@ref0/sdk 0.6.0 → 0.8.0

package/dist/{index-CJGX88qF.d.mts → index-Bm4HWooV.d.mts}

@@ -423,6 +423,8 @@ declare const ApprovalState: Schema.Union<readonly [Schema.Struct<{
   readonly expiresAt: Schema.DateTimeUtcFromString;
 }>, Schema.Struct<{
   readonly state: Schema.Literal<"approved">;
+  /** A machine's answering browser may forget its saved answer once the terminal kept it. */
+  readonly collected: Schema.optionalKey<Schema.Literal<true>>;
 }>, Schema.Struct<{
   readonly state: Schema.Literal<"refused">;
 }>, Schema.Struct<{
@@ -437,6 +439,8 @@ type ApprovalState = typeof ApprovalState.Type;
 /** Only the answering browser receives a machine's answer code; state reads never carry it. */
 declare const ApprovalAnswer: Schema.Union<readonly [Schema.Struct<{
   readonly state: Schema.Literal<"approved">;
+  /** A machine's answering browser may forget its saved answer once the terminal kept it. */
+  readonly collected: Schema.optionalKey<Schema.Literal<true>>;
   readonly answerCode: Schema.String;
 }>, Schema.Struct<{
   readonly status: Schema.Int;
@@ -449,6 +453,8 @@ declare const ApprovalAnswer: Schema.Union<readonly [Schema.Struct<{
   readonly expiresAt: Schema.DateTimeUtcFromString;
 }>, Schema.Struct<{
   readonly state: Schema.Literal<"approved">;
+  /** A machine's answering browser may forget its saved answer once the terminal kept it. */
+  readonly collected: Schema.optionalKey<Schema.Literal<true>>;
 }>, Schema.Struct<{
   readonly state: Schema.Literal<"refused">;
 }>, Schema.Struct<{
@@ -1055,16 +1061,30 @@ declare const AskRecipientNotFound_base: Schema.Class<AskRecipientNotFound, Sche
  * doesn't say, so an ask never says what exists elsewhere.
  */
 declare class AskRecipientNotFound extends AskRecipientNotFound_base {}
+declare const RequestFolder: Schema.Struct<{
+  readonly path: Schema.String;
+  readonly harness: Schema.Literals<readonly ["claude-code", "codex"]>;
+  readonly secretHash: Schema.brand<Schema.String, "SecretHash">;
+  readonly replaces: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">>;
+}>;
+type RequestFolder = typeof RequestFolder.Type;
 /** An attachment request, as its person reads it once they type its code. */
 declare const AttachmentRequestView: Schema.Struct<{
   readonly approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
   /** The machine's own word for itself, never fact. */
   readonly machineName: Schema.String;
-  /** The harness the machine says it uses, never fact. */
-  readonly harness: Schema.optionalKey<Schema.Literals<readonly ["claude-code", "codex"]>>;
+  readonly folders: Schema.$Array<Schema.Struct<{
+    readonly path: Schema.String;
+    readonly harness: Schema.Literals<readonly ["claude-code", "codex"]>;
+    readonly replaces: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">>;
+  }>>;
   readonly askedFrom: Schema.optionalKey<Schema.String>;
   readonly askedAt: Schema.DateTimeUtcFromString;
   readonly expiresAt: Schema.DateTimeUtcFromString;
+  readonly callback: Schema.optionalKey<Schema.Struct<{
+    readonly port: Schema.Int;
+    readonly state: Schema.String;
+  }>>;
 }>;
 type AttachmentRequestView = typeof AttachmentRequestView.Type;
 /**
@@ -1106,10 +1126,137 @@ declare const ConnectChosen: Schema.Struct<{
     readonly organization: Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">;
     readonly name: Schema.brand<Schema.String, "OwnerName">;
   }>>;
+  readonly replacement: Schema.optionalKey<Schema.Struct<{
+    readonly grant: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+    readonly state: Schema.Literals<readonly ["replaces", "revoked", "skipped"]>;
+    readonly attachedAt: Schema.optionalKey<Schema.DateTimeUtcFromString>;
+  }>>;
 }>;
 type ConnectChosen = typeof ConnectChosen.Type;
+declare const ConnectFolderChoices: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+  readonly path: Schema.String;
+  readonly excluded: Schema.Literal<true>;
+}>, Schema.Struct<{
+  readonly path: Schema.String;
+  readonly agent: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"existing">;
+    readonly agent: Schema.Struct<{
+      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+    }>;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"new">;
+    readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+  }>]>;
+}>]>>;
+declare const ConnectFolderOption: Schema.Union<readonly [Schema.Struct<{
+  readonly path: Schema.String;
+  readonly excluded: Schema.Literal<true>;
+}>, Schema.Struct<{
+  readonly path: Schema.String;
+  readonly connect: Schema.Struct<{
+    readonly agent: Schema.optionalKey<Schema.Struct<{
+      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+    }>>;
+    readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+    readonly organizations: Schema.$Array<Schema.Struct<{
+      readonly organization: Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">;
+      readonly name: Schema.brand<Schema.String, "OwnerName">;
+    }>>;
+    readonly replacement: Schema.optionalKey<Schema.Struct<{
+      readonly grant: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+      readonly state: Schema.Literals<readonly ["replaces", "revoked", "skipped"]>;
+      readonly attachedAt: Schema.optionalKey<Schema.DateTimeUtcFromString>;
+    }>>;
+  }>;
+}>]>;
+/** Defaults and explicit choices both resolve the entire request and sign one challenge. */
+declare const ConnectOptions: Schema.Struct<{
+  readonly request: Schema.Struct<{
+    readonly approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
+    /** The machine's own word for itself, never fact. */
+    readonly machineName: Schema.String;
+    readonly folders: Schema.$Array<Schema.Struct<{
+      readonly path: Schema.String;
+      readonly harness: Schema.Literals<readonly ["claude-code", "codex"]>;
+      readonly replaces: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">>;
+    }>>;
+    readonly askedFrom: Schema.optionalKey<Schema.String>;
+    readonly askedAt: Schema.DateTimeUtcFromString;
+    readonly expiresAt: Schema.DateTimeUtcFromString;
+    readonly callback: Schema.optionalKey<Schema.Struct<{
+      readonly port: Schema.Int;
+      readonly state: Schema.String;
+    }>>;
+  }>;
+  readonly agents: Schema.$Array<Schema.Struct<{
+    readonly agent: Schema.Struct<{
+      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+    }>;
+    readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+  }>>;
+  readonly folders: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+    readonly path: Schema.String;
+    readonly excluded: Schema.Literal<true>;
+  }>, Schema.Struct<{
+    readonly path: Schema.String;
+    readonly connect: Schema.Struct<{
+      readonly agent: Schema.optionalKey<Schema.Struct<{
+        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+      }>>;
+      readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+      readonly organizations: Schema.$Array<Schema.Struct<{
+        readonly organization: Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">;
+        readonly name: Schema.brand<Schema.String, "OwnerName">;
+      }>>;
+      readonly replacement: Schema.optionalKey<Schema.Struct<{
+        readonly grant: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+        readonly state: Schema.Literals<readonly ["replaces", "revoked", "skipped"]>;
+        readonly attachedAt: Schema.optionalKey<Schema.DateTimeUtcFromString>;
+      }>>;
+    }>;
+  }>]>>;
+  readonly passkey: Schema.Struct<{
+    readonly challenge: Schema.String;
+    readonly timeout: Schema.optionalKey<Schema.Int>;
+    readonly rpId: Schema.optionalKey<Schema.String>;
+    readonly allowCredentials: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+      readonly id: Schema.String;
+      readonly type: Schema.Literal<"public-key">;
+      readonly transports: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["ble", "cable", "hybrid", "internal", "nfc", "smart-card", "usb"]>>>;
+    }>>>;
+    readonly userVerification: Schema.optionalKey<Schema.Literals<readonly ["discouraged", "preferred", "required"]>>;
+    readonly hints: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["hybrid", "security-key", "client-device"]>>>;
+  }>;
+}>;
+type ConnectOptions = typeof ConnectOptions.Type;
 /** The endpoint an attachment's approval names: no `/v1` endpoint, and never a terminal's ask. */
 declare const connectEndpoint = "attachments.connect";
+declare const FoldersConnected: Schema.Struct<{
+  readonly folders: Schema.$Array<Schema.Struct<{
+    readonly agent: Schema.Struct<{
+      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+    }>;
+    readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+    readonly credential: Schema.Struct<{
+      readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+    }>;
+    readonly agentCreated: Schema.Boolean;
+    readonly path: Schema.String;
+    readonly replacement: Schema.optionalKey<Schema.Struct<{
+      readonly grant: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+      readonly state: Schema.Literals<readonly ["replaces", "revoked", "skipped"]>;
+      readonly attachedAt: Schema.optionalKey<Schema.DateTimeUtcFromString>;
+    }>>;
+  }>>;
+  readonly excluded: Schema.$Array<Schema.String>;
+}>;
+type FoldersConnected = typeof FoldersConnected.Type;
 declare const AttachmentNotFound_base: Schema.Class<AttachmentNotFound, Schema.TaggedStruct<"AttachmentNotFound", {
   readonly nextStep: Schema.String;
 }>, import("effect/Cause").YieldableError>;
@@ -1208,13 +1355,10 @@ declare const NoFork_base: Schema.Class<NoFork, Schema.TaggedStruct<"NoFork", {
 /** No fork of this repo for that session: it hasn't asked for one. */
 declare class NoFork extends NoFork_base {}
 declare const NoBase_base: Schema.Class<NoBase, Schema.TaggedStruct<"NoBase", {
-  readonly why: Schema.Literals<readonly ["main empty", "held by a run"]>;
+  readonly why: Schema.Literal<"main empty">;
   readonly nextStep: Schema.String;
 }>, import("effect/Cause").YieldableError>;
-/**
- * No base to fetch: `main` has no commit yet, or the pin of the thread below is in a workflow
- * run's fork, which has no session's path to fetch from.
- */
+/** No base to fetch: `main` has no commit yet. */
 declare class NoBase extends NoBase_base {}
 declare const PullRequestNotFound_base: Schema.Class<PullRequestNotFound, Schema.TaggedStruct<"PullRequestNotFound", {
   readonly nextStep: Schema.String;
@@ -1921,6 +2065,19 @@ declare const ApprovalSecret_base: HttpApiMiddleware.ServiceClass<ApprovalSecret
  * secret is all it has. Not required of every client: only the one that made it supplies it.
  */
 declare class ApprovalSecret extends ApprovalSecret_base {}
+declare const MachineNameRefusal_base: HttpApiMiddleware.ServiceClass<MachineNameRefusal, "ref0/contracts/MachineNameRefusal", {
+  requires: never;
+  provides: never;
+  error: typeof CommandRefused;
+  clientError: never;
+  requiredForClient: false;
+  security: never;
+}, HttpApiMiddleware.HttpApiMiddleware<never, typeof CommandRefused, never>>;
+/**
+ * A machine's request whose name its contract refuses, answered as `CommandRefused`, which says
+ * what to change. Any other part that fails its contract is answered with Effect's empty 400.
+ */
+declare class MachineNameRefusal extends MachineNameRefusal_base {}
 declare const WelcomeGroup_base: HttpApiGroup.HttpApiGroup<"welcome", HttpApiEndpoint.HttpApiEndpoint<"get", "GET", "/v1/welcome", never, never, never, never, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
   readonly state: Schema.Literals<readonly ["ready", "setting up"]>;
   readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
@@ -1946,7 +2103,15 @@ declare const WelcomeGroup_base: HttpApiGroup.HttpApiGroup<"welcome", HttpApiEnd
 }>]>>, Schema.toCodecJson<typeof NameTaken | typeof NameReserved | typeof AuthorityUnavailable>, SignedIn, never>, false>;
 /** Where a signed-in person stands, and naming their owner when their GitHub login couldn't. */
 declare class WelcomeGroup extends WelcomeGroup_base {}
-declare const PasskeysGroup_base: HttpApiGroup.HttpApiGroup<"passkeys", HttpApiEndpoint.HttpApiEndpoint<"firstOptions", "POST", "/v1/me/passkeys/first/options", never, never, never, Schema.toCodecStringTree<Schema.Struct<{
+declare const PasskeysGroup_base: HttpApiGroup.HttpApiGroup<"passkeys", HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/me/passkeys", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly passkeys: Schema.$Array<Schema.Struct<{
+    readonly passkey: Schema.brand<Schema.TemplateLiteral<readonly ["passkey_", Schema.String]>, "PasskeyId">;
+    readonly name: Schema.optionalKey<Schema.String>;
+    readonly createdAt: Schema.String;
+    readonly backedUp: Schema.Boolean;
+  }>>;
+  readonly approvesHere: Schema.Boolean;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"firstOptions", "POST", "/v1/me/passkeys/first/options", never, never, never, Schema.toCodecStringTree<Schema.Struct<{
   'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
 }>>, Schema.toCodecJson<Schema.Struct<{
   readonly rp: Schema.Struct<{
@@ -1977,15 +2142,7 @@ declare const PasskeysGroup_base: HttpApiGroup.HttpApiGroup<"passkeys", HttpApiE
   }>>;
   readonly hints: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["hybrid", "security-key", "client-device"]>>>;
   readonly attestation: Schema.optionalKey<Schema.Literals<readonly ["direct", "enterprise", "indirect", "none"]>>;
-}>>, Schema.toCodecJson<typeof AuthorityUnavailable | typeof PasskeyRefused>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/me/passkeys", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly passkeys: Schema.$Array<Schema.Struct<{
-    readonly passkey: Schema.brand<Schema.TemplateLiteral<readonly ["passkey_", Schema.String]>, "PasskeyId">;
-    readonly name: Schema.optionalKey<Schema.String>;
-    readonly createdAt: Schema.String;
-    readonly backedUp: Schema.Boolean;
-  }>>;
-  readonly approvesHere: Schema.Boolean;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"enrolFirst", "POST", "/v1/me/passkeys/first", never, never, Schema.toCodecJson<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof AuthorityUnavailable | typeof PasskeyRefused>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"enrolFirst", "POST", "/v1/me/passkeys/first", never, never, Schema.toCodecJson<Schema.Struct<{
   readonly id: Schema.String;
   readonly rawId: Schema.String;
   readonly type: Schema.Literal<"public-key">;
@@ -2020,6 +2177,7 @@ declare const TerminalApprovalsGroup_base: HttpApiGroup.HttpApiGroup<"terminalAp
   readonly expiresAt: Schema.DateTimeUtcFromString;
 }>, Schema.Struct<{
   readonly state: Schema.Literal<"approved">;
+  readonly collected: Schema.optionalKey<Schema.Literal<true>>;
 }>, Schema.Struct<{
   readonly state: Schema.Literal<"refused">;
 }>, Schema.Struct<{
@@ -2095,20 +2253,31 @@ declare const MachineAttachmentsGroup_base: HttpApiGroup.HttpApiGroup<"machineAt
 }>, Schema.Struct<{
   readonly state: Schema.Literal<"connected">;
   readonly owner: Schema.brand<Schema.String, "OwnerName">;
-  readonly agent: Schema.Struct<{
-    readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-    readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-  }>;
-  readonly handle: Schema.brand<Schema.String, "AgentHandle">;
-  readonly credential: Schema.Struct<{
-    readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-    readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
-  }>;
-  readonly organizations: Schema.$Array<Schema.Struct<{
-    readonly organization: Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">;
-    readonly name: Schema.brand<Schema.String, "OwnerName">;
-    readonly state: Schema.Literals<readonly ["pending", "authorized", "refused"]>;
+  readonly folders: Schema.$Array<Schema.Struct<{
+    readonly agent: Schema.Struct<{
+      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+    }>;
+    readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+    readonly credential: Schema.Struct<{
+      readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+    }>;
+    readonly agentCreated: Schema.Boolean;
+    readonly path: Schema.String;
+    readonly owner: Schema.brand<Schema.String, "OwnerName">;
+    readonly organizations: Schema.$Array<Schema.Struct<{
+      readonly organization: Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">;
+      readonly name: Schema.brand<Schema.String, "OwnerName">;
+      readonly state: Schema.Literals<readonly ["pending", "authorized", "refused"]>;
+    }>>;
+    readonly replacement: Schema.optionalKey<Schema.Struct<{
+      readonly grant: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+      readonly state: Schema.Literals<readonly ["replaces", "revoked", "skipped"]>;
+      readonly attachedAt: Schema.optionalKey<Schema.DateTimeUtcFromString>;
+    }>>;
   }>>;
+  readonly excluded: Schema.$Array<Schema.String>;
 }>, Schema.Struct<{
   readonly state: Schema.Literal<"refused">;
 }>, Schema.Struct<{
@@ -2117,7 +2286,7 @@ declare const MachineAttachmentsGroup_base: HttpApiGroup.HttpApiGroup<"machineAt
   readonly state: Schema.Literal<"expired">;
 }>, Schema.Struct<{
   readonly state: Schema.Literal<"failed">;
-  readonly reason: Schema.Literals<readonly ["agent not found", "agent turned off", "agent changed", "handle taken", "session ended", "recovered", "not confirmed"]>;
+  readonly reason: Schema.Literals<readonly ["agent not found", "agent turned off", "agent changed", "handle taken", "session ended", "recovered"]>;
   readonly nextStep: Schema.String;
 }>]>>, Schema.toCodecJson<typeof AuthorityUnavailable | typeof AttachmentNotFound>, ApprovalSecret, never> | HttpApiEndpoint.HttpApiEndpoint<"collect", "POST", "/v1/attachments/requests/:approval/result", Schema.toCodecStringTree<Schema.Struct<{
   approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
@@ -2129,20 +2298,31 @@ declare const MachineAttachmentsGroup_base: HttpApiGroup.HttpApiGroup<"machineAt
 }>, Schema.Struct<{
   readonly state: Schema.Literal<"connected">;
   readonly owner: Schema.brand<Schema.String, "OwnerName">;
-  readonly agent: Schema.Struct<{
-    readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-    readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-  }>;
-  readonly handle: Schema.brand<Schema.String, "AgentHandle">;
-  readonly credential: Schema.Struct<{
-    readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-    readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
-  }>;
-  readonly organizations: Schema.$Array<Schema.Struct<{
-    readonly organization: Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">;
-    readonly name: Schema.brand<Schema.String, "OwnerName">;
-    readonly state: Schema.Literals<readonly ["pending", "authorized", "refused"]>;
+  readonly folders: Schema.$Array<Schema.Struct<{
+    readonly agent: Schema.Struct<{
+      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+    }>;
+    readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+    readonly credential: Schema.Struct<{
+      readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+    }>;
+    readonly agentCreated: Schema.Boolean;
+    readonly path: Schema.String;
+    readonly owner: Schema.brand<Schema.String, "OwnerName">;
+    readonly organizations: Schema.$Array<Schema.Struct<{
+      readonly organization: Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">;
+      readonly name: Schema.brand<Schema.String, "OwnerName">;
+      readonly state: Schema.Literals<readonly ["pending", "authorized", "refused"]>;
+    }>>;
+    readonly replacement: Schema.optionalKey<Schema.Struct<{
+      readonly grant: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+      readonly state: Schema.Literals<readonly ["replaces", "revoked", "skipped"]>;
+      readonly attachedAt: Schema.optionalKey<Schema.DateTimeUtcFromString>;
+    }>>;
   }>>;
+  readonly excluded: Schema.$Array<Schema.String>;
 }>, Schema.Struct<{
   readonly state: Schema.Literal<"refused">;
 }>, Schema.Struct<{
@@ -2151,11 +2331,12 @@ declare const MachineAttachmentsGroup_base: HttpApiGroup.HttpApiGroup<"machineAt
   readonly state: Schema.Literal<"expired">;
 }>, Schema.Struct<{
   readonly state: Schema.Literal<"failed">;
-  readonly reason: Schema.Literals<readonly ["agent not found", "agent turned off", "agent changed", "handle taken", "session ended", "recovered", "not confirmed"]>;
+  readonly reason: Schema.Literals<readonly ["agent not found", "agent turned off", "agent changed", "handle taken", "session ended", "recovered"]>;
   readonly nextStep: Schema.String;
 }>]>>, Schema.toCodecJson<typeof AuthorityUnavailable | typeof AttachmentNotFound>, ApprovalSecret, never> | HttpApiEndpoint.HttpApiEndpoint<"confirm", "POST", "/v1/attachments/requests/:approval/collected", Schema.toCodecStringTree<Schema.Struct<{
   approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
+  readonly grants: Schema.$Array<Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">>;
   readonly answerCode: Schema.optionalKey<Schema.String>;
 }>>, Schema.toCodecStringTree<Schema.Struct<{
   'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
@@ -2164,8 +2345,12 @@ declare const MachineAttachmentsGroup_base: HttpApiGroup.HttpApiGroup<"machineAt
 }>>, Schema.toCodecJson<typeof AuthorityUnavailable | typeof AttachmentNotFound>, ApprovalSecret, never> | HttpApiEndpoint.HttpApiEndpoint<"request", "POST", "/v1/attachments/requests", never, never, Schema.toCodecJson<Schema.Struct<{
   readonly machine: Schema.brand<Schema.TemplateLiteral<readonly ["machine_", Schema.String]>, "MachineId">;
   readonly machineName: Schema.String;
-  readonly harness: Schema.optionalKey<Schema.Literals<readonly ["claude-code", "codex"]>>;
-  readonly secretHash: Schema.brand<Schema.String, "SecretHash">;
+  readonly folders: Schema.$Array<Schema.Struct<{
+    readonly path: Schema.String;
+    readonly harness: Schema.Literals<readonly ["claude-code", "codex"]>;
+    readonly secretHash: Schema.brand<Schema.String, "SecretHash">;
+    readonly replaces: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">>;
+  }>>;
   readonly collectHash: Schema.brand<Schema.String, "SecretHash">;
   readonly linkHash: Schema.brand<Schema.String, "SecretHash">;
   readonly callback: Schema.optionalKey<Schema.Struct<{
@@ -2178,7 +2363,7 @@ declare const MachineAttachmentsGroup_base: HttpApiGroup.HttpApiGroup<"machineAt
   readonly approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
   readonly code: Schema.String;
   readonly expiresAt: Schema.DateTimeUtcFromString;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof CommandRefused | typeof SlowDown>, never, never>, false>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof CommandRefused | typeof SlowDown>, MachineNameRefusal, never>, false>;
 /**
  * Connecting a machine, the machine's side: asking, with no credential, to connect to one owner's
  * agent, whose terminal shows the code their person types; then collecting what came of it,
@@ -2425,10 +2610,18 @@ declare const ApprovalsGroup_base: HttpApiGroup.HttpApiGroup<"approvals", HttpAp
   readonly requests: Schema.$Array<Schema.Struct<{
     readonly approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
     readonly machineName: Schema.String;
-    readonly harness: Schema.optionalKey<Schema.Literals<readonly ["claude-code", "codex"]>>;
+    readonly folders: Schema.$Array<Schema.Struct<{
+      readonly path: Schema.String;
+      readonly harness: Schema.Literals<readonly ["claude-code", "codex"]>;
+      readonly replaces: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">>;
+    }>>;
     readonly askedFrom: Schema.optionalKey<Schema.String>;
     readonly askedAt: Schema.DateTimeUtcFromString;
     readonly expiresAt: Schema.DateTimeUtcFromString;
+    readonly callback: Schema.optionalKey<Schema.Struct<{
+      readonly port: Schema.Int;
+      readonly state: Schema.String;
+    }>>;
   }>>;
 }>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"find", "POST", "/v1/approvals/find", never, never, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
   readonly code: Schema.String;
@@ -2649,10 +2842,18 @@ declare const ApprovalsGroup_base: HttpApiGroup.HttpApiGroup<"approvals", HttpAp
 }>, Schema.Struct<{
   readonly approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
   readonly machineName: Schema.String;
-  readonly harness: Schema.optionalKey<Schema.Literals<readonly ["claude-code", "codex"]>>;
+  readonly folders: Schema.$Array<Schema.Struct<{
+    readonly path: Schema.String;
+    readonly harness: Schema.Literals<readonly ["claude-code", "codex"]>;
+    readonly replaces: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">>;
+  }>>;
   readonly askedFrom: Schema.optionalKey<Schema.String>;
   readonly askedAt: Schema.DateTimeUtcFromString;
   readonly expiresAt: Schema.DateTimeUtcFromString;
+  readonly callback: Schema.optionalKey<Schema.Struct<{
+    readonly port: Schema.Int;
+    readonly state: Schema.String;
+  }>>;
 }>]>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof ApprovalNotFound | typeof SlowDown>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"get", "GET", "/v1/approvals/:approval", Schema.toCodecStringTree<Schema.Struct<{
   approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
 }>>, never, never, never, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
@@ -2660,6 +2861,7 @@ declare const ApprovalsGroup_base: HttpApiGroup.HttpApiGroup<"approvals", HttpAp
   readonly expiresAt: Schema.DateTimeUtcFromString;
 }>, Schema.Struct<{
   readonly state: Schema.Literal<"approved">;
+  readonly collected: Schema.optionalKey<Schema.Literal<true>>;
 }>, Schema.Struct<{
   readonly state: Schema.Literal<"refused">;
 }>, Schema.Struct<{
@@ -2673,16 +2875,22 @@ declare const ApprovalsGroup_base: HttpApiGroup.HttpApiGroup<"approvals", HttpAp
   approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
   readonly code: Schema.optionalKey<Schema.String>;
-  readonly agent: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
-    readonly kind: Schema.Literal<"existing">;
-    readonly agent: Schema.Struct<{
-      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-    }>;
+  readonly folders: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+    readonly path: Schema.String;
+    readonly excluded: Schema.Literal<true>;
   }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"new">;
-    readonly handle: Schema.brand<Schema.String, "AgentHandle">;
-  }>]>>;
+    readonly path: Schema.String;
+    readonly agent: Schema.Union<readonly [Schema.Struct<{
+      readonly kind: Schema.Literal<"existing">;
+      readonly agent: Schema.Struct<{
+        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+      }>;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"new">;
+      readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+    }>]>;
+  }>]>>>;
 }>>, Schema.toCodecStringTree<Schema.Struct<{
   'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
 }>>, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
@@ -2696,14 +2904,22 @@ declare const ApprovalsGroup_base: HttpApiGroup.HttpApiGroup<"approvals", HttpAp
   }>>>;
   readonly userVerification: Schema.optionalKey<Schema.Literals<readonly ["discouraged", "preferred", "required"]>>;
   readonly hints: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["hybrid", "security-key", "client-device"]>>>;
-}>, Schema.Union<readonly [Schema.Struct<{
+}>, Schema.Struct<{
   readonly request: Schema.Struct<{
     readonly approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
     readonly machineName: Schema.String;
-    readonly harness: Schema.optionalKey<Schema.Literals<readonly ["claude-code", "codex"]>>;
+    readonly folders: Schema.$Array<Schema.Struct<{
+      readonly path: Schema.String;
+      readonly harness: Schema.Literals<readonly ["claude-code", "codex"]>;
+      readonly replaces: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">>;
+    }>>;
     readonly askedFrom: Schema.optionalKey<Schema.String>;
     readonly askedAt: Schema.DateTimeUtcFromString;
     readonly expiresAt: Schema.DateTimeUtcFromString;
+    readonly callback: Schema.optionalKey<Schema.Struct<{
+      readonly port: Schema.Int;
+      readonly state: Schema.String;
+    }>>;
   }>;
   readonly agents: Schema.$Array<Schema.Struct<{
     readonly agent: Schema.Struct<{
@@ -2712,26 +2928,28 @@ declare const ApprovalsGroup_base: HttpApiGroup.HttpApiGroup<"approvals", HttpAp
     }>;
     readonly handle: Schema.brand<Schema.String, "AgentHandle">;
   }>>;
-}>, Schema.Struct<{
-  readonly request: Schema.Struct<{
-    readonly approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
-    readonly machineName: Schema.String;
-    readonly harness: Schema.optionalKey<Schema.Literals<readonly ["claude-code", "codex"]>>;
-    readonly askedFrom: Schema.optionalKey<Schema.String>;
-    readonly askedAt: Schema.DateTimeUtcFromString;
-    readonly expiresAt: Schema.DateTimeUtcFromString;
-  }>;
-  readonly connect: Schema.Struct<{
-    readonly agent: Schema.optionalKey<Schema.Struct<{
-      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-    }>>;
-    readonly handle: Schema.brand<Schema.String, "AgentHandle">;
-    readonly organizations: Schema.$Array<Schema.Struct<{
-      readonly organization: Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">;
-      readonly name: Schema.brand<Schema.String, "OwnerName">;
-    }>>;
-  }>;
+  readonly folders: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+    readonly path: Schema.String;
+    readonly excluded: Schema.Literal<true>;
+  }>, Schema.Struct<{
+    readonly path: Schema.String;
+    readonly connect: Schema.Struct<{
+      readonly agent: Schema.optionalKey<Schema.Struct<{
+        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+      }>>;
+      readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+      readonly organizations: Schema.$Array<Schema.Struct<{
+        readonly organization: Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">;
+        readonly name: Schema.brand<Schema.String, "OwnerName">;
+      }>>;
+      readonly replacement: Schema.optionalKey<Schema.Struct<{
+        readonly grant: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+        readonly state: Schema.Literals<readonly ["replaces", "revoked", "skipped"]>;
+        readonly attachedAt: Schema.optionalKey<Schema.DateTimeUtcFromString>;
+      }>>;
+    }>;
+  }>]>>;
   readonly passkey: Schema.Struct<{
     readonly challenge: Schema.String;
     readonly timeout: Schema.optionalKey<Schema.Int>;
@@ -2744,7 +2962,7 @@ declare const ApprovalsGroup_base: HttpApiGroup.HttpApiGroup<"approvals", HttpAp
     readonly userVerification: Schema.optionalKey<Schema.Literals<readonly ["discouraged", "preferred", "required"]>>;
     readonly hints: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["hybrid", "security-key", "client-device"]>>>;
   }>;
-}>]>]>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof PasskeyRefused | typeof AttachmentFailed | typeof ApprovalNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"answer", "POST", "/v1/approvals/:approval/answer", Schema.toCodecStringTree<Schema.Struct<{
+}>]>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof PasskeyRefused | typeof AttachmentFailed | typeof ApprovalNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"answer", "POST", "/v1/approvals/:approval/answer", Schema.toCodecStringTree<Schema.Struct<{
   approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
 }>>, never, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
   readonly answer: Schema.Literal<"yes">;
@@ -2794,6 +3012,7 @@ declare const ApprovalsGroup_base: HttpApiGroup.HttpApiGroup<"approvals", HttpAp
   'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
 }>>, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
   readonly state: Schema.Literal<"approved">;
+  readonly collected: Schema.optionalKey<Schema.Literal<true>>;
   readonly answerCode: Schema.String;
 }>, Schema.Struct<{
   readonly status: Schema.Int;
@@ -2806,6 +3025,7 @@ declare const ApprovalsGroup_base: HttpApiGroup.HttpApiGroup<"approvals", HttpAp
   readonly expiresAt: Schema.DateTimeUtcFromString;
 }>, Schema.Struct<{
   readonly state: Schema.Literal<"approved">;
+  readonly collected: Schema.optionalKey<Schema.Literal<true>>;
 }>, Schema.Struct<{
   readonly state: Schema.Literal<"refused">;
 }>, Schema.Struct<{
@@ -2856,11 +3076,7 @@ declare const MeGroup_base: HttpApiGroup.HttpApiGroup<"me", HttpApiEndpoint.Http
     readonly action: Schema.Literals<readonly ["project:read", "project:write", "thread:start", "thread:write", "session:start", "session:change", "agent:attach", "approval:start", "git:read", "git:push", "approval:ask", "repo:add", "project:create", "thread:watch", "check:run"]>;
   }>>;
   readonly expiresAt: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
-}>>, never, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"renew", "POST", "/v1/me/renew", never, never, never, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Struct<{
-  readonly expiresAt: Schema.DateTimeUtcFromMillis;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"mirrors", "GET", "/v1/me/mirrors", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
+}>>, never, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"mirrors", "GET", "/v1/me/mirrors", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
   readonly mirrors: Schema.$Array<Schema.Struct<{
     readonly repo: Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">;
     readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
@@ -2891,6 +3107,10 @@ declare const MeGroup_base: HttpApiGroup.HttpApiGroup<"me", HttpApiEndpoint.Http
       readonly nextStep: Schema.optionalKey<Schema.String>;
     }>]>;
   }>>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"renew", "POST", "/v1/me/renew", never, never, never, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Struct<{
+  readonly expiresAt: Schema.DateTimeUtcFromMillis;
 }>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"usage", "GET", "/v1/me/usage", never, Schema.toCodecStringTree<Schema.Struct<{
   from: Schema.optionalKey<Schema.brand<Schema.String, "UtcDay">>;
   to: Schema.optionalKey<Schema.brand<Schema.String, "UtcDay">>;
@@ -13269,6 +13489,7 @@ declare const ReposGroup_base: HttpApiGroup.HttpApiGroup<"repos", HttpApiEndpoin
         readonly permission: Schema.brand<Schema.String, "RepoPermissionName">;
       }>]>;
       readonly state: Schema.Literals<readonly ["asked", "yes", "no", "expired", "refused", "revoked"]>;
+      readonly why: Schema.optionalKey<Schema.Literals<readonly ["target", "self"]>>;
       readonly asked: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">>;
       readonly by: Schema.optionalKey<Schema.brand<Schema.String, "OwnerName">>;
       readonly at: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
@@ -18570,12 +18791,10 @@ declare const AgentsGroup_base: HttpApiGroup.HttpApiGroup<"agents", HttpApiEndpo
   readonly handle: Schema.brand<Schema.String, "AgentHandle">;
   readonly generation: Schema.Int;
   readonly turnedOff: Schema.Boolean;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof HandleTaken | typeof DeliveryOutsideWindow | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"disable", "POST", "/v1/owners/:owner/agents/:agent/disable", Schema.toCodecStringTree<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof HandleTaken | typeof DeliveryOutsideWindow | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"get", "GET", "/v1/owners/:owner/agents/:agent", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   agent: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">, Schema.brand<Schema.String, "AgentHandle">]>;
-}>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Struct<{
+}>>, never, never, never, Schema.toCodecJson<Schema.Struct<{
   readonly agent: Schema.Struct<{
     readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
     readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
@@ -18583,7 +18802,8 @@ declare const AgentsGroup_base: HttpApiGroup.HttpApiGroup<"agents", HttpApiEndpo
   readonly handle: Schema.brand<Schema.String, "AgentHandle">;
   readonly generation: Schema.Int;
   readonly turnedOff: Schema.Boolean;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof DeliveryOutsideWindow | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"enable", "POST", "/v1/owners/:owner/agents/:agent/enable", Schema.toCodecStringTree<Schema.Struct<{
+  readonly addedAt: Schema.DateTimeUtcFromMillis;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"disable", "POST", "/v1/owners/:owner/agents/:agent/disable", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   agent: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">, Schema.brand<Schema.String, "AgentHandle">]>;
 }>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
@@ -18596,10 +18816,12 @@ declare const AgentsGroup_base: HttpApiGroup.HttpApiGroup<"agents", HttpApiEndpo
   readonly handle: Schema.brand<Schema.String, "AgentHandle">;
   readonly generation: Schema.Int;
   readonly turnedOff: Schema.Boolean;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof DeliveryOutsideWindow | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"get", "GET", "/v1/owners/:owner/agents/:agent", Schema.toCodecStringTree<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof DeliveryOutsideWindow | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"enable", "POST", "/v1/owners/:owner/agents/:agent/enable", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   agent: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">, Schema.brand<Schema.String, "AgentHandle">]>;
-}>>, never, never, never, Schema.toCodecJson<Schema.Struct<{
+}>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Struct<{
   readonly agent: Schema.Struct<{
     readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
     readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
@@ -18607,8 +18829,7 @@ declare const AgentsGroup_base: HttpApiGroup.HttpApiGroup<"agents", HttpApiEndpo
   readonly handle: Schema.brand<Schema.String, "AgentHandle">;
   readonly generation: Schema.Int;
   readonly turnedOff: Schema.Boolean;
-  readonly addedAt: Schema.DateTimeUtcFromMillis;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/owners/:owner/agents", Schema.toCodecStringTree<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof DeliveryOutsideWindow | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/owners/:owner/agents", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
 }>>, Schema.toCodecStringTree<Schema.Struct<{
   after: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">>;
@@ -27268,7 +27489,9 @@ type LiveTicket = typeof LiveTicket.Type;
  * Who a passkey request asks: the accountable person; a person, by their name; or anyone holding
  * one of the repo's permissions, the first of whom to answer decides. Until a permission's holders
  * are kept, they're its owner's admins. A workflow run's `passkey.run` asks its run's accountable
- * person; a gate's `passkey.check` asks the person behind the run that meets its need.
+ * person; a gate's `passkey.check` asks the person behind the run that meets its need. A person or
+ * a permission is someone else, a second pair of eyes, so the person `'accountable'` would ask
+ * never answers it: a request with nobody else to ask is refused.
  */
 declare const PasskeyFrom: Schema.Union<readonly [Schema.Literal<"accountable">, Schema.Struct<{
   readonly person: Schema.brand<Schema.String, "OwnerName">;
@@ -28783,6 +29006,8 @@ type WorkflowPasskeyAsk = typeof WorkflowPasskeyAsk.Type;
  * - `undeclared`: the workflow's `permissions.ask` doesn't name this kind of `from`, or the
  *   statement isn't one of its code's templates.
  * - `target`: no such person, or one who can't see where the workflow lives.
+ * - `self`: `from` names the run's accountable person, or a permission they alone hold. A yes from
+ *   someone else is a second pair of eyes only when it isn't theirs: `'accountable'` asks them.
  * - `budget`: the run has asked as much as its `asks` budget allows, or its workflow as many as a
  *   day allows.
  * - `length`: the statement is longer than one may be.
@@ -28793,7 +29018,7 @@ type WorkflowPasskeyAsk = typeof WorkflowPasskeyAsk.Type;
  * - `agent`: `from` names an agent, such as one that answered an ask, and an agent has no passkey.
  *   The SDK refuses it before asking ref0.
  */
-declare const PasskeyRefusal: Schema.Literals<readonly ["undeclared", "target", "budget", "length", "secret", "ended", "changed", "invalid", "agent"]>;
+declare const PasskeyRefusal: Schema.Literals<readonly ["undeclared", "target", "self", "budget", "length", "secret", "ended", "changed", "invalid", "agent"]>;
 type PasskeyRefusal = typeof PasskeyRefusal.Type;
 /** ref0's answer to a `passkey.run`'s ask: the request, or why not. A refusal is never thrown. */
 declare const WorkflowPasskeyAsked: Schema.Union<readonly [Schema.Struct<{
@@ -28801,7 +29026,7 @@ declare const WorkflowPasskeyAsked: Schema.Union<readonly [Schema.Struct<{
   readonly request: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
 }>, Schema.Struct<{
   readonly kind: Schema.Literal<"refused">;
-  readonly why: Schema.Literals<readonly ["undeclared", "target", "budget", "length", "secret", "ended", "changed", "invalid", "agent"]>;
+  readonly why: Schema.Literals<readonly ["undeclared", "target", "self", "budget", "length", "secret", "ended", "changed", "invalid", "agent"]>;
 }>]>;
 type WorkflowPasskeyAsked = typeof WorkflowPasskeyAsked.Type;
 /** A run's read of one of its requests. */
@@ -28981,5 +29206,5 @@ declare const SandboxExecAnswer: Schema.Union<readonly [Schema.Struct<{
 }>]>;
 type SandboxExecAnswer = typeof SandboxExecAnswer.Type;
 //#endregion
-export { OwnerThreadPage as $, WorkflowCallRefusal as $t, ConnectionName as A, WorkflowStartState as An, SignInDestination as At, GateOwn as B, isRef0Path as Bn, TrackThread as Bt, ConnectAgent as C, WorkflowPasskeyState as Cn, SandboxPushAnswer as Ct, ConnectionCallAnswer as D, WorkflowPullRequestOpen as Dn, SentryOrg as Dt, ConnectionCall as E, WorkflowPullRequestAnswer as En, SecretHash as Et, CredentialView as F, commandLine as Fn, StatementView as Ft, LiveTicketRequest as G, WorkflowActionAnswer as Gt, Harness as H, projectParts as Hn, VersionFile as Ht, EndpointName as I, connectEndpoint as In, ThreadId as It, MirrorChoice as J, WorkflowAskClosed as Jt, LiveTrackName as K, WorkflowAnswerer as Kt, EventRunInput as L, encodeSecret as Ln, ThreadStage as Lt, ConsentAsked as M, WorkflowThreadStart as Mn, SocketUrl as Mt, ConsentClient as N, WorkflowTrigger as Nn, StartActor as Nt, ConnectionChanged as O, WorkflowRequestRefusal as On, SentryRegion as Ot, ConsentProject as P, WrittenProject as Pn, StartRun as Pt, OwnerName as Q, WorkflowCallInput as Qt, ForkAnswer as R, hookTokenPrefix as Rn, TrackClosed as Rt, ClientGranted as S, WorkflowPasskeyRead as Sn, SandboxPush as St, ConnectableAgent as T, WorkflowPreview as Tn, ScopeAction as Tt, ImportFailure as U, repoNameKey as Un, Welcome as Ut, GetIssueInput as V, liveSocketUrl as Vn, TypedApprovalCode as Vt, LiveTicket as W, surfaceOf as Wn, WorkflowAction as Wt, MirrorView as X, WorkflowCallAnswer as Xt, MirrorEntry as Y, WorkflowCall as Yt, OwnerId as Z, WorkflowCallEnded as Zt, CheckOwn as _, WorkflowFilters as _n, RepoView as _t, Api as a, WorkflowCheckResults as an, PasskeyFrom as at, CheckTreeEntry as b, WorkflowPasskeyAsked as bn, SandboxOpen as bt, ApprovalId as c, WorkflowCheckRunEnded as cn, PreviewEcho as ct, ApprovalView as d, WorkflowCheckStates as dn, ProjectTrackMessage as dt, WorkflowCallRefused as en, OwnerThreadView as et, AttachmentFailed as f, WorkflowCheckStatesAnswer as fn, RanOf as ft, CheckOn as g, WorkflowEvent as gn, RepoUrl as gt, ChangeAuthor as h, WorkflowConnections as hn, RepoName as ht, AgentView as i, WorkflowCheckRefused as in, PasskeyCreationOptions as it, ConnectionView as j, WorkflowText as jn, SignedIn as jt, ConnectionKind as k, WorkflowStartEnded as kn, SentryToken as kt, ApprovalPreview as l, WorkflowCheckStart as ln, PreviewUnavailable as lt, Authorization as m, WorkflowComment as mn, Ref0Owned as mt, AgentPermissionChoice as n, WorkflowCalledStateAnswer as nn, PasskeyAsserted as nt, ApiOrigin as o, WorkflowCheckResultsAnswer as on, PasskeyRefusal as ot, AttachmentRequestView as p, WorkflowCheckWhere as pn, ReadEvent as pt, MachineConnected as q, WorkflowAsk as qt, AgentPermissionSetting as r, WorkflowCheckRefusal as rn, PasskeyCreated as rt, ApprovalAnswer as s, WorkflowCheckRun as sn, PasskeyRequestOptions as st, AgentHandle as t, WorkflowCalledState as tn, OwnerTrackMessage as tt, ApprovalState as u, WorkflowCheckStartAnswer as un, ProjectName as ut, CheckRunError as v, WorkflowOwn as vn, SandboxExec as vt, ConnectChosen as w, WorkflowPermissions as wn, SandboxSize as wt, ClientAccess as x, WorkflowPasskeyEnded as xn, SandboxOpenAnswer as xt, CheckRunParams as y, WorkflowPasskeyAsk as yn, SandboxExecAnswer as yt, ForkCreate as z, hookUrl as zn, TrackSession as zt };
-//# sourceMappingURL=index-CJGX88qF.d.mts.map
+export { MirrorEntry as $, WorkflowAskClosed as $t, ConnectionCallAnswer as A, WorkflowPreview as An, ScopeAction as At, EventRunInput as B, commandLine as Bn, StatementView as Bt, ConnectAgent as C, WorkflowOwn as Cn, SandboxExec as Ct, ConnectOptions as D, WorkflowPasskeyRead as Dn, SandboxPush as Dt, ConnectFolderOption as E, WorkflowPasskeyEnded as En, SandboxOpenAnswer as Et, ConsentAsked as F, WorkflowStartState as Fn, SignInDestination as Ft, GetIssueInput as G, isRef0Path as Gn, TrackThread as Gt, ForkAnswer as H, encodeSecret as Hn, ThreadStage as Ht, ConsentClient as I, WorkflowText as In, SignedIn as It, LiveTicket as J, repoNameKey as Jn, Welcome as Jt, Harness as K, liveSocketUrl as Kn, TypedApprovalCode as Kt, ConsentProject as L, WorkflowThreadStart as Ln, SocketUrl as Lt, ConnectionKind as M, WorkflowPullRequestOpen as Mn, SentryOrg as Mt, ConnectionName as N, WorkflowRequestRefusal as Nn, SentryRegion as Nt, ConnectableAgent as O, WorkflowPasskeyState as On, SandboxPushAnswer as Ot, ConnectionView as P, WorkflowStartEnded as Pn, SentryToken as Pt, MirrorChoice as Q, WorkflowAsk as Qt, CredentialView as R, WorkflowTrigger as Rn, StartActor as Rt, ClientGranted as S, WorkflowFilters as Sn, RequestFolder as St, ConnectFolderChoices as T, WorkflowPasskeyAsked as Tn, SandboxOpen as Tt, ForkCreate as U, hookTokenPrefix as Un, TrackClosed as Ut, FoldersConnected as V, connectEndpoint as Vn, ThreadId as Vt, GateOwn as W, hookUrl as Wn, TrackSession as Wt, LiveTrackName as X, WorkflowActionAnswer as Xt, LiveTicketRequest as Y, surfaceOf as Yn, WorkflowAction as Yt, MachineConnected as Z, WorkflowAnswerer as Zt, CheckOwn as _, WorkflowCheckStatesAnswer as _n, ReadEvent as _t, Api as a, WorkflowCallRefused as an, OwnerTrackMessage as at, CheckTreeEntry as b, WorkflowConnections as bn, RepoUrl as bt, ApprovalId as c, WorkflowCheckRefusal as cn, PasskeyCreationOptions as ct, ApprovalView as d, WorkflowCheckResultsAnswer as dn, PasskeyRequestOptions as dt, WorkflowCall as en, MirrorView as et, AttachmentFailed as f, WorkflowCheckRun as fn, PreviewEcho as ft, CheckOn as g, WorkflowCheckStates as gn, RanOf as gt, ChangeAuthor as h, WorkflowCheckStartAnswer as hn, ProjectTrackMessage as ht, AgentView as i, WorkflowCallRefusal as in, OwnerThreadView as it, ConnectionChanged as j, WorkflowPullRequestAnswer as jn, SecretHash as jt, ConnectionCall as k, WorkflowPermissions as kn, SandboxSize as kt, ApprovalPreview as l, WorkflowCheckRefused as ln, PasskeyFrom as lt, Authorization as m, WorkflowCheckStart as mn, ProjectName as mt, AgentPermissionChoice as n, WorkflowCallEnded as nn, OwnerName as nt, ApiOrigin as o, WorkflowCalledState as on, PasskeyAsserted as ot, AttachmentRequestView as p, WorkflowCheckRunEnded as pn, PreviewUnavailable as pt, ImportFailure as q, projectParts as qn, VersionFile as qt, AgentPermissionSetting as r, WorkflowCallInput as rn, OwnerThreadPage as rt, ApprovalAnswer as s, WorkflowCalledStateAnswer as sn, PasskeyCreated as st, AgentHandle as t, WorkflowCallAnswer as tn, OwnerId as tt, ApprovalState as u, WorkflowCheckResults as un, PasskeyRefusal as ut, CheckRunError as v, WorkflowCheckWhere as vn, Ref0Owned as vt, ConnectChosen as w, WorkflowPasskeyAsk as wn, SandboxExecAnswer as wt, ClientAccess as x, WorkflowEvent as xn, RepoView as xt, CheckRunParams as y, WorkflowComment as yn, RepoName as yt, EndpointName as z, WrittenProject as zn, StartRun as zt };
+//# sourceMappingURL=index-Bm4HWooV.d.mts.map