@pstdio/pocketcoder-sdk 0.8.0 → 0.10.0

package/dist/index.js

@@ -1,3 +1,4 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
 import { z } from "zod";
 import { createHash } from "node:crypto";
 import { posix } from "node:path";
@@ -14,37 +15,6 @@ const AttachmentDescriptorSchema = z.object({
 	size_bytes: z.number().int().min(0).max(ATTACHMENT_MAX_FILE_BYTES),
 	sha256: z.string().regex(/^[0-9a-f]{64}$/)
 });
-z.looseObject({
-	type: z.literal("user"),
-	content: z.string(),
-	attachment_ids: z.array(z.uuid()).min(1).max(10).refine((ids) => new Set(ids).size === ids.length, "attachment_ids must be unique").optional()
-});
-const MANIFEST_OPEN = "<pocketcoder-attachments>";
-const MANIFEST_CLOSE = "</pocketcoder-attachments>";
-function splitAttachmentManifest(content) {
-	const open = content.lastIndexOf(MANIFEST_OPEN);
-	if (open < 0 || !content.trimEnd().endsWith(MANIFEST_CLOSE)) return {
-		text: content,
-		attachments: null
-	};
-	const close = content.lastIndexOf(MANIFEST_CLOSE);
-	const parsed = z.array(AttachmentDescriptorSchema).safeParse(safeJson(content.slice(open + 25, close)));
-	if (!parsed.success) return {
-		text: content,
-		attachments: null
-	};
-	return {
-		text: content.slice(0, open).trimEnd(),
-		attachments: parsed.data
-	};
-}
-function safeJson(value) {
-	try {
-		return JSON.parse(value);
-	} catch {
-		return;
-	}
-}
 const AttachmentStartPayload = z.object({
 	operation_id: z.uuid(),
 	attachment_id: z.uuid(),
@@ -139,7 +109,8 @@ const WorkloadCapabilitySchema = z.enum([
 	"workspace-services",
 	"revocable-preview-grants",
 	"workspace-cancel",
-	"unknown-outcome"
+	"unknown-outcome",
+	"parallel-conversations"
 ]);
 const WorkloadProfileSchema = z.enum([
 	"finite-process",
@@ -191,8 +162,7 @@ const InstalledWorkloadSchema = z.strictObject({
 		kind: z.enum([
 			"process",
 			"service",
-			"pi",
-			"agentapi"
+			"pi"
 		]),
 		digest: WorkloadDigestSchema,
 		protocol: z.string().min(1).max(128),
@@ -203,6 +173,7 @@ const InstalledWorkloadSchema = z.strictObject({
 //#region ../contracts/src/attachments/input-reference.ts
 const InputObjectReferenceSchema = z.strictObject({
 	workspaceId: z.uuid(),
+	storageOwnerId: z.uuid().optional(),
 	fileId: z.uuid(),
 	objectVersion: WorkloadDigestSchema,
 	name: z.string().min(1).max(255),
@@ -268,6 +239,10 @@ const SCOPES = [
 	"network:read",
 	"terminal:attach",
 	"terminal:read",
+	"sessions:read",
+	"sessions:write",
+	"budgets:read",
+	"budgets:admin",
 	"admin"
 ];
 z.strictObject({
@@ -572,6 +547,7 @@ const ERROR_CODES = {
 	"principal.name_conflict": 409,
 	"key.not_found": 404,
 	"request.body_too_large": 413,
+	"request.not_found": 404,
 	"validation.invalid": 400,
 	"idempotency.conflict": 409,
 	"capacity.queue_full": 429,
@@ -635,6 +611,16 @@ const ERROR_CODES = {
 	"account.purge_pending": 503,
 	"recovery.required": 503,
 	"recovery.failed": 409,
+	"session.not_found": 404,
+	"session.closed": 409,
+	"profile.not_found": 404,
+	"budget.not_found": 404,
+	"budget.exhausted": 429,
+	"budget.conflict": 409,
+	"revision.stale": 412,
+	"events.cursor_invalid": 400,
+	"events.cursor_expired": 410,
+	"runtime.unavailable": 503,
 	"internal.error": 500
 };
 const errorCodes = Object.keys(ERROR_CODES);
@@ -734,6 +720,45 @@ const ConversationProtocolSupportSchema = z.object({
 	producer_capabilities: z.null()
 });
 //#endregion
+//#region ../contracts/src/conversations/parts.ts
+const text = z.string().max(262144);
+const payload = JsonValueSchema.refine((value) => new TextEncoder().encode(JSON.stringify(value)).length <= 262144, "Session part payload exceeds 256 KiB");
+const ConversationPartSchema = z.discriminatedUnion("type", [
+	z.strictObject({
+		type: z.literal("text"),
+		text
+	}),
+	z.strictObject({
+		type: z.literal("tool"),
+		call_id: z.string().min(1).max(256),
+		name: z.string().min(1).max(128),
+		status: z.enum([
+			"pending",
+			"running",
+			"completed",
+			"failed",
+			"canceled"
+		]),
+		input: payload,
+		output: payload.optional(),
+		output_text: text.optional(),
+		started_at: z.iso.datetime().nullable().optional(),
+		ended_at: z.iso.datetime().nullable().optional()
+	}),
+	z.strictObject({
+		type: z.literal("error"),
+		code: z.string().min(1).max(128),
+		message: text
+	}),
+	z.strictObject({
+		type: z.literal("file"),
+		file_id: z.uuid(),
+		name: z.string().min(1).max(512),
+		media_type: z.string().min(1).max(256),
+		size_bytes: z.number().int().nonnegative()
+	})
+]);
+//#endregion
 //#region ../contracts/src/conversations/conversation.ts
 const CONVERSATION_ROLES = [
 	"user",
@@ -746,6 +771,7 @@ const ConversationMessageInputSchema = z.object({
 	message_id: z.string().min(1).max(256),
 	role: z.enum(CONVERSATION_ROLES),
 	content: z.string().max(262144),
+	parts: z.array(ConversationPartSchema).max(256).optional(),
 	occurred_at: z.iso.datetime(),
 	metadata: ConversationMetadataSchema.default({}),
 	identity: ConversationMessageIdentitySchema.nullable().optional()
@@ -789,7 +815,7 @@ const ConversationActivitySchema = z.object({
 	ended_at: z.iso.datetime().nullable(),
 	outcome: z.string().nullable()
 });
-z.object({
+const ConversationRecordDocumentSchema = z.object({
 	schema: z.literal("pocketcoder.conversation-record/v1"),
 	turn_id: z.uuid().nullable(),
 	request: ConversationRequestIdentitySchema.nullable(),
@@ -850,7 +876,10 @@ const ViewSessionSchema = z.discriminatedUnion("mode", [
 		parentOrigin: HttpsOriginSchema
 	})
 ]);
-z.strictObject({ session: ViewSessionSchema.default({ mode: "local" }) });
+z.strictObject({
+	session: ViewSessionSchema.default({ mode: "local" }),
+	grantId: z.uuid().optional()
+}).refine((input) => input.session.mode === "local" || !!input.grantId, "Cloud previews require a grant");
 //#endregion
 //#region ../contracts/src/displays/display.ts
 const DisplaySchema = z.strictObject({ mode: z.enum(["desktop", "browser"]) });
@@ -1022,7 +1051,7 @@ const ExportObjectReferenceSchema = z.strictObject({
 	mediaType: AttachmentMediaTypeSchema,
 	digest: WorkloadDigestSchema
 });
-z.strictObject({
+const WorkloadExportReferenceSchema = z.strictObject({
 	exportId: z.uuid(),
 	execution: WorkloadExecutionReferenceSchema,
 	manifestDigest: WorkloadDigestSchema,
@@ -1031,6 +1060,11 @@ z.strictObject({
 		"partial",
 		"lost"
 	]),
+	cleanupState: z.enum([
+		"not_required",
+		"pending",
+		"complete"
+	]).optional(),
 	publication: z.enum([
 		"published",
 		"unavailable",
@@ -1057,6 +1091,11 @@ z.strictObject({
 		path: ["expiresAt"],
 		message: "export retention must be positive"
 	});
+	if (value.completeness === "complete" !== (value.errors.length === 0)) ctx.addIssue({
+		code: "custom",
+		path: ["errors"],
+		message: "Export errors must agree with completeness"
+	});
 	const ids = value.objects.map((object) => object.objectId);
 	if (new Set(ids).size !== ids.length) ctx.addIssue({
 		code: "custom",
@@ -1124,6 +1163,14 @@ const PreviewSocketPayload = z.discriminatedUnion("op", [
 		request_id: z.uuid()
 	})
 ]);
+z.strictObject({
+	id: z.uuid(),
+	subject: z.string().min(1).max(256),
+	accessRevision: z.string().min(1).max(256),
+	previews: z.array(PreviewNameSchema).min(1).max(16).refine((names) => new Set(names).size === names.length, "Preview names must be unique"),
+	ceilingAt: z.iso.datetime()
+});
+z.strictObject({ accessRevision: z.string().min(1).max(256) });
 //#endregion
 //#region ../contracts/src/workspaces/workspace.ts
 const WORKSPACE_STATES = [
@@ -1170,6 +1217,7 @@ const REASON_CODES = [
 	"idle_expired",
 	"queue_timeout",
 	"launch_failed",
+	"launch_refused",
 	"preserve_requested",
 	"preserved_by_policy",
 	"checkpoint_created",
@@ -1190,7 +1238,6 @@ const AGENT_STATES = [
 	"running",
 	"stable"
 ];
-const AgentInterruptResponseSchema = z.object({ status: z.enum(["requested", "idle"]) });
 z.object({
 	external_id: z.string().min(1).max(256),
 	template: z.object({
@@ -1206,15 +1253,10 @@ const TemplateRefSchema = z.object({
 	version: z.string(),
 	digest: z.string()
 });
-const AgentMetadataSchema = z.object({
-	type: z.string(),
-	model: z.string().min(1).max(255).nullable()
-});
 const WorkspaceResourceSchema = z.object({
 	id: z.uuid(),
 	external_id: z.string(),
 	template: TemplateRefSchema,
-	agent: AgentMetadataSchema.nullable(),
 	state: z.enum(WORKSPACE_STATES),
 	reason_code: z.enum(REASON_CODES).nullable(),
 	agent_state: z.enum(AGENT_STATES),
@@ -1228,6 +1270,10 @@ const WorkspaceResourceSchema = z.object({
 	connected_at: z.iso.datetime().nullable(),
 	ready_at: z.iso.datetime().nullable(),
 	deadline_at: z.iso.datetime(),
+	lifetime: z.strictObject({
+		revision: z.number().int().positive(),
+		ceilingAt: z.iso.datetime()
+	}).optional(),
 	terminal_at: z.iso.datetime().nullable(),
 	metadata: z.record(z.string(), z.string()),
 	origin_workspace_id: z.uuid().nullable(),
@@ -1272,7 +1318,6 @@ const TemplateListItemSchema = z.object({
 	name: z.string(),
 	version: z.string(),
 	digest: z.string(),
-	agent: AgentMetadataSchema.nullable(),
 	description: z.string().optional(),
 	status: z.enum([
 		"active",
@@ -1382,7 +1427,8 @@ z.object({ name: SecretNameSchema });
 const issuerUrl = z.url().refine((value) => {
 	if (!URL.canParse(value)) return false;
 	const url = new URL(value);
-	return url.protocol === "https:" && !url.username && !url.password && !url.search && !url.hash;
+	const clusterLocal = url.protocol === "http:" && url.hostname.endsWith(".svc.cluster.local");
+	return (url.protocol === "https:" || clusterLocal) && !url.username && !url.password && !url.search && !url.hash;
 });
 const IssuerConfigSchema = z.strictObject({
 	url: issuerUrl,
@@ -1452,14 +1498,6 @@ const HarnessSchema = z.object({
 	env: EnvSchema.default({}),
 	cwd: z.string().refine(isAbsolutePath, "expected an absolute path").optional()
 });
-const AgentSchema = HarnessSchema.extend({
-	model: z.string().min(1).max(255).optional().describe("Display metadata only; does not configure the agent model."),
-	type: z.string().regex(/^[a-z0-9][a-z0-9-]{0,63}$/).default("custom"),
-	transport: z.enum(["pty", "acp"]).default("pty"),
-	termWidth: z.number().int().min(10).max(65535).optional(),
-	stateFile: z.string().refine(isAbsolutePath, "expected an absolute path").optional(),
-	interruptKeys: z.string().min(1).max(16).optional()
-});
 const TerminalSchema = z.object({
 	command: CommandSchema,
 	env: EnvSchema.default({}),
@@ -1538,7 +1576,7 @@ const CheckpointHookSchema = z.object({
 	env: EnvSchema.default({}),
 	cwd: z.string().refine(isAbsolutePath, "expected an absolute path").optional()
 });
-const TemplateSpecSchema = z.object({
+const RuntimeTemplatePolicySchema = z.object({
 	version: z.string().regex(SEMVER_RE),
 	image: z.string().regex(IMAGE_DIGEST_RE, { message: "image must be digest-pinned (repo@sha256:<64 hex>)" }),
 	imagePullSecret: z.string().refine((value) => value.startsWith("secretRef:") && SecretNameSchema.safeParse(value.slice(10)).success, "imagePullSecret must name a stored secret").optional(),
@@ -1549,7 +1587,6 @@ const TemplateSpecSchema = z.object({
 		"/run/pocketcoder/input"
 	]),
 	setup: z.array(SetupStepSchema).max(32).default([]),
-	agent: AgentSchema.optional(),
 	harness: HarnessSchema.optional(),
 	terminal: TerminalSchema.optional(),
 	previews: PreviewsSchema.optional(),
@@ -1561,59 +1598,14 @@ const TemplateSpecSchema = z.object({
 	security: SecuritySchema.prefault({}),
 	network: NetworkPolicySchema,
 	maxLaunchInputBytes: z.number().int().positive().max(1048576).default(65536),
-	compat: z.object({
-		agent: z.string().optional(),
-		agentapi: z.string().optional()
-	}).default({}),
 	persistence: PersistenceSpecSchema.prefault({}),
 	source: SourceSpecSchema.nullable().default(null),
 	checkpointHook: CheckpointHookSchema.optional(),
 	outputs: z.record(z.string().regex(NAME_RE), OutputDeclarationSchema).default({})
-}).superRefine((spec, ctx) => {
-	if (!spec.agent && !spec.harness) ctx.addIssue({
-		code: "custom",
-		path: ["harness"],
-		message: "either agent or harness is required"
-	});
-	if (!spec.agent) return;
-	if (spec.agent.transport === "acp") for (const field of [
-		"termWidth",
-		"stateFile",
-		"interruptKeys"
-	]) {
-		if (spec.agent[field] === void 0) continue;
-		ctx.addIssue({
-			code: "custom",
-			path: ["agent", field],
-			message: `${field} is only valid for PTY transport`
-		});
-	}
-	for (const field of [
-		"harness",
-		"services",
-		"checkpointHook"
-	]) {
-		if (spec[field] === void 0) continue;
-		ctx.addIssue({
-			code: "custom",
-			path: [field],
-			message: `agent cannot be combined with ${field}`
-		});
-	}
-}).transform((spec) => {
-	if (spec.agent) {
-		const { harness: _harness, services: _services, checkpointHook: _hook, ...native } = spec;
-		return {
-			...native,
-			agent: spec.agent
-		};
-	}
-	const { agent: _agent, ...legacy } = spec;
-	return {
-		...legacy,
-		harness: spec.harness,
-		services: spec.services ?? {}
-	};
+});
+const TemplateSpecSchema = RuntimeTemplatePolicySchema.extend({
+	harness: HarnessSchema,
+	services: z.record(z.string().regex(NAME_RE), ServiceSchema).default({})
 });
 const TemplateManifestBaseSchema = z.object({
 	apiVersion: z.literal("pocketcoder.dev/v1alpha1", { error: "unsupported template format for the alpha runtime; canonical workloads require an installed workload runtime" }),
@@ -1664,7 +1656,12 @@ const WaitingRuntimeSpecSchema = z.strictObject({
 	incarnationId: z.string().min(1).max(256),
 	profile: WorkloadProfileSchema,
 	operations: z.record(z.string(), HarnessSchema),
-	infrastructure: z.record(z.string(), HarnessSchema)
+	infrastructure: z.record(z.string(), HarnessSchema),
+	serviceHealth: z.record(z.string(), z.strictObject({
+		baseUrl: z.string().url(),
+		healthPath: z.string()
+	})).optional(),
+	manualServices: z.array(z.string()).optional()
 });
 const ProcessStartPayload = z.strictObject({
 	execution: ProcessReferenceSchema,
@@ -1688,6 +1685,11 @@ const ProcessCancelResultPayload = ProcessTargetPayload.extend({
 	])
 });
 //#endregion
+//#region ../contracts/src/templates/template-runtime.ts
+function templateServices(spec) {
+	return spec.services ?? {};
+}
+//#endregion
 //#region ../contracts/src/secrets/credential-slot.ts
 const CredentialSlotSchema = z.strictObject({
 	policyRef: z.string().regex(/^[a-zA-Z0-9][a-zA-Z0-9._/-]{0,254}$/).refine((value) => !value.includes("..")),
@@ -1727,22 +1729,18 @@ const WorkloadInputSchema = z.strictObject({
 //#endregion
 //#region ../contracts/src/templates/template-validation.ts
 function envSources(spec) {
-	const sources = [[["spec", "env"], spec.env], [isAgentApiNative(spec) ? [
-		"spec",
-		"agent",
-		"env"
-	] : [
+	const sources = [[["spec", "env"], spec.env], [[
 		"spec",
 		"harness",
 		"env"
-	], agentApiHarness(spec).env]];
+	], spec.harness.env]];
 	for (const [i, step] of spec.setup.entries()) sources.push([[
 		"spec",
 		"setup",
 		i,
 		"env"
 	], step.env]);
-	if (!isAgentApiNative(spec) && spec.checkpointHook) sources.push([[
+	if (spec.checkpointHook) sources.push([[
 		"spec",
 		"checkpointHook",
 		"env"
@@ -1793,10 +1791,10 @@ function validateServices$1(spec, ctx) {
 			],
 			message: "healthPath must be a normalized absolute path"
 		});
-		validateServiceRoutes(serviceName, service.routes, ctx);
+		validateServiceRoutes$1(serviceName, service.routes, ctx);
 	}
 }
-function validateServiceRoutes(serviceName, routes, ctx) {
+function validateServiceRoutes$1(serviceName, routes, ctx) {
 	const seen = /* @__PURE__ */ new Set();
 	for (const [index, route] of routes.entries()) {
 		if (!isNormalizedPath(route.path)) ctx.addIssue({
@@ -1919,7 +1917,6 @@ function validateTemplatePersistence(spec, ctx) {
 	const mounts = spec.persistence.mounts;
 	for (const [index, mount] of mounts.entries()) validatePersistenceMount(spec, mounts, mount, index, seenNames, ctx);
 	validateSourceMount(spec, mounts, ctx);
-	validateAgentStateFile(spec, mounts, ctx);
 	if (spec.persistence.conversationRestore === "supported" && (!spec.persistence.sessionCompatibility || mounts.length < 2)) ctx.addIssue({
 		code: "custom",
 		path: [
@@ -1930,43 +1927,6 @@ function validateTemplatePersistence(spec, ctx) {
 		message: "supported conversation restore requires sessionCompatibility and a separate harness-state mount"
 	});
 }
-function validateAgentStateFile(spec, mounts, ctx) {
-	if (!spec.agent) return;
-	const stateFile = spec.agent.stateFile;
-	const normalized = stateFile !== void 0 && isNormalizedFilesystemPath(stateFile);
-	if (stateFile !== void 0 && !normalized) ctx.addIssue({
-		code: "custom",
-		path: [
-			"spec",
-			"agent",
-			"stateFile"
-		],
-		message: "stateFile must be a normalized absolute filesystem path"
-	});
-	if (spec.agent.transport === "acp" && spec.persistence.conversationRestore === "supported") {
-		ctx.addIssue({
-			code: "custom",
-			path: [
-				"spec",
-				"persistence",
-				"conversationRestore"
-			],
-			message: "supported conversation restore requires PTY transport"
-		});
-		return;
-	}
-	if (spec.persistence.conversationRestore !== "supported") return;
-	if (normalized && mounts.some((mount) => stateFile.startsWith(`${mount.target}/`))) return;
-	ctx.addIssue({
-		code: "custom",
-		path: [
-			"spec",
-			"agent",
-			"stateFile"
-		],
-		message: "supported conversation restore requires agent.stateFile below a persistence mount"
-	});
-}
 function validatePersistenceMount(spec, mounts, mount, index, seenNames, ctx) {
 	const path = [
 		"spec",
@@ -2108,7 +2068,7 @@ function validateAdapters(spec, issue) {
 		const path = ["adapters", name];
 		if (adapter.kind === "service") {
 			if (!adapter.service || !Object.hasOwn(spec.services, adapter.service) || adapter.command) issue(path, "service adapters require a declared service and no process command");
-		} else if (!adapter.command || adapter.service) issue(path, "process, Pi and AgentAPI adapters require a command and no service reference");
+		} else if (!adapter.command || adapter.service) issue(path, "process and Pi adapters require a command and no service reference");
 	}
 }
 function validateProcessEnvironment(spec, issue) {
@@ -2164,16 +2124,24 @@ function validateOperations(spec, issue) {
 			"adapter"
 		], "operation must name a pinned adapter");
 		if (spec.profile === "cloud-interactive" && adapter?.kind === "process") issue(["operations", name], "cloud-interactive requires request-aware adapters");
-		for (const root of operation.outputRoots) if (!isWorkloadPath(root) || [
+		validateOutputRoots(spec, name, operation.outputRoots, issue);
+	}
+}
+function validateOutputRoots(spec, name, roots, issue) {
+	const path = [
+		"operations",
+		name,
+		"outputRoots"
+	];
+	for (const root of roots) {
+		if (!isWorkloadPath(root) || [
 			"/run",
 			"/proc",
 			"/sys",
 			"/dev"
-		].some((path) => overlaps(path, root))) issue([
-			"operations",
-			name,
-			"outputRoots"
-		], "output roots must be normalized and outside protected storage");
+		].some((base) => overlaps(base, root))) issue(path, "output roots must be normalized and outside protected storage");
+		if (spec.lifecycle?.persistence.mounts.some((mount) => overlaps(mount.target, root))) issue(path, "output roots must not overlap checkpoint storage");
+		if (roots.some((other) => other !== root && overlaps(root, other))) issue(path, "output roots must not overlap");
 	}
 }
 function serviceUrl(value) {
@@ -2192,27 +2160,32 @@ function isLoopbackService(url) {
 }
 function validateServices(spec, issue) {
 	for (const [name, service] of Object.entries(spec.services)) {
+		if (service.autostart === false && service.required) issue(["services", name], "manual services cannot be required for initial readiness");
 		const url = serviceUrl(service.baseUrl);
 		if (!url || !isLoopbackService(url)) {
 			issue(["services", name], "service must use loopback HTTP without credentials or a path");
 			continue;
 		}
-		const routes = /* @__PURE__ */ new Set();
-		if (!isNormalizedPath(service.healthPath)) issue([
+		validateServiceRoutes(name, service, issue);
+		const privateTransport = Object.values(spec.adapters).some((adapter) => adapter.service === name);
+		for (const [previewName, preview] of Object.entries(spec.previews)) if (privateTransport && preview.port === Number(url.port || 80)) issue(["previews", previewName], "preview port is reserved by a service");
+	}
+}
+function validateServiceRoutes(name, service, issue) {
+	const routes = /* @__PURE__ */ new Set();
+	if (!isNormalizedPath(service.healthPath)) issue([
+		"services",
+		name,
+		"healthPath"
+	], "health path must be normalized");
+	for (const route of service.routes) {
+		const key = `${route.method} ${route.path}`;
+		if (!isNormalizedPath(route.path) || routes.has(key)) issue([
 			"services",
 			name,
-			"healthPath"
-		], "health path must be normalized");
-		for (const route of service.routes) {
-			const key = `${route.method} ${route.path}`;
-			if (!isNormalizedPath(route.path) || routes.has(key)) issue([
-				"services",
-				name,
-				"routes"
-			], "routes must be normalized and unique");
-			routes.add(key);
-		}
-		for (const [previewName, preview] of Object.entries(spec.previews)) if (preview.port === Number(url.port || 80)) issue(["previews", previewName], "preview port is reserved by a service");
+			"routes"
+		], "routes must be normalized and unique");
+		routes.add(key);
 	}
 }
 function validateWorkloadTemplate(manifest, ctx) {
@@ -2243,8 +2216,7 @@ const WorkloadAdapterSchema = z.strictObject({
 	kind: z.enum([
 		"process",
 		"service",
-		"pi",
-		"agentapi"
+		"pi"
 	]),
 	digest: WorkloadDigestSchema,
 	protocol: z.string().min(1).max(128),
@@ -2269,11 +2241,15 @@ const WorkloadTemplateSchema = z.strictObject({
 	spec: z.strictObject({
 		version: z.string().regex(/^\d+\.\d+\.\d+(-[0-9A-Za-z.-]+)?$/),
 		image: WorkloadImageSchema,
+		imagePullSecret: RuntimeTemplatePolicySchema.shape.imagePullSecret,
 		runtime: WorkloadRuntimePinSchema,
 		profile: WorkloadProfileSchema,
 		adapters: z.record(WorkloadNameSchema, WorkloadAdapterSchema),
 		operations: z.record(WorkloadNameSchema, WorkloadOperationSchema),
-		services: z.record(WorkloadNameSchema, ServiceSchema.extend({ process: HarnessSchema.strict().optional() }).strict()),
+		services: z.record(WorkloadNameSchema, ServiceSchema.extend({
+			process: HarnessSchema.strict().optional(),
+			autostart: z.boolean().optional()
+		}).strict()),
 		previews: PreviewsSchema,
 		credentialSlots: z.record(WorkloadNameSchema, CredentialSlotSchema),
 		resources: ResourcesSchema.strict(),
@@ -2300,65 +2276,6 @@ const WorkloadTemplateSnapshotSchema = z.strictObject({
 		message: "snapshot identity does not match its immutable manifest"
 	});
 });
-//#endregion
-//#region ../contracts/src/templates/template-runtime.ts
-const LEGACY_AGENTAPI_SERVICE = ServiceSchema.parse({
-	baseUrl: "http://127.0.0.1:3284",
-	routes: [
-		{
-			method: "GET",
-			path: "/status"
-		},
-		{
-			method: "GET",
-			path: "/messages",
-			query: ["after"]
-		},
-		{
-			method: "POST",
-			path: "/message"
-		}
-	]
-});
-const AGENTAPI_SERVICE = ServiceSchema.parse({
-	...LEGACY_AGENTAPI_SERVICE,
-	routes: [...LEGACY_AGENTAPI_SERVICE.routes, {
-		method: "GET",
-		path: "/events",
-		responseMode: "stream",
-		maxResponseBytes: 4194304,
-		deadlineSeconds: 300
-	}]
-});
-function isAgentApiNative(spec) {
-	return "agent" in spec && spec.agent !== void 0;
-}
-function agentApiHarness(spec) {
-	if (!isAgentApiNative(spec)) {
-		if (!spec.harness) throw new Error("A workload infrastructure process is not an alpha harness.");
-		return spec.harness;
-	}
-	return {
-		command: [
-			"/usr/local/bin/agentapi",
-			"server",
-			"--type",
-			spec.agent.type,
-			...spec.agent.transport === "acp" ? ["--experimental-acp"] : [],
-			...spec.agent.termWidth === void 0 ? [] : ["--term-width", String(spec.agent.termWidth)],
-			...spec.agent.stateFile === void 0 ? [] : ["--state-file", spec.agent.stateFile],
-			"--port",
-			"3284",
-			"--",
-			...spec.agent.command
-		],
-		env: spec.agent.env,
-		...spec.agent.cwd ? { cwd: spec.agent.cwd } : {}
-	};
-}
-function templateServices(spec) {
-	return isAgentApiNative(spec) ? { agent: AGENTAPI_SERVICE } : spec.services ?? {};
-}
 z.object({
 	name: z.string(),
 	version: z.string(),
@@ -2428,7 +2345,6 @@ const CheckpointUploadStatusPayload = z.object({
 const SOURCE_CREDENTIAL_MAX_BYTES = 65536;
 const RestoreModeSchema = z.enum(["provider_installed", "controller_archive"]);
 const ExecSpecSchema = z.object({
-	agentapi_native: z.boolean().default(false),
 	setup: z.array(SetupStepSchema),
 	harness: HarnessSchema.nullable(),
 	workload: WaitingRuntimeSpecSchema.optional(),
@@ -2599,7 +2515,8 @@ const TerminalSessionPageSchema = CursorPageSchema(TerminalSessionSchema);
 //#region ../contracts/src/protocol/protocol-credentials.ts
 const WorkspaceCredentialSchema = z.object({
 	lease_id: z.uuid(),
-	path: z.string().regex(/^\/run\/pocketcoder\/secrets\/leases\/[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/),
+	path: z.string().regex(/^\/run\/pocketcoder\/secrets\/leases\/(?:sessions\/[0-9a-f-]{36}\/)?[A-Za-z0-9][A-Za-z0-9_.%-]{0,127}$/),
+	session_id: z.uuid().optional(),
 	credential: z.string().min(1).max(SOURCE_CREDENTIAL_MAX_BYTES).refine((value) => !value.includes("\0")),
 	expires_at: z.iso.datetime(),
 	purpose: z.enum(["setup-issuer", "runtime-issuer"])
@@ -2617,6 +2534,9 @@ const CredentialInstalledPayload = z.object({
 	previous_lease_id: z.uuid(),
 	lease_id: z.uuid()
 });
+const CredentialInstallPayload = z.object({ credentials: z.array(WorkspaceCredentialSchema).min(1).max(64) });
+const CredentialRemovePayload = z.object({ session_id: z.uuid() });
+const CredentialInstallAckPayload = z.object({ lease_ids: z.array(z.uuid()).min(1).max(64) });
 //#endregion
 //#region ../contracts/src/protocol/protocol-stream.ts
 const ProxyStreamStartPayload = z.object({
@@ -2705,7 +2625,9 @@ const EnvelopeBase = z.object({
 		z.literal(10),
 		z.literal(11),
 		z.literal(12),
-		z.literal(13)
+		z.literal(13),
+		z.literal(14),
+		z.literal(15)
 	]),
 	workspace_id: z.uuid(),
 	connection_id: z.uuid(),
@@ -2719,25 +2641,17 @@ const RegisteredPayload = z.object({
 		version: z.string(),
 		digest: z.string()
 	}),
-	agentapi_version: z.string().optional(),
 	services: z.array(z.string()),
 	pid: z.number().int().positive()
 });
-const HeartbeatPayload = z.object({
-	child: z.enum([
-		"starting",
-		"setup",
-		"waiting",
-		"running",
-		"exited",
-		"terminating"
-	]),
-	agentapi_state: z.enum([
-		"unknown",
-		"stable",
-		"running"
-	]).optional()
-});
+const HeartbeatPayload = z.object({ child: z.enum([
+	"starting",
+	"setup",
+	"waiting",
+	"running",
+	"exited",
+	"terminating"
+]) });
 const ProcessStatePayload = z.object({
 	phase: z.enum([
 		"starting",
@@ -2852,6 +2766,10 @@ z.discriminatedUnion("type", [
 		type: z.literal("credential_installed"),
 		payload: CredentialInstalledPayload
 	}),
+	EnvelopeBase.extend({
+		type: z.literal("credential_install_ack"),
+		payload: CredentialInstallAckPayload
+	}),
 	EnvelopeBase.extend({
 		type: z.literal("setup_complete"),
 		payload: z.object({ request_id: z.uuid() })
@@ -3031,6 +2949,14 @@ z.discriminatedUnion("type", [
 		type: z.literal("credential_installed_ack"),
 		payload: CredentialInstalledPayload
 	}),
+	EnvelopeBase.extend({
+		type: z.literal("credential_install"),
+		payload: CredentialInstallPayload
+	}),
+	EnvelopeBase.extend({
+		type: z.literal("credential_remove"),
+		payload: CredentialRemovePayload
+	}),
 	EnvelopeBase.extend({
 		type: z.literal("setup_complete_ack"),
 		payload: z.object({ request_id: z.uuid() })
@@ -3140,82 +3066,750 @@ z.strictObject({
 	root: fileIdentity,
 	lock: fileIdentity
 });
-z.strictObject({ manifest: z.union([TemplateManifestSchema, WorkloadTemplateSchema]) });
-z.object({
-	name: z.string().regex(/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/),
-	version: z.string().min(1).max(256)
+//#endregion
+//#region ../contracts/src/budgets/policy.ts
+const BudgetPolicyWriteSchema = z.strictObject({
+	scopeId: z.uuid(),
+	revision: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER),
+	period: z.enum(["utc_day", "utc_month"]),
+	limits: z.strictObject({
+		workspaceStarts: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER).nullable(),
+		maxActiveWorkspaces: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER).nullable(),
+		maxRunningRequestsPerSession: z.literal(1),
+		maxChatProcessesPerWorkspace: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER)
+	})
 });
-z.strictObject({
+const BudgetPolicySchema = BudgetPolicyWriteSchema.extend({ effectiveAt: z.iso.datetime({ offset: true }) });
+//#endregion
+//#region ../contracts/src/budgets/usage.ts
+const BudgetUsageSchema = z.strictObject({
+	scopeId: z.uuid(),
+	policyRevision: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER),
+	periodStart: z.iso.datetime({ offset: true }),
+	periodEnd: z.iso.datetime({ offset: true }),
+	workspaceStarts: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+	activeWorkspaces: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+	asOf: z.iso.datetime({ offset: true })
+});
+const CleanupReceiptFieldsSchema = z.strictObject({
+	workspaceId: z.uuid(),
+	generationId: z.string().min(1).max(256),
+	revision: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER),
+	state: z.enum(["pending", "proved"]),
+	basis: z.enum([
+		"never_launched",
+		"processes_exited",
+		"provider_fenced"
+	]).nullable(),
+	observedAt: z.iso.datetime({ offset: true }),
+	capacityReleasedAt: z.iso.datetime({ offset: true }).nullable()
+});
+const CleanupReceiptSchema = z.union([CleanupReceiptFieldsSchema.extend({
+	state: z.literal("pending"),
+	basis: z.null(),
+	capacityReleasedAt: z.null()
+}), CleanupReceiptFieldsSchema.extend({
+	state: z.literal("proved"),
+	basis: z.enum([
+		"never_launched",
+		"processes_exited",
+		"provider_fenced"
+	])
+})]);
+//#endregion
+//#region ../contracts/src/workspaces/lifetime.ts
+const LifetimeExtensionSchema = z.strictObject({
+	extensionId: z.uuid(),
+	expectedRevision: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+	deadlineAt: z.iso.datetime()
+});
+const LifetimeReceiptSchema = LifetimeExtensionSchema.extend({
+	workspaceId: z.uuid(),
+	revision: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+	ceilingAt: z.iso.datetime()
+});
+//#endregion
+//#region ../contracts/src/workspaces/service-control.ts
+const ServiceStartSchema = z.strictObject({ startId: z.uuid() });
+const ServiceReceiptSchema = z.strictObject({
 	workspaceId: z.uuid(),
 	incarnationId: z.string().min(1).max(256),
-	profiles: z.array(WorkloadProfileSchema),
-	storageProfiles: z.array(z.enum(["controller-readonly/v1", "shared-writer-readonly/v1"])),
-	ceilings: WorkloadLimitsSchema,
-	now: z.iso.datetime(),
-	expiresAt: z.iso.datetime(),
-	installed: InstalledWorkloadSchema.optional()
+	name: z.string().regex(/^[a-z][a-z0-9-]{0,62}$/),
+	startId: z.uuid().nullable(),
+	attemptId: z.uuid().nullable(),
+	state: z.enum([
+		"stopped",
+		"starting",
+		"running",
+		"exited",
+		"lost"
+	]),
+	pid: z.number().int().positive().nullable(),
+	exitCode: z.number().int().nullable(),
+	listener: z.enum([
+		"unknown",
+		"healthy",
+		"unhealthy"
+	])
 });
 //#endregion
-//#region ../contracts/src/workspaces/execution-dispatch.ts
-const ExecutionPhaseSchema = z.enum([
-	"accepted",
-	"dispatching",
-	"running",
-	"terminal",
-	"canceled",
-	"unknown",
-	"lost"
-]);
-z.strictObject({
-	acceptance: WorkloadAcceptanceSchema,
-	conversationIdentity: ConversationRequestIdentitySchema.nullable(),
-	outcome: JsonValueSchema.nullable(),
-	acceptedAt: z.iso.datetime(),
-	dispatchClaimedAt: z.iso.datetime().nullable(),
-	phase: ExecutionPhaseSchema,
-	cancel: z.strictObject({
-		cancelId: z.uuid(),
-		requestedAt: z.iso.datetime()
-	}).nullable(),
-	settledAt: z.iso.datetime().nullable(),
-	acknowledgedAt: z.iso.datetime().nullable(),
-	finalizedAt: z.iso.datetime().nullable()
+//#region ../contracts/src/sessions/files.ts
+const MAX_SESSION_FILE_REFERENCES = 1e3;
+const InputReferenceSchema = z.strictObject({
+	inputId: z.uuid(),
+	versionId: z.uuid(),
+	sha256: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+	name: z.string().min(1).max(255),
+	mediaType: AttachmentMediaTypeSchema,
+	sizeBytes: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER)
 });
-z.strictObject({
-	acceptance: WorkloadAcceptanceSchema,
-	conversationIdentity: ConversationRequestIdentitySchema.optional()
-}).refine(({ acceptance, conversationIdentity }) => acceptance.execution.owner !== "conversation-request" || conversationIdentity !== void 0, {
-	path: ["conversationIdentity"],
-	message: "Conversation execution requires a conversation identity."
+const InputUploadSchema = z.strictObject({
+	inputId: z.uuid(),
+	name: z.string().min(1).max(255),
+	mediaType: AttachmentMediaTypeSchema,
+	sizeBytes: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+	sha256: z.string().regex(/^sha256:[a-f0-9]{64}$/)
 });
-WorkloadCancelSchema.refine((cancel) => cancel.scope === "operation", { message: "Use workspace release for workspace cancellation" });
-z.strictObject({
-	workspaceId: z.uuid(),
-	callerPrincipalId: z.uuid(),
-	incarnationId: z.string().min(1),
-	template: WorkloadTemplateSnapshotSchema,
-	producer: InstalledWorkloadSchema,
-	readyAt: z.iso.datetime().nullable(),
-	endedAt: z.iso.datetime().nullable()
+const InputObjectSchema = z.strictObject({
+	sessionId: z.uuid(),
+	reference: InputReferenceSchema,
+	state: z.enum([
+		"uploading",
+		"ready",
+		"rejected",
+		"expired"
+	]),
+	expiresAt: z.iso.datetime({ offset: true })
 });
-z.discriminatedUnion("phase", [z.strictObject({
-	execution: WorkloadExecutionReferenceSchema,
-	phase: z.literal("absent")
-}), z.strictObject({
-	execution: WorkloadExecutionReferenceSchema,
-	fingerprint: WorkloadDigestSchema,
-	phase: z.enum([
+const ExportObjectSchema = z.strictObject({
+	exportId: z.uuid(),
+	sessionId: z.uuid(),
+	requestId: z.uuid(),
+	versionId: z.uuid(),
+	sha256: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+	name: z.string().min(1).max(255),
+	mediaType: AttachmentMediaTypeSchema,
+	sizeBytes: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER),
+	completeness: z.enum(["complete", "partial"]),
+	availability: z.enum([
+		"published",
+		"expired",
+		"unavailable"
+	]),
+	expiresAt: z.iso.datetime({ offset: true })
+});
+//#endregion
+//#region ../contracts/src/sessions/collection.ts
+const fields = z.strictObject({
+	sessionId: z.uuid(),
+	requestId: z.uuid(),
+	revision: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER),
+	state: z.enum([
+		"pending",
+		"finalizing",
+		"settled"
+	]),
+	completeness: z.enum([
+		"complete",
+		"partial",
+		"lost"
+	]).nullable(),
+	manifestDigest: z.string().regex(/^sha256:[a-f0-9]{64}$/).nullable(),
+	objects: z.array(ExportObjectSchema).max(MAX_SESSION_FILE_REFERENCES),
+	errors: z.array(z.string().min(1).max(512)).max(100),
+	settledAt: z.iso.datetime({ offset: true }).nullable(),
+	expiresAt: z.iso.datetime({ offset: true }).nullable(),
+	cleanupState: z.enum([
+		"not_required",
+		"pending",
+		"complete"
+	])
+});
+const CollectionResultSchema = z.union([fields.extend({
+	state: z.enum(["pending", "finalizing"]),
+	completeness: z.null(),
+	manifestDigest: z.null(),
+	settledAt: z.null(),
+	expiresAt: z.null()
+}), fields.extend({
+	state: z.literal("settled"),
+	completeness: z.enum([
+		"complete",
+		"partial",
+		"lost"
+	]),
+	manifestDigest: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+	settledAt: z.iso.datetime({ offset: true }),
+	expiresAt: z.iso.datetime({ offset: true })
+})]).superRefine((value, ctx) => {
+	if (value.completeness && value.completeness === "complete" !== (value.errors.length === 0)) ctx.addIssue({
+		code: "custom",
+		path: ["errors"],
+		message: "Collection errors must agree with completeness"
+	});
+	for (const object of value.objects) if (object.sessionId !== value.sessionId || object.requestId !== value.requestId) ctx.addIssue({
+		code: "custom",
+		path: ["objects"],
+		message: "Collection object owner mismatch"
+	});
+});
+//#endregion
+//#region ../contracts/src/sessions/profile.ts
+const ExecutionProfileSchema = z.strictObject({
+	profileId: z.uuid(),
+	revision: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER),
+	isolationScopeId: z.uuid(),
+	budgetScopeIds: z.array(z.uuid()).min(1).max(1e3).refine((items) => new Set(items).size === items.length, "Values must be unique"),
+	templateDigest: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+	credentialBindingId: z.uuid().nullable(),
+	credentialPlacement: z.enum(["exclusive", "shared"]).optional()
+}).refine((profile) => profile.credentialBindingId !== null || profile.credentialPlacement === void 0, {
+	message: "Only a credentialed profile can choose its credential placement",
+	path: ["credentialPlacement"]
+});
+const SessionCreateSchema = z.strictObject({
+	sessionId: z.uuid(),
+	profileId: z.uuid(),
+	profileRevision: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER)
+});
+const SessionSchema = z.strictObject({
+	sessionId: z.uuid(),
+	profileId: z.uuid(),
+	profileRevision: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER),
+	revision: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER),
+	state: z.enum([
+		"provisioning",
+		"ready",
+		"suspended",
+		"closed",
+		"failed"
+	]),
+	reasonCode: z.string().min(1).max(256).nullable(),
+	createdAt: z.iso.datetime({ offset: true }),
+	updatedAt: z.iso.datetime({ offset: true })
+});
+//#endregion
+//#region ../contracts/src/sessions/request.ts
+const RequestInputSchema = z.strictObject({
+	requestId: z.uuid(),
+	message: z.string().min(1).max(262144).refine((value) => value.isWellFormed(), "Message must contain valid Unicode").refine((value) => new TextEncoder().encode(value).length <= 262144, "Message exceeds 256 KiB UTF-8"),
+	attachments: z.array(InputReferenceSchema).max(MAX_SESSION_FILE_REFERENCES),
+	dispatchDeadline: z.iso.datetime({ offset: true })
+});
+const RequestFieldsSchema = z.strictObject({
+	sessionId: z.uuid(),
+	requestId: z.uuid(),
+	turnId: z.uuid(),
+	inputFingerprint: z.string().regex(/^sha256:[a-f0-9]{64}$/),
+	revision: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER),
+	state: z.enum([
 		"accepted",
+		"waiting",
 		"running",
-		"terminal",
-		"canceled"
+		"checking_outcome",
+		"terminal"
 	]),
-	outcome: JsonValueSchema.nullable()
-})]);
-WorkloadCancelSchema.extend({ fingerprint: WorkloadDigestSchema });
-//#endregion
-//#region src/resources/admin/admin.ts
-var AdministrationApi = class {
+	outcome: z.enum([
+		"completed",
+		"failed",
+		"canceled",
+		"interrupted",
+		"lost"
+	]).nullable(),
+	reasonCode: z.string().min(1).max(256).nullable(),
+	acceptedAt: z.iso.datetime({ offset: true }),
+	startedAt: z.iso.datetime({ offset: true }).nullable(),
+	endedAt: z.iso.datetime({ offset: true }).nullable(),
+	dispatchDeadline: z.iso.datetime({ offset: true }),
+	collection: CollectionResultSchema,
+	finalResponse: z.string().max(1048576).nullable()
+});
+const RequestSchema = z.union([RequestFieldsSchema.extend({
+	state: z.literal("terminal"),
+	outcome: z.enum([
+		"completed",
+		"failed",
+		"canceled",
+		"interrupted",
+		"lost"
+	])
+}), RequestFieldsSchema.extend({
+	state: z.enum([
+		"accepted",
+		"waiting",
+		"running",
+		"checking_outcome"
+	]),
+	outcome: z.null(),
+	endedAt: z.null()
+})]).superRefine((request, ctx) => {
+	if (request.sessionId !== request.collection.sessionId || request.requestId !== request.collection.requestId) ctx.addIssue({
+		code: "custom",
+		path: ["collection"],
+		message: "Collection owner mismatch"
+	});
+});
+const CancelCommandSchema = z.strictObject({ cancelId: z.uuid() });
+const CancelReceiptFieldsSchema = z.strictObject({
+	sessionId: z.uuid(),
+	requestId: z.uuid().nullable(),
+	cancelId: z.uuid(),
+	scope: z.enum(["request", "session"]),
+	state: z.enum(["pending", "completed"]),
+	acceptedAt: z.iso.datetime({ offset: true }),
+	completedAt: z.iso.datetime({ offset: true }).nullable(),
+	cancelDeadline: z.iso.datetime({ offset: true })
+});
+const CancelReceiptSchema = z.union([CancelReceiptFieldsSchema.extend({
+	scope: z.literal("request"),
+	requestId: z.uuid()
+}), CancelReceiptFieldsSchema.extend({
+	scope: z.literal("session"),
+	requestId: z.null()
+})]).superRefine((receipt, ctx) => {
+	if (receipt.state === "completed" !== (receipt.completedAt !== null)) ctx.addIssue({
+		code: "custom",
+		path: ["completedAt"],
+		message: "Completion time must agree with state"
+	});
+});
+//#endregion
+//#region ../contracts/src/sessions/event.ts
+const RuntimeEventFieldsSchema = z.strictObject({
+	eventId: z.uuid(),
+	cursor: z.string().min(1).max(256),
+	sessionId: z.uuid(),
+	requestId: z.uuid().nullable(),
+	sequence: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER),
+	revision: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER),
+	occurredAt: z.iso.datetime({ offset: true }).nullable(),
+	recordedAt: z.iso.datetime({ offset: true }),
+	kind: z.enum([
+		"session.updated",
+		"request.updated",
+		"output.published"
+	]),
+	data: z.union([
+		SessionSchema,
+		RequestSchema,
+		ExportObjectSchema
+	])
+});
+const RuntimeEventSchema = z.discriminatedUnion("kind", [
+	RuntimeEventFieldsSchema.extend({
+		kind: z.literal("session.updated"),
+		requestId: z.null(),
+		data: SessionSchema
+	}),
+	RuntimeEventFieldsSchema.extend({
+		kind: z.literal("request.updated"),
+		requestId: z.uuid(),
+		data: RequestSchema
+	}),
+	RuntimeEventFieldsSchema.extend({
+		kind: z.literal("output.published"),
+		requestId: z.uuid(),
+		data: ExportObjectSchema
+	})
+]).superRefine((event, ctx) => {
+	if (event.sessionId !== event.data.sessionId) ctx.addIssue({
+		code: "custom",
+		path: ["sessionId"],
+		message: "Session identity mismatch"
+	});
+	if (event.kind !== "session.updated" && event.requestId !== event.data.requestId) ctx.addIssue({
+		code: "custom",
+		path: ["requestId"],
+		message: "Request identity mismatch"
+	});
+	if (event.kind !== "output.published" && event.revision !== event.data.revision) ctx.addIssue({
+		code: "custom",
+		path: ["revision"],
+		message: "Resource revision mismatch"
+	});
+});
+const ErrorSchema = z.strictObject({ error: z.strictObject({
+	code: z.string().min(1).max(256),
+	message: z.string().max(512),
+	retry: z.enum([
+		"never",
+		"same_identity",
+		"after_capacity_change",
+		"reconcile"
+	]),
+	retryAfterSeconds: z.number().int().min(0).max(Number.MAX_SAFE_INTEGER).nullable(),
+	requestId: z.uuid().nullable()
+}) });
+//#endregion
+//#region ../contracts/src/sessions/fingerprint.ts
+const LogicalRequestInputSchema = RequestInputSchema.extend({
+	sessionId: z.uuid(),
+	profileId: z.uuid(),
+	profileRevision: z.number().int().positive().max(Number.MAX_SAFE_INTEGER)
+}).superRefine((input, ctx) => {
+	for (const [index, attachment] of input.attachments.entries()) for (const field of ["name", "mediaType"]) if (!attachment[field].isWellFormed()) ctx.addIssue({
+		code: "custom",
+		path: [
+			"attachments",
+			index,
+			field
+		],
+		message: "Invalid Unicode"
+	});
+});
+function fingerprintRequest(input) {
+	return digestOf(LogicalRequestInputSchema.parse(input));
+}
+//#endregion
+//#region ../contracts/src/sessions/pages.ts
+const ManagedHistoryQuerySchema = z.strictObject({
+	cursor: z.string().min(1).max(4096).optional(),
+	limit: z.number().int().min(1).max(200).optional()
+});
+const ManagedHistoryPageSchema = z.strictObject({
+	records: z.array(ConversationRecordDocumentSchema),
+	nextCursor: z.string().min(1).max(4096).nullable(),
+	eventCursor: z.string().min(1).max(4096)
+});
+const ManagedExportPageSchema = z.strictObject({
+	items: z.array(ExportObjectSchema),
+	nextCursor: z.string().min(1).max(4096).nullable()
+});
+//#endregion
+//#region ../contracts/src/sessions/placement.ts
+function managedPlacement(principalId, sessionId, input) {
+	const profile = ExecutionProfileSchema.parse(input);
+	const mode = profile.credentialBindingId === null || profile.credentialPlacement === "shared" ? "shared" : "exclusive";
+	return {
+		mode,
+		key: digestOf({
+			principalId,
+			profile,
+			sessionId: mode === "exclusive" ? sessionId : null
+		})
+	};
+}
+const MANAGED_SESSION_METADATA = "pocketcoder.managed-session";
+//#endregion
+//#region ../contracts/src/sessions/provisioning.ts
+const BudgetScopeGrantSchema = z.strictObject({
+	principalId: z.uuid(),
+	installation: z.boolean()
+});
+const CredentialBindingSchema = z.strictObject({
+	bindingId: z.uuid(),
+	principalId: z.uuid(),
+	secretName: z.string().min(1).max(128),
+	secretVersionId: z.uuid().optional(),
+	slots: z.array(z.string().min(1).max(128)).min(1).max(100),
+	authorityExpiresAt: z.iso.datetime({ offset: true })
+});
+//#endregion
+//#region ../contracts/src/sessions/states.ts
+const requestTransitions = {
+	accepted: [
+		"waiting",
+		"running",
+		"checking_outcome",
+		"terminal"
+	],
+	waiting: [
+		"running",
+		"checking_outcome",
+		"terminal"
+	],
+	running: ["checking_outcome", "terminal"],
+	checking_outcome: ["running", "terminal"],
+	terminal: []
+};
+const sessionTransitions = {
+	provisioning: [
+		"ready",
+		"suspended",
+		"closed",
+		"failed"
+	],
+	ready: [
+		"provisioning",
+		"suspended",
+		"closed",
+		"failed"
+	],
+	suspended: [
+		"provisioning",
+		"closed",
+		"failed"
+	],
+	closed: [],
+	failed: ["provisioning", "closed"]
+};
+const canTransitionRequest = (from, to) => requestTransitions[from].includes(to);
+const canTransitionSession = (from, to) => sessionTransitions[from].includes(to);
+const ManagedQueueLimitsSchema = z.strictObject({
+	requests: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+	bytes: z.number().int().positive().max(Number.MAX_SAFE_INTEGER)
+});
+//#endregion
+//#region ../contracts/src/sessions/schemas.ts
+const MANAGED_CONTRACT_REVISION = "pocketcoder.managed/v1";
+const managedSchemas = {
+	ExecutionProfile: ExecutionProfileSchema,
+	BudgetScopeGrant: BudgetScopeGrantSchema,
+	CredentialBinding: CredentialBindingSchema,
+	SessionCreate: SessionCreateSchema,
+	Session: SessionSchema,
+	InputReference: InputReferenceSchema,
+	InputUpload: InputUploadSchema,
+	InputObject: InputObjectSchema,
+	ExportObject: ExportObjectSchema,
+	CollectionResult: CollectionResultSchema,
+	RequestInput: RequestInputSchema,
+	Request: RequestSchema,
+	CancelCommand: CancelCommandSchema,
+	CancelReceipt: CancelReceiptSchema,
+	RuntimeEvent: RuntimeEventSchema,
+	Error: ErrorSchema,
+	WireError: ErrorEnvelopeSchema,
+	BudgetPolicy: BudgetPolicySchema,
+	BudgetPolicyWrite: BudgetPolicyWriteSchema,
+	BudgetUsage: BudgetUsageSchema,
+	CleanupReceipt: CleanupReceiptSchema,
+	HistoryPage: ManagedHistoryPageSchema,
+	OpenTurns: z.object({ turns: z.array(ConversationLiveEventSchema) }),
+	ExportPage: ManagedExportPageSchema,
+	ServiceStart: ServiceStartSchema,
+	ServiceReceipt: ServiceReceiptSchema,
+	LifetimeExtension: LifetimeExtensionSchema,
+	LifetimeReceipt: LifetimeReceiptSchema,
+	QueueLimits: ManagedQueueLimitsSchema
+};
+//#endregion
+//#region ../contracts/src/sessions/index.ts
+var sessions_exports = /* @__PURE__ */ __exportAll({
+	BudgetPolicySchema: () => BudgetPolicySchema,
+	BudgetPolicyWriteSchema: () => BudgetPolicyWriteSchema,
+	BudgetUsageSchema: () => BudgetUsageSchema,
+	CancelCommandSchema: () => CancelCommandSchema,
+	CancelReceiptSchema: () => CancelReceiptSchema,
+	CleanupReceiptSchema: () => CleanupReceiptSchema,
+	CollectionResultSchema: () => CollectionResultSchema,
+	ErrorSchema: () => ErrorSchema,
+	ExecutionProfileSchema: () => ExecutionProfileSchema,
+	ExportObjectSchema: () => ExportObjectSchema,
+	InputObjectSchema: () => InputObjectSchema,
+	InputReferenceSchema: () => InputReferenceSchema,
+	InputUploadSchema: () => InputUploadSchema,
+	LifetimeExtensionSchema: () => LifetimeExtensionSchema,
+	LifetimeReceiptSchema: () => LifetimeReceiptSchema,
+	LogicalRequestInputSchema: () => LogicalRequestInputSchema,
+	MANAGED_CONTRACT_REVISION: () => MANAGED_CONTRACT_REVISION,
+	MANAGED_SESSION_METADATA: () => MANAGED_SESSION_METADATA,
+	MAX_SESSION_FILE_REFERENCES: () => MAX_SESSION_FILE_REFERENCES,
+	ManagedExportPageSchema: () => ManagedExportPageSchema,
+	ManagedHistoryPageSchema: () => ManagedHistoryPageSchema,
+	ManagedHistoryQuerySchema: () => ManagedHistoryQuerySchema,
+	ManagedQueueLimitsSchema: () => ManagedQueueLimitsSchema,
+	RequestInputSchema: () => RequestInputSchema,
+	RequestSchema: () => RequestSchema,
+	RuntimeEventSchema: () => RuntimeEventSchema,
+	ServiceReceiptSchema: () => ServiceReceiptSchema,
+	ServiceStartSchema: () => ServiceStartSchema,
+	SessionCreateSchema: () => SessionCreateSchema,
+	SessionSchema: () => SessionSchema,
+	canTransitionRequest: () => canTransitionRequest,
+	canTransitionSession: () => canTransitionSession,
+	fingerprintRequest: () => fingerprintRequest,
+	managedPlacement: () => managedPlacement,
+	managedSchemas: () => managedSchemas
+});
+//#endregion
+//#region ../contracts/src/templates/session-template.ts
+function sessionTemplate(input) {
+	const protocol = "pocketcoder.execution/v1";
+	const { producer } = input;
+	return WorkloadTemplateSchema.parse({
+		apiVersion: "pocketcoder.dev/v1",
+		kind: "Template",
+		metadata: { name: input.name },
+		spec: {
+			version: input.version,
+			image: input.image,
+			profile: "service",
+			runtime: {
+				protocol: "pocketcoder.workload/v1",
+				digest: input.runtimeDigest
+			},
+			adapters: { session: {
+				kind: "service",
+				digest: producer.digest,
+				protocol,
+				service: "session",
+				env: {}
+			} },
+			operations: { message: {
+				adapter: "session",
+				inputSchema: {
+					type: "object",
+					properties: { message: { type: "string" } },
+					required: ["message"],
+					additionalProperties: false
+				},
+				requiredCapabilities: [
+					"request-lookup",
+					"deduplicated-accept",
+					"targeted-cancel"
+				],
+				outputRoots: []
+			} },
+			services: { session: {
+				...ServiceSchema.parse({
+					baseUrl: "http://127.0.0.1:3284",
+					healthPath: "/healthz",
+					routes: [
+						"accept",
+						"lookup",
+						"cancel",
+						"ack"
+					].map((action) => ({
+						method: "POST",
+						path: `/executions/${action}`,
+						maxRequestBytes: 1048576,
+						maxResponseBytes: 8388608,
+						deadlineSeconds: 30
+					}))
+				}),
+				process: {
+					command: producer.command,
+					env: producer.env ?? {},
+					...producer.cwd ? { cwd: producer.cwd } : {}
+				}
+			} },
+			previews: {},
+			credentialSlots: {},
+			resources: {
+				cpu: "1",
+				memory: "1Gi"
+			},
+			network: { mode: "unrestricted" },
+			security: SecuritySchema.parse({ writableMemoryPaths: ["/tmp"] }),
+			lifecycle: { timeouts: TimeoutsSchema.parse({}) },
+			limits: {
+				deadlineSeconds: 7200,
+				finalizationSeconds: 30,
+				inputFileBytes: 16777216,
+				stagedInputBytes: 67108864,
+				inputFiles: 100,
+				inFlightTransfers: 2,
+				exportBytes: 16777216,
+				exportFiles: 100,
+				unreferencedInputRetentionSeconds: 3600,
+				exportRetentionSeconds: 86400
+			}
+		}
+	});
+}
+z.strictObject({ manifest: z.union([TemplateManifestSchema, WorkloadTemplateSchema]) });
+z.object({
+	name: z.string().regex(/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/),
+	version: z.string().min(1).max(256)
+});
+z.strictObject({
+	workspaceId: z.uuid(),
+	incarnationId: z.string().min(1).max(256),
+	profiles: z.array(WorkloadProfileSchema),
+	storageProfiles: z.array(z.enum(["controller-readonly/v1", "shared-writer-readonly/v1"])),
+	ceilings: WorkloadLimitsSchema,
+	now: z.iso.datetime(),
+	expiresAt: z.iso.datetime(),
+	installed: InstalledWorkloadSchema.optional()
+});
+z.strictObject({
+	requestId: z.uuid(),
+	conversationId: z.uuid(),
+	message: z.string().min(1).max(262144),
+	files: z.array(InputObjectReferenceSchema).max(1e3)
+});
+//#endregion
+//#region ../contracts/src/workspaces/execution-dispatch.ts
+const ExecutionPhaseSchema = z.enum([
+	"accepted",
+	"dispatching",
+	"running",
+	"terminal",
+	"canceled",
+	"unknown",
+	"lost"
+]);
+const ExecutionRecordSchema = z.strictObject({
+	acceptance: WorkloadAcceptanceSchema,
+	conversationIdentity: ConversationRequestIdentitySchema.nullable(),
+	outcome: JsonValueSchema.nullable(),
+	acceptedAt: z.iso.datetime(),
+	dispatchClaimedAt: z.iso.datetime().nullable(),
+	producerSendClaimedAt: z.iso.datetime().optional(),
+	finalizationBasis: z.enum([
+		"never_sent",
+		"producer_acknowledged",
+		"runtime_fenced"
+	]).optional(),
+	phase: ExecutionPhaseSchema,
+	cancel: z.strictObject({
+		cancelId: z.uuid(),
+		requestedAt: z.iso.datetime()
+	}).nullable(),
+	settledAt: z.iso.datetime().nullable(),
+	acknowledgedAt: z.iso.datetime().nullable(),
+	finalizedAt: z.iso.datetime().nullable(),
+	collection: WorkloadExportReferenceSchema.optional(),
+	publicationComplete: z.boolean().optional()
+});
+z.strictObject({
+	acceptance: WorkloadAcceptanceSchema,
+	conversationIdentity: ConversationRequestIdentitySchema.optional()
+}).refine(({ acceptance, conversationIdentity }) => acceptance.execution.owner !== "conversation-request" || conversationIdentity !== void 0, {
+	path: ["conversationIdentity"],
+	message: "Conversation execution requires a conversation identity."
+});
+WorkloadCancelSchema.refine((cancel) => cancel.scope === "operation", { message: "Use workspace release for workspace cancellation" });
+z.strictObject({
+	workspaceId: z.uuid(),
+	callerPrincipalId: z.uuid(),
+	incarnationId: z.string().min(1),
+	template: WorkloadTemplateSnapshotSchema,
+	producer: InstalledWorkloadSchema,
+	readyAt: z.iso.datetime().nullable(),
+	endedAt: z.iso.datetime().nullable()
+});
+z.discriminatedUnion("phase", [z.strictObject({
+	execution: WorkloadExecutionReferenceSchema,
+	phase: z.literal("absent")
+}), z.strictObject({
+	execution: WorkloadExecutionReferenceSchema,
+	fingerprint: WorkloadDigestSchema,
+	phase: z.enum([
+		"accepted",
+		"running",
+		"terminal",
+		"canceled"
+	]),
+	outcome: JsonValueSchema.nullable(),
+	messages: z.array(ConversationMessageInputSchema).max(1024).optional(),
+	publication: z.strictObject({
+		complete: z.boolean(),
+		objects: z.array(z.strictObject({
+			publicationId: z.uuid(),
+			name: z.string().min(1).max(255),
+			mediaType: AttachmentMediaTypeSchema,
+			sizeBytes: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+			digest: WorkloadDigestSchema,
+			contentBase64: z.string()
+		})).max(1e3)
+	}).optional()
+})]);
+WorkloadCancelSchema.extend({ fingerprint: WorkloadDigestSchema });
+//#endregion
+//#region src/resources/admin/admin.ts
+var AdministrationApi = class {
 	transport;
 	constructor(transport) {
 		this.transport = transport;
@@ -3234,106 +3828,6 @@ var AdministrationApi = class {
 	}
 };
 //#endregion
-//#region src/transport/errors.ts
-z.enum(["client.non_json_response", "client.invalid_response"]);
-var PocketCoderError = class extends Error {
-	code;
-	status;
-	requestId;
-	details;
-	constructor(input) {
-		super(input.message);
-		this.name = "PocketCoderError";
-		this.code = input.code;
-		this.status = input.status;
-		this.requestId = input.requestId;
-		this.details = input.details;
-	}
-};
-var ConversationGoneError = class extends PocketCoderError {};
-var WorkspaceTerminalError = class extends Error {
-	workspace;
-	constructor(workspace) {
-		const reason = workspace.reason_code ?? workspace.failure?.reason_code ?? "no reason";
-		const tail = workspace.failure?.log_tail.trim();
-		super([`workspace ${workspace.id} reached ${workspace.state} (${reason})`, ...tail ? [`failure log:\n${tail}`] : []].join("\n"));
-		this.name = "WorkspaceTerminalError";
-		this.workspace = workspace;
-	}
-};
-var AgentNotReadyError = class extends Error {
-	workspaceId;
-	agentState;
-	constructor(workspaceId, agentState, timeoutMs) {
-		super(`agent in workspace ${workspaceId} was still ${agentState} after ${timeoutMs}ms and cannot accept a message`);
-		this.name = "AgentNotReadyError";
-		this.workspaceId = workspaceId;
-		this.agentState = agentState;
-	}
-};
-function isPocketCoderErrorCode(value) {
-	return typeof value === "string" && value in ERROR_CODES;
-}
-function responseError(response, body) {
-	const parsed = ErrorEnvelopeSchema.safeParse(body);
-	if (!parsed.success) return new PocketCoderError({
-		message: `PocketCoder returned an invalid error response (${response.status})`,
-		code: "client.invalid_response",
-		status: response.status
-	});
-	const { code, message, request_id: requestId, details } = parsed.data.error;
-	return new (code === "conversation.deleted" || code === "conversation.expired" ? ConversationGoneError : PocketCoderError)({
-		message,
-		code,
-		status: response.status,
-		requestId,
-		details
-	});
-}
-//#endregion
-//#region src/resources/agent/agent.ts
-const DEFAULT_READY_TIMEOUT_MS = 12e4;
-var AgentApi = class {
-	transport;
-	workspaces;
-	constructor(transport, workspaces) {
-		this.transport = transport;
-		this.workspaces = workspaces;
-	}
-	async sendMessage(workspaceId, input) {
-		await this.workspaces.waitForAgentInput(workspaceId, input.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS, input.signal ? { signal: input.signal } : {});
-		const response = await this.transport.raw(`/v1/workspaces/${encodeURIComponent(workspaceId)}/agent/message`, {
-			method: "POST",
-			...input.signal ? { signal: input.signal } : {},
-			headers: { "content-type": "application/json" },
-			body: JSON.stringify({
-				type: "user",
-				content: input.content,
-				...input.attachmentIds?.length ? { attachment_ids: input.attachmentIds } : {}
-			})
-		});
-		if (response.ok) return;
-		const text = await response.text();
-		let body;
-		try {
-			body = JSON.parse(text);
-		} catch {
-			throw new PocketCoderError({
-				message: `PocketCoder returned a non-JSON response (${response.status})`,
-				code: "client.non_json_response",
-				status: response.status
-			});
-		}
-		throw responseError(response, body);
-	}
-	interrupt(workspaceId, options = {}) {
-		return this.transport.request(`/v1/workspaces/${encodeURIComponent(workspaceId)}/agent/interrupt`, AgentInterruptResponseSchema, {
-			method: "POST",
-			signal: options.signal
-		});
-	}
-};
-//#endregion
 //#region src/resources/attachments/attachments.ts
 function contentDisposition(name) {
 	const clean = name.replace(/[\r\n]/g, "");
@@ -3380,6 +3874,50 @@ var AttachmentsApi = class {
 	}
 };
 //#endregion
+//#region src/resources/budgets/budgets.ts
+const scopePath = (scopeId) => `/v1/budget-scopes/${encodeURIComponent(scopeId)}`;
+var ManagedAuthorityApi = class {
+	transport;
+	constructor(transport) {
+		this.transport = transport;
+	}
+	async grantScope(scopeId, grant, options = {}) {
+		await this.transport.request(`${scopePath(scopeId)}/grant`, z.undefined(), {
+			...options,
+			method: "PUT",
+			body: JSON.stringify(managedSchemas.BudgetScopeGrant.parse(grant))
+		});
+	}
+	putPolicy(policy, expectedRevision, options = {}) {
+		return this.transport.request(`${scopePath(policy.scopeId)}/policy`, BudgetPolicySchema, {
+			...options,
+			method: "PUT",
+			body: JSON.stringify(BudgetPolicyWriteSchema.parse(policy)),
+			headers: expectedRevision === null ? { "if-none-match": "*" } : { "if-match": `"${expectedRevision}"` }
+		});
+	}
+	getPolicy(scopeId, options = {}) {
+		return this.transport.request(`${scopePath(scopeId)}/policy`, BudgetPolicySchema, options);
+	}
+	usage(scopeId, options = {}) {
+		return this.transport.request(`${scopePath(scopeId)}/usage`, BudgetUsageSchema, options);
+	}
+	putProfile(principalId, profile, options = {}) {
+		return this.transport.request(`/v1/execution-profiles/${encodeURIComponent(profile.profileId)}/revisions/${profile.revision}?principalId=${encodeURIComponent(principalId)}`, ExecutionProfileSchema, {
+			...options,
+			method: "PUT",
+			body: JSON.stringify(ExecutionProfileSchema.parse(profile))
+		});
+	}
+	async putCredentialBinding(binding, options = {}) {
+		await this.transport.request(`/v1/credential-bindings/${encodeURIComponent(binding.bindingId)}`, z.undefined(), {
+			...options,
+			method: "PUT",
+			body: JSON.stringify(managedSchemas.CredentialBinding.parse(binding))
+		});
+	}
+};
+//#endregion
 //#region src/transport/common.ts
 function queryString(values) {
 	const params = new URLSearchParams();
@@ -3509,8 +4047,95 @@ var ConversationsApi = class {
 		const response = await this.transport.stream(path, options.signal);
 		if (response.body) yield* liveEvents(response.body);
 	}
+	async open(id, options = {}) {
+		return this.transport.request(`${workspacePath(id)}/conversation/open${options.conversationId ? `?${queryString({ conversationId: options.conversationId })}` : ""}`, z.object({ turns: z.array(ConversationLiveEventSchema) }), options);
+	}
+};
+//#endregion
+//#region src/resources/conversations/requests.ts
+const path = (workspaceId) => `/v1/workspaces/${encodeURIComponent(workspaceId)}/requests`;
+var WorkspaceRequestsApi = class {
+	transport;
+	constructor(transport) {
+		this.transport = transport;
+	}
+	submit(workspaceId, input, options = {}) {
+		return this.transport.request(path(workspaceId), ExecutionRecordSchema, {
+			...options,
+			method: "POST",
+			body: JSON.stringify(input)
+		});
+	}
+	get(workspaceId, requestId, conversationId, options = {}) {
+		return this.transport.request(`${path(workspaceId)}/${encodeURIComponent(requestId)}?${queryString({ conversationId })}`, ExecutionRecordSchema, options);
+	}
+	list(workspaceId, query, options = {}) {
+		return this.transport.request(`${path(workspaceId)}?${queryString(query)}`, z.object({
+			items: z.array(ExecutionRecordSchema),
+			next_cursor: z.uuid().nullable()
+		}), options);
+	}
+	cancel(record, cancelId, options = {}) {
+		const execution = record.acceptance.execution;
+		return this.transport.request(`/v1/workspaces/${encodeURIComponent(execution.workspaceId)}/executions/${encodeURIComponent(execution.requestId)}/cancel`, ExecutionRecordSchema, {
+			...options,
+			method: "POST",
+			body: JSON.stringify({
+				execution,
+				cancelId,
+				scope: "operation"
+			})
+		});
+	}
 };
 //#endregion
+//#region src/transport/errors.ts
+z.enum(["client.non_json_response", "client.invalid_response"]);
+var PocketCoderError = class extends Error {
+	code;
+	status;
+	requestId;
+	details;
+	constructor(input) {
+		super(input.message);
+		this.name = "PocketCoderError";
+		this.code = input.code;
+		this.status = input.status;
+		this.requestId = input.requestId;
+		this.details = input.details;
+	}
+};
+var ConversationGoneError = class extends PocketCoderError {};
+var WorkspaceTerminalError = class extends Error {
+	workspace;
+	constructor(workspace) {
+		const reason = workspace.reason_code ?? workspace.failure?.reason_code ?? "no reason";
+		const tail = workspace.failure?.log_tail.trim();
+		super([`workspace ${workspace.id} reached ${workspace.state} (${reason})`, ...tail ? [`failure log:\n${tail}`] : []].join("\n"));
+		this.name = "WorkspaceTerminalError";
+		this.workspace = workspace;
+	}
+};
+function isPocketCoderErrorCode(value) {
+	return typeof value === "string" && value in ERROR_CODES;
+}
+function responseError(response, body) {
+	const parsed = ErrorEnvelopeSchema.safeParse(body);
+	if (!parsed.success) return new PocketCoderError({
+		message: `PocketCoder returned an invalid error response (${response.status})`,
+		code: "client.invalid_response",
+		status: response.status
+	});
+	const { code, message, request_id: requestId, details } = parsed.data.error;
+	return new (code === "conversation.deleted" || code === "conversation.expired" ? ConversationGoneError : PocketCoderError)({
+		message,
+		code,
+		status: response.status,
+		requestId,
+		details
+	});
+}
+//#endregion
 //#region src/resources/diagnostics/diagnostics.ts
 var WorkspaceCursorApi = class {
 	transport;
@@ -3660,7 +4285,10 @@ var PreviewsApi = class {
 	open(workspaceId, name, options = {}) {
 		return this.transport.request(`/v1/workspaces/${encodeURIComponent(workspaceId)}/previews/${encodeURIComponent(name)}`, PreviewOpenResponseSchema, {
 			method: "POST",
-			body: JSON.stringify({ session: options.session ?? { mode: "local" } }),
+			body: JSON.stringify({
+				session: options.session ?? { mode: "local" },
+				...options.grantId ? { grantId: options.grantId } : {}
+			}),
 			signal: options.signal
 		});
 	}
@@ -3718,6 +4346,204 @@ var SecretsApi = class {
 	}
 };
 //#endregion
+//#region src/resources/sessions/events.ts
+async function* frames(body) {
+	const decoder = new TextDecoder();
+	let buffer = "";
+	for await (const chunk of body) {
+		buffer += decoder.decode(chunk, { stream: true });
+		let end = buffer.indexOf("\n\n");
+		while (end !== -1) {
+			const block = buffer.slice(0, end).split("\n");
+			buffer = buffer.slice(end + 2);
+			const field = (name) => block.find((line) => line.startsWith(`${name}:`))?.slice(name.length + 1).trim();
+			const data = block.filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trimStart()).join("\n");
+			yield {
+				id: field("id") ?? null,
+				event: field("event") ?? null,
+				data
+			};
+			end = buffer.indexOf("\n\n");
+		}
+	}
+}
+async function* sessionEvents(transport, sessionId, options = {}) {
+	let cursor = options.after ?? null;
+	do {
+		const query = cursor ? `?after=${encodeURIComponent(cursor)}` : "";
+		const response = await transport.stream(`/v1/sessions/${encodeURIComponent(sessionId)}/events${query}`, options.signal, cursor ? { "last-event-id": cursor } : {});
+		if (!response.body) return;
+		for await (const frame of frames(response.body)) {
+			if (frame.event === "keepalive") continue;
+			if (frame.event === "error") {
+				const { code } = JSON.parse(frame.data);
+				throw new PocketCoderError({
+					message: `Session event stream ended: ${code}`,
+					code,
+					status: 0
+				});
+			}
+			const event = RuntimeEventSchema.parse(JSON.parse(frame.data));
+			cursor = event.cursor;
+			yield event;
+		}
+	} while (options.reconnect !== false && !options.signal?.aborted);
+}
+//#endregion
+//#region src/resources/sessions/sessions.ts
+function sessionPath(sessionId) {
+	return `/v1/sessions/${encodeURIComponent(sessionId)}`;
+}
+const SessionPreviewSchema = PreviewOpenResponseSchema.extend({ grantId: z.uuid().nullable() });
+var SessionsApi = class {
+	transport;
+	constructor(transport) {
+		this.transport = transport;
+	}
+	create(input, options = {}) {
+		return this.transport.request("/v1/sessions", SessionSchema, {
+			...options,
+			method: "POST",
+			body: JSON.stringify(SessionCreateSchema.parse(input))
+		});
+	}
+	get(sessionId, options = {}) {
+		return this.transport.request(sessionPath(sessionId), SessionSchema, options);
+	}
+	resume(sessionId, options = {}) {
+		return this.transport.request(`${sessionPath(sessionId)}/resume`, SessionSchema, {
+			...options,
+			method: "POST"
+		});
+	}
+	close(sessionId, command, options = {}) {
+		return this.transport.request(`${sessionPath(sessionId)}/close`, CancelReceiptSchema, {
+			...options,
+			method: "POST",
+			body: JSON.stringify(CancelCommandSchema.parse(command))
+		});
+	}
+	history(sessionId, query = {}, options = {}) {
+		return this.transport.request(`${sessionPath(sessionId)}/history?${queryString({
+			cursor: query.cursor,
+			limit: query.limit ?? 50
+		})}`, ManagedHistoryPageSchema, options);
+	}
+	async snapshot(sessionId, options = {}) {
+		const records = [];
+		let cursor;
+		let eventCursor = "";
+		do {
+			const page = await this.history(sessionId, {
+				cursor,
+				limit: 200
+			}, options);
+			records.push(...page.records);
+			eventCursor = page.eventCursor;
+			cursor = page.nextCursor ?? void 0;
+		} while (cursor);
+		return {
+			records,
+			eventCursor
+		};
+	}
+	events(sessionId, options = {}) {
+		return sessionEvents(this.transport, sessionId, options);
+	}
+	open(sessionId, options = {}) {
+		return this.transport.request(`${sessionPath(sessionId)}/conversation/open`, z.object({ turns: z.array(ConversationLiveEventSchema) }), options);
+	}
+	openPreview(sessionId, name, options = {}) {
+		return this.transport.request(`${sessionPath(sessionId)}/previews/${encodeURIComponent(name)}`, SessionPreviewSchema, {
+			method: "POST",
+			body: JSON.stringify({
+				session: options.session ?? { mode: "local" },
+				...options.grant ? { grant: options.grant } : {}
+			}),
+			signal: options.signal
+		});
+	}
+};
+//#endregion
+//#region src/resources/sessions/files.ts
+var SessionFilesApi = class {
+	transport;
+	constructor(transport) {
+		this.transport = transport;
+	}
+	register(sessionId, input, options = {}) {
+		return this.transport.request(`${sessionPath(sessionId)}/inputs`, InputObjectSchema, {
+			...options,
+			method: "POST",
+			body: JSON.stringify(InputUploadSchema.parse(input))
+		});
+	}
+	upload(sessionId, inputId, bytes, options = {}) {
+		return this.transport.request(`${sessionPath(sessionId)}/inputs/${encodeURIComponent(inputId)}/content`, InputObjectSchema, {
+			...options,
+			method: "PUT",
+			body: bytes,
+			headers: { "content-type": "application/octet-stream" }
+		});
+	}
+	async put(sessionId, file, options = {}) {
+		const digest = new Uint8Array(await crypto.subtle.digest("SHA-256", file.bytes));
+		const sha256 = `sha256:${Array.from(digest, (byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+		const registered = await this.register(sessionId, {
+			inputId: file.inputId,
+			name: file.name,
+			mediaType: file.mediaType,
+			sizeBytes: file.bytes.byteLength,
+			sha256
+		}, options);
+		if (registered.state === "ready") return registered;
+		return this.upload(sessionId, file.inputId, file.bytes, options);
+	}
+	get(sessionId, inputId, options = {}) {
+		return this.transport.request(`${sessionPath(sessionId)}/inputs/${encodeURIComponent(inputId)}`, InputObjectSchema, options);
+	}
+	exports(sessionId, requestId, options = {}) {
+		return this.transport.request(`${sessionPath(sessionId)}/exports?requestId=${encodeURIComponent(requestId)}`, ManagedExportPageSchema, options);
+	}
+	async content(sessionId, exportId, options = {}) {
+		const response = await this.transport.raw(`${sessionPath(sessionId)}/exports/${encodeURIComponent(exportId)}/content`, options);
+		if (!response.ok) {
+			const text = await response.text();
+			throw responseError(response, text ? JSON.parse(text) : void 0);
+		}
+		return new Uint8Array(await response.arrayBuffer());
+	}
+};
+//#endregion
+//#region src/resources/sessions/requests.ts
+const requestPath = (sessionId, requestId) => `${sessionPath(sessionId)}/requests/${encodeURIComponent(requestId)}`;
+var SessionRequestsApi = class {
+	transport;
+	constructor(transport) {
+		this.transport = transport;
+	}
+	submit(sessionId, input, options = {}) {
+		return this.transport.request(`${sessionPath(sessionId)}/requests`, RequestSchema, {
+			...options,
+			method: "POST",
+			body: JSON.stringify(RequestInputSchema.parse(input))
+		});
+	}
+	get(sessionId, requestId, options = {}) {
+		return this.transport.request(requestPath(sessionId, requestId), RequestSchema, options);
+	}
+	cancel(sessionId, requestId, command, options = {}) {
+		return this.transport.request(`${requestPath(sessionId, requestId)}/cancel`, CancelReceiptSchema, {
+			...options,
+			method: "POST",
+			body: JSON.stringify(CancelCommandSchema.parse(command))
+		});
+	}
+	collection(sessionId, requestId, options = {}) {
+		return this.transport.request(`${requestPath(sessionId, requestId)}/collection`, CollectionResultSchema, options);
+	}
+};
+//#endregion
 //#region src/resources/templates/templates.ts
 var TemplatesApi = class {
 	transport;
@@ -3926,17 +4752,6 @@ var WorkspacesApi = class {
 		}
 		return workspace;
 	}
-	async waitForAgentInput(id, timeoutMs, options = {}) {
-		const deadline = Date.now() + timeoutMs;
-		let workspace = await this.get(id, options);
-		while (workspace.agent_state !== "stable") {
-			if (TERMINAL_STATES.includes(workspace.state)) throw new WorkspaceTerminalError(workspace);
-			const remainingMs = deadline - Date.now();
-			if (remainingMs <= 0) throw new AgentNotReadyError(workspace.id, workspace.agent_state, timeoutMs);
-			workspace = (await this.change(workspace.id, workspace.change_cursor, Math.max(1, Math.min(30, Math.ceil(remainingMs / 1e3))), options)).workspace;
-		}
-		return workspace;
-	}
 	preserve(id, input, key, options = {}) {
 		return this.jsonOperation(`/v1/workspaces/${encodeURIComponent(id)}/preserve`, input, key, PreserveResponseSchema, options);
 	}
@@ -4015,11 +4830,12 @@ var PocketCoderTransport = class {
 			await delay(100 * 2 ** attempt, signal);
 		}
 	}
-	async stream(path, signal) {
+	async stream(path, signal, headers = {}) {
 		const response = await this.fetchImpl(`${this.baseUrl}${path.startsWith("/") ? path : `/${path}`}`, {
 			headers: {
 				authorization: `Bearer ${this.apiKey}`,
-				accept: "text/event-stream"
+				accept: "text/event-stream",
+				...headers
 			},
 			...signal ? { signal } : {}
 		});
@@ -4099,8 +4915,8 @@ var PocketCoderClient = class {
 	previews;
 	displays;
 	attachments;
-	agent;
 	conversations;
+	workspaceRequests;
 	checkpoints;
 	operations;
 	logs;
@@ -4111,6 +4927,10 @@ var PocketCoderClient = class {
 	principals;
 	keys;
 	recovery;
+	sessions;
+	requests;
+	files;
+	authority;
 	constructor(config, fetchImpl = fetch) {
 		this.transport = new PocketCoderTransport(config, fetchImpl);
 		this.secrets = new SecretsApi(this.transport);
@@ -4119,8 +4939,8 @@ var PocketCoderClient = class {
 		this.previews = new PreviewsApi(this.transport);
 		this.displays = new DisplaysApi(this.transport);
 		this.attachments = new AttachmentsApi(this.transport);
-		this.agent = new AgentApi(this.transport, this.workspaces);
 		this.conversations = new ConversationsApi(this.transport);
+		this.workspaceRequests = new WorkspaceRequestsApi(this.transport);
 		this.checkpoints = new CheckpointsApi(this.transport);
 		this.operations = new OperationsApi(this.transport);
 		this.logs = new LogsApi(this.transport);
@@ -4131,6 +4951,10 @@ var PocketCoderClient = class {
 		this.principals = new PrincipalsApi(this.transport);
 		this.keys = new KeysApi(this.transport);
 		this.recovery = new RecoveryApi(this.transport);
+		this.sessions = new SessionsApi(this.transport);
+		this.requests = new SessionRequestsApi(this.transport);
+		this.files = new SessionFilesApi(this.transport);
+		this.authority = new ManagedAuthorityApi(this.transport);
 	}
 	raw(path, init = {}) {
 		return this.transport.raw(path, init);
@@ -4281,4 +5105,4 @@ var WorkspaceTurnResolver = class {
 	}
 };
 //#endregion
-export { AdministrationApi, AgentApi, AgentNotReadyError, AttachmentsApi, CheckpointsApi, ConversationGoneError, ConversationsApi, KeysApi, LogsApi, NetworkEventsApi, OperationsApi, OutputsApi, PocketCoderClient, PocketCoderError, PrincipalsApi, RecoveryApi, SecretsApi, TERMINAL_WORKSPACE_STATES, TemplatesApi, TerminalConnection, TerminalsApi, WorkspaceTerminalError, WorkspaceTurnResolutionError, WorkspaceTurnResolver, WorkspacesApi, isPocketCoderErrorCode, splitAttachmentManifest };
+export { AdministrationApi, AttachmentsApi, CheckpointsApi, ConversationGoneError, ConversationsApi, KeysApi, LogsApi, ManagedAuthorityApi, NetworkEventsApi, OperationsApi, OutputsApi, PocketCoderClient, PocketCoderError, PrincipalsApi, RecoveryApi, SecretsApi, SessionFilesApi, SessionRequestsApi, SessionsApi, TERMINAL_WORKSPACE_STATES, TemplatesApi, TerminalConnection, TerminalsApi, WorkspaceRequestsApi, WorkspaceTerminalError, WorkspaceTurnResolutionError, WorkspaceTurnResolver, WorkspacesApi, isPocketCoderErrorCode, sessions_exports as managed, sessionTemplate };