@opengeni/sdk 4.0.2 → 5.0.0-canary.0

package/dist/chunk-TARU5CD2.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/types.ts"],"sourcesContent":["import type { WorkspaceTranscriptionPolicy } from \"./transcription\";\n\nexport type BundledSkillId =\n  | \"builtin:opengeni-skills\"\n  | \"builtin:opengeni-projects\"\n  | \"builtin:opengeni-documents\"\n  | \"builtin:opengeni-spreadsheets\"\n  | \"builtin:opengeni-presentations\"\n  | \"builtin:opengeni-sites\"\n  | \"builtin:opengeni-video-generation\";\n\n// Hand-written mirrors of the public wire shapes in `@opengeni/contracts`.\n// Ordinary SDK entries stay framework-agnostic and do not import the contracts\n// runtime; `test/contract-parity.test.ts` pins these types to the contracts\n// package so drift fails the gate instead of shipping.\n\nexport type CodexRealtimeWebrtcVersion = \"v3\";\nexport type CodexRealtimeVoice =\n  | \"juniper\"\n  | \"maple\"\n  | \"spruce\"\n  | \"ember\"\n  | \"vale\"\n  | \"breeze\"\n  | \"arbor\"\n  | \"sol\"\n  | \"cove\";\n\nexport type CodexRealtimeWebrtcRequest = {\n  realtimeId: string;\n  operationId: string;\n  browserInstanceId: string;\n  ownerKey: string;\n  expectedVersion: number;\n  expectedConnectionEpoch: number;\n  rotate: boolean;\n  browserActivation?: \"required\" | undefined;\n  sdp: string;\n  version: CodexRealtimeWebrtcVersion;\n  instructions?: string | undefined;\n  voice?: CodexRealtimeVoice | undefined;\n};\n\nexport type CodexRealtimeWebrtcResponse = {\n  sdp: string;\n  version: CodexRealtimeWebrtcVersion;\n  model: \"gpt-live-1-boulder-alpha\";\n  connectionId: string;\n  connectionEpoch: number;\n  startupFenceSequence: number;\n  modeVersion: number;\n  replay: boolean;\n};\n\nexport type GatewayRealtimeConnectRequest = {\n  realtimeId: string;\n  operationId: string;\n  browserInstanceId: string;\n  ownerKey: string;\n  expectedVersion: number;\n  expectedConnectionEpoch: number;\n  rotate: boolean;\n};\n\nexport type GatewayRealtimeInitialItem = {\n  role: \"user\" | \"developer\" | \"assistant\";\n  text: string;\n};\n\nexport type GatewayRealtimeConnectResponse = {\n  token: string;\n  url: string;\n  upstreamModelId: string;\n  expiresAt: number | null;\n  connectionId: string;\n  connectionEpoch: number;\n  startupFenceSequence: number;\n  modeVersion: number;\n  initialItems: GatewayRealtimeInitialItem[];\n  instructions: string;\n  replay: false;\n};\n\nexport type ToolGatewayIdentity = {\n  serverId: string;\n  toolName: string;\n};\n\nexport type ToolGatewayCatalogEntry = {\n  identity: ToolGatewayIdentity;\n  modelName: string;\n  codemodePath: string[];\n  title?: string | undefined;\n  description?: string | undefined;\n  inputSchema: Record<string, unknown>;\n  outputSchema?: Record<string, unknown> | undefined;\n  annotations?: Record<string, unknown> | undefined;\n  icons?: Array<Record<string, unknown>> | undefined;\n  source: \"opengeni\" | \"files\" | \"docs\" | \"mcp\" | \"codex_apps\" | \"interaction\";\n  approval: \"none\" | \"human\" | \"policy\";\n};\n\nexport type ToolGatewayCatalog = {\n  version: 1;\n  accountId: string;\n  workspaceId: string;\n  generation: number;\n  digest: string;\n  createdAt: string;\n  entries: ToolGatewayCatalogEntry[];\n};\n\nexport type ToolGatewayResult = {\n  content: Array<{ type: string; [key: string]: unknown }>;\n  structuredContent?: Record<string, unknown> | undefined;\n  isError?: boolean | undefined;\n  _meta?: Record<string, unknown> | undefined;\n  [key: string]: unknown;\n};\n\nexport type ToolGatewayCallRequest = {\n  operationId?: string | undefined;\n  catalogDigest: string;\n  identity: ToolGatewayIdentity;\n  arguments: Record<string, unknown>;\n  siteArtifactId?: string | undefined;\n  siteVersionId?: string | undefined;\n  approvalToken?: string | undefined;\n};\n\nexport type ToolGatewayApprovalRequest = {\n  operationId: string;\n  catalogDigest: string;\n  identity: ToolGatewayIdentity;\n  arguments: Record<string, unknown>;\n};\n\nexport type ToolGatewayApprovalResponse = {\n  operationId: string;\n  catalogDigest: string;\n  identity: ToolGatewayIdentity;\n  approvalToken: string;\n  expiresAt: string;\n};\n\nexport type ToolGatewayCallResponse = {\n  operationId: string;\n  catalogDigest: string;\n  result: ToolGatewayResult;\n};\n\nexport type ToolGatewayDeclarationsResponse = {\n  catalogDigest: string;\n  moduleSpecifier: string;\n  source: string;\n};\n\nexport type ActivateCodexRealtimeConnectionRequest = {\n  operationId: string;\n  browserInstanceId: string;\n  ownerKey: string;\n  connectionEpoch: number;\n  expectedVersion: number;\n  expectedConnectionEpoch: number;\n};\n\nexport type SessionRealtimeLedgerDirection = \"provider_in\" | \"provider_out\";\nexport type SessionRealtimeLedgerKind =\n  | \"user_transcript\"\n  | \"assistant_transcript\"\n  | \"delegation_call\"\n  | \"delegation_progress\"\n  | \"delegation_result\"\n  | \"interruption\"\n  | \"session_update\"\n  | \"error\";\n\nexport type SessionRealtimeLedgerEntry = {\n  id: string;\n  realtimeId: string;\n  operationId: string;\n  connectionEpoch: number;\n  sequence: number;\n  direction: SessionRealtimeLedgerDirection;\n  kind: SessionRealtimeLedgerKind;\n  role: \"user\" | \"assistant\" | null;\n  providerEventId: string | null;\n  delegationItemId: string | null;\n  sourceUpdateId: string | null;\n  historyItemId: string | null;\n  turnId: string | null;\n  text: string | null;\n  payload: Record<string, unknown>;\n  clientAckedAt: string | null;\n  providerAckedAt: string | null;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type SessionRealtimeInboundEntry = {\n  operationId: string;\n  kind: Exclude<\n    SessionRealtimeLedgerKind,\n    \"delegation_progress\" | \"delegation_result\" | \"session_update\"\n  >;\n  role?: \"user\" | \"assistant\" | null | undefined;\n  providerEventId?: string | null | undefined;\n  delegationItemId?: string | null | undefined;\n  text?: string | null | undefined;\n  payload?: Record<string, unknown> | undefined;\n  /** Model-visible application context attached to this exact realtime message. */\n  modelContext?: string | undefined;\n};\n\nexport type SyncSessionRealtimeLedgerRequest = {\n  browserInstanceId: string;\n  ownerKey: string;\n  expectedVersion: number;\n  connectionId: string;\n  connectionEpoch: number;\n  entries?: SessionRealtimeInboundEntry[] | undefined;\n  clientAckThroughSequence?: number | null | undefined;\n  providerAckSequences?: number[] | undefined;\n  providerStarted?:\n    | { providerSessionId: string; providerEventId?: string | null | undefined }\n    | undefined;\n};\n\nexport type SyncSessionRealtimeLedgerResponse = {\n  accepted: Array<{ entry: SessionRealtimeLedgerEntry; replay: boolean }>;\n  outbound: SessionRealtimeLedgerEntry[];\n};\n\nexport type SessionRealtimeModel =\n  | \"gpt-live-1-boulder-alpha\"\n  | \"supergrok/grok-voice-think-fast-2.0\"\n  | \"opengeni-gateway/openai/gpt-realtime-2.1\"\n  | \"opengeni-gateway/openai/gpt-realtime-mini\"\n  | \"opengeni-gateway/xai/grok-voice-think-fast-2.0\"\n  | \"workspace-gateway/openai/gpt-realtime-2.1\"\n  | \"workspace-gateway/openai/gpt-realtime-mini\"\n  | \"workspace-gateway/xai/grok-voice-think-fast-2.0\";\n\nexport type WorkspaceRealtimeModelCatalogItem = {\n  id: SessionRealtimeModel;\n  label: string;\n  provider: \"OpenGeni\" | \"Connected Codex\" | \"Connected SuperGrok\" | \"Your Gateway\";\n  description: string;\n  available: boolean;\n  unavailableReason: string | null;\n  recommended: boolean;\n};\n\nexport type WorkspaceRealtimeModelCatalogResponse = {\n  models: WorkspaceRealtimeModelCatalogItem[];\n};\nexport type SessionRealtimeState = \"active\" | \"ended\";\nexport type SessionRealtimeEndReason =\n  | \"user_stop\"\n  | \"browser_unload\"\n  | \"lease_expired\"\n  | \"authority_revoked\";\n\nexport type SessionRealtimeMode = {\n  id: string;\n  sessionId: string;\n  operationId: string;\n  browserInstanceId: string;\n  model: SessionRealtimeModel;\n  state: SessionRealtimeState;\n  version: number;\n  connectionEpoch: number;\n  leaseExpiresAt: string;\n  lastHeartbeatAt: string;\n  startedAt: string;\n  endedAt: string | null;\n  endReason: SessionRealtimeEndReason | null;\n};\n\nexport type BeginSessionRealtimeRequest = {\n  operationId: string;\n  browserInstanceId: string;\n  ownerKey: string;\n  model: SessionRealtimeModel;\n};\n\nexport type RenewSessionRealtimeRequest = {\n  browserInstanceId: string;\n  ownerKey: string;\n  expectedVersion: number;\n};\n\nexport type EndSessionRealtimeRequest = RenewSessionRealtimeRequest & {\n  reason: Extract<SessionRealtimeEndReason, \"user_stop\" | \"browser_unload\">;\n};\n\nexport type SessionRealtimeMutationResponse = {\n  mode: SessionRealtimeMode;\n  replay: boolean;\n};\n\nexport type SessionStatus =\n  | \"queued\"\n  | \"running\"\n  | \"idle\"\n  | \"requires_action\"\n  | \"recovering\"\n  | \"waiting_capacity\"\n  | \"failed\"\n  | \"cancelled\";\n\n// Mirror of `@opengeni/contracts` SandboxBackend (12 values; every member is\n// additive at the end). 3-way enum parity is pinned by\n// `test/contract-parity.test.ts`.\nexport type SandboxBackend =\n  | \"docker\"\n  | \"modal\"\n  | \"local\"\n  | \"none\"\n  | \"daytona\"\n  | \"runloop\"\n  | \"e2b\"\n  | \"blaxel\"\n  | \"cloudflare\"\n  | \"vercel\"\n  | \"selfhosted\"\n  | \"opensandbox\";\n\n// Mirror of `@opengeni/contracts` SandboxOs. Only \"linux\" is reachable in v1.\nexport type SandboxOs = \"linux\" | \"macos\" | \"windows\";\n\n// Mirror of `@opengeni/contracts` SandboxCapabilityName.\nexport type SandboxCapabilityName =\n  | \"FileSystem\"\n  | \"Terminal\"\n  | \"Git\"\n  | \"DesktopStream\"\n  | \"Recording\";\n\n// Mirror of `@opengeni/contracts` CapabilityUnavailableReason.\nexport type CapabilityUnavailableReason =\n  | \"backend_unsupported\"\n  | \"os_unsupported\"\n  | \"not_provisioned\"\n  | \"disabled_by_policy\"\n  | \"lease_cold\"\n  | \"tier_headless\"\n  // selfhosted (bring-your-own-compute) negotiation states:\n  | \"agent_offline\"\n  | \"agent_reconnecting\"\n  | \"consent_required\"\n  | \"display_unavailable\";\n\n// Mirror of `@opengeni/contracts` SessionCapabilities (the negotiated handshake\n// document). The descriptor table itself is NOT mirrored — it lives in\n// contracts (P0.1) and is consumed by the SDK config in a later PR.\nexport type SessionCapabilities = {\n  sessionId: string;\n  backend: SandboxBackend;\n  os: SandboxOs;\n  liveness: \"cold\" | \"warming\" | \"warm\" | \"draining\";\n  leaseEpoch: number;\n  workspaceGeneration: number | null;\n  archiveGeneration: number | null;\n  archiveComplete: boolean;\n  viewerHeartbeatIntervalMs: number;\n  FileSystem: {\n    available: boolean;\n    readOnly: boolean;\n    root: string;\n    pathSep: \"/\" | \"\\\\\";\n    treeMode: \"lazy\" | \"snapshot\";\n    reason: CapabilityUnavailableReason | null;\n  };\n  Terminal: {\n    transport: \"sse-events\" | \"pty-ws\" | \"relay-pty\" | null;\n    ptyCapable: boolean;\n    shell: string;\n    url: string | null;\n    token: string | null;\n    expiresAt: string | null;\n    reason: CapabilityUnavailableReason | null;\n  };\n  Git: {\n    available: boolean;\n    repos: string[];\n    reason: CapabilityUnavailableReason | null;\n  };\n  DesktopStream: {\n    // \"relay-frames\" + \"frames\": the selfhosted framebuffer stream — PNG-per-frame\n    // protobuf datagrams over the relay, painted by a canvas client (NOT RFB).\n    transport: \"vnc-ws\" | \"rdp-ws\" | \"webrtc\" | \"relay-frames\" | null;\n    client: \"novnc\" | \"web-rdp\" | \"frames\" | null;\n    mode: \"read-only\" | \"interactive\";\n    url: string | null;\n    token: string | null;\n    expiresAt: string | null;\n    resolution: [number, number];\n    unredacted: boolean;\n    requiresAcknowledgment: boolean;\n    acknowledged: boolean;\n    // Shared-exposure disclosure (addendum E.1): `shared` when the group has >1\n    // session; `sharedSessionIds` lists the OTHER sessions' ids ONLY (never their\n    // conversation/metadata).\n    shared: boolean;\n    sharedSessionIds: string[];\n    reason: CapabilityUnavailableReason | null;\n  };\n  Recording: {\n    available: boolean;\n    modes: (\"manual\" | \"on-turn\" | \"on-verify\")[];\n    codecs: (\"h264-mp4\" | \"vp9-webm\")[];\n    reason: CapabilityUnavailableReason | null;\n  };\n  /** @deprecated Use the managed ComputerSession interaction tools. */\n  ComputerUse: {\n    available: boolean;\n    readOnly: boolean;\n    reason: CapabilityUnavailableReason | null;\n  };\n  negotiatedAt: string;\n};\n\n// Convenience aliases for the per-surface cells of `SessionCapabilities`, so the\n// client hooks/components can take a single cell without restating the inline\n// shape. These are exact structural views of the cells above.\nexport type FileSystemCapability = SessionCapabilities[\"FileSystem\"];\nexport type TerminalCapability = SessionCapabilities[\"Terminal\"];\nexport type GitCapability = SessionCapabilities[\"Git\"];\nexport type DesktopStreamCapability = SessionCapabilities[\"DesktopStream\"];\nexport type RecordingCapability = SessionCapabilities[\"Recording\"];\n/** @deprecated Use the managed ComputerSession interaction tools. */\nexport type ComputerUseCapability = SessionCapabilities[\"ComputerUse\"];\n\n// ── Stream-surfacing client surface (Phase 5) ───────────────────────────────\n// Mirrors of the contracts viewer-attach / acknowledge / heartbeat shapes that\n// the capability-gated client (`@opengeni/react`) drives. The desktop pixel\n// plane rides Channel B (direct-to-provider noVNC); the structured terminal/\n// files/git surfaces ride Channel A (the existing event spine + the synchronous\n// fs/git/terminal point queries above). These are TYPES only, so ordinary SDK\n// entries do not reach the contracts runtime; the contract-parity test pins them.\n\n// Mirror of `@opengeni/contracts` StreamUrlRotatedPayload — the Channel-A event\n// the client folds in to hot-swap its noVNC socket on a box rollover, fenced on\n// leaseEpoch.\nexport type StreamUrlRotatedPayload = {\n  url: string;\n  token: string | null;\n  expiresAt: string | null;\n  leaseEpoch: number;\n  transport: \"vnc-ws\";\n  viewerId: string | null;\n};\nexport type StreamOpenedPayload = {\n  viewerId: string;\n  shared: boolean;\n  viewerCount: number;\n};\nexport type StreamClosedPayload = {\n  viewerId: string;\n  reason: \"client-disconnect\" | \"reaped\" | \"revoked\" | \"box-rollover\";\n  viewerCount: number;\n};\nexport type StreamRevokedPayload = {\n  viewerId: string | null;\n  reason: \"grant-revoked\" | \"session-failed\" | \"admin\";\n};\n\n// Mirror of `@opengeni/contracts` AttachViewerRequest. Omitting `viewerId` mints\n// a fresh holder id (returned on the response, carried through heartbeat/detach).\n// Plane flags are exact: credentials are minted only for the requested live\n// surfaces and each surface enforces its own permission. An omitted plane set is\n// retained as the legacy terminal-only request; current clients send all flags.\nexport type AttachViewerRequest = {\n  viewerId?: string | undefined;\n  desktop?: boolean | undefined;\n  terminal?: boolean | undefined;\n  files?: boolean | undefined;\n};\n\n// Mirror of `@opengeni/contracts` ViewerHolder + the P4.2 desktop-stream fields\n// the POST /viewers handler folds in when the pixel plane is minted in-process.\nexport type ViewerHolder = {\n  viewerId: string;\n  sandboxGroupId: string;\n  liveness: \"cold\" | \"warming\" | \"warm\" | \"draining\";\n  leaseEpoch: number;\n  workspaceGeneration: number | null;\n  archiveGeneration: number | null;\n  archiveComplete: boolean;\n  viewerHeartbeatIntervalMs: number;\n  dataPlaneUrl: string | null;\n};\nexport type AttachViewerResponse = ViewerHolder & {\n  // The scoped desktop-stream address minted for THIS holder (P4.2). Null when\n  // the deployment is headless / desktop is disabled / the mint degraded —\n  // the client then falls back to the Channel-A surfaces only.\n  streamToken: string | null;\n  streamExpiresAt: string | null;\n  resolution: [number, number] | null;\n  transport: \"vnc-ws\" | \"relay-frames\" | null;\n  client: \"novnc\" | \"frames\" | null;\n  // The scoped ttyd PTY-over-websocket address minted for THIS holder — the REAL\n  // interactive terminal, symmetric with the desktop pixel plane (same Modal\n  // tunnel, same scoped stream token). Populated on a warm box; null when the\n  // terminal mint degraded (headless / no secret / tunnel failure), in which case\n  // the client falls back to the Channel-A read-only command-output firehose.\n  // `terminalTransport` is \"pty-ws\" iff a live `terminalUrl` was minted.\n  terminalUrl: string | null;\n  terminalToken: string | null;\n  terminalExpiresAt: string | null;\n  terminalTransport: \"pty-ws\" | \"relay-pty\" | null;\n};\n\n// Mirror of `@opengeni/contracts` AcknowledgeStreamRequest/Response — the\n// un-redacted-pixel + shared-exposure consent gate (P3.2).\nexport type AcknowledgeStreamRequest = {\n  acknowledgeUnredacted?: boolean | undefined;\n  acknowledgeShared?: boolean | undefined;\n};\nexport type AcknowledgeStreamResponse = {\n  acknowledged: boolean;\n  acknowledgedShared: boolean;\n};\n\n// Mirror of `@opengeni/contracts` ViewerHeartbeatRequest/Response — the\n// Channel-A viewer-liveness ping, epoch-fenced (a stale-epoch beat → alive:false\n// → the client re-attaches).\nexport type ViewerHeartbeatRequest = { leaseEpoch: number };\nexport type ViewerHeartbeatResponse = { alive: boolean };\n\nexport type ReasoningEffort = \"none\" | \"minimal\" | \"low\" | \"medium\" | \"high\" | \"xhigh\" | \"max\";\nexport type LatencyMode = \"standard\" | \"priority\" | \"fast\";\nexport type GitCredentialProvider = \"github\" | \"gitlab\" | \"azure_devops\";\nexport type GitCredentialBindingId = string;\nexport type GitRepositoryAccess = \"read\" | \"write\";\n\nexport type RepositoryResourceRef = {\n  kind: \"repository\";\n  uri: string;\n  ref: string;\n  /** Exact immutable commit that repository materialization must produce. */\n  expectedCommitSha?: string | undefined;\n  /**\n   * Optional workspace-relative override. When omitted, OpenGeni persists\n   * `repos/<encoded-host>/<owner>/<repo>` so equal names on different Git\n   * providers do not collide. Explicit paths are portable, traversal-free, and\n   * collision-checked case-insensitively before sandbox execution.\n   */\n  mountPath?: string | undefined;\n  subpath?: string | undefined;\n  provider?: GitCredentialProvider | undefined;\n  connectionType?: \"github_personal\" | undefined;\n  credentialBindingId?: GitCredentialBindingId | undefined;\n  access?: GitRepositoryAccess | undefined;\n  repositoryId?: number | string | undefined;\n  installationId?: number | string | undefined;\n  projectId?: number | string | undefined;\n  connectionId?: string | undefined;\n  githubInstallationId?: number | undefined;\n  githubRepositoryId?: number | undefined;\n};\n\n/** Value mirror of `@opengeni/contracts`; parity-tested without importing it from ordinary SDK entries. */\nexport const DEFAULT_FILE_RESOURCE_MOUNT_ROOT = \".opengeni/files\" as const;\n\nexport type FileResourceRef = {\n  kind: \"file\";\n  fileId: string;\n  /** Optional workspace-relative override; defaults to `.opengeni/files/<file-id>`. */\n  mountPath?: string | undefined;\n};\n\nexport type ResourceRef = RepositoryResourceRef | FileResourceRef;\n\nexport type ToolRef = {\n  kind: \"mcp\";\n  id: string;\n  optional?: boolean | undefined;\n  eager?: boolean | undefined;\n};\n\nexport type SessionToolPolicy = {\n  mode: \"workspace_default\" | \"explicit\" | \"inherited\";\n  inheritedFromSessionId: string | null;\n};\n\nexport type UpdateSessionToolPolicyRequest =\n  | {\n      mode: \"workspace_default\";\n      expectedVersion: number;\n    }\n  | {\n      mode: \"explicit\";\n      tools: ToolRef[];\n      firstPartyMcpTools: FirstPartyMcpToolName[];\n      expectedVersion: number;\n    };\n\nexport type SessionEffectiveToolPolicy = {\n  mode: SessionToolPolicy[\"mode\"];\n  inheritedFromSessionId: string | null;\n  selectedIds: string[];\n  effectiveIds: string[];\n  mandatoryIds: string[];\n  lazyRouter: {\n    state: \"required\" | \"disabled\";\n    deferredIds: string[];\n  };\n  configuredIds: string[];\n  droppedIds: string[];\n  counts: {\n    selected: number;\n    effective: number;\n    mandatory: number;\n    deferred: number;\n    configured: number;\n    dropped: number;\n  };\n  idsTruncated: boolean;\n};\n\nexport type GoalSpec = {\n  text: string;\n  successCriteria?: string | undefined;\n  rootConstraints?: string[] | undefined;\n  maxAutoContinuations?: number | undefined;\n  mutationPolicy?: SessionGoalMutationPolicy | undefined;\n};\n\nexport type SessionMcpServerInput = {\n  id: string;\n  name?: string | undefined;\n  url: string;\n  allowedTools?: string[] | undefined;\n  timeoutMs?: number | undefined;\n  cacheToolsList?: boolean | undefined;\n  /** Require human approval for every tool, or only the listed unprefixed tool names. */\n  requireApproval?: boolean | string[] | undefined;\n  headers?: Record<string, string> | undefined;\n  connectionRef?: McpServerConnectionRef | undefined;\n};\n\nexport type SessionMcpCredentialUpdateInput = {\n  id: string;\n  headers: Record<string, string>;\n};\n\nexport type SessionMcpApprovalPolicy = boolean | string[];\n\nexport type SessionMcpServerMetadata = {\n  id: string;\n  name: string | null;\n  url: string;\n  headerNames: string[];\n  credentialVersion: number;\n  requireApproval: SessionMcpApprovalPolicy;\n  connectionRef: McpServerConnectionRef | null;\n};\n\nexport type UpdateSessionMcpApprovalPolicyRequest = {\n  requireApproval: SessionMcpApprovalPolicy;\n};\n\nexport type UpdateSessionMcpApprovalPolicyResponse = {\n  server: SessionMcpServerMetadata;\n  effectiveFrom: \"next_attempt\";\n};\n\nexport type ConnectionKind = \"oauth2\" | \"api_key\" | \"app_install\" | \"delegated\";\nexport type ConnectionStatus = \"active\" | \"needs_reauth\" | \"revoked\" | \"error\";\n\nexport type UserResourceDelegation = {\n  authorityId: string;\n  grantId: string;\n  organizationId: string;\n  workspaceId: string;\n  sessionId: string | null;\n  action: string;\n  mode: \"once\" | \"session\" | \"always\";\n  context: \"user_private\" | \"workspace_shared\";\n  authorityEpoch: number | null;\n  authorityGeneration: number;\n  grantGeneration: number;\n  resourceVersionId?: string | null | undefined;\n};\n\nexport type McpConnectionAuthoritySelection = {\n  serverId: string;\n  connectionId: string;\n  userDelegation: UserResourceDelegation;\n};\n\nexport type McpServerConnectionRef = {\n  connectionId?: string | undefined;\n  authoritySource?: \"host\" | undefined;\n  hostBinding?: { bindingId: string; generation: number } | undefined;\n  provider?: string | undefined;\n  providerDomain: string;\n  kind?: ConnectionKind | undefined;\n  scopes?: string[] | undefined;\n  resource?: string | undefined;\n  selectedResources?:\n    | Array<{\n        id: string;\n        kind: \"repository\";\n      }>\n    | undefined;\n  subjectScope?: \"workspace\" | \"subject\" | undefined;\n};\n\nexport type McpPersonalConnectionDelegation = {\n  serverId: string;\n  connectionId: string;\n  ownerSubjectId: string;\n  providerDomain: string;\n  kind?: ConnectionKind | undefined;\n};\n\nexport type McpPersonalConnectionSummary = Pick<\n  McpPersonalConnectionDelegation,\n  \"serverId\" | \"providerDomain\"\n>;\n\nexport type ConnectionMetadata = {\n  id: string;\n  authorityId?: string | undefined;\n  accountId: string;\n  workspaceId: string;\n  subjectId: string | null;\n  providerDomain: string;\n  kind: ConnectionKind;\n  status: ConnectionStatus;\n  grantedScopes: string[];\n  expiresAt: string | null;\n  lastRefreshAt: string | null;\n  lastUsedAt: string | null;\n  lastError: string | null;\n  version: number;\n  verifiedInstallAt?: string | null;\n  verifiedInstallVersion?: number | null;\n  metadata: Record<string, unknown>;\n  createdBySubjectId: string | null;\n  updatedBySubjectId: string | null;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type CreateConnectionRequest = {\n  providerDomain: string;\n  kind: ConnectionKind;\n  ownership?: ConnectionOwnership | undefined;\n  /** @deprecated use ownership */\n  subjectId?: string | null | undefined;\n  credential: Record<string, unknown>;\n  grantedScopes?: string[] | undefined;\n  expiresAt?: string | null | undefined;\n  metadata?: Record<string, unknown> | undefined;\n  operationId?: string | undefined;\n};\n\nexport type PersonalGitHubConnectionMetadata = {\n  credentialRole: \"opengeni_github_personal\";\n  providerFamily: \"github\";\n  providerPrincipalId: string;\n  githubUserId: string;\n  githubLogin: string;\n  oauthEnvironment: string;\n  oauthClientMarker: string;\n  credentialBindingId: string;\n  connectedAt: string;\n  lastVerifiedAt: string;\n  refreshTokenExpiresAt?: string | null | undefined;\n  disconnectedAt?: string | null | undefined;\n  [key: string]: unknown;\n};\n\nexport type PersonalGitHubOAuthStartRequest = {\n  connectionId?: string | undefined;\n  returnPath?: string | undefined;\n};\n\nexport type PersonalGitHubOAuthStartResponse = {\n  authorizationUrl: string;\n  expiresAt: string;\n};\n\nexport type PersonalGitHubConnectionStatusResponse = {\n  enabled: boolean;\n  connection: ConnectionMetadata | null;\n  reviewUrl: string | null;\n};\n\nexport type PersonalGitHubDisconnectRequest = {\n  expectedVersion: number;\n  idempotencyKey: string;\n};\n\nexport type PersonalGitHubRepositoryAccess = \"read\" | \"write\";\n\nexport type PersonalGitHubRepositoryPermissions = {\n  pull: boolean;\n  push: boolean;\n  admin: boolean;\n  maintain: boolean;\n  triage: boolean;\n};\n\nexport type PersonalGitHubRepository = {\n  repositoryId: string;\n  fullName: string;\n  canonicalUrl: string;\n  defaultBranch: string;\n  visibility: \"public\" | \"private\" | \"internal\";\n  private: boolean;\n  archived: boolean;\n  disabled: boolean;\n  permissions: PersonalGitHubRepositoryPermissions;\n};\n\nexport type PersonalGitHubSelectedRepository = PersonalGitHubRepository & {\n  selectedAccess: PersonalGitHubRepositoryAccess;\n  selectionGeneration: number;\n  selectedAt: string;\n  lastVerifiedAt: string;\n};\n\nexport type PersonalGitHubRepositorySelectionState = {\n  connectionAuthorityGeneration: number;\n  credentialBindingId: string;\n  providerPrincipalId: string;\n  selectionGeneration: number;\n  repositories: PersonalGitHubSelectedRepository[];\n};\n\nexport type PersonalGitHubRepositoryCatalogItem = PersonalGitHubRepository & {\n  selectedAccess: PersonalGitHubRepositoryAccess | null;\n};\n\nexport type ListPersonalGitHubRepositoriesOptions = {\n  cursor?: number | undefined;\n  limit?: number | undefined;\n};\n\nexport type ListPersonalGitHubRepositoriesResponse = {\n  repositories: PersonalGitHubRepositoryCatalogItem[];\n  nextCursor: number | null;\n  selection: PersonalGitHubRepositorySelectionState;\n};\n\nexport type PersonalGitHubRepositorySelectionInput = {\n  repositoryId: string;\n  fullName: string;\n  access: PersonalGitHubRepositoryAccess;\n};\n\nexport type ReplacePersonalGitHubRepositorySelectionsRequest = {\n  expectedConnectionAuthorityGeneration: number;\n  expectedSelectionGeneration: number;\n  idempotencyKey: string;\n  repositories: PersonalGitHubRepositorySelectionInput[];\n};\n\nexport type VerifyPersonalGitHubRepositorySelectionsRequest = {\n  expectedConnectionAuthorityGeneration: number;\n  expectedSelectionGeneration: number;\n  idempotencyKey: string;\n};\n\nexport type OpenGeniSlackBotInstallRequest = {\n  /** Existing OpenGeni Slack bot connection to reinstall in place. */\n  connectionId?: string | undefined;\n};\n\nexport type FikenInstallRequest = {\n  apiToken: string;\n  defaultCompanySlug?: string | undefined;\n  /** Existing Fiken connection to rewrite in place (reconnect). */\n  connectionId?: string | undefined;\n};\n\nexport type FikenOAuthStartRequest = {\n  returnPath?: string | undefined;\n  /** Existing Fiken connection to re-authorize in place (reconnect). */\n  connectionId?: string | undefined;\n};\n\nexport type FikenOAuthStartResponse = {\n  authorizationUrl: string;\n  expiresAt: string;\n};\n\nexport type OpenGeniSlackBotInstallStart = {\n  authorizationUrl: string;\n  expiresAt: string;\n};\n\nexport type SlackInstallationBindingState = \"active\" | \"quarantined\";\n\nexport type SlackInstallationBinding = {\n  id: string;\n  accountId: string;\n  accountName: string;\n  workspaceId: string;\n  workspaceName: string;\n  connectionId: string;\n  connectionStatus: ConnectionStatus;\n  connectionVersion: number;\n  slackTeamId: string;\n  slackTeamName: string;\n  botId: string;\n  botUserId: string;\n  botDisplayName: \"OpenGeni\" | \"OpenGeni Staging\";\n  state: SlackInstallationBindingState;\n  quarantineReason: string | null;\n  version: number;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type ListSlackInstallationBindingsResponse = {\n  bindings: SlackInstallationBinding[];\n};\n\nexport type GoogleDriveTargetScope = \"user\" | \"workspace\" | \"organization\";\nexport type ConnectorDocumentDestinationAuthority = \"organization\" | \"workspace\" | \"personal\";\nexport type ConnectorDocumentDestinationSelection = {\n  authorityKind: ConnectorDocumentDestinationAuthority;\n  collectionId: string | null;\n};\nexport type ConnectorDocumentDestination = ConnectorDocumentDestinationSelection & {\n  authorityAccountId: string;\n  authorityWorkspaceId: string | null;\n  authoritySubjectId: string | null;\n};\nexport type GoogleDriveSyncCadence = \"manual\" | \"hourly\" | \"daily\";\nexport type GoogleDriveReadPolicy = \"allow\" | \"ask\" | \"block\";\nexport type GoogleDriveConnectionLifecycleState =\n  | \"active\"\n  | \"paused\"\n  | \"token_revoked\"\n  | \"app_removed\"\n  | \"disconnected\"\n  | \"reconnect_required\"\n  | \"reconsent_required\";\n\nexport type GoogleDriveConnectionLifecycle =\n  | {\n      state: Exclude<GoogleDriveConnectionLifecycleState, \"app_removed\">;\n      recoverable: true;\n      observedAt: string;\n    }\n  | { state: \"app_removed\"; recoverable: false; observedAt: string };\n\nexport type GoogleDriveSelectedSource = {\n  id: string;\n  name: string;\n  mimeType: string;\n  driveId: string | null;\n  destination?: ConnectorDocumentDestination | undefined;\n  /** @deprecated Missing destinations resolve to the current workspace boundary. */\n  targetScope?: GoogleDriveTargetScope | undefined;\n  syncCadence: GoogleDriveSyncCadence;\n  syncEnabled: boolean;\n  configGeneration: number;\n  readPolicy: GoogleDriveReadPolicy;\n  selectedAt: string;\n};\n\nexport type GoogleDriveConnectionMetadata = {\n  credentialRole: \"google_drive_metadata\";\n  credentialLabel: \"Google Drive read-only source sync\" | \"Google Drive metadata browser\";\n  googlePermissionId: string;\n  googleEmail: string;\n  googleDisplayName: string | null;\n  verifiedAt: string;\n  accessMode: \"file_only\" | \"metadata_readonly\" | \"readonly\";\n  lifecycle?: GoogleDriveConnectionLifecycle | undefined;\n  outputDestination?: GoogleDriveOutputDestination | undefined;\n  documentDestination?: ConnectorDocumentDestination | undefined;\n  selectedSources?: GoogleDriveSelectedSource[] | undefined;\n  /** @deprecated Read selectedSources; retained while existing connections migrate. */\n  selectedSource?: GoogleDriveSelectedSource | null | undefined;\n  [key: string]: unknown;\n};\n\nexport type GoogleDriveOutputDestination = {\n  folderId: string;\n  folderName: string;\n  driveId: string | null;\n  location: \"my_drive\" | \"shared_drive\";\n  selectedAt: string;\n};\n\nexport type GoogleDriveOAuthStartRequest = {\n  connectionId?: string | undefined;\n  capability?: \"source_read\" | \"publish\" | undefined;\n};\n\nexport type GoogleDriveOAuthStartResponse = {\n  authorizationUrl: string;\n  expiresAt: string;\n};\n\nexport type GoogleDriveLifecycleActionRequest = {\n  action: \"pause\" | \"resume\";\n  expectedVersion: number;\n};\n\nexport type GoogleDriveDisconnectRequest = {\n  expectedVersion: number;\n  idempotencyKey: string;\n};\n\nexport type GoogleDriveBrowseItem = {\n  id: string;\n  name: string;\n  mimeType: string;\n  kind: \"folder\" | \"file\";\n  driveId: string | null;\n  modifiedTime: string | null;\n  size: string | null;\n  webViewLink: string | null;\n};\n\nexport type GoogleDriveBrowseResponse = {\n  connection: ConnectionMetadata;\n  parentId: string;\n  current: GoogleDriveBrowseItem | null;\n  items: GoogleDriveBrowseItem[];\n  nextPageToken: string | null;\n  incompleteSearch: boolean;\n};\n\nexport type AtlassianSourceKind = \"jira_project\" | \"confluence_space\";\nexport type AtlassianSyncCadence = \"manual\" | \"hourly\" | \"daily\";\nexport type AtlassianReadPolicy = \"allow\" | \"ask\" | \"block\";\nexport type AtlassianConnectionLifecycle = {\n  state:\n    | \"active\"\n    | \"paused\"\n    | \"token_revoked\"\n    | \"app_removed\"\n    | \"disconnected\"\n    | \"reconnect_required\"\n    | \"reconsent_required\";\n  recoverable: boolean;\n  observedAt: string;\n};\nexport type AtlassianSelectedSource = {\n  id: string;\n  cloudId: string;\n  siteName: string;\n  siteUrl: string;\n  resourceId: string;\n  key: string;\n  name: string;\n  kind: AtlassianSourceKind;\n  destination?: ConnectorDocumentDestination | undefined;\n  syncCadence: AtlassianSyncCadence;\n  syncEnabled: boolean;\n  configGeneration: number;\n  readPolicy: AtlassianReadPolicy;\n  selectedAt: string;\n};\nexport type AtlassianConnectionMetadata = {\n  credentialRole: \"atlassian_knowledge\";\n  credentialLabel: \"Atlassian read-only knowledge sync\";\n  atlassianAccountId: string;\n  displayName: string;\n  email?: string | null | undefined;\n  sites: Array<{\n    cloudId: string;\n    name: string;\n    url: string;\n    products: Array<\"jira\" | \"confluence\">;\n  }>;\n  verifiedAt: string;\n  accessMode: \"readonly\";\n  lifecycle?: AtlassianConnectionLifecycle | undefined;\n  documentDestination?: ConnectorDocumentDestination | undefined;\n  selectedSources: AtlassianSelectedSource[];\n  [key: string]: unknown;\n};\nexport type AtlassianOAuthStartResponse = {\n  authorizationUrl: string;\n  expiresAt: string;\n};\nexport type AtlassianLifecycleActionRequest = {\n  action: \"pause\" | \"resume\";\n  expectedVersion: number;\n};\nexport type AtlassianDisconnectRequest = {\n  expectedVersion: number;\n  idempotencyKey: string;\n};\nexport type AtlassianBrowseItem = {\n  id: string;\n  cloudId: string;\n  siteName: string;\n  siteUrl: string;\n  resourceId: string;\n  key: string;\n  name: string;\n  kind: AtlassianSourceKind;\n  description: string | null;\n  webUrl: string;\n};\nexport type AtlassianBrowseResponse = {\n  connection: ConnectionMetadata;\n  items: AtlassianBrowseItem[];\n};\n\nexport type SaveGoogleDriveSourceRequest = {\n  sources: Array<Pick<GoogleDriveBrowseItem, \"id\" | \"name\" | \"mimeType\" | \"driveId\">>;\n  destination?: ConnectorDocumentDestinationSelection | undefined;\n  /** @deprecated Legacy requests resolve to workspace authority. */\n  targetScope?: GoogleDriveTargetScope | undefined;\n  syncCadence: GoogleDriveSyncCadence;\n  syncEnabled: boolean;\n  readPolicy: GoogleDriveReadPolicy;\n};\n\nexport type GoogleDriveKnowledgeSourceItem = {\n  id: string;\n  name: string;\n  mimeType: string;\n  driveId?: string | undefined;\n  sourceKind: \"my_drive\" | \"shared_drive\" | \"folder\";\n  includeDescendants: boolean;\n};\n\nexport type GoogleDriveKnowledgeSourceDestination = {\n  authorityKind: ConnectorDocumentDestinationAuthority;\n  authorityAccountId: string;\n  authorityWorkspaceId?: string | undefined;\n  authoritySubjectId?: string | undefined;\n  collectionId?: string | undefined;\n};\n\nexport type GoogleDriveKnowledgeSourceConfig = {\n  sources: GoogleDriveKnowledgeSourceItem[];\n  destination: GoogleDriveKnowledgeSourceDestination;\n  syncCadence: GoogleDriveSyncCadence;\n  readPolicy: GoogleDriveReadPolicy;\n};\n\nexport type SaveGoogleDriveIntegrationSourceRequest = SaveGoogleDriveSourceRequest & {\n  expectedVersion?: number | undefined;\n  idempotencyKey: string;\n};\n\nexport type UpdateConnectionRequest = {\n  providerDomain?: string | undefined;\n  subjectId?: string | null | undefined;\n  kind?: ConnectionKind | undefined;\n  status?: ConnectionStatus | undefined;\n  credential?: Record<string, unknown> | undefined;\n  grantedScopes?: string[] | undefined;\n  expiresAt?: string | null | undefined;\n  metadata?: Record<string, unknown> | undefined;\n  expectedVersion?: number | undefined;\n  operationId?: string | undefined;\n};\n\nexport type ConnectionResponse = {\n  connection: ConnectionMetadata;\n};\n\nexport type ListConnectionsResponse = {\n  connections: ConnectionMetadata[];\n};\n\nexport type ConnectionOwnership = \"workspace\" | \"personal\";\n\nexport type OAuthStartRequest = {\n  providerDomain?: string | undefined;\n  mcpUrl?: string | undefined;\n  resource?: string | undefined;\n  requestedScopes?: string[] | undefined;\n  returnPath?: string | undefined;\n  /** Exact trusted-host destination; requires verified external-user mode. */\n  returnUrl?: string | undefined;\n  connectionId?: string | undefined;\n  ownership?: ConnectionOwnership | undefined;\n  oauthClient?:\n    | {\n        clientId: string;\n        clientSecret?: string | undefined;\n        tokenEndpointAuthMethod?: \"none\" | \"client_secret_post\" | \"client_secret_basic\" | undefined;\n      }\n    | undefined;\n};\n\nexport type OAuthStartResponse = {\n  state: string;\n  authorizationUrl: string | null;\n  expiresAt: string;\n};\n\nexport type SocialProvider =\n  | \"x\"\n  | \"reddit\"\n  | \"linkedin\"\n  | \"instagram\"\n  | \"facebook\"\n  | \"tiktok\"\n  | \"youtube\"\n  | \"custom\";\n\nexport type SocialConnectionStatus = \"connected\" | \"needs_reauth\" | \"disabled\";\n\nexport type SocialConnection = {\n  id: string;\n  accountId: string;\n  workspaceId: string;\n  provider: SocialProvider;\n  accountHandle: string;\n  accountName: string | null;\n  externalAccountId: string | null;\n  ownership: \"workspace\" | \"personal\";\n  status: SocialConnectionStatus;\n  scopes: string[];\n  credentialRef: string | null;\n  tokenMetadata: Record<string, unknown>;\n  metadata: Record<string, unknown>;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type SocialOAuthStartRequest = {\n  provider: \"x\" | \"reddit\";\n  ownership?: \"workspace\" | \"personal\" | undefined;\n  scopes?: string[] | undefined;\n  returnPath?: string | undefined;\n};\n\n/** The immutable principal whose authority accepted a session or turn. */\nexport type TurnInitiator = {\n  kind: \"subject\" | \"service\";\n  subjectId: string;\n  /** Display-only snapshot; never an authorization input. */\n  label?: string | undefined;\n};\n\n/** A trusted embedding host's causal machine/service principal. */\nexport type ServiceTurnInitiator = TurnInitiator & { kind: \"service\" };\n\nexport type TurnInitiatorContext = Record<string, unknown>;\n\n/** Bounded host provenance; OpenGeni-owned lineage keys are reserved. */\nexport type ServiceTurnInitiatorContext = TurnInitiatorContext;\n\nexport type IntegrationClientMetadata = {\n  client_id: string;\n  client_name: \"OpenGeni\";\n  redirect_uris: string[];\n  token_endpoint_auth_method: \"none\";\n  grant_types: Array<\"authorization_code\" | \"refresh_token\">;\n  response_types: [\"code\"];\n};\n\nexport type SessionVisibility = \"private\" | \"workspace\";\n\nexport type SessionTenancyCreateCapabilities = {\n  activated: boolean;\n  canCreatePrivate: boolean;\n  reason: \"available\" | \"not_activated\" | \"managed_session_required\" | \"unavailable\";\n};\n\nexport type SessionTenancyPublicProjection = {\n  visibility: SessionVisibility;\n  authorityEpoch: number;\n  ownedByCurrentUser: boolean;\n  fork: {\n    sourceVisibility: SessionVisibility;\n    sourceAuthorityEpoch: number;\n    forkedAt: string;\n  } | null;\n};\n\nexport type UpdateSessionVisibilityRequest = {\n  visibility: SessionVisibility;\n  expectedAuthorityEpoch: number;\n  idempotencyKey: string;\n};\n\nexport type UpdateSessionVisibilityResponse = {\n  operationId: string;\n  eventId: string | null;\n  eventSequence: number | null;\n  visibility: SessionVisibility;\n  authorityEpoch: number;\n  changed: boolean;\n  replay: boolean;\n  revokedGrantCount: number;\n};\n\nexport type ForkSessionRequest = {\n  idempotencyKey: string;\n  visibility: SessionVisibility;\n  workspaceSharedAcknowledged: boolean;\n  rigId?: string | null | undefined;\n  variableSetIds?: string[] | undefined;\n};\n\nexport type ForkSessionResponse = {\n  operationId: string;\n  eventId: string;\n  eventSequence: number;\n  sessionId: string;\n  workspaceId: string;\n  visibility: SessionVisibility;\n  authorityEpoch: 1;\n  copiedHistoryItemCount: number;\n  replay: boolean;\n};\n\nexport type SessionBackgroundCommandActivity = {\n  unavailableCount?: number | undefined;\n  state: \"running\" | \"stopping\";\n  count: number;\n};\n\nexport type SessionBackgroundCommand = {\n  observationStatus?: \"unavailable\" | undefined;\n  id: string;\n  workspaceId: string;\n  sessionId: string;\n  provider: \"managed\" | \"connected_machine\";\n  state: \"running\" | \"stopping\" | \"exited\" | \"lost\";\n  commandPreview: string;\n  cancelRequestedAt: string | null;\n  exitCode: number | null;\n  settlementReason: string | null;\n  startedAt: string;\n  settledAt: string | null;\n  updatedAt: string;\n};\n\nexport type SessionBackgroundCommandListResponse = {\n  commands: SessionBackgroundCommand[];\n};\n\nexport type CancelSessionBackgroundCommandResult = {\n  command: SessionBackgroundCommand;\n  accepted: boolean;\n};\n\nexport type Session = {\n  bundledSkillIds?: BundledSkillId[] | undefined;\n  id: string;\n  workspaceId: string;\n  accountId: string;\n  status: SessionStatus;\n  backgroundCommandActivity?: SessionBackgroundCommandActivity | undefined;\n  hasSchedules?: boolean | undefined;\n  initialMessage: string;\n  title: string | null;\n  titleSource: \"user\" | \"agent\" | null;\n  // Per-session agent persona/system instructions supplied at create; null when\n  // the session carried none. Org-visible metadata, never a timeline event.\n  instructions: string | null;\n  /** Immutable normalized prompt-policy role; distinct from membership roles. */\n  policyRole: string | null;\n  resources: ResourceRef[];\n  skills: SessionSkill[];\n  tools: ToolRef[];\n  toolPolicy: SessionToolPolicy;\n  toolPolicyVersion: number;\n  effectiveToolPolicy?: SessionEffectiveToolPolicy | undefined;\n  metadata: Record<string, unknown>;\n  /** Present only when session-tenancy product activation is enabled for the organization. */\n  tenancy?: SessionTenancyPublicProjection | undefined;\n  /** Frozen creator fact; later turns carry their own independent initiator. */\n  createdBy: TurnInitiator;\n  createdByContext: Record<string, unknown>;\n  model: string;\n  reasoningEffort: ReasoningEffort;\n  latencyMode: LatencyMode;\n  sandboxBackend: SandboxBackend;\n  sandboxOs: SandboxOs;\n  sandboxGroupId: string;\n  activeSandboxId: string | null;\n  activeEpoch: number;\n  /** Explicit connected-machine project root; null uses the agent launch root. */\n  workingDir: string | null;\n  /** Ordered low-to-high precedence; the final entry is the legacy singular alias. */\n  variableSetIds?: string[] | undefined;\n  variableSetId: string | null;\n  /** @deprecated use variableSetId */\n  environmentId: string | null;\n  // The rig + frozen rig version this session rides (M3). Both null for a\n  // rig-less session. Frozen at create; a later rig promote never moves them.\n  rigId: string | null;\n  rigVersionId: string | null;\n  /** Workspace channel the session is filed under; null = unfiled (inbox). */\n  channelId: string | null;\n  firstPartyMcpPermissions: string[] | null;\n  firstPartyMcpTools: FirstPartyMcpToolName[];\n  mcpServers: SessionMcpServerMetadata[];\n  parentSessionId: string | null;\n  /** Immutable server-authored nested-agent lineage and policy snapshot. */\n  rootSessionId: string;\n  nestedAgentDepth: number;\n  maxNestedAgentDepthOverride: number | null;\n  effectiveMaxNestedAgentDepth: number;\n  nestedAgentDepthPolicySource: \"session\" | \"workspace\" | \"deployment\" | \"default\";\n  nestedAgentDepthPolicySessionId: string | null;\n  createIdempotencyKey: string | null;\n  temporalWorkflowId: string | null;\n  activeTurnId: string | null;\n  queueVersion: number;\n  queueHeadPosition: number;\n  queueTailPosition: number;\n  effectiveControl: EffectiveSessionControl;\n  /** Current durable input wait; an elapsed deadline does not prove a new turn started. */\n  inputWait?: { deadlineAt: string; reason: string } | null | undefined;\n  lastSequence: number;\n  /** Multi-account Codex (P1): the account this session is pinned to (null ⇒ follow workspace active). */\n  codexPinnedCredentialId?: string | null;\n  /** Multi-account Codex (P1): the account the most recent turn ran on (the \"Running on:\" indicator). */\n  codexLastCredentialId?: string | null;\n  /** Accepted current-turn account, separate from future session preferences. */\n  codexCurrentSelection?: { credentialId: string | null; waiting: boolean } | null | undefined;\n  /**\n   * Frozen at create. `remote_v2` ⇒ Codex remote compaction + Codex-only model\n   * admission; `portable` ⇒ plaintext compaction and free provider switching.\n   */\n  codexCompactionMode: \"remote_v2\" | \"portable\";\n  /** Personal (authenticated subject) workspace pin state, never workspace-global. */\n  pinned?: boolean;\n  /** Stable pin ordering key; null when this subject has not pinned the session. */\n  pinnedAt?: string | null;\n  /** Optimistic pin-state revision; zero represents an absent pin relation. */\n  pinVersion?: number;\n  /** Personal explicit acknowledgment state. */\n  unread?: boolean;\n  /** Personal actively-working label. */\n  activelyWorking?: boolean;\n  /** Optimistic unread/actively-working revision. */\n  attentionVersion?: number;\n  /** Personal archive state. */\n  archived?: boolean;\n  archivedAt?: string | null;\n  /** Optimistic archive-state revision. */\n  archiveVersion?: number;\n  /** Server-authoritative descendant counts populated by session-list reads. */\n  treeStats?:\n    | {\n        directChildren: number;\n        totalDescendants: number;\n        runningDescendants: number;\n        queuedDescendants: number;\n        waitingDescendants?: number | undefined;\n        attentionDescendants: number;\n        pausedDescendants: number;\n        failedDescendants: number;\n        unreadDescendants?: number | undefined;\n        unreadFailedDescendants?: number | undefined;\n        activelyWorkingDescendants?: number | undefined;\n        /**\n         * Earliest moment one of the counted `attentionDescendants` entered\n         * `requires_action`; null when none is waiting, absent on older servers.\n         */\n        attentionSince?: string | null | undefined;\n        /** Counts are lower bounds rather than exact totals when true. */\n        truncated: boolean;\n      }\n    | undefined;\n  /**\n   * When this session's own open turn entered `requires_action`. Populated by\n   * list and lineage reads for `requires_action` sessions; null otherwise.\n   */\n  requiresActionSince?: string | null | undefined;\n  /** Agent access scope; absent on servers before the agent-access release. */\n  agentAccess?: SessionAgentAccess | undefined;\n  /** Opaque end-user label; null when the session carries none. */\n  scopeSubjectId?: SessionScopeSubjectId | null | undefined;\n  /** Memory scope; absent on servers before the agent-access release. */\n  memoryScope?: SessionMemoryScope | undefined;\n  createdAt: string;\n  updatedAt: string;\n};\n\n/** Additive receipt returned by POST /sessions. */\nexport type CreateSessionResponse = Session & {\n  initialTurnId: string | null;\n};\n\nexport type SessionSummary = Session;\n\n/** Canonical session-list page; pinned rows are excluded from ordinary pages. */\nexport type SessionListResponse = {\n  pinned: Session[];\n  /** True when the server omitted older pins from its bounded pinned section. */\n  pinnedTruncated?: boolean;\n  /** Present only when the server recognized and applied additive list filters. */\n  filtersApplied?: true;\n  /** Server-resolved Site origin filter, when requested. */\n  originSiteId?: string;\n  sessions: Session[];\n  nextCursor: string | null;\n};\n\nexport type WorkClaimSubjectType =\n  | \"repository\"\n  | \"branch\"\n  | \"pull_request\"\n  | \"issue\"\n  | \"artifact\"\n  | \"release\"\n  | \"ci_run\"\n  | \"other\";\n\nexport type WorkClaimDiscoverySummary = {\n  id: string;\n  sessionId: string;\n  subject: {\n    namespace: string;\n    type: WorkClaimSubjectType;\n    canonicalKey: string;\n    displayLabel: string | null;\n  };\n  role: \"working\" | \"reviewing\" | \"monitoring\" | \"delivering\";\n  state: \"active\" | \"released\" | \"superseded\" | \"stale\";\n  revision: number;\n  provenance:\n    | \"explicit_agent\"\n    | \"user_api\"\n    | \"trusted_integration\"\n    | \"session_resource\"\n    | \"system_lifecycle\";\n  version: {\n    kind:\n      | \"git_commit\"\n      | \"branch_head\"\n      | \"pull_request_head\"\n      | \"artifact_version\"\n      | \"release_version\"\n      | \"ci_run\"\n      | \"other\";\n    value: string;\n  } | null;\n  observedAt: string;\n  updatedAt: string;\n  settledAt: string | null;\n};\n\nexport type WorkDiscoveryProjection = {\n  claims: WorkClaimDiscoverySummary[];\n  claimsTruncated: boolean;\n  match: {\n    class: \"exact_subject\" | \"title\" | \"goal\" | \"fuzzy\";\n    field: \"subject\" | \"title\" | \"goal\" | \"claim_key\" | \"claim_label\";\n    scoreBand: \"exact\" | \"strong\" | \"related\";\n    claimId: string | null;\n  } | null;\n  possibleOverlap: boolean;\n  advisoryOnly: true;\n  noAdditionalAccess: true;\n};\n\n/** Compact, bounded session projection for workspace agent-topology browsers. */\nexport type AgentTopologySession = {\n  id: string;\n  title: string | null;\n  titleTruncated: boolean;\n  parentSessionId: string | null;\n  rootSessionId: string;\n  nestedAgentDepth: number;\n  ancestorPath: Array<{\n    id: string;\n    title: string | null;\n    titleTruncated: boolean;\n  }>;\n  status: SessionStatus;\n  goal: {\n    status: SessionGoalStatus;\n    summary: string;\n    summaryTruncated: boolean;\n  } | null;\n  pause: {\n    state: \"active\" | \"paused\";\n    additionalBlockerCount: number;\n    source: {\n      kind: \"session\" | \"workspace\";\n      sessionId?: string | undefined;\n      displayName: string;\n      displayNameTruncated: boolean;\n    } | null;\n  };\n  children: {\n    directChildren: number;\n    totalDescendants: number;\n    runningDescendants: number;\n    queuedDescendants: number;\n    attentionDescendants: number;\n    pausedDescendants: number;\n    failedDescendants: number;\n    truncated: boolean;\n  };\n  relatedWork: WorkDiscoveryProjection;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type AgentTopologyPageResponse = {\n  sessions: AgentTopologySession[];\n  total: number;\n  hasMore: boolean;\n  /** Operator rollout decision for human advisory presentation. */\n  humanAdvisoriesEnabled?: boolean | undefined;\n  nextCursor: string | null;\n};\n\nexport type UpdateSessionPinRequest = {\n  pinned: boolean;\n  expectedVersion?: number;\n};\n\nexport type UpdateSessionAttentionRequest = {\n  unread?: boolean;\n  acknowledgedThroughSequence?: number;\n  activelyWorking?: boolean;\n  expectedVersion?: number;\n};\n\nexport type UpdateSessionArchiveRequest = {\n  archived: boolean;\n  expectedVersion?: number;\n};\n\nexport type LineageNode = {\n  session: SessionSummary;\n  children: LineageNode[];\n};\n\nexport type SessionLineageResponse = {\n  sessionHasSchedules?: boolean | undefined;\n  ancestors: SessionSummary[];\n  children: LineageNode[];\n  truncated: boolean;\n};\n\nexport type SessionTurnStatus =\n  | \"queued\"\n  | \"running\"\n  | \"requires_action\"\n  | \"recovering\"\n  | \"waiting_capacity\"\n  | \"completed\"\n  | \"failed\"\n  | \"cancelled\"\n  | \"superseded\"\n  | \"withdrawn_for_edit\";\n\nexport type SessionTurnSource =\n  | \"user\"\n  | \"scheduled_task\"\n  | \"api\"\n  | \"goal\"\n  | \"system\"\n  | \"compaction\";\n\nexport type TimelineAnnotationSourceKind = \"user_message\" | \"assistant_message\" | \"tool_output\";\n\nexport type TimelineAnnotationSourceEventType =\n  | \"user.message\"\n  | \"agent.message.completed\"\n  | \"agent.toolCall.output\";\n\nexport type TimelineAnnotationSource = {\n  kind: TimelineAnnotationSourceKind;\n  eventId: string;\n  eventType: TimelineAnnotationSourceEventType;\n  sequence: number;\n  turnId: string | null;\n  startOffset: number;\n  endOffset: number;\n  contextBefore: string;\n  contextAfter: string;\n  label?: string | undefined;\n};\n\nexport type DraftTimelineAnnotation = {\n  id: string;\n  source: TimelineAnnotationSource;\n  quote: string;\n  note: string;\n};\n\nexport type SubmittedTimelineAnnotation = DraftTimelineAnnotation;\n\nexport type TimelineAnnotation = DraftTimelineAnnotation & {\n  ordinal: number;\n};\n\nexport const PERSONAL_RESOURCE_SHARED_OUTPUT_WARNING_VERSION = 1 as const;\nexport const PERSONAL_RESOURCE_SHARED_OUTPUT_WARNING =\n  \"Personal resources used in a workspace-shared session may influence outputs visible to other workspace members. The underlying credentials and secret values are not shared by the attachment itself.\";\n\nexport type PersonalResourceAttachmentIntent = {\n  mode: \"once\" | \"session\" | \"always\";\n  expectedAuthorityEpoch?: number | undefined;\n  workspaceSharedAcknowledged?: boolean | undefined;\n  sharedOutputWarningVersion: 1;\n};\n\nexport type PersonalResourceAttachmentSummary = {\n  mode: \"once\" | \"session\" | \"always\";\n  context: \"user_private\" | \"workspace_shared\";\n  resourceCount: number;\n  resourceKinds: Array<\"variable_set\" | \"rig\" | \"connected_machine\">;\n  sharedOutputWarningVersion: 1;\n};\n\nexport type SessionTurn = {\n  id: string;\n  workspaceId: string;\n  sessionId: string;\n  triggerEventId: string;\n  temporalWorkflowId: string;\n  status: SessionTurnStatus;\n  source: SessionTurnSource;\n  position: number;\n  prompt: string;\n  annotations?: TimelineAnnotation[] | undefined;\n  resources: ResourceRef[];\n  tools: ToolRef[];\n  toolsProvided?: boolean | undefined;\n  model: string;\n  reasoningEffort: ReasoningEffort;\n  latencyMode: LatencyMode;\n  sandboxBackend: SandboxBackend;\n  sandboxOs: SandboxOs | null;\n  metadata: Record<string, unknown>;\n  version: number;\n  executionGeneration: number;\n  activeAttemptId: string | null;\n  lineage: Record<string, unknown>;\n  initiator: TurnInitiator;\n  initiatorContext: Record<string, unknown>;\n  personalConnections?: McpPersonalConnectionSummary[] | undefined;\n  personalResources?: PersonalResourceAttachmentSummary | null | undefined;\n  cancelledBy?: string | null;\n  cancelReason?: string | null;\n  startedAt: string | null;\n  finishedAt: string | null;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type HumanInputQuestionKind = \"text\" | \"single_select\" | \"multi_select\";\n\nexport type HumanInputOption = {\n  id: string;\n  label: string;\n  description?: string | null | undefined;\n};\n\nexport type SkillReviewReference = {\n  sourceOperationId: string;\n  skillId: string;\n  revisionId: string;\n  expectedRevisionId: string | null;\n  expectedScopeVersion: number;\n};\n\nexport type HumanInputQuestion = {\n  skillReview?: SkillReviewReference | undefined;\n  id: string;\n  kind: HumanInputQuestionKind;\n  prompt: string;\n  label?: string | null | undefined;\n  helpText?: string | null | undefined;\n  options: HumanInputOption[];\n  required: boolean;\n  allowOther: boolean;\n  validation?:\n    | {\n        minSelections?: number | null | undefined;\n        maxSelections?: number | null | undefined;\n      }\n    | null\n    | undefined;\n};\n\nexport type HumanInputAnswer = {\n  questionId: string;\n  values: string[];\n  other?: string | null | undefined;\n};\n\nexport type HumanInputResponse =\n  | { outcome: \"answered\"; answers: HumanInputAnswer[] }\n  | { outcome: \"skipped\" | \"expired\" | \"cancelled\" };\n\nexport type SubmitHumanInputResponseRequest =\n  | { outcome: \"answered\"; answers: HumanInputAnswer[] }\n  | { outcome: \"skipped\" };\n\nexport type SessionHumanInputRequest = {\n  id: string;\n  workspaceId: string;\n  sessionId: string;\n  turnId: string;\n  turnGeneration: number;\n  creationAttemptId: string;\n  toolCallId: string;\n  status: \"pending\" | \"answered\" | \"skipped\" | \"expired\" | \"cancelled\";\n  questions: HumanInputQuestion[];\n  allowSkip: boolean;\n  response: HumanInputResponse | null;\n  respondedBy: string | null;\n  respondedAt: string | null;\n  expiresAt: string | null;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport const SESSION_EVENT_TYPES = [\n  \"session.created\",\n  \"session.variable_sets.updated\",\n  \"session.runtime.configured\",\n  // Defensive bounded projection for malformed/legacy oversized envelopes.\n  \"session.event.envelope_omitted\",\n  \"session.status.changed\",\n  \"session.realtime.started\",\n  \"session.realtime.ended\",\n  \"session.requiresAction\",\n  \"session.humanInput.requested\",\n  \"session.context.compaction.requested\",\n  \"session.context.compaction.started\",\n  \"session.context.compacted\",\n  \"session.context.compaction.skipped\",\n  \"session.context.cleared\",\n  \"user.message\",\n  \"user.pause\",\n  \"user.approvalDecision\",\n  \"user.humanInputResponse\",\n  \"turn.queued\",\n  \"turn.started\",\n  \"turn.completed\",\n  \"turn.failed\",\n  \"turn.cancelled\",\n  \"turn.superseded\",\n  \"turn.recovery.requested\",\n  \"turn.capacity_waiting\",\n  \"turn.startup.phase.started\",\n  \"turn.startup.phase.completed\",\n  \"turn.startup.phase.failed\",\n  \"agent.message.delta\",\n  \"agent.message.completed\",\n  \"agent.reasoning.delta\",\n  \"agent.toolCall.created\",\n  \"agent.toolCall.output\",\n  \"agent.model.request\",\n  \"agent.model.usage\",\n  \"tool.auth_needed\",\n  \"credential.auth_needed\",\n  \"agent.updated\",\n  \"rig.setup.started\",\n  \"rig.setup.completed\",\n  \"rig.setup.skipped\",\n  \"rig.setup.failed\",\n  \"sandbox.operation.started\",\n  \"sandbox.operation.completed\",\n  \"sandbox.operation.failed\",\n  \"session.command.backgrounded\",\n  \"session.command.finished\",\n  \"session.wait.started\",\n  \"session.wait.finished\",\n  \"sandbox.command.output.delta\",\n  \"artifact.created\",\n  \"goal.set\",\n  \"goal.updated\",\n  \"goal.progress\",\n  \"goal.rewrite.proposed\",\n  \"goal.rewrite.rejected\",\n  \"goal.completed\",\n  \"goal.paused\",\n  \"goal.resumed\",\n  \"goal.cleared\",\n  \"goal.held\",\n  \"goal.continuation\",\n  \"system.update.pending\",\n  \"system.update.delivered\",\n  \"system.update.superseded\",\n  \"system.update.cancelled\",\n  \"system.update.settled\",\n  \"session.control.paused\",\n  \"session.control.resumed\",\n  \"session.control.steer_requested\",\n  \"workspace.inference.paused\",\n  \"workspace.inference.resumed\",\n  \"session.queue.changed\",\n  \"session.queue.prompt.cancelled\",\n  \"session.queue.history\",\n  \"turn.event.rejected_late\",\n  \"memory.saved\",\n  \"memory.corrected\",\n  // Channel-B desktop pixel-plane signals (mirror of contracts SessionEventType;\n  // the contract-parity test asserts sorted equality).\n  \"stream.url.rotated\",\n  \"stream.opened\",\n  \"stream.closed\",\n  \"stream.revoked\",\n  // Channel-B recording signals (P4.3 — \"agent films itself proving the fix\").\n  \"recording.started\",\n  \"recording.available\",\n  \"recording.failed\",\n  // Channel-A structured-service notifications (P4.4; mirror of contracts\n  // SessionEventType — the contract-parity test asserts sorted equality).\n  \"fs.changed\",\n  \"git.changed\",\n  \"terminal.pty.started\",\n  \"terminal.pty.output.delta\",\n  \"terminal.pty.exited\",\n  \"session.title_set\",\n  \"session.visibility.changed\",\n  \"session.personal_resources.attached\",\n  \"session.mcp.approval_policy.updated\",\n  \"session.tool_policy.updated\",\n  // Multi-account Codex (P1): the session's inference account changed.\n  \"codex.account.switched\",\n  \"codex.account.selection.changed\",\n  // credential allocator metadata-only per-turn credential selection audit.\n  \"codex.credential.selected\",\n  // Bounded, identity-free deterministic shadow/replay decision.\n  \"codex.fleet.decision\",\n  // credential allocator durable zero-capacity wait lifecycle. These are system/runtime\n  // events, never synthetic user messages.\n  \"codex.capacity.waiting\",\n  \"codex.capacity.resumed\",\n  \"codex.capacity.superseded\",\n  // Sandbox durability observability (mirror of contracts SessionEventType):\n  // box lifecycle + manifest-env drift, attributable from the DB alone.\n  \"sandbox.box.created\",\n  \"sandbox.box.lost\",\n  \"sandbox.box.terminated\",\n  \"sandbox.box.snapshot\",\n  \"sandbox.env.drift\",\n  // Active-sandbox pointer reconcile (issue #341; announce-only; mirror of contracts\n  // SessionEventType — the contract-parity test asserts sorted equality).\n  \"session.route.reconciled\",\n  // Workbench v2 turn-end workspace capture (announce-only; mirror of contracts\n  // SessionEventType — the contract-parity test asserts sorted equality).\n  \"workspace.revision.captured\",\n  \"workspace.revision.degraded\",\n  // Connected Machine op-outcome observability (announce-only, quiet; mirror of\n  // contracts SessionEventType — the contract-parity test asserts sorted equality).\n  \"machine.op.failed\",\n  \"machine.op.recovered\",\n  // Connected Machine link-plane observability (announce-only, quiet; mirror of\n  // contracts SessionEventType — the contract-parity test asserts sorted equality).\n  \"machine.link.lost\",\n  \"machine.link.restored\",\n  \"machine.runner.restarted\",\n] as const;\n\nexport type KnownSessionEventType = (typeof SESSION_EVENT_TYPES)[number];\n\n/**\n * Event types the SDK knows about today, kept open so a newer OpenGeni server\n * can introduce event types without breaking older SDK consumers.\n */\nexport type SessionEventType = KnownSessionEventType | (string & {});\n\nexport type SessionEvent = {\n  id: string;\n  workspaceId: string;\n  sessionId: string;\n  /** Per-session sequence number: positive, contiguous, strictly increasing. */\n  sequence: number;\n  /** Server-owned durable high-water mark for a synthetic compact event. */\n  coveredThrough?: number | undefined;\n  type: SessionEventType;\n  payload: unknown;\n  occurredAt: string;\n  clientEventId?: string | null | undefined;\n  turnId?: string | null | undefined;\n  turnGeneration?: number | null | undefined;\n  turnAttemptId?: string | null | undefined;\n  turnAssociation?: \"current\" | \"late_rejected\" | \"duplicate\" | null | undefined;\n  duplicateOfEventId?: string | null | undefined;\n  duplicateReason?: string | null | undefined;\n};\n\nexport type SessionEventSemanticClass =\n  | \"control\"\n  | \"terminal\"\n  | \"failure\"\n  | \"checkpoint\"\n  | \"tool_receipt\"\n  | \"provider_account\";\nexport type SessionEventLatestClass = SessionEventSemanticClass | \"receipt\";\nexport type SessionEventPayloadMode = \"none\" | \"summary\" | \"full\";\nexport type SessionEventReadMode = \"monitoring\" | \"forensic\";\nexport type SessionEventReadDirection = \"after\" | \"before\";\nexport type SessionEventResultMode = \"events\" | \"compact\";\n\ntype SessionEventListCommonOptions = {\n  after?: number;\n  before?: number;\n  limit?: number;\n  compact?: boolean;\n  mode?: SessionEventReadMode;\n  direction?: SessionEventReadDirection;\n  payloadMode?: SessionEventPayloadMode;\n  resultMode?: \"events\";\n};\n\nexport type SessionEventListOptions = SessionEventListCommonOptions &\n  (\n    | {\n        latest?: never;\n        includeTypes?: SessionEventType[];\n        excludeTypes?: SessionEventType[];\n        includeClasses?: SessionEventSemanticClass[];\n        excludeClasses?: SessionEventSemanticClass[];\n      }\n    | {\n        /** Exclusive lookup for the newest event in exactly this semantic class. */\n        latest: SessionEventLatestClass;\n        includeTypes?: never;\n        excludeTypes?: never;\n        includeClasses?: never;\n        excludeClasses?: never;\n      }\n  );\n\nexport type SessionEventCompactResult = {\n  version: 1;\n  semanticClass: SessionEventSemanticClass;\n  source: {\n    id: string;\n    type: SessionEventType;\n    sequence: number;\n    occurredAt: string;\n    turnId: string | null;\n    turnGeneration: number | null;\n    turnAttemptId: string | null;\n    turnAssociation: SessionEvent[\"turnAssociation\"];\n  };\n  id: string;\n  type: SessionEventType;\n  sequence: number;\n  occurredAt: string;\n  turnId: string | null;\n  turnGeneration: number | null;\n  turnAttemptId: string | null;\n  turnAssociation: SessionEvent[\"turnAssociation\"];\n  coveredSequence: { first: number; last: number };\n  status:\n    | \"completed\"\n    | \"failed\"\n    | \"cancelled\"\n    | \"superseded\"\n    | \"checkpoint\"\n    | \"receipt\"\n    | \"unknown\";\n  text: string | null;\n  output: unknown;\n  result: unknown;\n  failure: {\n    error: string | null;\n    code: string | null;\n    retryable: boolean | null;\n    recovery: string | null;\n  } | null;\n  checkpoint: unknown;\n  receipt: unknown;\n  truncation: {\n    truncated: boolean;\n    fields: string[];\n    originalBytes: number | null;\n    deliveredBytes: number;\n  };\n};\n\nexport type SessionEventCompactResultOptions = {\n  latest: SessionEventLatestClass;\n  resultMode: \"compact\";\n  mode?: SessionEventReadMode;\n  payloadMode?: SessionEventPayloadMode;\n};\n\nexport type SessionEventPage = {\n  events: SessionEvent[];\n  mode: SessionEventReadMode;\n  payloadMode: SessionEventPayloadMode;\n  direction: SessionEventReadDirection;\n  bytes: number;\n  maxBytes: number;\n  truncated: boolean;\n  hasMore: boolean;\n  truncatedBy: \"count\" | \"bytes\" | \"http_bytes\" | null;\n  coveredSequence: { first: number; last: number } | null;\n  nextAfter: number | null;\n  nextBefore: number | null;\n  forensicExact: boolean;\n};\n\nexport type ToolAuthNeededPayload = {\n  serverId: string;\n  toolName?: string | null | undefined;\n  providerDomain: string;\n  provider?: string | undefined;\n  connectionId?: string | null | undefined;\n  authoritySource?: \"host\" | undefined;\n  reason:\n    | \"missing_connection\"\n    | \"expired\"\n    | \"insufficient_scope\"\n    | \"refresh_failed\"\n    | \"personal_authority_unavailable\"\n    | \"unsupported_auth\"\n    | \"resource_scope_unavailable\";\n  hostReason?:\n    | \"missing_connection\"\n    | \"expired\"\n    | \"insufficient_scope\"\n    | \"refresh_failed\"\n    | \"personal_authority_unavailable\"\n    | \"unsupported_auth\"\n    | \"resource_scope_unavailable\"\n    | undefined;\n  scopes?: string[] | undefined;\n  resource?: string | undefined;\n  selectedResources?: Array<{ id: string; kind: \"repository\" }> | undefined;\n  authorizationUrl?: string | undefined;\n  subjectId?: string | null | undefined;\n  capability?:\n    | {\n        id: string;\n        name: string;\n        kind: CapabilityKind;\n        source: CapabilitySource;\n        action: \"connect\" | \"add_credentials\" | \"enable\";\n        rationale: string;\n        requiredVariables: string[];\n      }\n    | undefined;\n};\n\n// Payload shapes for the high-traffic event types. `SessionEvent.payload` is\n// `unknown` on the wire; these are the documented shapes producers emit today.\nexport type AgentTextDeltaPayload = { text: string };\nexport type AgentMessageCompletedPayload = { text: string };\nexport type AgentToolCallCreatedPayload = {\n  id: string | null;\n  name: string;\n  arguments: unknown;\n  raw?: unknown | undefined;\n};\nexport type AgentToolCallOutputPayload = { id: string | null; output: unknown };\nexport type SessionStatusChangedPayload = { status: SessionStatus };\n\n// Adaptive-fleet shadow event. This is the typed, identity-free view\n// consumed by UI/manager tooling; the durable replay record also contains the\n// complete normalized policy/input needed for offline deterministic replay.\nexport type CodexFleetConfidence = \"unknown\" | \"low\" | \"medium\" | \"high\";\nexport type CodexFleetCacheState = \"unknown\" | \"healthy\" | \"collapsed\";\nexport type CodexFleetShadowComparison =\n  | \"match\"\n  | \"different_candidate\"\n  | \"different_outcome\"\n  | \"not_comparable_truncated\";\nexport type CodexFleetDecisionScore = {\n  candidateKey: string;\n  eligible: boolean;\n  rejectionReason:\n    | \"allocator_disabled\"\n    | \"unavailable\"\n    | \"cooling\"\n    | \"quota_ceiling\"\n    | \"overlay_isolation\"\n    | null;\n  quotaPressure: number;\n  leasePressure: number;\n  observedBurnPressure: number;\n  inferredBurnPressure: number;\n  runwayPressure: number;\n  uncertaintyPressure: number;\n  cacheAffinityBenefit: number;\n  cacheState: CodexFleetCacheState;\n  overlayPreferenceBenefit: number;\n  total: number;\n  confidence: CodexFleetConfidence;\n};\nexport type CodexFleetDecisionEventPayload = {\n  schemaVersion: 1;\n  mode: \"shadow\";\n  actual: {\n    outcome: \"selected\" | \"waiting\" | \"none\";\n    candidateKey: string | null;\n    reason:\n      | \"lease_reused\"\n      | \"pin\"\n      | \"rotation\"\n      | \"active\"\n      | \"all_capped\"\n      | \"allocator_disabled\"\n      | \"none\";\n  };\n  comparison: CodexFleetShadowComparison;\n  replay: {\n    schemaVersion: 1;\n    policyVersion: \"adaptive-shadow-v1\";\n    mode: \"shadow\";\n    input: { candidates: Array<{ key: string }> } & Record<string, unknown>;\n    truncatedCandidateCount: number;\n    inputFingerprint: string;\n    decisionFingerprint: string;\n    decision: {\n      outcome: \"selected\" | \"paced\" | \"none\";\n      selectedCandidateKey: string | null;\n      reason:\n        | \"fenced_in_flight\"\n        | \"fenced_candidate_missing\"\n        | \"admission_paced\"\n        | \"no_eligible_candidate\"\n        | \"overlay_isolated_empty\"\n        | \"best_score\"\n        | \"affinity_best\"\n        | \"hysteresis_hold\";\n      admission: {\n        outcome: \"admit\" | \"pace\";\n        reason:\n          | \"fenced_in_flight\"\n          | \"pacing_disabled\"\n          | \"capacity_unknown\"\n          | \"capacity_available\"\n          | \"work_conserving_borrow\"\n          | \"manager_priority\"\n          | \"standard_starvation_bound\"\n          | \"capacity_saturated\"\n          | \"emergency_fuse\";\n        borrowedIdleCapacity: boolean;\n      };\n      borrowedOverlayCapacity: boolean;\n      strandedEligibleCount: number;\n      confidence: CodexFleetConfidence;\n      scores: CodexFleetDecisionScore[];\n    };\n  } & Record<string, unknown>;\n};\n\n// Recording payloads (P4.3 — plain TS mirror of the contracts Zod schemas).\n// These are TYPES, not Zod (F15), so ordinary SDK entries remain runtime-clean.\n// The contract-parity test asserts the event-type literals; these shapes\n// document the wire payloads.\nexport type RecordingMode = \"manual\" | \"on-turn\" | \"on-verify\";\nexport type RecordingCodec = \"h264-mp4\" | \"vp9-webm\";\nexport type RecordingContentType = \"video/mp4\" | \"video/webm\";\nexport type RecordingFailedReason =\n  | \"ffmpeg-error\"\n  | \"box-death\"\n  | \"box-rollover\"\n  | \"upload-failed\"\n  | \"max-bytes-exceeded\"\n  | \"display-unavailable\";\n\nexport type RecordingStartedPayload = {\n  recordingId: string;\n  turnId: string | null;\n  mode: RecordingMode;\n  codec: RecordingCodec;\n  dimensions: [number, number];\n  framerate: number;\n  startedAt: string;\n  reason?: string | null | undefined;\n};\nexport type RecordingAvailablePayload = {\n  recordingId: string;\n  turnId: string | null;\n  codec: RecordingCodec;\n  contentType: RecordingContentType;\n  storageKey: string;\n  durationSeconds: number | null;\n  sizeBytes: number;\n  dimensions: [number, number];\n};\nexport type RecordingFailedPayload = {\n  recordingId: string;\n  turnId: string | null;\n  reason: RecordingFailedReason;\n  detail?: string | null | undefined;\n};\n\n// ── Channel-A structured services (P4.4) — hand-written wire mirrors ─────────\n\n// A1 notification payloads.\nexport type SandboxCommandOutputDeltaPayload = {\n  stream: \"stdout\" | \"stderr\";\n  chunk: string;\n  commandId?: string | undefined;\n  seq?: number | undefined;\n};\nexport type FsChangeKind = \"created\" | \"modified\" | \"deleted\" | \"renamed\";\nexport type FsChangedPayload = {\n  changes: {\n    path: string;\n    kind: FsChangeKind;\n    isDir: boolean;\n    sizeBytes: number | null;\n    oldPath?: string | undefined;\n  }[];\n  source: \"write\" | \"watch\" | \"agent\";\n  revision: number;\n  leaseEpoch: number;\n};\nexport type GitChangedPayload = {\n  head: string | null;\n  dirty: boolean;\n  ahead: number;\n  behind: number;\n  changedFileCount: number;\n  reason: \"commit\" | \"checkout\" | \"stage\" | \"worktree\" | \"fetch\" | \"unknown\";\n  revision: number;\n  leaseEpoch: number;\n};\nexport type TerminalPtyStartedPayload = {\n  ptyId: string;\n  cols: number;\n  rows: number;\n  shell: string;\n  cwd: string;\n};\nexport type TerminalPtyOutputDeltaPayload = {\n  ptyId: string;\n  stream: \"stdout\" | \"stderr\";\n  chunk: string;\n  seq: number;\n};\nexport type TerminalPtyExitedPayload = {\n  ptyId: string;\n  exitCode: number | null;\n  reason: \"exit\" | \"killed\" | \"owner_gone\" | \"timeout\" | \"lost\";\n};\n\n// A2 FileSystem request/response.\nexport type FsNodeType = \"file\" | \"dir\" | \"symlink\" | \"other\";\nexport type FsTreeNode = {\n  name: string;\n  path: string;\n  type: FsNodeType;\n  sizeBytes: number | null;\n  mtimeMs: number | null;\n  mode: number | null;\n  children?: FsTreeNode[] | undefined;\n  truncated: boolean;\n};\nexport type FsEncoding = \"utf8\" | \"base64\";\nexport type FileSystemRouteIdentity = {\n  epoch: number;\n  root: string;\n};\nexport type FsListRequest = {\n  path?: string;\n  depth?: number;\n  maxEntries?: number;\n  includeHidden?: boolean;\n  route?: FileSystemRouteIdentity;\n};\nexport type FsListResponse = {\n  root: FsTreeNode;\n  revision: number;\n  truncated: boolean;\n};\nexport type FsListBatchRequest = { requests: FsListRequest[] };\nexport type FsListBatchResponse = { results: FsListResponse[] };\nexport type FsReadRequest = {\n  path: string;\n  encoding?: FsEncoding;\n  maxBytes?: number;\n  route?: FileSystemRouteIdentity;\n};\nexport type FsReadResponse = {\n  path: string;\n  encoding: FsEncoding;\n  content: string;\n  sizeBytes: number;\n  truncated: boolean;\n  isBinary: boolean;\n  revision: number;\n};\nexport const SANDBOX_FILE_ARTIFACT_MAX_BYTES = 25 * 1024 * 1024 - 1;\nexport type PublishSandboxFileArtifactRequest = { path: string };\nexport type SandboxFileArtifactReceipt = {\n  type: \"sandbox_file\";\n  sandboxPath: string;\n  filename: string;\n  artifact: RetainedArtifactReference;\n};\nexport type FsWriteRequest = {\n  path: string;\n  encoding?: FsEncoding;\n  content: string;\n  overwrite?: boolean;\n  createParents?: boolean;\n  route?: FileSystemRouteIdentity;\n};\nexport type FsWriteResponse = {\n  path: string;\n  sizeBytes: number;\n  revision: number;\n};\nexport type FsDeleteRequest = {\n  path: string;\n  recursive?: boolean;\n  route?: FileSystemRouteIdentity;\n};\nexport type FsDeleteResponse = { revision: number };\nexport type FsMoveRequest = {\n  path: string;\n  newPath: string;\n  overwrite?: boolean;\n  createParents?: boolean;\n  route?: FileSystemRouteIdentity;\n};\nexport type FsMoveResponse = {\n  path: string;\n  newPath: string;\n  revision: number;\n};\nexport type FsMkdirRequest = {\n  path: string;\n  recursive?: boolean;\n  route?: FileSystemRouteIdentity;\n};\nexport type FsMkdirResponse = { path: string; revision: number };\n\n// A2 Git request/response (the Pierre-diff feed).\nexport type GitFileStatusCode =\n  | \"added\"\n  | \"modified\"\n  | \"deleted\"\n  | \"renamed\"\n  | \"copied\"\n  | \"untracked\"\n  | \"ignored\"\n  | \"conflicted\"\n  | \"typechange\";\nexport type GitFileStatus = {\n  path: string;\n  oldPath: string | null;\n  index: GitFileStatusCode | null;\n  worktree: GitFileStatusCode | null;\n  isConflicted: boolean;\n};\nexport type GitStatusRequest = { path?: string };\nexport type GitStatusResponse = {\n  isRepo: boolean;\n  head: string | null;\n  /** Exact commit object identity. null for unborn/non-repositories; absent on\n   *  legacy adapters. */\n  headOid?: string | null | undefined;\n  detached: boolean;\n  upstream: string | null;\n  ahead: number;\n  behind: number;\n  files: GitFileStatus[];\n  revision: number;\n};\nexport type GitDiffLineType = \"context\" | \"add\" | \"del\" | \"meta\";\nexport type GitDiffLine = {\n  type: GitDiffLineType;\n  oldNo: number | null;\n  newNo: number | null;\n  text: string;\n};\nexport type GitDiffHunk = {\n  oldStart: number;\n  oldLines: number;\n  newStart: number;\n  newLines: number;\n  header: string;\n  lines: GitDiffLine[];\n};\nexport type GitFileDiff = {\n  path: string;\n  oldPath: string | null;\n  status: GitFileStatusCode;\n  isBinary: boolean;\n  isImage: boolean;\n  additions: number;\n  deletions: number;\n  hunks: GitDiffHunk[];\n  truncated: boolean;\n};\nexport type GitDiffRequest = {\n  path?: string;\n  staged?: boolean;\n  includeUntracked?: boolean;\n  fromRef?: string;\n  toRef?: string;\n  pathspec?: string[];\n  contextLines?: number;\n  maxBytesPerFile?: number;\n};\nexport type GitDiffResponse = { files: GitFileDiff[]; revision: number };\nexport type GitReadBatchItemRequest = {\n  status: GitStatusRequest;\n  diff?: GitDiffRequest;\n};\nexport type GitReadBatchRequest = { requests: GitReadBatchItemRequest[] };\nexport type GitReadBatchItemResponse = {\n  status: GitStatusResponse;\n  diff?: GitDiffResponse;\n};\nexport type GitReadBatchResponse = { results: GitReadBatchItemResponse[] };\nexport type GitLogRequest = {\n  path?: string;\n  ref?: string;\n  maxCount?: number;\n  skip?: number;\n  pathspec?: string[];\n};\nexport type GitCommit = {\n  sha: string;\n  shortSha: string;\n  parents: string[];\n  author: { name: string; email: string; timestamp: number };\n  committer: { name: string; email: string; timestamp: number };\n  subject: string;\n  body: string;\n  refs: string[];\n};\nexport type GitLogResponse = { commits: GitCommit[]; hasMore: boolean };\nexport type GitShowRequest = {\n  path?: string;\n  ref: string;\n  filePath?: string;\n  encoding?: FsEncoding;\n  maxBytesPerFile?: number;\n};\nexport type GitShowResponse = {\n  commit: GitCommit | null;\n  files: GitFileDiff[];\n  blob: {\n    content: string;\n    encoding: FsEncoding;\n    sizeBytes: number;\n    truncated: boolean;\n  } | null;\n  revision: number;\n};\n\n// Workbench v2 turn-end capture (mirror of `@opengeni/contracts` WorkspaceCapture*\n// + the M2 read-API response shapes). Reuses FsTreeNode /\n// GitFileStatus / GitFileDiff / GitFileStatusCode / FsEncoding above.\nexport type WorkspaceCaptureFile = {\n  path: string;\n  status: GitFileStatusCode;\n  hash: string | null;\n  baseHash: string | null;\n  contentRef: string | null;\n  sizeBytes: number;\n  isBinary: boolean;\n  tooLarge: boolean;\n  deleted: boolean;\n};\nexport type WorkspaceCaptureRepo = {\n  root: string;\n  head: string | null;\n  /** Exact HEAD commit object identity. null for unborn repositories; absent\n   *  on legacy captures. */\n  headOid?: string | null | undefined;\n  detached: boolean;\n  upstream: string | null;\n  ahead: number;\n  behind: number;\n  status: GitFileStatus[];\n  diff: GitFileDiff[];\n  /** Current branch vs the remote default branch. Absent on legacy captures or\n   *  repositories whose remote default ref could not be resolved. */\n  branchDiff?: GitFileDiff[] | undefined;\n};\nexport type WorkspaceCaptureDegradedReason =\n  | \"repository_discovery_command_failed\"\n  | \"repository_discovery_timed_out\"\n  | \"repository_discovery_result_limit_exceeded\"\n  | \"repository_read_unavailable\";\nexport type WorkspaceCaptureStats = {\n  repoCount: number;\n  fileCount: number;\n  additions: number;\n  deletions: number;\n  totalBytes: number;\n  tooLargeCount: number;\n  binaryCount: number;\n  treeEntryCount: number;\n  treeTruncated: boolean;\n  durationMs: number;\n  fingerprint?: string;\n};\nexport type WorkspaceCaptureManifest = {\n  version: 1;\n  revision: number;\n  capturedAt: string;\n  turnId: string | null;\n  leaseEpoch: number;\n  treeIndex: FsTreeNode;\n  treeTruncated: boolean;\n  repos: WorkspaceCaptureRepo[];\n  files: WorkspaceCaptureFile[];\n  stats: WorkspaceCaptureStats;\n};\nexport type WorkspaceRevisionCapturedPayload = {\n  revision: number;\n  turnId: string | null;\n  capturedAt: string;\n  leaseEpoch: number;\n  stats: WorkspaceCaptureStats;\n};\nexport type WorkspaceRevisionDegradedPayload = {\n  revision: number;\n  turnId: string | null;\n  capturedAt: string;\n  leaseEpoch: number;\n  reason: WorkspaceCaptureDegradedReason;\n};\nexport type WorkspaceCaptureSignedUrl = { url: string; expiresAt: string };\n// GET …/workspace/capture. Exactly one of manifest/manifestUrl is non-null.\nexport type GetWorkspaceCaptureResponse =\n  | {\n      available: false;\n      degradedReason?: WorkspaceCaptureDegradedReason | null;\n      revision?: number | null;\n      capturedAt?: string | null;\n      turnId?: string | null;\n      leaseEpoch?: number | null;\n    }\n  | {\n      available: true;\n      revision: number;\n      capturedAt: string;\n      turnId: string | null;\n      leaseEpoch: number;\n      sizeBytes: number;\n      stats: WorkspaceCaptureStats;\n      manifest: WorkspaceCaptureManifest | null;\n      manifestUrl: WorkspaceCaptureSignedUrl | null;\n    };\n// GET …/workspace/capture/file. content inline (≤256KB) OR contentUrl OR marker\n// only (tooLarge / missing blob).\nexport type GetWorkspaceCaptureFileResponse = {\n  path: string;\n  revision: number;\n  status: GitFileStatusCode;\n  hash: string | null;\n  baseHash: string | null;\n  sizeBytes: number;\n  isBinary: boolean;\n  tooLarge: boolean;\n  encoding: FsEncoding | null;\n  content: string | null;\n  contentUrl: WorkspaceCaptureSignedUrl | null;\n};\n\n// A2 Terminal exec + PTY.\nexport type TerminalExecRequest = {\n  command: string;\n  cwd?: string;\n  timeoutMs?: number;\n  emitStream?: boolean;\n};\nexport type TerminalExecResponse = {\n  stdout: string;\n  stderr: string;\n  exitCode: number;\n  running: false;\n  wallTimeSeconds: number;\n};\nexport type PtyOpenRequest = {\n  cols?: number;\n  rows?: number;\n  cwd?: string;\n  shell?: string;\n};\nexport type PtyOpenResponse = {\n  ptyId: string;\n  streamVia: \"sse-events\";\n  supportsInput: boolean;\n};\nexport type PtyWriteRequest = { ptyId: string; data: string };\nexport type PtyResizeRequest = { ptyId: string; cols: number; rows: number };\nexport type PtyCloseRequest = { ptyId: string };\n\nexport type SessionStructuredCapabilities = {\n  FileSystem: { available: boolean; readOnly: boolean; root: string };\n  Terminal: { events: boolean; exec: boolean; pty: { available: boolean } };\n  Git: { available: boolean; repos: string[] };\n};\n\nexport type ScheduledTaskStatus = \"active\" | \"paused\";\n\nexport type ScheduledTaskRunMode = \"new_session_per_run\" | \"reusable_session\" | \"existing_session\";\n\nexport type ScheduledTaskOverlapPolicy = \"allow_concurrent\" | \"skip\" | \"buffer_one\";\n\nexport type ScheduledTaskDayOfWeek =\n  | \"SUNDAY\"\n  | \"MONDAY\"\n  | \"TUESDAY\"\n  | \"WEDNESDAY\"\n  | \"THURSDAY\"\n  | \"FRIDAY\"\n  | \"SATURDAY\";\n\nexport type ScheduledTaskScheduleSpec =\n  | { type: \"manual\" }\n  | { type: \"once\"; runAt: string; timeZone: string }\n  | {\n      type: \"interval\";\n      everySeconds: number;\n      startAt?: string | undefined;\n      endAt?: string | undefined;\n    }\n  | {\n      type: \"calendar\";\n      timeZone: string;\n      hour: number;\n      minute: number;\n      daysOfWeek?: ScheduledTaskDayOfWeek[] | undefined;\n    };\n\nexport type IncidentTelemetrySeriesMetadata = {\n  metric: string;\n  labels: string[];\n};\n\nexport type IncidentTelemetryDataRoute =\n  | { kind: \"mcp\"; serverId: string }\n  | { kind: \"first_party\"; tool: FirstPartyMcpToolName }\n  | { kind: \"variable_set\"; variableSetName: string; variableNames: string[] }\n  | { kind: \"rig_credential_hook\"; credentialHookId: string };\n\nexport type IncidentTelemetryPreflight = {\n  requiredResources: ResourceRef[];\n  requiredMcpServerIds: string[];\n  requiredFirstPartyMcpTools: FirstPartyMcpToolName[];\n  requiredFirstPartyMcpPermissions: Permission[];\n  requiredRig: { name: string; credentialHookIds: string[] } | null;\n  requiredVariableSetNames: string[];\n  requiredVariableNames: string[];\n  dataSource: {\n    kind: \"prometheus\";\n    queryPath: \"/api/v1/query\" | \"/api/v1/query_range\";\n    workspaceLabel: string;\n    alertSelectorLabels: string[];\n    route: IncidentTelemetryDataRoute;\n    requiredSeries: IncidentTelemetrySeriesMetadata[];\n    availableSeries: IncidentTelemetrySeriesMetadata[];\n  };\n};\n\nexport type IncidentTelemetryPreflightInput = Omit<\n  IncidentTelemetryPreflight,\n  | \"requiredResources\"\n  | \"requiredMcpServerIds\"\n  | \"requiredFirstPartyMcpTools\"\n  | \"requiredFirstPartyMcpPermissions\"\n  | \"requiredRig\"\n  | \"requiredVariableSetNames\"\n  | \"requiredVariableNames\"\n> & {\n  requiredResources?: ResourceRef[] | undefined;\n  requiredMcpServerIds?: string[] | undefined;\n  requiredFirstPartyMcpTools?: FirstPartyMcpToolName[] | undefined;\n  requiredFirstPartyMcpPermissions?: Permission[] | undefined;\n  requiredRig?: { name: string; credentialHookIds?: string[] | undefined } | null | undefined;\n  requiredVariableSetNames?: string[] | undefined;\n  requiredVariableNames?: string[] | undefined;\n};\n\nexport type ScheduledTaskAgentConfig = {\n  bundledSkillIds?: BundledSkillId[] | undefined;\n  prompt: string;\n  resources: ResourceRef[];\n  tools: ToolRef[];\n  metadata: Record<string, unknown>;\n  slackBotConnectionId?: string | undefined;\n  model?: string | undefined;\n  reasoningEffort?: ReasoningEffort | undefined;\n  sandboxBackend?: SandboxBackend | undefined;\n  machineTarget?: { targetSandboxId: string; workingDir?: string | undefined } | undefined;\n  goal?: GoalSpec | undefined;\n  executionClass?: \"incident_telemetry\" | undefined;\n  incidentTelemetryPreflight?: IncidentTelemetryPreflight | undefined;\n  maxNestedAgentDepth?: number | undefined;\n};\n\nexport type ScopedKnowledgeScope =\n  | { kind: \"organization\"; workspaceId: null; subjectId: null }\n  | { kind: \"workspace\"; workspaceId: string; subjectId: null }\n  | { kind: \"personal\"; workspaceId: string | null; subjectId: string };\n\nexport type KnowledgeSourceSyncLimits = {\n  maxItems: number;\n  maxBytes: number;\n  maxFileBytes: number;\n  maxProviderRequests: number;\n  maxElapsedSeconds: number;\n  maxConcurrency: number;\n  maxFailureDetails: number;\n};\n\nexport type ScheduledTaskAction =\n  | { kind: \"agent_turn\" }\n  | {\n      kind: \"knowledge_source_sync\";\n      sourceId: string;\n      sourceGeneration: number;\n      sourceLifecycleGeneration: number;\n      sourceConfigGeneration: number;\n      controlWorkspaceId: string;\n      providerCoordinationKey: string;\n      connection: {\n        connectionId: string;\n        connectionVersion: number;\n        providerDomain: string;\n        kind: ConnectionKind;\n        ownerSubjectId: string;\n      };\n      destination: ScopedKnowledgeScope;\n      initiatingSubjectId: string;\n      allDescendants: boolean;\n      limits: KnowledgeSourceSyncLimits;\n    };\n\nexport type ScheduledTask = {\n  id: string;\n  accountId: string;\n  workspaceId: string;\n  name: string;\n  status: ScheduledTaskStatus;\n  schedule: ScheduledTaskScheduleSpec;\n  temporalScheduleId: string;\n  runMode: ScheduledTaskRunMode;\n  overlapPolicy: ScheduledTaskOverlapPolicy;\n  action: ScheduledTaskAction;\n  agentConfig: ScheduledTaskAgentConfig;\n  createdBy?: TurnInitiator | undefined;\n  createdByContext?: TurnInitiatorContext | undefined;\n  personalConnections?: McpPersonalConnectionSummary[] | undefined;\n  authorityRevision: number;\n  executionDigest: string;\n  targetSessionId: string | null;\n  reusableSessionId: string | null;\n  variableSetId: string | null;\n  /** @deprecated use variableSetId */\n  environmentId: string | null;\n  // The rig each run binds to (M3); active version resolved per fire. Null ⇒ rig-less.\n  rigId: string | null;\n  metadata: Record<string, unknown>;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type CreateSessionRequest = {\n  /** Opt-in host grants for a direct external-user initial turn. */\n  selectedHostMcpDelegations?:\n    | { serverId: string; delegationId: string; generation: number }[]\n    | undefined;\n  /** Omitted: defaults/inheritance; []: no bundled guidance. Children cannot widen. */\n  bundledSkillIds?: BundledSkillId[] | undefined;\n  // Optional UUID preallocated by an embedding host so it can durably link its\n  // projection before OpenGeni admits the initial turn. Replays must retain the\n  // same UUID and idempotency key.\n  requestedSessionId?: string | undefined;\n  visibility?: SessionVisibility | undefined;\n  initialMessage?: string | undefined;\n  /** Create an idle session shell so realtime voice can be the first interaction. */\n  startMode?: \"realtime\" | undefined;\n  /** Model-visible application context attached to the initial user message; omitted by standard timeline rendering. */\n  modelContext?: string | undefined;\n  // Per-session agent persona/system instructions (org-visible metadata, not a\n  // secret). Delivered system-level, composed AFTER the per-workspace persona —\n  // how a host supplies per-agent-type prompts without leaking them into the\n  // user-visible timeline. Trimmed, non-empty, max 65536 chars.\n  instructions?: string | undefined;\n  /** Immutable normalized prompt-policy role; distinct from membership roles. */\n  policyRole?: string | undefined;\n  resources?: ResourceRef[] | undefined;\n  /** Inline skills fixed onto this session; omitted children inherit them. */\n  skills?: SessionSkillInput[] | undefined;\n  /** Installed session-selected Skill identities to freeze onto this session at creation. */\n  installedSkillIds?: string[] | undefined;\n  tools?: ToolRef[] | undefined;\n  metadata?: Record<string, unknown> | undefined;\n  model?: string | undefined;\n  reasoningEffort?: ReasoningEffort | undefined;\n  latencyMode?: LatencyMode | undefined;\n  sandboxBackend?: SandboxBackend | undefined;\n  // The enrolled machine (a sandbox id) to run this session on; seeds the\n  // active-sandbox pointer at creation so the first turn lands on it.\n  targetSandboxId?: string | undefined;\n  // Host working directory for a connected-machine target (the agent runs here;\n  // default = the machine's launch dir). Ignored for managed sandboxes.\n  workingDir?: string | undefined;\n  /** Ordered low-to-high precedence; later sets win name collisions. */\n  variableSetIds?: string[] | undefined;\n  variableSetId?: string | undefined;\n  /** @deprecated use variableSetId */\n  environmentId?: string | undefined;\n  // The rig to bind this session to (M3). Its active version is frozen onto the\n  // session at create. Omitted ⇒ the workspace default rig when set, else rig-less.\n  rigId?: string | undefined;\n  goal?: GoalSpec | undefined;\n  clientEventId?: string | undefined;\n  // Workspace-scoped CREATE idempotency key: forward a STABLE value to make a\n  // double-submit/retry of the same logical create collapse to one session.\n  // Distinct from the per-call clientEventId.\n  idempotencyKey?: string | undefined;\n  // Exact actor-private pre-session draft revision represented by this create.\n  // The server consumes only this revision after durable initialization.\n  expectedNewSessionDraftRevision?: number | undefined;\n  maxNestedAgentDepth?: number | undefined;\n  firstPartyMcpPermissions?: string[] | undefined;\n  firstPartyMcpTools?: FirstPartyMcpToolName[] | undefined;\n  mcpServers?: SessionMcpServerInput[] | undefined;\n  /** Atomically attach the server-derived personal Variable Set/Rig closure to the initial turn. */\n  personalResourceAttachment?: PersonalResourceAttachmentIntent | undefined;\n  // Shared-sandbox placement (mirror of `@opengeni/contracts` CreateSessionRequest.sandbox,\n  // addendum 05 §D.1). Three-way union; OMITTED ⇒ the context-dependent server default\n  // (from inside a session → \"shared\" with the creator's box, top-level → \"new\").\n  //   - \"shared\":  join the CREATOR's box (requires a parent session; top-level → 422).\n  //   - \"new\":     mint a fresh singleton box (group ≡ the new session's id).\n  //   - {groupId}: join a SPECIFIC sibling group in THIS workspace (manager fan-out).\n  sandbox?: \"shared\" | \"new\" | { groupId: string } | undefined;\n  // --- Agent access scope, end-user label, memory scope ---------------------\n  // Mirror of the contracts additions that land with the session agent-access\n  // release. Which other sessions the agent may reach; defaults to \"workspace\"\n  // on the platform (the chat facade defaults to \"session\").\n  agentAccess?: SessionAgentAccess | undefined;\n  /** Opaque end-user label inside the workspace. Not a subject, not authority. */\n  /** Select identity with server-side asUser(), not session creation data. */\n  scopeSubjectId?: never;\n  /** Which Memory the agent reads and where it saves; \"user\" requires `scopeSubjectId`. */\n  memoryScope?: SessionMemoryScope | undefined;\n};\n\nexport type SessionAgentAccess = \"session\" | \"user\" | \"workspace\";\nexport type SessionScopeSubjectId = string;\nexport type SessionMemoryScope = \"workspace\" | \"user\" | \"off\";\n\n// --- Access, workspaces, API keys -------------------------------------------\n\nexport const KNOWN_PERMISSIONS = [\n  \"account:read\",\n  \"account:admin\",\n  \"members:manage\",\n  \"workspace:create\",\n  \"billing:read\",\n  \"billing:manage\",\n  \"workspace:read\",\n  \"workspace:admin\",\n  \"sessions:create\",\n  \"sessions:read\",\n  \"sessions:control\",\n  // sandbox workspace (mirror of @opengeni/contracts Permission). stream:view is\n  // strictly broader than sessions:read (un-redacted pixels); stream:control is\n  // the never-granted-v1 raw-input plane; stream:acknowledge is the secret-leak\n  // consent gate.\n  \"stream:view\",\n  \"stream:control\",\n  \"stream:acknowledge\",\n  \"files:upload\",\n  \"files:read\",\n  \"files:write\",\n  \"terminal:attach\",\n  \"documents:manage\",\n  \"documents:search\",\n  \"scheduled_tasks:manage\",\n  \"scheduled_tasks:run\",\n  \"github:manage\",\n  \"github:use\",\n  \"api_keys:manage\",\n  \"connections:read\",\n  \"connections:write\",\n  \"capabilities:manage\",\n  \"environments:manage\",\n  \"environments:use\",\n  \"variable-sets:list\",\n  \"variable-sets:read\",\n  \"variable-sets:write\",\n  \"variable-sets:manage\",\n  \"variable-sets:attach\",\n  \"variable-sets:use\",\n  \"secrets:list\",\n  \"secrets:read\",\n  \"secrets:write\",\n  \"mcp_servers:attach\",\n  \"codemode:call\",\n  \"goals:manage\",\n  \"enrollments:read\",\n  \"enrollments:manage\",\n  \"rigs:use\",\n  \"rigs:manage\",\n  \"artifacts:read\",\n  \"artifacts:publish\",\n] as const;\n\nexport type KnownPermission = (typeof KNOWN_PERMISSIONS)[number];\n\n/**\n * Permissions the SDK knows about today, kept open so a newer OpenGeni server\n * can introduce permissions without breaking older SDK consumers.\n */\nexport type Permission = KnownPermission | (string & {});\n\nexport type FirstPartyMcpToolName =\n  | \"set_session_title\"\n  | \"goal_set\"\n  | \"goal_update\"\n  | \"goal_progress\"\n  | \"wait_for_input\"\n  | \"goal_complete\"\n  | \"goal_pause\"\n  | \"goal_resume\"\n  | \"memory_search\"\n  | \"memory_save\"\n  | \"memory_correct\"\n  | \"preference_registry_summary\"\n  | \"preference_registry_get\"\n  | \"task_notes_list\"\n  | \"task_note_save\"\n  | \"task_note_archive\"\n  | \"task_note_replace\"\n  | \"work_claim_upsert\"\n  | \"work_claim_release\"\n  | \"knowledge_propose\"\n  | \"knowledge_correct\"\n  | \"task_note_promote_knowledge\"\n  | \"task_note_promote_instruction_policy\"\n  | \"task_note_promote_preference\"\n  | \"instruction_policy_propose\"\n  | \"preference_propose\"\n  | \"remember\"\n  | \"remember_confirm\"\n  | \"company_profile_propose\"\n  | \"company_profile_confirm\"\n  | \"sandboxes_list\"\n  | \"sandbox_attach\"\n  | \"sandbox_swap\"\n  | \"run_on\"\n  | \"sandbox_provision\"\n  | \"connected_machine_remove\"\n  | \"project_list\"\n  | \"project_get\"\n  | \"project_create\"\n  | \"project_update\"\n  | \"project_reorder\"\n  | \"project_delete\"\n  | \"session_set_project\"\n  | \"rig_list\"\n  | \"rig_get\"\n  | \"rig_propose_change\"\n  | \"rig_verify\"\n  | \"rig_promote\"\n  | \"sessions_list\"\n  | \"session_get\"\n  | \"session_events\"\n  | \"session_wait\"\n  | \"command_read\"\n  | \"command_wait\"\n  | \"session_create\"\n  | \"session_send_message\"\n  | \"session_pause\"\n  | \"session_resume\"\n  | \"session_steer\"\n  | \"session_human_input_respond\"\n  | \"set_other_session_title\"\n  | \"interaction_discover\"\n  | \"browser_open\"\n  | \"browser_tabs\"\n  | \"browser_observe\"\n  | \"browser_act\"\n  | \"browser_clipboard\"\n  | \"browser_debug\"\n  | \"browser_auth\"\n  | \"interaction_request_human\"\n  | \"browser_identity\"\n  | \"browser_publish\"\n  | \"browser_lifecycle\"\n  | \"computer_open\"\n  | \"computer_targets\"\n  | \"computer_observe\"\n  | \"computer_clipboard\"\n  | \"computer_act\"\n  | \"computer_lifecycle\"\n  | \"variable_set_list\"\n  | \"environment_list\"\n  | \"variable_set_get_variable\"\n  | \"variable_set_set_variable\"\n  | \"environment_set_variable\"\n  | \"capability_catalog_search\"\n  | \"capability_authorization_request\"\n  | \"github_connect_link\"\n  | \"github_repositories_list\"\n  | \"social_connections_list\"\n  | \"social_posts_recent\"\n  | \"social_daily_analysis_context\"\n  | \"social_search_live\"\n  | \"social_mentions_live\"\n  | \"social_thread_fetch\"\n  | \"social_posts_sync\"\n  | \"social_post_reply\"\n  | \"x_accounts_list\"\n  | \"x_search_live\"\n  | \"x_mentions_live\"\n  | \"x_thread_fetch\"\n  | \"x_posts_sync\"\n  | \"x_post_reply\"\n  | \"reddit_accounts_list\"\n  | \"reddit_search_live\"\n  | \"reddit_mentions_live\"\n  | \"reddit_thread_fetch\"\n  | \"reddit_posts_sync\"\n  | \"reddit_post_reply\"\n  | \"scheduled_tasks_list\"\n  | \"scheduled_tasks_get\"\n  | \"scheduled_tasks_create\"\n  | \"scheduled_tasks_update\"\n  | \"scheduled_tasks_pause\"\n  | \"scheduled_tasks_resume\"\n  | \"scheduled_tasks_trigger\"\n  | \"scheduled_tasks_delete\"\n  | \"scheduled_task_runs_list\"\n  | \"slack_bot_list_channels\"\n  | \"slack_bot_search\"\n  | \"slack_bot_channel_history\"\n  | \"slack_bot_thread_replies\"\n  | \"slack_bot_list_users\"\n  | \"slack_bot_list_files\"\n  | \"slack_bot_file_info\"\n  | \"slack_bot_file_content\"\n  | \"slack_bot_post_message\"\n  | \"slack_bot_delete_message\"\n  | \"fiken_companies_list\"\n  | \"fiken_contacts_list\"\n  | \"fiken_contact_create\"\n  | \"fiken_products_list\"\n  | \"fiken_invoices_list\"\n  | \"fiken_invoice_get\"\n  | \"fiken_invoice_draft_create\"\n  | \"fiken_bank_accounts_list\"\n  | \"fiken_purchases_list\"\n  | \"fiken_sales_list\"\n  | \"atlassian_sources_list\"\n  | \"atlassian_search\"\n  | \"atlassian_get\"\n  | \"sandbox_file_publish\"\n  | \"artifacts_list\"\n  | \"artifacts_get_source\"\n  | \"artifacts_prepare_upload\"\n  | \"artifacts_create\"\n  | \"artifacts_publish\"\n  | \"artifacts_rollback\"\n  | \"artifacts_archive\"\n  | \"artifacts_restore\"\n  | \"editable_artifact_list\"\n  | \"editable_artifact_create\"\n  | \"editable_artifact_import\"\n  | \"editable_artifact_get\"\n  | \"editable_artifact_inspect\"\n  | \"editable_artifact_apply\"\n  | \"editable_artifact_export\"\n  | \"editable_artifact_export_status\";\n\nexport type ProductAccessMode = \"local\" | \"configured\" | \"managed\";\n\nexport type ModelCapabilitySupportV1 = \"supported\" | \"unsupported\" | \"unknown\";\n\nexport type ModelCapabilityStateV1 = {\n  upstream: ModelCapabilitySupportV1;\n  runnable: boolean;\n};\n\nexport type ModelCapabilitiesV1 = {\n  reasoning: ModelCapabilityStateV1 & {\n    efforts: ReasoningEffort[];\n    defaultEffort: ReasoningEffort | null;\n    required: boolean;\n  };\n  functionCalling: ModelCapabilityStateV1;\n  structuredOutput: ModelCapabilityStateV1;\n  hostedTools: {\n    webSearch: ModelCapabilityStateV1;\n    xSearch: ModelCapabilityStateV1;\n    codeExecution: ModelCapabilityStateV1;\n  };\n  inputModalities: Array<\"text\" | \"image\" | \"audio\">;\n  inputFileMediaTypes?: string[] | undefined;\n  outputModalities: Array<\"text\" | \"image\" | \"audio\">;\n  transports: {\n    sse: ModelCapabilityStateV1;\n    responsesWebSocket: ModelCapabilityStateV1;\n    realtimeAudio: ModelCapabilityStateV1;\n  };\n  promptCaching?:\n    | (ModelCapabilityStateV1 & {\n        mode: \"implicit\" | \"automatic\" | \"none\";\n      })\n    | undefined;\n  latencyModes: Array<{\n    id: \"standard\" | \"priority\" | \"fast\";\n    upstream: ModelCapabilitySupportV1;\n    runnable: boolean;\n    billingMultiplierBps?: number | undefined;\n  }>;\n};\n\nexport type ModelCredentialSourceV1 =\n  | { kind: \"deployment\"; mechanism: \"api_key\" | \"azure_ad_bearer\" }\n  | { kind: \"connected_subscription\"; provider: \"codex\" | \"xai\" }\n  | { kind: \"workspace_connection\"; mechanism: \"api_key\" }\n  | { kind: \"organization_connection\"; mechanism: \"api_key\" };\n\nexport type ModelBillingAttributionV1 = {\n  upstreamPayer: \"deployment\" | \"workspace\" | \"organization\" | \"connected_subscription\";\n  metering: \"opengeni_credits\" | \"external\";\n};\n\nexport type ModelCostClassV1 = \"free\" | \"credits\" | \"subscription\" | \"workspace\" | \"organization\";\n\nexport type ModelPricingV1 = {\n  inputMicrosPerMillionTokens: number;\n  cachedInputMicrosPerMillionTokens?: number | undefined;\n  cacheWriteMicrosPerMillionTokens?: number | undefined;\n  outputMicrosPerMillionTokens: number;\n  marginBps?: number | undefined;\n};\n\nexport type ModelPricingScheduleV1 = {\n  default: ModelPricingV1;\n  inputTokenTiers?:\n    | Array<{\n        minimumInputTokens: number;\n        pricing: ModelPricingV1;\n      }>\n    | undefined;\n};\n\n/**\n * One model a client may select at send time, plus the provider that serves it.\n * The wire API (`responses` | `chat`) lets a client reason about provider\n * capabilities; the provider id/label drive a picker's grouping. Mirrors the\n * `ClientModel` shape projected into `ClientConfig` by the server.\n */\nexport type ClientModel = {\n  id: string;\n  label: string;\n  /** Optional curated compact label for dense UI (e.g. mobile composer). */\n  shortLabel?: string | undefined;\n  /** Provider id (e.g. `openai`, `azure`, or a registry provider id). */\n  provider: string;\n  providerLabel: string;\n  api: \"responses\" | \"chat\";\n  source?: \"opengeni\" | \"codex\" | \"supergrok\" | \"workspace_gateway\" | \"openrouter\" | undefined;\n  contextWindowTokens?: number | undefined;\n  schemaVersion?: 1 | undefined;\n  aliases?: string[] | undefined;\n  deployment?:\n    | {\n        upstreamModelId: string;\n        wireApi: \"responses\" | \"chat\";\n      }\n    | undefined;\n  executionLimits?:\n    | {\n        contextWindowTokens: number | null;\n        effectiveContextWindowTokens: number | null;\n        autoCompactTokenLimit: number | null;\n        toolOutputTruncationTokens: number | null;\n      }\n    | undefined;\n  credentialSource?: ModelCredentialSourceV1 | undefined;\n  billing?: ModelBillingAttributionV1 | undefined;\n  cost?: ModelCostClassV1 | undefined;\n  capabilities?: ModelCapabilitiesV1 | undefined;\n  pricing?: ModelPricingScheduleV1 | undefined;\n  definitionVersion?: string | undefined;\n};\n\nexport type ModelAvailabilityV1 = {\n  status: \"available\" | \"unavailable\" | \"degraded\" | \"unknown\";\n  selectable: boolean;\n  reason:\n    | \"missing_credential\"\n    | \"needs_reauth\"\n    | \"credential_not_ready\"\n    | \"not_entitled\"\n    | \"provider_unhealthy\"\n    | \"policy_blocked\"\n    | \"unsupported\"\n    | null;\n  checkedAt: string | null;\n};\n\nexport type ModelCredentialReadinessV1 = {\n  status: \"ready\" | \"not_ready\" | \"error\";\n  reason:\n    | \"missing_credential\"\n    | \"needs_reauth\"\n    | \"prerequisites_missing\"\n    | \"resolver_error\"\n    | \"observation_stale\"\n    | null;\n  basis: \"configuration\" | \"connection\" | \"resolver\";\n  checkedAt: string | null;\n};\n\nexport type WorkspaceModelCatalogModel = ClientModel & {\n  credentialReadiness: ModelCredentialReadinessV1;\n  /** Exact workspace-policy verdict without exposing provider identity. */\n  policyAllowed?: boolean | undefined;\n  availability: ModelAvailabilityV1;\n};\n\nexport type WorkspaceModelCatalogResponse = {\n  models: WorkspaceModelCatalogModel[];\n};\n\nexport type WorkspaceGatewayCustomModel = {\n  id: string;\n  upstreamModelId: string;\n  label: string | null;\n  version: number;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type WorkspaceGatewayCustomModelsResponse = {\n  models: WorkspaceGatewayCustomModel[];\n};\n\nexport type CreateWorkspaceGatewayCustomModelRequest = {\n  operationId: string;\n  upstreamModelId: string;\n  label?: string | undefined;\n};\n\nexport type DeleteWorkspaceGatewayCustomModelRequest = {\n  expectedVersion: number;\n  operationId: string;\n};\n\nexport type WorkspaceOpenRouterCustomModel = WorkspaceGatewayCustomModel;\n\nexport type WorkspaceOpenRouterCustomModelsResponse = {\n  models: WorkspaceOpenRouterCustomModel[];\n};\n\nexport type CreateWorkspaceOpenRouterCustomModelRequest = CreateWorkspaceGatewayCustomModelRequest;\n\nexport type DeleteWorkspaceOpenRouterCustomModelRequest = DeleteWorkspaceGatewayCustomModelRequest;\n\nexport type OrganizationModelProviderKind = \"vercel_gateway\" | \"openrouter\";\n\nexport type OrganizationModelProviderConnection = {\n  providerKind: OrganizationModelProviderKind;\n  status: \"active\" | \"revoked\";\n  version: number;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type UpsertOrganizationModelProviderConnectionRequest = {\n  operationId: string;\n  expectedVersion?: number | undefined;\n  apiKey: string;\n};\n\nexport type RevokeOrganizationModelProviderConnectionRequest = {\n  operationId: string;\n  expectedVersion: number;\n};\n\nexport type OrganizationProviderCustomModel = WorkspaceGatewayCustomModel;\nexport type OrganizationProviderCustomModelsResponse = {\n  models: OrganizationProviderCustomModel[];\n};\nexport type CreateOrganizationProviderCustomModelRequest = CreateWorkspaceGatewayCustomModelRequest;\nexport type DeleteOrganizationProviderCustomModelRequest = DeleteWorkspaceGatewayCustomModelRequest;\n\n/**\n * The workspace's hard model/provider allowlist. `null` means unrestricted for\n * that dimension; an empty array is an explicit total block.\n */\nexport type WorkspaceModelAccessPolicy = {\n  allowedProviders: string[] | null;\n  allowedModels: string[] | null;\n};\n\n/** Full replacement body for `PUT /v1/workspaces/:id/model-policy`. */\nexport type UpdateWorkspaceModelAccessPolicyRequest = {\n  allowedProviders?: string[] | null | undefined;\n  allowedModels?: string[] | null | undefined;\n};\n\n/**\n * Connection state of a workspace's Codex (ChatGPT) subscription, returned by\n * `GET /v1/workspaces/:id/codex/status`. `models` are the codex models the\n * workspace can select (projected as ClientModel under their own \"no credits\"\n * provider group), present only while connected.\n */\nexport type CodexConnectionStatus = {\n  connected: boolean;\n  plan?: string | null;\n  valid?: boolean;\n  expiresAt?: string | null;\n  lastError?: string | null;\n  models?: ClientModel[];\n  /** The account a session runs on when unpinned (label for the in-session indicator). */\n  activeAccount?: {\n    id: string;\n    label?: string | null;\n    chatgptAccountId?: string | null;\n  } | null;\n  /** Live model-catalog probe result for the active account only. */\n  activeAccountValid?: boolean;\n  /** Cached readiness of any account in the effective worker pool. */\n  poolReady?: boolean;\n  /** Cached unpinned worker routability; rotation-off remains active-pointer-only. */\n  workerRoutable?: boolean;\n  /** How many Codex accounts the workspace has connected. */\n  accountCount?: number;\n  source?: WorkspaceCodexSubscriptionSource;\n};\n\nexport type WorkspaceCodexSubscriptionMode =\n  | \"automatic\"\n  | \"workspace\"\n  | \"organization\"\n  | \"disabled\";\n\nexport type WorkspaceCodexSubscriptionSource = {\n  accountId: string;\n  workspaceId: string;\n  workspaceKind: \"personal\" | \"shared\";\n  mode: WorkspaceCodexSubscriptionMode;\n  effectiveSource: \"workspace\" | \"organization\" | \"disabled\";\n  workspaceAvailable: boolean;\n  organizationAvailable: boolean;\n};\n\n/**\n * One normalized Codex usage window (5h or weekly), camelCase end-to-end (the\n * route normalizes server-side; the web layer never re-hand-types snake_case).\n * `percent` is authoritative; used/limit/remaining are a synthesized 0–100 scale\n * (limit = 100) because the provider gives only a percentage. `remaining =\n * 100 - percent` is the P3 rotation key. Identify the window by `limitWindowSeconds`\n * (18000 ⇒ 5h, 604800 ⇒ weekly), never by position.\n */\nexport type CodexUsageWindow = {\n  used: number;\n  limit: number;\n  remaining: number;\n  percent: number;\n  resetAt: string | null;\n  resetAfterSeconds: number | null;\n  limitWindowSeconds: number;\n};\n\n/** The normalized usage payload for one account — the P2/P3 contract. */\nexport type CodexUsagePayload = {\n  status: \"ok\" | \"limit_reached\" | \"error\" | \"no-data\";\n  planType: string | null;\n  fiveHour: CodexUsageWindow | null;\n  weekly: CodexUsageWindow | null;\n  limitReached: boolean;\n  fetchedAt: string;\n  /** Authoritative count-only summary from /wham/usage; never synthesized rows. */\n  rateLimitResetCredits?: { availableCount: number; credits: null } | null;\n  /** Present only on an auth/refresh failure path. */\n  reason?: \"needs_relogin\";\n  additionalLimits?: Array<{\n    limitName: string;\n    meteredFeature: string;\n    fiveHour: CodexUsageWindow | null;\n    weekly: CodexUsageWindow | null;\n  }>;\n  credits?: {\n    hasCredits: boolean;\n    unlimited: boolean;\n    overageLimitReached: boolean;\n    balance: string;\n  };\n};\n\n/** One connected Codex (ChatGPT) account in a workspace (multi-account P1). Metadata only. */\nexport type CodexAccount = {\n  id: string;\n  source?: \"workspace\" | \"organization\";\n  chatgptAccountId?: string | null;\n  label?: string | null;\n  email?: string | null;\n  plan?: string | null;\n  status: \"active\" | \"needs_relogin\" | \"error\";\n  active: boolean;\n  expiresAt?: string | null;\n  lastRefreshAt?: string | null;\n  lastError?: string | null;\n  // P2 CACHED usage (built from the persisted columns; renders bars off\n  // listCodexAccounts with no second call). null until the first live refresh.\n  fiveHour?: CodexUsageWindow | null;\n  weekly?: CodexUsageWindow | null;\n  usageCheckedAt?: string | null;\n  // P3 rotation cooldown: ISO timestamp until which this account is cooling-down\n  // (rotated-off after a usage cap). null/absent ⇒ not cooling.\n  exhaustedUntil?: string | null;\n  /** Controls only NEW automatic allocations. */\n  allocatorEnabled: boolean;\n  /** Independent OCC sequence; credential/token `version` is never exposed. */\n  allocatorVersion: number;\n  allocatorUpdatedAt?: string | null;\n  /** Cached authoritative summary count, never detailed redemption authority. */\n  resetCreditAvailableCount?: number | null;\n  resetCreditsCheckedAt?: string | null;\n  /** True when this exact credential is the workspace's independent Apps credential. */\n  appsDesignated: boolean;\n  /** True only for the scoped managed human who connected it. */\n  canEnableApps: boolean;\n};\n\nexport type CodexResetCredit = {\n  id: string;\n  resetType: \"codexRateLimits\" | \"unknown\";\n  status: \"available\" | \"redeeming\" | \"redeemed\" | \"unknown\";\n  /** Unix seconds from the provider contract. */\n  grantedAt: number;\n  /** Unix seconds, or null when the provider reports no expiry. */\n  expiresAt: number | null;\n  title: string | null;\n  description: string | null;\n  /** True only for fresh, complete, owning-human provider detail. */\n  actionable: boolean;\n};\n\n/** Owning-human recovery metadata. It contains no token, browser-session hash, or provider key. */\nexport type CodexResetRedemptionRecovery = {\n  attemptId: string;\n  creditId: string;\n  status: \"provider_started\" | \"completed\";\n  outcome: \"reset\" | \"nothingToReset\" | \"noCredit\" | \"alreadyRedeemed\" | null;\n  providerStartedAt: string | null;\n  completedAt: string | null;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type CodexAccountOverview = {\n  accountId: string;\n  usage: {\n    source: \"provider\" | \"cache\" | \"none\";\n    fetchedAt: string | null;\n    stale: boolean;\n    error: string | null;\n    value: CodexUsagePayload | null;\n  };\n  resetCredits: {\n    source: \"provider\" | \"cache\" | \"none\";\n    fetchedAt: string | null;\n    stale: boolean;\n    error: string | null;\n    detailState: \"detailed\" | \"count_only\" | \"capped\" | \"unsupported\" | \"unknown\" | \"error\";\n    detailsComplete: boolean;\n    availableCount: number | null;\n    credits: CodexResetCredit[];\n  };\n  canRedeem: boolean;\n  /** Secret-free reason redemption is owner-actionable or view-only. */\n  redemptionAccess: {\n    ownership: \"current_human\" | \"unowned\" | \"different_human\" | \"managed_human_unavailable\";\n    /** A direct managed-cookie admin may claim only an unowned same-provider row by reconnecting. */\n    canClaimUnownedViaReconnect: boolean;\n  };\n  /** Owning managed-cookie human may replay durable completion without a healthy provider token. */\n  canResumeRedemption: boolean;\n  /** Durable owner-scoped ambiguity/completion discovery; never redemption authority for agents. */\n  redemptions: CodexResetRedemptionRecovery[];\n};\n\n/** Independently settled live overview keyed by workspace credential id. */\nexport type CodexOverviewResponse = {\n  accounts: Record<string, CodexAccountOverview>;\n};\n\nexport type CodexAllocatorUpdate = {\n  allocatorEnabled: boolean;\n  allocatorVersion: number;\n  allocatorUpdatedAt: string | null;\n  changed: boolean;\n};\n\n/** Per-workspace Codex rotation/active settings. New servers return `sharded`. */\nexport type CodexRotationSettings = {\n  rotationEnabled: boolean;\n  rotationStrategy: \"sharded\" | \"most_remaining\" | \"round_robin\" | \"drain_then_next\";\n  activeCredentialId: string | null;\n};\n\n/** GET /codex/accounts — the accounts list + the workspace active pointer + settings. */\nexport type CodexAccountsResponse = {\n  accounts: CodexAccount[];\n  activeAccountId: string | null;\n  source?: WorkspaceCodexSubscriptionSource;\n  /** Added by Apps-aware servers; absent on older same-major deployments. */\n  apps?: {\n    available: boolean;\n    credentialId: string | null;\n    version: number;\n    designatedAt: string | null;\n    canDisable: boolean;\n  };\n  settings: CodexRotationSettings;\n};\n\nexport type OrganizationCodexAccountsResponse = Omit<CodexAccountsResponse, \"apps\" | \"source\">;\n\nexport type CodexAppsUpdate = {\n  credentialId: string | null;\n  version: number;\n  designatedAt: string | null;\n  changed: boolean;\n};\n\n/** Payload of a `codex.account.switched` session event. */\nexport type CodexAccountSwitchedPayload = {\n  fromAccountId: string | null;\n  toAccountId: string;\n  reason: \"manual\" | \"exhausted\" | \"rotation\";\n};\n\n/** Device-code start: show `userCode` at `verificationUri`, then poll with `state`. */\nexport type CodexConnectStart = {\n  userCode: string;\n  verificationUri: string;\n  intervalSeconds: number;\n  state: string;\n};\n\n/** Poll result: keep polling on `pending`, restart on `expired`, done on `connected`. */\nexport type CodexConnectPoll =\n  | { status: \"pending\" }\n  | { status: \"expired\" }\n  | {\n      status: \"connected\";\n      plan?: string | null;\n      accountId?: string;\n      isActive?: boolean;\n    };\n\n/** Explicit authority of one connected SuperGrok/xAI subscription account. */\nexport type SuperGrokAccountScope = \"workspace\" | \"user\" | \"organization\";\n\n/** Metadata-only connected SuperGrok account. Secret OAuth material never crosses the API. */\nexport type SuperGrokAccount = {\n  id: string;\n  plan?: string | null;\n  scope: SuperGrokAccountScope;\n  subject: string;\n  email?: string | null;\n  label?: string | null;\n  status: \"active\" | \"needs_relogin\" | \"error\";\n  active: boolean;\n  expiresAt?: string | null;\n  lastRefreshAt?: string | null;\n  lastError?: string | null;\n  allocatorEnabled: boolean;\n  allocatorVersion: number;\n  allocatorUpdatedAt?: string | null;\n  exhaustedUntil?: string | null;\n  quota?: {\n    usedPercent: number | null;\n    periodStart: string | null;\n    periodEnd: string | null;\n    subscriptionTier: string | null;\n    checkedAt: string | null;\n  } | null;\n};\n\nexport type SuperGrokRotationSettings = {\n  rotationEnabled: boolean;\n  rotationStrategy: \"sharded\";\n  activeCredentialId: string | null;\n};\n\n/** GET /supergrok/accounts — visible accounts plus the workspace active pointer. */\nexport type SuperGrokAccountsResponse = {\n  source?: \"workspace\" | \"user\" | \"organization\";\n  organizationId?: string;\n  accounts: SuperGrokAccount[];\n  activeAccountId: string | null;\n  settings: SuperGrokRotationSettings;\n};\n\nexport type SuperGrokConnectionStatus = {\n  connected: boolean;\n  valid?: boolean;\n  accountCount?: number;\n  models?: ClientModel[];\n  activeAccount?: {\n    id: string;\n    label?: string | null;\n    subject?: string | null;\n    scope: SuperGrokAccountScope;\n  } | null;\n};\n\n/** Workspace is the deliberately simple/default connection authority. */\nexport type SuperGrokConnectStart = {\n  userCode: string;\n  verificationUri: string;\n  verificationUriComplete?: string | null;\n  intervalSeconds: number;\n  expiresInSeconds: number;\n  scope: SuperGrokAccountScope;\n  state: string;\n};\n\nexport type SuperGrokConnectPoll =\n  | { status: \"pending\" | \"slow_down\"; intervalSeconds?: number }\n  | { status: \"expired\" | \"denied\" }\n  | {\n      status: \"connected\";\n      accountId: string;\n      scope: SuperGrokAccountScope;\n      isActive: boolean;\n      email?: string | null;\n    };\n\nexport type SuperGrokAllocatorUpdate = {\n  allocatorEnabled: boolean;\n  allocatorVersion: number;\n  allocatorUpdatedAt: string | null;\n  changed: boolean;\n};\n\n/** Remaining usage/limits for one account. `usage` is the normalized P2 payload. */\nexport type CodexUsage = {\n  status: \"ok\" | \"limit_reached\" | \"error\" | \"no-data\";\n  usage: CodexUsagePayload | null;\n};\n\n/** Batched live-refresh response, keyed by credential id; each entry independently statused. */\nexport type CodexUsageMap = Record<string, CodexUsage>;\n\n/**\n * How a deployment expects clients to authenticate to it, surfaced so a UI can\n * wire up the right header/cookie without prior knowledge of the host setup.\n * Discriminated on `mode`; `none` is the back-compat default.\n */\nexport type ClientAuthConfig =\n  | { mode: \"none\" }\n  | { mode: \"deploymentKey\"; headerName: \"x-opengeni-access-key\" }\n  | { mode: \"configuredToken\"; headerName: \"authorization\"; scheme: \"bearer\" }\n  | {\n      mode: \"managedSession\";\n      session: \"cookie\";\n      /** Defaults to true when omitted by an older deployment. */\n      emailVerificationRequired?: boolean;\n      /** Configured managed sign-in providers; omitted by older deployments. */\n      socialProviders?: (\"google\" | \"github\")[];\n    };\n\n// Kept value-identical to @opengeni/contracts and pinned by the SDK contract\n// parity suite. The SDK has no runtime dependency on the Zod contracts package.\nexport const OPENGENI_API_CONTRACT_REVISION = \"2026-08-organization-recovery-custody-v1\" as const;\nexport const OPENGENI_API_CONTRACT_HEADER = \"x-opengeni-api-contract\" as const;\n/** Bounded request/response identifier shared by browser, ingress, and API diagnostics. */\nexport const OPENGENI_CORRELATION_HEADER = \"x-opengeni-correlation-id\" as const;\n\n/**\n * Public, unauthenticated-by-default client bootstrap config returned by\n * `GET /v1/config/client`: which models + reasoning efforts are exposed, the\n * MCP servers and file-upload limits a composer should offer, and how the\n * deployment expects the client to authenticate. `allowedModels` is kept for\n * back-compat; `models` carries the richer provider-grouped list for a picker.\n */\nexport type ClientConfig = {\n  deploymentRevision: string;\n  apiContractRevision: typeof OPENGENI_API_CONTRACT_REVISION;\n  serverVersion?: string | undefined;\n  defaultModel: string;\n  allowedModels: string[];\n  models: ClientModel[];\n  defaultReasoningEffort: ReasoningEffort;\n  allowedReasoningEfforts: ReasoningEffort[];\n  defaultSandboxBackend?: SandboxBackend | undefined;\n  mcpServers: { id: string; name: string }[];\n  /** Deployment defaults and hard maximum for built-in OpenGeni session tools. */\n  firstPartyMcpTools?:\n    | {\n        default: FirstPartyMcpToolName[];\n        allowed: FirstPartyMcpToolName[];\n      }\n    | undefined;\n  fileUploads: { enabled: boolean; maxSizeBytes: number };\n  /** Native browser microphone capture + server-side transcription capability. */\n  voiceInput?: ClientVoiceInputConfig | undefined;\n  productAccessMode: ProductAccessMode;\n  /** Client-safe hint for whether the console should offer Stripe checkout. */\n  billingMode?: BillingMode | undefined;\n  managedAuthSessionSetMode: \"legacy\" | \"dual\" | \"broker\";\n  auth: ClientAuthConfig;\n  analytics: {\n    consentRequired: boolean;\n    providers: {\n      reo?: { clientId: string } | undefined;\n      posthog?: { projectKey: string; host: string } | undefined;\n      ga4?: { measurementId: string } | undefined;\n    };\n  };\n  // Server-wide hint: does this deployment support Channel-A structured services\n  // at all (P4.4). Per-session availability is negotiated on /stream-capabilities;\n  // this is the coarse on/off the client uses to decide whether to even attempt\n  // the fs/git/terminal panels.\n  structuredServices: {\n    fileSystem: boolean;\n    git: boolean;\n    terminalEvents: boolean;\n  };\n};\n\n/** Client-safe voice-input capability projection. */\nexport type ClientVoiceInputConfig = {\n  available: boolean;\n  providers?: VoiceInputProviderId[] | undefined;\n  maxDurationSeconds: number;\n  maxSizeBytes: number;\n  acceptedMimeTypes: string[];\n  resumable?: ClientResumableVoiceInputConfig | undefined;\n};\n\nexport type ClientResumableVoiceInputConfig = {\n  maxDurationSeconds: number;\n  maxSizeBytes: number;\n  maxChunkSizeBytes: number;\n  providerSegmentSeconds: number;\n};\n\nexport type TranscriptionRecordingErrorCode =\n  | \"permission_denied\"\n  | \"not_supported\"\n  | \"network\"\n  | \"provider\"\n  | \"policy_blocked\"\n  | \"timeout\"\n  | \"cancelled\"\n  | \"unavailable\"\n  | \"too_large\"\n  | \"invalid_audio\"\n  | \"unknown\";\n\nexport type TranscriptionRecordingState =\n  | \"uploading\"\n  | \"segmenting\"\n  | \"ready\"\n  | \"transcribing\"\n  | \"complete\"\n  | \"failed\"\n  | \"discarded\";\n\nexport type TranscriptionRecordingSegmentState =\n  | \"preparing\"\n  | \"pending\"\n  | \"transcribing\"\n  | \"complete\"\n  | \"failed\";\n\nexport type TranscriptionRecordingSegment = {\n  segmentNumber: number;\n  state: TranscriptionRecordingSegmentState;\n  startMilliseconds: number;\n  durationMilliseconds: number;\n  byteLength: number;\n  errorCode: TranscriptionRecordingErrorCode | null;\n  retryable: boolean;\n};\n\nexport type TranscriptionRecording = {\n  id: string;\n  workspaceId: string;\n  mimeType: string;\n  state: TranscriptionRecordingState;\n  nextChunkNumber: number;\n  chunkCount: number;\n  totalBytes: number;\n  totalDurationMilliseconds: number;\n  segmentCount: number;\n  completedSegmentCount: number;\n  transcriptText: string | null;\n  languages: string[];\n  errorCode: TranscriptionRecordingErrorCode | null;\n  retryable: boolean;\n  objectsCleaned: boolean;\n  createdAt: string;\n  updatedAt: string;\n  expiresAt: string;\n};\n\nexport type TranscriptionRecordingResponse = {\n  recording: TranscriptionRecording;\n  segments: TranscriptionRecordingSegment[];\n  retryAfterMilliseconds?: number;\n};\n\nexport type TranscriptionRecordingListResponse = {\n  recordings: TranscriptionRecording[];\n};\n\nexport type TranscriptionRecordingChunk = {\n  chunkNumber: number;\n  byteLength: number;\n  sha256: string;\n  startMilliseconds: number;\n  durationMilliseconds: number;\n  deduplicated: boolean;\n};\n\nexport type UploadTranscriptionRecordingChunkResponse = {\n  recording: TranscriptionRecording;\n  chunk: TranscriptionRecordingChunk;\n};\n\n/** Response from POST /v1/workspaces/:workspaceId/transcriptions. */\nexport type TranscribeAudioResponse = {\n  text: string;\n  languages: string[];\n};\n\nexport type AccountRole = \"owner\" | \"admin\" | \"member\";\n\nexport type AccessPrincipalKind =\n  | \"human_session\"\n  | \"agent_attempt\"\n  | \"service\"\n  | \"api_key\"\n  | \"configured_key\";\n\nexport type AccountGrant = {\n  accountId: string;\n  subjectId: string;\n  subjectLabel?: string | undefined;\n  role?: AccountRole | undefined;\n  permissions: Permission[];\n  metadata?: Record<string, unknown> | undefined;\n};\n\nexport type AccessGrant = {\n  workspaceId: string;\n  accountId: string;\n  subjectId: string;\n  subjectLabel?: string | undefined;\n  permissions: Permission[];\n  principalKind?: AccessPrincipalKind | undefined;\n  metadata?: Record<string, unknown> | undefined;\n  serviceInitiator?: ServiceTurnInitiator | undefined;\n  serviceInitiatorContext?: ServiceTurnInitiatorContext | undefined;\n};\n\nexport type AccessContext = {\n  mode: ProductAccessMode;\n  subjectId: string;\n  subjectLabel?: string | undefined;\n  accountGrants: AccountGrant[];\n  workspaceGrants: AccessGrant[];\n  defaultAccountId: string | null;\n  defaultWorkspaceId: string | null;\n};\n\nexport type ManagedOrganizationMembership = {\n  id: string;\n  organizationId: string;\n  status: \"active\";\n  personalWorkspaceId: string;\n};\n\nexport type ListManagedOrganizationMembershipsResponse = {\n  memberships: ManagedOrganizationMembership[];\n};\n\nexport type UserResourceKind =\n  | \"connection\"\n  | \"document\"\n  | \"variable_set\"\n  | \"rig\"\n  | \"connected_machine\";\nexport type UserResourceGrantAction =\n  | \"connection.use\"\n  | \"document.read\"\n  | \"variable_set.use\"\n  | \"rig.use\"\n  | \"connected_machine.use\";\nexport type UserResourceAuthorityGrant = {\n  grantId: string;\n  targetWorkspaceId: string;\n  targetSessionId: string | null;\n  action: UserResourceGrantAction;\n  mode: \"once\" | \"session\" | \"always\";\n  context: \"user_private\" | \"workspace_shared\";\n  authorityEpoch: number | null;\n  generation: number;\n  status: \"active\" | \"consumed\" | \"revoked\" | \"expired\";\n  expiresAt: string | null;\n  delegation: UserResourceDelegation;\n};\nexport type UserResourceAuthoritySummary = {\n  authorityId: string;\n  resourceKind: UserResourceKind;\n  resourceId: string;\n  originWorkspaceId: string | null;\n  generation: number;\n  status: \"active\" | \"retained\" | \"revoked\";\n  grants: UserResourceAuthorityGrant[];\n};\nexport type ListUserResourceAuthoritiesOptions = {\n  resourceKind: UserResourceKind;\n  cursor?: string | undefined;\n  limit?: number | undefined;\n};\nexport type ListUserResourceAuthoritiesResponse = {\n  scope: \"user\";\n  authorities: UserResourceAuthoritySummary[];\n  nextCursor: string | null;\n};\nexport type IssueUserResourceGrantRequest =\n  | {\n      scope: \"user\";\n      resourceKind: UserResourceKind;\n      mode: \"session\";\n      context: \"user_private\" | \"workspace_shared\";\n      sessionId: string;\n      expectedAuthorityEpoch: number;\n      workspaceSharedAcknowledged?: boolean | undefined;\n    }\n  | {\n      scope: \"user\";\n      resourceKind: UserResourceKind;\n      mode: \"always\";\n      context: \"user_private\" | \"workspace_shared\";\n      sessionId?: null | undefined;\n      expectedAuthorityEpoch?: null | undefined;\n      workspaceSharedAcknowledged?: boolean | undefined;\n    };\nexport type UserResourceGrantMutationResponse = {\n  scope: \"user\";\n  grant: UserResourceAuthorityGrant;\n};\nexport type RevokeUserResourceGrantResponse = {\n  scope: \"user\";\n  grant: {\n    grantId: string;\n    generation: number;\n    status: \"revoked\";\n    revokedAt: string;\n  };\n};\n\nexport type OrganizationMembershipRole = \"owner\" | \"admin\" | \"member\";\nexport type WorkspaceMemberRole = \"viewer\" | \"member\" | \"admin\" | \"custom\";\nexport type AssignableWorkspaceMemberRole = \"viewer\" | \"member\" | \"admin\";\nexport type OrganizationUserSetupDelivery = {\n  id: string;\n  state: \"pending\" | \"sent\" | \"failed\" | \"outcome_unknown\" | \"revoked\";\n  attemptCount: number;\n  revision: number;\n  errorClass: string | null;\n  retryState: \"available\" | \"reconciliation_required\" | \"unavailable\";\n  sentAt: string | null;\n  updatedAt: string;\n};\nexport type OrganizationInvitation = {\n  id: string;\n  organizationId: string;\n  organizationName: string | null;\n  targetEmail: string;\n  targetName: string | null;\n  initialWorkspaceIds: string[];\n  role: OrganizationMembershipRole;\n  status: \"pending\" | \"accepted\" | \"revoked\" | \"expired\";\n  revision: number;\n  expiresAt: string;\n  acceptedMembershipId: string | null;\n  createdAt: string;\n  updatedAt: string;\n  delivery: OrganizationUserSetupDelivery | null;\n};\nexport type OrganizationMember = {\n  id: string;\n  organizationId: string;\n  subjectId: string;\n  name: string | null;\n  email: string | null;\n  role: OrganizationMembershipRole;\n  status: \"provisioning\" | \"active\" | \"suspended\" | \"revoked\";\n  authorizationRevision: number;\n  personalWorkspaceId: string | null;\n  revokedAt: string | null;\n  personalRetentionUntil: string | null;\n  createdAt: string;\n  updatedAt: string;\n};\nexport type OrganizationAdministrationMemberWorkspaceAccess = {\n  workspaceId: string;\n  workspaceName: string;\n  membershipId: string;\n  role: WorkspaceMemberRole;\n  updatedAt: string;\n};\nexport type OrganizationAdministrationMember = {\n  id: string;\n  organizationId: string;\n  subjectId: string;\n  name: string | null;\n  email: string | null;\n  role: OrganizationMembershipRole;\n  status: \"provisioning\" | \"active\" | \"suspended\" | \"revoked\";\n  authorizationRevision: number;\n  sharedWorkspaceAccess: OrganizationAdministrationMemberWorkspaceAccess[];\n  revokedAt: string | null;\n  createdAt: string;\n  updatedAt: string;\n};\nexport type OrganizationSummary = {\n  id: string;\n  name: string;\n  createdAt: string;\n  updatedAt: string;\n};\nexport type OrganizationWorkspaceAccessMember = {\n  membershipId: string;\n  organizationMembershipId: string | null;\n  subjectId: string;\n  name: string | null;\n  email: string | null;\n  subjectLabel: string | null;\n  principalKind: \"human\" | \"service\";\n  organizationRole: OrganizationMembershipRole | null;\n  role: WorkspaceMemberRole;\n  permissions: string[];\n  createdAt: string;\n  updatedAt: string;\n};\nexport type OrganizationWorkspaceAccess = {\n  id: string;\n  name: string;\n  slug: string | null;\n  createdAt: string;\n  updatedAt: string;\n  members: OrganizationWorkspaceAccessMember[];\n};\nexport type OrganizationAdministrationOverview = {\n  organization: OrganizationSummary;\n  roles: OrganizationWorkspaceRoleDefinition[];\n  workspaces: OrganizationWorkspaceAccess[];\n};\nexport type OrganizationWorkspaceRoleDefinition = {\n  role: AssignableWorkspaceMemberRole;\n  label: string;\n  description: string;\n  permissions: Permission[];\n};\nexport type OrganizationPrivateSessionSettings = {\n  organizationId: string;\n  enabled: boolean;\n  available: boolean;\n  version: number;\n  updatedAt: string;\n  changed?: boolean;\n};\nexport type CreateOrganizationWorkspaceRequest = {\n  name: string;\n  operationId: string;\n};\nexport type UpdateOrganizationWorkspaceRequest = {\n  name: string;\n  expectedUpdatedAt: string;\n  operationId: string;\n};\nexport type PutOrganizationWorkspaceMemberRequest =\n  | {\n      role: AssignableWorkspaceMemberRole;\n      expectedUpdatedAt: string | null;\n      operationId: string;\n    }\n  | {\n      role: \"custom\";\n      permissions: Permission[];\n      expectedUpdatedAt: string | null;\n      operationId: string;\n    };\nexport type RevokeOrganizationWorkspaceMemberRequest = {\n  expectedUpdatedAt: string;\n  operationId: string;\n};\nexport type RevokeOrganizationWorkspaceMemberResponse = {\n  removed: boolean;\n  replay: boolean;\n};\nexport type CreateOrganizationRequest = {\n  name: string;\n  operationId: string;\n};\nexport type CreateOrganizationResponse = {\n  organization: OrganizationSummary;\n  workspaceId: string;\n};\nexport type CreateAdditionalOrganizationRequest = {\n  name: string;\n  workspaceName: string;\n  operationId: string;\n};\nexport type CreateAdditionalOrganizationResponse = {\n  organization: OrganizationSummary;\n  workspaceId: string;\n  personalWorkspaceId: string;\n};\nexport type UpdateOrganizationNameRequest = {\n  name: string;\n  expectedUpdatedAt: string;\n  operationId: string;\n};\nexport type UpdateOrganizationPrivateSessionSettingsRequest = {\n  enabled: boolean;\n  expectedVersion: number;\n  operationId: string;\n};\nexport type OrganizationRetentionPolicy = {\n  organizationId: string;\n  mode: \"retain\" | \"delete_after\";\n  retentionDays: number | null;\n  version: number;\n  updatedAt: string;\n};\nexport type OrganizationRecoveryPolicyState =\n  | \"pending_acceptance\"\n  | \"active\"\n  | \"degraded\"\n  | \"superseded\"\n  | \"disabled\";\nexport type OrganizationRecoveryOperationState =\n  | \"collecting\"\n  | \"cooling\"\n  | \"executed\"\n  | \"cancelled\"\n  | \"expired\"\n  | \"superseded\";\nexport type OrganizationRecoveryUnavailableReason =\n  | \"no_policy\"\n  | \"pending_acceptance\"\n  | \"degraded\"\n  | \"disabled\"\n  | \"identity_unavailable\";\nexport type OrganizationRecoveryMemberSummary = {\n  membershipId: string;\n  name: string | null;\n  email: string | null;\n};\nexport type OrganizationRecoveryCustodian = OrganizationRecoveryMemberSummary & {\n  ordinal: number;\n  enrollmentState: \"pending_acceptance\" | \"accepted\" | \"ineligible\";\n  acceptedAt: string | null;\n};\nexport type OrganizationRecoveryPolicy = {\n  id: string;\n  organizationId: string;\n  revision: number;\n  state: OrganizationRecoveryPolicyState;\n  custodians: OrganizationRecoveryCustodian[];\n  createdAt: string;\n  updatedAt: string;\n};\nexport type OrganizationRecoveryApproval = OrganizationRecoveryMemberSummary & {\n  approvedAt: string;\n};\nexport type OrganizationRecoveryOperation = {\n  id: string;\n  organizationId: string;\n  policyId: string;\n  policyRevision: number;\n  revision: number;\n  state: OrganizationRecoveryOperationState;\n  target: OrganizationRecoveryMemberSummary;\n  approvals: OrganizationRecoveryApproval[];\n  approvalCount: number;\n  quorumAt: string | null;\n  executableAt: string | null;\n  expiresAt: string;\n  executedAt: string | null;\n  cancelledAt: string | null;\n  notificationJournaled: boolean;\n  createdAt: string;\n  updatedAt: string;\n};\nexport type OrganizationRecoveryCapabilities = {\n  configure: boolean;\n  accept: boolean;\n  disable: boolean;\n  start: boolean;\n  approve: boolean;\n  cancel: boolean;\n  execute: boolean;\n};\nexport type OrganizationRecoveryOverview = {\n  organizationId: string;\n  availability: \"available\" | \"recovery_unavailable\";\n  unavailableReason: OrganizationRecoveryUnavailableReason | null;\n  recentReauthenticationAt: string | null;\n  eligibleMembers: OrganizationRecoveryMemberSummary[];\n  policy: OrganizationRecoveryPolicy | null;\n  operation: OrganizationRecoveryOperation | null;\n  capabilities: OrganizationRecoveryCapabilities;\n};\nexport type ConfigureOrganizationRecoveryPolicyRequest = {\n  custodianMembershipIds: [string, string, string];\n  expectedPolicyRevision: number;\n  operationId: string;\n};\nexport type AcceptOrganizationRecoveryCustodyRequest = {\n  expectedPolicyRevision: number;\n  operationId: string;\n};\nexport type DisableOrganizationRecoveryPolicyRequest = AcceptOrganizationRecoveryCustodyRequest;\nexport type StartOrganizationRecoveryOperationRequest = {\n  targetMembershipId: string;\n  expectedPolicyRevision: number;\n  operationId: string;\n};\nexport type OrganizationRecoveryOperationCommandRequest = {\n  expectedOperationRevision: number;\n  operationId: string;\n};\nexport type OrganizationRecoveryMutationResponse = {\n  replay: boolean;\n  overview: OrganizationRecoveryOverview;\n};\nexport type CreateOrganizationInvitationRequest = {\n  email: string;\n  name?: string;\n  initialWorkspaceIds?: string[];\n  role?: OrganizationMembershipRole;\n  expiresAt: string;\n  operationId: string;\n};\nexport type AcceptOrganizationInvitationRequest = {\n  expectedRevision: number;\n  operationId: string;\n};\nexport type RevokeOrganizationInvitationRequest = AcceptOrganizationInvitationRequest;\nexport type PreviewOrganizationUserSetupRequest = { token: string };\nexport type OrganizationUserSetupPreview =\n  | { state: \"unavailable\" | \"expired\" | \"revoked\" | \"completed\" }\n  | {\n      state: \"pending\";\n      organizationId: string;\n      organizationName: string;\n      targetEmail: string;\n      targetName: string | null;\n      organizationRole: OrganizationMembershipRole;\n      sharedWorkspaceAccess: Array<{\n        workspaceId: string;\n        workspaceName: string;\n        role: AssignableWorkspaceMemberRole;\n      }>;\n      expiresAt: string;\n    };\nexport type RetryOrganizationUserSetupDeliveryRequest = { operationId: string };\nexport type UpdateOrganizationMemberRequest = {\n  kind: \"change_role\" | \"suspend\" | \"reactivate\" | \"offboard\";\n  role?: OrganizationMembershipRole;\n  expectedAuthorizationRevision: number;\n  operationId: string;\n  reason?: string;\n};\nexport type UpdateOrganizationRetentionPolicyRequest = {\n  mode: \"retain\" | \"delete_after\";\n  retentionDays: number | null;\n  expectedVersion: number;\n  operationId: string;\n};\nexport type ListOrganizationInvitationsPageResponse = {\n  invitations: OrganizationInvitation[];\n  nextCursor: string | null;\n};\nexport type ListOrganizationMembersResponse = {\n  members: OrganizationAdministrationMember[];\n};\nexport type ListOrganizationAdministrationMembersResponse = {\n  members: OrganizationAdministrationMember[];\n};\nexport type AcceptOrganizationInvitationResponse = {\n  invitation: OrganizationInvitation;\n  membership: OrganizationMember;\n};\n\nexport type Workspace = {\n  id: string;\n  accountId: string;\n  kind: \"personal\" | \"shared\";\n  name: string;\n  slug: string | null;\n  externalSource: string | null;\n  externalId: string | null;\n  agentInstructions: string | null;\n  settings: Record<string, unknown>;\n  inferenceControl: {\n    timer?: WorkspacePauseTimer | null | undefined;\n    serverTime?: string | undefined;\n    state: \"active\" | \"paused\";\n    revision: number;\n    reason: string | null;\n    changedBy: string | null;\n    changedAt: string | null;\n  };\n  defaultRigId?: string | null;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type WorkspaceSettings = {\n  memoryEnabled?: boolean | undefined;\n  /** Reversible Memory V1 prompt composition rollout. */\n  memoryPromptMode?: \"legacy_standing\" | \"retrieval_only\" | undefined;\n  /** Model policy inherited by new chats and scheduled tasks. */\n  sessionDefaults?: WorkspaceSessionDefaults | undefined;\n  /** Exact capability selection inherited by new top-level sessions. */\n  sessionToolDefaults?: WorkspaceSessionToolDefaults | undefined;\n  voiceInput?: WorkspaceVoiceInputSettings | undefined;\n  transcription?: WorkspaceTranscriptionPolicy | undefined;\n  maxNestedAgentDepth?: number | null | undefined;\n  /** Default for new Codex sessions; absent ⇒ remote_v2. */\n  codexCompactionDefault?: \"remote_v2\" | \"portable\" | undefined;\n  /** Whether agents may invoke the built-in structured human-input tool. */\n  agentHumanInputEnabled?: boolean | undefined;\n  slackReactionSummon?: WorkspaceSlackReactionSummonSettings | undefined;\n  /** Slack orchestration notices; both default off when absent or invalid. */\n  slackOrchestrationNotices?: WorkspaceSlackOrchestrationNoticeSettings | undefined;\n  [key: string]: unknown;\n};\n\nexport type WorkspaceSessionDefaults = {\n  model: string;\n  reasoningEffort: ReasoningEffort;\n};\n\nexport type WorkspaceSessionToolDefaults = {\n  mcpServerIds?: string[];\n  firstPartyMcpTools?: FirstPartyMcpToolName[];\n};\n\nexport type WorkspaceSlackReactionSummonSettings = {\n  enabled: boolean;\n  emoji: \"genie\";\n  channelPolicy: { mode: \"bot_member\" } | { mode: \"allowlist\"; channelIds: string[] };\n};\n\n/**\n * Per-workspace switches for the two Slack orchestration notices. Both are off\n * unless the workspace explicitly turned them on.\n */\nexport type WorkspaceSlackOrchestrationNoticeSettings = {\n  /** Post a pointer card when a child worker blocks on input or an approval. */\n  childRequiresAction?: boolean | undefined;\n  /** Post one line when a goal pauses for budget or the continuation cap. */\n  goalPaused?: boolean | undefined;\n};\n\nexport type SlackReactionChannel = {\n  id: string;\n  name: string | null;\n  isPrivate: boolean;\n};\n\nexport type SlackReactionChannelListResponse = {\n  channels: SlackReactionChannel[];\n  nextCursor: string | null;\n};\n\nexport type SlackChannelRoute = {\n  slackChannelId: string;\n  targetWorkspaceId: string;\n  targetWorkspaceName: string | null;\n  source: \"picker\" | \"admin\";\n  updatedAt: string;\n};\n\nexport type SlackChannelRouteListResponse = {\n  routes: SlackChannelRoute[];\n  routingEnabled: boolean;\n};\n\nexport type UpdateSlackChannelRoutesRequest = {\n  connectionId: string;\n  routes: Array<{ slackChannelId: string; targetWorkspaceId: string | null }>;\n};\n\nexport type VoiceInputProviderId =\n  | \"supergrok-subscription\"\n  | \"codex-subscription\"\n  | \"openai\"\n  | \"azure-openai\";\n\nexport type WorkspaceVoiceInputSettings = {\n  enabled: boolean;\n  preferredProvider?: VoiceInputProviderId | null | undefined;\n  fallbackEnabled?: boolean | undefined;\n};\n\nexport type UpdateWorkspaceSettingsRequest = {\n  memoryEnabled?: boolean | undefined;\n  memoryPromptMode?: \"legacy_standing\" | \"retrieval_only\" | undefined;\n  sessionDefaults?: WorkspaceSessionDefaults | undefined;\n  sessionToolDefaults?:\n    | { mcpServerIds?: string[] | null; firstPartyMcpTools?: FirstPartyMcpToolName[] | null }\n    | undefined;\n  voiceInput?: WorkspaceVoiceInputSettings | undefined;\n  transcription?: WorkspaceTranscriptionPolicy | undefined;\n  maxNestedAgentDepth?: number | null | undefined;\n  codexCompactionDefault?: \"remote_v2\" | \"portable\" | undefined;\n  agentHumanInputEnabled?: boolean | undefined;\n  slackReactionSummon?: WorkspaceSlackReactionSummonSettings | undefined;\n  slackOrchestrationNotices?: WorkspaceSlackOrchestrationNoticeSettings | undefined;\n  [key: string]: unknown;\n};\n\nexport type SetWorkspaceDefaultRigRequest = {\n  rigId: string | null;\n};\n\nexport type CreateWorkspaceRequest = {\n  accountId?: string | undefined;\n  name: string;\n  slug?: string | undefined;\n  externalSource?: string | undefined;\n  externalId?: string | undefined;\n  agentInstructions?: string | null | undefined;\n};\n\nexport type EnsureWorkspaceRequest = {\n  accountId: string;\n  externalSource: string;\n  externalId: string;\n  name: string;\n  slug?: string | undefined;\n  agentInstructions?: string | null | undefined;\n};\n\nexport type EnsureWorkspaceResponse = {\n  workspace: Workspace;\n  created: boolean;\n};\n\nexport type UpdateWorkspaceRequest = {\n  name?: string | undefined;\n  slug?: string | null | undefined;\n  agentInstructions?: string | null | undefined;\n};\n\n/**\n * Organization API key access tier, derived by the server from the key's\n * permissions: `full` administers the organization, `read` only inventories\n * shared workspaces and reads their sessions, events, and files.\n */\nexport type OrganizationApiKeyAccess = \"full\" | \"read\";\n\nexport type ApiKey = {\n  id: string;\n  accountId: string;\n  workspaceId: string | null;\n  name: string;\n  description: string | null;\n  prefix: string;\n  permissions: Permission[];\n  /** Organization keys only; omitted for workspace-scoped keys. */\n  access?: OrganizationApiKeyAccess | undefined;\n  expiresAt: string | null;\n  revokedAt: string | null;\n  lastUsedAt: string | null;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type CreateApiKeyRequest = {\n  name: string;\n  description?: string | undefined;\n  permissions: Permission[];\n  expiresAt?: string | undefined;\n};\n\nexport type CreateApiKeyResponse = {\n  apiKey: ApiKey;\n  /** The full secret token — shown once at creation, never returned again. */\n  token: string;\n};\n\nexport type CreateOrganizationApiKeyRequest = {\n  name: string;\n  description?: string | undefined;\n  expiresAt?: string | undefined;\n  /** Omitted means `full`. */\n  access?: OrganizationApiKeyAccess | undefined;\n};\n\nexport type ListApiKeysResponse = {\n  apiKeys: ApiKey[];\n};\n\n// --- Organization-wide session list (org API key or organization owner) -----------------------\n\nexport type ListOrganizationSessionsOptions = {\n  /** Page size, 1..200; the server default is 50. */\n  limit?: number | undefined;\n  /** `nextCursor` from the previous page. */\n  cursor?: string | undefined;\n  /** Keep only sessions labelled with this exact end user. */\n  scopeSubjectId?: string | undefined;\n  /** Keep only sessions in this exact lifecycle state. */\n  status?: SessionStatus | undefined;\n  signal?: AbortSignal | undefined;\n};\n\n/**\n * One page of `GET /v1/organizations/:organizationId/sessions`. Rows come from\n * every shared workspace the caller may read, each carrying its\n * `workspaceId`; personal workspaces are never included and private sessions\n * stay invisible. A page may be shorter than `limit` while `nextCursor` is\n * still set, so follow `nextCursor` until it is null.\n */\nexport type OrganizationSessionListResponse = {\n  sessions: Session[];\n  nextCursor: string | null;\n};\n\n// A person (or API key) with access to a workspace. `subjectId` is\n// `user:<betterAuthUserId>` or `api_key:<id>`; the People surface lists the\n// `user:` subjects (api_key subjects belong to the API keys section).\nexport type WorkspaceMember = {\n  subjectId: string;\n  subjectLabel: string | null;\n  role: string;\n  permissions: Permission[];\n  createdAt: string;\n};\n\nexport type ListWorkspaceMembersResponse = {\n  members: WorkspaceMember[];\n};\n\nexport type WorkspaceMemberCandidate = {\n  organizationMembershipId: string;\n  subjectId: string;\n  name: string | null;\n  email: string | null;\n  organizationRole: \"owner\" | \"admin\" | \"member\";\n};\n\nexport type ListWorkspaceMemberCandidatesResponse = {\n  members: WorkspaceMemberCandidate[];\n};\n\nexport type AddWorkspaceMemberRequest = {\n  organizationMembershipId: string;\n  role?: string | undefined;\n  permissions: Permission[];\n};\n\nexport type UpdateWorkspaceMemberRequest = {\n  role?: string | undefined;\n  permissions: Permission[];\n};\n\nexport type SlackUserLinkAccessRequestStatus =\n  | \"prepared\"\n  | \"pending\"\n  | \"completed\"\n  | \"denied\"\n  | \"cancelled\"\n  | \"expired\";\n\n/** Token-free durable projection of one signed Slack identity-link intent. */\nexport type SlackUserLinkAccessRequest = {\n  id: string;\n  workspaceId: string;\n  workspaceDisplayName: string | null;\n  subjectLabel: string | null;\n  status: SlackUserLinkAccessRequestStatus;\n  version: number;\n  expiresAt: string;\n  requestedAt: string | null;\n  decidedAt: string | null;\n  completedAt: string | null;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type PrepareSlackUserLinkAccessRequest = {\n  linkToken: string;\n};\n\nexport type SlackUserLinkAccessMutationRequest = {\n  expectedVersion: number;\n  idempotencyKey: string;\n};\n\nexport type ApproveSlackUserLinkAccessRequest = SlackUserLinkAccessMutationRequest & {\n  role?: string | undefined;\n  permissions: Permission[];\n};\n\nexport type ListSlackUserLinkAccessRequestsResponse = {\n  requests: SlackUserLinkAccessRequest[];\n};\n\n// --- Goals -------------------------------------------------------------------\n\nexport type SessionGoalStatus = \"active\" | \"paused\" | \"completed\";\n\nexport type SessionGoalCreatedBy = \"api\" | \"agent\" | \"scheduled_task\";\n\nexport type SessionGoalMutationPolicy =\n  | \"review_changes\"\n  | \"preserve_intent\"\n  | \"autonomous_adaptation\";\n\nexport type SessionGoalChangeKind = \"refinement\" | \"adaptation\" | \"replacement\";\n\nexport type SessionGoalRevision = {\n  id: string;\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  goalId: string;\n  disposition: \"applied\" | \"proposed\" | \"rejected\";\n  changeKind: SessionGoalChangeKind;\n  baseObjectiveRevision: number;\n  resultObjectiveRevision: number | null;\n  text: string;\n  successCriteria: string | null;\n  rootConstraints: string[];\n  mutationPolicy: SessionGoalMutationPolicy;\n  rationale: string;\n  actor: \"agent\" | \"api\" | \"scheduled_task\";\n  actorTurnId: string | null;\n  actorAttemptId: string | null;\n  proposalId: string | null;\n  rollbackOfRevisionId: string | null;\n  createdAt: string;\n};\n\nexport type ApplySessionGoalRevisionRequest = {\n  expectedObjectiveRevision: number;\n  rationale?: string | undefined;\n};\n\nexport type ListSessionGoalRevisionsOptions = {\n  limit?: number | undefined;\n  before?: string | undefined;\n};\n\nexport type ListSessionGoalRevisionsResponse = {\n  revisions: SessionGoalRevision[];\n  hasMore: boolean;\n  nextCursor: string | null;\n};\n\nexport type RejectSessionGoalRevisionRequest = {\n  expectedObjectiveRevision: number;\n  rationale: string;\n};\n\nexport type RejectSessionGoalRevisionResponse = {\n  revision: SessionGoalRevision;\n  replay: boolean;\n};\n\nexport type RollbackSessionGoalRevisionRequest = {\n  expectedObjectiveRevision: number;\n  rationale: string;\n};\n\nexport type SessionGoalContinuationState =\n  | \"inactive\"\n  | \"scheduled\"\n  | \"running\"\n  | \"blocked\"\n  | \"invariant_broken\";\n\nexport type SessionGoalContinuationReason =\n  | \"goal_inactive\"\n  | \"wake_pending\"\n  | \"continuation_pending\"\n  | \"human_work_pending\"\n  | \"goal_turn_running\"\n  | \"human_turn_running\"\n  | \"workstream_paused\"\n  | \"approval_required\"\n  | \"provider_backpressure\"\n  | \"session_cancelled\"\n  | \"system_work_pending\"\n  | \"held_for_input\"\n  | \"backoff_pending\"\n  | \"missing_obligation\";\n\nexport type SessionGoalContinuation = {\n  state: SessionGoalContinuationState;\n  reason: SessionGoalContinuationReason;\n  wakeRevision: number;\n  observedRevision: number;\n  nextAttemptAt: string | null;\n  lastError: string | null;\n  /** Agent-stated reason for a `wait_for_input` hold; null otherwise. */\n  holdReason?: string | null | undefined;\n};\n\nexport type SessionGoal = {\n  id: string;\n  accountId: string;\n  workspaceId: string;\n  sessionId: string;\n  status: SessionGoalStatus;\n  text: string;\n  successCriteria: string | null;\n  rootConstraints: string[];\n  evidence: string | null;\n  rationale: string | null;\n  pausedReason: string | null;\n  createdBy: SessionGoalCreatedBy;\n  version: number;\n  objectiveRevision: number;\n  mutationPolicy: SessionGoalMutationPolicy;\n  autoContinuations: number;\n  noProgressStreak: number;\n  maxAutoContinuations: number | null;\n  metadata: Record<string, unknown>;\n  /** Optional for source compatibility; the API always supplies this projection. */\n  continuation?: SessionGoalContinuation | undefined;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type UpdateSessionGoalRequest =\n  | {\n      status: \"paused\" | \"active\";\n      rationale?: string | undefined;\n    }\n  | {\n      text: string;\n      successCriteria?: string | null | undefined;\n      rootConstraints?: string[] | undefined;\n      mutationPolicy?: SessionGoalMutationPolicy | undefined;\n      rationale: string;\n      expectedObjectiveRevision: number;\n    };\n\nexport type UpdateSessionRequest = {\n  title: string;\n};\n\n/** Replace the complete ordered low-to-high precedence Variable Set selection. */\nexport type UpdateSessionVariableSetsRequest = {\n  variableSetIds: string[];\n};\n\n// --- Operator context controls (/clear, /compact) ----------------------------\n\n/** Outcome of a manual /compact trigger. */\nexport type CompactSessionContextResult = {\n  /** pending waits for the current safe boundary; completed ran while idle. */\n  status: \"pending\" | \"completed\" | \"noop\";\n  message: string;\n};\n\n// --- Turn queue --------------------------------------------------------------\n\nexport type EffectiveControlBlocker = {\n  kind: \"session\" | \"workspace\";\n  sessionId?: string | undefined;\n  displayName: string;\n  actor: string | null;\n  reason: string | null;\n  changedAt: string | null;\n  revision: number;\n};\n\nexport type EffectiveControlResumeOption = {\n  scope: \"selected\" | \"session\" | \"workspace\";\n  targetId?: string | undefined;\n  selectedStateAfter: \"active\" | \"paused\";\n  remainingPrimaryBlocker?: EffectiveControlBlocker | undefined;\n  impactCopy: string;\n};\n\nexport type EffectiveSessionControl = {\n  state: \"active\" | \"paused\";\n  controlVersion: number;\n  controlEtag: string;\n  directState: \"active\" | \"paused\";\n  primaryBlocker: EffectiveControlBlocker | null;\n  additionalBlockerCount: number;\n  blockers: EffectiveControlBlocker[];\n  resumeOptions: EffectiveControlResumeOption[];\n  override: { rootSessionId: string; revision: number } | null;\n  settlement: {\n    state: \"stopping\";\n    attemptCount: number;\n    interruptionPendingCount: number;\n    quiescencePendingCount: number;\n  } | null;\n  backgroundCommandSettlement?: { state: \"stopping\"; commandCount: number } | null | undefined;\n};\n\nexport type SessionCommandReceipt = {\n  id: string;\n  action: string;\n  operationKey: string;\n  targetSessionId: string | null;\n  targetTurnId: string | null;\n  appliedControlRevision: number | null;\n  appliedQueueVersion: number | null;\n  appliedTurnVersion: number | null;\n  appliedDraftRevision: number | null;\n  createdAt: string;\n};\n\nexport type SessionPromptRouting =\n  | \"accepted_for_execution\"\n  | \"queued_for_execution\"\n  | \"accepted_for_steering\";\n\nexport type ComposerDraft = {\n  revision: number;\n  text: string;\n  annotations?: DraftTimelineAnnotation[] | undefined;\n  resources: ResourceRef[];\n  model: string;\n  reasoningEffort: ReasoningEffort;\n  latencyMode: LatencyMode;\n  sourceTurnId: string | null;\n  sourceTurnVersion: number | null;\n  updatedAt: string | null;\n};\n\nexport type NewSessionDraftOptions = {\n  visibility?: SessionVisibility | undefined;\n  sandboxBackend?: SandboxBackend | undefined;\n  targetSandboxId?: string | undefined;\n  workingDir?: string | undefined;\n  variableSetIds?: string[] | undefined;\n  variableSetId?: string | undefined;\n  rigId?: string | undefined;\n  goal?: GoalSpec | undefined;\n  firstPartyMcpPermissions?: Permission[] | undefined;\n  firstPartyMcpTools?: FirstPartyMcpToolName[] | undefined;\n};\n\nexport type NewSessionSelectionHistory = {\n  /** Most-recently used project first. Null channelId is the Default project. */\n  projects: Array<{\n    channelId: string | null;\n    /** Null means the managed sandbox was used most recently in this project. */\n    targetSandboxId: string | null;\n    /** Most-recently used machine in this project first. */\n    machines: Array<{ sandboxId: string; workingDir: string | null }>;\n  }>;\n};\n\nexport type NewSessionDraft = {\n  revision: number;\n  text: string;\n  resources: ResourceRef[];\n  tools: ToolRef[];\n  /** False inherits the workspace-default MCP policy; true preserves an explicit array. */\n  toolsProvided: boolean;\n  model: string;\n  reasoningEffort: ReasoningEffort;\n  latencyMode: LatencyMode;\n  /** Absent on legacy drafts; null records an explicit Default-project selection. */\n  selectedProjectChannelId?: string | null | undefined;\n  options: NewSessionDraftOptions;\n  selectionHistory: NewSessionSelectionHistory;\n  updatedAt: string | null;\n};\n\nexport type SessionQueueSnapshot = {\n  version: number;\n  effectiveControl: EffectiveSessionControl;\n  /** Secret-safe personal MCP summaries frozen on the exact active turn. */\n  activePersonalConnections: McpPersonalConnectionSummary[];\n  /** The latest interrupted attempt has not yet durably proved physical quiescence. */\n  stoppingPreviousAttempt: boolean;\n  items: SessionTurn[];\n  /** Canonical pending machine inputs. Events only invalidate this snapshot. */\n  pendingInputs: SessionPendingInputPreview[];\n  /** Exact next bounded input batch that will join an already-waiting prompt. */\n  pendingInputAttachment: {\n    turnId: string;\n    inputIds: string[];\n  } | null;\n};\n\nexport type SessionPendingInputPreview = Pick<\n  SessionSystemUpdate,\n  \"id\" | \"sessionId\" | \"kind\" | \"classification\" | \"sourceId\" | \"summary\" | \"createdAt\"\n>;\n\nexport type SystemUpdateClassification = \"success\" | \"failure\" | \"action_required\" | \"info\";\n\nexport type SessionSystemUpdateKind =\n  | \"scheduled_occurrence\"\n  | \"goal_continuation\"\n  | \"agent_message\"\n  | \"agent_steer_instruction\"\n  | \"session_wait_timeout\"\n  | \"background_command_result\"\n  | \"child_terminal_result\"\n  | \"media_generation_result\"\n  | \"child_requires_action\"\n  | \"child_requires_action_resolved\"\n  | \"child_paused\"\n  | \"child_waiting_capacity\"\n  | \"child_progress\";\n\nexport type SessionSystemUpdateState =\n  | \"pending\"\n  | \"delivered\"\n  | \"cancelled\"\n  | \"superseded\"\n  | \"failed\";\n\nexport type SessionSystemUpdatePayload =\n  | {\n      type: \"session_wait_timeout\";\n      waitTurnId: string;\n      deadlineAt: string;\n      reason: string;\n      [key: string]: unknown;\n    }\n  | {\n      type: \"background_command_result\";\n      commandId: string;\n      state: \"exited\" | \"lost\";\n      exitCode: number | null;\n      reason: string;\n      outputLocator: {\n        eventType: \"sandbox.command.output.delta\";\n        commandId: string;\n      };\n      [key: string]: unknown;\n    }\n  | ({\n      type: Exclude<SessionSystemUpdateKind, \"session_wait_timeout\" | \"background_command_result\">;\n    } & Record<string, unknown>);\n\nexport type SessionSystemUpdate = {\n  id: string;\n  sessionId: string;\n  kind: SessionSystemUpdateKind;\n  classification: SystemUpdateClassification;\n  sourceId: string;\n  dedupeKey: string;\n  summary: string;\n  payload: SessionSystemUpdatePayload;\n  lineage: Record<string, unknown>;\n  state: SessionSystemUpdateState;\n  deliveredTurnId: string | null;\n  deliveredHistoryItemId: string | null;\n  deliveredAt: string | null;\n  createdAt: string;\n};\n\nexport type SessionControlResponse = {\n  receipt: SessionCommandReceipt;\n  effectiveControl: EffectiveSessionControl;\n  interruptionCount: number;\n  wakeCount: number;\n  cancelledSessionCount: number;\n  cancelledTurnCount: number;\n};\n\nexport type WorkspacePauseTimer = {\n  id: string;\n  action: \"pause\" | \"resume\";\n  dueAt: string;\n  pauseForSeconds: number | null;\n};\nexport type WorkspacePauseTimerRequest = {\n  action: \"set\" | \"cancel\";\n  pauseInSeconds?: number | undefined;\n  pauseForSeconds?: number | null | undefined;\n  clientEventId: string;\n  expectedRevision: number;\n};\n\nexport type WorkspaceInferenceControlResponse = {\n  receipt: SessionCommandReceipt;\n  state: \"active\" | \"paused\";\n  revision: number;\n  interruptionCount: number;\n  wakeCount: number;\n};\n\nexport type WorkspaceControlEvent = {\n  id: string;\n  workspaceId: string;\n  /** Same monotonic value as revision; named sequence for SSE resume cursors. */\n  sequence: number;\n  revision: number;\n  type: \"workspace.control.changed\";\n  scope: \"workspace\" | \"session\";\n  rootSessionId: string | null;\n  action: \"pause\" | \"resume\" | \"timer_set\" | \"timer_cancelled\";\n  automatic: boolean;\n  reason: string | null;\n  actor: string;\n  occurredAt: string;\n  truncation?: {\n    truncated: true;\n    surface:\n      | \"durable_control\"\n      | \"database_guard\"\n      | \"http_projection\"\n      | \"nats_legacy_guard\"\n      | \"sse_legacy_guard\";\n    deliveredBytes: number;\n    fields: Array<{\n      field: \"reason\" | \"actor\";\n      originalBytes: number;\n      deliveredBytes: number;\n      omittedBytes: number;\n    }>;\n    fullEvidence: {\n      available: false;\n      reason: \"not_retained\";\n    };\n  } | null;\n};\n\nexport type SessionQueueMutationResponse = {\n  receipt: SessionCommandReceipt;\n  snapshot: SessionQueueSnapshot;\n  draft?: ComposerDraft;\n};\n\nexport type MoveSessionQueueItemRequest = {\n  clientEventId: string;\n  expectedQueueVersion: number;\n  beforeTurnId: string | null;\n};\n\nexport type EditSessionQueueItemRequest = {\n  clientEventId: string;\n  expectedTurnVersion: number;\n  expectedDraftRevision: number;\n  replaceDraft: boolean;\n};\n\nexport type SteerSessionQueueItemRequest = {\n  clientEventId: string;\n  expectedTurnVersion: number;\n  controlEtag?: string;\n};\n\nexport type DeleteSessionQueueItemRequest = {\n  clientEventId: string;\n  expectedTurnVersion: number;\n  reason?: string;\n};\n\nexport type SaveComposerDraftRequest = Omit<\n  ComposerDraft,\n  \"revision\" | \"sourceTurnId\" | \"sourceTurnVersion\" | \"updatedAt\"\n> & { expectedRevision: number };\n\nexport type SubmitComposerDraftRequest = Omit<SaveComposerDraftRequest, \"expectedRevision\"> & {\n  expectedDraftRevision: number;\n  clientEventId: string;\n  delivery: \"send\" | \"steer\";\n  controlEtag?: string;\n  modelContext?: string;\n  mcpCredentialUpdates?: SessionMcpCredentialUpdateInput[];\n  connectionAuthorities?: McpConnectionAuthoritySelection[];\n  personalResourceAttachment?: PersonalResourceAttachmentIntent;\n};\n\nexport type SubmitComposerDraftResponse = {\n  accepted: SessionEvent;\n  turn: SessionTurn;\n  draft: ComposerDraft;\n  receipt: SessionCommandReceipt;\n  routing: SessionPromptRouting;\n  interruptionCount: number;\n  replay: boolean;\n};\n\nexport type SaveNewSessionDraftRequest = Omit<\n  NewSessionDraft,\n  \"revision\" | \"selectionHistory\" | \"updatedAt\"\n> & {\n  expectedRevision: number;\n};\n\n// --- Scheduled tasks: requests + runs ----------------------------------------\n\n/** Input shape for agent config on create/update (server applies defaults). */\nexport type ScheduledTaskAgentConfigInput = {\n  prompt: string;\n  resources?: ResourceRef[] | undefined;\n  tools?: ToolRef[] | undefined;\n  metadata?: Record<string, unknown> | undefined;\n  slackBotConnectionId?: string | undefined;\n  model?: string | undefined;\n  reasoningEffort?: ReasoningEffort | undefined;\n  sandboxBackend?: SandboxBackend | undefined;\n  machineTarget?: { targetSandboxId: string; workingDir?: string | undefined } | undefined;\n  goal?: GoalSpec | undefined;\n  executionClass?: \"incident_telemetry\" | undefined;\n  incidentTelemetryPreflight?: IncidentTelemetryPreflightInput | undefined;\n  maxNestedAgentDepth?: number | undefined;\n};\n\nexport type CreateAgentScheduledTaskRequest = {\n  name: string;\n  schedule: ScheduledTaskScheduleSpec;\n  action?: { kind: \"agent_turn\" } | undefined;\n  runMode?: ScheduledTaskRunMode | undefined;\n  targetSessionId?: string | null | undefined;\n  connectionAuthorities?: McpConnectionAuthoritySelection[] | undefined;\n  selectedHostMcpDelegations?: CreateSessionRequest[\"selectedHostMcpDelegations\"];\n  overlapPolicy?: ScheduledTaskOverlapPolicy | undefined;\n  agentConfig: ScheduledTaskAgentConfigInput;\n  status?: ScheduledTaskStatus | undefined;\n  variableSetId?: string | null | undefined;\n  /** @deprecated use variableSetId */\n  environmentId?: string | null | undefined;\n  // The rig each run binds to (M3); active version resolved per fire.\n  rigId?: string | null | undefined;\n  metadata?: Record<string, unknown> | undefined;\n};\n\nexport type CreateKnowledgeSourceSyncScheduledTaskRequest = {\n  name: string;\n  schedule: ScheduledTaskScheduleSpec;\n  action: Extract<ScheduledTaskAction, { kind: \"knowledge_source_sync\" }>;\n  overlapPolicy?: \"skip\" | \"buffer_one\" | undefined;\n  status?: ScheduledTaskStatus | undefined;\n  metadata?: Record<string, unknown> | undefined;\n};\n\nexport type CreateScheduledTaskRequest =\n  | CreateAgentScheduledTaskRequest\n  | CreateKnowledgeSourceSyncScheduledTaskRequest;\n\nexport type UpdateScheduledTaskRequest = {\n  name?: string | undefined;\n  schedule?: ScheduledTaskScheduleSpec | undefined;\n  runMode?: ScheduledTaskRunMode | undefined;\n  targetSessionId?: string | null | undefined;\n  connectionAuthorities?: McpConnectionAuthoritySelection[] | undefined;\n  selectedHostMcpDelegations?: CreateSessionRequest[\"selectedHostMcpDelegations\"];\n  overlapPolicy?: ScheduledTaskOverlapPolicy | undefined;\n  action?: ScheduledTaskAction | undefined;\n  agentConfig?: ScheduledTaskAgentConfigInput | undefined;\n  status?: ScheduledTaskStatus | undefined;\n  variableSetId?: string | null | undefined;\n  /** @deprecated use variableSetId */\n  environmentId?: string | null | undefined;\n  // The rig each run binds to (M3); active version resolved per fire.\n  rigId?: string | null | undefined;\n  metadata?: Record<string, unknown> | undefined;\n};\n\nexport type ScheduledTaskRunStatus = \"queued\" | \"dispatched\" | \"succeeded\" | \"skipped\" | \"failed\";\n\nexport type KnowledgeSourceSyncRunSummary = {\n  phase: \"queued\" | \"inventory\" | \"transfer\" | \"index\" | \"checkpoint\" | \"completed\" | \"failed\";\n  scanned: number;\n  imported: number;\n  unchanged: number;\n  skipped: number;\n  failed: number;\n  bytes: number;\n  providerRequests: number;\n  elapsedMs: number;\n  indexed: number;\n  aclPending: number;\n  retryable: boolean;\n  limitReached: \"items\" | \"bytes\" | \"file_bytes\" | \"provider_requests\" | \"elapsed_time\" | null;\n  checkpointed: boolean;\n  reconnectRequired: boolean;\n  failures: Array<{\n    externalObjectId: string;\n    code:\n      | \"authority_changed\"\n      | \"connection_reconnect_required\"\n      | \"provider_unavailable\"\n      | \"provider_rejected\"\n      | \"provider_payload_invalid\"\n      | \"content_unsupported\"\n      | \"content_too_large\"\n      | \"resource_limit\"\n      | \"item_processing_failed\"\n      | \"indexing_failed\"\n      | \"internal_failure\";\n    retryable: boolean;\n    message: string;\n  }>;\n};\n\nexport type ScheduledTaskTriggerType =\n  | \"scheduled\"\n  | \"manual\"\n  | \"initial\"\n  | \"provider_event\"\n  | \"retry\"\n  | \"repair\";\n\nexport type ScheduledTaskRun = {\n  id: string;\n  accountId: string;\n  workspaceId: string;\n  taskId: string;\n  taskAuthorityRevision: number | null;\n  taskExecutionDigest: string | null;\n  status: ScheduledTaskRunStatus;\n  triggerType: ScheduledTaskTriggerType;\n  scheduledAt: string | null;\n  firedAt: string;\n  sessionId: string | null;\n  triggerEventId: string | null;\n  actionKind: \"agent_turn\" | \"knowledge_source_sync\";\n  knowledgeSyncRunId: string | null;\n  knowledgeSummary: KnowledgeSourceSyncRunSummary | null;\n  completedAt: string | null;\n  error: string | null;\n  createdAt: string;\n  updatedAt: string;\n};\n\n// --- VariableSets -------------------------------------------------------------\n\n/** Generic variable-set reads expose name + version metadata only. */\nexport type VariableSetVariableMetadata = {\n  name: string;\n  version: number;\n  createdAt: string;\n  updatedAt: string;\n};\n\n/** Dedicated permissioned plaintext response; never embedded in metadata reads. */\nexport type VariableSetSecret = {\n  variableSetId: string;\n  name: string;\n  version: number;\n  value: string;\n};\n\nexport type VariableSet = {\n  id: string;\n  accountId: string;\n  workspaceId: string;\n  scope: \"organization\" | \"workspace\" | \"user\";\n  generation: number;\n  status: \"active\" | \"revoked\";\n  name: string;\n  description: string | null;\n  variables: VariableSetVariableMetadata[];\n  createdAt: string;\n  updatedAt: string;\n};\n\n/** Exact-ID attachment metadata; intentionally excludes catalog and secret metadata. */\nexport type VariableSetAttachmentMetadata = {\n  id: string;\n  scope: \"organization\" | \"workspace\" | \"user\";\n};\n\nexport type ResolveVariableSetAttachmentsRequest = {\n  variableSetIds: string[];\n};\n\nexport type ResolveVariableSetAttachmentsResponse = {\n  variableSets: VariableSetAttachmentMetadata[];\n};\n\n/** @deprecated use VariableSetVariableMetadata */\nexport type WorkspaceEnvironmentVariableMetadata = VariableSetVariableMetadata;\n\n/** @deprecated use VariableSet */\nexport type WorkspaceEnvironment = VariableSet;\n\nexport type CreateVariableSetRequest = {\n  /** Omitted remains the legacy workspace-owned path. */\n  scope?: \"organization\" | \"workspace\" | \"user\" | undefined;\n  name: string;\n  description?: string | undefined;\n  /** Initial variables. Values are write-only: they never come back on reads. */\n  variables?: { name: string; value: string }[] | undefined;\n};\n\n/** @deprecated use CreateVariableSetRequest */\nexport type CreateWorkspaceEnvironmentRequest = CreateVariableSetRequest;\n\nexport type UpdateVariableSetRequest = {\n  name?: string | undefined;\n  description?: string | null | undefined;\n};\n\n/** @deprecated use UpdateVariableSetRequest */\nexport type UpdateWorkspaceEnvironmentRequest = UpdateVariableSetRequest;\n\nexport type SetVariableSetVariableRequest = {\n  value: string;\n};\n\n/** @deprecated use SetVariableSetVariableRequest */\nexport type SetWorkspaceEnvironmentVariableRequest = SetVariableSetVariableRequest;\n\n// --- Rigs ---------------------------------------------------------------------\n// Workspace-scoped, versioned sandbox machine definitions. Versions are\n// append-only and content-immutable; exactly one is active per rig.\n\nexport type RigCheck = {\n  name: string;\n  command: string;\n};\n\nexport type RigProviderImageBuildStatus = \"building\" | \"ready\" | \"failed\" | \"unsupported\";\n\nexport type RigProviderImage = {\n  backend: SandboxBackend;\n  provider: string;\n  status: RigProviderImageBuildStatus;\n  contentHash: string;\n  setupHash: string;\n  sourceImage: string | null;\n  buildRequestId: string;\n  imageId: string | null;\n  imageDigest: string | null;\n  artifactId: string | null;\n  providerBindingKeyHash: string | null;\n  coldBootValidation?:\n    | {\n        version: 1;\n        checkedAt: string;\n      }\n    | undefined;\n  provenance: {\n    kind: \"rig_verification\";\n    targetKind: \"change\" | \"version\";\n    targetId: string;\n  };\n  startedAt: string;\n  finishedAt: string | null;\n  error: {\n    code: string;\n    message: string;\n    retryable: boolean;\n  } | null;\n};\n\nexport type RigVersion = {\n  id: string;\n  rigId: string;\n  version: number;\n  image: string | null;\n  setupScript: string | null;\n  checks: RigCheck[];\n  credentialHooks: string[];\n  defaultVariableSetIds: string[];\n  changelog: string | null;\n  providerImages: Partial<Record<SandboxBackend, RigProviderImage>>;\n  createdBy: string | null;\n  active: boolean;\n  createdAt: string;\n};\n\nexport type RigVerificationHealth = {\n  checkHealth: \"passing\" | \"failing\" | \"unknown\";\n  lastVerifiedAt: string | null;\n};\n\n/**\n * Workspace-shared channel organizing root sessions (\"workstreams\") by work\n * type in the rail. Pure organizational metadata.\n */\nexport type Channel = {\n  id: string;\n  accountId: string;\n  workspaceId: string;\n  name: string;\n  description: string | null;\n  pinned: boolean;\n  sortOrder: number;\n  createdBy: string | null;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type CreateChannelRequest = {\n  name: string;\n  description?: string;\n};\n\nexport type UpdateChannelRequest = {\n  name?: string;\n  description?: string | null;\n  pinned?: boolean;\n};\n\n/** Complete workspace project order. It is replaced atomically after a drag. */\nexport type ReorderChannelsRequest = {\n  channelIds: string[];\n};\n\n/** Re-files one session; null moves it back to the unfiled inbox. */\nexport type UpdateSessionChannelRequest = {\n  channelId: string | null;\n};\n\nexport type Rig = {\n  id: string;\n  accountId: string;\n  workspaceId: string;\n  scope: ResourceAuthorityScope;\n  generation: number;\n  status: \"active\" | \"revoked\";\n  name: string;\n  description: string | null;\n  createdBy: string | null;\n  activeVersion: RigVersion | null;\n  activeVersionHealth?: RigVerificationHealth | null;\n  versionCount: number;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type RigChangeKind = \"setup_append\" | \"definition_edit\";\n\nexport type RigChangeStatus = \"proposed\" | \"verifying\" | \"merged\" | \"rejected\" | \"failed\";\n\nexport type RigCheckResult = {\n  name: string;\n  command: string;\n  exitCode: number | null;\n  output?: string | undefined;\n};\n\nexport type RigChangeVerification = {\n  startedAt?: string | undefined;\n  finishedAt?: string | undefined;\n  log?: string | undefined;\n  platformCheckResults?: RigCheckResult[] | undefined;\n  checkResults?: RigCheckResult[] | undefined;\n  [key: string]: unknown;\n};\n\nexport type RigChange = {\n  id: string;\n  rigId: string;\n  baseVersionId: string | null;\n  kind: RigChangeKind;\n  payload: Record<string, unknown>;\n  status: RigChangeStatus;\n  proposedBy: string | null;\n  verification: RigChangeVerification | null;\n  resultVersionId: string | null;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type CreateRigRequest = {\n  scope?: ResourceAuthorityScope;\n  name: string;\n  description?: string | undefined;\n  image?: never;\n  setupScript?: string | undefined;\n  checks?: RigCheck[] | undefined;\n  credentialHooks?: string[] | undefined;\n  defaultVariableSetIds?: string[] | undefined;\n};\n\nexport type UpdateRigRequest = {\n  name?: string | undefined;\n  description?: string | null | undefined;\n};\n\nexport type RigSetupAppendPayload = {\n  command: string;\n  note?: string | undefined;\n};\n\nexport type RigDefinitionEditPayload = {\n  image?: never;\n  setupScript?: string | null | undefined;\n  checks?: RigCheck[] | undefined;\n  credentialHooks?: string[] | undefined;\n  defaultVariableSetIds?: string[] | undefined;\n  changelog?: string | null | undefined;\n};\n\nexport type ProposeRigChangeRequest =\n  | { kind: \"setup_append\"; payload: RigSetupAppendPayload }\n  | { kind: \"definition_edit\"; payload: RigDefinitionEditPayload };\n\n// --- Files ---------------------------------------------------------------------\n\nexport type FileStatus = \"pending_upload\" | \"ready\" | \"failed\" | \"expired\" | \"deleted\";\n\nexport type FileAsset = {\n  id: string;\n  workspaceId: string;\n  status: FileStatus;\n  filename: string;\n  safeFilename: string;\n  contentType: string;\n  sizeBytes: number;\n  sha256: string | null;\n  bucket: string;\n  objectKey: string;\n  createdAt: string;\n  updatedAt: string;\n};\n\n/** Mirrors the closed, provider-neutral retained-output contract. */\nexport const RETAINED_OUTPUT_DEFAULT_PAGE_BYTES = 256 * 1024;\nexport const RETAINED_OUTPUT_MAX_PAGE_BYTES = 1024 * 1024;\nexport const COMPUTER_SCREENSHOT_MAX_BYTES = 32 * 1024 * 1024;\nexport const GENERATED_IMAGE_MAX_BYTES = 64 * 1024 * 1024;\nexport const GENERATED_VIDEO_MAX_BYTES = 512 * 1024 * 1024;\n\nexport type RetainedOutputKind =\n  | \"tool_result\"\n  | \"assistant_completion\"\n  | \"internal_update\"\n  | \"event_media\"\n  | \"computer_screenshot\"\n  | \"generated_image\"\n  | \"generated_video\"\n  | \"file\";\n\nexport type RetainedOutputUnavailableReason =\n  | \"not_retained\"\n  | \"pending\"\n  | \"failed\"\n  | \"expired\"\n  | \"deleted\"\n  | \"missing_storage\"\n  | \"storage_write_failed\"\n  | \"quota_exceeded\"\n  | \"invalid_content\"\n  | \"oversized\"\n  | \"unsupported\";\n\nexport type RetainedArtifactReference = {\n  available: true;\n  artifactId: string;\n  kind: RetainedOutputKind;\n  contentType: string;\n  originalBytes: number;\n  sha256: string;\n  retainedAt: string;\n  dimensions?: { width: number; height: number } | undefined;\n  retention:\n    | { policy: \"workspace_file\"; expiresAt: null }\n    | { policy: \"session_screenshot\"; expiresAt: string };\n  retrieval: {\n    method: \"GET\";\n    path: string;\n    acceptRanges: \"bytes\";\n    maxRangeBytes: number;\n  };\n};\n\nexport type RetainedArtifactUnavailable = {\n  available: false;\n  artifactId: string;\n  reason: RetainedOutputUnavailableReason;\n};\n\nexport type RetainedArtifactMetadata = RetainedArtifactReference | RetainedArtifactUnavailable;\n\nexport type GeneratedImageReceipt = {\n  type: \"generated_image\";\n  artifact: RetainedArtifactReference;\n  sandboxPath: string;\n};\n\nexport type VideoGenerationSourceMode =\n  | \"text\"\n  | \"first_frame\"\n  | \"first_and_last_frames\"\n  | \"image_reference\"\n  | \"video_reference\";\n\nexport type VideoGenerationResolution = \"480p\" | \"720p\";\n\nexport type VideoGenerationAspectRatio =\n  | \"16:9\"\n  | \"4:3\"\n  | \"1:1\"\n  | \"3:4\"\n  | \"9:16\"\n  | \"21:9\"\n  | \"adaptive\";\n\nexport type VideoGenerationModelCapability = {\n  modelId: string;\n  label: string;\n  providerLabel: string;\n  sourceModes: VideoGenerationSourceMode[];\n  resolutions: VideoGenerationResolution[];\n  aspectRatios: VideoGenerationAspectRatio[];\n  duration: {\n    minSeconds: number;\n    maxSeconds: number;\n    stepSeconds: number;\n  };\n  supportsAudio: boolean;\n};\n\nexport type VideoGenerationCapabilities = {\n  schemaVersion: 1;\n  capabilityRevision: string;\n  defaultModelId: string;\n  models: VideoGenerationModelCapability[];\n};\n\nexport type VideoGenerationPolicy = {\n  schemaVersion: 1;\n  revision: number;\n  fundingSource: VideoGenerationFundingSource;\n  enabledModelIds: string[];\n  defaultModelId: string | null;\n};\n\nexport type UpdateVideoGenerationPolicyRequest = {\n  expectedRevision: number;\n  fundingSource: VideoGenerationFundingSource;\n  enabledModelIds: string[];\n  defaultModelId: string | null;\n};\n\nexport type VideoGenerationFundingSource =\n  | \"opengeni_credits\"\n  | \"workspace_gateway\"\n  | \"supergrok_subscription\";\n\nexport type VideoGenerationFundingOption = {\n  source: VideoGenerationFundingSource;\n  label: string;\n  description: string;\n  available: boolean;\n  unavailableReason: string | null;\n};\n\nexport type WorkspaceVideoGenerationSettings = {\n  schemaVersion: 1;\n  policy: VideoGenerationPolicy;\n  fundingOptions: VideoGenerationFundingOption[];\n  availableModels: VideoGenerationModelCapability[];\n  capabilities: VideoGenerationCapabilities | null;\n};\n\nexport type GeneratedVideoFacts = {\n  durationSeconds: number;\n  width: number;\n  height: number;\n  fps: number;\n  hasAudio: boolean;\n  videoCodec: \"h264\";\n  audioCodec: \"aac\" | null;\n};\n\nexport type GeneratedVideoReceipt = {\n  type: \"generated_video\";\n  schemaVersion: 1;\n  operationId: string;\n  artifact: RetainedArtifactReference;\n  video: GeneratedVideoFacts;\n  sandboxPath: string;\n};\n\nexport type VideoGenerationTerminalFailureStatus =\n  | \"provider_failed\"\n  | \"retention_failed\"\n  | \"cancelled_before_submit\"\n  | \"outcome_unknown\";\n\nexport type MediaGenerationResult =\n  | {\n      type: \"media_generation_result\";\n      schemaVersion: 1;\n      status: \"ready\";\n      operationId: string;\n      receipt: GeneratedVideoReceipt;\n    }\n  | {\n      type: \"media_generation_result\";\n      schemaVersion: 1;\n      status: VideoGenerationTerminalFailureStatus;\n      operationId: string;\n      boundedPublicReason: string;\n    };\n\nexport type VideoGenerationPublicStatus =\n  | \"preparing\"\n  | \"prepared\"\n  | \"accepted\"\n  | \"provider_started\"\n  | \"retaining\"\n  | \"completed\"\n  | VideoGenerationTerminalFailureStatus;\n\nexport type VideoGenerationOperationSummary = {\n  schemaVersion: 1;\n  operationId: string;\n  modelId: string;\n  status: VideoGenerationPublicStatus;\n  createdAt: string;\n  updatedAt: string;\n  terminal: MediaGenerationResult | null;\n};\n\n/** Ephemeral source minted for native browser playback; never persist the URL. */\nexport type VideoArtifactPlaybackSource = {\n  schemaVersion: 1;\n  artifactId: string;\n  url: string;\n  expiresAt: string;\n  contentType: \"video/mp4\";\n  sizeBytes: number;\n  sha256: string;\n  acceptRanges: \"bytes\";\n};\n\nexport type RetainedArtifactContentOptions = {\n  /** One RFC-style bytes range, for example `bytes=1048576-2097151`. */\n  range?: string | undefined;\n  signal?: AbortSignal | undefined;\n};\n\nexport type RetainedArtifactContent = {\n  bytes: Uint8Array;\n  status: 200 | 206;\n  contentType: string;\n  contentLength: number;\n  contentRange: string | null;\n  acceptRanges: \"bytes\";\n};\n\nexport type RetainedArtifactDownloadOptions = {\n  signal?: AbortSignal | undefined;\n  /** Retry transient range failures; bounded to 0..3, default 2. */\n  maxRetries?: number | undefined;\n};\n\nexport type RetainedScreenshotDownloadOptions = RetainedArtifactDownloadOptions;\n\nexport type RetainedScreenshotDownload = {\n  metadata: RetainedArtifactMetadata;\n  /** Null when metadata truth says the screenshot is unavailable. */\n  bytes: Uint8Array | null;\n};\n\nexport type RetainedArtifactDownload = {\n  artifact: RetainedArtifactReference;\n  bytes: Uint8Array;\n};\n\nexport type CreateFileUploadRequest = {\n  filename: string;\n  contentType: string;\n  sizeBytes: number;\n  sha256?: string | undefined;\n};\n\nexport type CreateFileUploadResponse = {\n  fileId: string;\n  uploadId: string;\n  /** Pre-signed PUT URL for the file bytes (direct to object storage). */\n  putUrl: string;\n  /** Headers that MUST be sent with the PUT for the signature to validate. */\n  requiredHeaders: Record<string, string>;\n  expiresAt: string;\n  maxSizeBytes: number;\n};\n\nexport type CompleteFileUploadResponse = {\n  file: FileAsset;\n};\n\nexport type FileDownloadUrlResponse = {\n  url: string;\n  expiresAt: string;\n};\n\n/** Bytes accepted by the `uploadFile` helper. */\nexport type FileUploadData = Blob | ArrayBuffer | Uint8Array | string;\n\nexport type UploadFileInput = {\n  filename: string;\n  contentType: string;\n  data: FileUploadData;\n  sha256?: string | undefined;\n  /** Optional deadline for the signed object-storage PUT. */\n  timeoutMs?: number | undefined;\n};\n\n// --- Documents -------------------------------------------------------------------\n\nexport type DocumentStatus = \"queued\" | \"indexing\" | \"ready\" | \"failed\";\nexport type KnowledgeSourceKind =\n  | \"manual_upload\"\n  | \"meeting_transcript\"\n  | \"repository\"\n  | \"email\"\n  | \"chat\"\n  | \"document\"\n  | \"web\"\n  | \"other\";\nexport type DocumentSearchMode = \"hybrid\" | \"vector\" | \"keyword\";\n\nexport type DocumentAuthorityKind = \"organization\" | \"workspace\" | \"personal\";\n\nexport type DocumentVisibility = \"workspace\" | \"private\";\n\nexport type DocumentCurationStatus = \"none\" | \"pending\" | \"suggested\" | \"auto_filed\" | \"failed\";\n\nexport type DocumentCuration = {\n  suggestedBaseId: string | null;\n  suggestedBaseName: string | null;\n  confidence: number;\n  reason: string | null;\n  originalTitle: string | null;\n  model: string | null;\n};\n\nexport type DocumentBase = {\n  id: string;\n  workspaceId: string;\n  name: string;\n  description: string | null;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type Document = {\n  id: string;\n  workspaceId: string;\n  baseId: string;\n  fileId: string;\n  status: DocumentStatus;\n  title: string;\n  parser: string;\n  chunkCount: number;\n  error: string | null;\n  sourceKind: KnowledgeSourceKind;\n  sourceUri: string | null;\n  sourceExternalId: string | null;\n  sourceTitle: string | null;\n  sourceAuthor: string | null;\n  sourceCreatedAt: string | null;\n  sourceUpdatedAt: string | null;\n  sourceVersion: string | null;\n  aclTags: string[];\n  authorityKind: DocumentAuthorityKind;\n  authorityWorkspaceId: string | null;\n  authoritySubjectId: string | null;\n  authorityId?: string | null | undefined;\n  visibility: DocumentVisibility;\n  createdBy: string | null;\n  agentAccess: boolean;\n  summary: string | null;\n  topics: string[];\n  curationStatus: DocumentCurationStatus;\n  curation: DocumentCuration | null;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type DocumentSearchResult = {\n  chunkId: string;\n  workspaceId: string;\n  documentId: string;\n  baseId: string;\n  fileId: string;\n  title: string;\n  text: string;\n  score: number;\n  matchType: DocumentSearchMode;\n  vectorScore: number | null;\n  keywordScore: number | null;\n  chunkIndex: number;\n  metadata: Record<string, unknown>;\n  sourceKind: KnowledgeSourceKind;\n  sourceUri: string | null;\n  sourceExternalId: string | null;\n  sourceTitle: string | null;\n  sourceAuthor: string | null;\n  sourceCreatedAt: string | null;\n  sourceUpdatedAt: string | null;\n  sourceVersion: string | null;\n  aclTags: string[];\n  authorityKind: DocumentAuthorityKind;\n  authorityWorkspaceId: string | null;\n  authoritySubjectId: string | null;\n};\n\nexport type CreateDocumentBaseRequest = {\n  name: string;\n  description?: string | undefined;\n};\n\nexport type AddDocumentRequest = {\n  fileId: string;\n  title?: string | undefined;\n  sourceKind?: KnowledgeSourceKind | undefined;\n  sourceUri?: string | undefined;\n  sourceExternalId?: string | undefined;\n  sourceTitle?: string | undefined;\n  sourceAuthor?: string | undefined;\n  sourceCreatedAt?: string | undefined;\n  sourceUpdatedAt?: string | undefined;\n  sourceVersion?: string | undefined;\n  aclTags?: string[] | undefined;\n  authorityKind?: DocumentAuthorityKind | undefined;\n  visibility?: DocumentVisibility | undefined;\n  agentAccess?: boolean | undefined;\n};\n\nexport type CreateKnowledgeDropRequest = {\n  text?: string | undefined;\n  fileId?: string | undefined;\n  filename?: string | undefined;\n  title?: string | undefined;\n  authorityKind?: DocumentAuthorityKind | undefined;\n  visibility?: DocumentVisibility | undefined;\n  agentAccess?: boolean | undefined;\n};\n\nexport type MoveDocumentRequest = {\n  targetBaseId?: string | undefined;\n};\n\nexport type DocumentAuthorityTuple = {\n  kind: DocumentAuthorityKind;\n  workspaceId: string | null;\n  subjectId: string | null;\n  authorityId: string | null;\n};\n\nexport type ReclassifyDocumentAuthorityRequest = {\n  operationId: string;\n  expectedAuthority: DocumentAuthorityTuple;\n  targetAuthorityKind: DocumentAuthorityKind;\n};\n\nexport type DocumentAuthorityReclassification = {\n  operationId: string;\n  documentId: string;\n  previousAuthority: DocumentAuthorityTuple;\n  authority: DocumentAuthorityTuple;\n  createdAt: string;\n};\n\nexport type ListDocumentAuthorityReclassificationsOptions = {\n  limit?: number | undefined;\n  cursor?: string | undefined;\n};\n\nexport type ListDocumentAuthorityReclassificationsResponse = {\n  receipts: DocumentAuthorityReclassification[];\n  hasMore: boolean;\n  nextCursor: string | null;\n};\n\nexport type RunDocumentDefaultCollectionBackfillRequest = {\n  runId: string;\n  operationId: string;\n  batchSize?: number | undefined;\n};\n\nexport type DocumentDefaultCollectionBackfill = {\n  runId: string;\n  operationId: string;\n  status: \"running\" | \"completed\";\n  lastWorkspaceId: string | null;\n  processedCount: number;\n  createdCount: number;\n  adoptedCount: number;\n  completedAt: string | null;\n};\n\nexport type DocumentDefaultCollectionBackfillRunAudit = Omit<\n  DocumentDefaultCollectionBackfill,\n  \"operationId\"\n> & {\n  actorSubjectId: string;\n  startedAt: string;\n  updatedAt: string;\n};\n\nexport type DocumentDefaultCollectionBackfillOperationAudit = {\n  operationId: string;\n  result: DocumentDefaultCollectionBackfill;\n  createdAt: string;\n};\n\nexport type DocumentDefaultCollectionBackfillReceiptAudit = {\n  workspaceId: string;\n  baseId: string;\n  outcome: \"created\" | \"adopted\";\n  createdAt: string;\n};\n\nexport type ListDocumentDefaultCollectionBackfillRunsResponse = {\n  runs: DocumentDefaultCollectionBackfillRunAudit[];\n  hasMore: boolean;\n  nextCursor: string | null;\n};\n\nexport type DocumentDefaultCollectionBackfillAudit = {\n  run: DocumentDefaultCollectionBackfillRunAudit;\n  operations: DocumentDefaultCollectionBackfillOperationAudit[];\n  receipts: DocumentDefaultCollectionBackfillReceiptAudit[];\n  operationsHasMore: boolean;\n  operationsNextCursor: string | null;\n  receiptsHasMore: boolean;\n  receiptsNextCursor: string | null;\n};\n\nexport type GetDocumentDefaultCollectionBackfillAuditOptions = {\n  limit?: number | undefined;\n  operationCursor?: string | undefined;\n  receiptCursor?: string | undefined;\n};\n\nexport type OrganizationDocumentAuthorityReclassification = DocumentAuthorityReclassification & {\n  actorSubjectId: string;\n  requestWorkspaceId: string;\n};\n\nexport type ListOrganizationDocumentAuthorityReclassificationsResponse = {\n  receipts: OrganizationDocumentAuthorityReclassification[];\n  hasMore: boolean;\n  nextCursor: string | null;\n};\n\nexport type DocumentSearchRequest = {\n  query: string;\n  baseIds?: string[] | undefined;\n  mode?: DocumentSearchMode | undefined;\n  sourceKinds?: KnowledgeSourceKind[] | undefined;\n  authorityKinds?: DocumentAuthorityKind[] | undefined;\n  aclTags?: string[] | undefined;\n  limit?: number | undefined;\n};\n\nexport type DocumentSearchResponse = {\n  results: DocumentSearchResult[];\n};\n\nexport type KnowledgeMemoryStatus =\n  | \"proposed\"\n  | \"approved\"\n  | \"rejected\"\n  | \"active\"\n  | \"superseded\"\n  | \"archived\";\nexport type KnowledgeMemoryKind =\n  | \"semantic\"\n  | \"episodic\"\n  | \"procedural\"\n  | \"decision\"\n  | \"preference\";\n\nexport type KnowledgeSourceRef = {\n  kind: \"document_chunk\" | \"document\" | \"session_event\" | \"memory\" | \"external\";\n  id: string;\n  uri?: string | undefined;\n  title?: string | undefined;\n  metadata?: Record<string, unknown> | undefined;\n};\n\nexport type KnowledgeMemory = {\n  id: string;\n  workspaceId: string;\n  status: KnowledgeMemoryStatus;\n  kind: KnowledgeMemoryKind;\n  scope: string;\n  text: string;\n  sourceRefs: KnowledgeSourceRef[];\n  confidence: number;\n  metadata: Record<string, unknown>;\n  createdBySessionId: string | null;\n  reviewedBy: string | null;\n  reviewedAt: string | null;\n  pinned: boolean;\n  usageCount: number;\n  lastUsedAt: string | null;\n  supersedesId: string | null;\n  supersededById: string | null;\n  validFrom: string;\n  validUntil: string | null;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type CreateKnowledgeMemoryRequest = {\n  status?: KnowledgeMemoryStatus | undefined;\n  kind?: KnowledgeMemoryKind | undefined;\n  scope?: string | undefined;\n  text: string;\n  sourceRefs?: KnowledgeSourceRef[] | undefined;\n  confidence?: number | undefined;\n  metadata?: Record<string, unknown> | undefined;\n  createdBySessionId?: string | undefined;\n  pinned?: boolean | undefined;\n  replacesId?: string | undefined;\n};\n\nexport type UpdateKnowledgeMemoryRequest = {\n  status?: KnowledgeMemoryStatus | undefined;\n  kind?: KnowledgeMemoryKind | undefined;\n  scope?: string | undefined;\n  text?: string | undefined;\n  sourceRefs?: KnowledgeSourceRef[] | undefined;\n  confidence?: number | undefined;\n  metadata?: Record<string, unknown> | undefined;\n  reviewedBy?: string | undefined;\n  pinned?: boolean | undefined;\n};\n\nexport type KnowledgeMemorySearchRequest = {\n  query?: string | undefined;\n  status?: KnowledgeMemoryStatus | undefined;\n  kind?: KnowledgeMemoryKind | undefined;\n  scope?: string | undefined;\n  limit?: number | undefined;\n};\n\nexport type WorkspaceMemorySearchMode = \"hybrid\" | \"vector\" | \"keyword\";\n\nexport type WorkspaceMemorySearchRequest = {\n  query: string;\n  kind?: KnowledgeMemoryKind | undefined;\n  limit?: number | undefined;\n  mode?: WorkspaceMemorySearchMode | undefined;\n};\n\nexport type WorkspaceMemorySearchResult = {\n  memory: KnowledgeMemory;\n  score: number;\n  matchType: WorkspaceMemorySearchMode;\n  vectorScore: number | null;\n  keywordScore: number | null;\n};\n\nexport type WorkspaceMemorySearchResponse = {\n  results: WorkspaceMemorySearchResult[];\n};\n\n// --- Capability packs ---------------------------------------------------------\n\nexport type CapabilityPackConnectorAuthModel =\n  | \"oauth2_authorization_code_pkce\"\n  | \"oauth2_authorization_code\"\n  | \"api_key\"\n  | \"credential_ref\";\n\nexport type CapabilityPackConnector = {\n  id: string;\n  name: string;\n  category: string;\n  authModel: CapabilityPackConnectorAuthModel;\n  providers: string[];\n  scopes: string[];\n  required: boolean;\n  metadata: Record<string, unknown>;\n};\n\nexport type CapabilityPackKnowledge = {\n  type: \"document_base\";\n  id: string;\n  name: string;\n  description: string | null;\n  required: boolean;\n};\n\nexport type CapabilityPackScheduledTaskTemplate = {\n  id: string;\n  name: string;\n  description: string;\n  defaultSchedule: ScheduledTaskScheduleSpec;\n  defaultRunMode: ScheduledTaskRunMode;\n  defaultOverlapPolicy: ScheduledTaskOverlapPolicy;\n  prompt?: string | undefined;\n};\n\nexport type CapabilityPackAutomationTemplate = {\n  id: string;\n  name: string;\n  description: string;\n  adapterId: string;\n  eventTypes: string[];\n  sessionTemplate: {\n    bundledSkillIds?: BundledSkillId[] | undefined;\n    prompt: string;\n    instructions: string | null;\n    resources: ResourceRef[];\n    skills: CapabilityPackSkill[];\n    tools: ToolRef[];\n    firstPartyMcpTools: string[];\n    firstPartyMcpPermissions: Permission[];\n    model: string | null;\n    reasoningEffort: ReasoningEffort | null;\n    sandboxBackend: SandboxBackend | null;\n    policyRole: string | null;\n    metadata: Record<string, unknown>;\n  };\n  configuration: Record<string, unknown>;\n  connectionRequirement: string | null;\n};\n\nexport type CapabilityPackSkillFile = {\n  path: string;\n  content: string;\n};\n\nexport type CapabilityPackSkill = {\n  name: string;\n  description?: string | undefined;\n  /** Omitted means workspace-wide; session_selected requires explicit session attachment. */\n  activationMode?: \"workspace_managed\" | \"session_selected\" | undefined;\n  files: CapabilityPackSkillFile[];\n};\n\nexport type SessionSkill = Omit<CapabilityPackSkill, \"activationMode\">;\n/** SKILL.md owns metadata; supplied legacy fields must exactly match it. */\nexport type CapabilityPackSkillInput = Omit<CapabilityPackSkill, \"name\" | \"description\"> & {\n  name?: string | undefined;\n  description?: string | undefined;\n};\nexport type SessionSkillInput = Omit<CapabilityPackSkillInput, \"activationMode\">;\n\nexport type CapabilityPackVariableSetSpec = {\n  description: string;\n  requiredVariables: string[];\n  required: boolean;\n};\n\nexport type CapabilityPackComponentReference =\n  | {\n      key: string;\n      kind: \"plugin\";\n      pluginKey: string;\n      version: string;\n      manifestDigest: string;\n      required: boolean;\n    }\n  | {\n      key: string;\n      kind: \"skill\";\n      capabilityId: string;\n      contentSha256: string;\n      required: boolean;\n    }\n  | {\n      key: string;\n      kind: \"integration\";\n      capabilityId: string;\n      instanceKey: string;\n      revisionId: string;\n      contentSha256: string;\n      required: boolean;\n    }\n  | {\n      key: string;\n      kind: \"facet\";\n      capabilityId: string;\n      instanceKey: string;\n      facetKey: string;\n      bindingKey: string;\n      configDigest: string;\n      required: boolean;\n    };\n\nexport type CapabilityPackRigRequirement = {\n  description?: string | undefined;\n  required: boolean;\n  rigId?: string | undefined;\n  requireVerified: boolean;\n};\n\nexport type CapabilityPack = {\n  id: string;\n  name: string;\n  description: string;\n  role: string;\n  category: string;\n  version: string;\n  sandboxImage?: string | undefined;\n  sandboxProviderImages?:\n    | {\n        modal?: { imageId: string } | undefined;\n      }\n    | undefined;\n  skills: CapabilityPackSkill[];\n  components: CapabilityPackComponentReference[];\n  rig?: CapabilityPackRigRequirement | undefined;\n  tools: ToolRef[];\n  connectors: CapabilityPackConnector[];\n  knowledge: CapabilityPackKnowledge[];\n  scheduledTaskTemplates: CapabilityPackScheduledTaskTemplate[];\n  automationTemplates?: CapabilityPackAutomationTemplate[] | undefined;\n  variableSet?: CapabilityPackVariableSetSpec | undefined;\n  metadata: Record<string, unknown>;\n};\n\n/** Input shape for registering a pack manifest (server applies defaults). */\nexport type RegisterCapabilityPackRequest = {\n  id: string;\n  name: string;\n  description: string;\n  role: string;\n  category: string;\n  version: string;\n  sandboxImage?: string | undefined;\n  sandboxProviderImages?:\n    | {\n        modal?: { imageId: string } | undefined;\n      }\n    | undefined;\n  skills?:\n    | {\n        name?: string | undefined;\n        description?: string | undefined;\n        activationMode?: \"workspace_managed\" | \"session_selected\" | undefined;\n        files: CapabilityPackSkillFile[];\n      }[]\n    | undefined;\n  components?:\n    | (\n        | {\n            key: string;\n            kind: \"plugin\";\n            pluginKey: string;\n            version: string;\n            manifestDigest: string;\n            required?: boolean | undefined;\n          }\n        | {\n            key: string;\n            kind: \"skill\";\n            capabilityId: string;\n            contentSha256: string;\n            required?: boolean | undefined;\n          }\n        | {\n            key: string;\n            kind: \"integration\";\n            capabilityId: string;\n            instanceKey: string;\n            revisionId: string;\n            contentSha256: string;\n            required?: boolean | undefined;\n          }\n        | {\n            key: string;\n            kind: \"facet\";\n            capabilityId: string;\n            instanceKey: string;\n            facetKey: string;\n            bindingKey: string;\n            configDigest: string;\n            required?: boolean | undefined;\n          }\n      )[]\n    | undefined;\n  rig?:\n    | {\n        description?: string | undefined;\n        required?: boolean | undefined;\n        rigId?: string | undefined;\n        requireVerified?: boolean | undefined;\n      }\n    | undefined;\n  tools?: ToolRef[] | undefined;\n  connectors?:\n    | {\n        id: string;\n        name: string;\n        category: string;\n        authModel: CapabilityPackConnectorAuthModel;\n        providers?: string[] | undefined;\n        scopes?: string[] | undefined;\n        required?: boolean | undefined;\n        metadata?: Record<string, unknown> | undefined;\n      }[]\n    | undefined;\n  knowledge?:\n    | {\n        type: \"document_base\";\n        id: string;\n        name: string;\n        description?: string | null | undefined;\n        required?: boolean | undefined;\n      }[]\n    | undefined;\n  scheduledTaskTemplates?:\n    | {\n        id: string;\n        name: string;\n        description: string;\n        defaultSchedule: ScheduledTaskScheduleSpec;\n        defaultRunMode?: ScheduledTaskRunMode | undefined;\n        defaultOverlapPolicy?: ScheduledTaskOverlapPolicy | undefined;\n        prompt?: string | undefined;\n      }[]\n    | undefined;\n  automationTemplates?:\n    | {\n        id: string;\n        name: string;\n        description: string;\n        adapterId: string;\n        eventTypes: string[];\n        sessionTemplate: {\n          bundledSkillIds?: BundledSkillId[] | undefined;\n          prompt: string;\n          instructions?: string | null | undefined;\n          resources?: ResourceRef[] | undefined;\n          skills?: CapabilityPackSkill[] | undefined;\n          tools?: ToolRef[] | undefined;\n          firstPartyMcpTools?: string[] | undefined;\n          firstPartyMcpPermissions?: Permission[] | undefined;\n          model?: string | null | undefined;\n          reasoningEffort?: ReasoningEffort | null | undefined;\n          sandboxBackend?: SandboxBackend | null | undefined;\n          policyRole?: string | null | undefined;\n          metadata?: Record<string, unknown> | undefined;\n        };\n        configuration?: Record<string, unknown> | undefined;\n        connectionRequirement?: string | null | undefined;\n      }[]\n    | undefined;\n  variableSet?:\n    | {\n        description: string;\n        requiredVariables?: string[] | undefined;\n        required?: boolean | undefined;\n      }\n    | undefined;\n  metadata?: Record<string, unknown> | undefined;\n};\n\nexport type WorkspaceRegisteredPack = {\n  accountId: string;\n  workspaceId: string;\n  pack: CapabilityPack;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type PackInstallationStatus = \"installing\" | \"active\" | \"needs_attention\" | \"disabled\";\n\nexport type PackInstallation = {\n  skillPublications?: import(\"./skills\").SkillPublicationReceipt[] | undefined;\n  skillWrites?: import(\"./skills\").SkillWriteReceipt[] | undefined;\n  skillReleases?: import(\"./skills\").SkillSourceReleaseReceipt[] | undefined;\n  id: string;\n  accountId: string;\n  workspaceId: string;\n  packId: string;\n  status: PackInstallationStatus;\n  version: number;\n  /** Exact accepted manifest, not a normalized executable Pack. */\n  manifestSnapshot: Record<string, unknown> | null;\n  manifestDigest: string | null;\n  selectedRigId: string | null;\n  installedBySubjectId: string | null;\n  metadata: Record<string, unknown>;\n  enabledAt: string;\n  updatedAt: string;\n};\n\n// --- OpenGeni Review Bot ------------------------------------------------------------\n\nexport type PrReviewProvider = GitCredentialProvider;\nexport type PrReviewCredentialKind = \"github_app\" | \"managed_github_app\" | \"provider_token\";\nexport type PrReviewWebhookAuthKind = \"hmac_sha256\" | \"shared_token\" | \"basic\";\n\nexport type CreatePrReviewAppRegistrationRequest = {\n  name: string;\n  provider: PrReviewProvider;\n  providerBaseUrl?: string | undefined;\n  appId?: string | undefined;\n  credentialKind: PrReviewCredentialKind;\n  privateKey?: string | undefined;\n  accessToken?: string | undefined;\n  accessTokenExpiresAt?: string | null | undefined;\n  webhookSecret: string;\n  webhookUsername?: string | undefined;\n};\n\nexport type UpdatePrReviewAppRegistrationRequest = {\n  name?: string | undefined;\n  privateKey?: string | undefined;\n  accessToken?: string | undefined;\n  accessTokenExpiresAt?: string | null | undefined;\n  webhookSecret?: string | undefined;\n  webhookUsername?: string | undefined;\n  status?: \"active\" | \"disabled\" | undefined;\n};\n\nexport type PrReviewAppRegistration = {\n  id: string;\n  sourceId: string;\n  accountId: string;\n  workspaceId: string;\n  name: string;\n  provider: PrReviewProvider;\n  providerBaseUrl: string;\n  appId: string | null;\n  installationId: string | null;\n  providerAccountLogin: string | null;\n  providerAccountType: \"User\" | \"Organization\" | null;\n  credentialKind: PrReviewCredentialKind;\n  hasCredential: boolean;\n  accessTokenExpiresAt: string | null;\n  webhookAuthKind: PrReviewWebhookAuthKind;\n  hasWebhookSecret: boolean;\n  webhookUsername: string | null;\n  webhookPath: string;\n  status: \"active\" | \"disabled\";\n  createdBySubjectId: string;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type CreatePrReviewRepositoryBindingRequest = {\n  registrationId: string;\n  repositoryUri: string;\n  repositoryFullName: string;\n  providerRepositoryId: string | number;\n  installationId?: string | number | undefined;\n  projectId?: string | number | undefined;\n  model?: string | null | undefined;\n  additionalInstructions?: string | null | undefined;\n  status?: \"active\" | \"disabled\" | undefined;\n};\n\nexport type UpdatePrReviewRepositoryBindingRequest = {\n  model?: string | null | undefined;\n  additionalInstructions?: string | null | undefined;\n  status?: \"active\" | \"disabled\" | undefined;\n};\n\nexport type PrReviewRepositoryBinding = {\n  id: string;\n  triggerId: string;\n  accountId: string;\n  workspaceId: string;\n  registrationId: string;\n  provider: PrReviewProvider;\n  repositoryUri: string;\n  repositoryFullName: string;\n  providerRepositoryId: string;\n  installationId: string | null;\n  projectId: string | null;\n  model: string | null;\n  additionalInstructions: string | null;\n  status: \"active\" | \"disabled\";\n  createdBySubjectId: string;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type ListPrReviewConfigurationResponse = {\n  registrations: PrReviewAppRegistration[];\n  repositories: PrReviewRepositoryBinding[];\n};\n\nexport type PrReviewManagedGitHubInstallation = {\n  registrationId: string;\n  installationId: string;\n  accountLogin: string | null;\n  configureUrl: string | null;\n  repositoryCount: number;\n};\n\nexport type PrReviewManagedGitHubSetup = {\n  configured: boolean;\n  status: \"unavailable\" | \"not_connected\" | \"connected\";\n  appName: \"OpenGeni Lens\";\n  connectUrl: string | null;\n  installations: PrReviewManagedGitHubInstallation[];\n  missing: string[];\n};\n\nexport type EnablePackRequest = {\n  variableSetId?: string | undefined;\n  /** @deprecated use variableSetId */\n  environmentId?: string | undefined;\n  metadata?: Record<string, unknown> | undefined;\n};\n\nexport type PackComponentResolutionStatus = \"ready\" | \"missing\" | \"mismatch\";\n\nexport type PackComponentResolution = {\n  key: string;\n  kind: \"plugin\" | \"skill\" | \"integration\" | \"facet\" | \"inline_skill\";\n  capabilityId: string;\n  required: boolean;\n  status: PackComponentResolutionStatus;\n  expectedDigest: string;\n  actualDigest: string | null;\n  resolvedId: string | null;\n  label: string;\n};\n\nexport type PackRigResolution = {\n  required: boolean;\n  status: \"not_required\" | \"ready\" | \"missing\" | \"mismatch\" | \"unverified\";\n  requestedRigId: string | null;\n  rigId: string | null;\n  rigVersionId: string | null;\n  name: string | null;\n  image: string | null;\n};\n\nexport type PreviewPackInstallationRequest = {\n  rigId?: string | undefined;\n  variableSetId?: string | undefined;\n};\n\nexport type PackInstallationPreview = {\n  packId: string;\n  packVersion: string;\n  manifestDigest: string;\n  installationVersion: number | null;\n  action: \"install\" | \"update\" | \"repair\";\n  ready: boolean;\n  blockers: string[];\n  components: PackComponentResolution[];\n  rig: PackRigResolution;\n  variableSetId: string | null;\n  legacyInlineSkillCount: number;\n  legacySandboxImage: string | null;\n};\n\nexport type InstallPackRequest = {\n  expectedManifestDigest: string;\n  expectedInstallationVersion?: number | undefined;\n  rigId?: string | undefined;\n  variableSetId?: string | undefined;\n  idempotencyKey: string;\n  metadata?: Record<string, unknown> | undefined;\n};\n\nexport type PackUninstallPreview = {\n  packId: string;\n  installed: boolean;\n  installationVersion: number | null;\n  components: Array<{\n    key: string;\n    kind: \"plugin\" | \"skill\" | \"integration\" | \"facet\" | \"inline_skill\";\n    capabilityId: string;\n    retainedByOtherOwners: boolean;\n  }>;\n};\n\nexport type UninstallPackRequest = {\n  expectedInstallationVersion: number;\n  idempotencyKey: string;\n};\n\nexport type UninstallPackResult = {\n  skillReleases?: import(\"./skills\").SkillSourceReleaseReceipt[] | undefined;\n  packId: string;\n  status: \"not_installed\" | \"uninstalled\";\n  retainedComponents: string[];\n};\n\nexport type ListPacksResponse = {\n  packs: CapabilityPack[];\n  installations: PackInstallation[];\n};\n\nexport type GetPackResponse = {\n  pack: CapabilityPack;\n  installation: PackInstallation | null;\n};\n\n// --- Capabilities ---------------------------------------------------------------\n\nexport type CapabilityKind = \"pack\" | \"mcp\" | \"api\" | \"skill\" | \"plugin\";\n\nexport type CapabilitySource =\n  | \"built_in\"\n  | \"library\"\n  | \"configured\"\n  | \"public_registry\"\n  | \"registry\"\n  | \"manual\";\n\nexport type CapabilityInstallationStatus = \"active\" | \"disabled\";\n\nexport type CapabilityCatalogAuthKind = \"oauth2\" | \"api_key\" | \"none\" | \"unknown\";\n\nexport type CapabilityCatalogTier = \"verified\" | \"community\";\n\nexport type CapabilityLifecycleStatus =\n  | \"available\"\n  | \"installed\"\n  | \"connected\"\n  | \"ready\"\n  | \"needs_attention\"\n  | \"unavailable\"\n  | \"managed\";\n\nexport type CapabilityReadiness = \"ready\" | \"setup_required\" | \"attention\" | \"unavailable\";\n\nexport type CapabilityAction =\n  | \"install\"\n  | \"connect\"\n  | \"configure\"\n  | \"update\"\n  | \"repair\"\n  | \"disconnect\"\n  | \"uninstall\"\n  | \"inspect\";\n\nexport type CapabilityLifecycle = {\n  status: CapabilityLifecycleStatus;\n  readiness: CapabilityReadiness;\n  detail: string | null;\n  managedBy: \"deployment\" | \"platform\" | \"workspace\" | null;\n};\n\nexport type CapabilityRuntime = {\n  available: boolean;\n  mcpServerId?: string | undefined;\n  transport?: string | undefined;\n  notes: string | null;\n  /** Secret-safe server-derived registry exposure state. */\n  catalogTrust?:\n    | {\n        state: \"trusted\" | \"legacy_active\" | \"unverified\";\n        reason:\n          | \"trusted_source\"\n          | \"verified_probe\"\n          | \"active_installation_compatibility\"\n          | \"missing_verification\";\n      }\n    | undefined;\n};\n\nexport type CapabilityCatalogItem = {\n  id: string;\n  accountId?: string | undefined;\n  workspaceId?: string | undefined;\n  kind: CapabilityKind;\n  source: CapabilitySource;\n  name: string;\n  description: string | null;\n  category: string;\n  tags: string[];\n  homepageUrl: string | null;\n  endpointUrl: string | null;\n  installUrl: string | null;\n  authModel: string | null;\n  providerDomain: string | null;\n  surfaceType: string | null;\n  transport: string | null;\n  mcpUrl: string | null;\n  authKind: CapabilityCatalogAuthKind | null;\n  credentialFacts: Record<string, unknown>[];\n  tier: CapabilityCatalogTier | null;\n  provenance: string | null;\n  logoAssetPath: string | null;\n  importBatchId: string | null;\n  stale: boolean;\n  staleAt: string | null;\n  tools: ToolRef[];\n  runtime: CapabilityRuntime;\n  lifecycle: CapabilityLifecycle;\n  actions: CapabilityAction[];\n  /** @deprecated Use lifecycle and actions. */\n  enabled: boolean;\n  /** @deprecated Use lifecycle.detail. */\n  enabledReason: string | null;\n  /** The connection backing this enabled installation, or null when none is involved. */\n  connectionRef: {\n    connectionId?: string | undefined;\n    authoritySource?: \"host\" | undefined;\n    providerDomain: string;\n    kind: string;\n    subjectScope?: \"subject\" | \"workspace\" | undefined;\n  } | null;\n  metadata: Record<string, unknown>;\n  createdAt?: string | undefined;\n  updatedAt?: string | undefined;\n};\n\nexport type CapabilityInstallation = {\n  id: string;\n  accountId: string;\n  workspaceId: string;\n  capabilityId: string;\n  kind: CapabilityKind;\n  status: CapabilityInstallationStatus;\n  config: Record<string, unknown>;\n  metadata: Record<string, unknown>;\n  enabledAt: string;\n  updatedAt: string;\n};\n\nexport type CapabilityCatalogResponse = {\n  items: CapabilityCatalogItem[];\n  installations: CapabilityInstallation[];\n};\n\nexport type CreateCapabilityCatalogItemRequest = {\n  id?: string | undefined;\n  kind: \"mcp\";\n  source?: CapabilitySource | undefined;\n  name: string;\n  description?: string | undefined;\n  category?: string | undefined;\n  tags?: string[] | undefined;\n  homepageUrl?: string | undefined;\n  endpointUrl?: string | undefined;\n  installUrl?: string | undefined;\n  authModel?: string | undefined;\n  metadata?: Record<string, unknown> | undefined;\n};\n\nexport type EnableCapabilityRequest = {\n  config?: Record<string, unknown> | undefined;\n  metadata?: Record<string, unknown> | undefined;\n  connectionRef?: McpServerConnectionRef | undefined;\n  /**\n   * Credential headers for remote MCP capabilities. Write-only: encrypted at\n   * rest, injected only into the runtime MCP client, never returned by the\n   * API (responses expose header names only).\n   */\n  headers?: Record<string, string> | undefined;\n};\n\nexport type DiscoverMcpCapabilitiesResponse = {\n  items: CapabilityCatalogItem[];\n  source: \"official_mcp_registry\";\n  sourceUrl: string;\n};\n\nexport type SkillImportSource = \"github\" | \"skills_sh\";\n\nexport type SkillInstallationSource = \"library\" | \"github\" | \"skills_sh\" | \"pack\";\n\nexport type PreviewSkillImportRequest = {\n  url: string;\n};\n\nexport type SkillImportFileSummary = {\n  path: string;\n  byteSize: number;\n  contentSha256: string;\n};\n\nexport type SkillImportPreview = {\n  source: SkillImportSource;\n  sourceUrl: string;\n  repositoryUrl: string;\n  owner: string;\n  repository: string;\n  sourcePath: string;\n  sourceCommit: string;\n  name: string;\n  description: string;\n  contentSha256: string;\n  totalBytes: number;\n  files: SkillImportFileSummary[];\n  warnings: string[];\n  installed: boolean;\n  installationVersion: number | null;\n};\n\nexport type InstallSkillRequest = {\n  url: string;\n  expectedSourceCommit: string;\n  expectedContentSha256: string;\n  expectedInstallationVersion?: number | undefined;\n};\n\nexport type InstallLibrarySkillRequest = {\n  expectedVersion: string;\n  expectedContentSha256: string;\n  expectedInstallationVersion?: number | undefined;\n};\n\nexport type InstalledSkill = {\n  skillReceipt?: import(\"./skills\").SkillWriteReceipt | undefined;\n  capabilityId: string;\n  pluginId: string;\n  pluginVersionId: string;\n  facetId: string;\n  pluginInstallationId: string;\n  facetInstallationId: string;\n  installationVersion: number;\n  source: SkillInstallationSource;\n  version: string;\n  sourceUrl: string;\n  sourceCommit: string;\n  contentSha256: string;\n  name: string;\n  status: \"installed\";\n};\n\nexport type CapabilityComponentOwner = {\n  kind: \"direct\" | \"plugin\" | \"pack\" | \"migration\";\n  id: string;\n  removable: boolean;\n};\n\nexport type InstalledSkillSummary = {\n  capabilityId: string;\n  pluginKey: string;\n  installationVersion: number;\n  name: string;\n  description: string;\n  category: string;\n  tags: string[];\n  provenance: string;\n  source: SkillInstallationSource;\n  version: string;\n  sourceUrl: string;\n  repositoryUrl: string;\n  sourceCommit: string;\n  sourcePath: string;\n  contentSha256: string;\n  fileCount: number;\n  totalBytes: number;\n  license: string | null;\n  installedAt: string;\n  updatedAt: string;\n  owners: CapabilityComponentOwner[];\n};\n\nexport type ListInstalledSkillsResponse = {\n  skills: InstalledSkillSummary[];\n};\n\nexport type SkillUninstallPreview = {\n  capabilityId: string;\n  installed: boolean;\n  installationVersion: number | null;\n  directOwner: CapabilityComponentOwner | null;\n  remainingOwners: CapabilityComponentOwner[];\n  removesRuntimeSkill: boolean;\n};\n\nexport type UninstallSkillRequest = {\n  expectedInstallationVersion: number;\n};\n\nexport type UninstallSkillResult = {\n  skillReleases?: import(\"./skills\").SkillSourceReleaseReceipt[] | undefined;\n  capabilityId: string;\n  status: \"not_installed\" | \"uninstalled\" | \"retained_by_other_owners\";\n  remainingOwners: CapabilityComponentOwner[];\n};\n\nexport type ApiIntegrationProtocol = \"openapi\" | \"graphql\";\nexport type IntegrationDefinitionProvenance = \"curated\" | \"workspace\";\n\nexport type IntegrationFacetKind =\n  | \"tools\"\n  | \"knowledge_source\"\n  | \"inbound_trigger\"\n  | \"delivery_destination\"\n  | \"identity_link\";\n\nexport type IntegrationFacetStatus = \"active\" | \"paused\" | \"needs_attention\" | \"disabled\";\n\nexport type IntegrationFacetDefinitionSummary = {\n  facetKey: string;\n  kind: Exclude<IntegrationFacetKind, \"tools\">;\n  configSchema: Record<string, unknown>;\n  capabilities: Record<string, unknown>;\n};\n\nexport type IntegrationFacetBindingSummary = {\n  id: string;\n  facetKey: string;\n  kind: Exclude<IntegrationFacetKind, \"tools\">;\n  bindingKey: string;\n  displayName: string;\n  connectionId: string | null;\n  status: IntegrationFacetStatus;\n  config: Record<string, unknown>;\n  version: number;\n  hasCursor: boolean;\n  lastSuccessAt: string | null;\n  lastErrorCode: string | null;\n  createdAt: string;\n  updatedAt: string;\n  directlyOwned: boolean;\n  owners: CapabilityComponentOwner[];\n};\n\nexport type IntegrationInstanceFacetsResponse = {\n  capabilityId: string;\n  instanceKey: string;\n  providerDomain: string;\n  connectionId: string | null;\n  facets: {\n    definition: IntegrationFacetDefinitionSummary;\n    binding: IntegrationFacetBindingSummary | null;\n  }[];\n};\n\nexport type UpsertIntegrationFacetRequest = {\n  displayName: string;\n  config?: Record<string, unknown> | undefined;\n  expectedVersion?: number | undefined;\n  idempotencyKey: string;\n};\n\nexport type MutateIntegrationFacetRequest = {\n  expectedVersion: number;\n  idempotencyKey: string;\n};\n\nexport type IntegrationFacetMutationResult = {\n  capabilityId: string;\n  instanceKey: string;\n  facetKey: string;\n  status: \"configured\" | \"paused\" | \"active\";\n  binding: IntegrationFacetBindingSummary;\n};\n\nexport type IntegrationFacetRemovalResult = {\n  capabilityId: string;\n  instanceKey: string;\n  facetKey: string;\n  status: \"not_configured\" | \"removed\" | \"retained_by_other_owners\";\n  binding: IntegrationFacetBindingSummary | null;\n  remainingOwners: CapabilityComponentOwner[];\n};\n\n/**\n * Presentation-only consent copy served with an integration or connector.\n * Never grants a scope or replaces server-side authorization; the UI keeps a\n * generic fallback for any omitted field.\n */\nexport type IntegrationPresentation = {\n  providerName?: string | undefined;\n  icon?: \"calendar\" | \"cloud\" | \"contacts\" | \"files\" | \"mail\" | undefined;\n  introduction?: string | undefined;\n  capabilities?: { title: string; description: string }[] | undefined;\n  permissionSummary?: string | undefined;\n  scopeLabels?: Record<string, { label: string; description: string }> | undefined;\n};\n\nexport type IntegrationDefinitionSummary = {\n  id: string;\n  name: string;\n  summary: string;\n  protocol: \"openapi\";\n  provider: {\n    id: \"google\" | \"microsoft\";\n    domain: string;\n  };\n  authentication: {\n    kind: \"oauth2\";\n    scopes: string[];\n  };\n  presentation?: IntegrationPresentation | undefined;\n  facets: IntegrationFacetDefinitionSummary[];\n};\n\nexport type ListIntegrationDefinitionsResponse = {\n  definitions: IntegrationDefinitionSummary[];\n};\n\nexport type IntegrationSource =\n  | { kind: \"definition\"; definitionId: string }\n  | { kind: \"openapi\"; url: string; baseUrl?: string | undefined }\n  | { kind: \"graphql\"; endpoint: string; name?: string | undefined }\n  | { kind: \"auto\"; url: string; baseUrl?: string | undefined };\n\nexport type PreviewApiIntegrationRequest = {\n  source: IntegrationSource;\n  connectionId?: string | undefined;\n  ownership?: ConnectionOwnership | undefined;\n};\n\nexport type ApiIntegrationOAuthStartRequest = {\n  definitionId: string;\n  ownership?: ConnectionOwnership | undefined;\n  connectionId?: string | undefined;\n  returnPath?: string | undefined;\n};\n\nexport type ApiIntegrationAuthPreview =\n  | { kind: \"none\" }\n  | { kind: \"oauth2\"; providerDomain: string; scopes: string[] }\n  | {\n      kind: \"api_key\";\n      providerDomain: string;\n      carrier: \"header\" | \"query\" | \"cookie\";\n      name: string;\n    }\n  | { kind: \"http\"; providerDomain: string; scheme: string };\n\nexport type ApiIntegrationToolPreview = {\n  id: string;\n  operationKey: string;\n  name: string;\n  description: string;\n  safety: \"read\" | \"write\" | \"destructive\";\n  approvalMode: \"never\" | \"ask\";\n  deprecated: boolean;\n};\n\nexport type ApiIntegrationPreview = {\n  source: IntegrationSource;\n  definitionId: string;\n  definitionProvenance: IntegrationDefinitionProvenance;\n  protocol: ApiIntegrationProtocol;\n  capabilityId: string;\n  pluginKey: string;\n  serverId: string;\n  name: string;\n  description: string | null;\n  provider: string | null;\n  providerDomain: string;\n  baseUrl: string;\n  sourceUrl: string | null;\n  revisionId: string;\n  contentSha256: string;\n  auth: ApiIntegrationAuthPreview;\n  connectionId: string | null;\n  connectionOwnership: ConnectionOwnership | null;\n  tools: ApiIntegrationToolPreview[];\n  warnings: string[];\n};\n\nexport type InstallApiIntegrationRequest = {\n  source: IntegrationSource;\n  expectedRevisionId: string;\n  expectedContentSha256: string;\n  connectionId?: string | undefined;\n  ownership?: ConnectionOwnership | undefined;\n  instanceKey?: string | undefined;\n  displayName?: string | undefined;\n  expectedInstanceVersion?: number | undefined;\n  allowedTools?: string[] | undefined;\n};\n\nexport type InstalledApiIntegration = {\n  capabilityId: string;\n  pluginId: string;\n  pluginVersionId: string;\n  integrationFacetId: string;\n  apiFacetId: string;\n  pluginInstallationId: string;\n  integrationFacetInstallationId: string;\n  apiFacetInstallationId: string;\n  installationVersion: number;\n  instanceId: string;\n  instanceKey: string;\n  displayName: string;\n  instanceVersion: number;\n  revisionId: string;\n  serverId: string;\n  status: \"installed\";\n};\n\nexport type ApiIntegrationInstallationSummary = {\n  capabilityId: string;\n  pluginKey: string;\n  installationVersion: number;\n  instanceId: string;\n  instanceKey: string;\n  displayName: string;\n  instanceVersion: number;\n  serverId: string;\n  name: string;\n  description: string | null;\n  protocol: ApiIntegrationProtocol;\n  definitionId: string;\n  definitionProvenance: IntegrationDefinitionProvenance;\n  providerDomain: string;\n  baseUrl: string;\n  sourceUrl: string | null;\n  connected: boolean;\n  requiresConnection: boolean;\n  connectionId: string | null;\n  ownership: \"workspace\" | \"personal\" | \"none\";\n  allowedTools: string[];\n  toolCount: number;\n  approvalRequiredToolCount: number;\n  revisionId: string;\n  contentSha256: string;\n};\n\nexport type ListApiIntegrationsResponse = {\n  integrations: ApiIntegrationInstallationSummary[];\n};\n\nexport type ApiIntegrationUninstallPreview = {\n  capabilityId: string;\n  instanceKey: string;\n  displayName: string | null;\n  installed: boolean;\n  installationVersion: number | null;\n  instanceVersion: number | null;\n  directOwner: CapabilityComponentOwner | null;\n  remainingOwners: CapabilityComponentOwner[];\n  removesRuntimeIntegration: boolean;\n  removesDefinition: boolean;\n};\n\nexport type UninstallApiIntegrationRequest = {\n  expectedInstallationVersion: number;\n  expectedInstanceVersion: number;\n};\n\nexport type UninstallApiIntegrationResult = {\n  capabilityId: string;\n  instanceKey: string;\n  status: \"not_installed\" | \"uninstalled\" | \"retained_by_other_owners\";\n  remainingOwners: CapabilityComponentOwner[];\n  definitionStatus: \"retained\" | \"disabled\";\n};\n\nexport type PluginManifestComponent =\n  | { key: string; kind: \"skill\"; url: string }\n  | { key: string; kind: \"integration\"; source: IntegrationSource }\n  | { key: string; kind: \"mcp\"; serverId: string };\n\nexport type PluginManifest = {\n  schemaVersion: 1;\n  pluginKey: string;\n  version: string;\n  name: string;\n  description: string;\n  category: string;\n  tags: string[];\n  components: PluginManifestComponent[];\n};\n\nexport type PluginComponentBinding = {\n  connectionId?: string | undefined;\n  instanceKey?: string | undefined;\n  displayName?: string | undefined;\n};\n\nexport type PreviewPluginRequest = {\n  url: string;\n  bindings?: Record<string, PluginComponentBinding> | undefined;\n};\n\nexport type PluginComponentPreview = {\n  key: string;\n  kind: \"skill\" | \"integration\" | \"mcp\";\n  name: string;\n  capabilityId: string;\n  digest: string;\n  connectionRequired: boolean;\n  connectionId: string | null;\n  instanceKey: string | null;\n  displayName: string | null;\n  facts: Record<string, unknown>;\n};\n\nexport type PluginUpdateDiff = {\n  fromVersion: string | null;\n  toVersion: string;\n  added: string[];\n  removed: string[];\n  changed: string[];\n  unchanged: string[];\n};\n\nexport type PluginPreview = {\n  sourceUrl: string;\n  manifest: PluginManifest;\n  manifestDigest: string;\n  installed: boolean;\n  installationVersion: number | null;\n  components: PluginComponentPreview[];\n  diff: PluginUpdateDiff;\n};\n\nexport type InstallPluginRequest = {\n  url: string;\n  expectedManifestDigest: string;\n  expectedComponents: Array<{ key: string; digest: string }>;\n  bindings?: Record<string, PluginComponentBinding> | undefined;\n  idempotencyKey: string;\n  expectedInstallationVersion?: number | undefined;\n};\n\nexport type InstalledPlugin = {\n  skillPublications?: import(\"./skills\").SkillPublicationReceipt[] | undefined;\n  skillWrites?: import(\"./skills\").SkillWriteReceipt[] | undefined;\n  skillReleases?: import(\"./skills\").SkillSourceReleaseReceipt[] | undefined;\n  pluginKey: string;\n  version: string;\n  pluginId: string;\n  pluginVersionId: string;\n  pluginInstallationId: string;\n  installationVersion: number;\n  componentCount: number;\n  status: \"installed\";\n};\n\nexport type PluginInstallationSummary = {\n  pluginKey: string;\n  version: string;\n  name: string;\n  description: string;\n  category: string;\n  tags: string[];\n  sourceUrl: string | null;\n  manifestDigest: string;\n  installationVersion: number;\n  componentCount: number;\n  status: \"active\" | \"needs_attention\";\n  installedAt: string;\n  updatedAt: string;\n};\n\nexport type ListInstalledPluginsResponse = {\n  plugins: PluginInstallationSummary[];\n};\n\nexport type PluginUninstallPreview = {\n  pluginKey: string;\n  installed: boolean;\n  version: string | null;\n  installationVersion: number | null;\n  components: Array<{\n    capabilityId: string;\n    kind: \"skill\" | \"integration\" | \"mcp\";\n    retainedByOtherOwners: boolean;\n  }>;\n};\n\nexport type UninstallPluginRequest = {\n  expectedInstallationVersion: number;\n  idempotencyKey: string;\n};\n\nexport type UninstallPluginResult = {\n  skillReleases?: import(\"./skills\").SkillSourceReleaseReceipt[] | undefined;\n  pluginKey: string;\n  status: \"not_installed\" | \"uninstalled\";\n  retainedComponents: string[];\n};\n\n// --- GitHub ---------------------------------------------------------------------\n\nexport type GitHubRepository = {\n  id: number;\n  installationId: number;\n  fullName: string;\n  name: string;\n  private: boolean;\n  htmlUrl: string;\n  cloneUrl: string;\n  defaultBranch: string;\n  accountLogin: string;\n  accountType: string | null;\n};\n\nexport type GitHubRepositoryScope = \"all\" | \"selected\";\n\nexport type GitHubBindingStatus = \"disabled\" | \"unbound\" | \"bound\";\n\nexport type GitHubAppSetupMode = \"platform\" | \"operator\";\n\nexport type GitHubInstallationLifecycle = \"active\" | \"suspended\" | \"deleted\" | \"unverified\";\n\nexport type GitHubInstallationBinding = {\n  installationId: number;\n  githubAccountId: number | null;\n  accountLogin: string | null;\n  accountType: string | null;\n  lifecycle: GitHubInstallationLifecycle;\n  repositoryScope: GitHubRepositoryScope;\n  repositoryCount: number;\n  /** OpenGeni-owned entry point for changing the installation's repository allowlist. */\n  configureUrl: string | null;\n  createdAt: string;\n  updatedAt: string;\n};\n\nexport type GitHubAppInfo = {\n  configured: boolean;\n  /** Truthful workspace binding state; server App credentials alone are not a binding. */\n  status: GitHubBindingStatus;\n  /** Platform deployments expose installation only; operator deployments may create an App. */\n  setupMode: GitHubAppSetupMode;\n  appId: string | null;\n  clientId: string | null;\n  appSlug: string | null;\n  /** Fresh OAuth-first existing-installation discovery and install entry point. */\n  installUrl: string | null;\n  /** Compatibility alias for installUrl. */\n  linkUrl: string | null;\n  /** Installation bindings owned independently by this workspace. */\n  installations: GitHubInstallationBinding[];\n  /** Setting names still missing when `configured` is false. */\n  missing: string[];\n};\n\nexport type GitHubRepositoriesResponse = {\n  repositories: GitHubRepository[];\n};\n\nexport type GitHubActionPolicyDecision = \"allow\" | \"ask\" | \"block\";\nexport type GitHubActionPolicyEffectiveDecision = GitHubActionPolicyDecision | \"mixed\";\nexport type GitHubActionPolicyGroup = \"routine\" | \"review\" | \"merge\";\n\nexport type GitHubActionPolicyActor =\n  | { kind: \"workspace_app\"; installationId: number }\n  | { kind: \"personal\"; connectionId: string };\n\nexport type GitHubActionPolicyActorState = GitHubActionPolicyActor & {\n  label: string;\n  groups: Record<GitHubActionPolicyGroup, GitHubActionPolicyEffectiveDecision>;\n};\n\nexport type GitHubActionPoliciesResponse = {\n  enabled: boolean;\n  actors: GitHubActionPolicyActorState[];\n};\n\nexport type UpdateGitHubActionPolicyRequest = {\n  actor: GitHubActionPolicyActor;\n  group: GitHubActionPolicyGroup;\n  decision: GitHubActionPolicyDecision;\n};\n\nexport type VerifyPublicGitHubRepositoryRefRequest = {\n  url: string;\n  ref: string;\n};\n\nexport type VerifyPublicGitHubRepositoryRefResponse = {\n  owner: string;\n  name: string;\n  fullName: string;\n  canonicalUrl: string;\n  cloneUrl: string;\n  defaultBranch: string;\n  ref: string;\n  commitSha: string;\n};\n\nexport type GitHubRepositoryBranch = {\n  name: string;\n  isDefault: boolean;\n};\n\nexport type ListGitHubRepositoryBranchesOptions = {\n  cursor?: number | undefined;\n  limit?: number | undefined;\n};\n\nexport type GitHubRepositoryBranchesResponse = {\n  branches: GitHubRepositoryBranch[];\n  nextCursor: number | null;\n};\n\nexport type CreateGitHubAppManifestRequest = {\n  appName?: string | undefined;\n  organization?: string | undefined;\n  public?: boolean | undefined;\n  includeCiPermissions?: boolean | undefined;\n};\n\nexport type CreateGitHubAppManifestResponse = {\n  /** GitHub URL to POST the manifest to (personal or organization flow). */\n  actionUrl: string;\n  state: string;\n  manifest: Record<string, unknown>;\n};\n\n// --- Billing --------------------------------------------------------------------\n\nexport type BillingMode = \"disabled\" | \"stripe\";\n\nexport type EntitlementsMode = \"none\" | \"static\" | \"managed\";\n\nexport type BillingBalance = {\n  accountId: string;\n  balanceMicros: number;\n  currency: \"usd\";\n  updatedAt: string;\n};\n\nexport const KNOWN_USAGE_EVENT_TYPES = [\n  \"agent_run.created\",\n  \"agent_run.completed\",\n  \"model.tokens\",\n  \"model.cost\",\n  \"file.uploaded\",\n  \"file.deleted\",\n  \"document.indexed\",\n  \"scheduled_task.fired\",\n  \"knowledge_source_sync.fired\",\n  \"knowledge_source_sync.completed\",\n  \"knowledge_source_sync.items\",\n  \"knowledge_source_sync.bytes\",\n  \"api_key.request\",\n  // sandbox warm-time metering (P2.1) — mirrors contracts UsageEventType.\n  \"sandbox.warm_seconds\",\n  \"sandbox.warm_cost\",\n] as const;\n\nexport type KnownUsageEventType = (typeof KNOWN_USAGE_EVENT_TYPES)[number];\n\nexport type UsageEventType = KnownUsageEventType | (string & {});\n\nexport type UsageEvent = {\n  id: string;\n  workspaceId: string;\n  accountId: string;\n  subjectId: string | null;\n  eventType: UsageEventType;\n  quantity: number;\n  unit: string;\n  sourceResourceType: string | null;\n  sourceResourceId: string | null;\n  idempotencyKey: string;\n  occurredAt: string;\n  recordedAt: string;\n  exportedToBillingAt: string | null;\n  billingProviderEventId: string | null;\n};\n\nexport type EntitlementValue = boolean | string | number | string[];\n\nexport type Entitlements = Record<string, EntitlementValue>;\n\nexport type BillingSummary = {\n  mode: BillingMode;\n  balance: BillingBalance;\n};\n\nexport type BillingUsageResponse = {\n  balance: BillingBalance;\n  usage: UsageEvent[];\n};\n\nexport type InsightsRange = \"today\" | \"week\" | \"month\" | \"ytd\";\n\nexport type InsightsBillingPath = \"opengeni_credits\" | \"external\";\n\nexport type InsightsPricingSource = \"configured_list_price\" | \"gateway_reported\";\n\nexport type InsightsModelUsageRow = {\n  id: string;\n  model: string;\n  provider: string;\n  billing: InsightsBillingPath;\n  calls: number;\n  inputTokens: number;\n  outputTokens: number;\n  cachedTokens: number;\n  cacheInputTokens: number;\n  cacheWriteTokens: number;\n  reasoningTokens: number;\n  totalTokens: number;\n  tokenKnownCalls: number;\n  cacheKnownCalls: number;\n  creditUsd: number;\n  estimatedProviderUsd: number;\n  estimatedProviderCostKnownCalls: number;\n  equivalentCreditUsd: number;\n  equivalentCreditCostKnownCalls: number;\n};\n\nexport type InsightsSeriesPoint = {\n  label: string;\n  modelCostUsd: number;\n  estimatedProviderUsd: number;\n  estimatedProviderCostKnownCalls: number;\n  equivalentCreditUsd: number;\n  equivalentCreditCostKnownCalls: number;\n  warmSeconds: number;\n  inputTokens: number;\n  outputTokens: number;\n  cachedTokens: number;\n  cacheInputTokens: number;\n  cacheWriteTokens: number;\n  reasoningTokens: number;\n  totalTokens: number;\n  tokenKnownCalls: number;\n  cacheKnownCalls: number;\n  cacheHitPct: number;\n  calls: number;\n};\n\nexport type InsightsDepthBucket = {\n  depth: number;\n  sessions: number;\n};\n\nexport type InsightsModelFacet = {\n  provider: string;\n  model: string;\n};\n\nexport type InsightsSpendDriver = {\n  id: string;\n  groupBy: \"root_session\" | \"schedule\";\n  label: string;\n  creditUsd: number;\n  estimatedProviderUsd: number;\n  estimatedProviderCostKnownCalls: number;\n  equivalentCreditUsd: number;\n  equivalentCreditCostKnownCalls: number;\n  tokens: number;\n  cacheHitPct: number;\n  pctOfCreditUsd: number;\n  pctOfTokens: number;\n  deltaUsdVsPrior: number;\n};\n\nexport type InsightsWarmGroupRow = {\n  id: string;\n  groupId: string;\n  label: string;\n  backend: string | null;\n  warmSeconds: number;\n  sessionsAttached: number;\n};\n\nexport type InsightsLiveWarmLease = {\n  id: string;\n  groupId: string;\n  backend: string;\n  turnHolders: number;\n  viewerHolders: number;\n  warmForLabel: string;\n  warmSeconds: number;\n};\n\nexport type InsightsFloorSession = {\n  id: string;\n  title: string;\n  state: \"running\" | \"paused\" | \"failed\" | \"idle\" | \"compacting\" | \"waiting\";\n  depth: number;\n  model: string | null;\n  provider: string | null;\n  ageLabel: string;\n  cacheHitPct: number | null;\n  route: string | null;\n};\n\nexport type InsightsScheduleRow = {\n  id: string;\n  name: string;\n  fires: number;\n  creditUsd: number | null;\n  estimatedProviderUsd: number | null;\n  estimatedProviderCostKnownCalls: number | null;\n  equivalentCreditUsd: number | null;\n  equivalentCreditCostKnownCalls: number | null;\n  tokens: number | null;\n  cacheHitPct: number | null;\n  billing: InsightsBillingPath | null;\n};\n\nexport type InsightsModelCallRow = {\n  id: string;\n  occurredAt: string;\n  recordedAt: string;\n  sessionId: string;\n  sessionTitle: string;\n  turnId: string;\n  provider: string;\n  providerApi: string;\n  model: string;\n  billing: InsightsBillingPath;\n  inputTokens: number | null;\n  outputTokens: number | null;\n  cachedTokens: number | null;\n  cacheWriteTokens: number | null;\n  reasoningTokens: number | null;\n  totalTokens: number | null;\n  creditUsd: number;\n  estimatedProviderUsd: number | null;\n  equivalentCreditUsd: number | null;\n  pricingSource: InsightsPricingSource | null;\n};\n\nexport type ModelContextContributionSource =\n  | \"workspace_instruction_policy\"\n  | \"legacy_workspace_instructions\"\n  | \"preference_registry_descriptor\"\n  | \"company_profile\"\n  | \"legacy_memory_v1\"\n  | \"runtime_skill_catalog\";\n\nexport type InsightsPromptContributionRow = {\n  source: ModelContextContributionSource;\n  items: number;\n  utf8Bytes: number;\n  estimatedTokens: number;\n  calls: number;\n};\n\nexport type InsightsPromptContributions = {\n  estimatedTokens: number;\n  utf8Bytes: number;\n  coveredCalls: number;\n  totalCalls: number;\n  sources: InsightsPromptContributionRow[];\n};\n\nexport type WorkspaceInsightsSnapshot = {\n  range: InsightsRange;\n  rangeLabel: string;\n  priorLabel: string;\n  seriesLabel: string;\n  cacheSeriesLabel: string;\n  windowStart: string;\n  windowEnd: string;\n  generatedAt: string;\n  timezone: \"UTC\";\n  models: InsightsModelUsageRow[];\n  facets: InsightsModelFacet[];\n  series: InsightsSeriesPoint[];\n  depth: InsightsDepthBucket[];\n  drivers: InsightsSpendDriver[];\n  schedules: InsightsScheduleRow[];\n  recentCalls: InsightsModelCallRow[];\n  promptContributions: InsightsPromptContributions;\n  warmSeconds: number;\n  priorWarmSeconds: number;\n  warmGroups: InsightsWarmGroupRow[];\n  liveWarm: InsightsLiveWarmLease[];\n  floor: InsightsFloorSession[];\n  selfhostedEnabled: boolean;\n  machinesOnline: number;\n  workspaceCreditUsd: number;\n  priorWorkspaceCreditUsd: number;\n  creditUsd: number;\n  priorCreditUsd: number;\n  estimatedProviderUsd: number;\n  priorEstimatedProviderUsd: number;\n  estimatedProviderCostKnownCalls: number;\n  priorEstimatedProviderCostKnownCalls: number;\n  equivalentCreditUsd: number;\n  priorEquivalentCreditUsd: number;\n  equivalentCreditCostKnownCalls: number;\n  priorEquivalentCreditCostKnownCalls: number;\n  modelCalls: number;\n  priorInputTokens: number;\n  priorTotalTokens: number;\n  priorCacheHitPct: number;\n  priorCalls: number;\n  goalsActive: number;\n  goalsCompleted: number;\n  sessionsTouched: number;\n  rootSessions: number;\n  deepestDepth: number;\n  deepestSessionTitle: string;\n  avgDepth: number;\n  warmIdleNow: number;\n  billableTokensUsed: number;\n  billableTokenCap: number | null;\n  agentRunsUsed: number;\n  agentRunCap: number | null;\n  modelFilterActive: boolean;\n};\n\nexport type WorkspaceInsightsResponse = {\n  snapshot: WorkspaceInsightsSnapshot;\n};\n\nexport type BillingEntitlementsResponse = {\n  accountId: string;\n  mode: EntitlementsMode;\n  entitlements: Entitlements;\n};\n\nexport type CreateCheckoutRequest = {\n  accountId?: string | undefined;\n  /** USD amount with cent precision (server enforces min/max). */\n  amountUsd: number;\n  successUrl?: string | undefined;\n  cancelUrl?: string | undefined;\n};\n\nexport type CreateCheckoutResponse = {\n  checkoutSessionId: string;\n  url: string;\n};\n\nexport type CreateBillingPortalRequest = {\n  accountId?: string | undefined;\n  returnUrl?: string | undefined;\n};\n\nexport type CreateBillingPortalResponse = {\n  portalSessionId: string;\n  url: string;\n};\n\nexport type UserMessageEventInput = {\n  type: \"user.message\";\n  clientEventId?: string | undefined;\n  payload: {\n    text: string;\n    annotations?: SubmittedTimelineAnnotation[] | undefined;\n    modelContext?: string | undefined;\n    resources?: ResourceRef[] | undefined;\n    model?: string | undefined;\n    reasoningEffort?: ReasoningEffort | undefined;\n    latencyMode?: LatencyMode | undefined;\n    controlEtag?: string | undefined;\n    expectedDraftRevision?: number | undefined;\n    mcpCredentialUpdates?: SessionMcpCredentialUpdateInput[] | undefined;\n    connectionAuthorities?: McpConnectionAuthoritySelection[] | undefined;\n    selectedHostMcpDelegations?: CreateSessionRequest[\"selectedHostMcpDelegations\"];\n    personalResourceAttachment?: PersonalResourceAttachmentIntent | undefined;\n  };\n};\n\nexport type UserApprovalDecisionEventInput = {\n  type: \"user.approvalDecision\";\n  clientEventId?: string | undefined;\n  payload: {\n    approvalId: string;\n    decision: \"approve\" | \"reject\";\n    message?: string | undefined;\n  };\n};\n\nexport type UserHumanInputResponseEventInput = {\n  type: \"user.humanInputResponse\";\n  clientEventId?: string | undefined;\n  payload: {\n    requestId: string;\n    response: SubmitHumanInputResponseRequest;\n  };\n};\n\n/** Control/user events a client may POST to a session's event log. */\nexport type ClientSessionEventInput =\n  | UserMessageEventInput\n  | UserApprovalDecisionEventInput\n  | UserHumanInputResponseEventInput;\n\n// ── Bring-your-own-compute: Machines dashboard + per-machine metrics (M10) ────\n// Hand-written mirrors of the `@opengeni/contracts` MetricSample / MachineView /\n// MachinesResponse / MachineMetricsSeriesResponse (pinned by contract-parity).\n// M9 imports THESE so the dashboard UI never drifts from the API.\n\n/** A point-in-time machine metrics sample. `gpuUtilPct`/`gpuMemBytes` are null\n *  when no GPU was present (not-reported, never a real zero); the bytes/load are\n *  numbers; `sampledAt` is an ISO-8601 instant. */\nexport type MetricSample = {\n  cpuPct: number;\n  load1: number;\n  load5: number;\n  load15: number;\n  memUsedBytes: number;\n  memTotalBytes: number;\n  diskUsedBytes: number;\n  diskTotalBytes: number;\n  gpuUtilPct: number | null;\n  gpuMemBytes: number | null;\n  runQueue: number;\n  sampledAt: string;\n};\n\n/** The derived dashboard state of a machine (M3 liveness + consent/display\n *  reasons + the in-flight device-flow). */\nexport type MachineState =\n  | \"online\"\n  | \"reconnecting\"\n  | \"offline\"\n  | \"consent_required\"\n  | \"display_unavailable\"\n  | \"enrolling\";\n\nexport type MachineKind = \"modal\" | \"selfhosted\" | \"opensandbox\";\n\nexport type MachineConnectionAuthority = {\n  state: \"not_applicable\" | \"unclaimed\" | \"active\" | \"expired\";\n  generation: number;\n  supersededCount: number;\n  leaseExpiresAt: string | null;\n  duplicateRunnerDeniedCount: number;\n  duplicateRunnerDeniedAt: string | null;\n};\n\nexport type MachineRuntimeCapabilities = {\n  exec: boolean;\n  filesystem: boolean;\n  git: boolean;\n  pty: boolean;\n  desktop: boolean;\n  opStream: boolean;\n  browserBridge: boolean;\n  operationResourcePolicy: boolean;\n  operationCpuQuota: boolean;\n};\n\nexport type MachineUpdateStatus =\n  | \"requested\"\n  | \"accepted\"\n  | \"waiting_for_idle\"\n  | \"downloading\"\n  | \"verifying\"\n  | \"applying\"\n  | \"restarting\"\n  | \"succeeded\"\n  | \"failed\";\n\nexport type MachineUpdateState = {\n  operationId: string;\n  status: MachineUpdateStatus;\n  targetVersion: string;\n  expectedBinarySha256: string | null;\n  errorCode: string | null;\n  retryable: boolean;\n  rolledBack: boolean;\n  requestedAt: string;\n  updatedAt: string;\n  completedAt: string | null;\n};\n\nexport type MachineRuntime = {\n  installedVersion: string | null;\n  binarySha256: string | null;\n  updateChannel: \"stable\" | \"beta\" | null;\n  desiredVersion: string | null;\n  versionState: \"unknown\" | \"current\" | \"outdated\" | \"ahead\" | \"updating\" | \"update_failed\";\n  capabilities: MachineRuntimeCapabilities;\n  update: MachineUpdateState | null;\n};\n\nexport type UpdateMachineAgentResponse = {\n  operationId: string;\n  accepted: boolean;\n  targetVersion: string;\n};\n\nexport type MachineOperationPolicy = {\n  memoryMaxBytes: number | null;\n  memoryHighBytes: number | null;\n  cpuMaxMillicores: number | null;\n  revision: number;\n  updatedAt: string | null;\n};\n\nexport type UpdateMachineOperationPolicyRequest = {\n  memoryMaxBytes: number | null;\n  memoryHighBytes: number | null;\n  /** Omitted preserves the current CPU limit for older/partial clients; null clears. */\n  cpuMaxMillicores?: number | null;\n  expectedRevision: number;\n};\n\n/** A machine as the Machines dashboard renders it (an enrolled selfhosted machine\n *  or the session's synthetic Modal group box, `isSessionGroup: true`). */\nexport type MachineView = {\n  sandboxId: string;\n  enrollmentId: string | null;\n  scope: ResourceAuthorityScope;\n  generation: number;\n  name: string;\n  kind: MachineKind;\n  state: MachineState;\n  active: boolean;\n  isSessionGroup: boolean;\n  workspaceGeneration: number | null;\n  archiveGeneration: number | null;\n  archiveComplete: boolean;\n  os: string;\n  arch: string;\n  hasDisplay: boolean;\n  /** Non-null only when a display exists but capture is blocked (macOS Screen\n   *  Recording / TCC not granted) — the UI can surface \"display: capture not\n   *  granted\". null == capture permitted OR headless. */\n  desktopUnavailableReason?: string | null | undefined;\n  allowScreenControl: boolean;\n  sharedSessionCount: number;\n  lastSeenAt: string | null;\n  /** Secret-free single-runner authority diagnostics. */\n  connectionAuthority: MachineConnectionAuthority;\n  /** Exact build/update truth. Null means the runner predates runtime Hello\n   * reporting or this is a managed-session group without a connected agent. */\n  runtime: MachineRuntime | null;\n  /** Explicit per-enrollment command memory policy. Null only for managed\n   * session boxes; null limits on a real machine mean unrestricted. */\n  operationPolicy: MachineOperationPolicy | null;\n  metrics: MetricSample | null;\n};\n\n/** GET /v1/workspaces/:ws/machines — the dashboard list + the active-sandbox\n *  pointer (null activeSandboxId == the session's own group box is active). */\nexport type MachinesResponse = {\n  activeSandboxId: string | null;\n  activeEpoch: number;\n  machines: MachineView[];\n};\n\n/** GET /v1/workspaces/:ws/machines/:enrollmentId/metrics/series — the downsampled\n *  (~1/min) history the dashboard time-range reads. */\nexport type MachineMetricsSeriesResponse = {\n  samples: MetricSample[];\n};\n\n/** POST /v1/workspaces/:ws/enrollments/:id/revoke body. */\nexport type RemoveEnrollmentRequest = {\n  expectedUpdatedAt?: string;\n  idempotencyKey?: string;\n};\n\n/** Typed removal/revocation outcome. Blocked outcomes preserve the exact\n * dependency and the action needed to make removal safe. */\nexport type RemoveEnrollmentResponse = {\n  revoked: boolean;\n  outcome: \"removed\" | \"already_removed\" | \"blocked\";\n  enrollmentId: string;\n  machineName: string | null;\n  lastSeenAt: string | null;\n  revokedAt: string | null;\n  code:\n    | \"active_route\"\n    | \"active_commands\"\n    | \"machine_home\"\n    | \"active_lease\"\n    | \"recovery_pending\"\n    | \"not_selfhosted\"\n    | null;\n  message: string;\n  action: string;\n  dependentSessions: Array<{ id: string; title: string | null }>;\n};\n\n/** POST /v1/workspaces/:ws/sessions/:sessionId/active-sandbox — swap a session's\n *  active sandbox. `target` is a `MachineView.sandboxId`, or \"session\"/\"default\"\n *  to swap back to the session's own group box. */\nexport type SwapActiveSandboxRequest = {\n  target: string;\n};\n\n/** The swap outcome (mirrors the server `FleetSwapResult`). `swapped` is true on a\n *  successful repoint OR a no-op (already there); `reason` carries the failure\n *  detail (unowned/offline target, or a lost epoch fence) when false. */\nexport type SwapActiveSandboxResponse = {\n  swapped: boolean;\n  activeSandboxId: string | null;\n  activeEpoch: number;\n  reason?: string;\n  // Typed rejection discriminant (issue #341); present only when swapped is false.\n  // Mirror of the `@opengeni/contracts` SwapActiveSandboxResponse.code enum.\n  code?:\n    | \"stale_pointer\"\n    | \"offline_enrollment\"\n    | \"unsupported_backend_context\"\n    | \"transient_establishment\"\n    | \"concurrent_swap\"\n    | \"recovery_in_progress\"\n    | \"recovery_degraded\"\n    | \"recovery_unrecoverable\";\n};\n\n// ── Self-hosted enrollment UX (design 11) ────────────────────────────────────\n// Hand-written mirrors of the `@opengeni/contracts` enrollment-UX request/response\n// shapes. They remain type-only so ordinary SDK entries do not reach the contracts\n// runtime. The click-Grant approve-page lookup/deny + the headless enroll-token\n// mint/exchange.\n\n/** Mirror of `@opengeni/contracts` EnrollmentOs. */\nexport type EnrollmentOs = \"linux\" | \"macos\" | \"windows\";\nexport type ResourceAuthorityScope = \"organization\" | \"workspace\" | \"user\";\n\n/** POST /v1/enrollments/device/lookup body. */\nexport type DeviceEnrollmentLookupRequest = {\n  userCode: string;\n};\n\n/** The presentational machine details the consent screen renders. */\nexport type DeviceEnrollmentLookupMachine = {\n  machineName: string | null;\n  os: EnrollmentOs;\n  arch: string;\n  canOfferDisplay: boolean;\n  requestsScreenControl: boolean;\n};\n\n/** POST /v1/enrollments/device/lookup response (no secrets, no device_code). */\nexport type DeviceEnrollmentLookupResponse = {\n  workspaceId: string;\n  userCode: string;\n  machine: DeviceEnrollmentLookupMachine;\n  expiresAt: string;\n};\n\n/** POST /v1/workspaces/:ws/enrollments/device/approve body. */\nexport type DeviceEnrollmentApproveRequest = {\n  userCode: string;\n  allowScreenControl?: boolean;\n  scope?: ResourceAuthorityScope;\n};\n\n/** POST /v1/workspaces/:ws/enrollments/device/approve response. */\nexport type DeviceEnrollmentApproveResponse = {\n  approved: boolean;\n  enrollmentId: string;\n  sandboxId: string;\n  allowScreenControl: boolean;\n};\n\n/** POST /v1/workspaces/:ws/enrollments/device/deny body. */\nexport type DeviceEnrollmentDenyRequest = {\n  userCode: string;\n};\n\n/** POST /v1/workspaces/:ws/enrollments/device/deny response. */\nexport type DeviceEnrollmentDenyResponse = {\n  denied: boolean;\n};\n\n/** POST /v1/workspaces/:ws/enrollments/token body. */\nexport type MintEnrollTokenRequest = {\n  allowScreenControl?: boolean;\n};\n\n/** POST /v1/workspaces/:ws/enrollments/token response. The `token` is SECRET. */\nexport type MintEnrollTokenResponse = {\n  token: string;\n  expiresAt: string;\n  expiresInSeconds: number;\n};\n\n/** The credential payload the headless exchange returns (a subset of the agent's\n *  EnrollmentCredentials — IDENTICAL to the device-flow poll authorized branch). */\nexport type EnrollmentCredentials = {\n  agentId: string;\n  workspaceId: string;\n  bearer: string;\n  subjectPrefix: string;\n  natsUrls: string[];\n  relayUrl: string;\n  relayToken: string;\n  natsAccountCreds: string;\n  updatePublicKey: string;\n  consentedWholeMachine: boolean;\n  consentedScreenControl: boolean;\n};\n\n/** POST /v1/enrollments/token/exchange body (the headless / fleet enroll path). */\nexport type EnrollTokenExchangeRequest = {\n  token: string;\n  publicKey: string;\n  os?: EnrollmentOs;\n  arch?: string;\n  machineName?: string;\n  exposure?: \"whole-machine\";\n  canOfferDisplay?: boolean;\n  requestsScreenControl?: boolean;\n};\n\n/** POST /v1/enrollments/token/exchange response (wraps the credential shape). */\nexport type EnrollTokenExchangeResponse = {\n  credentials: EnrollmentCredentials;\n};\n\nexport type ModelConnectionAccessPolicy = {\n  allowedModels: string[] | null;\n  allowedWorkspaces: string[] | null;\n  allowPersonalWorkspaces: boolean;\n  version: number;\n};\nexport type ModelConnectionAccessResponse = {\n  policy: ModelConnectionAccessPolicy;\n  models: Array<{ id: string; label: string }>;\n  workspaces: Array<{ id: string; name: string }>;\n  personalWorkspacesSupported: boolean;\n};\n"],"mappings":";AAojBO,IAAM,mCAAmC;AA8mCzC,IAAM,kDAAkD;AACxD,IAAM,0CACX;AAyHK,IAAM,sBAAsB;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AACF;AA6aO,IAAM,kCAAkC,KAAK,OAAO,OAAO;AAmjB3D,IAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAgwBO,IAAM,iCAAiC;AACvC,IAAM,+BAA+B;AAErC,IAAM,8BAA8B;AA+zDpC,IAAM,qCAAqC,MAAM;AACjD,IAAM,iCAAiC,OAAO;AAC9C,IAAM,gCAAgC,KAAK,OAAO;AAClD,IAAM,4BAA4B,KAAK,OAAO;AAC9C,IAAM,4BAA4B,MAAM,OAAO;AA07D/C,IAAM,0BAA0B;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEA;AAAA,EACA;AACF;","names":[]}