider_unavailable\" };\n      }\n      const consistency = checkConsistency(wire.operation, result.data);\n      if (consistency) return { ok: false, code: consistency };\n      return {\n        ok: true,\n        result: result.data,\n        response: await signed(secret!, {\n          version: VAULT_PROVIDER_WIRE_VERSION,\n          type: \"response\",\n          requestId: wire.requestId,\n          ok: true,\n          op,\n          result: result.data,\n          freshness: freshness ? freshness.data : null,\n        } as VaultProviderWireSuccess),\n      };\n    };\n\n    if (!isVaultProviderWireMutation(op)) {\n      try {\n        const output = await runRead(wire.operation, inventory, call);\n        if (!output) return failure(\"provider_permission_denied\");\n        const outcome = await respond(output);\n        return outcome.ok ? outcome.response : failure(outcome.code);\n      } catch (error) {\n        if (error instanceof ExternalVaultReceiverError) {\n          return failure(error.code, {\n            retryAfterMs: error.retryAfterMs,\n            freshness: error.freshness,\n          });\n        }\n        report(\"handler\", op, connectionId, error);\n        return failure(\"provider_unavailable\");\n      }\n    }\n\n    const mutation = wire.operation as VaultProviderWireOperationOf<\"write_item\" | \"archive_item\">;\n    const handler =\n      mutation.op === \"write_item\" ? options.handlers.writeItem : options.handlers.archiveItem;\n    if (!handler) return failure(\"provider_permission_denied\");\n    const digest = await externalVaultMutationDigest({ signingSecret: secret, request: wire });\n    const key = { connectionId, idempotencyKey: mutation.idempotencyKey, digest };\n    let claim: ExternalVaultMutationClaim;\n    try {\n      claim = await options.store.claimMutation({\n        ...key,\n        expiresAt: new Date(now() + retentionMs),\n      });\n    } catch (error) {\n      report(\"store\", op, connectionId, error);\n      // Nothing was claimed or run.\n      return failure(\n        error instanceof ExternalVaultReceiverError ? error.code : \"provider_unavailable\",\n      );\n    }\n    if (claim.state === \"mismatch\") return failure(\"provider_conflict\");\n    if (claim.state === \"pending\") return failure(\"provider_outcome_unknown\");\n    if (claim.state === \"completed\") {\n      const outcome = await respond({ result: claim.result });\n      return outcome.ok ? outcome.response : failure(\"provider_outcome_unknown\");\n    }\n\n    let output: ExternalVaultHandlerOutput<unknown>;\n    try {\n      output =\n        mutation.op === \"write_item\"\n          ? await options.handlers.writeItem!(call, {\n              externalVaultId: mutation.externalVaultId,\n              item: mutation.item,\n              idempotencyKey: mutation.idempotencyKey,\n            })\n          : await options.handlers.archiveItem!(call, {\n              externalVaultId: mutation.externalVaultId,\n              externalItemId: mutation.externalItemId,\n              idempotencyKey: mutation.idempotencyKey,\n            });\n    } catch (error) {\n      if (\n        error instanceof ExternalVaultReceiverError &&\n        error.code !== \"provider_outcome_unknown\"\n      ) {\n        // Definite failure: the key may be used again.\n        try {\n          await options.store.releaseMutation(key);\n        } catch (storeError) {\n          report(\"store\", op, connectionId, storeError);\n        }\n        return failure(error.code, {\n          retryAfterMs: error.retryAfterMs,\n          freshness: error.freshness,\n        });\n      }\n      // Unknown: keep the claim pending so a repeat cannot apply it twice.\n      report(\"handler\", op, connectionId, error);\n      return failure(\"provider_outcome_unknown\");\n    }\n    const outcome = await respond(output);\n    if (!outcome.ok) return failure(\"provider_outcome_unknown\");\n    try {\n      await options.store.completeMutation({ ...key, result: outcome.result });\n    } catch (error) {\n      report(\"store\", op, connectionId, error);\n    }\n    return outcome.response;\n  }\n\n  async function runRead(\n    operation: VaultProviderWireOperation,\n    inventory: ExternalVaultInventoryContext<TConnection>,\n    call: ExternalVaultCallContext<TConnection, TPrincipal>,\n  ): Promise<ExternalVaultHandlerOutput<unknown> | null> {\n    const handlers = options.handlers;\n    switch (operation.op) {\n      case \"describe\":\n        return handlers.describe(inventory);\n      case \"refresh\":\n        return handlers.refresh ? handlers.refresh(inventory) : null;\n      case \"list_vaults\":\n        return handlers.listVaults(inventory, {\n          page: operation.page,\n          forceRefresh: operation.forceRefresh,\n          cacheEpoch: operation.cacheEpoch,\n        });\n      case \"list_items\":\n        return handlers.listItems(inventory, {\n          externalVaultId: operation.externalVaultId,\n          page: operation.page,\n          forceRefresh: operation.forceRefresh,\n          cacheEpoch: operation.cacheEpoch,\n        });\n      case \"read_fields\":\n        return handlers.readFields(call, {\n          externalVaultId: operation.externalVaultId,\n          externalItemId: operation.externalItemId,\n          externalFieldIds: operation.externalFieldIds,\n          forceRefresh: operation.forceRefresh,\n          cacheEpoch: operation.cacheEpoch,\n        });\n      default:\n        return null;\n    }\n  }\n\n  return {\n    handle,\n    async fetch(request) {\n      if (request.method !== \"POST\") {\n        return new Response(JSON.stringify({ error: \"method_not_allowed\" }), {\n          status: 405,\n          headers: { ...JSON_HEADERS, allow: \"POST\" },\n        });\n      }\n      const max = VAULT_PROVIDER_WIRE_LIMITS.maxRequestBytes;\n      const declared = Number(request.headers.get(\"content-length\") ?? \"0\");\n      if (Number.isFinite(declared) && declared > max) {\n        await request.body?.cancel().catch(() => {});\n        const response = plain(413, \"request_too_large\");\n        return new Response(response.body, { status: response.status, headers: response.headers });\n      }\n      const chunks: Uint8Array[] = [];\n      let total = 0;\n      const reader = request.body?.getReader();\n      if (reader) {\n        for (;;) {\n          const { done, value } = await reader.read();\n          if (done) break;\n          total += value.byteLength;\n          if (total > max) {\n            await reader.cancel().catch(() => {});\n            const response = plain(413, \"request_too_large\");\n            return new Response(response.body, {\n              status: response.status,\n              headers: response.headers,\n            });\n          }\n          chunks.push(value);\n        }\n      }\n      const bytes = new Uint8Array(total);\n      let offset = 0;\n      for (const chunk of chunks) {\n        bytes.set(chunk, offset);\n        offset += chunk.byteLength;\n      }\n      let body: string;\n      try {\n        body = new TextDecoder(\"utf-8\", { fatal: true }).decode(bytes);\n      } catch {\n        const response = plain(400, \"invalid_request\");\n        return new Response(response.body, { status: response.status, headers: response.headers });\n      }\n      const response = await handle({ body, headers: request.headers, signal: request.signal });\n      return new Response(response.body, { status: response.status, headers: response.headers });\n    },\n  };\n}\n\n/** Cross-checks the schema cannot express on its own. */\nfunction checkConsistency(\n  operation: VaultProviderWireOperation,\n  result: unknown,\n): VaultProviderWireErrorCode | null {\n  switch (operation.op) {\n    case \"list_vaults\":\n    case \"list_items\": {\n      const page = result as VaultProviderWireResult<\"list_items\" | \"list_vaults\">;\n      if (page.items.length > operation.page.limit) return \"provider_unavailable\";\n      const ids = new Set<string>();\n      for (const entry of page.items as Array<{\n        externalVaultId?: string;\n        externalItemId?: string;\n      }>) {\n        const id = entry.externalVaultId ?? entry.externalItemId ?? \"\";\n        if (ids.has(id)) return \"provider_unavailable\";\n        ids.add(id);\n      }\n      return null;\n    }\n    case \"read_fields\": {\n      const fields = (result as VaultProviderWireResult<\"read_fields\">).fields;\n      const requested = new Set(operation.externalFieldIds);\n      if (fields.some((field) => !requested.has(field.externalFieldId))) {\n        return \"provider_unavailable\";\n      }\n      return fields.length === requested.size ? null : \"provider_not_found\";\n    }\n    case \"write_item\": {\n      const item = (result as VaultProviderWireResult<\"write_item\">).item;\n      const expected = operation.item.externalItemId;\n      return expected !== undefined && item.externalItemId !== expected\n        ? \"provider_outcome_unknown\"\n        : null;\n    }\n    default:\n      return null;\n  }\n}\n"],"mappings":";;;;;;;AAuBA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAYK;AAEP;AAAA,EACE;AAAA,EACA,8BAAAA;AAAA,EACA,iDAAAC;AAAA,EACA,+BAAAC;AAAA,EACA,gCAAAC;AAAA,OACK;AAsBA,IAAM,6BAAN,cAAyC,MAAM;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACT,YACE,MACA,UAII,CAAC,GACL;AACA,UAAM,QAAQ,WAAW,IAAI;AAC7B,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,eACH,QAAQ,iBAAiB,SACrB,OACA,KAAK,IAAI,KAAK,IAAI,KAAK,MAAM,QAAQ,YAAY,GAAG,CAAC,GAAG,KAAU;AACxE,SAAK,YAAY,QAAQ,aAAa;AAAA,EACxC;AACF;AAkLA,IAAM,eAAe,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAW;AACvF,IAAM,OAAO;AAEb,SAAS,MAAM,QAAgB,OAAkD;AAC/E,SAAO,EAAE,QAAQ,SAAS,EAAE,GAAG,aAAa,GAAG,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC,EAAE;AACjF;AAEA,SAAS,YAAY,SAAsD,MAAc;AACvF,MAAI,mBAAmB,QAAS,QAAO,QAAQ,IAAI,IAAI;AACvD,QAAM,SAAS,KAAK,YAAY;AAChC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,IAAI,YAAY,MAAM,QAAQ;AAChC,aAAO,MAAM,QAAQ,KAAK,IACtB,MAAM,WAAW,IACd,MAAM,CAAC,KAAK,OACb,OACD,SAAS;AAAA,IAChB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,cAAc,OAAwB;AAC7C,MAAI,UAAU,QAAQ,OAAO,UAAU,SAAU,QAAO,KAAK,UAAU,KAAK;AAC5E,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,IAAI,MAAM,IAAI,aAAa,EAAE,KAAK,GAAG,CAAC;AACvE,QAAM,UAAU,OAAO,QAAQ,KAAgC,EAC5D,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,UAAU,MAAS,EACzC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAO,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,CAAE;AAClD,SAAO,IAAI,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,GAAG,KAAK,UAAU,GAAG,CAAC,IAAI,cAAc,KAAK,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC;AACtG;AAEA,eAAe,QAAQ,KAAa,SAAkC;AACpE,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,YAAY,MAAM,OAAO,OAAO;AAAA,IACpC;AAAA,IACA,QAAQ,OAAO,GAAG;AAAA,IAClB,EAAE,MAAM,QAAQ,MAAM,UAAU;AAAA,IAChC;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AACA,QAAM,MAAM,IAAI,WAAW,MAAM,OAAO,OAAO,KAAK,QAAQ,WAAW,QAAQ,OAAO,OAAO,CAAC,CAAC;AAC/F,SAAO,MAAM,KAAK,KAAK,CAAC,SAAS,KAAK,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC9E;AAOA,eAAsB,4BAA4B,OAG9B;AAClB,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,EAAE,gBAAgB,UAAU,GAAG,UAAU,IAAI,QAAQ;AAI3D,SAAO;AAAA,IACL,GAAG,MAAM,aAAa,KAAS,2BAA2B;AAAA,IAC1D,cAAc;AAAA,MACZ,cAAc,QAAQ,aAAa,YAAY;AAAA,MAC/C,UAAU,QAAQ;AAAA,MAClB,WAAW,QAAQ,UAAU;AAAA,MAC7B,aAAa,QAAQ,UAAU;AAAA,MAC/B,WAAW,QAAQ,UAAU;AAAA,MAC7B,uBAAuB,QAAQ,UAAU;AAAA,MACzC;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEA,SAAS,KAA0C,OAAU,MAAgC;AAC3F,QAAM,MAAM,CAAC;AACb,aAAW,OAAO,KAAM,KAAI,MAAM,GAAG,MAAM,OAAW,KAAI,GAAG,IAAI,MAAM,GAAG;AAC1E,SAAO;AACT;AAGA,SAAS,QAAQ,IAAoC,KAAuB;AAC1E,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,SAAS;AACf,QAAM,QAAQ,CAAC,MACb,KAAK,OAAO,MAAM,WAAW,KAAK,GAAG,CAAC,mBAAmB,QAAQ,MAAM,CAAC,IAAI;AAC9E,QAAM,OAAO,CAAC,MACZ,KAAK,OAAO,MAAM,WACd;AAAA,IACE,GAAG,KAAK,GAAG,CAAC,kBAAkB,QAAQ,QAAQ,YAAY,WAAW,WAAW,CAAC;AAAA,IACjF,QAAQ,MAAM,QAAQ,EAAE,MAAM,IAAI,EAAE,OAAO,IAAI,KAAK,IAAI,EAAE;AAAA,EAC5D,IACA;AACN,QAAM,QAAQ,CAAC,MACb,KAAK,OAAO,MAAM,WACd,KAAK,GAAG;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,IACD;AACN,UAAQ,IAAI;AAAA,IACV,KAAK;AACH,aAAO,KAAK,QAAQ;AAAA,QAClB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH,KAAK;AACH,aAAO,KAAK,QAAQ,CAAC,WAAW,CAAC;AAAA,IACnC,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,QACL,GAAG,KAAK,QAAQ,CAAC,cAAc,UAAU,CAAC;AAAA,QAC1C,OAAO,MAAM,QAAQ,OAAO,KAAK,IAC7B,OAAO,MAAM,IAAI,OAAO,gBAAgB,QAAQ,IAAI,IACpD,OAAO;AAAA,MACb;AAAA,IACF,KAAK;AACH,aAAO;AAAA,QACL,QAAQ,MAAM,QAAQ,OAAO,MAAM,IAC/B,OAAO,OAAO;AAAA,UAAI,CAAC,MACjB,KAAK,OAAO,MAAM,WAAW,KAAK,GAAG,CAAC,mBAAmB,OAAO,CAAC,IAAI;AAAA,QACvE,IACA,OAAO;AAAA,MACb;AAAA,IACF,KAAK;AACH,aAAO,EAAE,MAAM,KAAK,OAAO,IAAI,EAAE;AAAA,IACnC,KAAK;AACH,aAAO,KAAK,QAAQ,CAAC,UAAU,CAAC;AAAA,EACpC;AACF;AAGO,SAAS,sBAAsB,KAAa,WAAW,YAAoB;AAEhF,QAAM,YAAY;AAClB,QAAM,QAAQ,CAAC,UACb,CAAC,GAAG,MAAM,QAAQ,WAAW,GAAG,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,GAAG,EAAE,KAAK,EAAE,EAAE,KAAK;AACxE,MAAI,OAAO,MAAM,OAAO,QAAQ,WAAW,MAAM,EAAE;AACnD,MAAI,CAAC,KAAM,QAAO,MAAM,QAAQ,KAAK;AACrC,MAAI,QAAQ,KAAK,IAAI,EAAG,QAAO,MAAM,KAAK,MAAM,CAAC,CAAC;AAClD,SAAO;AACT;AAGO,SAAS,6BAA6B,KAAa,OAAoB,WAAW,SAAS;AAChG,MAAI,OAAO,sBAAsB,KAAK,QAAQ;AAC9C,MAAI,yBAAyB,IAAI,MAAM,MAAO,QAAO;AACrD,MAAI,YAAY;AAChB,WAAS,IAAI,GAAG,MAAM,IAAI,yBAAyB,SAAS,CAAC,GAAG,KAAK,GAAG;AACtE,UAAM,SAAS,KAAK,CAAC;AACrB,gBAAY,GAAG,CAAC,GAAG,IAAI,EAAE,MAAM,GAAG,MAAM,OAAO,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM;AAAA,EAC1E;AACA,QAAM,IAAI,yBAAyB,SAAS,CAAC;AAC7C,SAAO;AACT;AAMO,SAAS,yCACd,UAAuD,CAAC,GACP;AACjD,QAAM,aAAa,QAAQ,cAAc;AACzC,QAAM,MAAM,QAAQ,QAAQ,MAAM,KAAK,IAAI;AAC3C,QAAM,WAAW,oBAAI,IAAoB;AACzC,QAAM,YAAY,oBAAI,IAGpB;AACF,QAAM,QAAQ,MAAM;AAClB,UAAM,IAAI,IAAI;AACd,eAAW,CAAC,KAAK,SAAS,KAAK,SAAU,KAAI,aAAa,EAAG,UAAS,OAAO,GAAG;AAChF,eAAW,CAAC,KAAK,KAAK,KAAK,UAAW,KAAI,MAAM,aAAa,EAAG,WAAU,OAAO,GAAG;AAAA,EACtF;AACA,QAAM,OAAO,MAAM,SAAS,OAAO,UAAU,QAAQ;AACrD,SAAO;AAAA,IACL,MAAM,MAAM,SAAS,OAAO,UAAU;AAAA,IACtC,MAAM,gBAAgB,EAAE,cAAc,WAAW,UAAU,GAAG;AAC5D,YAAM;AACN,YAAM,MAAM,GAAG,YAAY,KAAS,SAAS;AAC7C,UAAI,SAAS,IAAI,GAAG,EAAG,QAAO;AAE9B,UAAI,KAAK,EAAG,OAAM,IAAI,2BAA2B,uBAAuB;AACxE,eAAS,IAAI,KAAK,UAAU,QAAQ,CAAC;AACrC,aAAO;AAAA,IACT;AAAA,IACA,MAAM,cAAc,EAAE,cAAc,gBAAgB,QAAQ,UAAU,GAAG;AACvE,YAAM;AACN,YAAM,MAAM,GAAG,YAAY,KAAS,cAAc;AAClD,YAAM,WAAW,UAAU,IAAI,GAAG;AAClC,UAAI,UAAU;AACZ,YAAI,SAAS,WAAW,OAAQ,QAAO,EAAE,OAAO,WAAW;AAC3D,eAAO,SAAS,UAAU,cACtB,EAAE,OAAO,aAAa,QAAQ,gBAAgB,SAAS,MAAM,EAAE,IAC/D,EAAE,OAAO,UAAU;AAAA,MACzB;AACA,UAAI,KAAK,EAAG,OAAM,IAAI,2BAA2B,uBAAuB;AACxE,gBAAU,IAAI,KAAK,EAAE,QAAQ,WAAW,UAAU,QAAQ,GAAG,OAAO,UAAU,CAAC;AAC/E,aAAO,EAAE,OAAO,UAAU;AAAA,IAC5B;AAAA,IACA,MAAM,iBAAiB,EAAE,cAAc,gBAAgB,QAAQ,OAAO,GAAG;AACvE,YAAM,QAAQ,UAAU,IAAI,GAAG,YAAY,KAAS,cAAc,EAAE;AACpE,UAAI,CAAC,SAAS,MAAM,WAAW,OAAQ,OAAM,IAAI,MAAM,wBAAwB;AAC/E,YAAM,QAAQ;AACd,YAAM,SAAS,gBAAgB,MAAM;AAAA,IACvC;AAAA,IACA,MAAM,gBAAgB,EAAE,cAAc,gBAAgB,OAAO,GAAG;AAC9D,YAAM,MAAM,GAAG,YAAY,KAAS,cAAc;AAClD,UAAI,UAAU,IAAI,GAAG,GAAG,WAAW,OAAQ,WAAU,OAAO,GAAG;AAAA,IACjE;AAAA,EACF;AACF;AAEA,SAAS,gBAAgB,WAAuC;AAC9D,SAAO;AAAA,IACL,IAAI,UAAU;AAAA,IACd,GAAI,qBAAqB,YAAY,EAAE,iBAAiB,UAAU,gBAAgB,IAAI,CAAC;AAAA,IACvF,GAAI,oBAAoB,YAAY,EAAE,gBAAgB,UAAU,eAAe,IAAI,CAAC;AAAA,IACpF,GAAI,UAAU,OAAO,gBAAgB,UAAU,KAAK,iBAChD,EAAE,gBAAgB,UAAU,KAAK,eAAe,IAChD,CAAC;AAAA,EACP;AACF;AAEO,SAAS,4BACd,SACuB;AACvB,QAAM,MAAM,QAAQ,QAAQ,MAAM,KAAK,IAAI;AAC3C,QAAM,YAAY,2BAA2B;AAC7C,QAAM,cAAc,KAAK,IAAI,QAAQ,uBAAuB,OAAY,YAAY,GAAK;AACzF,QAAM,SAAS,CACb,OACA,IACA,cACA,UACG;AACH,QAAI;AACF,cAAQ,UAAU,EAAE,OAAO,IAAI,cAAc,MAAM,CAAC;AAAA,IACtD,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,iBAAe,OACb,QACA,UAC4C;AAC5C,UAAM,OAAO,KAAK,UAAU,QAAQ;AACpC,UAAM,YAAY,MAAM;AAAA,MACtB,6BAA6B,MAAM;AAAA,MACnC;AAAA,MACA,KAAK,MAAM,IAAI,IAAI,GAAI;AAAA,IACzB;AACA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS,EAAE,GAAG,cAAc,CAAC,6CAA6C,GAAG,UAAU;AAAA,MACvF;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,OACb,SAC4C;AAC5C,QAAI,OAAO,QAAQ,SAAS,SAAU,QAAO,MAAM,KAAK,iBAAiB;AACzE,QAAI,2BAA2B,QAAQ,IAAI,IAAI,2BAA2B,iBAAiB;AACzF,aAAO,MAAM,KAAK,mBAAmB;AAAA,IACvC;AACA,UAAM,YAAY,YAAY,QAAQ,SAAS,yBAAyB;AACxE,QAAI,CAAC,UAAW,QAAO,MAAM,KAAK,cAAc;AAChD,QAAI;AACJ,QAAI;AACF,YAAM,KAAK,MAAM,QAAQ,IAAI;AAAA,IAC/B,QAAQ;AACN,aAAO,MAAM,KAAK,iBAAiB;AAAA,IACrC;AACA,UAAM,sBACJ,OAAO,OAAO,QAAQ,WAAY,IAAmC,eAAe;AACtF,QAAI,OAAO,wBAAwB,YAAY,CAAC,KAAK,KAAK,mBAAmB,GAAG;AAC9E,aAAO,MAAM,KAAK,cAAc;AAAA,IAClC;AACA,UAAM,eAAe,oBAAoB,YAAY;AACrD,QAAI;AACJ,QAAI;AACF,mBAAa,MAAM,QAAQ,kBAAkB,YAAY;AAAA,IAC3D,SAAS,OAAO;AACd,aAAO,SAAS,YAAY,cAAc,KAAK;AAC/C,aAAO,MAAM,KAAK,aAAa;AAAA,IACjC;AACA,QAAI,CAAC,cAAc,WAAW,eAAe,WAAW,EAAG,QAAO,MAAM,KAAK,cAAc;AAC3F,QAAI,SAAwB;AAC5B,eAAW,aAAa,WAAW,eAAe,MAAM,GAAG,CAAC,GAAG;AAC7D,UACE,MAAM,wBAAwB;AAAA,QAC5B,QAAQ;AAAA,QACR,MAAM,QAAQ;AAAA,QACd;AAAA,QACA,kBAAkB;AAAA,QAClB,YAAY,KAAK,MAAM,IAAI,IAAI,GAAI;AAAA,MACrC,CAAC,GACD;AACA,iBAAS;AACT;AAAA,MACF;AAAA,IACF;AACA,QAAI,CAAC,OAAQ,QAAO,MAAM,KAAK,cAAc;AAC7C,UAAM,SAAS,yBAAyB,UAAU,GAAG;AACrD,QAAI,CAAC,OAAO,QAAS,QAAO,MAAM,KAAK,iBAAiB;AACxD,UAAM,OAAO,OAAO;AACpB,UAAM,KAAK,KAAK,UAAU;AAC1B,UAAM,SAAS,KAAK,MAAM,KAAK,MAAM;AACrC,QAAI,CAAC,OAAO,SAAS,MAAM,KAAK,KAAK,IAAI,IAAI,IAAI,MAAM,IAAI,YAAY,KAAM;AAC3E,aAAO,MAAM,KAAK,cAAc;AAAA,IAClC;AAEA,UAAM,UAAU,CACd,MACA,QAAyF,CAAC,MAE1F,OAAO,QAAS;AAAA,MACd,SAAS;AAAA,MACT,MAAM;AAAA,MACN,WAAW,KAAK;AAAA,MAChB,IAAI;AAAA,MACJ;AAAA,MACA,OAAO,EAAE,MAAM,cAAc,MAAM,gBAAgB,KAAK;AAAA;AAAA,MAExD,WACE,MAAM,aAAa,OACf,OACC,2BAA2B,UAAU,MAAM,SAAS,EAAE,QAAQ;AAAA,IACvE,CAAC;AAEH,QAAI;AACF,YAAM,QAAQ,MAAM,QAAQ,MAAM,gBAAgB;AAAA,QAChD;AAAA,QACA,WAAW,KAAK;AAAA,QAChB,WAAW,IAAI,KAAK,IAAI,IAAI,YAAY,GAAK;AAAA,MAC/C,CAAC;AACD,UAAI,CAAC,MAAO,QAAO,MAAM,KAAK,kBAAkB;AAAA,IAClD,SAAS,OAAO;AACd,aAAO,SAAS,IAAI,cAAc,KAAK;AACvC,UAAI,iBAAiB,2BAA4B,QAAO,QAAQ,MAAM,IAAI;AAC1E,aAAO,QAAQ,sBAAsB;AAAA,IACvC;AAEA,QACE,KAAK,aAAa,WAAW,YAC5B,WAAW,cAAc,UAAa,KAAK,UAAU,cAAc,WAAW,aAC9E,WAAW,0BAA0B,UACpC,KAAK,UAAU,0BAA0B,WAAW,uBACtD;AACA,aAAO,QAAQ,4BAA4B;AAAA,IAC7C;AAEA,QAAI;AACJ,QAAI;AACF,kBAAY,MAAM,QAAQ,UAAU;AAAA,QAClC;AAAA,QACA,YAAY,WAAW;AAAA,QACvB,WAAW,KAAK;AAAA,QAChB,WAAW,gBAAgB,KAAK,SAAS;AAAA,QACzC,WAAW,KAAK;AAAA,MAClB,CAAC;AAAA,IACH,SAAS,OAAO;AACd,aAAO,aAAa,IAAI,cAAc,KAAK;AAC3C,UAAI,iBAAiB,2BAA4B,QAAO,QAAQ,MAAM,IAAI;AAC1E,aAAO,QAAQ,sBAAsB;AAAA,IACvC;AACA,QAAI,cAAc,QAAQ,cAAc,QAAW;AACjD,aAAO,QAAQ,4BAA4B;AAAA,IAC7C;AAEA,UAAM,YAAwD;AAAA,MAC5D;AAAA,MACA,YAAY,WAAW;AAAA,MACvB,WAAW,KAAK;AAAA,MAChB,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,IACrD;AACA,UAAM,OAA0D;AAAA,MAC9D,GAAG;AAAA,MACH;AAAA,MACA,WAAW,KAAK;AAAA,IAClB;AAEA,UAAM,UAAU,OACdC,YAIG;AACH,YAAM,YAAY,QAAQ,IAAIA,SAAQ,MAAM;AAC5C,YAAM,SAAS,yBAAyB,EAAE,EAAE,UAAU,SAAS;AAC/D,YAAM,YACJA,SAAQ,aAAa,OAAO,OAAO,2BAA2B,UAAUA,QAAO,SAAS;AAC1F,UAAI,CAAC,OAAO,WAAY,aAAa,CAAC,UAAU,SAAU;AACxD,eAAO,UAAU,IAAI,cAAc,OAAO,SAAS,WAAW,KAAK;AACnE,eAAO,EAAE,IAAI,OAAO,MAAM,uBAAuB;AAAA,MACnD;AACA,YAAM,cAAc,iBAAiB,KAAK,WAAW,OAAO,IAAI;AAChE,UAAI,YAAa,QAAO,EAAE,IAAI,OAAO,MAAM,YAAY;AACvD,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,QAAQ,OAAO;AAAA,QACf,UAAU,MAAM,OAAO,QAAS;AAAA,UAC9B,SAAS;AAAA,UACT,MAAM;AAAA,UACN,WAAW,KAAK;AAAA,UAChB,IAAI;AAAA,UACJ;AAAA,UACA,QAAQ,OAAO;AAAA,UACf,WAAW,YAAY,UAAU,OAAO;AAAA,QAC1C,CAA6B;AAAA,MAC/B;AAAA,IACF;AAEA,QAAI,CAAC,4BAA4B,EAAE,GAAG;AACpC,UAAI;AACF,cAAMA,UAAS,MAAM,QAAQ,KAAK,WAAW,WAAW,IAAI;AAC5D,YAAI,CAACA,QAAQ,QAAO,QAAQ,4BAA4B;AACxD,cAAMC,WAAU,MAAM,QAAQD,OAAM;AACpC,eAAOC,SAAQ,KAAKA,SAAQ,WAAW,QAAQA,SAAQ,IAAI;AAAA,MAC7D,SAAS,OAAO;AACd,YAAI,iBAAiB,4BAA4B;AAC/C,iBAAO,QAAQ,MAAM,MAAM;AAAA,YACzB,cAAc,MAAM;AAAA,YACpB,WAAW,MAAM;AAAA,UACnB,CAAC;AAAA,QACH;AACA,eAAO,WAAW,IAAI,cAAc,KAAK;AACzC,eAAO,QAAQ,sBAAsB;AAAA,MACvC;AAAA,IACF;AAEA,UAAM,WAAW,KAAK;AACtB,UAAM,UACJ,SAAS,OAAO,eAAe,QAAQ,SAAS,YAAY,QAAQ,SAAS;AAC/E,QAAI,CAAC,QAAS,QAAO,QAAQ,4BAA4B;AACzD,UAAM,SAAS,MAAM,4BAA4B,EAAE,eAAe,QAAQ,SAAS,KAAK,CAAC;AACzF,UAAM,MAAM,EAAE,cAAc,gBAAgB,SAAS,gBAAgB,OAAO;AAC5E,QAAI;AACJ,QAAI;AACF,cAAQ,MAAM,QAAQ,MAAM,cAAc;AAAA,QACxC,GAAG;AAAA,QACH,WAAW,IAAI,KAAK,IAAI,IAAI,WAAW;AAAA,MACzC,CAAC;AAAA,IACH,SAAS,OAAO;AACd,aAAO,SAAS,IAAI,cAAc,KAAK;AAEvC,aAAO;AAAA,QACL,iBAAiB,6BAA6B,MAAM,OAAO;AAAA,MAC7D;AAAA,IACF;AACA,QAAI,MAAM,UAAU,WAAY,QAAO,QAAQ,mBAAmB;AAClE,QAAI,MAAM,UAAU,UAAW,QAAO,QAAQ,0BAA0B;AACxE,QAAI,MAAM,UAAU,aAAa;AAC/B,YAAMA,WAAU,MAAM,QAAQ,EAAE,QAAQ,MAAM,OAAO,CAAC;AACtD,aAAOA,SAAQ,KAAKA,SAAQ,WAAW,QAAQ,0BAA0B;AAAA,IAC3E;AAEA,QAAI;AACJ,QAAI;AACF,eACE,SAAS,OAAO,eACZ,MAAM,QAAQ,SAAS,UAAW,MAAM;AAAA,QACtC,iBAAiB,SAAS;AAAA,QAC1B,MAAM,SAAS;AAAA,QACf,gBAAgB,SAAS;AAAA,MAC3B,CAAC,IACD,MAAM,QAAQ,SAAS,YAAa,MAAM;AAAA,QACxC,iBAAiB,SAAS;AAAA,QAC1B,gBAAgB,SAAS;AAAA,QACzB,gBAAgB,SAAS;AAAA,MAC3B,CAAC;AAAA,IACT,SAAS,OAAO;AACd,UACE,iBAAiB,8BACjB,MAAM,SAAS,4BACf;AAEA,YAAI;AACF,gBAAM,QAAQ,MAAM,gBAAgB,GAAG;AAAA,QACzC,SAAS,YAAY;AACnB,iBAAO,SAAS,IAAI,cAAc,UAAU;AAAA,QAC9C;AACA,eAAO,QAAQ,MAAM,MAAM;AAAA,UACzB,cAAc,MAAM;AAAA,UACpB,WAAW,MAAM;AAAA,QACnB,CAAC;AAAA,MACH;AAEA,aAAO,WAAW,IAAI,cAAc,KAAK;AACzC,aAAO,QAAQ,0BAA0B;AAAA,IAC3C;AACA,UAAM,UAAU,MAAM,QAAQ,MAAM;AACpC,QAAI,CAAC,QAAQ,GAAI,QAAO,QAAQ,0BAA0B;AAC1D,QAAI;AACF,YAAM,QAAQ,MAAM,iBAAiB,EAAE,GAAG,KAAK,QAAQ,QAAQ,OAAO,CAAC;AAAA,IACzE,SAAS,OAAO;AACd,aAAO,SAAS,IAAI,cAAc,KAAK;AAAA,IACzC;AACA,WAAO,QAAQ;AAAA,EACjB;AAEA,iBAAe,QACb,WACA,WACA,MACqD;AACrD,UAAM,WAAW,QAAQ;AACzB,YAAQ,UAAU,IAAI;AAAA,MACpB,KAAK;AACH,eAAO,SAAS,SAAS,SAAS;AAAA,MACpC,KAAK;AACH,eAAO,SAAS,UAAU,SAAS,QAAQ,SAAS,IAAI;AAAA,MAC1D,KAAK;AACH,eAAO,SAAS,WAAW,WAAW;AAAA,UACpC,MAAM,UAAU;AAAA,UAChB,cAAc,UAAU;AAAA,UACxB,YAAY,UAAU;AAAA,QACxB,CAAC;AAAA,MACH,KAAK;AACH,eAAO,SAAS,UAAU,WAAW;AAAA,UACnC,iBAAiB,UAAU;AAAA,UAC3B,MAAM,UAAU;AAAA,UAChB,cAAc,UAAU;AAAA,UACxB,YAAY,UAAU;AAAA,QACxB,CAAC;AAAA,MACH,KAAK;AACH,eAAO,SAAS,WAAW,MAAM;AAAA,UAC/B,iBAAiB,UAAU;AAAA,UAC3B,gBAAgB,UAAU;AAAA,UAC1B,kBAAkB,UAAU;AAAA,UAC5B,cAAc,UAAU;AAAA,UACxB,YAAY,UAAU;AAAA,QACxB,CAAC;AAAA,MACH;AACE,eAAO;AAAA,IACX;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,MAAM,MAAM,SAAS;AACnB,UAAI,QAAQ,WAAW,QAAQ;AAC7B,eAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAO,qBAAqB,CAAC,GAAG;AAAA,UACnE,QAAQ;AAAA,UACR,SAAS,EAAE,GAAG,cAAc,OAAO,OAAO;AAAA,QAC5C,CAAC;AAAA,MACH;AACA,YAAM,MAAM,2BAA2B;AACvC,YAAM,WAAW,OAAO,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,GAAG;AACpE,UAAI,OAAO,SAAS,QAAQ,KAAK,WAAW,KAAK;AAC/C,cAAM,QAAQ,MAAM,OAAO,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAC3C,cAAMC,YAAW,MAAM,KAAK,mBAAmB;AAC/C,eAAO,IAAI,SAASA,UAAS,MAAM,EAAE,QAAQA,UAAS,QAAQ,SAASA,UAAS,QAAQ,CAAC;AAAA,MAC3F;AACA,YAAM,SAAuB,CAAC;AAC9B,UAAI,QAAQ;AACZ,YAAM,SAAS,QAAQ,MAAM,UAAU;AACvC,UAAI,QAAQ;AACV,mBAAS;AACP,gBAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,cAAI,KAAM;AACV,mBAAS,MAAM;AACf,cAAI,QAAQ,KAAK;AACf,kBAAM,OAAO,OAAO,EAAE,MAAM,MAAM;AAAA,YAAC,CAAC;AACpC,kBAAMA,YAAW,MAAM,KAAK,mBAAmB;AAC/C,mBAAO,IAAI,SAASA,UAAS,MAAM;AAAA,cACjC,QAAQA,UAAS;AAAA,cACjB,SAASA,UAAS;AAAA,YACpB,CAAC;AAAA,UACH;AACA,iBAAO,KAAK,KAAK;AAAA,QACnB;AAAA,MACF;AACA,YAAM,QAAQ,IAAI,WAAW,KAAK;AAClC,UAAI,SAAS;AACb,iBAAW,SAAS,QAAQ;AAC1B,cAAM,IAAI,OAAO,MAAM;AACvB,kBAAU,MAAM;AAAA,MAClB;AACA,UAAI;AACJ,UAAI;AACF,eAAO,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,EAAE,OAAO,KAAK;AAAA,MAC/D,QAAQ;AACN,cAAMA,YAAW,MAAM,KAAK,iBAAiB;AAC7C,eAAO,IAAI,SAASA,UAAS,MAAM,EAAE,QAAQA,UAAS,QAAQ,SAASA,UAAS,QAAQ,CAAC;AAAA,MAC3F;AACA,YAAM,WAAW,MAAM,OAAO,EAAE,MAAM,SAAS,QAAQ,SAAS,QAAQ,QAAQ,OAAO,CAAC;AACxF,aAAO,IAAI,SAAS,SAAS,MAAM,EAAE,QAAQ,SAAS,QAAQ,SAAS,SAAS,QAAQ,CAAC;AAAA,IAC3F;AAAA,EACF;AACF;AAGA,SAAS,iBACP,WACA,QACmC;AACnC,UAAQ,UAAU,IAAI;AAAA,IACpB,KAAK;AAAA,IACL,KAAK,cAAc;AACjB,YAAM,OAAO;AACb,UAAI,KAAK,MAAM,SAAS,UAAU,KAAK,MAAO,QAAO;AACrD,YAAM,MAAM,oBAAI,IAAY;AAC5B,iBAAW,SAAS,KAAK,OAGrB;AACF,cAAM,KAAK,MAAM,mBAAmB,MAAM,kBAAkB;AAC5D,YAAI,IAAI,IAAI,EAAE,EAAG,QAAO;AACxB,YAAI,IAAI,EAAE;AAAA,MACZ;AACA,aAAO;AAAA,IACT;AAAA,IACA,KAAK,eAAe;AAClB,YAAM,SAAU,OAAkD;AAClE,YAAM,YAAY,IAAI,IAAI,UAAU,gBAAgB;AACpD,UAAI,OAAO,KAAK,CAAC,UAAU,CAAC,UAAU,IAAI,MAAM,eAAe,CAAC,GAAG;AACjE,eAAO;AAAA,MACT;AACA,aAAO,OAAO,WAAW,UAAU,OAAO,OAAO;AAAA,IACnD;AAAA,IACA,KAAK,cAAc;AACjB,YAAM,OAAQ,OAAiD;AAC/D,YAAM,WAAW,UAAU,KAAK;AAChC,aAAO,aAAa,UAAa,KAAK,mBAAmB,WACrD,6BACA;AAAA,IACN;AAAA,IACA;AACE,aAAO;AAAA,EACX;AACF;","names":["VAULT_PROVIDER_WIRE_LIMITS","VAULT_PROVIDER_WIRE_RESPONSE_SIGNATURE_HEADER","VAULT_PROVIDER_WIRE_VERSION","vaultProviderWireResponseKey","output","outcome","response"]}

package/dist/feedback.d.ts

@@ -0,0 +1,23 @@
+export type FeedbackSentiment = "positive" | "negative";
+export type CreateFeedbackRequest = {
+    idempotencyKey: string;
+    sessionId?: string | undefined;
+    turnId?: string | undefined;
+    sentiment?: FeedbackSentiment | undefined;
+    comment?: string | undefined;
+};
+export type Feedback = {
+    id: string;
+    workspaceId: string;
+    subjectId: string;
+    principalKind: string | null;
+    sessionId: string | null;
+    turnId: string | null;
+    sentiment: FeedbackSentiment | null;
+    comment: string | null;
+    createdAt: string;
+};
+export type FeedbackSubmissionResponse = {
+    feedback: Feedback;
+    replayed: boolean;
+};

package/dist/gateway-realtime-transport.js

@@ -1,7 +1,7 @@
 import {
   createGatewayRealtimeTransportStarter,
   createXaiSubscriptionRealtimeTransportStarter
-} from "./chunk-YKZME56C.js";
+} from "./chunk-KWADQ227.js";
 export {
   createGatewayRealtimeTransportStarter,
   createXaiSubscriptionRealtimeTransportStarter

package/dist/github-repositories.d.ts

@@ -0,0 +1,10 @@
+import type { OpenGeniClient } from "./client.js";
+import type { GitHubRepositoryBranchesResponse, ListGitHubRepositoryBranchesOptions, VerifyPublicGitHubRepositoryRefRequest, VerifyPublicGitHubRepositoryRefResponse } from "./types.js";
+type GitHubRepositoryRequestClient = Pick<OpenGeniClient, "requestJson">;
+/** Verify one exact public github.com repository and branch/tag/SHA anonymously. */
+export declare function verifyPublicGitHubRepositoryRef(client: GitHubRepositoryRequestClient, workspaceId: string, request: VerifyPublicGitHubRepositoryRefRequest): Promise<VerifyPublicGitHubRepositoryRefResponse>;
+/** List one bounded page of branch suggestions for one exact workspace App repository. */
+export declare function listGitHubRepositoryBranches(client: GitHubRepositoryRequestClient, workspaceId: string, installationId: number, repositoryId: number, options?: ListGitHubRepositoryBranchesOptions): Promise<GitHubRepositoryBranchesResponse>;
+/** List one bounded page of branch suggestions for one currently selected personal repository. */
+export declare function listPersonalGitHubRepositoryBranches(client: GitHubRepositoryRequestClient, workspaceId: string, connectionId: string, repositoryId: string, options?: ListGitHubRepositoryBranchesOptions): Promise<GitHubRepositoryBranchesResponse>;
+export {};

package/dist/github-repositories.js

@@ -0,0 +1,36 @@
+// src/github-repositories.ts
+async function verifyPublicGitHubRepositoryRef(client, workspaceId, request) {
+  return await client.requestJson(
+    "POST",
+    `/v1/workspaces/${workspaceId}/github/public-repositories/verify`,
+    request
+  );
+}
+async function listGitHubRepositoryBranches(client, workspaceId, installationId, repositoryId, options = {}) {
+  return await client.requestJson(
+    "GET",
+    `/v1/workspaces/${workspaceId}/github/installations/${installationId}/repositories/${repositoryId}/branches`,
+    void 0,
+    {
+      ...options.cursor !== void 0 ? { cursor: String(options.cursor) } : {},
+      ...options.limit !== void 0 ? { limit: String(options.limit) } : {}
+    }
+  );
+}
+async function listPersonalGitHubRepositoryBranches(client, workspaceId, connectionId, repositoryId, options = {}) {
+  return await client.requestJson(
+    "GET",
+    `/v1/workspaces/${workspaceId}/connections/${connectionId}/github/repositories/${encodeURIComponent(repositoryId)}/branches`,
+    void 0,
+    {
+      ...options.cursor !== void 0 ? { cursor: String(options.cursor) } : {},
+      ...options.limit !== void 0 ? { limit: String(options.limit) } : {}
+    }
+  );
+}
+export {
+  listGitHubRepositoryBranches,
+  listPersonalGitHubRepositoryBranches,
+  verifyPublicGitHubRepositoryRef
+};
+//# sourceMappingURL=github-repositories.js.map

package/dist/github-repositories.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/github-repositories.ts"],"sourcesContent":["import type { OpenGeniClient } from \"./client\";\nimport type {\n  GitHubRepositoryBranchesResponse,\n  ListGitHubRepositoryBranchesOptions,\n  VerifyPublicGitHubRepositoryRefRequest,\n  VerifyPublicGitHubRepositoryRefResponse,\n} from \"./types\";\n\ntype GitHubRepositoryRequestClient = Pick<OpenGeniClient, \"requestJson\">;\n\n/** Verify one exact public github.com repository and branch/tag/SHA anonymously. */\nexport async function verifyPublicGitHubRepositoryRef(\n  client: GitHubRepositoryRequestClient,\n  workspaceId: string,\n  request: VerifyPublicGitHubRepositoryRefRequest,\n): Promise<VerifyPublicGitHubRepositoryRefResponse> {\n  return await client.requestJson<VerifyPublicGitHubRepositoryRefResponse>(\n    \"POST\",\n    `/v1/workspaces/${workspaceId}/github/public-repositories/verify`,\n    request,\n  );\n}\n\n/** List one bounded page of branch suggestions for one exact workspace App repository. */\nexport async function listGitHubRepositoryBranches(\n  client: GitHubRepositoryRequestClient,\n  workspaceId: string,\n  installationId: number,\n  repositoryId: number,\n  options: ListGitHubRepositoryBranchesOptions = {},\n): Promise<GitHubRepositoryBranchesResponse> {\n  return await client.requestJson<GitHubRepositoryBranchesResponse>(\n    \"GET\",\n    `/v1/workspaces/${workspaceId}/github/installations/${installationId}/repositories/${repositoryId}/branches`,\n    undefined,\n    {\n      ...(options.cursor !== undefined ? { cursor: String(options.cursor) } : {}),\n      ...(options.limit !== undefined ? { limit: String(options.limit) } : {}),\n    },\n  );\n}\n\n/** List one bounded page of branch suggestions for one currently selected personal repository. */\nexport async function listPersonalGitHubRepositoryBranches(\n  client: GitHubRepositoryRequestClient,\n  workspaceId: string,\n  connectionId: string,\n  repositoryId: string,\n  options: ListGitHubRepositoryBranchesOptions = {},\n): Promise<GitHubRepositoryBranchesResponse> {\n  return await client.requestJson<GitHubRepositoryBranchesResponse>(\n    \"GET\",\n    `/v1/workspaces/${workspaceId}/connections/${connectionId}/github/repositories/${encodeURIComponent(repositoryId)}/branches`,\n    undefined,\n    {\n      ...(options.cursor !== undefined ? { cursor: String(options.cursor) } : {}),\n      ...(options.limit !== undefined ? { limit: String(options.limit) } : {}),\n    },\n  );\n}\n"],"mappings":";AAWA,eAAsB,gCACpB,QACA,aACA,SACkD;AAClD,SAAO,MAAM,OAAO;AAAA,IAClB;AAAA,IACA,kBAAkB,WAAW;AAAA,IAC7B;AAAA,EACF;AACF;AAGA,eAAsB,6BACpB,QACA,aACA,gBACA,cACA,UAA+C,CAAC,GACL;AAC3C,SAAO,MAAM,OAAO;AAAA,IAClB;AAAA,IACA,kBAAkB,WAAW,yBAAyB,cAAc,iBAAiB,YAAY;AAAA,IACjG;AAAA,IACA;AAAA,MACE,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,OAAO,QAAQ,MAAM,EAAE,IAAI,CAAC;AAAA,MACzE,GAAI,QAAQ,UAAU,SAAY,EAAE,OAAO,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC;AAAA,IACxE;AAAA,EACF;AACF;AAGA,eAAsB,qCACpB,QACA,aACA,cACA,cACA,UAA+C,CAAC,GACL;AAC3C,SAAO,MAAM,OAAO;AAAA,IAClB;AAAA,IACA,kBAAkB,WAAW,gBAAgB,YAAY,wBAAwB,mBAAmB,YAAY,CAAC;AAAA,IACjH;AAAA,IACA;AAAA,MACE,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,OAAO,QAAQ,MAAM,EAAE,IAAI,CAAC;AAAA,MACzE,GAAI,QAAQ,UAAU,SAAY,EAAE,OAAO,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC;AAAA,IACxE;AAAA,EACF;AACF;","names":[]}

package/dist/index.d.ts

@@ -1,12 +1,57 @@
-export { OpenGeniClient } from "./artifact-client.js";
-export type { FetchLike, GetSessionOptions, OpenGeniClientOptions, OpenGeniRequestOptions, SendMessageInput, SteerMessageResult, TranscribeAudioInput, WorkspaceControlEventPage, } from "./client.js";
+export { parseCustomMcpSetupRequest } from "./prepared-mcp-setup.js";
+export type { AvailableOpenGeniSlackBots, OpenGeniSlackBotOrganizationAccess, UpdateOpenGeniSlackBotOrganizationAccess, } from "./types.js";
+export type { ToolActionReview, ToolReviewDetailsPage, ToolReviewStatus, } from "@opengeni/contracts";
+export type { SiteDataAccessMode, SiteDataCollectionDefinitionRequest, SiteDataCollectionResponse, SiteDataDescribeResponse, SiteDataErrorCode, SiteDataFileListResponse, SiteDataFileResponse, SiteDataFileScope, SiteDataFileUrlResponse, SiteDataFilter, SiteDataImportRequest, SiteDataImportResponse, SiteDataLimitsResponse, SiteDataQueryRequest, SiteDataQueryResponse, SiteDataRecordResponse, SiteDataSort, SiteDataWriteOperation, SiteDataWriteRequest, SiteDataWriteResponse, SiteDataWriteResultResponse, } from "@opengeni/contracts";
+export type { SiteSqlDescribeResponse, SiteSqlErrorCode, SiteSqlExportFormat, SiteSqlImportRequest, SiteSqlImportResponse, SiteSqlInspectResponse, SiteSqlLimits, SiteSqlMigrateResponse, SiteSqlMigrationRequest, SiteSqlMigrationResponse, SiteSqlParams, SiteSqlQueryAudience, SiteSqlQueryDefinitionRequest, SiteSqlQueryResponse, SiteSqlResetRequest, SiteSqlResetResponse, SiteSqlRow, SiteSqlRunRequest, SiteSqlRunResponse, SiteSqlSettingsRequest, SiteSqlStatementRequest, SiteSqlUsageResponse, SiteSqlValue, } from "@opengeni/contracts";
+export type { SiteAbuseCategory, SiteAbuseReport, SiteAccessMode, SiteAuthAuthorizeRequest, SiteAuthAuthorizeResponse, SiteEmbeddedAgent, SiteEmbeddedAgentChanges, SiteHostnameAvailability, SiteHostnameAvailabilityProblem, SiteLimitProfile, SiteLimitProfileKind, SiteLimits, SitePlatformBillingMode, SitePlatformBrakeState, SitePlatformMeter, SitePlatformMeterUsage, SitePlatformUsage, SitePublication, SitePublicationStatus, SitePublishWarning, SitePublishWarningFix, SiteTakedownRequest, SiteViewAs, SiteViewer, SiteViewerCapabilities, UpsertSitePublicationRequest, } from "@opengeni/contracts";
+export { toolReviewAction, toolReviewFields, toolReviewDetails, } from "@opengeni/contracts/tool-review-presentation";
+export type { SubscriptionAccountSummary, SubscriptionPoolSettings, ClaudeSubscriptionSetupTokenRequest, ClaudeSubscriptionAccount, ClaudeSubscriptionAccountsResponse, } from "@opengeni/contracts";
+export type { ArtifactPinResponse, ArtifactCatalogKind, ArtifactCatalogItem, ArtifactCatalogListOptions, ArtifactCatalogListResponse, } from "./artifact-catalog.js";
+export type { SessionMessageSearchRequest, SessionMessageSearchMatch, SessionMessageSearchResponse, SessionMessagePreview, SessionMessagePreviewReference, } from "./session-message-search.js";
+export { OpenGeniEmbeddingClient as OpenGeniClient } from "./embedding-client.js";
+export type { Chats } from "./chats.js";
+export type { ServiceContext } from "./embedding-client.js";
+export { OPENGENI_TEST_REQUEST_NIL_ID, OPENGENI_WEBHOOK_HEADERS, OPENGENI_WEBHOOK_TEST_EVENT_TYPE, OpenGeniSignatureError, WORKSPACE_WEBHOOK_EVENT_TYPES, signOpenGeniPayload, verifyCredentialProviderRequest, verifyOpenGeniSignature, verifyWebhookEvent, } from "./workspace-integrations.js";
+export type { CreateOrganizationWebhookRequest, CreateOrganizationWebhookResponse, CredentialProviderMcpHeaders, CredentialProviderMcpMaterial, GetOrganizationCredentialProviderResponse, InitiatingHuman, IntegrationWorkspaceFilter, ListOrganizationWebhookDeliveriesResponse, ListOrganizationWebhooksResponse, OrganizationCredentialProvider, OrganizationWebhook, OrganizationWebhookDelivery, PutOrganizationCredentialProviderRequest, PutOrganizationCredentialProviderResponse, RotateWorkspaceCredentialProviderSecretResponse, RotateOrganizationCredentialProviderSecretResponse, RotateWorkspaceWebhookSecretResponse, RotateOrganizationWebhookSecretResponse, UpdateOrganizationWebhookRequest, CreateWorkspaceWebhookRequest, CreateWorkspaceWebhookResponse, CredentialProviderRequest, CredentialProviderInitiatorContext, CredentialProviderResponse, GetWorkspaceCredentialProviderResponse, ListWorkspaceWebhookDeliveriesResponse, ListWorkspaceWebhooksResponse, PutWorkspaceCredentialProviderRequest, PutWorkspaceCredentialProviderResponse, UpdateWorkspaceWebhookRequest, WorkspaceCredentialProvider, WorkspaceSandboxImages, WorkspaceWebhook, WorkspaceWebhookDelivery, WorkspaceWebhookEvent, WorkspaceWebhookEventType, SessionWorkspaceWebhookEvent, WorkspaceUsageWebhookEvent, WorkspaceTestWebhookEvent, IntegrationEndpointTestResult, TestWorkspaceWebhookResponse, TestWorkspaceCredentialProviderResponse, WorkspaceInheritedIntegrationsResponse, } from "./workspace-integrations.js";
+export type { AllowanceExhaustedRefusal, ClearWorkspaceAllowanceRequest, ClearWorkspaceAllowanceResponse, GetUsageRequest, GetMyUsageRequest, GrantWorkspaceCreditsRequest, MemberAllowance, MemberAllowanceDefault, MemberAllowanceRule, MemberAllowanceUsage, SetMemberAllowanceRequest, SetWorkspaceAllowanceRequest, UsageAllowancePeriod, UsageAllowanceStatus, UsageAllowanceWindow, WorkspaceAllowance, WorkspaceAllowanceConfig, WorkspaceAllowanceState, WorkspaceAllowanceUsage, WorkspaceCreditGrant, WorkspaceUsageResponse, } from "@opengeni/contracts/usage-allowances";
+export { pluginMcpUnavailableReason } from "@opengeni/contracts/plugin-discovery";
+export type { ToolDisplayMetadata } from "@opengeni/contracts";
+export { EMPTY_FINAL_REPLY_NOTICE, turnCompletedWithEmptyFinalReply, } from "@opengeni/contracts/session-final-reply";
+export type { EmptyFinalReplyCompletion } from "@opengeni/contracts/session-final-reply";
+export { parseToolDisplayMetadata } from "./tool-display-metadata.js";
+export type { PluginDiscoveryItem, PluginDiscoveryPage, } from "@opengeni/contracts/plugin-discovery";
+export { createSiteToolBridge, isSiteCatalogStaleError } from "./site-tool-bridge.js";
+export type { SiteToolBridge, SiteToolCaller, SiteToolCallRequest, CreateSiteToolBridgeOptions, } from "./site-tool-bridge.js";
+export type { ExternalIdentityLink, BeginExternalIdentityLinkRequest, BeginExternalIdentityLinkResponse, ConfirmExternalIdentityLinkRequest, ExternalIdentityLinkPreview, ExternalIdentityLinkPage, } from "@opengeni/contracts/external-identities";
+export type { ModelConnectionAccessKind, ModelConnectionAccessPolicy, ModelConnectionAccessResponse, } from "./types.js";
+export { OpenGeniToolCallError, OpenGeniToolReapprovalRequiredError, OpenGeniToolsClient, } from "./tools.js";
+export type { OpenGeniDynamicToolNamespace, OpenGeniDynamicToolNode, OpenGeniGeneratedTools, OpenGeniToolCallOptions, OpenGeniToolFunction, OpenGeniToolTransport, OpenGeniToolsFacade, OpenGeniWorkspaceTools, } from "./tools.js";
+export type { FetchLike, FetchResponse, GetSessionOptions, InteractionSessionListOptions, OpenGeniClientOptions, OpenGeniRequestOptions, SendMessageInput, SessionListPageOptions, SteerMessageResult, TranscribeAudioInput, WorkspaceControlEventPage, } from "./client.js";
+export { OPENGENI_SITE_BRIDGE_CANCEL, OPENGENI_SITE_BRIDGE_CONNECT, OPENGENI_SITE_BRIDGE_READY, OPENGENI_SITE_BRIDGE_REQUEST, OPENGENI_SITE_BRIDGE_RESPONSE, OPENGENI_SITE_BRIDGE_SIGN_IN_METHOD, OPENGENI_SITE_BRIDGE_VERSION, OPENGENI_SITE_BRIDGE_VIEWER_METHOD, OpenGeniSiteBridgeError, createOpenGeniSiteClient, isOpenGeniSiteBridgeCancelMessage, isOpenGeniSiteBridgeConnectMessage, isOpenGeniSiteBridgeRequestMessage, sanitizeOpenGeniSiteToolCallRequest, } from "./site.js";
+export type { OpenGeniSiteBridgeCancelMessage, OpenGeniSiteBridgeConnectMessage, OpenGeniSiteBridgeReadyMessage, OpenGeniSiteBridgeRequestMessage, OpenGeniSiteBridgeResponseMessage, OpenGeniSiteClient, OpenGeniSiteClientOptions, OpenGeniSiteSignInResult, OpenGeniSiteToolCatalog, OpenGeniSiteToolCallRequest, OpenGeniSiteViewer, OpenGeniSiteCapabilities, OpenGeniSiteWorkspaceTools, } from "./site.js";
+export type { ToolGatewayCallRequest, ToolGatewayTarget, ToolGatewayResolveRequest, ToolGatewayResolvedTool, ToolGatewayInvokeRequest, ToolGatewayInvokeResponse, ToolGatewayTargetApprovalRequest, ToolGatewayTargetApprovalResponse, ToolGatewayManifestRequest, ToolGatewayManifestResponse, ToolGatewayCallResponse, ToolGatewayApprovalRequest, ToolGatewayApprovalResponse, ToolGatewayCatalog, ToolGatewayCatalogEntry, ToolGatewayDeclarationsResponse, ToolGatewayIdentity, ToolGatewayResult, } from "./types.js";
 export type { CreateEditableArtifactMaterializationRequest, CreateEditableArtifactResourceRequest, EditableArtifactListResource, EditableArtifactMaterializationFormat, EditableArtifactMaterializationJobResource, EditableArtifactMaterializationResultResource, EditableArtifactPinnedVersionResource, EditableArtifactResource, ListSessionEditableArtifactResourcesOptions, PinEditableArtifactVersionRequest, ReadEditableArtifactMaterializationOptions, ReadEditableArtifactResourceOptions, } from "./editable-artifact-resources.js";
-export { OpenGeniApiContractMismatchError, OpenGeniApiError, OpenGeniSessionListCursorError, OpenGeniStreamError, isRetryableStreamError, } from "./errors.js";
-export { AUTOMATIC_SESSION_TITLE_FALLBACK, deriveSessionDisplayTitle, sessionTitleIsPending, } from "./session-titles.js";
+export { OpenGeniApiContractMismatchError, OpenGeniApiError, OpenGeniSetupError, OpenGeniAllowanceExhaustedError, OpenGeniSessionUsageLimitReachedError, OpenGeniSessionUsageLimitUnsupportedError, OpenGeniSecureContextRequiredError, OpenGeniSessionListCursorError, OpenGeniStreamError, formatErrorMessage, isRetryableStreamError, } from "./errors.js";
+export type { OpenGeniSecureContextRequiredReason } from "./errors.js";
+export { parseDeprecationNotice } from "./deprecation.js";
+export type { OpenGeniDeprecationHandler, OpenGeniDeprecationNotice } from "./deprecation.js";
+export { AUTOMATIC_SESSION_TITLE_FALLBACK, deriveAutomaticSessionTitlePreview, deriveSessionDisplayTitle, sessionTitleIsPending, } from "./session-titles.js";
 export type { SessionDisplayTitleInput, SessionDisplayTitleOptions } from "./session-titles.js";
+export { humanizeModelSlug, isRawModelLabel, modelDisplayName, modelSlug, modelVendor, } from "./model-display.js";
+export type { ModelDisplayInput, ModelVendor } from "./model-display.js";
+export type { AgentPromptModuleId, ModelContextInstructionLayer, ModelContextInstructionLayerId, ModelContextInstructionModule, ModelContextSkill, ModelContextSkillKind, ModelContextSnapshot, ModelContextTokenCounts, ModelContextTool, ModelContextToolVisibility, SessionModelContextResponse, } from "./model-context.js";
 export { formatSseEvent, proxySessionEventStream, resumeSequenceFromRequest, sessionEventsToSseResponse, sessionEventsToSseStream, } from "./proxy.js";
 export type { ProxySessionEventStreamOptions, SseReStreamOptions } from "./proxy.js";
+export { artifactViewerCapability, createSessionProxyHandler } from "./session-proxy.js";
+export type { SessionProxyContext, SessionProxyCreateInput, SessionProxyHandlerOptions, SessionProxyMessageExtras, SessionProxyMessageInput, SessionProxyResolution, SessionProxyResolve, SessionProxyToolServer, } from "./session-proxy.js";
+export { ToolRequestError, verifyToolRequest } from "./tool-auth.js";
+export type { ToolRequestIdentity, ToolRequestLike, VerifyToolRequestOptions } from "./tool-auth.js";
+export { openGeniConsolePath, parseOpenGeniLink, isReservedOpenGeniLink, openGeniLinkScheme, parseRetainedFileReference, parseSandboxLink, SESSION_SCOPE_HEADER, } from "./message-links.js";
+export type { OpenGeniLinkTarget } from "./message-links.js";
 export { parseSseStream } from "./sse.js";
+export { asVaultClient, vaultsApi, vaultErrorCode, vaultErrorDetail } from "./vaults-api.js";
+export type { VaultClientLike, VaultsApi } from "./vaults-api.js";
+export type * from "./vault-types.js";
 export type { SseMessage } from "./sse.js";
 export { normalizeMcpOutput } from "./mcp-output.js";
 export type { NormalizedMcpOutput } from "./mcp-output.js";
@@ -16,7 +61,8 @@ export type { AcquireCodexRealtimeMicrophoneOptions, CodexRealtimeAudibleOutputS
 export { CODEX_REALTIME_CONTEXT_APPEND_MAX_BYTES, contextAppendChunks, createCodexRealtimeV3Bridge, encodeCodexRealtimeV3DelegationContextAppend, encodeCodexRealtimeV3SessionContextAppend, parseCodexRealtimeV3Event, } from "./codex-realtime-v3.js";
 export type { CodexRealtimeV3Bridge, CodexRealtimeV3BridgeOptions, CodexRealtimeV3BridgeSnapshot, CodexRealtimeV3ContextAppendChannel, CodexRealtimeV3DelegationContextAppend, CodexRealtimeV3Event, CodexRealtimeV3ParseFailure, CodexRealtimeV3ParseResult, CodexRealtimeV3SessionContextAppend, } from "./codex-realtime-v3.js";
 export { createCodexRealtimeController } from "./codex-realtime-controller.js";
-export type { CodexRealtimeController, CodexRealtimeControllerClient, CodexRealtimeDiagnostic, CodexRealtimeDiagnosticKind, CodexRealtimeControllerSnapshot, CodexRealtimeControllerStatus, CodexRealtimeMicrophoneState, CodexRealtimeOwnerStorage, CreateCodexRealtimeControllerOptions, RealtimeControllerTransportStarter, } from "./codex-realtime-controller.js";
+export type { CodexRealtimeController, CodexRealtimeControllerClient, CodexRealtimeDiagnostic, CodexRealtimeDiagnosticKind, CodexRealtimeControllerSnapshot, CodexRealtimeControllerStatus, CodexRealtimeMicrophoneState, CodexRealtimeOwnerStorage, CodexRealtimeRefusal, CreateCodexRealtimeControllerOptions, RealtimeControllerTransportStarter, } from "./codex-realtime-controller.js";
+export { codexRealtimeRefusal } from "./codex-realtime-controller.js";
 export { createGatewayRealtimeTransportStarter, createXaiSubscriptionRealtimeTransportStarter, } from "./gateway-realtime-transport.js";
 export { projectSessionRealtimeLifecycle } from "./codex-realtime-lifecycle.js";
 export type { SessionRealtimeLifecycleProjection } from "./codex-realtime-lifecycle.js";
@@ -24,7 +70,7 @@ export * from "./interaction.js";
 export { desktopSocketUrl, nextDesktopState, applyUrlRotation } from "./desktop.js";
 export type { DesktopRfbLike, DesktopRfbFactory, DesktopConnectionState, DesktopStreamEvent, } from "./desktop.js";
 export { terminalSocketUrl, ttydAuthFrame, ttydInputFrame, ttydResizeFrame, TTYD_SUBPROTOCOL, TtydClientCommand, TtydServerCommand, } from "./terminal.js";
-export { streamSessionEvents } from "./stream.js";
+export { sessionEventStreamCoveredThrough, streamSessionEvents } from "./stream.js";
 export type { SessionEventStreamTransport, StreamConnectionState, StreamSessionEventsOptions, } from "./stream.js";
 export { streamWorkspaceControlEvents } from "./workspace-control-stream.js";
 export type { WorkspaceControlStreamTransport } from "./workspace-control-stream.js";
@@ -32,19 +78,24 @@ export { streamWorkspaceInteractionRevisions } from "./interaction-revision-stre
 export type { WorkspaceInteractionRevisionStreamTransport } from "./interaction-revision-stream.js";
 export { parseWorkspaceLiveEvent, streamWorkspaceLiveEvents } from "./workspace-live-stream.js";
 export type { WorkspaceLiveEvent, WorkspaceLiveStreamOptions, WorkspaceLiveStreamTransport, } from "./workspace-live-stream.js";
-export type { CreateWorkspaceArtifactRequest, PublishWorkspaceArtifactVersionRequest, RollbackWorkspaceArtifactRequest, WorkspaceArtifact, WorkspaceArtifactContentResponse, WorkspaceArtifactDetailResponse, WorkspaceArtifactEvent, WorkspaceArtifactListOptions, WorkspaceArtifactListResponse, WorkspaceArtifactMutationResponse, WorkspaceArtifactVersion, } from "./workspace-artifacts.js";
+export type { CreateWorkspaceArtifactRequest, PublishWorkspaceArtifactVersionRequest, RollbackWorkspaceArtifactRequest, SetWorkspaceArtifactStatusRequest, UpdateWorkspaceArtifactVisibilityRequest, UpdateWorkspaceArtifactVisibilityResponse, WorkspaceArtifactVisibility, WorkspaceArtifact, WorkspaceArtifactContentResponse, WorkspaceArtifactDetailResponse, WorkspaceArtifactEvent, WorkspaceArtifactListOptions, WorkspaceArtifactListResponse, WorkspaceArtifactMutationResponse, WorkspaceArtifactSourceBundle, WorkspaceArtifactSourceFile, WorkspaceArtifactVersion, } from "./workspace-artifacts.js";
 export { normalizeWorkspaceInstructionPolicyRoleKey, WORKSPACE_INSTRUCTION_POLICY_CONTENT_MAX_CHARS, } from "./workspace-instruction-policies.js";
 export type { ActivateWorkspaceLearningPolicyRevisionRequest, CreateWorkspaceLearningPolicyRevisionRequest, GovernedLearningActivationReceipt, GovernedLearningActivationUndoReceipt, GovernedLearningDecisionReceipt, RollbackWorkspaceLearningPolicyRevisionRequest, WorkspaceLearningHistoryOptions, WorkspaceLearningHistoryResponse, WorkspaceLearningMode, WorkspaceLearningOverrideMode, WorkspaceLearningPolicyEvent, WorkspaceLearningPolicyHead, WorkspaceLearningPolicyMutationResponse, WorkspaceLearningPolicyRevision, WorkspaceLearningPolicyRevisionIdentity, WorkspaceLearningSourceOverride, WorkspaceLearningSourceOverrideInput, } from "./workspace-learning.js";
 export { COMPANY_PROFILE_ENTRY_MAX_CHARS, COMPANY_PROFILE_ENTRY_MAX_COUNT, COMPANY_PROFILE_SCALAR_MAX_CHARS, normalizeCompanyProfileStableKey, } from "./company-profile.js";
 export type { ActivateCompanyProfileRevisionRequest, CompanyProfileAgentPolicy, CompanyProfileAgentPolicyMode, CompanyProfileActivationEvent, CompanyProfileContent, CompanyProfileDiffRequest, CompanyProfileDiffResponse, CompanyProfileEntry, CompanyProfileHead, CompanyProfileListOptions, CompanyProfileListResponse, CompanyProfileMutationResponse, CompanyProfileRevision, CompanyProfileRevisionIdentity, RollbackCompanyProfileRequest, UpdateCompanyProfileRequest, UpdateCompanyProfileAgentPolicyRequest, } from "./company-profile.js";
 export type { ActivateWorkspaceInstructionPolicyRequest, CreateWorkspaceInstructionPolicyDraftRequest, CreateWorkspaceInstructionPolicyOnboardingProposalRequest, ImportLegacyWorkspaceInstructionPolicyDraftRequest, RollbackWorkspaceInstructionPolicyRequest, WorkspaceInstructionPolicyActivationEvent, WorkspaceInstructionPolicyActivationResponse, WorkspaceInstructionPolicyActivationType, WorkspaceInstructionPolicyConflictResponse, WorkspaceInstructionPolicyDiffRequest, WorkspaceInstructionPolicyDiffResponse, WorkspaceInstructionPolicyDraftProvenanceSource, WorkspaceInstructionPolicyHead, WorkspaceInstructionPolicyKind, WorkspaceInstructionPolicyListOptions, WorkspaceInstructionPolicyListResponse, WorkspaceInstructionPolicyOnboardingProposal, WorkspaceInstructionPolicyOnboardingProposalConflictResponse, WorkspaceInstructionPolicyOnboardingProposalContentErrorResponse, WorkspaceInstructionPolicyOnboardingProposalListOptions, WorkspaceInstructionPolicyOnboardingProposalListResponse, WorkspaceInstructionPolicyOnboardingProposalSource, WorkspaceInstructionPolicyOnboardingProposalStaleResponse, WorkspaceInstructionPolicyOperationReuseResponse, WorkspaceInstructionPolicyProvenanceSource, WorkspaceInstructionPolicyRevision, WorkspaceInstructionPolicyRevisionIdentity, WorkspaceInstructionPolicyScope, WorkspaceInstructionPolicyTarget, } from "./workspace-instruction-policies.js";
-export type { WorkspaceStateDocumentStatusCounts, WorkspaceStateDocumentAuthorityKindCounts, WorkspaceStateAttemptGovernance, WorkspaceStateExportOmission, WorkspaceStateExportResponse, WorkspaceStateGapCode, WorkspaceStateGetOptions, WorkspaceStateGovernanceDriftStatus, WorkspaceStateMemoryKindCounts, WorkspaceStateMemoryStatusCounts, WorkspaceStateResponse, WorkspaceStateSourceKindCounts, } from "./workspace-state.js";
-export type { CompanyBrainContextReceiptListOptions, CompanyBrainContextReceiptPage, CompanyBrainInspectorTransport, CompanyBrainKnowledgeBrowseRequest, CompanyBrainKnowledgeBrowseResponse, CompanyBrainKnowledgeGetResponse, CompanyBrainKnowledgeRecord, CompanyBrainKnowledgeProposalListOptions, CompanyBrainKnowledgeProposalPage, CompanyBrainKnowledgeSearchRequest, CompanyBrainKnowledgeSearchResponse, CompanyBrainOkfDownload, CompanyBrainOkfPackage, } from "./company-brain.js";
-export { browseCompanyBrainKnowledge, getCompanyBrainKnowledge, listCompanyBrainContextReceipts, listCompanyBrainKnowledgeProposals, searchCompanyBrainKnowledge, } from "./company-brain.js";
+export type { WorkspaceStateAttemptGovernance, WorkspaceStateExportOmission, WorkspaceStateExportResponse, WorkspaceStateGetOptions, WorkspaceStateGovernanceDriftStatus, WorkspaceStateResponse, } from "./workspace-state.js";
+export type { CompanyBrainContextReceiptListOptions, CompanyBrainContextReceiptPage, CompanyBrainInspectorTransport, CompanyBrainKnowledgeProposalListOptions, CompanyBrainKnowledgeProposalPage, CompanyBrainOkfDownload, CompanyBrainOkfPackage, } from "./company-brain.js";
+export { listCompanyBrainContextReceipts, listCompanyBrainKnowledgeProposals, } from "./company-brain.js";
 export type { MemorySlackImportance, MemorySlackPublication, MemorySlackPublicationActionRequest, MemorySlackPublicationConfiguration, MemorySlackPublicationConfigurationResponse, MemorySlackPublicationDistribution, MemorySlackPublicationHistoryResponse, MemorySlackPublicationReceipt, MemorySlackPublicationReceiptKind, MemorySlackPublicationState, MemorySlackRequestedMode, SlackPublicationChannel, SlackPublicationChannelListResponse, UpdateMemorySlackPublicationConfigurationRequest, } from "./memory-slack-delivery.js";
 export { normalizePreferenceRegistryStableKey } from "./preference-registry.js";
+export type { SkillFile, SkillScope, SkillRecord, SkillSummary, SkillWriteReceipt, SkillPublicationReceipt, SkillSourceReleaseReceipt, SaveWorkspaceSkillRequest, RemoveWorkspaceSkillRequest, ApplyWorkspaceSkillRevisionRequest, } from "./skills.js";
 export type { ActivatePreferenceRegistryRevisionRequest, ChangePreferenceRegistryScopeRequest, CorrectPreferenceRegistryRequest, CreatePreferenceRegistryProposalRequest, DeactivatePreferenceRegistryRequest, PreferenceRegistryConflictStrategy, PreferenceRegistryDescriptor, PreferenceRegistryActivationAuthority, PreferenceRegistryDescriptorProvenance, PreferenceRegistryDetailResponse, PreferenceRegistryEvent, PreferenceRegistryFullContent, PreferenceRegistryListOptions, PreferenceRegistryListResponse, PreferenceRegistryMutationResponse, PreferenceRegistryPrecedence, PreferenceRegistryProvenanceSource, PreferenceRegistryRecord, PreferenceRegistryRevisionSummary, PreferenceRegistryScope, PreferenceRegistryScopeTarget, PreferenceRegistrySnapshot, PreferenceRegistryStatus, PreferenceRegistryTrust, RejectPreferenceRegistryProposalRequest, SupersedePreferenceRegistryRequest, } from "./preference-registry.js";
 export { DEFAULT_WORKSPACE_TRANSCRIPTION_POLICY, authorizeTranscriptionAdapter, createTranscriptionSessionRequest, resolveWorkspaceVoiceInputEnabled, resolveWorkspaceTranscriptionPolicy, } from "./transcription.js";
 export type { TranscriptionAdapter, TranscriptionAdapterDescriptor, TranscriptionAdapterStartContext, TranscriptionAuthorization, TranscriptionCredentialMode, TranscriptionDiagnostic, TranscriptionErrorCode, TranscriptionEvent, TranscriptionEventListener, TranscriptionLifecycleStatus, TranscriptionPolicyBlockReason, TranscriptionResultMetadata, TranscriptionSession, TranscriptionSessionRequest, TranscriptionSpeaker, TranscriptionTargetSelection, TranscriptionTimeSpan, TranscriptionWord, WorkspaceTranscriptionPolicy, WorkspaceTranscriptionTarget, } from "./transcription.js";
 export { DEFAULT_FILE_RESOURCE_MOUNT_ROOT, KNOWN_PERMISSIONS, KNOWN_USAGE_EVENT_TYPES, OPENGENI_API_CONTRACT_HEADER, OPENGENI_API_CONTRACT_REVISION, OPENGENI_CORRELATION_HEADER, PERSONAL_RESOURCE_SHARED_OUTPUT_WARNING, PERSONAL_RESOURCE_SHARED_OUTPUT_WARNING_VERSION, GENERATED_VIDEO_MAX_BYTES, RETAINED_OUTPUT_DEFAULT_PAGE_BYTES, RETAINED_OUTPUT_MAX_PAGE_BYTES, SANDBOX_FILE_ARTIFACT_MAX_BYTES, SESSION_EVENT_TYPES, } from "./types.js";
-export type { AccessContext, ActivateCodexRealtimeConnectionRequest, AccessGrant, AccountGrant, AccountRole, AddWorkspaceMemberRequest, ApproveSlackUserLinkAccessRequest, BeginSessionRealtimeRequest, AgentMessageCompletedPayload, AgentTextDeltaPayload, AgentToolCallCreatedPayload, AgentToolCallOutputPayload, ApiKey, BillingBalance, BillingEntitlementsResponse, BillingMode, BillingSummary, ListManagedOrganizationMembershipsResponse, ManagedOrganizationMembership, OrganizationAdministrationMember, OrganizationAdministrationMemberWorkspaceAccess, OrganizationAdministrationOverview, OrganizationInvitation, OrganizationMember, OrganizationMembershipRole, OrganizationPrivateSessionSettings, OrganizationRecoveryApproval, OrganizationRecoveryCapabilities, OrganizationRecoveryCustodian, OrganizationRecoveryMemberSummary, OrganizationRecoveryMutationResponse, OrganizationRecoveryOperation, OrganizationRecoveryOperationCommandRequest, OrganizationRecoveryOperationState, OrganizationRecoveryOverview, OrganizationRecoveryPolicy, OrganizationRecoveryPolicyState, OrganizationRecoveryUnavailableReason, OrganizationSummary, OrganizationWorkspaceAccess, OrganizationWorkspaceAccessMember, OrganizationWorkspaceRoleDefinition, WorkspaceMemberRole, AssignableWorkspaceMemberRole, CreateOrganizationWorkspaceRequest, UpdateOrganizationWorkspaceRequest, PutOrganizationWorkspaceMemberRequest, RevokeOrganizationWorkspaceMemberRequest, RevokeOrganizationWorkspaceMemberResponse, UpdateOrganizationNameRequest, UpdateOrganizationPrivateSessionSettingsRequest, AcceptOrganizationRecoveryCustodyRequest, ConfigureOrganizationRecoveryPolicyRequest, DisableOrganizationRecoveryPolicyRequest, StartOrganizationRecoveryOperationRequest, BillingUsageResponse, InsightsRange, InsightsBillingPath, InsightsPricingSource, ModelContextContributionSource, InsightsPromptContributionRow, InsightsPromptContributions, InsightsModelUsageRow, InsightsModelCallRow, InsightsSeriesPoint, InsightsDepthBucket, InsightsModelFacet, InsightsSpendDriver, InsightsWarmGroupRow, InsightsLiveWarmLease, InsightsFloorSession, InsightsScheduleRow, WorkspaceInsightsSnapshot, WorkspaceInsightsResponse, CapabilityCatalogItem, CapabilityAction, CapabilityCatalogResponse, CapabilityComponentOwner, CapabilityInstallation, CapabilityInstallationStatus, CapabilityKind, CapabilityLifecycle, CapabilityLifecycleStatus, CapabilityPack, CapabilityPackComponentReference, CapabilityPackConnector, CapabilityPackConnectorAuthModel, CapabilityPackRigRequirement, CapabilityPackVariableSetSpec, CapabilityPackKnowledge, CapabilityPackScheduledTaskTemplate, CapabilityPackSkill, CapabilityPackSkillFile, CapabilityRuntime, CapabilityReadiness, CapabilitySource, CapabilityUnavailableReason, ClientConfig, ClientVoiceInputConfig, ClientModel, CodexRealtimeVoice, CodexRealtimeWebrtcRequest, CodexRealtimeWebrtcResponse, CodexRealtimeWebrtcVersion, GatewayRealtimeConnectRequest, GatewayRealtimeConnectResponse, GatewayRealtimeInitialItem, EndSessionRealtimeRequest, ModelAvailabilityV1, ModelBillingAttributionV1, ModelCapabilitiesV1, ModelCapabilityStateV1, ModelCapabilitySupportV1, ModelCredentialReadinessV1, ModelCredentialSourceV1, ModelPricingScheduleV1, ModelPricingV1, RenewSessionRealtimeRequest, SessionRealtimeEndReason, SessionRealtimeMode, SessionRealtimeModel, SessionRealtimeMutationResponse, SessionRealtimeState, WorkspaceModelCatalogModel, WorkspaceModelCatalogResponse, WorkspaceModelAccessPolicy, WorkspaceRealtimeModelCatalogItem, WorkspaceRealtimeModelCatalogResponse, CodexAccount, CodexAccountOverview, CodexAccountsResponse, OrganizationCodexAccountsResponse, CodexAllocatorUpdate, CodexAccountSwitchedPayload, CodexConnectionStatus, CodexConnectStart, CodexConnectPoll, SuperGrokAccount, SuperGrokAccountsResponse, SuperGrokAccountScope, SuperGrokAllocatorUpdate, SuperGrokConnectionStatus, SuperGrokConnectPoll, SuperGrokConnectStart, SuperGrokRotationSettings, CodexFleetConfidence, CodexFleetCacheState, CodexFleetDecisionEventPayload, CodexFleetDecisionScore, CodexFleetShadowComparison, CodexOverviewResponse, CodexResetCredit, CodexResetRedemptionRecovery, CodexRotationSettings, CodexUsage, CodexUsageMap, WorkspaceCodexSubscriptionMode, WorkspaceCodexSubscriptionSource, CodexUsagePayload, CodexUsageWindow, CompactSessionContextResult, ClientSessionEventInput, CompleteFileUploadResponse, ConnectionKind, ConnectionMetadata, McpConnectionAuthoritySelection, ConnectionOwnership, ConnectionResponse, ConnectionStatus, PersonalGitHubConnectionMetadata, PersonalGitHubConnectionStatusResponse, PersonalGitHubDisconnectRequest, PersonalGitHubOAuthStartRequest, PersonalGitHubOAuthStartResponse, ListPersonalGitHubRepositoriesOptions, ListPersonalGitHubRepositoriesResponse, PersonalGitHubRepository, PersonalGitHubRepositoryAccess, PersonalGitHubRepositoryCatalogItem, PersonalGitHubRepositoryPermissions, PersonalGitHubRepositorySelectionInput, PersonalGitHubRepositorySelectionState, PersonalGitHubSelectedRepository, ReplacePersonalGitHubRepositorySelectionsRequest, VerifyPersonalGitHubRepositorySelectionsRequest, ConnectorDocumentDestination, ConnectorDocumentDestinationAuthority, ConnectorDocumentDestinationSelection, SocialConnection, SocialConnectionStatus, SocialOAuthStartRequest, AddDocumentRequest, CreateApiKeyRequest, CreateApiKeyResponse, CreateOrganizationApiKeyRequest, CreateCapabilityCatalogItemRequest, OpenGeniSlackBotInstallRequest, OpenGeniSlackBotInstallStart, SlackInstallationBinding, SlackInstallationBindingState, ListSlackInstallationBindingsResponse, SlackChannelRoute, SlackChannelRouteListResponse, UpdateSlackChannelRoutesRequest, SlackReactionChannel, SlackReactionChannelListResponse, CreateConnectionRequest, CreateBillingPortalRequest, CreateBillingPortalResponse, CreateCheckoutRequest, CreateCheckoutResponse, CreateDocumentBaseRequest, CreateFileUploadRequest, CreateFileUploadResponse, CreateGitHubAppManifestRequest, CreateGitHubAppManifestResponse, CreateKnowledgeDropRequest, CreateKnowledgeMemoryRequest, CreateScheduledTaskRequest, CreateSessionRequest, CreateVariableSetRequest, CreateWorkspaceEnvironmentRequest, CreateWorkspaceRequest, EnsureWorkspaceRequest, EnsureWorkspaceResponse, DiscoverMcpCapabilitiesResponse, InstallSkillRequest, InstallLibrarySkillRequest, InstalledSkill, InstalledSkillSummary, ListInstalledSkillsResponse, Document, DocumentAuthorityKind, DocumentBase, DocumentCuration, DocumentCurationStatus, DocumentSearchMode, DocumentSearchRequest, DocumentSearchResponse, DocumentSearchResult, DocumentStatus, DocumentVisibility, MoveDocumentRequest, EnableCapabilityRequest, EnablePackRequest, Entitlements, EntitlementValue, EntitlementsMode, FileAsset, HumanInputAnswer, HumanInputOption, HumanInputQuestion, HumanInputQuestionKind, HumanInputResponse, FileDownloadUrlResponse, FileResourceRef, FileStatus, FileUploadData, FirstPartyMcpToolName, AtlassianBrowseItem, AtlassianBrowseResponse, AtlassianConnectionLifecycle, AtlassianConnectionMetadata, AtlassianDisconnectRequest, AtlassianLifecycleActionRequest, AtlassianOAuthStartResponse, AtlassianReadPolicy, AtlassianSelectedSource, AtlassianSourceKind, AtlassianSyncCadence, GetPackResponse, GitHubAppInfo, GitHubAppSetupMode, GitHubBindingStatus, GitHubInstallationBinding, GitHubInstallationLifecycle, GitHubRepositoriesResponse, GoogleDriveBrowseItem, GoogleDriveBrowseResponse, GoogleDriveConnectionLifecycle, GoogleDriveConnectionLifecycleState, GoogleDriveConnectionMetadata, GoogleDriveDisconnectRequest, GoogleDriveLifecycleActionRequest, GoogleDriveKnowledgeSourceConfig, GoogleDriveKnowledgeSourceDestination, GoogleDriveKnowledgeSourceItem, GoogleDriveOAuthStartRequest, GoogleDriveOAuthStartResponse, GoogleDriveReadPolicy, GoogleDriveSelectedSource, GoogleDriveSyncCadence, GoogleDriveTargetScope, GitHubRepository, GitHubRepositoryScope, GoalSpec, IntegrationClientMetadata, KnownPermission, KnownSessionEventType, KnownUsageEventType, KnowledgeMemory, KnowledgeMemoryKind, KnowledgeMemorySearchRequest, KnowledgeMemoryStatus, KnowledgeSourceKind, KnowledgeSourceRef, GitCredentialProvider, GitCredentialBindingId, GitRepositoryAccess, PrReviewProvider, PrReviewCredentialKind, PrReviewWebhookAuthKind, PrReviewAppRegistration, PrReviewManagedGitHubInstallation, PrReviewManagedGitHubSetup, PrReviewRepositoryBinding, CreatePrReviewAppRegistrationRequest, UpdatePrReviewAppRegistrationRequest, CreatePrReviewRepositoryBindingRequest, UpdatePrReviewRepositoryBindingRequest, ListPrReviewConfigurationResponse, ListApiKeysResponse, ListConnectionsResponse, ListPacksResponse, ListSlackUserLinkAccessRequestsResponse, ListWorkspaceMemberCandidatesResponse, ListWorkspaceMembersResponse, McpServerConnectionRef, McpPersonalConnectionDelegation, McpPersonalConnectionSummary, OAuthStartRequest, OAuthStartResponse, PackInstallation, PackInstallationPreview, PackInstallationStatus, PackComponentResolution, PackComponentResolutionStatus, PackRigResolution, PackUninstallPreview, PreviewPackInstallationRequest, InstallPackRequest, UninstallPackRequest, UninstallPackResult, Permission, PrepareSlackUserLinkAccessRequest, ProductAccessMode, LatencyMode, ReasoningEffort, GeneratedImageReceipt, GeneratedVideoFacts, GeneratedVideoReceipt, MediaGenerationResult, RetainedArtifactContent, RetainedArtifactContentOptions, RetainedArtifactDownload, RetainedArtifactDownloadOptions, RetainedArtifactMetadata, RetainedArtifactReference, RetainedArtifactUnavailable, RetainedOutputKind, RetainedOutputUnavailableReason, UpdateVideoGenerationPolicyRequest, VideoArtifactPlaybackSource, VideoGenerationAspectRatio, VideoGenerationCapabilities, VideoGenerationFundingOption, VideoGenerationFundingSource, VideoGenerationModelCapability, VideoGenerationOperationSummary, VideoGenerationPolicy, VideoGenerationPublicStatus, VideoGenerationResolution, VideoGenerationSourceMode, VideoGenerationTerminalFailureStatus, RecordingAvailablePayload, RecordingCodec, RecordingContentType, RecordingFailedPayload, RecordingFailedReason, RecordingMode, RecordingStartedPayload, RegisterCapabilityPackRequest, RepositoryResourceRef, ResourceRef, SaveGoogleDriveSourceRequest, SaveGoogleDriveIntegrationSourceRequest, SandboxBackend, SandboxCapabilityName, SandboxOs, ScheduledTask, ScheduledTaskAgentConfig, ScheduledTaskAgentConfigInput, ScheduledTaskDayOfWeek, ScheduledTaskOverlapPolicy, ScheduledTaskRun, ScheduledTaskRunMode, ScheduledTaskRunStatus, ScheduledTaskAction, KnowledgeSourceSyncLimits, KnowledgeSourceSyncRunSummary, ScopedKnowledgeScope, ScheduledTaskScheduleSpec, ScheduledTaskStatus, ScheduledTaskTriggerType, Session, SessionBackgroundCommand, SessionBackgroundCommandActivity, SessionBackgroundCommandListResponse, CancelSessionBackgroundCommandResult, SessionVisibility, SessionTenancyCreateCapabilities, SessionTenancyPublicProjection, UpdateSessionVisibilityRequest, UpdateSessionVisibilityResponse, ForkSessionRequest, ForkSessionResponse, SessionCapabilities, AgentTopologyPageResponse, AgentTopologySession, SessionListResponse, SessionLineageResponse, SessionEffectiveToolPolicy, SessionQueueMutationResponse, SessionQueueSnapshot, SessionControlResponse, ComposerDraft, DeleteSessionQueueItemRequest, EditSessionQueueItemRequest, EffectiveControlBlocker, EffectiveControlResumeOption, EffectiveSessionControl, MoveSessionQueueItemRequest, NewSessionDraft, NewSessionDraftOptions, NewSessionSelectionHistory, SaveComposerDraftRequest, SubmitComposerDraftRequest, SubmitComposerDraftResponse, SaveNewSessionDraftRequest, SessionCommandReceipt, SessionPromptRouting, SteerSessionQueueItemRequest, WorkspaceInferenceControlResponse, SessionPendingInputPreview, SessionSystemUpdate, SessionSystemUpdateKind, SessionSystemUpdateState, SessionSummary, LineageNode, SessionMcpCredentialUpdateInput, SessionMcpApprovalPolicy, SessionMcpServerInput, SessionMcpServerMetadata, SessionToolPolicy, FileSystemCapability, TerminalCapability, GitCapability, DesktopStreamCapability, RecordingCapability, ComputerUseCapability, ClientAuthConfig, StreamUrlRotatedPayload, StreamOpenedPayload, StreamClosedPayload, StreamRevokedPayload, AttachViewerRequest, AttachViewerResponse, ViewerHolder, AcknowledgeStreamRequest, AcknowledgeStreamResponse, ViewerHeartbeatRequest, ViewerHeartbeatResponse, SessionEvent, SessionEventCompactResult, SessionEventCompactResultOptions, SessionEventListOptions, SessionEventLatestClass, SessionEventPage, SessionEventPayloadMode, SessionEventReadDirection, SessionEventReadMode, SessionEventResultMode, SessionEventSemanticClass, SessionEventType, SessionGoal, SessionGoalRevision, ListSessionGoalRevisionsOptions, ListSessionGoalRevisionsResponse, RejectSessionGoalRevisionRequest, RejectSessionGoalRevisionResponse, RollbackSessionGoalRevisionRequest, SessionGoalCreatedBy, SessionGoalStatus, SessionHumanInputRequest, SessionStatus, SessionStatusChangedPayload, SessionStructuredCapabilities, SessionTurn, DraftTimelineAnnotation, SubmittedTimelineAnnotation, TimelineAnnotation, TimelineAnnotationSource, TimelineAnnotationSourceEventType, TimelineAnnotationSourceKind, ServiceTurnInitiator, ServiceTurnInitiatorContext, TurnInitiatorContext, SessionTurnSource, SessionTurnStatus, SubmitHumanInputResponseRequest, TurnInitiator, ToolAuthNeededPayload, UpdateConnectionRequest, SandboxCommandOutputDeltaPayload, FsChangeKind, FsChangedPayload, GitChangedPayload, TerminalPtyStartedPayload, TerminalPtyOutputDeltaPayload, TerminalPtyExitedPayload, FsNodeType, FsTreeNode, FsEncoding, FsListRequest, FsListResponse, FsListBatchRequest, FsListBatchResponse, FsReadRequest, FsReadResponse, PublishSandboxFileArtifactRequest, SandboxFileArtifactReceipt, FsWriteRequest, FsWriteResponse, FsDeleteRequest, FsDeleteResponse, FsMoveRequest, FsMoveResponse, FsMkdirRequest, FsMkdirResponse, GitFileStatusCode, GitFileStatus, GitStatusRequest, GitStatusResponse, GitDiffLineType, GitDiffLine, GitDiffHunk, GitFileDiff, GitDiffRequest, GitDiffResponse, GitReadBatchItemRequest, GitReadBatchRequest, GitReadBatchItemResponse, GitReadBatchResponse, GitLogRequest, GitCommit, GitLogResponse, GitShowRequest, GitShowResponse, SetWorkspaceEnvironmentVariableRequest, WorkspaceCaptureFile, WorkspaceCaptureRepo, WorkspaceCaptureDegradedReason, WorkspaceCaptureStats, WorkspaceCaptureManifest, WorkspaceRevisionCapturedPayload, WorkspaceRevisionDegradedPayload, WorkspaceCaptureSignedUrl, GetWorkspaceCaptureResponse, GetWorkspaceCaptureFileResponse, TerminalExecRequest, TerminalExecResponse, PtyOpenRequest, PtyOpenResponse, PtyWriteRequest, PtyResizeRequest, PtyCloseRequest, ToolRef, SlackUserLinkAccessMutationRequest, SlackUserLinkAccessRequest, SlackUserLinkAccessRequestStatus, UpdateKnowledgeMemoryRequest, UpdateScheduledTaskRequest, UpdateSessionGoalRequest, UpdateSessionMcpApprovalPolicyRequest, UpdateSessionMcpApprovalPolicyResponse, UpdateSessionAttentionRequest, UpdateSessionArchiveRequest, UpdateSessionPinRequest, UpdateSessionRequest, UpdateSessionVariableSetsRequest, UpdateSessionToolPolicyRequest, UpdateVariableSetRequest, UpdateWorkspaceEnvironmentRequest, UpdateWorkspaceMemberRequest, UpdateWorkspaceRequest, UpdateWorkspaceModelAccessPolicyRequest, UpdateWorkspaceSettingsRequest, WorkspaceSlackReactionSummonSettings, TranscribeAudioResponse, UploadFileInput, UsageEvent, UsageEventType, UserApprovalDecisionEventInput, UserHumanInputResponseEventInput, UserMessageEventInput, PersonalResourceAttachmentIntent, PersonalResourceAttachmentSummary, UserResourceAuthoritySummary, UserResourceAuthorityGrant, UserResourceKind, ListUserResourceAuthoritiesOptions, ListUserResourceAuthoritiesResponse, Workspace, WorkspaceControlEvent, VariableSet, VariableSetAttachmentMetadata, ResolveVariableSetAttachmentsRequest, ResolveVariableSetAttachmentsResponse, VariableSetSecret, VariableSetVariableMetadata, Channel, CreateChannelRequest, ReorderChannelsRequest, UpdateChannelRequest, UpdateSessionChannelRequest, Rig, RigVersion, RigCheck, RigChange, RigChangeKind, RigChangeStatus, RigCheckResult, RigChangeVerification, CreateRigRequest, UpdateRigRequest, RigSetupAppendPayload, RigDefinitionEditPayload, ProposeRigChangeRequest, WorkspaceEnvironment, WorkspaceEnvironmentVariableMetadata, WorkspaceMember, WorkspaceMemberCandidate, PreviewSkillImportRequest, ApiIntegrationAuthPreview, ApiIntegrationInstallationSummary, IntegrationDefinitionSummary, ApiIntegrationPreview, ApiIntegrationOAuthStartRequest, ApiIntegrationProtocol, IntegrationSource, ApiIntegrationToolPreview, ApiIntegrationUninstallPreview, IntegrationFacetBindingSummary, IntegrationFacetDefinitionSummary, IntegrationFacetKind, IntegrationFacetMutationResult, IntegrationFacetRemovalResult, IntegrationFacetStatus, IntegrationInstanceFacetsResponse, InstallApiIntegrationRequest, InstalledApiIntegration, ListIntegrationDefinitionsResponse, ListApiIntegrationsResponse, PreviewApiIntegrationRequest, MutateIntegrationFacetRequest, UpsertIntegrationFacetRequest, SkillImportFileSummary, SkillImportPreview, SkillImportSource, SkillInstallationSource, SkillUninstallPreview, UninstallSkillRequest, UninstallSkillResult, UninstallApiIntegrationRequest, UninstallApiIntegrationResult, PluginManifest, PluginManifestComponent, PluginComponentBinding, PreviewPluginRequest, PluginComponentPreview, PluginUpdateDiff, PluginPreview, InstallPluginRequest, InstalledPlugin, PluginInstallationSummary, ListInstalledPluginsResponse, PluginUninstallPreview, UninstallPluginRequest, UninstallPluginResult, WorkspaceMemorySearchMode, WorkspaceMemorySearchRequest, WorkspaceMemorySearchResult, WorkspaceMemorySearchResponse, WorkspaceSessionDefaults, WorkspaceSettings, WorkspaceVideoGenerationSettings, WorkspaceVoiceInputSettings, WorkspaceRegisteredPack, MetricSample, MachineState, MachineKind, MachineConnectionAuthority, MachineRuntimeCapabilities, MachineUpdateStatus, MachineUpdateState, MachineRuntime, UpdateMachineAgentResponse, MachineOperationPolicy, UpdateMachineOperationPolicyRequest, MachineView, MachinesResponse, MachineMetricsSeriesResponse, RemoveEnrollmentRequest, RemoveEnrollmentResponse, SwapActiveSandboxRequest, SwapActiveSandboxResponse, EnrollmentOs, ResourceAuthorityScope, DeviceEnrollmentLookupRequest, DeviceEnrollmentLookupResponse, DeviceEnrollmentLookupMachine, DeviceEnrollmentApproveRequest, DeviceEnrollmentApproveResponse, DeviceEnrollmentDenyRequest, DeviceEnrollmentDenyResponse, MintEnrollTokenRequest, MintEnrollTokenResponse, EnrollmentCredentials, EnrollTokenExchangeRequest, EnrollTokenExchangeResponse, } from "./types.js";
+export type { AccessContext, AccessCredential, ActivateCodexRealtimeConnectionRequest, AccessGrant, AccountGrant, AccountRole, AddWorkspaceMemberRequest, ApproveSlackUserLinkAccessRequest, BeginSessionRealtimeRequest, AgentMessageCompletedPayload, AgentTextDeltaPayload, AgentToolCallCreatedPayload, AgentToolCallOutputPayload, ApiKey, BillingBalance, BillingPlanBalance, SubscriptionPlan, SubscriptionPlanCatalog, BillingSubscriptionCatalog, CreateSubscriptionCheckoutRequest, CreateSubscriptionCheckoutResponse, ChangeBillingSubscriptionRequest, CancelBillingSubscriptionRequest, BillingSubscriptionChange, PromotionalCreditScope, PromotionalCreditBalance, BillingEntitlementsResponse, BillingMode, BillingSummary, BillingCheckoutStatus, ListManagedOrganizationMembershipsResponse, ManagedOrganizationMembership, OrganizationAdministrationMember, OrganizationAdministrationMemberWorkspaceAccess, OrganizationAdministrationOverview, OrganizationApiKeyAccess, OrganizationAccessPreset, OrganizationWorkspaceScope, OrganizationAccessPolicy, OrganizationActor, OrganizationInvitation, OrganizationMember, OrganizationMembershipRole, OrganizationSessionListResponse, OrganizationPrivateSessionSettings, OrganizationRecoveryApproval, OrganizationRecoveryCapabilities, OrganizationRecoveryCustodian, OrganizationRecoveryMemberSummary, OrganizationRecoveryMutationResponse, OrganizationRecoveryOperation, OrganizationRecoveryOperationCommandRequest, OrganizationRecoveryOperationState, OrganizationRecoveryOverview, OrganizationRecoveryPolicy, OrganizationRecoveryPolicyState, OrganizationRecoveryUnavailableReason, OrganizationSummary, OrganizationWorkspaceAccess, OrganizationWorkspaceAccessMember, OrganizationWorkspaceRoleDefinition, WorkspaceMemberRole, AssignableWorkspaceMemberRole, CreateOrganizationWorkspaceRequest, UpdateOrganizationWorkspaceRequest, PutOrganizationWorkspaceMemberRequest, RevokeOrganizationWorkspaceMemberRequest, RevokeOrganizationWorkspaceMemberResponse, UpdateOrganizationNameRequest, UpdateOrganizationPrivateSessionSettingsRequest, AcceptOrganizationRecoveryCustodyRequest, ConfigureOrganizationRecoveryPolicyRequest, DisableOrganizationRecoveryPolicyRequest, StartOrganizationRecoveryOperationRequest, BillingUsageResponse, InsightsRange, InsightsBillingPath, InsightsPricingSource, ModelContextContributionSource, InsightsPromptContributionRow, InsightsPromptContributions, InsightsModelUsageRow, InsightsModelCallRow, InsightsSeriesPoint, InsightsDepthBucket, InsightsModelFacet, InsightsSpendDriver, InsightsProjectRow, InsightsWarmGroupRow, InsightsLiveWarmLease, InsightsFloorSession, InsightsScheduleRow, InsightsScope, WorkspaceInsightsSnapshot, WorkspaceInsightsResponse, CapabilityCatalogItem, CapabilityAction, CapabilityCatalogResponse, CapabilityComponentOwner, CapabilityInstallation, CapabilityInstallationStatus, CapabilityKind, CapabilityLifecycle, CapabilityLifecycleStatus, SkillArtifactDefinition, SkillArtifactFile, CapabilityRuntime, CapabilityReadiness, CapabilitySource, CapabilityUnavailableReason, ClientConfig, ClientVoiceInputConfig, ClientModel, CodexRealtimeVoice, CodexRealtimeWebrtcRequest, CodexRealtimeWebrtcResponse, CodexRealtimeWebrtcVersion, GatewayRealtimeConnectRequest, GatewayRealtimeConnectResponse, GatewayRealtimeInitialItem, EndSessionRealtimeRequest, ModelAvailabilityV1, ModelBillingAttributionV1, ModelCostClassV1, ModelCapabilitiesV1, ModelCapabilityStateV1, ModelCapabilitySupportV1, ModelCredentialReadinessV1, ModelCredentialSourceV1, ModelPricingScheduleV1, ModelPricingV1, RenewSessionRealtimeRequest, SessionRealtimeEndReason, SessionRealtimeMode, SessionRealtimeModel, SessionRealtimeMutationResponse, SessionRealtimeStopInstruction, SessionRealtimeState, WorkspaceModelCatalogModel, WorkspaceModelCatalogResponse, DefaultModelSelection, DefaultModelSelectionSource, WorkspaceGatewayCustomModel, WorkspaceGatewayCustomModelsResponse, CreateWorkspaceGatewayCustomModelRequest, DeleteWorkspaceGatewayCustomModelRequest, WorkspaceOpenRouterCustomModel, WorkspaceOpenRouterCustomModelsResponse, CreateWorkspaceOpenRouterCustomModelRequest, DeleteWorkspaceOpenRouterCustomModelRequest, WorkspaceOpperCustomModel, WorkspaceOpperCustomModelsResponse, CreateWorkspaceOpperCustomModelRequest, DeleteWorkspaceOpperCustomModelRequest, OrganizationModelProviderKind, ClaudeSubscriptionUsage, ClaudeSubscriptionOAuthStartResponse, ClaudeSubscriptionOAuthCompleteRequest, ClaudeSubscriptionOAuthCompleteResponse, ClaudeUsageWindow, ClaudeUsageRequestStatus, OrganizationModelProviderConnection, UpsertOrganizationModelProviderConnectionRequest, RevokeOrganizationModelProviderConnectionRequest, OrganizationProviderCustomModel, OrganizationProviderCustomModelsResponse, CreateOrganizationProviderCustomModelRequest, DeleteOrganizationProviderCustomModelRequest, WorkspaceModelAccessPolicy, OrganizationModelDefaults, UpdateOrganizationModelDefaultsRequest, ModelAccountRotationMode, ModelAccountSettingKey, ModelAccountSettingSource, ModelAccountSettingValues, ModelAccountSettingsView, ModelAccountSettingsOverview, OrganizationModelAccountSettings, UpdateOrganizationModelAccountSettingsRequest, WorkspaceModelAccountSettings, UpdateWorkspaceModelAccountSettingsRequest, ModelAccountChoiceRefusal, ModelAccountChoiceOption, ModelAccountUsageSnapshot, SessionModelAccountChoiceResponse, SetSessionModelAccountChoiceRequest, SetSessionModelAccountChoiceResponse, ModelAccountPreferences, UpdateModelAccountPreferencesRequest, OrganizationAgentAdminAccess, UpdateOrganizationAgentAdminAccessRequest, OrganizationPrivacySettings, UpdateOrganizationPrivacySettingsRequest, SessionAdminAccess, GrantSessionAdminAccessRequest, WorkspaceRealtimeModelCatalogItem, WorkspaceRealtimeModelCatalogResponse, CodexAccount, CodexPlanExcludedModel, CodexAccountOverview, CodexAccountsResponse, SessionCodexAccountsResponse, OrganizationCodexAccountsResponse, CodexAllocatorUpdate, CodexAccountSwitchedPayload, CodexConnectionStatus, CodexConnectStart, CodexConnectPoll, SuperGrokAccount, SuperGrokAccountsResponse, SuperGrokAccountScope, SuperGrokAllocatorUpdate, SuperGrokConnectionStatus, SuperGrokConnectPoll, SuperGrokConnectStart, SuperGrokRotationSettings, CodexFleetConfidence, CodexFleetCacheState, CodexFleetDecisionEventPayload, CodexFleetDecisionScore, CodexFleetShadowComparison, CodexOverviewResponse, CodexResetCredit, CodexResetRedemptionRecovery, CodexRotationSettings, CodexUsage, CodexUsageMap, WorkspaceCodexSubscriptionMode, WorkspaceCodexSubscriptionSource, CodexUsagePayload, CodexUsageWindow, CompactSessionContextResult, ClientSessionEventInput, CompleteFileUploadResponse, ConnectionKind, ConnectionMetadata, McpConnectionAccountSelection, ConnectionOwnership, ConnectionResponse, ConnectionStatus, PersonalGitHubConnectionMetadata, PersonalGitHubConnectionStatusResponse, PersonalGitHubDisconnectRequest, PersonalGitHubOAuthStartRequest, PersonalGitHubOAuthStartResponse, ListGitHubRepositoryBranchesOptions, ListPersonalGitHubRepositoriesOptions, ListPersonalGitHubRepositoriesResponse, PersonalGitHubRepository, PersonalGitHubRepositoryAccess, PersonalGitHubRepositoryCatalogItem, PersonalGitHubRepositoryPermissions, PersonalGitHubRepositorySelectionInput, PersonalGitHubRepositorySelectionState, PersonalGitHubSelectedRepository, ReplacePersonalGitHubRepositorySelectionsRequest, VerifyPersonalGitHubRepositorySelectionsRequest, ConnectorDocumentDestination, ConnectorDocumentDestinationAuthority, ConnectorDocumentDestinationSelection, SocialConnection, SocialConnectionStatus, SocialOAuthStartRequest, AddDocumentRequest, CreateApiKeyRequest, CreateApiKeyResponse, CreateOrganizationApiKeyRequest, UpdateOrganizationApiKeyRequest, OrganizationMcpConnection, OrganizationMcpConnectionList, PersonalApiKey, ListPersonalApiKeysResponse, CreatePersonalApiKeyRequest, CreatePersonalApiKeyResponse, UpdateOrganizationMcpConnectionRequest, OrganizationServiceAccount, OrganizationServiceAccountRole, ListOrganizationServiceAccountsResponse, CreateOrganizationServiceAccountRequest, UpdateOrganizationServiceAccountRequest, McpConnectionRequest, McpConnectionDecision, NativeAppPlatform, NativeAppAuthorizeInput, NativeAppTokenInput, NativeAppToken, NativePushDevice, NativePushRule, InboxItem, InboxItemChoice, InboxItemFact, InboxItemLink, InboxItemKind, InboxItemSender, InboxSettings, MemberNotificationsSetting, SessionInboxMute, InboxTidyPolicy, ListInboxResponse, UpdateInboxItemInput, RegisterNativePushDeviceInput, CreateCapabilityCatalogItemRequest, OpenGeniSlackBotInstallRequest, OpenGeniSlackBotInstallStart, SlackInstallationBinding, SlackInstallationBindingState, ListScheduledTaskAccessAttentionResponse, ListSlackInstallationBindingsResponse, SlackChannelRoute, SlackChannelRouteListResponse, UpdateSlackChannelRoutesRequest, SlackReactionChannel, SlackReactionChannelListResponse, ApiKeyConnectionCredential, ConnectionCredentialPlacement, CreateConnectionRequest, InlineOpenApiDocumentSource, IntegrationSourceInput, IntegrationSourceProjection, SessionApprovalRequest, CreateBillingPortalRequest, CreateBillingPortalResponse, CreateCheckoutRequest, CreateCheckoutResponse, CreateDocumentBaseRequest, CreateFileUploadRequest, CreateFileUploadResponse, CreateGitHubAppManifestRequest, CreateGitHubAppManifestResponse, CreateKnowledgeDropRequest, CreateKnowledgeMemoryRequest, CreateScheduledTaskRequest, CreateSessionScheduledTaskRequest, CreateSessionRequest, CreateWorkspaceRequest, EnsureWorkspaceRequest, EnsureWorkspaceResponse, DiscoverMcpCapabilitiesResponse, InstallSkillRequest, InstallLibrarySkillRequest, InstalledSkill, InstalledSkillSummary, ListInstalledSkillsResponse, Document, DocumentAuthorityKind, DocumentBase, DocumentCuration, DocumentCurationStatus, DocumentSearchMode, DocumentSearchRequest, DocumentSearchResponse, DocumentSearchResult, DocumentStatus, DocumentVisibility, MoveDocumentRequest, EnableCapabilityRequest, Entitlements, EntitlementValue, EntitlementsMode, FileAsset, FileListRequest, FileListResponse, HumanInputAnswer, HumanInputOption, HumanInputQuestion, HumanInputQuestionKind, HumanInputResponse, HumanInputSecretAnswer, HumanInputSecretAnswerResult, HumanInputSecretSaveTo, HumanInputSecretSpec, GeneratePasswordSpec, VaultPolicy, FileDownloadUrlResponse, FileResourceRef, FileStatus, FileUploadData, FirstPartyMcpToolName, AtlassianBrowseItem, AtlassianBrowseResponse, AtlassianConnectionLifecycle, AtlassianConnectionMetadata, AtlassianDisconnectRequest, AtlassianLifecycleActionRequest, AtlassianOAuthStartResponse, AtlassianReadPolicy, AtlassianSelectedSource, AtlassianSourceKind, AtlassianSyncCadence, GitHubActionPoliciesResponse, GitHubActionPolicyActor, GitHubActionPolicyActorState, GitHubActionPolicyDecision, GitHubActionPolicyEffectiveDecision, GitHubActionPolicyGroup, GitHubAppInfo, GitHubAppSetupMode, GitHubBindingStatus, GitHubInstallationBinding, GitHubInstallationLifecycle, GitHubRepositoryBranch, GitHubRepositoryBranchesResponse, VerifyPublicGitHubRepositoryRefRequest, VerifyPublicGitHubRepositoryRefResponse, GitHubRepositoriesResponse, UpdateGitHubActionPolicyRequest, GoogleDriveBrowseItem, GoogleDriveBrowseResponse, GoogleDriveConnectionLifecycle, GoogleDriveConnectionLifecycleState, GoogleDriveConnectionMetadata, GoogleDriveDisconnectRequest, GoogleDriveLifecycleActionRequest, GoogleDriveKnowledgeSourceConfig, GoogleDriveKnowledgeSourceDestination, GoogleDriveKnowledgeSourceItem, GoogleDriveOAuthStartRequest, GoogleDriveOAuthStartResponse, GoogleDriveReadPolicy, GoogleDriveSelectedSource, GoogleDriveSyncCadence, GoogleDriveTargetScope, GitHubRepository, GitHubRepositoryScope, GoalSpec, SessionGoalReportRequirement, SessionGoalReportDelivery, IntegrationClientMetadata, KnownPermission, KnownSessionEventType, KnownUsageEventType, KnowledgeMemory, KnowledgeMemoryKind, KnowledgeMemorySearchRequest, KnowledgeMemoryStatus, KnowledgeSourceKind, KnowledgeSourceRef, GitCredentialProvider, GitCredentialBindingId, GitRepositoryAccess, PrReviewProvider, PrReviewCredentialKind, PrReviewWebhookAuthKind, PrReviewAppRegistration, PrReviewManagedGitHubInstallation, PrReviewManagedGitHubSetup, PrReviewRepositoryBinding, CreatePrReviewAppRegistrationRequest, UpdatePrReviewAppRegistrationRequest, CreatePrReviewRepositoryBindingRequest, UpdatePrReviewRepositoryBindingRequest, ListPrReviewConfigurationResponse, ListApiKeysResponse, ListOrganizationSessionsOptions, ListConnectionsResponse, ListSlackUserLinkAccessRequestsResponse, ListWorkspaceMemberCandidatesResponse, ListWorkspaceMembersResponse, McpServerConnectionRef, McpPersonalConnectionDelegation, McpPersonalConnectionSummary, OAuthStartRequest, OAuthStartResponse, Permission, PrepareSlackUserLinkAccessRequest, ProductAccessMode, LatencyMode, ReasoningEffort, GeneratedImageReceipt, GeneratedVideoFacts, GeneratedVideoReceipt, MediaGenerationResult, RetainedArtifactContent, RetainedArtifactContentOptions, RetainedArtifactDownload, RetainedArtifactDownloadOptions, RetainedArtifactMetadata, RetainedArtifactReference, RetainedArtifactUnavailable, RetainedOutputKind, RetainedOutputUnavailableReason, UpdateVideoGenerationPolicyRequest, VideoArtifactPlaybackSource, VideoGenerationAspectRatio, VideoGenerationCapabilities, VideoGenerationFundingOption, VideoGenerationFundingSource, VideoGenerationModelCapability, VideoGenerationOperationSummary, VideoGenerationPolicy, VideoGenerationPublicStatus, VideoGenerationResolution, VideoGenerationSourceMode, VideoGenerationTerminalFailureStatus, RecordingAvailablePayload, RecordingCodec, RecordingContentType, RecordingFailedPayload, RecordingFailedReason, RecordingMode, RecordingStartedPayload, RepositoryResourceRef, ResourceRef, SaveGoogleDriveSourceRequest, SaveGoogleDriveIntegrationSourceRequest, SandboxBackend, SandboxCapabilityName, SandboxOs, ScheduledTask, ScheduledTaskAccessAttention, PrivateScheduledTaskSummary, ScheduledTaskAccessConnector, ScheduledTaskAccessFailureReason, ScheduledTaskAccountPlan, ScheduledTaskAccountPlanAccount, ScheduledTaskAccountPlanConnector, ScheduledTaskToolPolicy, ScheduledTaskAgentConfig, ScheduledTaskAgentConfigInput, ScheduledTaskDayOfWeek, ScheduledTaskOverlapPolicy, ScheduledTaskPolicyDrift, RefreshScheduledTaskAccessRequest, ScheduledTaskRun, ScheduledTaskRunAccessFailure, ScheduledTaskRunMode, ScheduledTaskRunStatus, ScheduledTaskAction, KnowledgeSourceSyncLimits, KnowledgeSourceSyncRunSummary, ScopedKnowledgeScope, ScheduledTaskScheduleSpec, ScheduledTaskStatus, ScheduledTaskTriggerType, Session, SessionAdmissionBlock, SessionBackgroundCommand, SessionBackgroundCommandReconciliation, SessionBackgroundCommandActivity, SessionBackgroundCommandListResponse, CancelSessionBackgroundCommandResult, SessionVisibility, SessionTenancyCreateCapabilities, SessionTenancyPublicProjection, UpdateSessionVisibilityRequest, UpdateSessionVisibilityResponse, SessionTenancyBlocker, SessionVisibilityWork, SessionVisibilityChangePreview, ForkSessionRequest, ForkSessionResponse, SessionCapabilities, AgentTopologyPageResponse, AgentTopologySession, SessionListResponse, SessionListTotals, SessionListEntry, SessionListEntryResponse, SessionLineageResponse, SessionEffectiveToolPolicy, SessionQueueMutationResponse, SessionQueueSnapshot, SessionControlResponse, SessionRetryRequest, SandboxRecoverySelection, SandboxRecoveryProjection, SandboxRecoveryRequest, SandboxRecoveryResponse, SessionRetryResponse, ComposerDraft, DeleteSessionQueueItemRequest, EditSessionQueueItemRequest, EffectiveControlBlocker, EffectiveControlResumeOption, EffectiveSessionControl, MoveSessionQueueItemRequest, NewSessionDraft, NewSessionDraftOptions, NewSessionSelectionHistory, SaveComposerDraftRequest, SubmitComposerDraftRequest, SubmitComposerDraftResponse, SaveNewSessionDraftRequest, SessionCommandReceipt, SessionPromptRouting, SteerSessionQueueItemRequest, WorkspaceInferenceControlResponse, WorkspacePauseTimer, WorkspacePauseTimerRequest, SessionPendingInputPreview, SessionSystemUpdate, SessionSystemUpdateKind, SessionSystemUpdateState, SessionSummary, LineageNode, SessionMcpCredentialUpdateInput, RotateSessionMcpCredentialsRequest, RotateSessionMcpCredentialsReceipt, SessionMcpApprovalPolicy, SessionMcpApprovalPolicyTarget, SessionMcpServerInput, SessionMcpServerMetadata, SessionToolPolicy, FileSystemCapability, TerminalCapability, GitCapability, DesktopStreamCapability, RecordingCapability, ComputerUseCapability, ClientAuthConfig, StreamUrlRotatedPayload, StreamOpenedPayload, StreamClosedPayload, StreamRevokedPayload, AttachViewerRequest, AttachViewerResponse, ViewerHolder, AcknowledgeStreamRequest, AcknowledgeStreamResponse, ViewerHeartbeatRequest, ViewerHeartbeatResponse, SessionEvent, SessionEventCompactResult, SessionEventCompactResultOptions, SessionEventListOptions, SessionEventLatestClass, SessionEventPage, SessionEventPayloadMode, SessionEventReadDirection, SessionEventReadMode, SessionEventResultMode, SessionEventSemanticClass, SessionEventType, SessionGoal, SessionGoalRevision, ListSessionGoalRevisionsOptions, ListSessionGoalRevisionsResponse, RejectSessionGoalRevisionRequest, RejectSessionGoalRevisionResponse, RollbackSessionGoalRevisionRequest, SessionGoalCreatedBy, SessionGoalStatus, SessionHumanInputRequest, SessionStatus, SessionStatusChangedPayload, SessionStructuredCapabilities, SessionTurn, DraftTimelineAnnotation, SubmittedTimelineAnnotation, TimelineAnnotation, TimelineAnnotationSource, TimelineAnnotationSourceEventType, TimelineAnnotationSourceKind, ServiceTurnInitiator, ServiceTurnInitiatorContext, TurnInitiatorContext, SessionTurnSource, SessionTurnStatus, SubmitHumanInputResponseRequest, TurnInitiator, ToolAuthNeededPayload, UpdateConnectionRequest, SandboxCommandOutputDeltaPayload, FsChangeKind, FsChangedPayload, GitChangedPayload, TerminalPtyStartedPayload, TerminalPtyOutputDeltaPayload, TerminalPtyExitedPayload, FsNodeType, FsTreeNode, FsEncoding, FileSystemRouteIdentity, FsListRequest, FsListResponse, FsListBatchRequest, FsListBatchResponse, FsReadRequest, FsReadResponse, PublishSandboxFileArtifactRequest, SandboxFileArtifactReceipt, FsWriteRequest, FsWriteResponse, FsDeleteRequest, FsDeleteResponse, FsMoveRequest, FsMoveResponse, FsMkdirRequest, FsMkdirResponse, GitFileStatusCode, GitFileStatus, GitStatusRequest, GitStatusResponse, GitDiffLineType, GitDiffLine, GitDiffHunk, GitFileDiff, GitDiffRequest, GitDiffResponse, GitReadBatchItemRequest, GitReadBatchRequest, GitReadBatchItemResponse, GitReadBatchResponse, GitLogRequest, GitCommit, GitLogResponse, GitShowRequest, GitShowResponse, WorkspaceCaptureFile, WorkspaceCaptureRepo, WorkspaceCaptureDegradedReason, WorkspaceCaptureStats, WorkspaceCaptureManifest, WorkspaceRevisionCapturedPayload, WorkspaceRevisionDegradedPayload, WorkspaceCaptureSignedUrl, GetWorkspaceCaptureResponse, GetWorkspaceCaptureFileResponse, TerminalExecRequest, TerminalExecResponse, PtyOpenRequest, PtyOpenResponse, PtyWriteRequest, PtyResizeRequest, PtyCloseRequest, ToolRef, SlackUserLinkAccessMutationRequest, SlackUserLinkAccessRequest, SlackUserLinkAccessRequestStatus, UpdateKnowledgeMemoryRequest, UpdateScheduledTaskRequest, UpdateSessionGoalRequest, UpdateSessionMcpApprovalPolicyRequest, UpdateSessionMcpApprovalPolicyResponse, UpdateSessionAttentionRequest, UpdateSessionArchiveRequest, UpdateSessionRetentionRequest, SessionRetention, UpdateSessionPinRequest, UpdateSessionRequest, UpdateSessionToolPolicyRequest, UpdateSessionAgentRequest, AgentCapabilityId, AgentSkillsCapability, AgentCapabilityToggles, AgentCapabilities, AgentRenderer, AgentConfigRequest, WorkspaceAgentDefaults, ResolvedAgentCapabilities, ResolvedAgentConfig, AgentEffectiveTools, ClientAgentConfig, AgentConfigErrorCode, UpdateWorkspaceMemberRequest, UpdateWorkspaceRequest, UpdateWorkspaceModelAccessPolicyRequest, UpdateWorkspaceSettingsRequest, WorkspaceSlackReactionSummonSettings, TranscribeAudioResponse, UploadFileInput, UsageEvent, UsageEventType, UserApprovalDecisionEventInput, UserHumanInputResponseEventInput, UserMessageEventInput, PersonalResourceAttachmentIntent, PersonalResourceAttachmentSummary, UserResourceAuthoritySummary, UserResourceAuthorityGrant, UserResourceKind, ListUserResourceAuthoritiesOptions, ListUserResourceAuthoritiesResponse, Workspace, WorkspaceControlEvent, Channel, CreateChannelRequest, ReorderChannelsRequest, UpdateChannelRequest, UpdateSessionChannelRequest, Rig, RigVersion, RigCheck, RigChange, RigChangeKind, RigChangeStatus, RigCheckResult, RigChangeVerification, CreateRigRequest, UpdateRigRequest, RigSetupAppendPayload, RigDefinitionEditPayload, ProposeRigChangeRequest, WorkspaceMember, WorkspaceMemberCandidate, PreviewSkillImportRequest, ApiIntegrationAuthPreview, ApiIntegrationInstallationSummary, IntegrationDefinitionSummary, ApiIntegrationPreview, ApiIntegrationOAuthStartRequest, ApiIntegrationProtocol, IntegrationSource, ApiIntegrationToolPreview, ApiIntegrationUninstallPreview, IntegrationFacetBindingSummary, IntegrationFacetDefinitionSummary, IntegrationFacetKind, IntegrationFacetMutationResult, IntegrationFacetRemovalResult, IntegrationFacetStatus, IntegrationInstanceFacetsResponse, InstallApiIntegrationRequest, InstalledApiIntegration, ListIntegrationDefinitionsResponse, ListApiIntegrationsResponse, PreviewApiIntegrationRequest, MutateIntegrationFacetRequest, UpsertIntegrationFacetRequest, SkillImportFileSummary, SkillImportPreview, SkillImportSource, SkillInstallationSource, SkillUninstallPreview, UninstallSkillRequest, UninstallSkillResult, UninstallApiIntegrationRequest, UninstallApiIntegrationResult, PluginManifest, PluginManifestComponent, PluginComponentBinding, PreviewPluginRequest, PluginComponentPreview, PluginUpdateDiff, PluginPreview, InstallPluginRequest, InstalledPlugin, PluginInstallationSummary, ListInstalledPluginsResponse, PluginUninstallComponentImpact, PluginUninstallPreview, UninstallPluginRequest, UninstallPluginResult, WorkspaceMemorySearchMode, WorkspaceMemorySearchRequest, WorkspaceMemorySearchResult, WorkspaceMemorySearchResponse, WorkspaceSessionDefaults, WorkspaceSettings, WorkspaceVideoGenerationSettings, WorkspaceVoiceInputSettings, VoiceInputProviderId, MetricSample, MachineState, MachineKind, MachineConnectionAuthority, MachineRuntimeCapabilities, MachineUpdateStatus, MachineUpdateState, MachineRuntime, UpdateMachineAgentResponse, EnableMachineScreenControlResponse, MachineMacPermissions, MachinePrivacySettingsPane, OpenMachinePrivacySettingsRequest, OpenMachinePrivacySettingsResponse, MachineAudience, MachineAudienceAction, MachineAudienceItem, MachineAudienceSummary, MachineAudiencePreview, MachineAudiencePreviewRequest, ChangeMachineAudienceRequest, ChangeMachineAudienceResponse, MachineOperationPolicy, UpdateMachineOperationPolicyRequest, MachineView, MachinesResponse, MachineMetricsSeriesResponse, RemoveEnrollmentRequest, RemoveEnrollmentResponse, SwapActiveSandboxRequest, SwapActiveSandboxResponse, EnrollmentOs, ResourceAuthorityScope, DeviceEnrollmentLookupRequest, DeviceEnrollmentLookupResponse, DeviceEnrollmentLookupMachine, DeviceEnrollmentApproveRequest, DeviceEnrollmentApproveResponse, DeviceEnrollmentDenyRequest, DeviceEnrollmentDenyResponse, EnrollTokenScope, MintEnrollTokenRequest, MintEnrollTokenResponse, EnrollmentCredentials, EnrollTokenExchangeRequest, EnrollTokenExchangeResponse, } from "./types.js";
+export type { FeedbackSentiment, CreateFeedbackRequest, Feedback, FeedbackSubmissionResponse, } from "./feedback.js";
+export type * from "./knowledge.js";
+export type { ConnectorToolPermission, ConnectorToolPermissionEntry, ConnectorToolPermissionsResponse, UpdateConnectorToolPermissionsRequest, SessionMcpToolPermissionsResponse, UpdateSessionMcpToolPermissionsRequest, } from "./types.js";
+export { sessionListEntry } from "./session-list-entries.js";