@ref0/sdk 0.12.0 → 0.13.0

package/dist/{index-BSPC_jQm.d.mts → index-DRFaIKvW.d.mts}

@@ -604,6 +604,22 @@ declare const WorkflowHasNoVersion_base: Schema.Class<WorkflowHasNoVersion, Sche
  * was past the reader's bounds, or ref0 couldn't read `main` for a day.
  */
 declare class WorkflowHasNoVersion extends WorkflowHasNoVersion_base {}
+declare const RunNotFound_base: Schema.Class<RunNotFound, Schema.TaggedStruct<"RunNotFound", {
+  readonly run: Schema.String;
+  readonly nextStep: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** No run with this ID that the caller may read, here or where it named. */
+declare class RunNotFound extends RunNotFound_base {}
+declare const InvalidCursor_base: Schema.Class<InvalidCursor, Schema.TaggedStruct<"InvalidCursor", {
+  readonly nextStep: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The cursor isn't one a page of this run's trace gave. */
+declare class InvalidCursor extends InvalidCursor_base {}
+declare const TraceUnavailable_base: Schema.Class<TraceUnavailable, Schema.TaggedStruct<"TraceUnavailable", {
+  readonly nextStep: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** ref0 couldn't read the trace's chunks now: nothing was skipped, so ask again. */
+declare class TraceUnavailable extends TraceUnavailable_base {}
 declare const RequestChanged_base: Schema.Class<RequestChanged, Schema.TaggedStruct<"RequestChanged", {
   readonly nextStep: Schema.String;
 }>, import("effect/Cause").YieldableError>;
@@ -665,22 +681,6 @@ declare const SignerNotRevoked_base: Schema.Class<SignerNotRevoked, Schema.Tagge
 }>, import("effect/Cause").YieldableError>;
 /** A restore of a signer nothing revoked from answering that check: nothing changed. */
 declare class SignerNotRevoked extends SignerNotRevoked_base {}
-declare const RunNotFound_base: Schema.Class<RunNotFound, Schema.TaggedStruct<"RunNotFound", {
-  readonly run: Schema.String;
-  readonly nextStep: Schema.String;
-}>, import("effect/Cause").YieldableError>;
-/** No run with this ID that the caller may read, here or where it named. */
-declare class RunNotFound extends RunNotFound_base {}
-declare const InvalidCursor_base: Schema.Class<InvalidCursor, Schema.TaggedStruct<"InvalidCursor", {
-  readonly nextStep: Schema.String;
-}>, import("effect/Cause").YieldableError>;
-/** The cursor isn't one a page of this run's trace gave. */
-declare class InvalidCursor extends InvalidCursor_base {}
-declare const TraceUnavailable_base: Schema.Class<TraceUnavailable, Schema.TaggedStruct<"TraceUnavailable", {
-  readonly nextStep: Schema.String;
-}>, import("effect/Cause").YieldableError>;
-/** ref0 couldn't read the trace's chunks now: nothing was skipped, so ask again. */
-declare class TraceUnavailable extends TraceUnavailable_base {}
 //#endregion
 //#region src/approval-previews.d.ts
 /**
@@ -1428,6 +1428,58 @@ declare const IdentityTokenNotReady_base: Schema.Class<IdentityTokenNotReady, Sc
  */
 declare class IdentityTokenNotReady extends IdentityTokenNotReady_base {}
 //#endregion
+//#region src/proofs.d.ts
+/**
+ * Proofs of possession: a credential bound to a key, and the proof that comes with each request
+ * made with it, RFC 9449's DPoP. A bound credential, a host grant or a session's token, names its
+ * key's thumbprint as `cnf`, which only ref0's own state says, never a caller. Each request sends
+ * the token as `Authorization: DPoP <token>` and one `DPoP` header: a compact JWS, signed with
+ * ES256 by that key, over the request's method and URL, when it was made, and the token's hash.
+ * There's no server nonce and no replay store: a captured token and proof can be used again on
+ * the same method and path while the proof's time is in the window, and a token alone can't.
+ */
+/** A P-256 key's RFC 7638 thumbprint: SHA-256 over its required members, in base64url. */
+declare const KeyThumbprint: Schema.brand<Schema.String, "KeyThumbprint">;
+type KeyThumbprint = typeof KeyThumbprint.Type;
+/**
+ * ref0's origin as a proof names it: HTTPS, or plain HTTP only on loopback, for development. A
+ * client sends a proof, and ref0 takes one, for no other.
+ */
+declare const ProofOrigin: Schema.brand<Schema.brand<Schema.String, "ApiOrigin">, "ProofOrigin">;
+type ProofOrigin = typeof ProofOrigin.Type;
+/**
+ * A P-256 public key as a JWK: exactly `kty`, `crv`, `x` and `y`, so never a private part, a
+ * key reference or another algorithm's key. Whether its point is on the curve is for Web Crypto
+ * to say, when it imports it.
+ */
+declare const PublicJwk: Schema.decodeTo<Schema.Struct<{
+  readonly kty: Schema.Literal<"EC">;
+  readonly crv: Schema.Literal<"P-256">;
+  readonly x: Schema.String;
+  readonly y: Schema.String;
+}>, Schema.$Record<Schema.String, Schema.Unknown>, never, never>;
+type PublicJwk = typeof PublicJwk.Type;
+declare const InvalidDpopProof_base: Schema.Class<InvalidDpopProof, Schema.TaggedStruct<"InvalidDpopProof", {
+  readonly error: Schema.Literal<"invalid_dpop_proof">;
+  readonly nextStep: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * A bound credential came with a proof that's missing, malformed, stale, from another key, or
+ * for another request, or came as a bearer token, or a proof came with no `DPoP` credential to
+ * go with it. ref0 answers it before any handler runs, so nothing was done. A machine whose clock
+ * is off signs again once, by the answer's `Date`. Also what a machine answers itself when the key
+ * its credential is bound to is gone, without sending anything.
+ */
+declare class InvalidDpopProof extends InvalidDpopProof_base {}
+declare const KeyStoreUnavailable_base: Schema.Class<KeyStoreUnavailable, Schema.TaggedStruct<"KeyStoreUnavailable", {
+  readonly nextStep: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * The key store a request's proof is signed in didn't sign it: locked, unavailable or out of
+ * time. Nothing was sent. A client's own, never an answer of ref0's.
+ */
+declare class KeyStoreUnavailable extends KeyStoreUnavailable_base {}
+//#endregion
 //#region src/ids.d.ts
 /** A person. A person is an owner, so this is also their owner ID. */
 declare const PersonId: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
@@ -2084,6 +2136,9 @@ declare const Caller_base: Context.ServiceClass<Caller, "ref0/contracts/Caller",
     readonly target?: number;
   };
   readonly expiresAt?: import("effect/DateTime").Utc;
+  readonly cnf?: {
+    readonly jkt: string & import("effect/Brand").Brand<"KeyThumbprint">;
+  };
   readonly scopes: readonly {
     readonly kind: "agent" | "owner" | "person" | "project" | "repo" | "session" | "thread";
     readonly id: string;
@@ -2136,20 +2191,24 @@ declare class Caller extends Caller_base {}
 declare const Authorization_base: HttpApiMiddleware.ServiceClass<Authorization, "ref0/contracts/Authorization", {
   requires: never;
   provides: Caller;
-  error: readonly [typeof Unauthenticated, typeof SessionHasEnded, typeof AuthorityUnavailable];
-  clientError: never;
+  error: readonly [typeof Unauthenticated, typeof InvalidDpopProof, typeof SessionHasEnded, typeof AuthorityUnavailable];
+  clientError: KeyStoreUnavailable;
   requiredForClient: true;
   security: {
     readonly bearer: HttpApiSecurity.Http;
+    readonly dpop: HttpApiSecurity.Http;
     readonly browserSession: HttpApiSecurity.ApiKey;
   };
 }, HttpApiMiddleware.HttpApiMiddlewareSecurity<{
   readonly bearer: HttpApiSecurity.Http;
+  readonly dpop: HttpApiSecurity.Http;
   readonly browserSession: HttpApiSecurity.ApiKey;
-}, Caller, readonly [typeof Unauthenticated, typeof SessionHasEnded, typeof AuthorityUnavailable], never>>;
+}, Caller, readonly [typeof Unauthenticated, typeof InvalidDpopProof, typeof SessionHasEnded, typeof AuthorityUnavailable], never>>;
 /**
- * Every endpoint's credential, checked before its handler runs: a bearer token, or a browser
- * session's cookie. A request with both is refused before it gets here.
+ * Every endpoint's credential, checked before its handler runs: a bearer token, a token bound to
+ * a key with a proof that key signed (`Authorization: DPoP` and one `DPoP` header), or a browser
+ * session's cookie. A request with a cookie and a token is refused before it gets here. A client
+ * that signs proofs may fail before it sends anything, when its key store doesn't sign.
  */
 declare class Authorization extends Authorization_base {}
 declare const SignedInPerson_base: Context.ServiceClass<SignedInPerson, "ref0/contracts/SignedInPerson", {
@@ -2212,6 +2271,27 @@ declare const MachineNameRefusal_base: HttpApiMiddleware.ServiceClass<MachineNam
  * what to change. Any other part that fails its contract is answered with Effect's empty 400.
  */
 declare class MachineNameRefusal extends MachineNameRefusal_base {}
+declare const ProvedKey_base: Context.ServiceClass<ProvedKey, "ref0/contracts/ProvedKey", {
+  readonly signedBy: Option.Option<KeyThumbprint>;
+}>;
+/** The key a request with no credential was signed by, when it came with a proof: its thumbprint. */
+declare class ProvedKey extends ProvedKey_base {}
+declare const KeyProof_base: HttpApiMiddleware.ServiceClass<KeyProof, "ref0/contracts/KeyProof", {
+  requires: never;
+  provides: ProvedKey;
+  error: typeof InvalidDpopProof;
+  clientError: KeyStoreUnavailable;
+  requiredForClient: true;
+  security: never;
+}, HttpApiMiddleware.HttpApiMiddleware<ProvedKey, typeof InvalidDpopProof, never>>;
+/**
+ * A request with no credential, signed by a key it names, such as a machine's ask to connect: one
+ * `DPoP` header, a proof with no `ath`, since there's no token, checked before the request is
+ * read, which says the key that signed it; or no proof, which says none. Every client supplies
+ * it, as it does `Authorization`, so its key store's failure, before anything is sent, is typed:
+ * one with a key store signs, and every other sends no proof.
+ */
+declare class KeyProof extends KeyProof_base {}
 declare const IdentityAudienceRefusal_base: HttpApiMiddleware.ServiceClass<IdentityAudienceRefusal, "ref0/contracts/IdentityAudienceRefusal", {
   requires: never;
   provides: never;
@@ -2258,7 +2338,29 @@ declare const PasskeysGroup_base: HttpApiGroup.HttpApiGroup<"passkeys", HttpApiE
     readonly backedUp: Schema.Boolean;
   }>>;
   readonly approvesHere: Schema.Boolean;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"firstOptions", "POST", "/v1/me/passkeys/first/options", never, never, never, Schema.toCodecStringTree<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"enrolFirst", "POST", "/v1/me/passkeys/first", never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly id: Schema.String;
+  readonly rawId: Schema.String;
+  readonly type: Schema.Literal<"public-key">;
+  readonly response: Schema.Struct<{
+    readonly clientDataJSON: Schema.String;
+    readonly attestationObject: Schema.String;
+    readonly authenticatorData: Schema.optional<Schema.String>;
+    readonly transports: Schema.optional<Schema.$Array<Schema.Literals<readonly ["ble", "cable", "hybrid", "internal", "nfc", "smart-card", "usb"]>>>;
+    readonly publicKeyAlgorithm: Schema.optional<Schema.Int>;
+    readonly publicKey: Schema.optional<Schema.String>;
+  }>;
+  readonly authenticatorAttachment: Schema.optional<Schema.Literals<readonly ["platform", "cross-platform"]>>;
+  readonly clientExtensionResults: Schema.Struct<{
+    readonly credProps: Schema.optionalKey<Schema.Struct<{
+      readonly rk: Schema.optionalKey<Schema.Boolean>;
+    }>>;
+  }>;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Struct<{
+  readonly passkey: Schema.brand<Schema.TemplateLiteral<readonly ["passkey_", Schema.String]>, "PasskeyId">;
+}>>, Schema.toCodecJson<typeof AuthorityUnavailable | typeof PasskeyRefused>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"firstOptions", "POST", "/v1/me/passkeys/first/options", never, never, never, Schema.toCodecStringTree<Schema.Struct<{
   'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
 }>>, Schema.toCodecJson<Schema.Struct<{
   readonly rp: Schema.Struct<{
@@ -2289,28 +2391,6 @@ declare const PasskeysGroup_base: HttpApiGroup.HttpApiGroup<"passkeys", HttpApiE
   }>>;
   readonly hints: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["hybrid", "security-key", "client-device"]>>>;
   readonly attestation: Schema.optionalKey<Schema.Literals<readonly ["direct", "enterprise", "indirect", "none"]>>;
-}>>, Schema.toCodecJson<typeof AuthorityUnavailable | typeof PasskeyRefused>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"enrolFirst", "POST", "/v1/me/passkeys/first", never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly id: Schema.String;
-  readonly rawId: Schema.String;
-  readonly type: Schema.Literal<"public-key">;
-  readonly response: Schema.Struct<{
-    readonly clientDataJSON: Schema.String;
-    readonly attestationObject: Schema.String;
-    readonly authenticatorData: Schema.optional<Schema.String>;
-    readonly transports: Schema.optional<Schema.$Array<Schema.Literals<readonly ["ble", "cable", "hybrid", "internal", "nfc", "smart-card", "usb"]>>>;
-    readonly publicKeyAlgorithm: Schema.optional<Schema.Int>;
-    readonly publicKey: Schema.optional<Schema.String>;
-  }>;
-  readonly authenticatorAttachment: Schema.optional<Schema.Literals<readonly ["platform", "cross-platform"]>>;
-  readonly clientExtensionResults: Schema.Struct<{
-    readonly credProps: Schema.optionalKey<Schema.Struct<{
-      readonly rk: Schema.optionalKey<Schema.Boolean>;
-    }>>;
-  }>;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Struct<{
-  readonly passkey: Schema.brand<Schema.TemplateLiteral<readonly ["passkey_", Schema.String]>, "PasskeyId">;
 }>>, Schema.toCodecJson<typeof AuthorityUnavailable | typeof PasskeyRefused>, Authorization, never>, false>;
 /**
  * A person's passkeys: listing them, and enrolling the first, which signing in asks for straight
@@ -2354,19 +2434,7 @@ declare const TerminalApprovalsGroup_base: HttpApiGroup.HttpApiGroup<"terminalAp
  * what it came to with the approval's secret. Its person answers on their own page, by its code.
  */
 declare class TerminalApprovalsGroup extends TerminalApprovalsGroup_base {}
-declare const AttachmentsGroup_base: HttpApiGroup.HttpApiGroup<"attachments", HttpApiEndpoint.HttpApiEndpoint<"revoke", "DELETE", "/v1/owners/:owner/agents/:agent/attachments/:attachment", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-  agent: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">, Schema.brand<Schema.String, "AgentHandle">]>;
-  attachment: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
-}>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Struct<{
-  readonly credential: Schema.Struct<{
-    readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-    readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
-  }>;
-  readonly childrenRevoked: Schema.Int;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof DeliveryOutsideWindow | typeof AttachmentNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/owners/:owner/agents/:agent/attachments", Schema.toCodecStringTree<Schema.Struct<{
+declare const AttachmentsGroup_base: HttpApiGroup.HttpApiGroup<"attachments", HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/owners/:owner/agents/:agent/attachments", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   agent: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">, Schema.brand<Schema.String, "AgentHandle">]>;
 }>>, Schema.toCodecStringTree<Schema.Struct<{
@@ -2383,7 +2451,19 @@ declare const AttachmentsGroup_base: HttpApiGroup.HttpApiGroup<"attachments", Ht
     readonly person: Schema.brand<Schema.String, "OwnerName">;
   }>>;
   readonly nextAfter: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof OrganizationNotFound>, Authorization, never>, false>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"revoke", "DELETE", "/v1/owners/:owner/agents/:agent/attachments/:attachment", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+  agent: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">, Schema.brand<Schema.String, "AgentHandle">]>;
+  attachment: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+}>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Struct<{
+  readonly credential: Schema.Struct<{
+    readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+    readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+  }>;
+  readonly childrenRevoked: Schema.Int;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof DeliveryOutsideWindow | typeof AttachmentNotFound>, Authorization, never>, false>;
 /**
  * An agent's live attachments, by approval: listed, every one to an admin and their own to anyone
  * else; and one of the caller's own disconnected, revoking its credential, which the Worker checks
@@ -2397,6 +2477,7 @@ declare const MachineAttachmentsGroup_base: HttpApiGroup.HttpApiGroup<"machineAt
 }>>, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
   readonly state: Schema.Literal<"waiting">;
   readonly expiresAt: Schema.DateTimeUtcFromString;
+  readonly confirmBy: Schema.optionalKey<Schema.DateTimeUtcFromString>;
 }>, Schema.Struct<{
   readonly state: Schema.Literal<"connected">;
   readonly owner: Schema.brand<Schema.String, "OwnerName">;
@@ -2442,6 +2523,7 @@ declare const MachineAttachmentsGroup_base: HttpApiGroup.HttpApiGroup<"machineAt
 }>>, never, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
   readonly state: Schema.Literal<"waiting">;
   readonly expiresAt: Schema.DateTimeUtcFromString;
+  readonly confirmBy: Schema.optionalKey<Schema.DateTimeUtcFromString>;
 }>, Schema.Struct<{
   readonly state: Schema.Literal<"connected">;
   readonly owner: Schema.brand<Schema.String, "OwnerName">;
@@ -2492,6 +2574,12 @@ declare const MachineAttachmentsGroup_base: HttpApiGroup.HttpApiGroup<"machineAt
 }>>, Schema.toCodecJson<typeof AuthorityUnavailable | typeof AttachmentNotFound>, ApprovalSecret, never> | HttpApiEndpoint.HttpApiEndpoint<"request", "POST", "/v1/attachments/requests", never, never, Schema.toCodecJson<Schema.Struct<{
   readonly machine: Schema.brand<Schema.TemplateLiteral<readonly ["machine_", Schema.String]>, "MachineId">;
   readonly machineName: Schema.String;
+  readonly publicKey: Schema.optionalKey<Schema.decodeTo<Schema.Struct<{
+    readonly kty: Schema.Literal<"EC">;
+    readonly crv: Schema.Literal<"P-256">;
+    readonly x: Schema.String;
+    readonly y: Schema.String;
+  }>, Schema.$Record<Schema.String, Schema.Unknown>, never, never>>;
   readonly folders: Schema.$Array<Schema.Struct<{
     readonly path: Schema.String;
     readonly harness: Schema.Literals<readonly ["claude-code", "codex"]>;
@@ -2510,11 +2598,12 @@ declare const MachineAttachmentsGroup_base: HttpApiGroup.HttpApiGroup<"machineAt
   readonly approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
   readonly code: Schema.String;
   readonly expiresAt: Schema.DateTimeUtcFromString;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof CommandRefused | typeof SlowDown>, MachineNameRefusal, never>, false>;
+}>>, Schema.toCodecJson<typeof InvalidDpopProof | typeof NotPermitted | typeof AuthorityUnavailable | typeof CommandRefused | typeof SlowDown>, KeyProof | MachineNameRefusal, never>, false>;
 /**
  * Connecting a machine, the machine's side: asking, with no credential, to connect to one owner's
- * agent, whose terminal shows the code their person types; then collecting what came of it,
- * confirming it saved the grant, or aborting, with its collecting secret.
+ * agent, whose terminal shows the code their person types, signed by the machine key it names;
+ * then collecting what came of it, confirming it saved the grant, or aborting, with its collecting
+ * secret, which needs no proof: a grant it collects is bound to the key its ask named.
  */
 declare class MachineAttachmentsGroup extends MachineAttachmentsGroup_base {}
 declare const ApprovalsGroup_base: HttpApiGroup.HttpApiGroup<"approvals", HttpApiEndpoint.HttpApiEndpoint<"waiting", "GET", "/v1/approvals", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
@@ -2901,7 +2990,80 @@ declare const ApprovalsGroup_base: HttpApiGroup.HttpApiGroup<"approvals", HttpAp
   readonly result: Schema.Codec<Schema.Json, Schema.Json, never, never>;
   readonly state: Schema.Literal<"ran">;
   readonly endpoint: Schema.String;
-}>]>>, Schema.toCodecJson<typeof AuthorityUnavailable | typeof ApprovalNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"options", "POST", "/v1/approvals/:approval/options", Schema.toCodecStringTree<Schema.Struct<{
+}>]>>, Schema.toCodecJson<typeof AuthorityUnavailable | typeof ApprovalNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"answer", "POST", "/v1/approvals/:approval/answer", Schema.toCodecStringTree<Schema.Struct<{
+  approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
+}>>, never, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
+  readonly answer: Schema.Literal<"yes">;
+  readonly permission: Schema.optionalKey<Schema.Literal<"allow">>;
+  readonly assertion: Schema.Struct<{
+    readonly id: Schema.String;
+    readonly rawId: Schema.String;
+    readonly type: Schema.Literal<"public-key">;
+    readonly response: Schema.Struct<{
+      readonly clientDataJSON: Schema.String;
+      readonly authenticatorData: Schema.String;
+      readonly signature: Schema.String;
+      readonly userHandle: Schema.optional<Schema.String>;
+    }>;
+    readonly authenticatorAttachment: Schema.optional<Schema.Literals<readonly ["platform", "cross-platform"]>>;
+    readonly clientExtensionResults: Schema.Struct<{}>;
+  }>;
+  readonly code: Schema.optionalKey<Schema.String>;
+  readonly preview: Schema.optionalKey<Schema.Struct<{
+    readonly kind: Schema.Literals<readonly ["workflow", "attached workflow"]>;
+    readonly version: Schema.brand<Schema.String, "WorkflowVersion">;
+  }>>;
+  readonly statement: Schema.optionalKey<Schema.Struct<{
+    readonly hash: Schema.String;
+  }>>;
+}>, Schema.Struct<{
+  readonly answer: Schema.Literal<"no">;
+  readonly permission: Schema.Literal<"deny">;
+  readonly assertion: Schema.Struct<{
+    readonly id: Schema.String;
+    readonly rawId: Schema.String;
+    readonly type: Schema.Literal<"public-key">;
+    readonly response: Schema.Struct<{
+      readonly clientDataJSON: Schema.String;
+      readonly authenticatorData: Schema.String;
+      readonly signature: Schema.String;
+      readonly userHandle: Schema.optional<Schema.String>;
+    }>;
+    readonly authenticatorAttachment: Schema.optional<Schema.Literals<readonly ["platform", "cross-platform"]>>;
+    readonly clientExtensionResults: Schema.Struct<{}>;
+  }>;
+  readonly code: Schema.optionalKey<Schema.String>;
+}>, Schema.Struct<{
+  readonly answer: Schema.Literal<"no">;
+  readonly code: Schema.optionalKey<Schema.String>;
+}>]>>, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
+  readonly state: Schema.Literal<"approved">;
+  readonly collected: Schema.optionalKey<Schema.Literal<true>>;
+  readonly answerCode: Schema.String;
+}>, Schema.Struct<{
+  readonly status: Schema.Int;
+  readonly result: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+  readonly state: Schema.Literal<"ran">;
+  readonly endpoint: Schema.String;
+  readonly answerCode: Schema.String;
+}>, Schema.Union<readonly [Schema.Struct<{
+  readonly state: Schema.Literal<"waiting">;
+  readonly expiresAt: Schema.DateTimeUtcFromString;
+}>, Schema.Struct<{
+  readonly state: Schema.Literal<"approved">;
+  readonly collected: Schema.optionalKey<Schema.Literal<true>>;
+}>, Schema.Struct<{
+  readonly state: Schema.Literal<"refused">;
+}>, Schema.Struct<{
+  readonly state: Schema.Literal<"expired">;
+}>, Schema.Struct<{
+  readonly status: Schema.Int;
+  readonly result: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+  readonly state: Schema.Literal<"ran">;
+  readonly endpoint: Schema.String;
+}>]>]>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof ApprovalStale | typeof PreviewNotReady | typeof PasskeyRefused | typeof ApprovalNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"options", "POST", "/v1/approvals/:approval/options", Schema.toCodecStringTree<Schema.Struct<{
   approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
   readonly code: Schema.optionalKey<Schema.String>;
@@ -3223,121 +3385,89 @@ declare const ApprovalsGroup_base: HttpApiGroup.HttpApiGroup<"approvals", HttpAp
     readonly port: Schema.Int;
     readonly state: Schema.String;
   }>>;
-}>]>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof ApprovalNotFound | typeof SlowDown>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"answer", "POST", "/v1/approvals/:approval/answer", Schema.toCodecStringTree<Schema.Struct<{
-  approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
-}>>, never, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
-  readonly answer: Schema.Literal<"yes">;
-  readonly permission: Schema.optionalKey<Schema.Literal<"allow">>;
-  readonly assertion: Schema.Struct<{
-    readonly id: Schema.String;
-    readonly rawId: Schema.String;
-    readonly type: Schema.Literal<"public-key">;
-    readonly response: Schema.Struct<{
-      readonly clientDataJSON: Schema.String;
-      readonly authenticatorData: Schema.String;
-      readonly signature: Schema.String;
-      readonly userHandle: Schema.optional<Schema.String>;
-    }>;
-    readonly authenticatorAttachment: Schema.optional<Schema.Literals<readonly ["platform", "cross-platform"]>>;
-    readonly clientExtensionResults: Schema.Struct<{}>;
+}>]>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof ApprovalNotFound | typeof SlowDown>, Authorization, never>, false>;
+/**
+ * A person's side of approvals, in an approving browser: what waits for them, finding a
+ * terminal's request or a machine's attachment request by its code, and answering one, with
+ * their passkey for a yes. And where an ask stands, for whoever asked: an agent, from the session
+ * it asked in, or a page, from the browser session it asked in, which follows a yes until its
+ * command has run.
+ */
+declare class ApprovalsGroup extends ApprovalsGroup_base {}
+declare const MeGroup_base: HttpApiGroup.HttpApiGroup<"me", HttpApiEndpoint.HttpApiEndpoint<"get", "GET", "/v1/me", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly actor: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"person">;
+    readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"agent">;
+    readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+    readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"ref0">;
+    readonly id: Schema.Literals<("ref0:attachments" | "ref0:barrier" | "ref0:blockers" | "ref0:checks" | "ref0:gate" | "ref0:hooks" | "ref0:importer" | "ref0:invitations" | "ref0:listings" | "ref0:mirror" | "ref0:needs" | "ref0:oauth" | "ref0:owners" | "ref0:plans" | "ref0:prepare" | "ref0:project-gate" | "ref0:pushes" | "ref0:queue" | "ref0:rebuilder" | "ref0:sessions" | "ref0:sign-in" | "ref0:stages" | "ref0:sweeper" | "ref0:usage" | "ref0:warm-up" | "ref0:workflows")[]>;
+  }>]>;
+  readonly credential: Schema.Struct<{
+    readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+    readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
   }>;
-  readonly code: Schema.optionalKey<Schema.String>;
-  readonly preview: Schema.optionalKey<Schema.Struct<{
-    readonly kind: Schema.Literals<readonly ["workflow", "attached workflow"]>;
-    readonly version: Schema.brand<Schema.String, "WorkflowVersion">;
+  readonly kind: Schema.Literals<readonly ["browser session", "host grant", "client grant", "session", "step-up", "git"]>;
+  readonly agent: Schema.optionalKey<Schema.Struct<{
+    readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+    readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
   }>>;
-  readonly statement: Schema.optionalKey<Schema.Struct<{
-    readonly hash: Schema.String;
+  readonly session: Schema.optionalKey<Schema.Struct<{
+    readonly project: Schema.brand<Schema.TemplateLiteral<readonly ["project_", Schema.String]>, "ProjectId">;
+    readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["session_", Schema.String]>, "SessionId">;
+    readonly depth: Schema.Int;
   }>>;
-}>, Schema.Struct<{
-  readonly answer: Schema.Literal<"no">;
-  readonly permission: Schema.Literal<"deny">;
-  readonly assertion: Schema.Struct<{
-    readonly id: Schema.String;
-    readonly rawId: Schema.String;
-    readonly type: Schema.Literal<"public-key">;
-    readonly response: Schema.Struct<{
-      readonly clientDataJSON: Schema.String;
-      readonly authenticatorData: Schema.String;
-      readonly signature: Schema.String;
-      readonly userHandle: Schema.optional<Schema.String>;
-    }>;
-    readonly authenticatorAttachment: Schema.optional<Schema.Literals<readonly ["platform", "cross-platform"]>>;
-    readonly clientExtensionResults: Schema.Struct<{}>;
-  }>;
-  readonly code: Schema.optionalKey<Schema.String>;
-}>, Schema.Struct<{
-  readonly answer: Schema.Literal<"no">;
-  readonly code: Schema.optionalKey<Schema.String>;
-}>]>>, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
-  readonly state: Schema.Literal<"approved">;
-  readonly collected: Schema.optionalKey<Schema.Literal<true>>;
-  readonly answerCode: Schema.String;
-}>, Schema.Struct<{
-  readonly status: Schema.Int;
-  readonly result: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-  readonly state: Schema.Literal<"ran">;
-  readonly endpoint: Schema.String;
-  readonly answerCode: Schema.String;
-}>, Schema.Union<readonly [Schema.Struct<{
-  readonly state: Schema.Literal<"waiting">;
-  readonly expiresAt: Schema.DateTimeUtcFromString;
-}>, Schema.Struct<{
-  readonly state: Schema.Literal<"approved">;
-  readonly collected: Schema.optionalKey<Schema.Literal<true>>;
-}>, Schema.Struct<{
-  readonly state: Schema.Literal<"refused">;
-}>, Schema.Struct<{
-  readonly state: Schema.Literal<"expired">;
-}>, Schema.Struct<{
-  readonly status: Schema.Int;
-  readonly result: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-  readonly state: Schema.Literal<"ran">;
-  readonly endpoint: Schema.String;
-}>]>]>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof ApprovalStale | typeof PreviewNotReady | typeof PasskeyRefused | typeof ApprovalNotFound>, Authorization, never>, false>;
-/**
- * A person's side of approvals, in an approving browser: what waits for them, finding a
- * terminal's request or a machine's attachment request by its code, and answering one, with
- * their passkey for a yes. And where an ask stands, for whoever asked: an agent, from the session
- * it asked in, or a page, from the browser session it asked in, which follows a yes until its
- * command has run.
- */
-declare class ApprovalsGroup extends ApprovalsGroup_base {}
-declare const MeGroup_base: HttpApiGroup.HttpApiGroup<"me", HttpApiEndpoint.HttpApiEndpoint<"get", "GET", "/v1/me", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly actor: Schema.Union<readonly [Schema.Struct<{
-    readonly kind: Schema.Literal<"person">;
-    readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"agent">;
-    readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-    readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"ref0">;
-    readonly id: Schema.Literals<("ref0:attachments" | "ref0:barrier" | "ref0:blockers" | "ref0:checks" | "ref0:gate" | "ref0:hooks" | "ref0:importer" | "ref0:invitations" | "ref0:listings" | "ref0:mirror" | "ref0:needs" | "ref0:oauth" | "ref0:owners" | "ref0:plans" | "ref0:prepare" | "ref0:project-gate" | "ref0:pushes" | "ref0:queue" | "ref0:rebuilder" | "ref0:sessions" | "ref0:sign-in" | "ref0:stages" | "ref0:sweeper" | "ref0:usage" | "ref0:warm-up" | "ref0:workflows")[]>;
-  }>]>;
-  readonly credential: Schema.Struct<{
-    readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-    readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
-  }>;
-  readonly kind: Schema.Literals<readonly ["browser session", "host grant", "client grant", "session", "step-up", "git"]>;
-  readonly agent: Schema.optionalKey<Schema.Struct<{
-    readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-    readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-  }>>;
-  readonly session: Schema.optionalKey<Schema.Struct<{
-    readonly project: Schema.brand<Schema.TemplateLiteral<readonly ["project_", Schema.String]>, "ProjectId">;
-    readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["session_", Schema.String]>, "SessionId">;
-    readonly depth: Schema.Int;
-  }>>;
-  readonly scopes: Schema.$Array<Schema.Struct<{
-    readonly kind: Schema.Literals<readonly ["person", "owner", "project", "repo", "thread", "session", "agent"]>;
+  readonly scopes: Schema.$Array<Schema.Struct<{
+    readonly kind: Schema.Literals<readonly ["person", "owner", "project", "repo", "thread", "session", "agent"]>;
     readonly id: Schema.String;
     readonly action: Schema.Literals<readonly ["project:read", "project:write", "thread:start", "thread:write", "session:start", "session:change", "agent:attach", "approval:start", "git:read", "git:push", "approval:ask", "repo:add", "project:create", "thread:watch", "check:run"]>;
   }>>;
   readonly expiresAt: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
-}>>, never, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"mirrors", "GET", "/v1/me/mirrors", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
+}>>, never, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"meters", "GET", "/v1/me/meters", never, Schema.toCodecStringTree<Schema.Struct<{
+  from: Schema.optionalKey<Schema.brand<Schema.String, "UtcDay">>;
+  to: Schema.optionalKey<Schema.brand<Schema.String, "UtcDay">>;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly from: Schema.brand<Schema.String, "UtcDay">;
+  readonly to: Schema.brand<Schema.String, "UtcDay">;
+  readonly days: Schema.$Array<Schema.Struct<{
+    readonly day: Schema.brand<Schema.String, "UtcDay">;
+    readonly lines: Schema.$Array<Schema.Struct<{
+      readonly meter: Schema.Literals<readonly ["containers.vcpu_seconds", "containers.memory_gib_seconds", "containers.disk_gb_seconds", "containers.egress_gb", "browser.seconds", "artifacts.bytes", "r2.bytes"]>;
+      readonly quantity: Schema.Finite;
+      readonly known: Schema.Literals<readonly ["measured", "estimated"]>;
+    }>>;
+  }>>;
+  readonly work: Schema.$Array<Schema.Struct<{
+    readonly work: Schema.optionalKey<Schema.Literals<readonly ["sandbox", "check run", "merge queue", "snapshot build"]>>;
+    readonly repo: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">>;
+    readonly name: Schema.optionalKey<Schema.brand<Schema.String, "RepoName">>;
+    readonly lines: Schema.$Array<Schema.Struct<{
+      readonly meter: Schema.Literals<readonly ["containers.vcpu_seconds", "containers.memory_gib_seconds", "containers.disk_gb_seconds", "containers.egress_gb", "browser.seconds", "artifacts.bytes", "r2.bytes"]>;
+      readonly quantity: Schema.Finite;
+      readonly known: Schema.Literals<readonly ["measured", "estimated"]>;
+    }>>;
+  }>>;
+  readonly kept: Schema.optionalKey<Schema.Struct<{
+    readonly day: Schema.brand<Schema.String, "UtcDay">;
+    readonly counts: Schema.$Array<Schema.Struct<{
+      readonly repo: Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">;
+      readonly name: Schema.optionalKey<Schema.brand<Schema.String, "RepoName">>;
+      readonly fork: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["fork_", Schema.String]>, "ForkId">>;
+      readonly store: Schema.Literals<readonly ["artifacts", "r2"]>;
+      readonly bytes: Schema.Int;
+      readonly known: Schema.Literals<readonly ["measured", "estimated"]>;
+    }>>;
+    readonly others: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+      readonly store: Schema.Literals<readonly ["artifacts", "r2"]>;
+      readonly known: Schema.Literals<readonly ["measured", "estimated"]>;
+      readonly counts: Schema.Int;
+      readonly bytes: Schema.Int;
+    }>>>;
+  }>>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof UsageRangeRefused>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"mirrors", "GET", "/v1/me/mirrors", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
   readonly mirrors: Schema.$Array<Schema.Struct<{
     readonly repo: Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">;
     readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
@@ -3368,10 +3498,6 @@ declare const MeGroup_base: HttpApiGroup.HttpApiGroup<"me", HttpApiEndpoint.Http
       readonly nextStep: Schema.optionalKey<Schema.String>;
     }>]>;
   }>>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"renew", "POST", "/v1/me/renew", never, never, never, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Struct<{
-  readonly expiresAt: Schema.DateTimeUtcFromMillis;
 }>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"usage", "GET", "/v1/me/usage", never, Schema.toCodecStringTree<Schema.Struct<{
   from: Schema.optionalKey<Schema.brand<Schema.String, "UtcDay">>;
   to: Schema.optionalKey<Schema.brand<Schema.String, "UtcDay">>;
@@ -3404,53 +3530,16 @@ declare const MeGroup_base: HttpApiGroup.HttpApiGroup<"me", HttpApiEndpoint.Http
     readonly harness: Schema.String;
   }>>;
   readonly pricesAsOf: Schema.String;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof UsageRangeRefused>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"meters", "GET", "/v1/me/meters", never, Schema.toCodecStringTree<Schema.Struct<{
-  from: Schema.optionalKey<Schema.brand<Schema.String, "UtcDay">>;
-  to: Schema.optionalKey<Schema.brand<Schema.String, "UtcDay">>;
-}>>, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly from: Schema.brand<Schema.String, "UtcDay">;
-  readonly to: Schema.brand<Schema.String, "UtcDay">;
-  readonly days: Schema.$Array<Schema.Struct<{
-    readonly day: Schema.brand<Schema.String, "UtcDay">;
-    readonly lines: Schema.$Array<Schema.Struct<{
-      readonly meter: Schema.Literals<readonly ["containers.vcpu_seconds", "containers.memory_gib_seconds", "containers.disk_gb_seconds", "containers.egress_gb", "browser.seconds", "artifacts.bytes", "r2.bytes"]>;
-      readonly quantity: Schema.Finite;
-      readonly known: Schema.Literals<readonly ["measured", "estimated"]>;
-    }>>;
-  }>>;
-  readonly work: Schema.$Array<Schema.Struct<{
-    readonly work: Schema.optionalKey<Schema.Literals<readonly ["sandbox", "check run", "merge queue", "snapshot build"]>>;
-    readonly repo: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">>;
-    readonly name: Schema.optionalKey<Schema.brand<Schema.String, "RepoName">>;
-    readonly lines: Schema.$Array<Schema.Struct<{
-      readonly meter: Schema.Literals<readonly ["containers.vcpu_seconds", "containers.memory_gib_seconds", "containers.disk_gb_seconds", "containers.egress_gb", "browser.seconds", "artifacts.bytes", "r2.bytes"]>;
-      readonly quantity: Schema.Finite;
-      readonly known: Schema.Literals<readonly ["measured", "estimated"]>;
-    }>>;
-  }>>;
-  readonly kept: Schema.optionalKey<Schema.Struct<{
-    readonly day: Schema.brand<Schema.String, "UtcDay">;
-    readonly counts: Schema.$Array<Schema.Struct<{
-      readonly repo: Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">;
-      readonly name: Schema.optionalKey<Schema.brand<Schema.String, "RepoName">>;
-      readonly fork: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["fork_", Schema.String]>, "ForkId">>;
-      readonly store: Schema.Literals<readonly ["artifacts", "r2"]>;
-      readonly bytes: Schema.Int;
-      readonly known: Schema.Literals<readonly ["measured", "estimated"]>;
-    }>>;
-    readonly others: Schema.optionalKey<Schema.$Array<Schema.Struct<{
-      readonly store: Schema.Literals<readonly ["artifacts", "r2"]>;
-      readonly known: Schema.Literals<readonly ["measured", "estimated"]>;
-      readonly counts: Schema.Int;
-      readonly bytes: Schema.Int;
-    }>>>;
-  }>>;
 }>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof UsageRangeRefused>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"identityToken", "POST", "/v1/me/identity-token", never, never, Schema.toCodecJson<Schema.Struct<{
   readonly audience: Schema.brand<Schema.String, "IdentityAudience">;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
   readonly token: Schema.brand<Schema.String, "IdentityToken">;
   readonly expiresAt: Schema.DateTimeUtcFromMillis;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof SessionHasEnded | typeof SlowDown | typeof IdentityAudienceRefused | typeof IdentityTokenNotReady>, Authorization | IdentityAudienceRefusal, never>, false>;
+}>>, Schema.toCodecJson<typeof IdentityAudienceRefused | typeof IdentityTokenNotReady | typeof NotPermitted | typeof AuthorityUnavailable | typeof SessionHasEnded | typeof SlowDown>, Authorization | IdentityAudienceRefusal, never> | HttpApiEndpoint.HttpApiEndpoint<"renew", "POST", "/v1/me/renew", never, never, never, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Struct<{
+  readonly expiresAt: Schema.DateTimeUtcFromMillis;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable>, Authorization, never>, false>;
 declare class MeGroup extends MeGroup_base {}
 declare const ThreadsGroup_base: HttpApiGroup.HttpApiGroup<"threads", HttpApiEndpoint.HttpApiEndpoint<"ask", "POST", "/v1/projects/:owner/:project/threads/:number/asks", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
@@ -5420,6 +5509,27 @@ declare const SessionsGroup_base: HttpApiGroup.HttpApiGroup<"sessions", HttpApiE
         readonly path: Schema.brand<Schema.String, "RepoPath">;
       }>>;
       readonly more: Schema.Int;
+      readonly toolTime: Schema.Union<readonly [Schema.Struct<{
+        readonly known: Schema.Literal<"timed">;
+        readonly totalMs: Schema.Int;
+        readonly longest: Schema.optionalKey<Schema.Struct<{
+          readonly tool: Schema.String;
+          readonly ms: Schema.Int;
+        }>>;
+      }>, Schema.Struct<{
+        readonly known: Schema.Literal<"unknown">;
+      }>]>;
+      readonly context: Schema.Union<readonly [Schema.Struct<{
+        readonly known: Schema.Literal<"read">;
+        readonly peak: Schema.optionalKey<Schema.Int>;
+        readonly compactions: Schema.$Array<Schema.Struct<{
+          readonly trigger: Schema.optionalKey<Schema.Literals<readonly ["auto", "manual"]>>;
+          readonly afterMs: Schema.optionalKey<Schema.Int>;
+        }>>;
+      }>, Schema.Struct<{
+        readonly known: Schema.Literal<"unknown">;
+      }>]>;
+      readonly moreSubagents: Schema.Int;
       readonly tokens: Schema.Union<readonly [Schema.Struct<{
         readonly known: Schema.Literal<"read">;
         readonly models: Schema.$Array<Schema.Struct<{
@@ -5432,6 +5542,21 @@ declare const SessionsGroup_base: HttpApiGroup.HttpApiGroup<"sessions", HttpApiE
       }>, Schema.Struct<{
         readonly known: Schema.Literal<"unknown">;
       }>]>;
+      readonly subagents: Schema.$Array<Schema.Struct<{
+        readonly type: Schema.optionalKey<Schema.String>;
+        readonly tokens: Schema.Union<readonly [Schema.Struct<{
+          readonly known: Schema.Literal<"read">;
+          readonly models: Schema.$Array<Schema.Struct<{
+            readonly model: Schema.String;
+            readonly input: Schema.Int;
+            readonly output: Schema.Int;
+            readonly cacheWrite: Schema.Int;
+            readonly cacheRead: Schema.Int;
+          }>>;
+        }>, Schema.Struct<{
+          readonly known: Schema.Literal<"unknown">;
+        }>]>;
+      }>>;
       readonly stoppedAfterMs: Schema.optionalKey<Schema.Int>;
     }>;
   }>>;
@@ -5452,6 +5577,27 @@ declare const SessionsGroup_base: HttpApiGroup.HttpApiGroup<"sessions", HttpApiE
       readonly path: Schema.brand<Schema.String, "RepoPath">;
     }>>;
     readonly more: Schema.Int;
+    readonly toolTime: Schema.Union<readonly [Schema.Struct<{
+      readonly known: Schema.Literal<"timed">;
+      readonly totalMs: Schema.Int;
+      readonly longest: Schema.optionalKey<Schema.Struct<{
+        readonly tool: Schema.String;
+        readonly ms: Schema.Int;
+      }>>;
+    }>, Schema.Struct<{
+      readonly known: Schema.Literal<"unknown">;
+    }>]>;
+    readonly context: Schema.Union<readonly [Schema.Struct<{
+      readonly known: Schema.Literal<"read">;
+      readonly peak: Schema.optionalKey<Schema.Int>;
+      readonly compactions: Schema.$Array<Schema.Struct<{
+        readonly trigger: Schema.optionalKey<Schema.Literals<readonly ["auto", "manual"]>>;
+        readonly afterMs: Schema.optionalKey<Schema.Int>;
+      }>>;
+    }>, Schema.Struct<{
+      readonly known: Schema.Literal<"unknown">;
+    }>]>;
+    readonly moreSubagents: Schema.Int;
     readonly tokens: Schema.Union<readonly [Schema.Struct<{
       readonly known: Schema.Literal<"read">;
       readonly models: Schema.$Array<Schema.Struct<{
@@ -5464,6 +5610,21 @@ declare const SessionsGroup_base: HttpApiGroup.HttpApiGroup<"sessions", HttpApiE
     }>, Schema.Struct<{
       readonly known: Schema.Literal<"unknown">;
     }>]>;
+    readonly subagents: Schema.$Array<Schema.Struct<{
+      readonly type: Schema.optionalKey<Schema.String>;
+      readonly tokens: Schema.Union<readonly [Schema.Struct<{
+        readonly known: Schema.Literal<"read">;
+        readonly models: Schema.$Array<Schema.Struct<{
+          readonly model: Schema.String;
+          readonly input: Schema.Int;
+          readonly output: Schema.Int;
+          readonly cacheWrite: Schema.Int;
+          readonly cacheRead: Schema.Int;
+        }>>;
+      }>, Schema.Struct<{
+        readonly known: Schema.Literal<"unknown">;
+      }>]>;
+    }>>;
     readonly stoppedAfterMs: Schema.optionalKey<Schema.Int>;
   }>;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
@@ -6347,6 +6508,9 @@ declare const EventsGroup_base: HttpApiGroup.HttpApiGroup<"events", HttpApiEndpo
         readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
       }>>;
       readonly expiresAt: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
+      readonly cnf: Schema.optionalKey<Schema.Struct<{
+        readonly jkt: Schema.brand<Schema.String, "KeyThumbprint">;
+      }>>;
     }>;
   } & {
     readonly seq: Schema.Int;
@@ -11326,6 +11490,27 @@ declare const EventsGroup_base: HttpApiGroup.HttpApiGroup<"events", HttpApiEndpo
           readonly path: Schema.brand<Schema.String, "RepoPath">;
         }>>;
         readonly more: Schema.Int;
+        readonly toolTime: Schema.Union<readonly [Schema.Struct<{
+          readonly known: Schema.Literal<"timed">;
+          readonly totalMs: Schema.Int;
+          readonly longest: Schema.optionalKey<Schema.Struct<{
+            readonly tool: Schema.String;
+            readonly ms: Schema.Int;
+          }>>;
+        }>, Schema.Struct<{
+          readonly known: Schema.Literal<"unknown">;
+        }>]>;
+        readonly context: Schema.Union<readonly [Schema.Struct<{
+          readonly known: Schema.Literal<"read">;
+          readonly peak: Schema.optionalKey<Schema.Int>;
+          readonly compactions: Schema.$Array<Schema.Struct<{
+            readonly trigger: Schema.optionalKey<Schema.Literals<readonly ["auto", "manual"]>>;
+            readonly afterMs: Schema.optionalKey<Schema.Int>;
+          }>>;
+        }>, Schema.Struct<{
+          readonly known: Schema.Literal<"unknown">;
+        }>]>;
+        readonly moreSubagents: Schema.Int;
         readonly tokens: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
           readonly known: Schema.Literal<"read">;
           readonly models: Schema.$Array<Schema.Struct<{
@@ -11338,6 +11523,21 @@ declare const EventsGroup_base: HttpApiGroup.HttpApiGroup<"events", HttpApiEndpo
         }>, Schema.Struct<{
           readonly known: Schema.Literal<"unknown">;
         }>]>>;
+        readonly subagents: Schema.$Array<Schema.Struct<{
+          readonly type: Schema.optionalKey<Schema.String>;
+          readonly tokens: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
+            readonly known: Schema.Literal<"read">;
+            readonly models: Schema.$Array<Schema.Struct<{
+              readonly model: Schema.String;
+              readonly input: Schema.Int;
+              readonly output: Schema.Int;
+              readonly cacheWrite: Schema.Int;
+              readonly cacheRead: Schema.Int;
+            }>>;
+          }>, Schema.Struct<{
+            readonly known: Schema.Literal<"unknown">;
+          }>]>>;
+        }>>;
       }>>;
       readonly tasks: Schema.optionalKey<Schema.$Array<Schema.Struct<{
         readonly text: Schema.brand<Schema.TemplateLiteral<readonly ["text_", Schema.String]>, "TextId">;
@@ -13000,34 +13200,220 @@ declare const OwnerThreadsGroup_base: HttpApiGroup.HttpApiGroup<"ownerThreads",
  * the stage as filters. A project the reader can't see answers as one that isn't there.
  */
 declare class OwnerThreadsGroup extends OwnerThreadsGroup_base {}
-declare const ReposGroup_base: HttpApiGroup.HttpApiGroup<"repos", HttpApiEndpoint.HttpApiEndpoint<"projectGate", "GET", "/v1/repos/:owner/:repo/project-gate", Schema.toCodecStringTree<Schema.Struct<{
+declare const ReposGroup_base: HttpApiGroup.HttpApiGroup<"repos", HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/owners/:owner/repos", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-  repo: Schema.brand<Schema.String, "RepoName">;
-}>>, never, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly active: Schema.Struct<{
-    readonly revision: Schema.Int;
-    readonly commit: Schema.NullOr<Schema.brand<Schema.String, "CommitOid">>;
-    readonly repo: Schema.NullOr<Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">>;
-  }>;
-  readonly pending: Schema.optionalKey<Schema.Struct<{
-    readonly revision: Schema.Int;
-    readonly commit: Schema.NullOr<Schema.brand<Schema.String, "CommitOid">>;
-    readonly repo: Schema.NullOr<Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">>;
-  }>>;
-  readonly holding: Schema.$Array<Schema.Struct<{
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  after: Schema.optionalKey<Schema.brand<Schema.String, "RepoName">>;
+  limit: Schema.optionalKey<Schema.Int>;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly repos: Schema.$Array<Schema.Struct<{
     readonly repo: Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">;
-    readonly latch: Schema.brand<Schema.TemplateLiteral<readonly ["latch_", Schema.String]>, "LatchId">;
-    readonly thread: Schema.brand<Schema.TemplateLiteral<readonly ["thread_", Schema.String]>, "ThreadId">;
-    readonly version: Schema.brand<Schema.TemplateLiteral<readonly ["version_", Schema.String]>, "VersionId">;
-    readonly gate: Schema.Int;
-    readonly since: Schema.Int;
+    readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+    readonly project: Schema.brand<Schema.TemplateLiteral<readonly ["project_", Schema.String]>, "ProjectId">;
+    readonly scope: Schema.Union<readonly [Schema.Struct<{
+      readonly kind: Schema.Literal<"project">;
+      readonly name: Schema.brand<Schema.String, "ProjectName">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"owner">;
+    }>]>;
+    readonly name: Schema.brand<Schema.String, "RepoName">;
+    readonly visibility: Schema.Literals<readonly ["private", "internal", "public"]>;
+    readonly state: Schema.Literals<readonly ["creating", "importing", "ready", "failed"]>;
+    readonly createdAt: Schema.DateTimeUtcFromMillis;
   }>>;
-}>>, Schema.toCodecJson<typeof RepoNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"pull", "GET", "/v1/repos/:owner/:repo/pulls/:pullRequest", Schema.toCodecStringTree<Schema.Struct<{
+  readonly nextAfter: Schema.optionalKey<Schema.brand<Schema.String, "RepoName">>;
+}>>, never, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"get", "GET", "/v1/repos/:owner/:repo", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   repo: Schema.brand<Schema.String, "RepoName">;
-  pullRequest: Schema.brand<Schema.Int, "PullRequestNumber">;
 }>>, never, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly pullRequest: Schema.brand<Schema.Int, "PullRequestNumber">;
+  readonly repo: Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">;
+  readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+  readonly project: Schema.brand<Schema.TemplateLiteral<readonly ["project_", Schema.String]>, "ProjectId">;
+  readonly scope: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"project">;
+    readonly name: Schema.brand<Schema.String, "ProjectName">;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"owner">;
+  }>]>;
+  readonly name: Schema.brand<Schema.String, "RepoName">;
+  readonly visibility: Schema.Literals<readonly ["private", "internal", "public"]>;
+  readonly state: Schema.Literals<readonly ["creating", "importing", "ready", "failed"]>;
+  readonly createdAt: Schema.DateTimeUtcFromMillis;
+}>>, Schema.toCodecJson<typeof RepoNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"line", "GET", "/v1/repos/:owner/:repo/commits/:commit/lines", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+  repo: Schema.brand<Schema.String, "RepoName">;
+  commit: Schema.brand<Schema.String, "CommitOid">;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  path: Schema.brand<Schema.String, "RepoPath">;
+  line: Schema.Int;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly commit: Schema.brand<Schema.String, "CommitOid">;
+  readonly path: Schema.brand<Schema.String, "RepoPath">;
+  readonly line: Schema.Int;
+  readonly from: Schema.Literals<readonly ["session", "workflow", "main", "unknown"]>;
+  readonly authorship: Schema.Literals<readonly ["ai", "human", "mixed", "unknown"]>;
+  readonly turns: Schema.$Array<Schema.Struct<{
+    readonly thread: Schema.brand<Schema.TemplateLiteral<readonly ["thread_", Schema.String]>, "ThreadId">;
+    readonly threadNumber: Schema.Int;
+    readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["session_", Schema.String]>, "SessionId">;
+    readonly turn: Schema.Int;
+    readonly authorship: Schema.Literals<readonly ["ai", "human", "mixed", "unknown"]>;
+    readonly model: Schema.optionalKey<Schema.String>;
+  }>>;
+  readonly workflow: Schema.optionalKey<Schema.Struct<{
+    readonly name: Schema.brand<Schema.String, "WorkflowName">;
+    readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["workflowrun_", Schema.String]>, "WorkflowRunId">;
+    readonly version: Schema.brand<Schema.String, "WorkflowVersion">;
+    readonly step: Schema.Struct<{
+      readonly name: Schema.String;
+      readonly count: Schema.Int;
+      readonly attempt: Schema.Int;
+    }>;
+  }>>;
+}>>, Schema.toCodecJson<typeof RepoNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"manifest", "GET", "/v1/repos/:owner/:repo/history/manifest", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+  repo: Schema.brand<Schema.String, "RepoName">;
+}>>, never, never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly repo: Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">;
+  readonly version: Schema.Int;
+  readonly baseline: Schema.Struct<{
+    readonly gitRepository: Schema.brand<Schema.TemplateLiteral<readonly ["gitrepo_", Schema.String]>, "GitRepositoryId">;
+    readonly tip: Schema.brand<Schema.String, "CommitOid">;
+    readonly sequence: Schema.Int;
+    readonly depth: Schema.Int;
+    readonly boundary: Schema.$Array<Schema.brand<Schema.String, "CommitOid">>;
+  }>;
+  readonly main: Schema.optionalKey<Schema.Struct<{
+    readonly sequence: Schema.Int;
+    readonly commit: Schema.brand<Schema.String, "CommitOid">;
+  }>>;
+  readonly packs: Schema.$Array<Schema.Struct<{
+    readonly kind: Schema.Literals<readonly ["base", "baseline", "deepen", "merge", "rollup"]>;
+    readonly key: Schema.String;
+    readonly sha256: Schema.String;
+    readonly bytes: Schema.Int;
+    readonly merges: Schema.optionalKey<Schema.Struct<{
+      readonly first: Schema.Int;
+      readonly last: Schema.Int;
+    }>>;
+    readonly baseline: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["gitrepo_", Schema.String]>, "GitRepositoryId">>;
+    readonly depth: Schema.optionalKey<Schema.Int>;
+    readonly roots: Schema.$Array<Schema.Struct<{
+      readonly commit: Schema.brand<Schema.String, "CommitOid">;
+      readonly parents: Schema.$Array<Schema.brand<Schema.String, "CommitOid">>;
+    }>>;
+  }>>;
+}>>, Schema.toCodecJson<typeof RepoNotFound | typeof HistoryNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"pack", "GET", "/v1/repos/:owner/:repo/history/packs", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+  repo: Schema.brand<Schema.String, "RepoName">;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  key: Schema.String;
+}>>, never, never, HttpApiSchema.StreamUint8Array, Schema.toCodecJson<typeof RepoNotFound | typeof HistoryPackNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"mirror", "GET", "/v1/repos/:owner/:repo/mirror", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+  repo: Schema.brand<Schema.String, "RepoName">;
+}>>, never, never, never, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
+  readonly kind: Schema.Literal<"none">;
+}>, Schema.Struct<{
+  readonly kind: Schema.Literal<"github">;
+  readonly branch: Schema.String;
+  readonly mirror: Schema.Union<readonly [Schema.Struct<{
+    readonly state: Schema.Literal<"on">;
+  }>, Schema.Struct<{
+    readonly state: Schema.Literal<"paused">;
+    readonly paused: Schema.Union<readonly [Schema.Struct<{
+      readonly why: Schema.Literal<"diverged">;
+      readonly github: Schema.NullOr<Schema.brand<Schema.String, "CommitOid">>;
+    }>, Schema.Struct<{
+      readonly why: Schema.Literal<"refused">;
+      readonly said: Schema.String;
+    }>, Schema.Struct<{
+      readonly why: Schema.Literal<"unauthorized">;
+    }>]>;
+  }>, Schema.Struct<{
+    readonly state: Schema.Literal<"off">;
+  }>]>;
+  readonly lastMirrored: Schema.NullOr<Schema.brand<Schema.String, "CommitOid">>;
+  readonly nextStep: Schema.optionalKey<Schema.String>;
+}>]>>, Schema.toCodecJson<typeof RepoNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"projectGate", "GET", "/v1/repos/:owner/:repo/project-gate", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+  repo: Schema.brand<Schema.String, "RepoName">;
+}>>, never, never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly active: Schema.Struct<{
+    readonly revision: Schema.Int;
+    readonly commit: Schema.NullOr<Schema.brand<Schema.String, "CommitOid">>;
+    readonly repo: Schema.NullOr<Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">>;
+  }>;
+  readonly pending: Schema.optionalKey<Schema.Struct<{
+    readonly revision: Schema.Int;
+    readonly commit: Schema.NullOr<Schema.brand<Schema.String, "CommitOid">>;
+    readonly repo: Schema.NullOr<Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">>;
+  }>>;
+  readonly holding: Schema.$Array<Schema.Struct<{
+    readonly repo: Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">;
+    readonly latch: Schema.brand<Schema.TemplateLiteral<readonly ["latch_", Schema.String]>, "LatchId">;
+    readonly thread: Schema.brand<Schema.TemplateLiteral<readonly ["thread_", Schema.String]>, "ThreadId">;
+    readonly version: Schema.brand<Schema.TemplateLiteral<readonly ["version_", Schema.String]>, "VersionId">;
+    readonly gate: Schema.Int;
+    readonly since: Schema.Int;
+  }>>;
+}>>, Schema.toCodecJson<typeof RepoNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"pulls", "GET", "/v1/repos/:owner/:repo/pulls", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+  repo: Schema.brand<Schema.String, "RepoName">;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  readonly state: Schema.optionalKey<Schema.Literals<readonly ["open", "merged", "closed"]>>;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly pullRequests: Schema.$Array<Schema.Struct<{
+    readonly pullRequest: Schema.brand<Schema.Int, "PullRequestNumber">;
+    readonly thread: Schema.brand<Schema.TemplateLiteral<readonly ["thread_", Schema.String]>, "ThreadId">;
+    readonly state: Schema.Literals<readonly ["open", "merged", "closed"]>;
+    readonly head: Schema.Struct<{
+      readonly gitRepository: Schema.brand<Schema.TemplateLiteral<readonly ["gitrepo_", Schema.String]>, "GitRepositoryId">;
+      readonly fork: Schema.brand<Schema.TemplateLiteral<readonly ["fork_", Schema.String]>, "ForkId">;
+      readonly branch: Schema.String;
+      readonly commit: Schema.brand<Schema.String, "CommitOid">;
+      readonly generation: Schema.Int;
+    }>;
+    readonly openedBy: Schema.Union<readonly [Schema.Struct<{
+      readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["session_", Schema.String]>, "SessionId">;
+      readonly agent: Schema.Struct<{
+        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+      }>;
+    }>, Schema.Struct<{
+      readonly workflow: Schema.Struct<{
+        readonly name: Schema.brand<Schema.String, "WorkflowName">;
+        readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["workflowrun_", Schema.String]>, "WorkflowRunId">;
+        readonly version: Schema.brand<Schema.String, "WorkflowVersion">;
+        readonly step: Schema.Struct<{
+          readonly name: Schema.String;
+          readonly count: Schema.Int;
+          readonly attempt: Schema.Int;
+        }>;
+      }>;
+    }>]>;
+    readonly openedAt: Schema.DateTimeUtcFromMillis;
+    readonly closedAt: Schema.NullOr<Schema.DateTimeUtcFromMillis>;
+    readonly closedWhy: Schema.NullOr<Schema.Literals<readonly ["closed", "thread closed", "fork deleted"]>>;
+    readonly repair: Schema.Boolean;
+    readonly current: Schema.Struct<{
+      readonly version: Schema.brand<Schema.Int, "VersionNumber">;
+      readonly head: Schema.brand<Schema.String, "CommitOid">;
+      readonly base: Schema.NullOr<Schema.brand<Schema.String, "CommitOid">>;
+      readonly planVersion: Schema.NullOr<Schema.Int>;
+      readonly intentRevision: Schema.Int;
+      readonly generation: Schema.Int;
+      readonly state: Schema.Literals<readonly ["preparing", "evaluating", "gating", "waiting", "queued", "publishing", "merged", "superseded", "stale", "conflicted"]>;
+      readonly why: Schema.Literals<readonly ["opened", "push", "head set", "main moved", ".ref0/ changed", "outcomes changed", "intent changed", "needs changed", "project gate changed"]>;
+      readonly createdAt: Schema.DateTimeUtcFromMillis;
+    }>;
+    readonly threadNumber: Schema.Int;
+  }>>;
+}>>, Schema.toCodecJson<typeof RepoNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"pull", "GET", "/v1/repos/:owner/:repo/pulls/:pullRequest", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+  repo: Schema.brand<Schema.String, "RepoName">;
+  pullRequest: Schema.brand<Schema.Int, "PullRequestNumber">;
+}>>, never, never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly pullRequest: Schema.brand<Schema.Int, "PullRequestNumber">;
   readonly thread: Schema.brand<Schema.TemplateLiteral<readonly ["thread_", Schema.String]>, "ThreadId">;
   readonly state: Schema.Literals<readonly ["open", "merged", "closed"]>;
   readonly head: Schema.Struct<{
@@ -13071,24 +13457,7 @@ declare const ReposGroup_base: HttpApiGroup.HttpApiGroup<"repos", HttpApiEndpoin
     readonly createdAt: Schema.DateTimeUtcFromMillis;
   }>;
   readonly threadNumber: Schema.Int;
-}>>, Schema.toCodecJson<typeof PullRequestNotFound | typeof RepoNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"get", "GET", "/v1/repos/:owner/:repo", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-  repo: Schema.brand<Schema.String, "RepoName">;
-}>>, never, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly repo: Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">;
-  readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-  readonly project: Schema.brand<Schema.TemplateLiteral<readonly ["project_", Schema.String]>, "ProjectId">;
-  readonly scope: Schema.Union<readonly [Schema.Struct<{
-    readonly kind: Schema.Literal<"project">;
-    readonly name: Schema.brand<Schema.String, "ProjectName">;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"owner">;
-  }>]>;
-  readonly name: Schema.brand<Schema.String, "RepoName">;
-  readonly visibility: Schema.Literals<readonly ["private", "internal", "public"]>;
-  readonly state: Schema.Literals<readonly ["creating", "importing", "ready", "failed"]>;
-  readonly createdAt: Schema.DateTimeUtcFromMillis;
-}>>, Schema.toCodecJson<typeof RepoNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"gate", "GET", "/v1/repos/:owner/:repo/pulls/:pullRequest/gate", Schema.toCodecStringTree<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof PullRequestNotFound | typeof RepoNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"gate", "GET", "/v1/repos/:owner/:repo/pulls/:pullRequest/gate", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   repo: Schema.brand<Schema.String, "RepoName">;
   pullRequest: Schema.brand<Schema.Int, "PullRequestNumber">;
@@ -13851,66 +14220,7 @@ declare const ReposGroup_base: HttpApiGroup.HttpApiGroup<"repos", HttpApiEndpoin
     readonly failed: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
     readonly at: Schema.DateTimeUtcFromMillis;
   }>]>>>;
-}>>, Schema.toCodecJson<typeof PullRequestNotFound | typeof RepoNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"manifest", "GET", "/v1/repos/:owner/:repo/history/manifest", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-  repo: Schema.brand<Schema.String, "RepoName">;
-}>>, never, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly repo: Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">;
-  readonly version: Schema.Int;
-  readonly baseline: Schema.Struct<{
-    readonly gitRepository: Schema.brand<Schema.TemplateLiteral<readonly ["gitrepo_", Schema.String]>, "GitRepositoryId">;
-    readonly tip: Schema.brand<Schema.String, "CommitOid">;
-    readonly sequence: Schema.Int;
-    readonly depth: Schema.Int;
-    readonly boundary: Schema.$Array<Schema.brand<Schema.String, "CommitOid">>;
-  }>;
-  readonly main: Schema.optionalKey<Schema.Struct<{
-    readonly sequence: Schema.Int;
-    readonly commit: Schema.brand<Schema.String, "CommitOid">;
-  }>>;
-  readonly packs: Schema.$Array<Schema.Struct<{
-    readonly kind: Schema.Literals<readonly ["base", "baseline", "deepen", "merge", "rollup"]>;
-    readonly key: Schema.String;
-    readonly sha256: Schema.String;
-    readonly bytes: Schema.Int;
-    readonly merges: Schema.optionalKey<Schema.Struct<{
-      readonly first: Schema.Int;
-      readonly last: Schema.Int;
-    }>>;
-    readonly baseline: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["gitrepo_", Schema.String]>, "GitRepositoryId">>;
-    readonly depth: Schema.optionalKey<Schema.Int>;
-    readonly roots: Schema.$Array<Schema.Struct<{
-      readonly commit: Schema.brand<Schema.String, "CommitOid">;
-      readonly parents: Schema.$Array<Schema.brand<Schema.String, "CommitOid">>;
-    }>>;
-  }>>;
-}>>, Schema.toCodecJson<typeof RepoNotFound | typeof HistoryNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"mirror", "GET", "/v1/repos/:owner/:repo/mirror", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-  repo: Schema.brand<Schema.String, "RepoName">;
-}>>, never, never, never, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
-  readonly kind: Schema.Literal<"none">;
-}>, Schema.Struct<{
-  readonly kind: Schema.Literal<"github">;
-  readonly branch: Schema.String;
-  readonly mirror: Schema.Union<readonly [Schema.Struct<{
-    readonly state: Schema.Literal<"on">;
-  }>, Schema.Struct<{
-    readonly state: Schema.Literal<"paused">;
-    readonly paused: Schema.Union<readonly [Schema.Struct<{
-      readonly why: Schema.Literal<"diverged">;
-      readonly github: Schema.NullOr<Schema.brand<Schema.String, "CommitOid">>;
-    }>, Schema.Struct<{
-      readonly why: Schema.Literal<"refused">;
-      readonly said: Schema.String;
-    }>, Schema.Struct<{
-      readonly why: Schema.Literal<"unauthorized">;
-    }>]>;
-  }>, Schema.Struct<{
-    readonly state: Schema.Literal<"off">;
-  }>]>;
-  readonly lastMirrored: Schema.NullOr<Schema.brand<Schema.String, "CommitOid">>;
-  readonly nextStep: Schema.optionalKey<Schema.String>;
-}>]>>, Schema.toCodecJson<typeof RepoNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"create", "POST", "/v1/owners/:owner/repos", Schema.toCodecStringTree<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof PullRequestNotFound | typeof RepoNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"create", "POST", "/v1/owners/:owner/repos", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
   readonly name: Schema.brand<Schema.String, "RepoName">;
@@ -14035,117 +14345,7 @@ declare const ReposGroup_base: HttpApiGroup.HttpApiGroup<"repos", HttpApiEndpoin
   }>]>;
   readonly lastMirrored: Schema.NullOr<Schema.brand<Schema.String, "CommitOid">>;
   readonly nextStep: Schema.optionalKey<Schema.String>;
-}>]>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof RepoNotFound | typeof CommandRefused | typeof ApprovalNeeded | typeof SlowDown | typeof NotMirrored>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"pulls", "GET", "/v1/repos/:owner/:repo/pulls", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-  repo: Schema.brand<Schema.String, "RepoName">;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  readonly state: Schema.optionalKey<Schema.Literals<readonly ["open", "merged", "closed"]>>;
-}>>, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly pullRequests: Schema.$Array<Schema.Struct<{
-    readonly pullRequest: Schema.brand<Schema.Int, "PullRequestNumber">;
-    readonly thread: Schema.brand<Schema.TemplateLiteral<readonly ["thread_", Schema.String]>, "ThreadId">;
-    readonly state: Schema.Literals<readonly ["open", "merged", "closed"]>;
-    readonly head: Schema.Struct<{
-      readonly gitRepository: Schema.brand<Schema.TemplateLiteral<readonly ["gitrepo_", Schema.String]>, "GitRepositoryId">;
-      readonly fork: Schema.brand<Schema.TemplateLiteral<readonly ["fork_", Schema.String]>, "ForkId">;
-      readonly branch: Schema.String;
-      readonly commit: Schema.brand<Schema.String, "CommitOid">;
-      readonly generation: Schema.Int;
-    }>;
-    readonly openedBy: Schema.Union<readonly [Schema.Struct<{
-      readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["session_", Schema.String]>, "SessionId">;
-      readonly agent: Schema.Struct<{
-        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-      }>;
-    }>, Schema.Struct<{
-      readonly workflow: Schema.Struct<{
-        readonly name: Schema.brand<Schema.String, "WorkflowName">;
-        readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["workflowrun_", Schema.String]>, "WorkflowRunId">;
-        readonly version: Schema.brand<Schema.String, "WorkflowVersion">;
-        readonly step: Schema.Struct<{
-          readonly name: Schema.String;
-          readonly count: Schema.Int;
-          readonly attempt: Schema.Int;
-        }>;
-      }>;
-    }>]>;
-    readonly openedAt: Schema.DateTimeUtcFromMillis;
-    readonly closedAt: Schema.NullOr<Schema.DateTimeUtcFromMillis>;
-    readonly closedWhy: Schema.NullOr<Schema.Literals<readonly ["closed", "thread closed", "fork deleted"]>>;
-    readonly repair: Schema.Boolean;
-    readonly current: Schema.Struct<{
-      readonly version: Schema.brand<Schema.Int, "VersionNumber">;
-      readonly head: Schema.brand<Schema.String, "CommitOid">;
-      readonly base: Schema.NullOr<Schema.brand<Schema.String, "CommitOid">>;
-      readonly planVersion: Schema.NullOr<Schema.Int>;
-      readonly intentRevision: Schema.Int;
-      readonly generation: Schema.Int;
-      readonly state: Schema.Literals<readonly ["preparing", "evaluating", "gating", "waiting", "queued", "publishing", "merged", "superseded", "stale", "conflicted"]>;
-      readonly why: Schema.Literals<readonly ["opened", "push", "head set", "main moved", ".ref0/ changed", "outcomes changed", "intent changed", "needs changed", "project gate changed"]>;
-      readonly createdAt: Schema.DateTimeUtcFromMillis;
-    }>;
-    readonly threadNumber: Schema.Int;
-  }>>;
-}>>, Schema.toCodecJson<typeof RepoNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/owners/:owner/repos", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  after: Schema.optionalKey<Schema.brand<Schema.String, "RepoName">>;
-  limit: Schema.optionalKey<Schema.Int>;
-}>>, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly repos: Schema.$Array<Schema.Struct<{
-    readonly repo: Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">;
-    readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-    readonly project: Schema.brand<Schema.TemplateLiteral<readonly ["project_", Schema.String]>, "ProjectId">;
-    readonly scope: Schema.Union<readonly [Schema.Struct<{
-      readonly kind: Schema.Literal<"project">;
-      readonly name: Schema.brand<Schema.String, "ProjectName">;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"owner">;
-    }>]>;
-    readonly name: Schema.brand<Schema.String, "RepoName">;
-    readonly visibility: Schema.Literals<readonly ["private", "internal", "public"]>;
-    readonly state: Schema.Literals<readonly ["creating", "importing", "ready", "failed"]>;
-    readonly createdAt: Schema.DateTimeUtcFromMillis;
-  }>>;
-  readonly nextAfter: Schema.optionalKey<Schema.brand<Schema.String, "RepoName">>;
-}>>, never, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"pack", "GET", "/v1/repos/:owner/:repo/history/packs", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-  repo: Schema.brand<Schema.String, "RepoName">;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  key: Schema.String;
-}>>, never, never, HttpApiSchema.StreamUint8Array, Schema.toCodecJson<typeof RepoNotFound | typeof HistoryPackNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"line", "GET", "/v1/repos/:owner/:repo/commits/:commit/lines", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-  repo: Schema.brand<Schema.String, "RepoName">;
-  commit: Schema.brand<Schema.String, "CommitOid">;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  path: Schema.brand<Schema.String, "RepoPath">;
-  line: Schema.Int;
-}>>, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly commit: Schema.brand<Schema.String, "CommitOid">;
-  readonly path: Schema.brand<Schema.String, "RepoPath">;
-  readonly line: Schema.Int;
-  readonly from: Schema.Literals<readonly ["session", "workflow", "main", "unknown"]>;
-  readonly authorship: Schema.Literals<readonly ["ai", "human", "mixed", "unknown"]>;
-  readonly turns: Schema.$Array<Schema.Struct<{
-    readonly thread: Schema.brand<Schema.TemplateLiteral<readonly ["thread_", Schema.String]>, "ThreadId">;
-    readonly threadNumber: Schema.Int;
-    readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["session_", Schema.String]>, "SessionId">;
-    readonly turn: Schema.Int;
-    readonly authorship: Schema.Literals<readonly ["ai", "human", "mixed", "unknown"]>;
-    readonly model: Schema.optionalKey<Schema.String>;
-  }>>;
-  readonly workflow: Schema.optionalKey<Schema.Struct<{
-    readonly name: Schema.brand<Schema.String, "WorkflowName">;
-    readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["workflowrun_", Schema.String]>, "WorkflowRunId">;
-    readonly version: Schema.brand<Schema.String, "WorkflowVersion">;
-    readonly step: Schema.Struct<{
-      readonly name: Schema.String;
-      readonly count: Schema.Int;
-      readonly attempt: Schema.Int;
-    }>;
-  }>>;
-}>>, Schema.toCodecJson<typeof RepoNotFound>, Authorization, never>, false>;
+}>]>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof RepoNotFound | typeof CommandRefused | typeof ApprovalNeeded | typeof SlowDown | typeof NotMirrored>, Authorization, never>, false>;
 /**
  * An owner's repos, as each reader may see them: a repo shows only to whoever can see its
  * project. Adding one is a person's approved command, which reaches `/v1` with approvals.
@@ -17695,31 +17895,7 @@ declare const WorkflowsGroup_base: HttpApiGroup.HttpApiGroup<"workflows", HttpAp
     readonly thread: Schema.optionalKey<Schema.Int>;
     readonly suspended: Schema.optionalKey<Schema.Literal<true>>;
   }>>;
-}>>, Schema.toCodecJson<typeof RepoNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"disable", "POST", "/v1/repos/:owner/:repo/workflows/disable", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-  repo: Schema.brand<Schema.String, "RepoName">;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-  readonly workflows: Schema.Union<readonly [Schema.Literal<"all">, Schema.$Array<Schema.brand<Schema.String, "WorkflowName">>]>;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Struct<{
-  readonly disabled: Schema.$Array<Schema.brand<Schema.String, "WorkflowName">>;
-  readonly alreadyDisabled: Schema.$Array<Schema.brand<Schema.String, "WorkflowName">>;
-  readonly coversUnread: Schema.Boolean;
-}>>, Schema.toCodecJson<typeof ProjectNotFound | typeof NotPermitted | typeof DeliveryOutsideWindow | typeof ProjectNotReady | typeof RepoNotFound | typeof WorkflowNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"enable", "POST", "/v1/repos/:owner/:repo/workflows/enable", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-  repo: Schema.brand<Schema.String, "RepoName">;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-  readonly workflow: Schema.brand<Schema.String, "WorkflowName">;
-  readonly version: Schema.brand<Schema.String, "WorkflowVersion">;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Struct<{
-  readonly workflow: Schema.brand<Schema.String, "WorkflowName">;
-  readonly version: Schema.brand<Schema.String, "WorkflowVersion">;
-  readonly changed: Schema.Boolean;
-  readonly accountable: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-}>>, Schema.toCodecJson<typeof ProjectNotFound | typeof NotPermitted | typeof DeliveryOutsideWindow | typeof ProjectNotReady | typeof RepoNotFound | typeof WorkflowNotFound | typeof WorkflowVersionMoved | typeof WorkflowsBeingRead | typeof WorkflowHasNoVersion>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"runs", "GET", "/v1/repos/:owner/:repo/workflows/:workflow/runs", Schema.toCodecStringTree<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof RepoNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"runs", "GET", "/v1/repos/:owner/:repo/workflows/:workflow/runs", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   repo: Schema.brand<Schema.String, "RepoName">;
   workflow: Schema.brand<Schema.String, "WorkflowName">;
@@ -17791,133 +17967,124 @@ declare const WorkflowsGroup_base: HttpApiGroup.HttpApiGroup<"workflows", HttpAp
     readonly title: Schema.optionalKey<Schema.String>;
   }>>;
   readonly before: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["workflowrun_", Schema.String]>, "WorkflowRunId">>;
-}>>, Schema.toCodecJson<typeof RepoNotFound>, Authorization, never>, false>;
+}>>, Schema.toCodecJson<typeof RepoNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"disable", "POST", "/v1/repos/:owner/:repo/workflows/disable", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+  repo: Schema.brand<Schema.String, "RepoName">;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+  readonly workflows: Schema.Union<readonly [Schema.Literal<"all">, Schema.$Array<Schema.brand<Schema.String, "WorkflowName">>]>;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Struct<{
+  readonly disabled: Schema.$Array<Schema.brand<Schema.String, "WorkflowName">>;
+  readonly alreadyDisabled: Schema.$Array<Schema.brand<Schema.String, "WorkflowName">>;
+  readonly coversUnread: Schema.Boolean;
+}>>, Schema.toCodecJson<typeof ProjectNotFound | typeof NotPermitted | typeof DeliveryOutsideWindow | typeof ProjectNotReady | typeof RepoNotFound | typeof WorkflowNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"enable", "POST", "/v1/repos/:owner/:repo/workflows/enable", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+  repo: Schema.brand<Schema.String, "RepoName">;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+  readonly workflow: Schema.brand<Schema.String, "WorkflowName">;
+  readonly version: Schema.brand<Schema.String, "WorkflowVersion">;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Struct<{
+  readonly workflow: Schema.brand<Schema.String, "WorkflowName">;
+  readonly version: Schema.brand<Schema.String, "WorkflowVersion">;
+  readonly changed: Schema.Boolean;
+  readonly accountable: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+}>>, Schema.toCodecJson<typeof ProjectNotFound | typeof NotPermitted | typeof DeliveryOutsideWindow | typeof ProjectNotReady | typeof RepoNotFound | typeof WorkflowNotFound | typeof WorkflowVersionMoved | typeof WorkflowsBeingRead | typeof WorkflowHasNoVersion>, Authorization, never>, false>;
 /**
  * A repo's workflows and their workflow runs, for whoever may read the repo. Turning workflows
  * off is a person's approved command, which reaches `/v1` with approvals; an agent asks its
  * person.
  */
 declare class WorkflowsGroup extends WorkflowsGroup_base {}
-declare const RunsGroup_base: HttpApiGroup.HttpApiGroup<"runs", HttpApiEndpoint.HttpApiEndpoint<"start", "POST", "/v1/repos/:owner/:repo/runs", Schema.toCodecStringTree<Schema.Struct<{
+declare const RunsGroup_base: HttpApiGroup.HttpApiGroup<"runs", HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/repos/:owner/:repo/runs", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   repo: Schema.brand<Schema.String, "RepoName">;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-  readonly check: Schema.brand<Schema.String, "CheckKey">;
-  readonly on: Schema.Union<readonly [Schema.Struct<{
-    readonly kind: Schema.Literal<"main">;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"thread">;
-    readonly thread: Schema.brand<Schema.String, "WrittenThread">;
-    readonly branch: Schema.optionalKey<Schema.String>;
-  }>]>;
-  readonly params: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
-  readonly rerun: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
 }>>, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
+  readonly thread: Schema.optionalKey<Schema.brand<Schema.String, "WrittenThread">>;
+  readonly check: Schema.optionalKey<Schema.brand<Schema.String, "CheckKey">>;
+  readonly before: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
   readonly runs: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
     readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+    readonly check: Schema.brand<Schema.String, "CheckName">;
     readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
     readonly rerun: Schema.Int;
     readonly rerunOf: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-    readonly got: Schema.Literals<readonly ["new", "joined", "answered"]>;
-    readonly reusedFrom: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-    readonly readsMoved: Schema.optionalKey<Schema.String>;
-    readonly reuseSkipped: Schema.optionalKey<Schema.String>;
+    readonly tree: Schema.brand<Schema.String, "TreeOid">;
+    readonly origin: Schema.Literals<readonly ["main", "thread", "project"]>;
+    readonly createdAt: Schema.DateTimeUtcFromMillis;
+    readonly startedAt: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
+    readonly endedAt: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
+    readonly starters: Schema.$Array<Schema.Struct<{
+      readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"person">;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"agent">;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"ref0">;
+        readonly id: Schema.Literals<("ref0:attachments" | "ref0:barrier" | "ref0:blockers" | "ref0:checks" | "ref0:gate" | "ref0:hooks" | "ref0:importer" | "ref0:invitations" | "ref0:listings" | "ref0:mirror" | "ref0:needs" | "ref0:oauth" | "ref0:owners" | "ref0:plans" | "ref0:prepare" | "ref0:project-gate" | "ref0:pushes" | "ref0:queue" | "ref0:rebuilder" | "ref0:sessions" | "ref0:sign-in" | "ref0:stages" | "ref0:sweeper" | "ref0:usage" | "ref0:warm-up" | "ref0:workflows")[]>;
+      }>]>;
+      readonly request: Schema.String;
+      readonly at: Schema.DateTimeUtcFromMillis;
+    }>>;
+    readonly local: Schema.optionalKey<Schema.Struct<{
+      readonly attachment: Schema.Struct<{
+        readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+      }>;
+      readonly agent: Schema.optionalKey<Schema.Struct<{
+        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+      }>>;
+    }>>;
+    readonly routes: Schema.optionalKey<Schema.Struct<{
+      readonly requests: Schema.Int;
+      readonly omitted: Schema.Int;
+      readonly trace: Schema.Literals<readonly ["pending", "kept", "failed"]>;
+      readonly refusals: Schema.$Array<Schema.Struct<{
+        readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+        readonly step: Schema.String;
+        readonly count: Schema.Int;
+        readonly attempt: Schema.Int;
+        readonly provenance: Schema.Literals<readonly ["observed", "reported"]>;
+        readonly why: Schema.Literals<readonly ["scheme", "https", "host", "port", "websocket", "webrtc", "deadline", "ended", "not yours", "closed", "browse closed", "fenced", "not open", "not served", "stopped", "unreachable", "too many", "unavailable"]>;
+        readonly recovery: Schema.String;
+        readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["sbxsession_", Schema.String]>, "SandboxSessionId">;
+        readonly url: Schema.String;
+      }>>;
+      readonly refusalsOmitted: Schema.Int;
+      readonly reported: Schema.$Array<Schema.Struct<{
+        readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+        readonly step: Schema.String;
+        readonly count: Schema.Int;
+        readonly attempt: Schema.Int;
+        readonly provenance: Schema.Literals<readonly ["observed", "reported"]>;
+        readonly why: Schema.Literals<readonly ["scheme", "https", "host", "port", "websocket", "webrtc", "deadline", "ended", "not yours", "closed", "browse closed", "fenced", "not open", "not served", "stopped", "unreachable", "too many", "unavailable"]>;
+        readonly recovery: Schema.String;
+        readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["sbxsession_", Schema.String]>, "SandboxSessionId">;
+        readonly url: Schema.String;
+      }>>;
+      readonly reportedOmitted: Schema.Int;
+    }>>;
+    readonly browsers: Schema.optionalKey<Schema.Struct<{
+      readonly browses: Schema.Int;
+      readonly closing: Schema.Int;
+      readonly unconfirmed: Schema.Int;
+      readonly lastError: Schema.optionalKey<Schema.String>;
+      readonly unresolved: Schema.Int;
+      readonly presumedExpired: Schema.Int;
+      readonly browserMs: Schema.Int;
+      readonly estimated: Schema.Boolean;
+    }>>;
     readonly state: Schema.Literals<readonly ["waiting", "pending", "starting", "created", "running"]>;
   }>, Schema.Struct<{
     readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
-    readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-    readonly rerun: Schema.Int;
-    readonly rerunOf: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-    readonly got: Schema.Literals<readonly ["new", "joined", "answered"]>;
-    readonly reusedFrom: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-    readonly readsMoved: Schema.optionalKey<Schema.String>;
-    readonly reuseSkipped: Schema.optionalKey<Schema.String>;
-    readonly state: Schema.Literal<"ended">;
-    readonly conclusion: Schema.Literals<readonly ["success", "failure", "neutral"]>;
-    readonly reused: Schema.optionalKey<Schema.Literal<true>>;
-  }>, Schema.Struct<{
-    readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
-    readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-    readonly rerun: Schema.Int;
-    readonly rerunOf: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-    readonly got: Schema.Literals<readonly ["new", "joined", "answered"]>;
-    readonly reusedFrom: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-    readonly readsMoved: Schema.optionalKey<Schema.String>;
-    readonly reuseSkipped: Schema.optionalKey<Schema.String>;
-    readonly state: Schema.Literal<"ended">;
-    readonly error: Schema.Literals<readonly ["timeout", "threw", "invalid output", "unavailable", "expired", "cancelled"]>;
-  }>]>>;
-}>, Schema.Struct<{
-  readonly waiting: Schema.Struct<{
-    readonly start: Schema.brand<Schema.TemplateLiteral<readonly ["startwait_", Schema.String]>, "StartWaitId">;
-    readonly check: Schema.brand<Schema.String, "CheckName">;
-    readonly params: Schema.$Array<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
-    readonly thread: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["thread_", Schema.String]>, "ThreadId">>;
-    readonly waitingSince: Schema.DateTimeUtcFromString;
-    readonly endsAt: Schema.DateTimeUtcFromString;
-    readonly runs: Schema.$Array<Schema.Struct<{
-      readonly workflow: Schema.brand<Schema.String, "WorkflowName">;
-      readonly run: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["workflowrun_", Schema.String]>, "WorkflowRunId">>;
-      readonly title: Schema.optionalKey<Schema.String>;
-      readonly state: Schema.Literals<readonly ["starting", "going", "allowed", "refused", "failed"]>;
-      readonly leaves: Schema.$Array<Schema.Struct<{
-        readonly kind: Schema.Literals<readonly ["ask", "passkey"]>;
-        readonly state: Schema.Literals<readonly ["waiting", "answered", "ended"]>;
-        readonly since: Schema.DateTimeUtcFromString;
-        readonly who: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
-          readonly kind: Schema.Literal<"person">;
-          readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-          readonly name: Schema.optionalKey<Schema.brand<Schema.String, "OwnerName">>;
-        }>, Schema.Struct<{
-          readonly kind: Schema.Literal<"agent">;
-          readonly handle: Schema.brand<Schema.String, "AgentHandle">;
-        }>, Schema.Struct<{
-          readonly kind: Schema.Literal<"holders">;
-          readonly permission: Schema.String;
-        }>]>>;
-        readonly what: Schema.optionalKey<Schema.String>;
-        readonly answer: Schema.optionalKey<Schema.String>;
-      }>>;
-    }>>;
-  }>;
-}>]>>, Schema.toCodecJson<typeof NotPermitted | typeof ThreadNotFound | typeof RepoNotFound | typeof RequestChanged | typeof RunsBusy | typeof RunRefused | typeof RunUnavailable | typeof CheckNotFound | typeof NoThreadHead>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"report", "POST", "/v1/repos/:owner/:repo/runs/local", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-  repo: Schema.brand<Schema.String, "RepoName">;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-  readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
-  readonly thread: Schema.brand<Schema.String, "WrittenThread">;
-  readonly check: Schema.brand<Schema.String, "CheckName">;
-  readonly code: Schema.Struct<{
-    readonly version: Schema.brand<Schema.String, "CheckCodeVersion">;
-    readonly origin: Schema.Literals<readonly ["main", "thread", "project"]>;
-  }>;
-  readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-  readonly tree: Schema.brand<Schema.String, "TreeOid">;
-  readonly result: Schema.Union<readonly [Schema.Struct<{
-    readonly conclusion: Schema.Literals<readonly ["success", "failure", "neutral"]>;
-    readonly output: Schema.optionalKey<Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-    readonly needs: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
-      readonly kind: Schema.Literal<"review">;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"accountable">;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"admin">;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"permission">;
-      readonly name: Schema.brand<Schema.String, "RepoPermissionName">;
-    }>]>>>;
-  }>, Schema.Struct<{
-    readonly error: Schema.Literals<readonly ["threw", "invalid output", "timeout"]>;
-    readonly why: Schema.optionalKey<Schema.String>;
-  }>]>;
-  readonly outputsHash: Schema.String;
-  readonly attachment: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">>;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-  readonly run: Schema.Union<readonly [Schema.Struct<{
-    readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
-    readonly check: Schema.brand<Schema.String, "CheckName">;
+    readonly check: Schema.brand<Schema.String, "CheckName">;
     readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
     readonly rerun: Schema.Int;
     readonly rerunOf: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
@@ -17990,7 +18157,8 @@ declare const RunsGroup_base: HttpApiGroup.HttpApiGroup<"runs", HttpApiEndpoint.
       readonly browserMs: Schema.Int;
       readonly estimated: Schema.Boolean;
     }>>;
-    readonly state: Schema.Literals<readonly ["waiting", "pending", "starting", "created", "running"]>;
+    readonly state: Schema.Literal<"ended">;
+    readonly conclusion: Schema.Literals<readonly ["success", "failure", "neutral"]>;
   }>, Schema.Struct<{
     readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
     readonly check: Schema.brand<Schema.String, "CheckName">;
@@ -18067,86 +18235,249 @@ declare const RunsGroup_base: HttpApiGroup.HttpApiGroup<"runs", HttpApiEndpoint.
       readonly estimated: Schema.Boolean;
     }>>;
     readonly state: Schema.Literal<"ended">;
+    readonly error: Schema.Literals<readonly ["timeout", "threw", "invalid output", "unavailable", "expired", "cancelled"]>;
+  }>]>>;
+  readonly before: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
+}>>, Schema.toCodecJson<typeof ThreadNotFound | typeof RepoNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"trace", "GET", "/v1/repos/:owner/:repo/runs/:run/trace", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+  repo: Schema.brand<Schema.String, "RepoName">;
+  run: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">, Schema.brand<Schema.TemplateLiteral<readonly ["workflowrun_", Schema.String]>, "WorkflowRunId">]>;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  readonly thread: Schema.optionalKey<Schema.brand<Schema.String, "WrittenThread">>;
+  readonly cursor: Schema.optionalKey<Schema.brand<Schema.String, "TraceCursor">>;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly run: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">, Schema.brand<Schema.TemplateLiteral<readonly ["workflowrun_", Schema.String]>, "WorkflowRunId">]>;
+  readonly eventsKept: Schema.Literals<readonly ["collecting", "complete", "incomplete"]>;
+  readonly events: Schema.$Array<Schema.Struct<{
+    readonly eventId: Schema.Int;
+    readonly timestamp: Schema.Finite;
+    readonly type: Schema.String;
+    readonly stepName: Schema.optionalKey<Schema.String>;
+    readonly attempt: Schema.optionalKey<Schema.Int>;
+    readonly durationMs: Schema.optionalKey<Schema.Finite>;
+    readonly retryDelayMs: Schema.optionalKey<Schema.Finite>;
+    readonly eventType: Schema.optionalKey<Schema.String>;
+    readonly error: Schema.optionalKey<Schema.Struct<{
+      readonly name: Schema.String;
+      readonly message: Schema.String;
+    }>>;
+  }>>;
+  readonly spans: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"session">;
+    readonly id: Schema.String;
+    readonly at: Schema.Finite;
+    readonly sandbox: Schema.String;
+    readonly step: Schema.String;
+    readonly attempt: Schema.Int;
+    readonly from: Schema.Literals<readonly ["snapshot", "image"]>;
+    readonly key: Schema.optionalKey<Schema.String>;
+    readonly restoreMs: Schema.Finite;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"command">;
+    readonly id: Schema.String;
+    readonly parent: Schema.String;
+    readonly at: Schema.Finite;
+    readonly argv: Schema.$Array<Schema.String>;
+    readonly outcome: Schema.Literals<readonly ["exited", "timeout", "stopped", "lost"]>;
+    readonly exitCode: Schema.optionalKey<Schema.Int>;
+    readonly durationMs: Schema.Finite;
+    readonly stdoutCut: Schema.Boolean;
+    readonly stderrCut: Schema.Boolean;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"untraced">;
+    readonly id: Schema.String;
+    readonly parent: Schema.String;
+    readonly at: Schema.Finite;
+    readonly commands: Schema.Int;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"serve">;
+    readonly id: Schema.String;
+    readonly parent: Schema.String;
+    readonly at: Schema.Finite;
+    readonly argv: Schema.$Array<Schema.String>;
+    readonly port: Schema.Int;
+    readonly host: Schema.String;
+    readonly outcome: Schema.Literals<readonly ["ready", "occupied", "exited", "not ready", "stopped", "unavailable"]>;
+    readonly readyMs: Schema.optionalKey<Schema.Finite>;
+    readonly exitCode: Schema.optionalKey<Schema.Int>;
+    readonly log: Schema.Literals<readonly ["captured", "unavailable"]>;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"route">;
+    readonly id: Schema.String;
+    readonly parent: Schema.String;
+    readonly at: Schema.Finite;
+    readonly method: Schema.String;
+    readonly path: Schema.String;
+    readonly outcome: Schema.Literals<readonly ["complete", "refused", "failed", "cancelled", "interrupted"]>;
+    readonly status: Schema.optionalKey<Schema.Int>;
+    readonly why: Schema.optionalKey<Schema.String>;
+    readonly durationMs: Schema.Finite;
+    readonly bytes: Schema.Int;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"routes omitted">;
+    readonly id: Schema.String;
+    readonly parent: Schema.String;
+    readonly at: Schema.Finite;
+    readonly requests: Schema.Int;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"route refusal">;
+    readonly id: Schema.String;
+    readonly parent: Schema.String;
+    readonly at: Schema.Finite;
+    readonly provenance: Schema.Literals<readonly ["observed", "reported"]>;
+    readonly why: Schema.String;
+    readonly url: Schema.String;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"browser">;
+    readonly id: Schema.String;
+    readonly parent: Schema.String;
+    readonly at: Schema.Finite;
+    readonly browserSession: Schema.optionalKey<Schema.String>;
+    readonly acquireMs: Schema.optionalKey<Schema.Finite>;
+    readonly connects: Schema.Int;
+    readonly closedAt: Schema.optionalKey<Schema.Finite>;
+    readonly outcome: Schema.Literals<readonly ["closed", "unconfirmed", "unresolved", "failed", "unavailable"]>;
+    readonly reported: Schema.Int;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"build">;
+    readonly id: Schema.String;
+    readonly at: Schema.Finite;
+    readonly build: Schema.Int;
+    readonly key: Schema.String;
+    readonly state: Schema.Literals<readonly ["queued", "starting", "building", "ready", "failed", "full", "unbegun"]>;
+    readonly durationMs: Schema.optionalKey<Schema.Finite>;
+    readonly why: Schema.optionalKey<Schema.String>;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"setup">;
+    readonly id: Schema.String;
+    readonly parent: Schema.String;
+    readonly at: Schema.Finite;
+    readonly argv: Schema.$Array<Schema.String>;
+    readonly exitCode: Schema.optionalKey<Schema.Int>;
+    readonly durationMs: Schema.Finite;
+  }>]>>;
+  readonly logs: Schema.$Array<Schema.Struct<{
+    readonly at: Schema.Finite;
+    readonly level: Schema.String;
+    readonly message: Schema.String;
+    readonly span: Schema.optionalKey<Schema.String>;
+  }>>;
+  readonly cursor: Schema.brand<Schema.String, "TraceCursor">;
+  readonly more: Schema.Boolean;
+}>>, Schema.toCodecJson<typeof ThreadNotFound | typeof RepoNotFound | typeof RunNotFound | typeof InvalidCursor | typeof TraceUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"local", "GET", "/v1/repos/:owner/:repo/runs/local", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+  repo: Schema.brand<Schema.String, "RepoName">;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  readonly thread: Schema.brand<Schema.String, "WrittenThread">;
+  readonly check: Schema.brand<Schema.String, "CheckKey">;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly pullRequest: Schema.brand<Schema.Int, "PullRequestNumber">;
+  readonly version: Schema.brand<Schema.Int, "VersionNumber">;
+  readonly tree: Schema.brand<Schema.String, "TreeOid">;
+  readonly check: Schema.brand<Schema.String, "CheckName">;
+  readonly code: Schema.Struct<{
+    readonly version: Schema.brand<Schema.String, "CheckCodeVersion">;
+    readonly origin: Schema.Literals<readonly ["main", "thread", "project"]>;
+  }>;
+  readonly timeoutSeconds: Schema.Int;
+  readonly runs: Schema.$Array<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
+  readonly compiled: Schema.Struct<{
+    readonly entry: Schema.Struct<{
+      readonly name: Schema.String;
+      readonly module: Schema.String;
+      readonly manifest: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
+      readonly files: Schema.$Array<Schema.String>;
+      readonly templates: Schema.optionalKey<Schema.$Array<Schema.$Array<Schema.String>>>;
+      readonly sourceMap: Schema.optionalKey<Schema.String>;
+      readonly reaches: Schema.optionalKey<Schema.Struct<{
+        readonly tree: Schema.Boolean;
+        readonly browser: Schema.Boolean;
+      }>>;
+      readonly sandboxes: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+        readonly name: Schema.String;
+        readonly manifest: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+        readonly pin: Schema.String;
+        readonly format: Schema.Int;
+      }>>>;
+      readonly codeHash: Schema.brand<Schema.String, "CheckCodeVersion">;
+    }>;
+    readonly modules: Schema.$Record<Schema.String, Schema.String>;
+  }>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof ThreadNotFound | typeof RepoNotFound | typeof RunUnavailable | typeof LocalRunRefused>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"waiting", "GET", "/v1/repos/:owner/:repo/runs/waiting/:start", Schema.toCodecStringTree<Schema.Struct<{
+  start: Schema.brand<Schema.TemplateLiteral<readonly ["startwait_", Schema.String]>, "StartWaitId">;
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+  repo: Schema.brand<Schema.String, "RepoName">;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  readonly thread: Schema.optionalKey<Schema.brand<Schema.String, "WrittenThread">>;
+}>>, never, never, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
+  readonly runs: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+    readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+    readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+    readonly rerun: Schema.Int;
+    readonly rerunOf: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
+    readonly got: Schema.Literals<readonly ["new", "joined", "answered"]>;
+    readonly reusedFrom: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
+    readonly readsMoved: Schema.optionalKey<Schema.String>;
+    readonly reuseSkipped: Schema.optionalKey<Schema.String>;
+    readonly state: Schema.Literals<readonly ["waiting", "pending", "starting", "created", "running"]>;
+  }>, Schema.Struct<{
+    readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+    readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+    readonly rerun: Schema.Int;
+    readonly rerunOf: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
+    readonly got: Schema.Literals<readonly ["new", "joined", "answered"]>;
+    readonly reusedFrom: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
+    readonly readsMoved: Schema.optionalKey<Schema.String>;
+    readonly reuseSkipped: Schema.optionalKey<Schema.String>;
+    readonly state: Schema.Literal<"ended">;
     readonly conclusion: Schema.Literals<readonly ["success", "failure", "neutral"]>;
+    readonly reused: Schema.optionalKey<Schema.Literal<true>>;
   }>, Schema.Struct<{
     readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
-    readonly check: Schema.brand<Schema.String, "CheckName">;
     readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
     readonly rerun: Schema.Int;
     readonly rerunOf: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-    readonly tree: Schema.brand<Schema.String, "TreeOid">;
-    readonly origin: Schema.Literals<readonly ["main", "thread", "project"]>;
-    readonly createdAt: Schema.DateTimeUtcFromMillis;
-    readonly startedAt: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
-    readonly endedAt: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
-    readonly starters: Schema.$Array<Schema.Struct<{
-      readonly actor: Schema.Union<readonly [Schema.Struct<{
-        readonly kind: Schema.Literal<"person">;
-        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-      }>, Schema.Struct<{
-        readonly kind: Schema.Literal<"agent">;
-        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-      }>, Schema.Struct<{
-        readonly kind: Schema.Literal<"ref0">;
-        readonly id: Schema.Literals<("ref0:attachments" | "ref0:barrier" | "ref0:blockers" | "ref0:checks" | "ref0:gate" | "ref0:hooks" | "ref0:importer" | "ref0:invitations" | "ref0:listings" | "ref0:mirror" | "ref0:needs" | "ref0:oauth" | "ref0:owners" | "ref0:plans" | "ref0:prepare" | "ref0:project-gate" | "ref0:pushes" | "ref0:queue" | "ref0:rebuilder" | "ref0:sessions" | "ref0:sign-in" | "ref0:stages" | "ref0:sweeper" | "ref0:usage" | "ref0:warm-up" | "ref0:workflows")[]>;
-      }>]>;
-      readonly request: Schema.String;
-      readonly at: Schema.DateTimeUtcFromMillis;
-    }>>;
-    readonly local: Schema.optionalKey<Schema.Struct<{
-      readonly attachment: Schema.Struct<{
-        readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
-      }>;
-      readonly agent: Schema.optionalKey<Schema.Struct<{
-        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-      }>>;
-    }>>;
-    readonly routes: Schema.optionalKey<Schema.Struct<{
-      readonly requests: Schema.Int;
-      readonly omitted: Schema.Int;
-      readonly trace: Schema.Literals<readonly ["pending", "kept", "failed"]>;
-      readonly refusals: Schema.$Array<Schema.Struct<{
-        readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
-        readonly step: Schema.String;
-        readonly count: Schema.Int;
-        readonly attempt: Schema.Int;
-        readonly provenance: Schema.Literals<readonly ["observed", "reported"]>;
-        readonly why: Schema.Literals<readonly ["scheme", "https", "host", "port", "websocket", "webrtc", "deadline", "ended", "not yours", "closed", "browse closed", "fenced", "not open", "not served", "stopped", "unreachable", "too many", "unavailable"]>;
-        readonly recovery: Schema.String;
-        readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["sbxsession_", Schema.String]>, "SandboxSessionId">;
-        readonly url: Schema.String;
-      }>>;
-      readonly refusalsOmitted: Schema.Int;
-      readonly reported: Schema.$Array<Schema.Struct<{
-        readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
-        readonly step: Schema.String;
-        readonly count: Schema.Int;
-        readonly attempt: Schema.Int;
-        readonly provenance: Schema.Literals<readonly ["observed", "reported"]>;
-        readonly why: Schema.Literals<readonly ["scheme", "https", "host", "port", "websocket", "webrtc", "deadline", "ended", "not yours", "closed", "browse closed", "fenced", "not open", "not served", "stopped", "unreachable", "too many", "unavailable"]>;
-        readonly recovery: Schema.String;
-        readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["sbxsession_", Schema.String]>, "SandboxSessionId">;
-        readonly url: Schema.String;
-      }>>;
-      readonly reportedOmitted: Schema.Int;
-    }>>;
-    readonly browsers: Schema.optionalKey<Schema.Struct<{
-      readonly browses: Schema.Int;
-      readonly closing: Schema.Int;
-      readonly unconfirmed: Schema.Int;
-      readonly lastError: Schema.optionalKey<Schema.String>;
-      readonly unresolved: Schema.Int;
-      readonly presumedExpired: Schema.Int;
-      readonly browserMs: Schema.Int;
-      readonly estimated: Schema.Boolean;
+    readonly got: Schema.Literals<readonly ["new", "joined", "answered"]>;
+    readonly reusedFrom: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
+    readonly readsMoved: Schema.optionalKey<Schema.String>;
+    readonly reuseSkipped: Schema.optionalKey<Schema.String>;
+    readonly state: Schema.Literal<"ended">;
+    readonly error: Schema.Literals<readonly ["timeout", "threw", "invalid output", "unavailable", "expired", "cancelled"]>;
+  }>]>>;
+}>, Schema.Struct<{
+  readonly waiting: Schema.Struct<{
+    readonly start: Schema.brand<Schema.TemplateLiteral<readonly ["startwait_", Schema.String]>, "StartWaitId">;
+    readonly check: Schema.brand<Schema.String, "CheckName">;
+    readonly params: Schema.$Array<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
+    readonly thread: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["thread_", Schema.String]>, "ThreadId">>;
+    readonly waitingSince: Schema.DateTimeUtcFromString;
+    readonly endsAt: Schema.DateTimeUtcFromString;
+    readonly runs: Schema.$Array<Schema.Struct<{
+      readonly workflow: Schema.brand<Schema.String, "WorkflowName">;
+      readonly run: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["workflowrun_", Schema.String]>, "WorkflowRunId">>;
+      readonly title: Schema.optionalKey<Schema.String>;
+      readonly state: Schema.Literals<readonly ["starting", "going", "allowed", "refused", "failed"]>;
+      readonly leaves: Schema.$Array<Schema.Struct<{
+        readonly kind: Schema.Literals<readonly ["ask", "passkey"]>;
+        readonly state: Schema.Literals<readonly ["waiting", "answered", "ended"]>;
+        readonly since: Schema.DateTimeUtcFromString;
+        readonly who: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
+          readonly kind: Schema.Literal<"person">;
+          readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+          readonly name: Schema.optionalKey<Schema.brand<Schema.String, "OwnerName">>;
+        }>, Schema.Struct<{
+          readonly kind: Schema.Literal<"agent">;
+          readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+        }>, Schema.Struct<{
+          readonly kind: Schema.Literal<"holders">;
+          readonly permission: Schema.String;
+        }>]>>;
+        readonly what: Schema.optionalKey<Schema.String>;
+        readonly answer: Schema.optionalKey<Schema.String>;
+      }>>;
     }>>;
-    readonly state: Schema.Literal<"ended">;
-    readonly error: Schema.Literals<readonly ["timeout", "threw", "invalid output", "unavailable", "expired", "cancelled"]>;
-  }>]>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof ThreadNotFound | typeof RepoNotFound | typeof RequestChanged | typeof RunsBusy | typeof RunUnavailable | typeof LocalRunRefused>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"restoreSigner", "POST", "/v1/repos/:owner/:repo/checks/signers/restore", Schema.toCodecStringTree<Schema.Struct<{
+  }>;
+}>]>>, Schema.toCodecJson<typeof NotPermitted | typeof ThreadNotFound | typeof RepoNotFound | typeof RequestChanged | typeof RunsBusy | typeof RunRefused | typeof StartNotFound | typeof RunUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"restoreSigner", "POST", "/v1/repos/:owner/:repo/checks/signers/restore", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   repo: Schema.brand<Schema.String, "RepoName">;
 }>>, never, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
@@ -18161,15 +18492,40 @@ declare const RunsGroup_base: HttpApiGroup.HttpApiGroup<"runs", HttpApiEndpoint.
 }>, Schema.Struct<{
   readonly check: Schema.brand<Schema.String, "CheckKey">;
   readonly person: Schema.brand<Schema.String, "OwnerName">;
-}>]>>, Schema.toCodecJson<typeof NotPermitted | typeof RepoNotFound | typeof SignerNotRevoked>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/repos/:owner/:repo/runs", Schema.toCodecStringTree<Schema.Struct<{
+}>]>>, Schema.toCodecJson<typeof NotPermitted | typeof RepoNotFound | typeof SignerNotRevoked>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"report", "POST", "/v1/repos/:owner/:repo/runs/local", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   repo: Schema.brand<Schema.String, "RepoName">;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  readonly thread: Schema.optionalKey<Schema.brand<Schema.String, "WrittenThread">>;
-  readonly check: Schema.optionalKey<Schema.brand<Schema.String, "CheckKey">>;
-  readonly before: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-}>>, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly runs: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+  readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+  readonly thread: Schema.brand<Schema.String, "WrittenThread">;
+  readonly check: Schema.brand<Schema.String, "CheckName">;
+  readonly code: Schema.Struct<{
+    readonly version: Schema.brand<Schema.String, "CheckCodeVersion">;
+    readonly origin: Schema.Literals<readonly ["main", "thread", "project"]>;
+  }>;
+  readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+  readonly tree: Schema.brand<Schema.String, "TreeOid">;
+  readonly result: Schema.Union<readonly [Schema.Struct<{
+    readonly conclusion: Schema.Literals<readonly ["success", "failure", "neutral"]>;
+    readonly output: Schema.optionalKey<Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+    readonly needs: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+      readonly kind: Schema.Literal<"review">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"accountable">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"admin">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"permission">;
+      readonly name: Schema.brand<Schema.String, "RepoPermissionName">;
+    }>]>>>;
+  }>, Schema.Struct<{
+    readonly error: Schema.Literals<readonly ["threw", "invalid output", "timeout"]>;
+    readonly why: Schema.optionalKey<Schema.String>;
+  }>]>;
+  readonly outputsHash: Schema.String;
+  readonly attachment: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">>;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+  readonly run: Schema.Union<readonly [Schema.Struct<{
     readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
     readonly check: Schema.brand<Schema.String, "CheckName">;
     readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
@@ -18399,9 +18755,8 @@ declare const RunsGroup_base: HttpApiGroup.HttpApiGroup<"runs", HttpApiEndpoint.
     }>>;
     readonly state: Schema.Literal<"ended">;
     readonly error: Schema.Literals<readonly ["timeout", "threw", "invalid output", "unavailable", "expired", "cancelled"]>;
-  }>]>>;
-  readonly before: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-}>>, Schema.toCodecJson<typeof ThreadNotFound | typeof RepoNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"cancel", "POST", "/v1/repos/:owner/:repo/runs/waiting/:start/cancel", Schema.toCodecStringTree<Schema.Struct<{
+  }>]>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof ThreadNotFound | typeof RepoNotFound | typeof RequestChanged | typeof RunsBusy | typeof RunUnavailable | typeof LocalRunRefused>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"cancel", "POST", "/v1/repos/:owner/:repo/runs/waiting/:start/cancel", Schema.toCodecStringTree<Schema.Struct<{
   start: Schema.brand<Schema.TemplateLiteral<readonly ["startwait_", Schema.String]>, "StartWaitId">;
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   repo: Schema.brand<Schema.String, "RepoName">;
@@ -18409,13 +18764,23 @@ declare const RunsGroup_base: HttpApiGroup.HttpApiGroup<"runs", HttpApiEndpoint.
   readonly thread: Schema.optionalKey<Schema.brand<Schema.String, "WrittenThread">>;
 }>>, never, never, Schema.toCodecJson<Schema.Struct<{
   readonly cancelled: Schema.Literals<readonly ["start", "yours"]>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof ThreadNotFound | typeof RepoNotFound | typeof StartNotFound | typeof StartPast | typeof RunUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"waiting", "GET", "/v1/repos/:owner/:repo/runs/waiting/:start", Schema.toCodecStringTree<Schema.Struct<{
-  start: Schema.brand<Schema.TemplateLiteral<readonly ["startwait_", Schema.String]>, "StartWaitId">;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof ThreadNotFound | typeof RepoNotFound | typeof StartNotFound | typeof StartPast | typeof RunUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"start", "POST", "/v1/repos/:owner/:repo/runs", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   repo: Schema.brand<Schema.String, "RepoName">;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+  readonly check: Schema.brand<Schema.String, "CheckKey">;
+  readonly on: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"main">;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"thread">;
+    readonly thread: Schema.brand<Schema.String, "WrittenThread">;
+    readonly branch: Schema.optionalKey<Schema.String>;
+  }>]>;
+  readonly params: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
+  readonly rerun: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
 }>>, Schema.toCodecStringTree<Schema.Struct<{
-  readonly thread: Schema.optionalKey<Schema.brand<Schema.String, "WrittenThread">>;
-}>>, never, never, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
   readonly runs: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
     readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
     readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
@@ -18434,221 +18799,56 @@ declare const RunsGroup_base: HttpApiGroup.HttpApiGroup<"runs", HttpApiEndpoint.
     readonly got: Schema.Literals<readonly ["new", "joined", "answered"]>;
     readonly reusedFrom: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
     readonly readsMoved: Schema.optionalKey<Schema.String>;
-    readonly reuseSkipped: Schema.optionalKey<Schema.String>;
-    readonly state: Schema.Literal<"ended">;
-    readonly conclusion: Schema.Literals<readonly ["success", "failure", "neutral"]>;
-    readonly reused: Schema.optionalKey<Schema.Literal<true>>;
-  }>, Schema.Struct<{
-    readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
-    readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-    readonly rerun: Schema.Int;
-    readonly rerunOf: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-    readonly got: Schema.Literals<readonly ["new", "joined", "answered"]>;
-    readonly reusedFrom: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-    readonly readsMoved: Schema.optionalKey<Schema.String>;
-    readonly reuseSkipped: Schema.optionalKey<Schema.String>;
-    readonly state: Schema.Literal<"ended">;
-    readonly error: Schema.Literals<readonly ["timeout", "threw", "invalid output", "unavailable", "expired", "cancelled"]>;
-  }>]>>;
-}>, Schema.Struct<{
-  readonly waiting: Schema.Struct<{
-    readonly start: Schema.brand<Schema.TemplateLiteral<readonly ["startwait_", Schema.String]>, "StartWaitId">;
-    readonly check: Schema.brand<Schema.String, "CheckName">;
-    readonly params: Schema.$Array<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
-    readonly thread: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["thread_", Schema.String]>, "ThreadId">>;
-    readonly waitingSince: Schema.DateTimeUtcFromString;
-    readonly endsAt: Schema.DateTimeUtcFromString;
-    readonly runs: Schema.$Array<Schema.Struct<{
-      readonly workflow: Schema.brand<Schema.String, "WorkflowName">;
-      readonly run: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["workflowrun_", Schema.String]>, "WorkflowRunId">>;
-      readonly title: Schema.optionalKey<Schema.String>;
-      readonly state: Schema.Literals<readonly ["starting", "going", "allowed", "refused", "failed"]>;
-      readonly leaves: Schema.$Array<Schema.Struct<{
-        readonly kind: Schema.Literals<readonly ["ask", "passkey"]>;
-        readonly state: Schema.Literals<readonly ["waiting", "answered", "ended"]>;
-        readonly since: Schema.DateTimeUtcFromString;
-        readonly who: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
-          readonly kind: Schema.Literal<"person">;
-          readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-          readonly name: Schema.optionalKey<Schema.brand<Schema.String, "OwnerName">>;
-        }>, Schema.Struct<{
-          readonly kind: Schema.Literal<"agent">;
-          readonly handle: Schema.brand<Schema.String, "AgentHandle">;
-        }>, Schema.Struct<{
-          readonly kind: Schema.Literal<"holders">;
-          readonly permission: Schema.String;
-        }>]>>;
-        readonly what: Schema.optionalKey<Schema.String>;
-        readonly answer: Schema.optionalKey<Schema.String>;
-      }>>;
-    }>>;
-  }>;
-}>]>>, Schema.toCodecJson<typeof NotPermitted | typeof ThreadNotFound | typeof RepoNotFound | typeof RequestChanged | typeof RunsBusy | typeof RunRefused | typeof StartNotFound | typeof RunUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"local", "GET", "/v1/repos/:owner/:repo/runs/local", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-  repo: Schema.brand<Schema.String, "RepoName">;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  readonly thread: Schema.brand<Schema.String, "WrittenThread">;
-  readonly check: Schema.brand<Schema.String, "CheckKey">;
-}>>, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly pullRequest: Schema.brand<Schema.Int, "PullRequestNumber">;
-  readonly version: Schema.brand<Schema.Int, "VersionNumber">;
-  readonly tree: Schema.brand<Schema.String, "TreeOid">;
-  readonly check: Schema.brand<Schema.String, "CheckName">;
-  readonly code: Schema.Struct<{
-    readonly version: Schema.brand<Schema.String, "CheckCodeVersion">;
-    readonly origin: Schema.Literals<readonly ["main", "thread", "project"]>;
-  }>;
-  readonly timeoutSeconds: Schema.Int;
-  readonly runs: Schema.$Array<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
-  readonly compiled: Schema.Struct<{
-    readonly entry: Schema.Struct<{
-      readonly name: Schema.String;
-      readonly module: Schema.String;
-      readonly manifest: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
-      readonly files: Schema.$Array<Schema.String>;
-      readonly templates: Schema.optionalKey<Schema.$Array<Schema.$Array<Schema.String>>>;
-      readonly sourceMap: Schema.optionalKey<Schema.String>;
-      readonly reaches: Schema.optionalKey<Schema.Struct<{
-        readonly tree: Schema.Boolean;
-        readonly browser: Schema.Boolean;
-      }>>;
-      readonly sandboxes: Schema.optionalKey<Schema.$Array<Schema.Struct<{
-        readonly name: Schema.String;
-        readonly manifest: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-        readonly pin: Schema.String;
-        readonly format: Schema.Int;
-      }>>>;
-      readonly codeHash: Schema.brand<Schema.String, "CheckCodeVersion">;
-    }>;
-    readonly modules: Schema.$Record<Schema.String, Schema.String>;
-  }>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof ThreadNotFound | typeof RepoNotFound | typeof RunUnavailable | typeof LocalRunRefused>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"trace", "GET", "/v1/repos/:owner/:repo/runs/:run/trace", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-  repo: Schema.brand<Schema.String, "RepoName">;
-  run: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">, Schema.brand<Schema.TemplateLiteral<readonly ["workflowrun_", Schema.String]>, "WorkflowRunId">]>;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  readonly thread: Schema.optionalKey<Schema.brand<Schema.String, "WrittenThread">>;
-  readonly cursor: Schema.optionalKey<Schema.brand<Schema.String, "TraceCursor">>;
-}>>, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly run: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">, Schema.brand<Schema.TemplateLiteral<readonly ["workflowrun_", Schema.String]>, "WorkflowRunId">]>;
-  readonly eventsKept: Schema.Literals<readonly ["collecting", "complete", "incomplete"]>;
-  readonly events: Schema.$Array<Schema.Struct<{
-    readonly eventId: Schema.Int;
-    readonly timestamp: Schema.Finite;
-    readonly type: Schema.String;
-    readonly stepName: Schema.optionalKey<Schema.String>;
-    readonly attempt: Schema.optionalKey<Schema.Int>;
-    readonly durationMs: Schema.optionalKey<Schema.Finite>;
-    readonly retryDelayMs: Schema.optionalKey<Schema.Finite>;
-    readonly eventType: Schema.optionalKey<Schema.String>;
-    readonly error: Schema.optionalKey<Schema.Struct<{
-      readonly name: Schema.String;
-      readonly message: Schema.String;
-    }>>;
-  }>>;
-  readonly spans: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
-    readonly kind: Schema.Literal<"session">;
-    readonly id: Schema.String;
-    readonly at: Schema.Finite;
-    readonly sandbox: Schema.String;
-    readonly step: Schema.String;
-    readonly attempt: Schema.Int;
-    readonly from: Schema.Literals<readonly ["snapshot", "image"]>;
-    readonly key: Schema.optionalKey<Schema.String>;
-    readonly restoreMs: Schema.Finite;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"command">;
-    readonly id: Schema.String;
-    readonly parent: Schema.String;
-    readonly at: Schema.Finite;
-    readonly argv: Schema.$Array<Schema.String>;
-    readonly outcome: Schema.Literals<readonly ["exited", "timeout", "stopped", "lost"]>;
-    readonly exitCode: Schema.optionalKey<Schema.Int>;
-    readonly durationMs: Schema.Finite;
-    readonly stdoutCut: Schema.Boolean;
-    readonly stderrCut: Schema.Boolean;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"untraced">;
-    readonly id: Schema.String;
-    readonly parent: Schema.String;
-    readonly at: Schema.Finite;
-    readonly commands: Schema.Int;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"serve">;
-    readonly id: Schema.String;
-    readonly parent: Schema.String;
-    readonly at: Schema.Finite;
-    readonly argv: Schema.$Array<Schema.String>;
-    readonly port: Schema.Int;
-    readonly host: Schema.String;
-    readonly outcome: Schema.Literals<readonly ["ready", "occupied", "exited", "not ready", "stopped", "unavailable"]>;
-    readonly readyMs: Schema.optionalKey<Schema.Finite>;
-    readonly exitCode: Schema.optionalKey<Schema.Int>;
-    readonly log: Schema.Literals<readonly ["captured", "unavailable"]>;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"route">;
-    readonly id: Schema.String;
-    readonly parent: Schema.String;
-    readonly at: Schema.Finite;
-    readonly method: Schema.String;
-    readonly path: Schema.String;
-    readonly outcome: Schema.Literals<readonly ["complete", "refused", "failed", "cancelled", "interrupted"]>;
-    readonly status: Schema.optionalKey<Schema.Int>;
-    readonly why: Schema.optionalKey<Schema.String>;
-    readonly durationMs: Schema.Finite;
-    readonly bytes: Schema.Int;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"routes omitted">;
-    readonly id: Schema.String;
-    readonly parent: Schema.String;
-    readonly at: Schema.Finite;
-    readonly requests: Schema.Int;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"route refusal">;
-    readonly id: Schema.String;
-    readonly parent: Schema.String;
-    readonly at: Schema.Finite;
-    readonly provenance: Schema.Literals<readonly ["observed", "reported"]>;
-    readonly why: Schema.String;
-    readonly url: Schema.String;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"browser">;
-    readonly id: Schema.String;
-    readonly parent: Schema.String;
-    readonly at: Schema.Finite;
-    readonly browserSession: Schema.optionalKey<Schema.String>;
-    readonly acquireMs: Schema.optionalKey<Schema.Finite>;
-    readonly connects: Schema.Int;
-    readonly closedAt: Schema.optionalKey<Schema.Finite>;
-    readonly outcome: Schema.Literals<readonly ["closed", "unconfirmed", "unresolved", "failed", "unavailable"]>;
-    readonly reported: Schema.Int;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"build">;
-    readonly id: Schema.String;
-    readonly at: Schema.Finite;
-    readonly build: Schema.Int;
-    readonly key: Schema.String;
-    readonly state: Schema.Literals<readonly ["queued", "starting", "building", "ready", "failed", "full", "unbegun"]>;
-    readonly durationMs: Schema.optionalKey<Schema.Finite>;
-    readonly why: Schema.optionalKey<Schema.String>;
+    readonly reuseSkipped: Schema.optionalKey<Schema.String>;
+    readonly state: Schema.Literal<"ended">;
+    readonly conclusion: Schema.Literals<readonly ["success", "failure", "neutral"]>;
+    readonly reused: Schema.optionalKey<Schema.Literal<true>>;
   }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"setup">;
-    readonly id: Schema.String;
-    readonly parent: Schema.String;
-    readonly at: Schema.Finite;
-    readonly argv: Schema.$Array<Schema.String>;
-    readonly exitCode: Schema.optionalKey<Schema.Int>;
-    readonly durationMs: Schema.Finite;
+    readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+    readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+    readonly rerun: Schema.Int;
+    readonly rerunOf: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
+    readonly got: Schema.Literals<readonly ["new", "joined", "answered"]>;
+    readonly reusedFrom: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
+    readonly readsMoved: Schema.optionalKey<Schema.String>;
+    readonly reuseSkipped: Schema.optionalKey<Schema.String>;
+    readonly state: Schema.Literal<"ended">;
+    readonly error: Schema.Literals<readonly ["timeout", "threw", "invalid output", "unavailable", "expired", "cancelled"]>;
   }>]>>;
-  readonly logs: Schema.$Array<Schema.Struct<{
-    readonly at: Schema.Finite;
-    readonly level: Schema.String;
-    readonly message: Schema.String;
-    readonly span: Schema.optionalKey<Schema.String>;
-  }>>;
-  readonly cursor: Schema.brand<Schema.String, "TraceCursor">;
-  readonly more: Schema.Boolean;
-}>>, Schema.toCodecJson<typeof ThreadNotFound | typeof RepoNotFound | typeof RunNotFound | typeof InvalidCursor | typeof TraceUnavailable>, Authorization, never>, false>;
+}>, Schema.Struct<{
+  readonly waiting: Schema.Struct<{
+    readonly start: Schema.brand<Schema.TemplateLiteral<readonly ["startwait_", Schema.String]>, "StartWaitId">;
+    readonly check: Schema.brand<Schema.String, "CheckName">;
+    readonly params: Schema.$Array<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
+    readonly thread: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["thread_", Schema.String]>, "ThreadId">>;
+    readonly waitingSince: Schema.DateTimeUtcFromString;
+    readonly endsAt: Schema.DateTimeUtcFromString;
+    readonly runs: Schema.$Array<Schema.Struct<{
+      readonly workflow: Schema.brand<Schema.String, "WorkflowName">;
+      readonly run: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["workflowrun_", Schema.String]>, "WorkflowRunId">>;
+      readonly title: Schema.optionalKey<Schema.String>;
+      readonly state: Schema.Literals<readonly ["starting", "going", "allowed", "refused", "failed"]>;
+      readonly leaves: Schema.$Array<Schema.Struct<{
+        readonly kind: Schema.Literals<readonly ["ask", "passkey"]>;
+        readonly state: Schema.Literals<readonly ["waiting", "answered", "ended"]>;
+        readonly since: Schema.DateTimeUtcFromString;
+        readonly who: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
+          readonly kind: Schema.Literal<"person">;
+          readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+          readonly name: Schema.optionalKey<Schema.brand<Schema.String, "OwnerName">>;
+        }>, Schema.Struct<{
+          readonly kind: Schema.Literal<"agent">;
+          readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+        }>, Schema.Struct<{
+          readonly kind: Schema.Literal<"holders">;
+          readonly permission: Schema.String;
+        }>]>>;
+        readonly what: Schema.optionalKey<Schema.String>;
+        readonly answer: Schema.optionalKey<Schema.String>;
+      }>>;
+    }>>;
+  }>;
+}>]>>, Schema.toCodecJson<typeof NotPermitted | typeof ThreadNotFound | typeof RepoNotFound | typeof RequestChanged | typeof RunsBusy | typeof RunRefused | typeof RunUnavailable | typeof CheckNotFound | typeof NoThreadHead>, Authorization, never>, false>;
 /**
  * A repo's check runs: starting them, on `main` or a thread's head, for whoever's token reaches
  * `check:run` there, and listing them, one scope at a time, for whoever sees it. A person's start
@@ -18708,33 +18908,7 @@ declare const ClientGrantsGroup_base: HttpApiGroup.HttpApiGroup<"clientGrants",
  * consented, hands the client its code.
  */
 declare class ClientGrantsGroup extends ClientGrantsGroup_base {}
-declare const OrganizationsGroup_base: HttpApiGroup.HttpApiGroup<"organizations", HttpApiEndpoint.HttpApiEndpoint<"leave", "DELETE", "/v1/me/organizations/:owner", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-}>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Struct<{
-  readonly member: Schema.Union<readonly [Schema.Struct<{
-    readonly kind: Schema.Literal<"person">;
-    readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"agent">;
-    readonly agent: Schema.Struct<{
-      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-    }>;
-  }>]>;
-  readonly why: Schema.Literals<readonly ["removed", "left"]>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof MemberNotFound | typeof LastAdmin | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"create", "POST", "/v1/organizations", never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly name: Schema.brand<Schema.String, "OwnerName">;
-  readonly displayName: Schema.optionalKey<Schema.String>;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Struct<{
-  readonly owner: Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">;
-  readonly name: Schema.brand<Schema.String, "OwnerName">;
-  readonly displayName: Schema.String;
-  readonly state: Schema.Literals<readonly ["initializing", "ready"]>;
-}>>, Schema.toCodecJson<typeof NameTaken | typeof NameReserved | typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"mine", "GET", "/v1/me/organizations", never, Schema.toCodecStringTree<Schema.Struct<{
+declare const OrganizationsGroup_base: HttpApiGroup.HttpApiGroup<"organizations", HttpApiEndpoint.HttpApiEndpoint<"mine", "GET", "/v1/me/organizations", never, Schema.toCodecStringTree<Schema.Struct<{
   cursor: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">>;
 }>>, never, never, Schema.toCodecJson<Schema.Struct<{
   readonly organizations: Schema.$Array<Schema.Struct<{
@@ -18743,7 +18917,50 @@ declare const OrganizationsGroup_base: HttpApiGroup.HttpApiGroup<"organizations"
     readonly role: Schema.Literals<readonly ["admin", "member"]>;
   }>>;
   readonly next: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"usage", "GET", "/v1/owners/:owner/usage", Schema.toCodecStringTree<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"meters", "GET", "/v1/owners/:owner/meters", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  from: Schema.optionalKey<Schema.brand<Schema.String, "UtcDay">>;
+  to: Schema.optionalKey<Schema.brand<Schema.String, "UtcDay">>;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly from: Schema.brand<Schema.String, "UtcDay">;
+  readonly to: Schema.brand<Schema.String, "UtcDay">;
+  readonly days: Schema.$Array<Schema.Struct<{
+    readonly day: Schema.brand<Schema.String, "UtcDay">;
+    readonly lines: Schema.$Array<Schema.Struct<{
+      readonly meter: Schema.Literals<readonly ["containers.vcpu_seconds", "containers.memory_gib_seconds", "containers.disk_gb_seconds", "containers.egress_gb", "browser.seconds", "artifacts.bytes", "r2.bytes"]>;
+      readonly quantity: Schema.Finite;
+      readonly known: Schema.Literals<readonly ["measured", "estimated"]>;
+    }>>;
+  }>>;
+  readonly work: Schema.$Array<Schema.Struct<{
+    readonly work: Schema.optionalKey<Schema.Literals<readonly ["sandbox", "check run", "merge queue", "snapshot build"]>>;
+    readonly repo: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">>;
+    readonly name: Schema.optionalKey<Schema.brand<Schema.String, "RepoName">>;
+    readonly lines: Schema.$Array<Schema.Struct<{
+      readonly meter: Schema.Literals<readonly ["containers.vcpu_seconds", "containers.memory_gib_seconds", "containers.disk_gb_seconds", "containers.egress_gb", "browser.seconds", "artifacts.bytes", "r2.bytes"]>;
+      readonly quantity: Schema.Finite;
+      readonly known: Schema.Literals<readonly ["measured", "estimated"]>;
+    }>>;
+  }>>;
+  readonly kept: Schema.optionalKey<Schema.Struct<{
+    readonly day: Schema.brand<Schema.String, "UtcDay">;
+    readonly counts: Schema.$Array<Schema.Struct<{
+      readonly repo: Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">;
+      readonly name: Schema.optionalKey<Schema.brand<Schema.String, "RepoName">>;
+      readonly fork: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["fork_", Schema.String]>, "ForkId">>;
+      readonly store: Schema.Literals<readonly ["artifacts", "r2"]>;
+      readonly bytes: Schema.Int;
+      readonly known: Schema.Literals<readonly ["measured", "estimated"]>;
+    }>>;
+    readonly others: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+      readonly store: Schema.Literals<readonly ["artifacts", "r2"]>;
+      readonly known: Schema.Literals<readonly ["measured", "estimated"]>;
+      readonly counts: Schema.Int;
+      readonly bytes: Schema.Int;
+    }>>>;
+  }>>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof UsageRangeRefused | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"usage", "GET", "/v1/owners/:owner/usage", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
 }>>, Schema.toCodecStringTree<Schema.Struct<{
   from: Schema.optionalKey<Schema.brand<Schema.String, "UtcDay">>;
@@ -18918,56 +19135,60 @@ declare const OrganizationsGroup_base: HttpApiGroup.HttpApiGroup<"organizations"
     }>>;
   }>;
   readonly pricesAsOf: Schema.String;
-}>]>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof UsageRangeRefused | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"meters", "GET", "/v1/owners/:owner/meters", Schema.toCodecStringTree<Schema.Struct<{
+}>]>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof UsageRangeRefused | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"leave", "DELETE", "/v1/me/organizations/:owner", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+}>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Struct<{
+  readonly member: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"person">;
+    readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"agent">;
+    readonly agent: Schema.Struct<{
+      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+    }>;
+  }>]>;
+  readonly why: Schema.Literals<readonly ["removed", "left"]>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof MemberNotFound | typeof LastAdmin | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"create", "POST", "/v1/organizations", never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly name: Schema.brand<Schema.String, "OwnerName">;
+  readonly displayName: Schema.optionalKey<Schema.String>;
 }>>, Schema.toCodecStringTree<Schema.Struct<{
-  from: Schema.optionalKey<Schema.brand<Schema.String, "UtcDay">>;
-  to: Schema.optionalKey<Schema.brand<Schema.String, "UtcDay">>;
-}>>, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly from: Schema.brand<Schema.String, "UtcDay">;
-  readonly to: Schema.brand<Schema.String, "UtcDay">;
-  readonly days: Schema.$Array<Schema.Struct<{
-    readonly day: Schema.brand<Schema.String, "UtcDay">;
-    readonly lines: Schema.$Array<Schema.Struct<{
-      readonly meter: Schema.Literals<readonly ["containers.vcpu_seconds", "containers.memory_gib_seconds", "containers.disk_gb_seconds", "containers.egress_gb", "browser.seconds", "artifacts.bytes", "r2.bytes"]>;
-      readonly quantity: Schema.Finite;
-      readonly known: Schema.Literals<readonly ["measured", "estimated"]>;
-    }>>;
-  }>>;
-  readonly work: Schema.$Array<Schema.Struct<{
-    readonly work: Schema.optionalKey<Schema.Literals<readonly ["sandbox", "check run", "merge queue", "snapshot build"]>>;
-    readonly repo: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">>;
-    readonly name: Schema.optionalKey<Schema.brand<Schema.String, "RepoName">>;
-    readonly lines: Schema.$Array<Schema.Struct<{
-      readonly meter: Schema.Literals<readonly ["containers.vcpu_seconds", "containers.memory_gib_seconds", "containers.disk_gb_seconds", "containers.egress_gb", "browser.seconds", "artifacts.bytes", "r2.bytes"]>;
-      readonly quantity: Schema.Finite;
-      readonly known: Schema.Literals<readonly ["measured", "estimated"]>;
-    }>>;
-  }>>;
-  readonly kept: Schema.optionalKey<Schema.Struct<{
-    readonly day: Schema.brand<Schema.String, "UtcDay">;
-    readonly counts: Schema.$Array<Schema.Struct<{
-      readonly repo: Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">;
-      readonly name: Schema.optionalKey<Schema.brand<Schema.String, "RepoName">>;
-      readonly fork: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["fork_", Schema.String]>, "ForkId">>;
-      readonly store: Schema.Literals<readonly ["artifacts", "r2"]>;
-      readonly bytes: Schema.Int;
-      readonly known: Schema.Literals<readonly ["measured", "estimated"]>;
-    }>>;
-    readonly others: Schema.optionalKey<Schema.$Array<Schema.Struct<{
-      readonly store: Schema.Literals<readonly ["artifacts", "r2"]>;
-      readonly known: Schema.Literals<readonly ["measured", "estimated"]>;
-      readonly counts: Schema.Int;
-      readonly bytes: Schema.Int;
-    }>>>;
-  }>>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof UsageRangeRefused | typeof OrganizationNotFound>, Authorization, never>, false>;
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Struct<{
+  readonly owner: Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">;
+  readonly name: Schema.brand<Schema.String, "OwnerName">;
+  readonly displayName: Schema.String;
+  readonly state: Schema.Literals<readonly ["initializing", "ready"]>;
+}>>, Schema.toCodecJson<typeof NameTaken | typeof NameReserved | typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow>, Authorization, never>, false>;
 /**
  * Organizations (layer 1): making one, the person's own list of theirs, leaving one, and its
  * usage. Every change is a person's, by approval; agents never change members.
  */
 declare class OrganizationsGroup extends OrganizationsGroup_base {}
-declare const MembersGroup_base: HttpApiGroup.HttpApiGroup<"members", HttpApiEndpoint.HttpApiEndpoint<"remove", "DELETE", "/v1/owners/:owner/members/:member", Schema.toCodecStringTree<Schema.Struct<{
+declare const MembersGroup_base: HttpApiGroup.HttpApiGroup<"members", HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/owners/:owner/members", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  cursor: Schema.optionalKey<Schema.brand<Schema.String, "MemberCursor">>;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly members: Schema.$Array<Schema.Struct<{
+    readonly member: Schema.Union<readonly [Schema.Struct<{
+      readonly kind: Schema.Literal<"person">;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"agent">;
+      readonly agent: Schema.Struct<{
+        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+      }>;
+    }>]>;
+    readonly name: Schema.String;
+    readonly role: Schema.Literals<readonly ["admin", "member"]>;
+    readonly addedAt: Schema.DateTimeUtcFromMillis;
+  }>>;
+  readonly next: Schema.optionalKey<Schema.brand<Schema.String, "MemberCursor">>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"remove", "DELETE", "/v1/owners/:owner/members/:member", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   member: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
 }>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
@@ -19003,40 +19224,49 @@ declare const MembersGroup_base: HttpApiGroup.HttpApiGroup<"members", HttpApiEnd
     }>;
   }>]>;
   readonly role: Schema.Literals<readonly ["admin", "member"]>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof MemberNotFound | typeof LastAdmin | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/owners/:owner/members", Schema.toCodecStringTree<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof MemberNotFound | typeof LastAdmin | typeof OrganizationNotFound>, Authorization, never>, false>;
+/** An organization's members: any member lists them; an admin changes a role or removes one. */
+declare class MembersGroup extends MembersGroup_base {}
+declare const InvitationsGroup_base: HttpApiGroup.HttpApiGroup<"invitations", HttpApiEndpoint.HttpApiEndpoint<"received", "GET", "/v1/me/invitations", never, Schema.toCodecStringTree<Schema.Struct<{
+  cursor: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">>;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly invitations: Schema.$Array<Schema.Struct<{
+    readonly invitation: Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">;
+    readonly organization: Schema.Struct<{
+      readonly owner: Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">;
+      readonly name: Schema.brand<Schema.String, "OwnerName">;
+    }>;
+    readonly role: Schema.Literals<readonly ["admin", "member"]>;
+    readonly expiresAt: Schema.DateTimeUtcFromMillis;
+  }>>;
+  readonly next: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/owners/:owner/invitations", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
 }>>, Schema.toCodecStringTree<Schema.Struct<{
-  cursor: Schema.optionalKey<Schema.brand<Schema.String, "MemberCursor">>;
+  cursor: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">>;
 }>>, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly members: Schema.$Array<Schema.Struct<{
-    readonly member: Schema.Union<readonly [Schema.Struct<{
-      readonly kind: Schema.Literal<"person">;
-      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"agent">;
-      readonly agent: Schema.Struct<{
-        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-      }>;
-    }>]>;
-    readonly name: Schema.String;
+  readonly invitations: Schema.$Array<Schema.Struct<{
+    readonly invitation: Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">;
+    readonly invitee: Schema.Struct<{
+      readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+      readonly name: Schema.brand<Schema.String, "OwnerName">;
+    }>;
     readonly role: Schema.Literals<readonly ["admin", "member"]>;
-    readonly addedAt: Schema.DateTimeUtcFromMillis;
+    readonly sentBy: Schema.Struct<{
+      readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+      readonly name: Schema.brand<Schema.String, "OwnerName">;
+    }>;
+    readonly expiresAt: Schema.DateTimeUtcFromMillis;
   }>>;
-  readonly next: Schema.optionalKey<Schema.brand<Schema.String, "MemberCursor">>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof OrganizationNotFound>, Authorization, never>, false>;
-/** An organization's members: any member lists them; an admin changes a role or removes one. */
-declare class MembersGroup extends MembersGroup_base {}
-declare const InvitationsGroup_base: HttpApiGroup.HttpApiGroup<"invitations", HttpApiEndpoint.HttpApiEndpoint<"accept", "POST", "/v1/me/invitations/:invitation/accept", Schema.toCodecStringTree<Schema.Struct<{
+  readonly next: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"withdraw", "DELETE", "/v1/owners/:owner/invitations/:invitation", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   invitation: Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">;
 }>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
   'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
 }>>, Schema.toCodecJson<Schema.Struct<{
   readonly invitation: Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">;
-  readonly organization: Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">;
-  readonly answer: Schema.Literals<readonly ["accept", "decline"]>;
-  readonly role: Schema.Literals<readonly ["admin", "member"]>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof InvitationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"decline", "POST", "/v1/me/invitations/:invitation/decline", Schema.toCodecStringTree<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof InvitationNotFound | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"accept", "POST", "/v1/me/invitations/:invitation/accept", Schema.toCodecStringTree<Schema.Struct<{
   invitation: Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">;
 }>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
   'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
@@ -19045,14 +19275,16 @@ declare const InvitationsGroup_base: HttpApiGroup.HttpApiGroup<"invitations", Ht
   readonly organization: Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">;
   readonly answer: Schema.Literals<readonly ["accept", "decline"]>;
   readonly role: Schema.Literals<readonly ["admin", "member"]>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof InvitationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"withdraw", "DELETE", "/v1/owners/:owner/invitations/:invitation", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof InvitationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"decline", "POST", "/v1/me/invitations/:invitation/decline", Schema.toCodecStringTree<Schema.Struct<{
   invitation: Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">;
 }>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
   'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
 }>>, Schema.toCodecJson<Schema.Struct<{
   readonly invitation: Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof InvitationNotFound | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"send", "POST", "/v1/owners/:owner/invitations", Schema.toCodecStringTree<Schema.Struct<{
+  readonly organization: Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">;
+  readonly answer: Schema.Literals<readonly ["accept", "decline"]>;
+  readonly role: Schema.Literals<readonly ["admin", "member"]>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof InvitationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"send", "POST", "/v1/owners/:owner/invitations", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
   readonly invitee: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
@@ -19067,45 +19299,62 @@ declare const InvitationsGroup_base: HttpApiGroup.HttpApiGroup<"invitations", Ht
   }>;
   readonly role: Schema.Literals<readonly ["admin", "member"]>;
   readonly expiresAt: Schema.DateTimeUtcFromMillis;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof AlreadyMember | typeof InvitationOpen | typeof OrganizationNotFound | typeof PersonNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/owners/:owner/invitations", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  cursor: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">>;
-}>>, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly invitations: Schema.$Array<Schema.Struct<{
-    readonly invitation: Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">;
-    readonly invitee: Schema.Struct<{
-      readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-      readonly name: Schema.brand<Schema.String, "OwnerName">;
-    }>;
-    readonly role: Schema.Literals<readonly ["admin", "member"]>;
-    readonly sentBy: Schema.Struct<{
-      readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-      readonly name: Schema.brand<Schema.String, "OwnerName">;
-    }>;
-    readonly expiresAt: Schema.DateTimeUtcFromMillis;
-  }>>;
-  readonly next: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"received", "GET", "/v1/me/invitations", never, Schema.toCodecStringTree<Schema.Struct<{
-  cursor: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">>;
-}>>, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly invitations: Schema.$Array<Schema.Struct<{
-    readonly invitation: Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">;
-    readonly organization: Schema.Struct<{
-      readonly owner: Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">;
-      readonly name: Schema.brand<Schema.String, "OwnerName">;
-    }>;
-    readonly role: Schema.Literals<readonly ["admin", "member"]>;
-    readonly expiresAt: Schema.DateTimeUtcFromMillis;
-  }>>;
-  readonly next: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable>, Authorization, never>, false>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof AlreadyMember | typeof InvitationOpen | typeof OrganizationNotFound | typeof PersonNotFound>, Authorization, never>, false>;
 /**
  * Invitations: an organization's admins send, list and withdraw them; the person invited lists
  * theirs and accepts or declines one, which is found from their own list, never the client.
  */
 declare class InvitationsGroup extends InvitationsGroup_base {}
-declare const GrantsGroup_base: HttpApiGroup.HttpApiGroup<"grants", HttpApiEndpoint.HttpApiEndpoint<"revoke", "DELETE", "/v1/owners/:owner/grants", Schema.toCodecStringTree<Schema.Struct<{
+declare const GrantsGroup_base: HttpApiGroup.HttpApiGroup<"grants", HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/owners/:owner/grants", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  after: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["event_", Schema.String]>, "EventId">>;
+  limit: Schema.optionalKey<Schema.Int>;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly grants: Schema.$Array<Schema.Struct<{
+    readonly grant: Schema.brand<Schema.TemplateLiteral<readonly ["event_", Schema.String]>, "EventId">;
+    readonly subject: Schema.Union<readonly [Schema.Struct<{
+      readonly kind: Schema.Literal<"owner">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"project">;
+      readonly project: Schema.brand<Schema.String, "ProjectName">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"thread">;
+      readonly thread: Schema.brand<Schema.String, "WrittenThread">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"agent">;
+      readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+    }>]>;
+    readonly principal: Schema.Union<readonly [Schema.Struct<{
+      readonly kind: Schema.Literal<"person">;
+      readonly name: Schema.brand<Schema.String, "OwnerName">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"agent">;
+      readonly owner: Schema.brand<Schema.String, "OwnerName">;
+      readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"agent">;
+      readonly agent: Schema.Struct<{
+        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+      }>;
+    }>]>;
+    readonly role: Schema.Literals<readonly ["read", "write", "attach", "manage"]>;
+    readonly grantedBy: Schema.Union<readonly [Schema.Struct<{
+      readonly kind: Schema.Literal<"person">;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"agent">;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"ref0">;
+      readonly id: Schema.Literals<("ref0:attachments" | "ref0:barrier" | "ref0:blockers" | "ref0:checks" | "ref0:gate" | "ref0:hooks" | "ref0:importer" | "ref0:invitations" | "ref0:listings" | "ref0:mirror" | "ref0:needs" | "ref0:oauth" | "ref0:owners" | "ref0:plans" | "ref0:prepare" | "ref0:project-gate" | "ref0:pushes" | "ref0:queue" | "ref0:rebuilder" | "ref0:sessions" | "ref0:sign-in" | "ref0:stages" | "ref0:sweeper" | "ref0:usage" | "ref0:warm-up" | "ref0:workflows")[]>;
+    }>]>;
+    readonly grantedAt: Schema.DateTimeUtcFromMillis;
+  }>>;
+  readonly nextAfter: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["event_", Schema.String]>, "EventId">>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"revoke", "DELETE", "/v1/owners/:owner/grants", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
   readonly subject: Schema.Union<readonly [Schema.Struct<{
@@ -19217,56 +19466,7 @@ declare const GrantsGroup_base: HttpApiGroup.HttpApiGroup<"grants", HttpApiEndpo
     }>;
   }>]>;
   readonly role: Schema.Literals<readonly ["read", "write", "attach", "manage"]>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof MemberNotFound | typeof OrganizationNotFound | typeof SubjectNotFound | typeof RoleNotFitting>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/owners/:owner/grants", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  after: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["event_", Schema.String]>, "EventId">>;
-  limit: Schema.optionalKey<Schema.Int>;
-}>>, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly grants: Schema.$Array<Schema.Struct<{
-    readonly grant: Schema.brand<Schema.TemplateLiteral<readonly ["event_", Schema.String]>, "EventId">;
-    readonly subject: Schema.Union<readonly [Schema.Struct<{
-      readonly kind: Schema.Literal<"owner">;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"project">;
-      readonly project: Schema.brand<Schema.String, "ProjectName">;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"thread">;
-      readonly thread: Schema.brand<Schema.String, "WrittenThread">;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"agent">;
-      readonly handle: Schema.brand<Schema.String, "AgentHandle">;
-    }>]>;
-    readonly principal: Schema.Union<readonly [Schema.Struct<{
-      readonly kind: Schema.Literal<"person">;
-      readonly name: Schema.brand<Schema.String, "OwnerName">;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"agent">;
-      readonly owner: Schema.brand<Schema.String, "OwnerName">;
-      readonly handle: Schema.brand<Schema.String, "AgentHandle">;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"agent">;
-      readonly agent: Schema.Struct<{
-        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-      }>;
-    }>]>;
-    readonly role: Schema.Literals<readonly ["read", "write", "attach", "manage"]>;
-    readonly grantedBy: Schema.Union<readonly [Schema.Struct<{
-      readonly kind: Schema.Literal<"person">;
-      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"agent">;
-      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"ref0">;
-      readonly id: Schema.Literals<("ref0:attachments" | "ref0:barrier" | "ref0:blockers" | "ref0:checks" | "ref0:gate" | "ref0:hooks" | "ref0:importer" | "ref0:invitations" | "ref0:listings" | "ref0:mirror" | "ref0:needs" | "ref0:oauth" | "ref0:owners" | "ref0:plans" | "ref0:prepare" | "ref0:project-gate" | "ref0:pushes" | "ref0:queue" | "ref0:rebuilder" | "ref0:sessions" | "ref0:sign-in" | "ref0:stages" | "ref0:sweeper" | "ref0:usage" | "ref0:warm-up" | "ref0:workflows")[]>;
-    }>]>;
-    readonly grantedAt: Schema.DateTimeUtcFromMillis;
-  }>>;
-  readonly nextAfter: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["event_", Schema.String]>, "EventId">>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof OrganizationNotFound>, Authorization, never>, false>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof MemberNotFound | typeof OrganizationNotFound | typeof SubjectNotFound | typeof RoleNotFitting>, Authorization, never>, false>;
 /**
  * An organization's grants (layer 1): any person lists those they may see; an admin gives one or
  * takes one back, by approval, naming it in the body, `DELETE` too. People only: agents never
@@ -19274,7 +19474,24 @@ declare const GrantsGroup_base: HttpApiGroup.HttpApiGroup<"grants", HttpApiEndpo
  * `OrganizationNotFound`.
  */
 declare class GrantsGroup extends GrantsGroup_base {}
-declare const AgentsGroup_base: HttpApiGroup.HttpApiGroup<"agents", HttpApiEndpoint.HttpApiEndpoint<"get", "GET", "/v1/owners/:owner/agents/:agent", Schema.toCodecStringTree<Schema.Struct<{
+declare const AgentsGroup_base: HttpApiGroup.HttpApiGroup<"agents", HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/owners/:owner/agents", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  after: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">>;
+  limit: Schema.optionalKey<Schema.Int>;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly agents: Schema.$Array<Schema.Struct<{
+    readonly agent: Schema.Struct<{
+      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+    }>;
+    readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+    readonly generation: Schema.Int;
+    readonly turnedOff: Schema.Boolean;
+    readonly addedAt: Schema.DateTimeUtcFromMillis;
+  }>>;
+  readonly nextAfter: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"get", "GET", "/v1/owners/:owner/agents/:agent", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   agent: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">, Schema.brand<Schema.String, "AgentHandle">]>;
 }>>, never, never, never, Schema.toCodecJson<Schema.Struct<{
@@ -19286,10 +19503,11 @@ declare const AgentsGroup_base: HttpApiGroup.HttpApiGroup<"agents", HttpApiEndpo
   readonly generation: Schema.Int;
   readonly turnedOff: Schema.Boolean;
   readonly addedAt: Schema.DateTimeUtcFromMillis;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"disable", "POST", "/v1/owners/:owner/agents/:agent/disable", Schema.toCodecStringTree<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"add", "POST", "/v1/owners/:owner/agents", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-  agent: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">, Schema.brand<Schema.String, "AgentHandle">]>;
-}>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+  readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
   'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
 }>>, Schema.toCodecJson<Schema.Struct<{
   readonly agent: Schema.Struct<{
@@ -19299,7 +19517,7 @@ declare const AgentsGroup_base: HttpApiGroup.HttpApiGroup<"agents", HttpApiEndpo
   readonly handle: Schema.brand<Schema.String, "AgentHandle">;
   readonly generation: Schema.Int;
   readonly turnedOff: Schema.Boolean;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof DeliveryOutsideWindow | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"enable", "POST", "/v1/owners/:owner/agents/:agent/enable", Schema.toCodecStringTree<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof HandleTaken | typeof DeliveryOutsideWindow | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"disable", "POST", "/v1/owners/:owner/agents/:agent/disable", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   agent: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">, Schema.brand<Schema.String, "AgentHandle">]>;
 }>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
@@ -19312,11 +19530,10 @@ declare const AgentsGroup_base: HttpApiGroup.HttpApiGroup<"agents", HttpApiEndpo
   readonly handle: Schema.brand<Schema.String, "AgentHandle">;
   readonly generation: Schema.Int;
   readonly turnedOff: Schema.Boolean;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof DeliveryOutsideWindow | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"add", "POST", "/v1/owners/:owner/agents", Schema.toCodecStringTree<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof DeliveryOutsideWindow | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"enable", "POST", "/v1/owners/:owner/agents/:agent/enable", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-  readonly handle: Schema.brand<Schema.String, "AgentHandle">;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
+  agent: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">, Schema.brand<Schema.String, "AgentHandle">]>;
+}>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
   'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
 }>>, Schema.toCodecJson<Schema.Struct<{
   readonly agent: Schema.Struct<{
@@ -19326,24 +19543,7 @@ declare const AgentsGroup_base: HttpApiGroup.HttpApiGroup<"agents", HttpApiEndpo
   readonly handle: Schema.brand<Schema.String, "AgentHandle">;
   readonly generation: Schema.Int;
   readonly turnedOff: Schema.Boolean;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof HandleTaken | typeof DeliveryOutsideWindow | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/owners/:owner/agents", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  after: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">>;
-  limit: Schema.optionalKey<Schema.Int>;
-}>>, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly agents: Schema.$Array<Schema.Struct<{
-    readonly agent: Schema.Struct<{
-      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-    }>;
-    readonly handle: Schema.brand<Schema.String, "AgentHandle">;
-    readonly generation: Schema.Int;
-    readonly turnedOff: Schema.Boolean;
-    readonly addedAt: Schema.DateTimeUtcFromMillis;
-  }>>;
-  readonly nextAfter: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof OrganizationNotFound>, Authorization, never>, false>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof DeliveryOutsideWindow | typeof OrganizationNotFound>, Authorization, never>, false>;
 /**
  * An owner's agents (layer 1): an organization's members, or a person themselves, read them and
  * turn one off everywhere, or on again; an organization's admin adds one, and only an admin turns
@@ -19396,7 +19596,34 @@ declare const AuthorizationsGroup_base: HttpApiGroup.HttpApiGroup<"authorization
  * decides. People only, by approval.
  */
 declare class AuthorizationsGroup extends AuthorizationsGroup_base {}
-declare const AgentDisablesGroup_base: HttpApiGroup.HttpApiGroup<"agentDisables", HttpApiEndpoint.HttpApiEndpoint<"add", "POST", "/v1/owners/:owner/agent-disables", Schema.toCodecStringTree<Schema.Struct<{
+declare const AgentDisablesGroup_base: HttpApiGroup.HttpApiGroup<"agentDisables", HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/owners/:owner/agent-disables", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  after: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">>;
+  limit: Schema.optionalKey<Schema.Int>;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly disables: Schema.$Array<Schema.Struct<{
+    readonly agent: Schema.Struct<{
+      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+    }>;
+    readonly owner: Schema.optionalKey<Schema.brand<Schema.String, "OwnerName">>;
+    readonly handle: Schema.optionalKey<Schema.brand<Schema.String, "AgentHandle">>;
+    readonly disabledBy: Schema.Union<readonly [Schema.Struct<{
+      readonly kind: Schema.Literal<"person">;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"agent">;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"ref0">;
+      readonly id: Schema.Literals<("ref0:attachments" | "ref0:barrier" | "ref0:blockers" | "ref0:checks" | "ref0:gate" | "ref0:hooks" | "ref0:importer" | "ref0:invitations" | "ref0:listings" | "ref0:mirror" | "ref0:needs" | "ref0:oauth" | "ref0:owners" | "ref0:plans" | "ref0:prepare" | "ref0:project-gate" | "ref0:pushes" | "ref0:queue" | "ref0:rebuilder" | "ref0:sessions" | "ref0:sign-in" | "ref0:stages" | "ref0:sweeper" | "ref0:usage" | "ref0:warm-up" | "ref0:workflows")[]>;
+    }>]>;
+    readonly disabledAt: Schema.DateTimeUtcFromMillis;
+  }>>;
+  readonly nextAfter: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"remove", "DELETE", "/v1/owners/:owner/agent-disables", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
   readonly agent: Schema.Struct<{
@@ -19412,7 +19639,7 @@ declare const AgentDisablesGroup_base: HttpApiGroup.HttpApiGroup<"agentDisables"
   }>;
   readonly targetGeneration: Schema.Int;
   readonly turnedOff: Schema.Boolean;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof DeliveryOutsideWindow | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"remove", "DELETE", "/v1/owners/:owner/agent-disables", Schema.toCodecStringTree<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof DeliveryOutsideWindow | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"add", "POST", "/v1/owners/:owner/agent-disables", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
   readonly agent: Schema.Struct<{
@@ -19428,34 +19655,7 @@ declare const AgentDisablesGroup_base: HttpApiGroup.HttpApiGroup<"agentDisables"
   }>;
   readonly targetGeneration: Schema.Int;
   readonly turnedOff: Schema.Boolean;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof DeliveryOutsideWindow | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/owners/:owner/agent-disables", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  after: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">>;
-  limit: Schema.optionalKey<Schema.Int>;
-}>>, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly disables: Schema.$Array<Schema.Struct<{
-    readonly agent: Schema.Struct<{
-      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-    }>;
-    readonly owner: Schema.optionalKey<Schema.brand<Schema.String, "OwnerName">>;
-    readonly handle: Schema.optionalKey<Schema.brand<Schema.String, "AgentHandle">>;
-    readonly disabledBy: Schema.Union<readonly [Schema.Struct<{
-      readonly kind: Schema.Literal<"person">;
-      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"agent">;
-      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"ref0">;
-      readonly id: Schema.Literals<("ref0:attachments" | "ref0:barrier" | "ref0:blockers" | "ref0:checks" | "ref0:gate" | "ref0:hooks" | "ref0:importer" | "ref0:invitations" | "ref0:listings" | "ref0:mirror" | "ref0:needs" | "ref0:oauth" | "ref0:owners" | "ref0:plans" | "ref0:prepare" | "ref0:project-gate" | "ref0:pushes" | "ref0:queue" | "ref0:rebuilder" | "ref0:sessions" | "ref0:sign-in" | "ref0:stages" | "ref0:sweeper" | "ref0:usage" | "ref0:warm-up" | "ref0:workflows")[]>;
-    }>]>;
-    readonly disabledAt: Schema.DateTimeUtcFromMillis;
-  }>>;
-  readonly nextAfter: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof OrganizationNotFound>, Authorization, never>, false>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof DeliveryOutsideWindow | typeof OrganizationNotFound>, Authorization, never>, false>;
 /**
  * Agents of other owners an organization's admin turns off there (layer 1), such as a member's
  * own, named in the body, `DELETE` too, since a handle alone can't tell `pip/claude` from
@@ -21650,6 +21850,9 @@ declare const ReadEvent: Schema.Union<readonly [Schema.Union<readonly [Schema.St
       readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
     }>>;
     readonly expiresAt: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
+    readonly cnf: Schema.optionalKey<Schema.Struct<{
+      readonly jkt: Schema.brand<Schema.String, "KeyThumbprint">;
+    }>>;
   }>;
 } & {
   readonly seq: Schema.Int;
@@ -26629,6 +26832,27 @@ declare const ReadEvent: Schema.Union<readonly [Schema.Union<readonly [Schema.St
         readonly path: Schema.brand<Schema.String, "RepoPath">;
       }>>;
       readonly more: Schema.Int;
+      readonly toolTime: Schema.Union<readonly [Schema.Struct<{
+        readonly known: Schema.Literal<"timed">;
+        readonly totalMs: Schema.Int;
+        readonly longest: Schema.optionalKey<Schema.Struct<{
+          readonly tool: Schema.String;
+          readonly ms: Schema.Int;
+        }>>;
+      }>, Schema.Struct<{
+        readonly known: Schema.Literal<"unknown">;
+      }>]>;
+      readonly context: Schema.Union<readonly [Schema.Struct<{
+        readonly known: Schema.Literal<"read">;
+        readonly peak: Schema.optionalKey<Schema.Int>;
+        readonly compactions: Schema.$Array<Schema.Struct<{
+          readonly trigger: Schema.optionalKey<Schema.Literals<readonly ["auto", "manual"]>>;
+          readonly afterMs: Schema.optionalKey<Schema.Int>;
+        }>>;
+      }>, Schema.Struct<{
+        readonly known: Schema.Literal<"unknown">;
+      }>]>;
+      readonly moreSubagents: Schema.Int;
       readonly tokens: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
         readonly known: Schema.Literal<"read">;
         readonly models: Schema.$Array<Schema.Struct<{
@@ -26641,6 +26865,21 @@ declare const ReadEvent: Schema.Union<readonly [Schema.Union<readonly [Schema.St
       }>, Schema.Struct<{
         readonly known: Schema.Literal<"unknown">;
       }>]>>;
+      readonly subagents: Schema.$Array<Schema.Struct<{
+        readonly type: Schema.optionalKey<Schema.String>;
+        readonly tokens: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
+          readonly known: Schema.Literal<"read">;
+          readonly models: Schema.$Array<Schema.Struct<{
+            readonly model: Schema.String;
+            readonly input: Schema.Int;
+            readonly output: Schema.Int;
+            readonly cacheWrite: Schema.Int;
+            readonly cacheRead: Schema.Int;
+          }>>;
+        }>, Schema.Struct<{
+          readonly known: Schema.Literal<"unknown">;
+        }>]>>;
+      }>>;
     }>>;
     readonly tasks: Schema.optionalKey<Schema.$Array<Schema.Struct<{
       readonly text: Schema.brand<Schema.TemplateLiteral<readonly ["text_", Schema.String]>, "TextId">;
@@ -29769,5 +30008,5 @@ declare const SandboxExecAnswer: Schema.Union<readonly [Schema.Struct<{
 }>]>;
 type SandboxExecAnswer = typeof SandboxExecAnswer.Type;
 //#endregion
-export { MirrorChoice as $, WorkflowAnswerer as $t, ConnectionCall as A, WorkflowPasskeyState as An, SandboxPushAnswer as At, EndpointName as B, WorkflowTrigger as Bn, StartActor as Bt, ClientGranted as C, WorkflowEvent as Cn, RepoView as Ct, ConnectFolderOption as D, WorkflowPasskeyAsked as Dn, SandboxOpen as Dt, ConnectFolderChoices as E, WorkflowPasskeyAsk as En, SandboxExecAnswer as Et, ConnectionView as F, WorkflowRequestRefusal as Fn, SentryRegion as Ft, GateOwn as G, hookTokenPrefix as Gn, TrackClosed as Gt, FoldersConnected as H, commandLine as Hn, StatementView as Ht, ConsentAsked as I, WorkflowStartEnded as In, SentryToken as It, ImportFailure as J, liveSocketUrl as Jn, TypedApprovalCode as Jt, GetIssueInput as K, hookUrl as Kn, TrackSession as Kt, ConsentClient as L, WorkflowStartState as Ln, SignInDestination as Lt, ConnectionChanged as M, WorkflowPreview as Mn, ScopeAction as Mt, ConnectionKind as N, WorkflowPullRequestAnswer as Nn, SecretHash as Nt, ConnectOptions as O, WorkflowPasskeyEnded as On, SandboxOpenAnswer as Ot, ConnectionName as P, WorkflowPullRequestOpen as Pn, SentryOrg as Pt, MachineConnected as Q, threadParts as Qn, WorkflowActionAnswer as Qt, ConsentProject as R, WorkflowText as Rn, SignedIn as Rt, ClientAccess as S, WorkflowConnections as Sn, RepoUrl as St, ConnectChosen as T, WorkflowOwn as Tn, SandboxExec as Tt, ForkAnswer as U, connectEndpoint as Un, ThreadId as Ut, EventRunInput as V, WrittenProject as Vn, StartRun as Vt, ForkCreate as W, encodeSecret as Wn, ThreadStage as Wt, LiveTicketRequest as X, repoNameKey as Xn, Welcome as Xt, LiveTicket as Y, projectParts as Yn, VersionFile as Yt, LiveTrackName as Z, surfaceOf as Zn, WorkflowAction as Zt, CheckOn as _, WorkflowCheckStartAnswer as _n, ProjectTrackMessage as _t, AnswerKey as a, WorkflowCallInput as an, OwnerThreadPage as at, CheckRunParams as b, WorkflowCheckWhere as bn, Ref0Owned as bt, ApprovalAnswer as c, WorkflowCalledState as cn, PasskeyAsserted as ct, ApprovalState as d, WorkflowCheckRefused as dn, PasskeyFrom as dt, WorkflowAsk as en, MirrorEntry as et, ApprovalView as f, WorkflowCheckResults as fn, PasskeyRefusal as ft, ChangeAuthor as g, WorkflowCheckStart as gn, ProjectName as gt, Authorization as h, WorkflowCheckRunEnded as hn, PreviewUnavailable as ht, AgentView as i, WorkflowCallEnded as in, OwnerName as it, ConnectionCallAnswer as j, WorkflowPermissions as jn, SandboxSize as jt, ConnectableAgent as k, WorkflowPasskeyRead as kn, SandboxPush as kt, ApprovalId as l, WorkflowCalledStateAnswer as ln, PasskeyCreated as lt, AttachmentRequestView as m, WorkflowCheckRun as mn, PreviewEcho as mt, AgentPermissionChoice as n, WorkflowCall as nn, NamedDecision as nt, Api as o, WorkflowCallRefusal as on, OwnerThreadView as ot, AttachmentFailed as p, WorkflowCheckResultsAnswer as pn, PasskeyRequestOptions as pt, Harness as q, isRef0Path as qn, TrackThread as qt, AgentPermissionSetting as r, WorkflowCallAnswer as rn, OwnerId as rt, ApiOrigin as s, WorkflowCallRefused as sn, OwnerTrackMessage as st, AgentHandle as t, WorkflowAskClosed as tn, MirrorView as tt, ApprovalPreview as u, WorkflowCheckRefusal as un, PasskeyCreationOptions as ut, CheckOwn as v, WorkflowCheckStates as vn, RanOf as vt, ConnectAgent as w, WorkflowFilters as wn, RequestFolder as wt, CheckTreeEntry as x, WorkflowComment as xn, RepoName as xt, CheckRunError as y, WorkflowCheckStatesAnswer as yn, ReadEvent as yt, CredentialView as z, WorkflowThreadStart as zn, SocketUrl as zt };
-//# sourceMappingURL=index-BSPC_jQm.d.mts.map
+export { LiveTicketRequest as $, liveSocketUrl as $n, TypedApprovalCode as $t, ConnectionCall as A, WorkflowOwn as An, SandboxExec as At, EndpointName as B, WorkflowRequestRefusal as Bn, SentryRegion as Bt, ClientGranted as C, WorkflowCheckStates as Cn, RanOf as Ct, ConnectFolderOption as D, WorkflowConnections as Dn, RepoUrl as Dt, ConnectFolderChoices as E, WorkflowComment as En, RepoName as Et, ConnectionView as F, WorkflowPasskeyState as Fn, SandboxPushAnswer as Ft, GateOwn as G, WorkflowTrigger as Gn, StartActor as Gt, FoldersConnected as H, WorkflowStartState as Hn, SignInDestination as Ht, ConsentAsked as I, WorkflowPermissions as In, SandboxSize as It, ImportFailure as J, connectEndpoint as Jn, ThreadId as Jt, GetIssueInput as K, WrittenProject as Kn, StartRun as Kt, ConsentClient as L, WorkflowPreview as Ln, ScopeAction as Lt, ConnectionChanged as M, WorkflowPasskeyAsked as Mn, SandboxOpen as Mt, ConnectionKind as N, WorkflowPasskeyEnded as Nn, SandboxOpenAnswer as Nt, ConnectOptions as O, WorkflowEvent as On, RepoView as Ot, ConnectionName as P, WorkflowPasskeyRead as Pn, SandboxPush as Pt, LiveTicket as Q, isRef0Path as Qn, TrackThread as Qt, ConsentProject as R, WorkflowPullRequestAnswer as Rn, SecretHash as Rt, ClientAccess as S, WorkflowCheckStartAnswer as Sn, PublicJwk as St, ConnectChosen as T, WorkflowCheckWhere as Tn, Ref0Owned as Tt, ForkAnswer as U, WorkflowText as Un, SignedIn as Ut, EventRunInput as V, WorkflowStartEnded as Vn, SentryToken as Vt, ForkCreate as W, WorkflowThreadStart as Wn, SocketUrl as Wt, KeyProof as X, hookTokenPrefix as Xn, TrackClosed as Xt, InvalidDpopProof as Y, encodeSecret as Yn, ThreadStage as Yt, KeyStoreUnavailable as Z, hookUrl as Zn, TrackSession as Zt, CheckOn as _, WorkflowCheckResults as _n, PreviewEcho as _t, AnswerKey as a, WorkflowAsk as an, NamedDecision as at, CheckRunParams as b, WorkflowCheckRunEnded as bn, ProjectTrackMessage as bt, ApprovalAnswer as c, WorkflowCallAnswer as cn, OwnerThreadPage as ct, ApprovalState as d, WorkflowCallRefusal as dn, PasskeyAsserted as dt, VersionFile as en, projectParts as er, LiveTrackName as et, ApprovalView as f, WorkflowCallRefused as fn, PasskeyCreated as ft, ChangeAuthor as g, WorkflowCheckRefused as gn, PasskeyRequestOptions as gt, Authorization as h, WorkflowCheckRefusal as hn, PasskeyRefusal as ht, AgentView as i, WorkflowAnswerer as in, MirrorView as it, ConnectionCallAnswer as j, WorkflowPasskeyAsk as jn, SandboxExecAnswer as jt, ConnectableAgent as k, WorkflowFilters as kn, RequestFolder as kt, ApprovalId as l, WorkflowCallEnded as ln, OwnerThreadView as lt, AttachmentRequestView as m, WorkflowCalledStateAnswer as mn, PasskeyFrom as mt, AgentPermissionChoice as n, WorkflowAction as nn, surfaceOf as nr, MirrorChoice as nt, Api as o, WorkflowAskClosed as on, OwnerId as ot, AttachmentFailed as p, WorkflowCalledState as pn, PasskeyCreationOptions as pt, Harness as q, commandLine as qn, StatementView as qt, AgentPermissionSetting as r, WorkflowActionAnswer as rn, threadParts as rr, MirrorEntry as rt, ApiOrigin as s, WorkflowCall as sn, OwnerName as st, AgentHandle as t, Welcome as tn, repoNameKey as tr, MachineConnected as tt, ApprovalPreview as u, WorkflowCallInput as un, OwnerTrackMessage as ut, CheckOwn as v, WorkflowCheckResultsAnswer as vn, PreviewUnavailable as vt, ConnectAgent as w, WorkflowCheckStatesAnswer as wn, ReadEvent as wt, CheckTreeEntry as x, WorkflowCheckStart as xn, ProofOrigin as xt, CheckRunError as y, WorkflowCheckRun as yn, ProjectName as yt, CredentialView as z, WorkflowPullRequestOpen as zn, SentryOrg as zt };
+//# sourceMappingURL=index-DRFaIKvW.d.mts.map