@ref0/sdk 0.9.0 → 0.11.0

package/dist/{index-Db86z11q.d.mts → index-Cc-mPnNF.d.mts}

@@ -992,6 +992,122 @@ declare const PreviewNotReady_base: Schema.Class<PreviewNotReady, Schema.TaggedS
 }>, import("effect/Cause").YieldableError>;
 /** ref0 couldn't check what the person saw just now. Nothing ran: answer again. */
 declare class PreviewNotReady extends PreviewNotReady_base {}
+/** A decision as `/v1` answers it: as it stands, and where it is, in words. */
+declare const NamedDecision: Schema.Struct<{
+  readonly decision: Schema.brand<Schema.TemplateLiteral<readonly ["decision_", Schema.String]>, "DecisionId">;
+  readonly kind: Schema.Literals<readonly ["ask", "gate"]>;
+  readonly subject: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"thread">;
+    readonly thread: Schema.brand<Schema.TemplateLiteral<readonly ["thread_", Schema.String]>, "ThreadId">;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"version">;
+    readonly thread: Schema.brand<Schema.TemplateLiteral<readonly ["thread_", Schema.String]>, "ThreadId">;
+    readonly repo: Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">;
+    readonly pullRequest: Schema.brand<Schema.Int, "PullRequestNumber">;
+    readonly version: Schema.brand<Schema.Int, "VersionNumber">;
+  }>]>;
+  readonly question: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["text_", Schema.String]>, "TextId">>;
+  readonly options: Schema.$Array<Schema.Struct<{
+    readonly key: Schema.brand<Schema.String, "AnswerKey">;
+    readonly label: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["text_", Schema.String]>, "TextId">>;
+    readonly detail: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["text_", Schema.String]>, "TextId">>;
+  }>>;
+  readonly lean: Schema.optionalKey<Schema.brand<Schema.String, "AnswerKey">>;
+  readonly deciders: Schema.$Array<Schema.Struct<{
+    readonly decider: Schema.Union<readonly [Schema.Struct<{
+      readonly kind: Schema.Literal<"person">;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"agent">;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"check">;
+      readonly name: Schema.brand<Schema.String, "CheckName">;
+      readonly source: Schema.optionalKey<Schema.Literal<"project">>;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"role">;
+      readonly role: Schema.Literal<"admin">;
+      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"permission">;
+      readonly repo: Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">;
+      readonly name: Schema.brand<Schema.String, "RepoPermissionName">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"override">;
+      readonly of: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"check">;
+        readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"not-run">;
+        readonly check: Schema.brand<Schema.String, "CheckName">;
+        readonly source: Schema.optionalKey<Schema.Literal<"project">>;
+      }>]>;
+      readonly by: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"person">;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"role">;
+        readonly role: Schema.Literal<"admin">;
+        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+      }>]>;
+    }>]>;
+    readonly required: Schema.Boolean;
+    readonly why: Schema.optionalKey<Schema.String>;
+  }>>;
+  readonly deadline: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
+  readonly state: Schema.Literals<readonly ["open", "closed"]>;
+  readonly answers: Schema.$Array<Schema.Struct<{
+    readonly decider: Schema.Union<readonly [Schema.Struct<{
+      readonly kind: Schema.Literal<"person">;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"agent">;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"check">;
+      readonly name: Schema.brand<Schema.String, "CheckName">;
+      readonly source: Schema.optionalKey<Schema.Literal<"project">>;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"role">;
+      readonly role: Schema.Literal<"admin">;
+      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"permission">;
+      readonly repo: Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">;
+      readonly name: Schema.brand<Schema.String, "RepoPermissionName">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"override">;
+      readonly of: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"check">;
+        readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"not-run">;
+        readonly check: Schema.brand<Schema.String, "CheckName">;
+        readonly source: Schema.optionalKey<Schema.Literal<"project">>;
+      }>]>;
+      readonly by: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"person">;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"role">;
+        readonly role: Schema.Literal<"admin">;
+        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+      }>]>;
+    }>]>;
+    readonly answer: Schema.brand<Schema.String, "AnswerKey">;
+    readonly reason: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["text_", Schema.String]>, "TextId">>;
+    readonly at: Schema.DateTimeUtcFromMillis;
+  }>>;
+  readonly result: Schema.optionalKey<Schema.brand<Schema.String, "AnswerKey">>;
+  readonly closedWhy: Schema.optionalKey<Schema.Literals<readonly ["decided", "expired", "withdrawn", "superseded"]>>;
+  readonly names: Schema.Struct<{
+    readonly thread: Schema.brand<Schema.String, "WrittenThread">;
+    readonly pullRequest: Schema.optionalKey<Schema.brand<Schema.String, "WrittenPullRequest">>;
+  }>;
+}>;
+type NamedDecision = typeof NamedDecision.Type;
 declare const PlanTextRefused_base: Schema.Class<PlanTextRefused, Schema.TaggedStruct<"PlanTextRefused", {
   /** Where it is in the plan, such as `outcomes[3]`. */
   readonly where: Schema.String;
@@ -1295,6 +1411,22 @@ declare const StaleSeq_base: Schema.Class<StaleSeq, Schema.TaggedStruct<"StaleSe
 }>, import("effect/Cause").YieldableError>;
 /** A list older than the one kept, or the same one again: it changes nothing. */
 declare class StaleSeq extends StaleSeq_base {}
+declare const IdentityAudienceRefused_base: Schema.Class<IdentityAudienceRefused, Schema.TaggedStruct<"IdentityAudienceRefused", {
+  readonly nextStep: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * The audience isn't one ref0 signs for: missing, given twice, or not an HTTPS origin as
+ * `IdentityAudience` says. The refused text is never echoed.
+ */
+declare class IdentityAudienceRefused extends IdentityAudienceRefused_base {}
+declare const IdentityTokenNotReady_base: Schema.Class<IdentityTokenNotReady, Schema.TaggedStruct<"IdentityTokenNotReady", {
+  readonly nextStep: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * Less than a whole second is left before the session, a parent or the credential expires, or
+ * the token would expire before it's recorded: the next prompt renews or replaces the session.
+ */
+declare class IdentityTokenNotReady extends IdentityTokenNotReady_base {}
 //#endregion
 //#region src/ids.d.ts
 /** A person. A person is an owner, so this is also their owner ID. */
@@ -1346,7 +1478,7 @@ declare const ApiOrigin: Schema.brand<Schema.String, "ApiOrigin">;
 type ApiOrigin = typeof ApiOrigin.Type;
 /**
  * Whether a path is Worker "server"'s to answer, not a page's: the API's, signing in's, a
- * connection's webhook, or OAuth's metadata.
+ * connection's webhook, OAuth's metadata, or identity tokens' published documents.
  */
 declare const isRef0Path: (pathname: string) => boolean;
 declare const NoFork_base: Schema.Class<NoFork, Schema.TaggedStruct<"NoFork", {
@@ -1995,7 +2127,9 @@ declare const Caller_base: Context.ServiceClass<Caller, "ref0/contracts/Caller",
  * from. Every endpoint needs a credential, except a terminal asking for an approval, which has
  * none to give; who's acting comes from it, never from the request.
  * Every request that changes something carries an `Idempotency-Key`, a delivery ID its client
- * made: a retry with the same key gets the first answer, for 24 hours.
+ * made: a retry with the same key gets the first answer, for 24 hours. Asking for an identity
+ * token is the one exception: each request makes a new token, and ref0 keeps none to answer a
+ * retry with, so a retry gets another token, as `identity-tokens.ts` says.
  */
 /** Who's acting on a request: what `Authorize` found its credential to be. */
 declare class Caller extends Caller_base {}
@@ -2078,6 +2212,19 @@ declare const MachineNameRefusal_base: HttpApiMiddleware.ServiceClass<MachineNam
  * what to change. Any other part that fails its contract is answered with Effect's empty 400.
  */
 declare class MachineNameRefusal extends MachineNameRefusal_base {}
+declare const IdentityAudienceRefusal_base: HttpApiMiddleware.ServiceClass<IdentityAudienceRefusal, "ref0/contracts/IdentityAudienceRefusal", {
+  requires: never;
+  provides: never;
+  error: typeof IdentityAudienceRefused;
+  clientError: never;
+  requiredForClient: false;
+  security: never;
+}, HttpApiMiddleware.HttpApiMiddleware<never, typeof IdentityAudienceRefused, never>>;
+/**
+ * An identity token's request whose audience its contract refuses, missing or not an HTTPS
+ * origin, answered as `IdentityAudienceRefused`, which never echoes what was sent.
+ */
+declare class IdentityAudienceRefusal extends IdentityAudienceRefusal_base {}
 declare const WelcomeGroup_base: HttpApiGroup.HttpApiGroup<"welcome", HttpApiEndpoint.HttpApiEndpoint<"get", "GET", "/v1/welcome", never, never, never, never, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
   readonly state: Schema.Literals<readonly ["ready", "setting up"]>;
   readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
@@ -2103,15 +2250,29 @@ declare const WelcomeGroup_base: HttpApiGroup.HttpApiGroup<"welcome", HttpApiEnd
 }>]>>, Schema.toCodecJson<typeof NameTaken | typeof NameReserved | typeof AuthorityUnavailable>, SignedIn, never>, false>;
 /** Where a signed-in person stands, and naming their owner when their GitHub login couldn't. */
 declare class WelcomeGroup extends WelcomeGroup_base {}
-declare const PasskeysGroup_base: HttpApiGroup.HttpApiGroup<"passkeys", HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/me/passkeys", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly passkeys: Schema.$Array<Schema.Struct<{
-    readonly passkey: Schema.brand<Schema.TemplateLiteral<readonly ["passkey_", Schema.String]>, "PasskeyId">;
-    readonly name: Schema.optionalKey<Schema.String>;
-    readonly createdAt: Schema.String;
-    readonly backedUp: Schema.Boolean;
-  }>>;
-  readonly approvesHere: Schema.Boolean;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"firstOptions", "POST", "/v1/me/passkeys/first/options", never, never, never, Schema.toCodecStringTree<Schema.Struct<{
+declare const PasskeysGroup_base: HttpApiGroup.HttpApiGroup<"passkeys", HttpApiEndpoint.HttpApiEndpoint<"enrolFirst", "POST", "/v1/me/passkeys/first", never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly id: Schema.String;
+  readonly rawId: Schema.String;
+  readonly type: Schema.Literal<"public-key">;
+  readonly response: Schema.Struct<{
+    readonly clientDataJSON: Schema.String;
+    readonly attestationObject: Schema.String;
+    readonly authenticatorData: Schema.optional<Schema.String>;
+    readonly transports: Schema.optional<Schema.$Array<Schema.Literals<readonly ["ble", "cable", "hybrid", "internal", "nfc", "smart-card", "usb"]>>>;
+    readonly publicKeyAlgorithm: Schema.optional<Schema.Int>;
+    readonly publicKey: Schema.optional<Schema.String>;
+  }>;
+  readonly authenticatorAttachment: Schema.optional<Schema.Literals<readonly ["platform", "cross-platform"]>>;
+  readonly clientExtensionResults: Schema.Struct<{
+    readonly credProps: Schema.optionalKey<Schema.Struct<{
+      readonly rk: Schema.optionalKey<Schema.Boolean>;
+    }>>;
+  }>;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Struct<{
+  readonly passkey: Schema.brand<Schema.TemplateLiteral<readonly ["passkey_", Schema.String]>, "PasskeyId">;
+}>>, Schema.toCodecJson<typeof AuthorityUnavailable | typeof PasskeyRefused>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"firstOptions", "POST", "/v1/me/passkeys/first/options", never, never, never, Schema.toCodecStringTree<Schema.Struct<{
   'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
 }>>, Schema.toCodecJson<Schema.Struct<{
   readonly rp: Schema.Struct<{
@@ -2142,29 +2303,15 @@ declare const PasskeysGroup_base: HttpApiGroup.HttpApiGroup<"passkeys", HttpApiE
   }>>;
   readonly hints: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["hybrid", "security-key", "client-device"]>>>;
   readonly attestation: Schema.optionalKey<Schema.Literals<readonly ["direct", "enterprise", "indirect", "none"]>>;
-}>>, Schema.toCodecJson<typeof AuthorityUnavailable | typeof PasskeyRefused>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"enrolFirst", "POST", "/v1/me/passkeys/first", never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly id: Schema.String;
-  readonly rawId: Schema.String;
-  readonly type: Schema.Literal<"public-key">;
-  readonly response: Schema.Struct<{
-    readonly clientDataJSON: Schema.String;
-    readonly attestationObject: Schema.String;
-    readonly authenticatorData: Schema.optional<Schema.String>;
-    readonly transports: Schema.optional<Schema.$Array<Schema.Literals<readonly ["ble", "cable", "hybrid", "internal", "nfc", "smart-card", "usb"]>>>;
-    readonly publicKeyAlgorithm: Schema.optional<Schema.Int>;
-    readonly publicKey: Schema.optional<Schema.String>;
-  }>;
-  readonly authenticatorAttachment: Schema.optional<Schema.Literals<readonly ["platform", "cross-platform"]>>;
-  readonly clientExtensionResults: Schema.Struct<{
-    readonly credProps: Schema.optionalKey<Schema.Struct<{
-      readonly rk: Schema.optionalKey<Schema.Boolean>;
-    }>>;
-  }>;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Struct<{
-  readonly passkey: Schema.brand<Schema.TemplateLiteral<readonly ["passkey_", Schema.String]>, "PasskeyId">;
-}>>, Schema.toCodecJson<typeof AuthorityUnavailable | typeof PasskeyRefused>, Authorization, never>, false>;
+}>>, Schema.toCodecJson<typeof AuthorityUnavailable | typeof PasskeyRefused>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/me/passkeys", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly passkeys: Schema.$Array<Schema.Struct<{
+    readonly passkey: Schema.brand<Schema.TemplateLiteral<readonly ["passkey_", Schema.String]>, "PasskeyId">;
+    readonly name: Schema.optionalKey<Schema.String>;
+    readonly createdAt: Schema.String;
+    readonly backedUp: Schema.Boolean;
+  }>>;
+  readonly approvesHere: Schema.Boolean;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable>, Authorization, never>, false>;
 /**
  * A person's passkeys: listing them, and enrolling the first, which signing in asks for straight
  * away and a browser session does on its own, once. Every passkey after is an approval.
@@ -2207,19 +2354,7 @@ declare const TerminalApprovalsGroup_base: HttpApiGroup.HttpApiGroup<"terminalAp
  * what it came to with the approval's secret. Its person answers on their own page, by its code.
  */
 declare class TerminalApprovalsGroup extends TerminalApprovalsGroup_base {}
-declare const AttachmentsGroup_base: HttpApiGroup.HttpApiGroup<"attachments", HttpApiEndpoint.HttpApiEndpoint<"revoke", "DELETE", "/v1/owners/:owner/agents/:agent/attachments/:attachment", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-  agent: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">, Schema.brand<Schema.String, "AgentHandle">]>;
-  attachment: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
-}>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Struct<{
-  readonly credential: Schema.Struct<{
-    readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-    readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
-  }>;
-  readonly childrenRevoked: Schema.Int;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof DeliveryOutsideWindow | typeof AttachmentNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/owners/:owner/agents/:agent/attachments", Schema.toCodecStringTree<Schema.Struct<{
+declare const AttachmentsGroup_base: HttpApiGroup.HttpApiGroup<"attachments", HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/owners/:owner/agents/:agent/attachments", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   agent: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">, Schema.brand<Schema.String, "AgentHandle">]>;
 }>>, Schema.toCodecStringTree<Schema.Struct<{
@@ -2236,7 +2371,19 @@ declare const AttachmentsGroup_base: HttpApiGroup.HttpApiGroup<"attachments", Ht
     readonly person: Schema.brand<Schema.String, "OwnerName">;
   }>>;
   readonly nextAfter: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof OrganizationNotFound>, Authorization, never>, false>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"revoke", "DELETE", "/v1/owners/:owner/agents/:agent/attachments/:attachment", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+  agent: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">, Schema.brand<Schema.String, "AgentHandle">]>;
+  attachment: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+}>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Struct<{
+  readonly credential: Schema.Struct<{
+    readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+    readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+  }>;
+  readonly childrenRevoked: Schema.Int;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof DeliveryOutsideWindow | typeof AttachmentNotFound>, Authorization, never>, false>;
 /**
  * An agent's live attachments, by approval: listed, every one to an admin and their own to anyone
  * else; and one of the caller's own disconnected, revoking its credential, which the Worker checks
@@ -2370,16 +2517,72 @@ declare const MachineAttachmentsGroup_base: HttpApiGroup.HttpApiGroup<"machineAt
  * confirming it saved the grant, or aborting, with its collecting secret.
  */
 declare class MachineAttachmentsGroup extends MachineAttachmentsGroup_base {}
-declare const ApprovalsGroup_base: HttpApiGroup.HttpApiGroup<"approvals", HttpApiEndpoint.HttpApiEndpoint<"get", "GET", "/v1/approvals/:approval", Schema.toCodecStringTree<Schema.Struct<{
+declare const ApprovalsGroup_base: HttpApiGroup.HttpApiGroup<"approvals", HttpApiEndpoint.HttpApiEndpoint<"answer", "POST", "/v1/approvals/:approval/answer", Schema.toCodecStringTree<Schema.Struct<{
   approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
-}>>, never, never, never, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
-  readonly state: Schema.Literal<"waiting">;
-  readonly expiresAt: Schema.DateTimeUtcFromString;
+}>>, never, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
+  readonly answer: Schema.Literal<"yes">;
+  readonly permission: Schema.optionalKey<Schema.Literal<"allow">>;
+  readonly assertion: Schema.Struct<{
+    readonly id: Schema.String;
+    readonly rawId: Schema.String;
+    readonly type: Schema.Literal<"public-key">;
+    readonly response: Schema.Struct<{
+      readonly clientDataJSON: Schema.String;
+      readonly authenticatorData: Schema.String;
+      readonly signature: Schema.String;
+      readonly userHandle: Schema.optional<Schema.String>;
+    }>;
+    readonly authenticatorAttachment: Schema.optional<Schema.Literals<readonly ["platform", "cross-platform"]>>;
+    readonly clientExtensionResults: Schema.Struct<{}>;
+  }>;
+  readonly code: Schema.optionalKey<Schema.String>;
+  readonly preview: Schema.optionalKey<Schema.Struct<{
+    readonly kind: Schema.Literals<readonly ["workflow", "attached workflow"]>;
+    readonly version: Schema.brand<Schema.String, "WorkflowVersion">;
+  }>>;
+  readonly statement: Schema.optionalKey<Schema.Struct<{
+    readonly hash: Schema.String;
+  }>>;
+}>, Schema.Struct<{
+  readonly answer: Schema.Literal<"no">;
+  readonly permission: Schema.Literal<"deny">;
+  readonly assertion: Schema.Struct<{
+    readonly id: Schema.String;
+    readonly rawId: Schema.String;
+    readonly type: Schema.Literal<"public-key">;
+    readonly response: Schema.Struct<{
+      readonly clientDataJSON: Schema.String;
+      readonly authenticatorData: Schema.String;
+      readonly signature: Schema.String;
+      readonly userHandle: Schema.optional<Schema.String>;
+    }>;
+    readonly authenticatorAttachment: Schema.optional<Schema.Literals<readonly ["platform", "cross-platform"]>>;
+    readonly clientExtensionResults: Schema.Struct<{}>;
+  }>;
+  readonly code: Schema.optionalKey<Schema.String>;
 }>, Schema.Struct<{
+  readonly answer: Schema.Literal<"no">;
+  readonly code: Schema.optionalKey<Schema.String>;
+}>]>>, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
   readonly state: Schema.Literal<"approved">;
   readonly collected: Schema.optionalKey<Schema.Literal<true>>;
+  readonly answerCode: Schema.String;
 }>, Schema.Struct<{
-  readonly state: Schema.Literal<"refused">;
+  readonly status: Schema.Int;
+  readonly result: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+  readonly state: Schema.Literal<"ran">;
+  readonly endpoint: Schema.String;
+  readonly answerCode: Schema.String;
+}>, Schema.Union<readonly [Schema.Struct<{
+  readonly state: Schema.Literal<"waiting">;
+  readonly expiresAt: Schema.DateTimeUtcFromString;
+}>, Schema.Struct<{
+  readonly state: Schema.Literal<"approved">;
+  readonly collected: Schema.optionalKey<Schema.Literal<true>>;
+}>, Schema.Struct<{
+  readonly state: Schema.Literal<"refused">;
 }>, Schema.Struct<{
   readonly state: Schema.Literal<"expired">;
 }>, Schema.Struct<{
@@ -2387,49 +2590,388 @@ declare const ApprovalsGroup_base: HttpApiGroup.HttpApiGroup<"approvals", HttpAp
   readonly result: Schema.Codec<Schema.Json, Schema.Json, never, never>;
   readonly state: Schema.Literal<"ran">;
   readonly endpoint: Schema.String;
-}>]>>, Schema.toCodecJson<typeof AuthorityUnavailable | typeof ApprovalNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"waiting", "GET", "/v1/approvals", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly approvals: Schema.$Array<Schema.Struct<{
-    readonly approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
-    readonly says: Schema.String;
-    readonly fields: Schema.$Array<Schema.Struct<{
-      readonly name: Schema.String;
-      readonly value: Schema.String;
-      readonly part: Schema.Literals<readonly ["path", "query", "payload"]>;
+}>]>]>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof ApprovalStale | typeof PreviewNotReady | typeof PasskeyRefused | typeof ApprovalNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"find", "POST", "/v1/approvals/find", never, never, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
+  readonly code: Schema.String;
+}>, Schema.Struct<{
+  readonly link: Schema.String;
+}>]>>, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
+  readonly approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
+  readonly says: Schema.String;
+  readonly fields: Schema.$Array<Schema.Struct<{
+    readonly name: Schema.String;
+    readonly value: Schema.String;
+    readonly part: Schema.Literals<readonly ["path", "query", "payload"]>;
+  }>>;
+  readonly command: Schema.Struct<{
+    readonly endpoint: Schema.String;
+    readonly params: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+    readonly query: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
+    readonly payload: Schema.optionalKey<Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+  }>;
+  readonly asker: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"terminal">;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"page">;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"agent">;
+    readonly agent: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+    readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+    readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["session_", Schema.String]>, "SessionId">;
+    readonly attachment: Schema.optionalKey<Schema.Struct<{
+      readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
     }>>;
-    readonly command: Schema.Struct<{
-      readonly endpoint: Schema.String;
-      readonly params: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
-      readonly query: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
-      readonly payload: Schema.optionalKey<Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-    }>;
-    readonly asker: Schema.Union<readonly [Schema.Struct<{
-      readonly kind: Schema.Literal<"terminal">;
+  }>]>;
+  readonly askedFrom: Schema.optionalKey<Schema.String>;
+  readonly askedAt: Schema.DateTimeUtcFromString;
+  readonly expiresAt: Schema.DateTimeUtcFromString;
+  readonly agentPermission: Schema.optionalKey<Schema.Struct<{
+    readonly action: Schema.Literals<readonly ["project:read", "project:write", "thread:start", "thread:write", "session:start", "session:change", "agent:attach", "approval:start", "git:read", "git:push", "approval:ask", "repo:add", "project:create", "thread:watch", "check:run"]>;
+    readonly mayAllow: Schema.Boolean;
+  }>>;
+  readonly preview: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"workflow">;
+    readonly repo: Schema.String;
+    readonly workflow: Schema.brand<Schema.String, "WorkflowName">;
+    readonly version: Schema.brand<Schema.String, "WorkflowVersion">;
+    readonly manifest: Schema.Union<readonly [Schema.Struct<{
+      readonly description: Schema.optionalKey<Schema.String>;
+      readonly calls: Schema.optionalKey<Schema.$Array<Schema.brand<Schema.String, "WorkflowName">>>;
+      readonly on: Schema.$Array<Schema.Literals<readonly ["pull_request.merged", "main.moved", "tip_run.failed", "queue.stopped", "check.finished", "thread.stage.moved", "thread.closed", "occurrence.repeated", "schedule", "signal.received"]>>;
+      readonly where: Schema.Struct<{
+        readonly 'pull_request.merged': Schema.optionalKey<Schema.Struct<{
+          readonly paths: Schema.optionalKey<Schema.$Array<Schema.String>>;
+        }>>;
+        readonly 'main.moved': Schema.optionalKey<Schema.Struct<{
+          readonly paths: Schema.optionalKey<Schema.$Array<Schema.String>>;
+        }>>;
+        readonly 'tip_run.failed': Schema.optionalKey<Schema.Struct<{
+          readonly outcome: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["failed", "failing on main", "main too big", "repair failed"]>>>;
+        }>>;
+        readonly 'queue.stopped': Schema.optionalKey<Schema.Struct<{
+          readonly why: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["nothing to search", "can't judge", "main too big"]>>>;
+        }>>;
+        readonly 'check.finished': Schema.optionalKey<Schema.Struct<{
+          readonly check: Schema.optionalKey<Schema.$Array<Schema.brand<Schema.String, "CheckKey">>>;
+          readonly conclusion: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["success", "failure", "neutral"]>>>;
+        }>>;
+        readonly 'thread.stage.moved': Schema.optionalKey<Schema.Struct<{
+          readonly to: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["planning", "active", "settled", "closed"]>>>;
+          readonly self: Schema.optionalKey<Schema.Boolean>;
+        }>>;
+        readonly 'signal.received': Schema.optionalKey<Schema.Struct<{
+          readonly connection: Schema.$Array<Schema.brand<Schema.String, "ConnectionName">>;
+          readonly kind: Schema.optionalKey<Schema.$Array<Schema.brand<Schema.String, "SignalKind">>>;
+          readonly key: Schema.optionalKey<Schema.$Array<Schema.brand<Schema.String, "SignalKey">>>;
+        }>>;
+        readonly schedule: Schema.optionalKey<Schema.Struct<{
+          readonly cron: Schema.String;
+          readonly timezone: Schema.String;
+        }>>;
+      }>;
+      readonly permissions: Schema.Struct<{
+        readonly comment: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["session", "thread", "own thread", "accountable"]>>>;
+        readonly ask: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["agent", "accountable", "person", "permission"]>>>;
+        readonly threads: Schema.optionalKey<Schema.Literal<"start">>;
+        readonly checks: Schema.optionalKey<Schema.Literal<"run">>;
+        readonly code: Schema.optionalKey<Schema.Literal<"write">>;
+        readonly needs: Schema.optionalKey<Schema.Literal<"add">>;
+        readonly connections: Schema.optionalKey<Schema.$Record<Schema.brand<Schema.String, "ConnectionName">, Schema.$Array<Schema.brand<Schema.String, "ConnectionMethod">>>>;
+        readonly egress: Schema.optionalKey<Schema.$Array<Schema.String>>;
+        readonly budgets: Schema.Struct<{
+          readonly requests: Schema.Int;
+          readonly asks: Schema.Int;
+          readonly threads: Schema.Int;
+          readonly calls: Schema.Int;
+          readonly forks: Schema.Int;
+          readonly pushes: Schema.Int;
+          readonly sandboxMinutes: Schema.Int;
+        }>;
+      }>;
     }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"page">;
+      readonly description: Schema.optionalKey<Schema.String>;
+      readonly calls: Schema.optionalKey<Schema.$Array<Schema.brand<Schema.String, "WorkflowName">>>;
+      readonly called: Schema.Literal<true>;
+      readonly permissions: Schema.Struct<{
+        readonly comment: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["session", "thread", "own thread", "accountable"]>>>;
+        readonly ask: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["agent", "accountable", "person", "permission"]>>>;
+        readonly threads: Schema.optionalKey<Schema.Literal<"start">>;
+        readonly checks: Schema.optionalKey<Schema.Literal<"run">>;
+        readonly code: Schema.optionalKey<Schema.Literal<"write">>;
+        readonly needs: Schema.optionalKey<Schema.Literal<"add">>;
+        readonly connections: Schema.optionalKey<Schema.$Record<Schema.brand<Schema.String, "ConnectionName">, Schema.$Array<Schema.brand<Schema.String, "ConnectionMethod">>>>;
+        readonly egress: Schema.optionalKey<Schema.$Array<Schema.String>>;
+        readonly budgets: Schema.Struct<{
+          readonly requests: Schema.Int;
+          readonly asks: Schema.Int;
+          readonly threads: Schema.Int;
+          readonly calls: Schema.Int;
+          readonly forks: Schema.Int;
+          readonly pushes: Schema.Int;
+          readonly sandboxMinutes: Schema.Int;
+        }>;
+      }>;
+    }>]>;
+    readonly state: Schema.Literals<readonly ["on", "off"]>;
+    readonly why: Schema.optionalKey<Schema.Literals<readonly ["asked", "failures", "refused", "too big", "approver gone", "imported", "not approved", "activation failed"]>>;
+    readonly accountable: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">>;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"attached workflow">;
+    readonly thread: Schema.String;
+    readonly workflow: Schema.brand<Schema.String, "WorkflowName">;
+    readonly version: Schema.brand<Schema.String, "WorkflowVersion">;
+    readonly manifest: Schema.Union<readonly [Schema.Struct<{
+      readonly description: Schema.optionalKey<Schema.String>;
+      readonly calls: Schema.optionalKey<Schema.$Array<Schema.brand<Schema.String, "WorkflowName">>>;
+      readonly on: Schema.$Array<Schema.Literals<readonly ["pull_request.merged", "main.moved", "tip_run.failed", "queue.stopped", "check.finished", "thread.stage.moved", "thread.closed", "occurrence.repeated", "schedule", "signal.received"]>>;
+      readonly where: Schema.Struct<{
+        readonly 'pull_request.merged': Schema.optionalKey<Schema.Struct<{
+          readonly paths: Schema.optionalKey<Schema.$Array<Schema.String>>;
+        }>>;
+        readonly 'main.moved': Schema.optionalKey<Schema.Struct<{
+          readonly paths: Schema.optionalKey<Schema.$Array<Schema.String>>;
+        }>>;
+        readonly 'tip_run.failed': Schema.optionalKey<Schema.Struct<{
+          readonly outcome: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["failed", "failing on main", "main too big", "repair failed"]>>>;
+        }>>;
+        readonly 'queue.stopped': Schema.optionalKey<Schema.Struct<{
+          readonly why: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["nothing to search", "can't judge", "main too big"]>>>;
+        }>>;
+        readonly 'check.finished': Schema.optionalKey<Schema.Struct<{
+          readonly check: Schema.optionalKey<Schema.$Array<Schema.brand<Schema.String, "CheckKey">>>;
+          readonly conclusion: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["success", "failure", "neutral"]>>>;
+        }>>;
+        readonly 'thread.stage.moved': Schema.optionalKey<Schema.Struct<{
+          readonly to: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["planning", "active", "settled", "closed"]>>>;
+          readonly self: Schema.optionalKey<Schema.Boolean>;
+        }>>;
+        readonly 'signal.received': Schema.optionalKey<Schema.Struct<{
+          readonly connection: Schema.$Array<Schema.brand<Schema.String, "ConnectionName">>;
+          readonly kind: Schema.optionalKey<Schema.$Array<Schema.brand<Schema.String, "SignalKind">>>;
+          readonly key: Schema.optionalKey<Schema.$Array<Schema.brand<Schema.String, "SignalKey">>>;
+        }>>;
+        readonly schedule: Schema.optionalKey<Schema.Struct<{
+          readonly cron: Schema.String;
+          readonly timezone: Schema.String;
+        }>>;
+      }>;
+      readonly permissions: Schema.Struct<{
+        readonly comment: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["session", "thread", "own thread", "accountable"]>>>;
+        readonly ask: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["agent", "accountable", "person", "permission"]>>>;
+        readonly threads: Schema.optionalKey<Schema.Literal<"start">>;
+        readonly checks: Schema.optionalKey<Schema.Literal<"run">>;
+        readonly code: Schema.optionalKey<Schema.Literal<"write">>;
+        readonly needs: Schema.optionalKey<Schema.Literal<"add">>;
+        readonly connections: Schema.optionalKey<Schema.$Record<Schema.brand<Schema.String, "ConnectionName">, Schema.$Array<Schema.brand<Schema.String, "ConnectionMethod">>>>;
+        readonly egress: Schema.optionalKey<Schema.$Array<Schema.String>>;
+        readonly budgets: Schema.Struct<{
+          readonly requests: Schema.Int;
+          readonly asks: Schema.Int;
+          readonly threads: Schema.Int;
+          readonly calls: Schema.Int;
+          readonly forks: Schema.Int;
+          readonly pushes: Schema.Int;
+          readonly sandboxMinutes: Schema.Int;
+        }>;
+      }>;
     }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"agent">;
-      readonly agent: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-      readonly handle: Schema.brand<Schema.String, "AgentHandle">;
-      readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["session_", Schema.String]>, "SessionId">;
-      readonly attachment: Schema.optionalKey<Schema.Struct<{
-        readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
-      }>>;
+      readonly description: Schema.optionalKey<Schema.String>;
+      readonly calls: Schema.optionalKey<Schema.$Array<Schema.brand<Schema.String, "WorkflowName">>>;
+      readonly called: Schema.Literal<true>;
+      readonly permissions: Schema.Struct<{
+        readonly comment: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["session", "thread", "own thread", "accountable"]>>>;
+        readonly ask: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["agent", "accountable", "person", "permission"]>>>;
+        readonly threads: Schema.optionalKey<Schema.Literal<"start">>;
+        readonly checks: Schema.optionalKey<Schema.Literal<"run">>;
+        readonly code: Schema.optionalKey<Schema.Literal<"write">>;
+        readonly needs: Schema.optionalKey<Schema.Literal<"add">>;
+        readonly connections: Schema.optionalKey<Schema.$Record<Schema.brand<Schema.String, "ConnectionName">, Schema.$Array<Schema.brand<Schema.String, "ConnectionMethod">>>>;
+        readonly egress: Schema.optionalKey<Schema.$Array<Schema.String>>;
+        readonly budgets: Schema.Struct<{
+          readonly requests: Schema.Int;
+          readonly asks: Schema.Int;
+          readonly threads: Schema.Int;
+          readonly calls: Schema.Int;
+          readonly forks: Schema.Int;
+          readonly pushes: Schema.Int;
+          readonly sandboxMinutes: Schema.Int;
+        }>;
+      }>;
     }>]>;
-    readonly askedFrom: Schema.optionalKey<Schema.String>;
-    readonly askedAt: Schema.DateTimeUtcFromString;
-    readonly expiresAt: Schema.DateTimeUtcFromString;
-    readonly agentPermission: Schema.optionalKey<Schema.Struct<{
-      readonly action: Schema.Literals<readonly ["project:read", "project:write", "thread:start", "thread:write", "session:start", "session:change", "agent:attach", "approval:start", "git:read", "git:push", "approval:ask", "repo:add", "project:create", "thread:watch", "check:run"]>;
-      readonly mayAllow: Schema.Boolean;
-    }>>;
-    readonly preview: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
-      readonly kind: Schema.Literal<"workflow">;
-      readonly repo: Schema.String;
-      readonly workflow: Schema.brand<Schema.String, "WorkflowName">;
-      readonly version: Schema.brand<Schema.String, "WorkflowVersion">;
-      readonly manifest: Schema.Union<readonly [Schema.Struct<{
-        readonly description: Schema.optionalKey<Schema.String>;
+    readonly agent: Schema.brand<Schema.String, "AgentHandle">;
+    readonly source: Schema.String;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"unavailable">;
+    readonly nextStep: Schema.String;
+  }>]>>;
+}>, Schema.Struct<{
+  readonly approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
+  readonly machineName: Schema.String;
+  readonly folders: Schema.$Array<Schema.Struct<{
+    readonly path: Schema.String;
+    readonly harness: Schema.Literals<readonly ["claude-code", "codex"]>;
+    readonly replaces: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">>;
+  }>>;
+  readonly askedFrom: Schema.optionalKey<Schema.String>;
+  readonly askedAt: Schema.DateTimeUtcFromString;
+  readonly expiresAt: Schema.DateTimeUtcFromString;
+  readonly callback: Schema.optionalKey<Schema.Struct<{
+    readonly port: Schema.Int;
+    readonly state: Schema.String;
+  }>>;
+}>]>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof ApprovalNotFound | typeof SlowDown>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"get", "GET", "/v1/approvals/:approval", Schema.toCodecStringTree<Schema.Struct<{
+  approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
+}>>, never, never, never, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
+  readonly state: Schema.Literal<"waiting">;
+  readonly expiresAt: Schema.DateTimeUtcFromString;
+}>, Schema.Struct<{
+  readonly state: Schema.Literal<"approved">;
+  readonly collected: Schema.optionalKey<Schema.Literal<true>>;
+}>, Schema.Struct<{
+  readonly state: Schema.Literal<"refused">;
+}>, Schema.Struct<{
+  readonly state: Schema.Literal<"expired">;
+}>, Schema.Struct<{
+  readonly status: Schema.Int;
+  readonly result: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+  readonly state: Schema.Literal<"ran">;
+  readonly endpoint: Schema.String;
+}>]>>, Schema.toCodecJson<typeof AuthorityUnavailable | typeof ApprovalNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"options", "POST", "/v1/approvals/:approval/options", Schema.toCodecStringTree<Schema.Struct<{
+  approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+  readonly code: Schema.optionalKey<Schema.String>;
+  readonly folders: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+    readonly path: Schema.String;
+    readonly excluded: Schema.Literal<true>;
+  }>, Schema.Struct<{
+    readonly path: Schema.String;
+    readonly agent: Schema.Union<readonly [Schema.Struct<{
+      readonly kind: Schema.Literal<"existing">;
+      readonly agent: Schema.Struct<{
+        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+      }>;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"new">;
+      readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+    }>]>;
+  }>]>>>;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
+  readonly challenge: Schema.String;
+  readonly timeout: Schema.optionalKey<Schema.Int>;
+  readonly rpId: Schema.optionalKey<Schema.String>;
+  readonly allowCredentials: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+    readonly id: Schema.String;
+    readonly type: Schema.Literal<"public-key">;
+    readonly transports: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["ble", "cable", "hybrid", "internal", "nfc", "smart-card", "usb"]>>>;
+  }>>>;
+  readonly userVerification: Schema.optionalKey<Schema.Literals<readonly ["discouraged", "preferred", "required"]>>;
+  readonly hints: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["hybrid", "security-key", "client-device"]>>>;
+}>, Schema.Struct<{
+  readonly request: Schema.Struct<{
+    readonly approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
+    readonly machineName: Schema.String;
+    readonly folders: Schema.$Array<Schema.Struct<{
+      readonly path: Schema.String;
+      readonly harness: Schema.Literals<readonly ["claude-code", "codex"]>;
+      readonly replaces: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">>;
+    }>>;
+    readonly askedFrom: Schema.optionalKey<Schema.String>;
+    readonly askedAt: Schema.DateTimeUtcFromString;
+    readonly expiresAt: Schema.DateTimeUtcFromString;
+    readonly callback: Schema.optionalKey<Schema.Struct<{
+      readonly port: Schema.Int;
+      readonly state: Schema.String;
+    }>>;
+  }>;
+  readonly agents: Schema.$Array<Schema.Struct<{
+    readonly agent: Schema.Struct<{
+      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+    }>;
+    readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+  }>>;
+  readonly folders: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+    readonly path: Schema.String;
+    readonly excluded: Schema.Literal<true>;
+  }>, Schema.Struct<{
+    readonly path: Schema.String;
+    readonly connect: Schema.Struct<{
+      readonly agent: Schema.optionalKey<Schema.Struct<{
+        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+      }>>;
+      readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+      readonly organizations: Schema.$Array<Schema.Struct<{
+        readonly organization: Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">;
+        readonly name: Schema.brand<Schema.String, "OwnerName">;
+      }>>;
+      readonly replacement: Schema.optionalKey<Schema.Struct<{
+        readonly grant: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+        readonly state: Schema.Literals<readonly ["replaces", "revoked", "skipped"]>;
+        readonly attachedAt: Schema.optionalKey<Schema.DateTimeUtcFromString>;
+      }>>;
+    }>;
+  }>]>>;
+  readonly passkey: Schema.Struct<{
+    readonly challenge: Schema.String;
+    readonly timeout: Schema.optionalKey<Schema.Int>;
+    readonly rpId: Schema.optionalKey<Schema.String>;
+    readonly allowCredentials: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+      readonly id: Schema.String;
+      readonly type: Schema.Literal<"public-key">;
+      readonly transports: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["ble", "cable", "hybrid", "internal", "nfc", "smart-card", "usb"]>>>;
+    }>>>;
+    readonly userVerification: Schema.optionalKey<Schema.Literals<readonly ["discouraged", "preferred", "required"]>>;
+    readonly hints: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["hybrid", "security-key", "client-device"]>>>;
+  }>;
+}>]>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof PasskeyRefused | typeof AttachmentFailed | typeof ApprovalNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"waiting", "GET", "/v1/approvals", never, never, never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly approvals: Schema.$Array<Schema.Struct<{
+    readonly approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
+    readonly says: Schema.String;
+    readonly fields: Schema.$Array<Schema.Struct<{
+      readonly name: Schema.String;
+      readonly value: Schema.String;
+      readonly part: Schema.Literals<readonly ["path", "query", "payload"]>;
+    }>>;
+    readonly command: Schema.Struct<{
+      readonly endpoint: Schema.String;
+      readonly params: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+      readonly query: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
+      readonly payload: Schema.optionalKey<Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+    }>;
+    readonly asker: Schema.Union<readonly [Schema.Struct<{
+      readonly kind: Schema.Literal<"terminal">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"page">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"agent">;
+      readonly agent: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+      readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+      readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["session_", Schema.String]>, "SessionId">;
+      readonly attachment: Schema.optionalKey<Schema.Struct<{
+        readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+      }>>;
+    }>]>;
+    readonly askedFrom: Schema.optionalKey<Schema.String>;
+    readonly askedAt: Schema.DateTimeUtcFromString;
+    readonly expiresAt: Schema.DateTimeUtcFromString;
+    readonly agentPermission: Schema.optionalKey<Schema.Struct<{
+      readonly action: Schema.Literals<readonly ["project:read", "project:write", "thread:start", "thread:write", "session:start", "session:change", "agent:attach", "approval:start", "git:read", "git:push", "approval:ask", "repo:add", "project:create", "thread:watch", "check:run"]>;
+      readonly mayAllow: Schema.Boolean;
+    }>>;
+    readonly preview: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
+      readonly kind: Schema.Literal<"workflow">;
+      readonly repo: Schema.String;
+      readonly workflow: Schema.brand<Schema.String, "WorkflowName">;
+      readonly version: Schema.brand<Schema.String, "WorkflowVersion">;
+      readonly manifest: Schema.Union<readonly [Schema.Struct<{
+        readonly description: Schema.optionalKey<Schema.String>;
         readonly calls: Schema.optionalKey<Schema.$Array<Schema.brand<Schema.String, "WorkflowName">>>;
         readonly on: Schema.$Array<Schema.Literals<readonly ["pull_request.merged", "main.moved", "tip_run.failed", "queue.stopped", "check.finished", "thread.stage.moved", "thread.closed", "occurrence.repeated", "schedule", "signal.received"]>>;
         readonly where: Schema.Struct<{
@@ -2640,402 +3182,121 @@ declare const ApprovalsGroup_base: HttpApiGroup.HttpApiGroup<"approvals", HttpAp
       readonly state: Schema.String;
     }>>;
   }>>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"options", "POST", "/v1/approvals/:approval/options", Schema.toCodecStringTree<Schema.Struct<{
-  approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-  readonly code: Schema.optionalKey<Schema.String>;
-  readonly folders: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
-    readonly path: Schema.String;
-    readonly excluded: Schema.Literal<true>;
-  }>, Schema.Struct<{
-    readonly path: Schema.String;
-    readonly agent: Schema.Union<readonly [Schema.Struct<{
-      readonly kind: Schema.Literal<"existing">;
-      readonly agent: Schema.Struct<{
-        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-      }>;
+  readonly decisions: Schema.$Array<Schema.Struct<{
+    readonly decision: Schema.brand<Schema.TemplateLiteral<readonly ["decision_", Schema.String]>, "DecisionId">;
+    readonly kind: Schema.Literals<readonly ["ask", "gate"]>;
+    readonly subject: Schema.Union<readonly [Schema.Struct<{
+      readonly kind: Schema.Literal<"thread">;
+      readonly thread: Schema.brand<Schema.TemplateLiteral<readonly ["thread_", Schema.String]>, "ThreadId">;
     }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"new">;
-      readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+      readonly kind: Schema.Literal<"version">;
+      readonly thread: Schema.brand<Schema.TemplateLiteral<readonly ["thread_", Schema.String]>, "ThreadId">;
+      readonly repo: Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">;
+      readonly pullRequest: Schema.brand<Schema.Int, "PullRequestNumber">;
+      readonly version: Schema.brand<Schema.Int, "VersionNumber">;
     }>]>;
-  }>]>>>;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
-  readonly challenge: Schema.String;
-  readonly timeout: Schema.optionalKey<Schema.Int>;
-  readonly rpId: Schema.optionalKey<Schema.String>;
-  readonly allowCredentials: Schema.optionalKey<Schema.$Array<Schema.Struct<{
-    readonly id: Schema.String;
-    readonly type: Schema.Literal<"public-key">;
-    readonly transports: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["ble", "cable", "hybrid", "internal", "nfc", "smart-card", "usb"]>>>;
-  }>>>;
-  readonly userVerification: Schema.optionalKey<Schema.Literals<readonly ["discouraged", "preferred", "required"]>>;
-  readonly hints: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["hybrid", "security-key", "client-device"]>>>;
-}>, Schema.Struct<{
-  readonly request: Schema.Struct<{
-    readonly approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
-    readonly machineName: Schema.String;
-    readonly folders: Schema.$Array<Schema.Struct<{
-      readonly path: Schema.String;
-      readonly harness: Schema.Literals<readonly ["claude-code", "codex"]>;
-      readonly replaces: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">>;
-    }>>;
-    readonly askedFrom: Schema.optionalKey<Schema.String>;
-    readonly askedAt: Schema.DateTimeUtcFromString;
-    readonly expiresAt: Schema.DateTimeUtcFromString;
-    readonly callback: Schema.optionalKey<Schema.Struct<{
-      readonly port: Schema.Int;
-      readonly state: Schema.String;
+    readonly question: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["text_", Schema.String]>, "TextId">>;
+    readonly options: Schema.$Array<Schema.Struct<{
+      readonly key: Schema.brand<Schema.String, "AnswerKey">;
+      readonly label: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["text_", Schema.String]>, "TextId">>;
+      readonly detail: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["text_", Schema.String]>, "TextId">>;
     }>>;
-  }>;
-  readonly agents: Schema.$Array<Schema.Struct<{
-    readonly agent: Schema.Struct<{
-      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-    }>;
-    readonly handle: Schema.brand<Schema.String, "AgentHandle">;
-  }>>;
-  readonly folders: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
-    readonly path: Schema.String;
-    readonly excluded: Schema.Literal<true>;
-  }>, Schema.Struct<{
-    readonly path: Schema.String;
-    readonly connect: Schema.Struct<{
-      readonly agent: Schema.optionalKey<Schema.Struct<{
-        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+    readonly lean: Schema.optionalKey<Schema.brand<Schema.String, "AnswerKey">>;
+    readonly deciders: Schema.$Array<Schema.Struct<{
+      readonly decider: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"person">;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"agent">;
         readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-      }>>;
-      readonly handle: Schema.brand<Schema.String, "AgentHandle">;
-      readonly organizations: Schema.$Array<Schema.Struct<{
-        readonly organization: Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">;
-        readonly name: Schema.brand<Schema.String, "OwnerName">;
-      }>>;
-      readonly replacement: Schema.optionalKey<Schema.Struct<{
-        readonly grant: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
-        readonly state: Schema.Literals<readonly ["replaces", "revoked", "skipped"]>;
-        readonly attachedAt: Schema.optionalKey<Schema.DateTimeUtcFromString>;
-      }>>;
-    }>;
-  }>]>>;
-  readonly passkey: Schema.Struct<{
-    readonly challenge: Schema.String;
-    readonly timeout: Schema.optionalKey<Schema.Int>;
-    readonly rpId: Schema.optionalKey<Schema.String>;
-    readonly allowCredentials: Schema.optionalKey<Schema.$Array<Schema.Struct<{
-      readonly id: Schema.String;
-      readonly type: Schema.Literal<"public-key">;
-      readonly transports: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["ble", "cable", "hybrid", "internal", "nfc", "smart-card", "usb"]>>>;
-    }>>>;
-    readonly userVerification: Schema.optionalKey<Schema.Literals<readonly ["discouraged", "preferred", "required"]>>;
-    readonly hints: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["hybrid", "security-key", "client-device"]>>>;
-  }>;
-}>]>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof PasskeyRefused | typeof AttachmentFailed | typeof ApprovalNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"find", "POST", "/v1/approvals/find", never, never, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
-  readonly code: Schema.String;
-}>, Schema.Struct<{
-  readonly link: Schema.String;
-}>]>>, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
-  readonly approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
-  readonly says: Schema.String;
-  readonly fields: Schema.$Array<Schema.Struct<{
-    readonly name: Schema.String;
-    readonly value: Schema.String;
-    readonly part: Schema.Literals<readonly ["path", "query", "payload"]>;
-  }>>;
-  readonly command: Schema.Struct<{
-    readonly endpoint: Schema.String;
-    readonly params: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
-    readonly query: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
-    readonly payload: Schema.optionalKey<Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-  }>;
-  readonly asker: Schema.Union<readonly [Schema.Struct<{
-    readonly kind: Schema.Literal<"terminal">;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"page">;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"agent">;
-    readonly agent: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-    readonly handle: Schema.brand<Schema.String, "AgentHandle">;
-    readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["session_", Schema.String]>, "SessionId">;
-    readonly attachment: Schema.optionalKey<Schema.Struct<{
-      readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"check">;
+        readonly name: Schema.brand<Schema.String, "CheckName">;
+        readonly source: Schema.optionalKey<Schema.Literal<"project">>;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"role">;
+        readonly role: Schema.Literal<"admin">;
+        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"permission">;
+        readonly repo: Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">;
+        readonly name: Schema.brand<Schema.String, "RepoPermissionName">;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"override">;
+        readonly of: Schema.Union<readonly [Schema.Struct<{
+          readonly kind: Schema.Literal<"check">;
+          readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+        }>, Schema.Struct<{
+          readonly kind: Schema.Literal<"not-run">;
+          readonly check: Schema.brand<Schema.String, "CheckName">;
+          readonly source: Schema.optionalKey<Schema.Literal<"project">>;
+        }>]>;
+        readonly by: Schema.Union<readonly [Schema.Struct<{
+          readonly kind: Schema.Literal<"person">;
+          readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+        }>, Schema.Struct<{
+          readonly kind: Schema.Literal<"role">;
+          readonly role: Schema.Literal<"admin">;
+          readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+        }>]>;
+      }>]>;
+      readonly required: Schema.Boolean;
+      readonly why: Schema.optionalKey<Schema.String>;
     }>>;
-  }>]>;
-  readonly askedFrom: Schema.optionalKey<Schema.String>;
-  readonly askedAt: Schema.DateTimeUtcFromString;
-  readonly expiresAt: Schema.DateTimeUtcFromString;
-  readonly agentPermission: Schema.optionalKey<Schema.Struct<{
-    readonly action: Schema.Literals<readonly ["project:read", "project:write", "thread:start", "thread:write", "session:start", "session:change", "agent:attach", "approval:start", "git:read", "git:push", "approval:ask", "repo:add", "project:create", "thread:watch", "check:run"]>;
-    readonly mayAllow: Schema.Boolean;
-  }>>;
-  readonly preview: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
-    readonly kind: Schema.Literal<"workflow">;
-    readonly repo: Schema.String;
-    readonly workflow: Schema.brand<Schema.String, "WorkflowName">;
-    readonly version: Schema.brand<Schema.String, "WorkflowVersion">;
-    readonly manifest: Schema.Union<readonly [Schema.Struct<{
-      readonly description: Schema.optionalKey<Schema.String>;
-      readonly calls: Schema.optionalKey<Schema.$Array<Schema.brand<Schema.String, "WorkflowName">>>;
-      readonly on: Schema.$Array<Schema.Literals<readonly ["pull_request.merged", "main.moved", "tip_run.failed", "queue.stopped", "check.finished", "thread.stage.moved", "thread.closed", "occurrence.repeated", "schedule", "signal.received"]>>;
-      readonly where: Schema.Struct<{
-        readonly 'pull_request.merged': Schema.optionalKey<Schema.Struct<{
-          readonly paths: Schema.optionalKey<Schema.$Array<Schema.String>>;
-        }>>;
-        readonly 'main.moved': Schema.optionalKey<Schema.Struct<{
-          readonly paths: Schema.optionalKey<Schema.$Array<Schema.String>>;
-        }>>;
-        readonly 'tip_run.failed': Schema.optionalKey<Schema.Struct<{
-          readonly outcome: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["failed", "failing on main", "main too big", "repair failed"]>>>;
-        }>>;
-        readonly 'queue.stopped': Schema.optionalKey<Schema.Struct<{
-          readonly why: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["nothing to search", "can't judge", "main too big"]>>>;
-        }>>;
-        readonly 'check.finished': Schema.optionalKey<Schema.Struct<{
-          readonly check: Schema.optionalKey<Schema.$Array<Schema.brand<Schema.String, "CheckKey">>>;
-          readonly conclusion: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["success", "failure", "neutral"]>>>;
-        }>>;
-        readonly 'thread.stage.moved': Schema.optionalKey<Schema.Struct<{
-          readonly to: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["planning", "active", "settled", "closed"]>>>;
-          readonly self: Schema.optionalKey<Schema.Boolean>;
-        }>>;
-        readonly 'signal.received': Schema.optionalKey<Schema.Struct<{
-          readonly connection: Schema.$Array<Schema.brand<Schema.String, "ConnectionName">>;
-          readonly kind: Schema.optionalKey<Schema.$Array<Schema.brand<Schema.String, "SignalKind">>>;
-          readonly key: Schema.optionalKey<Schema.$Array<Schema.brand<Schema.String, "SignalKey">>>;
-        }>>;
-        readonly schedule: Schema.optionalKey<Schema.Struct<{
-          readonly cron: Schema.String;
-          readonly timezone: Schema.String;
-        }>>;
-      }>;
-      readonly permissions: Schema.Struct<{
-        readonly comment: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["session", "thread", "own thread", "accountable"]>>>;
-        readonly ask: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["agent", "accountable", "person", "permission"]>>>;
-        readonly threads: Schema.optionalKey<Schema.Literal<"start">>;
-        readonly checks: Schema.optionalKey<Schema.Literal<"run">>;
-        readonly code: Schema.optionalKey<Schema.Literal<"write">>;
-        readonly needs: Schema.optionalKey<Schema.Literal<"add">>;
-        readonly connections: Schema.optionalKey<Schema.$Record<Schema.brand<Schema.String, "ConnectionName">, Schema.$Array<Schema.brand<Schema.String, "ConnectionMethod">>>>;
-        readonly egress: Schema.optionalKey<Schema.$Array<Schema.String>>;
-        readonly budgets: Schema.Struct<{
-          readonly requests: Schema.Int;
-          readonly asks: Schema.Int;
-          readonly threads: Schema.Int;
-          readonly calls: Schema.Int;
-          readonly forks: Schema.Int;
-          readonly pushes: Schema.Int;
-          readonly sandboxMinutes: Schema.Int;
-        }>;
-      }>;
-    }>, Schema.Struct<{
-      readonly description: Schema.optionalKey<Schema.String>;
-      readonly calls: Schema.optionalKey<Schema.$Array<Schema.brand<Schema.String, "WorkflowName">>>;
-      readonly called: Schema.Literal<true>;
-      readonly permissions: Schema.Struct<{
-        readonly comment: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["session", "thread", "own thread", "accountable"]>>>;
-        readonly ask: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["agent", "accountable", "person", "permission"]>>>;
-        readonly threads: Schema.optionalKey<Schema.Literal<"start">>;
-        readonly checks: Schema.optionalKey<Schema.Literal<"run">>;
-        readonly code: Schema.optionalKey<Schema.Literal<"write">>;
-        readonly needs: Schema.optionalKey<Schema.Literal<"add">>;
-        readonly connections: Schema.optionalKey<Schema.$Record<Schema.brand<Schema.String, "ConnectionName">, Schema.$Array<Schema.brand<Schema.String, "ConnectionMethod">>>>;
-        readonly egress: Schema.optionalKey<Schema.$Array<Schema.String>>;
-        readonly budgets: Schema.Struct<{
-          readonly requests: Schema.Int;
-          readonly asks: Schema.Int;
-          readonly threads: Schema.Int;
-          readonly calls: Schema.Int;
-          readonly forks: Schema.Int;
-          readonly pushes: Schema.Int;
-          readonly sandboxMinutes: Schema.Int;
-        }>;
-      }>;
-    }>]>;
-    readonly state: Schema.Literals<readonly ["on", "off"]>;
-    readonly why: Schema.optionalKey<Schema.Literals<readonly ["asked", "failures", "refused", "too big", "approver gone", "imported", "not approved", "activation failed"]>>;
-    readonly accountable: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">>;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"attached workflow">;
-    readonly thread: Schema.String;
-    readonly workflow: Schema.brand<Schema.String, "WorkflowName">;
-    readonly version: Schema.brand<Schema.String, "WorkflowVersion">;
-    readonly manifest: Schema.Union<readonly [Schema.Struct<{
-      readonly description: Schema.optionalKey<Schema.String>;
-      readonly calls: Schema.optionalKey<Schema.$Array<Schema.brand<Schema.String, "WorkflowName">>>;
-      readonly on: Schema.$Array<Schema.Literals<readonly ["pull_request.merged", "main.moved", "tip_run.failed", "queue.stopped", "check.finished", "thread.stage.moved", "thread.closed", "occurrence.repeated", "schedule", "signal.received"]>>;
-      readonly where: Schema.Struct<{
-        readonly 'pull_request.merged': Schema.optionalKey<Schema.Struct<{
-          readonly paths: Schema.optionalKey<Schema.$Array<Schema.String>>;
-        }>>;
-        readonly 'main.moved': Schema.optionalKey<Schema.Struct<{
-          readonly paths: Schema.optionalKey<Schema.$Array<Schema.String>>;
-        }>>;
-        readonly 'tip_run.failed': Schema.optionalKey<Schema.Struct<{
-          readonly outcome: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["failed", "failing on main", "main too big", "repair failed"]>>>;
-        }>>;
-        readonly 'queue.stopped': Schema.optionalKey<Schema.Struct<{
-          readonly why: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["nothing to search", "can't judge", "main too big"]>>>;
-        }>>;
-        readonly 'check.finished': Schema.optionalKey<Schema.Struct<{
-          readonly check: Schema.optionalKey<Schema.$Array<Schema.brand<Schema.String, "CheckKey">>>;
-          readonly conclusion: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["success", "failure", "neutral"]>>>;
-        }>>;
-        readonly 'thread.stage.moved': Schema.optionalKey<Schema.Struct<{
-          readonly to: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["planning", "active", "settled", "closed"]>>>;
-          readonly self: Schema.optionalKey<Schema.Boolean>;
-        }>>;
-        readonly 'signal.received': Schema.optionalKey<Schema.Struct<{
-          readonly connection: Schema.$Array<Schema.brand<Schema.String, "ConnectionName">>;
-          readonly kind: Schema.optionalKey<Schema.$Array<Schema.brand<Schema.String, "SignalKind">>>;
-          readonly key: Schema.optionalKey<Schema.$Array<Schema.brand<Schema.String, "SignalKey">>>;
-        }>>;
-        readonly schedule: Schema.optionalKey<Schema.Struct<{
-          readonly cron: Schema.String;
-          readonly timezone: Schema.String;
-        }>>;
-      }>;
-      readonly permissions: Schema.Struct<{
-        readonly comment: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["session", "thread", "own thread", "accountable"]>>>;
-        readonly ask: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["agent", "accountable", "person", "permission"]>>>;
-        readonly threads: Schema.optionalKey<Schema.Literal<"start">>;
-        readonly checks: Schema.optionalKey<Schema.Literal<"run">>;
-        readonly code: Schema.optionalKey<Schema.Literal<"write">>;
-        readonly needs: Schema.optionalKey<Schema.Literal<"add">>;
-        readonly connections: Schema.optionalKey<Schema.$Record<Schema.brand<Schema.String, "ConnectionName">, Schema.$Array<Schema.brand<Schema.String, "ConnectionMethod">>>>;
-        readonly egress: Schema.optionalKey<Schema.$Array<Schema.String>>;
-        readonly budgets: Schema.Struct<{
-          readonly requests: Schema.Int;
-          readonly asks: Schema.Int;
-          readonly threads: Schema.Int;
-          readonly calls: Schema.Int;
-          readonly forks: Schema.Int;
-          readonly pushes: Schema.Int;
-          readonly sandboxMinutes: Schema.Int;
-        }>;
-      }>;
-    }>, Schema.Struct<{
-      readonly description: Schema.optionalKey<Schema.String>;
-      readonly calls: Schema.optionalKey<Schema.$Array<Schema.brand<Schema.String, "WorkflowName">>>;
-      readonly called: Schema.Literal<true>;
-      readonly permissions: Schema.Struct<{
-        readonly comment: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["session", "thread", "own thread", "accountable"]>>>;
-        readonly ask: Schema.optionalKey<Schema.$Array<Schema.Literals<readonly ["agent", "accountable", "person", "permission"]>>>;
-        readonly threads: Schema.optionalKey<Schema.Literal<"start">>;
-        readonly checks: Schema.optionalKey<Schema.Literal<"run">>;
-        readonly code: Schema.optionalKey<Schema.Literal<"write">>;
-        readonly needs: Schema.optionalKey<Schema.Literal<"add">>;
-        readonly connections: Schema.optionalKey<Schema.$Record<Schema.brand<Schema.String, "ConnectionName">, Schema.$Array<Schema.brand<Schema.String, "ConnectionMethod">>>>;
-        readonly egress: Schema.optionalKey<Schema.$Array<Schema.String>>;
-        readonly budgets: Schema.Struct<{
-          readonly requests: Schema.Int;
-          readonly asks: Schema.Int;
-          readonly threads: Schema.Int;
-          readonly calls: Schema.Int;
-          readonly forks: Schema.Int;
-          readonly pushes: Schema.Int;
-          readonly sandboxMinutes: Schema.Int;
-        }>;
-      }>;
-    }>]>;
-    readonly agent: Schema.brand<Schema.String, "AgentHandle">;
-    readonly source: Schema.String;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"unavailable">;
-    readonly nextStep: Schema.String;
-  }>]>>;
-}>, Schema.Struct<{
-  readonly approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
-  readonly machineName: Schema.String;
-  readonly folders: Schema.$Array<Schema.Struct<{
-    readonly path: Schema.String;
-    readonly harness: Schema.Literals<readonly ["claude-code", "codex"]>;
-    readonly replaces: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">>;
-  }>>;
-  readonly askedFrom: Schema.optionalKey<Schema.String>;
-  readonly askedAt: Schema.DateTimeUtcFromString;
-  readonly expiresAt: Schema.DateTimeUtcFromString;
-  readonly callback: Schema.optionalKey<Schema.Struct<{
-    readonly port: Schema.Int;
-    readonly state: Schema.String;
-  }>>;
-}>]>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof ApprovalNotFound | typeof SlowDown>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"answer", "POST", "/v1/approvals/:approval/answer", Schema.toCodecStringTree<Schema.Struct<{
-  approval: Schema.brand<Schema.TemplateLiteral<readonly ["approval_", Schema.String]>, "ApprovalId">;
-}>>, never, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
-  readonly answer: Schema.Literal<"yes">;
-  readonly permission: Schema.optionalKey<Schema.Literal<"allow">>;
-  readonly assertion: Schema.Struct<{
-    readonly id: Schema.String;
-    readonly rawId: Schema.String;
-    readonly type: Schema.Literal<"public-key">;
-    readonly response: Schema.Struct<{
-      readonly clientDataJSON: Schema.String;
-      readonly authenticatorData: Schema.String;
-      readonly signature: Schema.String;
-      readonly userHandle: Schema.optional<Schema.String>;
-    }>;
-    readonly authenticatorAttachment: Schema.optional<Schema.Literals<readonly ["platform", "cross-platform"]>>;
-    readonly clientExtensionResults: Schema.Struct<{}>;
-  }>;
-  readonly code: Schema.optionalKey<Schema.String>;
-  readonly preview: Schema.optionalKey<Schema.Struct<{
-    readonly kind: Schema.Literals<readonly ["workflow", "attached workflow"]>;
-    readonly version: Schema.brand<Schema.String, "WorkflowVersion">;
-  }>>;
-  readonly statement: Schema.optionalKey<Schema.Struct<{
-    readonly hash: Schema.String;
-  }>>;
-}>, Schema.Struct<{
-  readonly answer: Schema.Literal<"no">;
-  readonly permission: Schema.Literal<"deny">;
-  readonly assertion: Schema.Struct<{
-    readonly id: Schema.String;
-    readonly rawId: Schema.String;
-    readonly type: Schema.Literal<"public-key">;
-    readonly response: Schema.Struct<{
-      readonly clientDataJSON: Schema.String;
-      readonly authenticatorData: Schema.String;
-      readonly signature: Schema.String;
-      readonly userHandle: Schema.optional<Schema.String>;
+    readonly deadline: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
+    readonly state: Schema.Literals<readonly ["open", "closed"]>;
+    readonly answers: Schema.$Array<Schema.Struct<{
+      readonly decider: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"person">;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"agent">;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"check">;
+        readonly name: Schema.brand<Schema.String, "CheckName">;
+        readonly source: Schema.optionalKey<Schema.Literal<"project">>;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"role">;
+        readonly role: Schema.Literal<"admin">;
+        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"permission">;
+        readonly repo: Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">;
+        readonly name: Schema.brand<Schema.String, "RepoPermissionName">;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"override">;
+        readonly of: Schema.Union<readonly [Schema.Struct<{
+          readonly kind: Schema.Literal<"check">;
+          readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+        }>, Schema.Struct<{
+          readonly kind: Schema.Literal<"not-run">;
+          readonly check: Schema.brand<Schema.String, "CheckName">;
+          readonly source: Schema.optionalKey<Schema.Literal<"project">>;
+        }>]>;
+        readonly by: Schema.Union<readonly [Schema.Struct<{
+          readonly kind: Schema.Literal<"person">;
+          readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+        }>, Schema.Struct<{
+          readonly kind: Schema.Literal<"role">;
+          readonly role: Schema.Literal<"admin">;
+          readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+        }>]>;
+      }>]>;
+      readonly answer: Schema.brand<Schema.String, "AnswerKey">;
+      readonly reason: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["text_", Schema.String]>, "TextId">>;
+      readonly at: Schema.DateTimeUtcFromMillis;
+    }>>;
+    readonly result: Schema.optionalKey<Schema.brand<Schema.String, "AnswerKey">>;
+    readonly closedWhy: Schema.optionalKey<Schema.Literals<readonly ["decided", "expired", "withdrawn", "superseded"]>>;
+    readonly names: Schema.Struct<{
+      readonly thread: Schema.brand<Schema.String, "WrittenThread">;
+      readonly pullRequest: Schema.optionalKey<Schema.brand<Schema.String, "WrittenPullRequest">>;
     }>;
-    readonly authenticatorAttachment: Schema.optional<Schema.Literals<readonly ["platform", "cross-platform"]>>;
-    readonly clientExtensionResults: Schema.Struct<{}>;
-  }>;
-  readonly code: Schema.optionalKey<Schema.String>;
-}>, Schema.Struct<{
-  readonly answer: Schema.Literal<"no">;
-  readonly code: Schema.optionalKey<Schema.String>;
-}>]>>, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
-  readonly state: Schema.Literal<"approved">;
-  readonly collected: Schema.optionalKey<Schema.Literal<true>>;
-  readonly answerCode: Schema.String;
-}>, Schema.Struct<{
-  readonly status: Schema.Int;
-  readonly result: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-  readonly state: Schema.Literal<"ran">;
-  readonly endpoint: Schema.String;
-  readonly answerCode: Schema.String;
-}>, Schema.Union<readonly [Schema.Struct<{
-  readonly state: Schema.Literal<"waiting">;
-  readonly expiresAt: Schema.DateTimeUtcFromString;
-}>, Schema.Struct<{
-  readonly state: Schema.Literal<"approved">;
-  readonly collected: Schema.optionalKey<Schema.Literal<true>>;
-}>, Schema.Struct<{
-  readonly state: Schema.Literal<"refused">;
-}>, Schema.Struct<{
-  readonly state: Schema.Literal<"expired">;
-}>, Schema.Struct<{
-  readonly status: Schema.Int;
-  readonly result: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-  readonly state: Schema.Literal<"ran">;
-  readonly endpoint: Schema.String;
-}>]>]>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof ApprovalStale | typeof PreviewNotReady | typeof PasskeyRefused | typeof ApprovalNotFound>, Authorization, never>, false>;
+  }>>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable>, Authorization, never>, false>;
 /**
  * A person's side of approvals, in an approving browser: what waits for them, finding a
  * terminal's request or a machine's attachment request by its code, and answering one, with
@@ -3076,7 +3337,12 @@ declare const MeGroup_base: HttpApiGroup.HttpApiGroup<"me", HttpApiEndpoint.Http
     readonly action: Schema.Literals<readonly ["project:read", "project:write", "thread:start", "thread:write", "session:start", "session:change", "agent:attach", "approval:start", "git:read", "git:push", "approval:ask", "repo:add", "project:create", "thread:watch", "check:run"]>;
   }>>;
   readonly expiresAt: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
-}>>, never, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"meters", "GET", "/v1/me/meters", never, Schema.toCodecStringTree<Schema.Struct<{
+}>>, never, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"identityToken", "POST", "/v1/me/identity-token", never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly audience: Schema.brand<Schema.String, "IdentityAudience">;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+  readonly token: Schema.brand<Schema.String, "IdentityToken">;
+  readonly expiresAt: Schema.DateTimeUtcFromMillis;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof SessionHasEnded | typeof SlowDown | typeof IdentityAudienceRefused | typeof IdentityTokenNotReady>, Authorization | IdentityAudienceRefusal, never> | HttpApiEndpoint.HttpApiEndpoint<"meters", "GET", "/v1/me/meters", never, Schema.toCodecStringTree<Schema.Struct<{
   from: Schema.optionalKey<Schema.brand<Schema.String, "UtcDay">>;
   to: Schema.optionalKey<Schema.brand<Schema.String, "UtcDay">>;
 }>>, never, never, Schema.toCodecJson<Schema.Struct<{
@@ -3148,6 +3414,10 @@ declare const MeGroup_base: HttpApiGroup.HttpApiGroup<"me", HttpApiEndpoint.Http
       readonly nextStep: Schema.optionalKey<Schema.String>;
     }>]>;
   }>>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"renew", "POST", "/v1/me/renew", never, never, never, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Struct<{
+  readonly expiresAt: Schema.DateTimeUtcFromMillis;
 }>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"usage", "GET", "/v1/me/usage", never, Schema.toCodecStringTree<Schema.Struct<{
   from: Schema.optionalKey<Schema.brand<Schema.String, "UtcDay">>;
   to: Schema.optionalKey<Schema.brand<Schema.String, "UtcDay">>;
@@ -3180,11 +3450,7 @@ declare const MeGroup_base: HttpApiGroup.HttpApiGroup<"me", HttpApiEndpoint.Http
     readonly harness: Schema.String;
   }>>;
   readonly pricesAsOf: Schema.String;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof UsageRangeRefused>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"renew", "POST", "/v1/me/renew", never, never, never, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Struct<{
-  readonly expiresAt: Schema.DateTimeUtcFromMillis;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable>, Authorization, never>, false>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof UsageRangeRefused>, Authorization, never>, false>;
 declare class MeGroup extends MeGroup_base {}
 declare const ThreadsGroup_base: HttpApiGroup.HttpApiGroup<"threads", HttpApiEndpoint.HttpApiEndpoint<"ask", "POST", "/v1/projects/:owner/:project/threads/:number/asks", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
@@ -6634,6 +6900,60 @@ declare const EventsGroup_base: HttpApiGroup.HttpApiGroup<"events", HttpApiEndpo
     }>;
   } & {
     readonly seq: Schema.Int;
+  }>, Schema.Struct<{
+    readonly log: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">, Schema.brand<Schema.TemplateLiteral<readonly ["project_", Schema.String]>, "ProjectId">]>;
+    readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["event_", Schema.String]>, "EventId">;
+    readonly writer: Schema.Union<readonly [Schema.Literal<"directory">, Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">, Schema.brand<Schema.TemplateLiteral<readonly ["project_", Schema.String]>, "ProjectId">, Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">, Schema.brand<Schema.TemplateLiteral<readonly ["usage:", Schema.String]>, "UsageLogId">]>;
+    readonly writerSeq: Schema.Int;
+    readonly at: Schema.DateTimeUtcFromMillis;
+    readonly schemaVersion: Schema.Literal<1>;
+    readonly actor: Schema.Union<readonly [Schema.Struct<{
+      readonly kind: Schema.Literal<"person">;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"agent">;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"ref0">;
+      readonly id: Schema.Literals<("ref0:attachments" | "ref0:barrier" | "ref0:blockers" | "ref0:checks" | "ref0:gate" | "ref0:hooks" | "ref0:importer" | "ref0:invitations" | "ref0:listings" | "ref0:mirror" | "ref0:needs" | "ref0:oauth" | "ref0:owners" | "ref0:plans" | "ref0:prepare" | "ref0:project-gate" | "ref0:pushes" | "ref0:queue" | "ref0:rebuilder" | "ref0:sessions" | "ref0:sign-in" | "ref0:stages" | "ref0:sweeper" | "ref0:usage" | "ref0:warm-up" | "ref0:workflows")[]>;
+    }>]>;
+    readonly token: Schema.optionalKey<Schema.Struct<{
+      readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+    }>>;
+    readonly draftedBy: Schema.optionalKey<Schema.Struct<{
+      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+    }>>;
+    readonly cause: Schema.optionalKey<Schema.Struct<{
+      readonly log: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">, Schema.brand<Schema.TemplateLiteral<readonly ["project_", Schema.String]>, "ProjectId">, Schema.brand<Schema.TemplateLiteral<readonly ["usage:", Schema.String]>, "UsageLogId">]>;
+      readonly event: Schema.brand<Schema.TemplateLiteral<readonly ["event_", Schema.String]>, "EventId">;
+    }>>;
+    readonly thread: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["thread_", Schema.String]>, "ThreadId">>;
+    readonly refs: Schema.$Array<Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["thread_", Schema.String]>, "ThreadId">, Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">]>>;
+    readonly source: Schema.optionalKey<Schema.Struct<{
+      readonly system: Schema.String;
+      readonly deliveryId: Schema.String;
+    }>>;
+    readonly trace: Schema.optionalKey<Schema.String>;
+    readonly kind: Schema.Literal<"identity_token.issued">;
+    readonly data: Schema.Struct<{
+      readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["session_", Schema.String]>, "SessionId">;
+      readonly agent: Schema.Struct<{
+        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+      }>;
+      readonly accountable: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+      readonly jti: Schema.brand<Schema.String, "IdentityTokenId">;
+      readonly audience: Schema.brand<Schema.String, "IdentityAudience">;
+      readonly issuer: Schema.brand<Schema.String, "ApiOrigin">;
+      readonly keyId: Schema.brand<Schema.String, "SigningKeyId">;
+      readonly issuedAt: Schema.DateTimeUtcFromMillis;
+      readonly expiresAt: Schema.DateTimeUtcFromMillis;
+    }>;
+  } & {
+    readonly seq: Schema.Int;
   }>, Schema.Struct<{
     readonly log: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">, Schema.brand<Schema.TemplateLiteral<readonly ["project_", Schema.String]>, "ProjectId">]>;
     readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["event_", Schema.String]>, "EventId">;
@@ -12680,7 +13000,66 @@ declare const OwnerThreadsGroup_base: HttpApiGroup.HttpApiGroup<"ownerThreads",
  * the stage as filters. A project the reader can't see answers as one that isn't there.
  */
 declare class OwnerThreadsGroup extends OwnerThreadsGroup_base {}
-declare const ReposGroup_base: HttpApiGroup.HttpApiGroup<"repos", HttpApiEndpoint.HttpApiEndpoint<"gate", "GET", "/v1/repos/:owner/:repo/pulls/:pullRequest/gate", Schema.toCodecStringTree<Schema.Struct<{
+declare const ReposGroup_base: HttpApiGroup.HttpApiGroup<"repos", HttpApiEndpoint.HttpApiEndpoint<"addNeed", "POST", "/v1/repos/:owner/:repo/pulls/:pullRequest/needs", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+  repo: Schema.brand<Schema.String, "RepoName">;
+  pullRequest: Schema.brand<Schema.Int, "PullRequestNumber">;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+  readonly need: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"checks">;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"check">;
+    readonly name: Schema.brand<Schema.String, "CheckName">;
+    readonly params: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
+    readonly source: Schema.optionalKey<Schema.Literal<"project">>;
+    readonly local: Schema.optionalKey<Schema.Literal<true>>;
+    readonly passkey: Schema.optionalKey<Schema.Struct<{
+      readonly from: Schema.Union<readonly [Schema.Literal<"accountable">, Schema.Struct<{
+        readonly person: Schema.brand<Schema.String, "OwnerName">;
+      }>, Schema.Struct<{
+        readonly permission: Schema.brand<Schema.String, "RepoPermissionName">;
+      }>]>;
+    }>>;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"review">;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"accountable">;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"admin">;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"permission">;
+    readonly name: Schema.brand<Schema.String, "RepoPermissionName">;
+  }>]>;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Struct<{
+  readonly pullRequest: Schema.optionalKey<Schema.brand<Schema.Int, "PullRequestNumber">>;
+  readonly outcome: Schema.Literals<readonly ["added", "removed", "unchanged"]>;
+  readonly version: Schema.optionalKey<Schema.brand<Schema.Int, "VersionNumber">>;
+  readonly source: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["needsource_", Schema.String]>, "NeedSourceId">>;
+  readonly removed: Schema.optionalKey<Schema.$Array<Schema.brand<Schema.TemplateLiteral<readonly ["needsource_", Schema.String]>, "NeedSourceId">>>;
+}>>, Schema.toCodecJson<typeof ProjectNotFound | typeof NotPermitted | typeof PullRequestNotFound | typeof ProjectNotReady | typeof RepoNotFound | typeof NeedRefused>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"create", "POST", "/v1/owners/:owner/repos", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+  readonly name: Schema.brand<Schema.String, "RepoName">;
+  readonly project: Schema.optionalKey<Schema.brand<Schema.String, "ProjectName">>;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Struct<{
+  readonly repo: Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">;
+  readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+  readonly project: Schema.brand<Schema.TemplateLiteral<readonly ["project_", Schema.String]>, "ProjectId">;
+  readonly scope: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"project">;
+    readonly name: Schema.brand<Schema.String, "ProjectName">;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"owner">;
+  }>]>;
+  readonly name: Schema.brand<Schema.String, "RepoName">;
+  readonly visibility: Schema.Literals<readonly ["private", "internal", "public"]>;
+  readonly state: Schema.Literals<readonly ["creating", "importing", "ready", "failed"]>;
+  readonly createdAt: Schema.DateTimeUtcFromMillis;
+}>>, Schema.toCodecJson<typeof NameTaken | typeof NameReserved | typeof ProjectNotFound | typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof CommandRefused | typeof ApprovalNeeded | typeof SlowDown>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"gate", "GET", "/v1/repos/:owner/:repo/pulls/:pullRequest/gate", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   repo: Schema.brand<Schema.String, "RepoName">;
   pullRequest: Schema.brand<Schema.Int, "PullRequestNumber">;
@@ -12702,33 +13081,171 @@ declare const ReposGroup_base: HttpApiGroup.HttpApiGroup<"repos", HttpApiEndpoin
         readonly from: Schema.Union<readonly [Schema.Literal<"accountable">, Schema.Struct<{
           readonly person: Schema.brand<Schema.String, "OwnerName">;
         }>, Schema.Struct<{
-          readonly permission: Schema.brand<Schema.String, "RepoPermissionName">;
+          readonly permission: Schema.brand<Schema.String, "RepoPermissionName">;
+        }>]>;
+      }>>;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"review">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"accountable">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"admin">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"permission">;
+      readonly name: Schema.brand<Schema.String, "RepoPermissionName">;
+    }>]>;
+    readonly from: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+      readonly kind: Schema.Literal<"gate">;
+      readonly line: Schema.optionalKey<Schema.Int>;
+      readonly code: Schema.optionalKey<Schema.String>;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"floor">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"project gate">;
+      readonly line: Schema.optionalKey<Schema.Int>;
+      readonly code: Schema.optionalKey<Schema.String>;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"added">;
+      readonly source: Schema.brand<Schema.TemplateLiteral<readonly ["needsource_", Schema.String]>, "NeedSourceId">;
+      readonly by: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"person">;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"agent">;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"ref0">;
+        readonly id: Schema.Literals<("ref0:attachments" | "ref0:barrier" | "ref0:blockers" | "ref0:checks" | "ref0:gate" | "ref0:hooks" | "ref0:importer" | "ref0:invitations" | "ref0:listings" | "ref0:mirror" | "ref0:needs" | "ref0:oauth" | "ref0:owners" | "ref0:plans" | "ref0:prepare" | "ref0:project-gate" | "ref0:pushes" | "ref0:queue" | "ref0:rebuilder" | "ref0:sessions" | "ref0:sign-in" | "ref0:stages" | "ref0:sweeper" | "ref0:usage" | "ref0:warm-up" | "ref0:workflows")[]>;
+      }>]>;
+      readonly through: Schema.Literals<readonly ["thread", "person", "finding", "workflow"]>;
+      readonly at: Schema.Int;
+      readonly finding: Schema.optionalKey<Schema.Struct<{
+        readonly review: Schema.brand<Schema.TemplateLiteral<readonly ["review_", Schema.String]>, "ReviewId">;
+        readonly finding: Schema.Int;
+      }>>;
+      readonly run: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["workflowrun_", Schema.String]>, "WorkflowRunId">>;
+      readonly accountable: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">>;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"result">;
+      readonly check: Schema.brand<Schema.String, "CheckName">;
+      readonly source: Schema.optionalKey<Schema.Literal<"project">>;
+      readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+      readonly local: Schema.optionalKey<Schema.Literal<true>>;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"tip">;
+      readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["tiprun_", Schema.String]>, "TipRunId">;
+      readonly source: Schema.brand<Schema.TemplateLiteral<readonly ["needsource_", Schema.String]>, "NeedSourceId">;
+      readonly check: Schema.optionalKey<Schema.brand<Schema.String, "CheckName">>;
+      readonly checkRun: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
+    }>]>>;
+    readonly standing: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
+      readonly state: Schema.Literal<"met">;
+      readonly by: Schema.$Array<Schema.Struct<{
+        readonly decider: Schema.Union<readonly [Schema.Struct<{
+          readonly kind: Schema.Literal<"person">;
+          readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+        }>, Schema.Struct<{
+          readonly kind: Schema.Literal<"agent">;
+          readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+          readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+        }>, Schema.Struct<{
+          readonly kind: Schema.Literal<"check">;
+          readonly name: Schema.brand<Schema.String, "CheckName">;
+          readonly source: Schema.optionalKey<Schema.Literal<"project">>;
+        }>, Schema.Struct<{
+          readonly kind: Schema.Literal<"role">;
+          readonly role: Schema.Literal<"admin">;
+          readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+        }>, Schema.Struct<{
+          readonly kind: Schema.Literal<"permission">;
+          readonly repo: Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">;
+          readonly name: Schema.brand<Schema.String, "RepoPermissionName">;
+        }>, Schema.Struct<{
+          readonly kind: Schema.Literal<"override">;
+          readonly of: Schema.Union<readonly [Schema.Struct<{
+            readonly kind: Schema.Literal<"check">;
+            readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+          }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"not-run">;
+            readonly check: Schema.brand<Schema.String, "CheckName">;
+            readonly source: Schema.optionalKey<Schema.Literal<"project">>;
+          }>]>;
+          readonly by: Schema.Union<readonly [Schema.Struct<{
+            readonly kind: Schema.Literal<"person">;
+            readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+          }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"role">;
+            readonly role: Schema.Literal<"admin">;
+            readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+          }>]>;
+        }>]>;
+        readonly by: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">>;
+        readonly overridden: Schema.optionalKey<Schema.Literal<true>>;
+      }>>;
+    }>, Schema.Struct<{
+      readonly state: Schema.Literal<"met">;
+      readonly as: Schema.Literals<readonly ["no checks", "on the tip"]>;
+    }>, Schema.Struct<{
+      readonly state: Schema.Literal<"waiting">;
+      readonly on: Schema.$Array<Schema.Struct<{
+        readonly decider: Schema.Union<readonly [Schema.Struct<{
+          readonly kind: Schema.Literal<"person">;
+          readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+        }>, Schema.Struct<{
+          readonly kind: Schema.Literal<"agent">;
+          readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+          readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+        }>, Schema.Struct<{
+          readonly kind: Schema.Literal<"check">;
+          readonly name: Schema.brand<Schema.String, "CheckName">;
+          readonly source: Schema.optionalKey<Schema.Literal<"project">>;
+        }>, Schema.Struct<{
+          readonly kind: Schema.Literal<"role">;
+          readonly role: Schema.Literal<"admin">;
+          readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+        }>, Schema.Struct<{
+          readonly kind: Schema.Literal<"permission">;
+          readonly repo: Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">;
+          readonly name: Schema.brand<Schema.String, "RepoPermissionName">;
+        }>, Schema.Struct<{
+          readonly kind: Schema.Literal<"override">;
+          readonly of: Schema.Union<readonly [Schema.Struct<{
+            readonly kind: Schema.Literal<"check">;
+            readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+          }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"not-run">;
+            readonly check: Schema.brand<Schema.String, "CheckName">;
+            readonly source: Schema.optionalKey<Schema.Literal<"project">>;
+          }>]>;
+          readonly by: Schema.Union<readonly [Schema.Struct<{
+            readonly kind: Schema.Literal<"person">;
+            readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+          }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"role">;
+            readonly role: Schema.Literal<"admin">;
+            readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+          }>]>;
         }>]>;
+        readonly overrides: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+          readonly of: Schema.Literals<readonly ["failed run", "not run"]>;
+          readonly by: Schema.Union<readonly [Schema.Struct<{
+            readonly kind: Schema.Literal<"person">;
+            readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+          }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"role">;
+            readonly role: Schema.Literal<"admin">;
+            readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+          }>]>;
+        }>>>;
       }>>;
+      readonly all: Schema.Boolean;
     }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"review">;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"accountable">;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"admin">;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"permission">;
-      readonly name: Schema.brand<Schema.String, "RepoPermissionName">;
-    }>]>;
-    readonly from: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
-      readonly kind: Schema.Literal<"gate">;
-      readonly line: Schema.optionalKey<Schema.Int>;
-      readonly code: Schema.optionalKey<Schema.String>;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"floor">;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"project gate">;
-      readonly line: Schema.optionalKey<Schema.Int>;
-      readonly code: Schema.optionalKey<Schema.String>;
+      readonly state: Schema.Literal<"waiting">;
+      readonly for: Schema.Literal<"checks read">;
     }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"added">;
-      readonly source: Schema.brand<Schema.TemplateLiteral<readonly ["needsource_", Schema.String]>, "NeedSourceId">;
-      readonly by: Schema.Union<readonly [Schema.Struct<{
+      readonly state: Schema.Literal<"refused">;
+      readonly decider: Schema.Union<readonly [Schema.Struct<{
         readonly kind: Schema.Literal<"person">;
         readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
       }>, Schema.Struct<{
@@ -12736,31 +13253,44 @@ declare const ReposGroup_base: HttpApiGroup.HttpApiGroup<"repos", HttpApiEndpoin
         readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
         readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
       }>, Schema.Struct<{
-        readonly kind: Schema.Literal<"ref0">;
-        readonly id: Schema.Literals<("ref0:attachments" | "ref0:barrier" | "ref0:blockers" | "ref0:checks" | "ref0:gate" | "ref0:hooks" | "ref0:importer" | "ref0:invitations" | "ref0:listings" | "ref0:mirror" | "ref0:needs" | "ref0:oauth" | "ref0:owners" | "ref0:plans" | "ref0:prepare" | "ref0:project-gate" | "ref0:pushes" | "ref0:queue" | "ref0:rebuilder" | "ref0:sessions" | "ref0:sign-in" | "ref0:stages" | "ref0:sweeper" | "ref0:usage" | "ref0:warm-up" | "ref0:workflows")[]>;
+        readonly kind: Schema.Literal<"check">;
+        readonly name: Schema.brand<Schema.String, "CheckName">;
+        readonly source: Schema.optionalKey<Schema.Literal<"project">>;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"role">;
+        readonly role: Schema.Literal<"admin">;
+        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"permission">;
+        readonly repo: Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">;
+        readonly name: Schema.brand<Schema.String, "RepoPermissionName">;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"override">;
+        readonly of: Schema.Union<readonly [Schema.Struct<{
+          readonly kind: Schema.Literal<"check">;
+          readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+        }>, Schema.Struct<{
+          readonly kind: Schema.Literal<"not-run">;
+          readonly check: Schema.brand<Schema.String, "CheckName">;
+          readonly source: Schema.optionalKey<Schema.Literal<"project">>;
+        }>]>;
+        readonly by: Schema.Union<readonly [Schema.Struct<{
+          readonly kind: Schema.Literal<"person">;
+          readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+        }>, Schema.Struct<{
+          readonly kind: Schema.Literal<"role">;
+          readonly role: Schema.Literal<"admin">;
+          readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+        }>]>;
       }>]>;
-      readonly through: Schema.Literals<readonly ["thread", "person", "finding", "workflow"]>;
-      readonly at: Schema.Int;
-      readonly finding: Schema.optionalKey<Schema.Struct<{
-        readonly review: Schema.brand<Schema.TemplateLiteral<readonly ["review_", Schema.String]>, "ReviewId">;
-        readonly finding: Schema.Int;
-      }>>;
-      readonly run: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["workflowrun_", Schema.String]>, "WorkflowRunId">>;
-      readonly accountable: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">>;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"result">;
-      readonly check: Schema.brand<Schema.String, "CheckName">;
-      readonly source: Schema.optionalKey<Schema.Literal<"project">>;
-      readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
-      readonly local: Schema.optionalKey<Schema.Literal<true>>;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"tip">;
-      readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["tiprun_", Schema.String]>, "TipRunId">;
-      readonly source: Schema.brand<Schema.TemplateLiteral<readonly ["needsource_", Schema.String]>, "NeedSourceId">;
-      readonly check: Schema.optionalKey<Schema.brand<Schema.String, "CheckName">>;
-      readonly checkRun: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
+      readonly by: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
     }>]>>;
   }>>;
+  readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+  readonly names: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+    readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+    readonly name: Schema.brand<Schema.String, "OwnerName">;
+  }>>>;
   readonly reads: Schema.$Array<Schema.Struct<{
     readonly side: Schema.Literals<readonly ["before", "after"]>;
     readonly path: Schema.String;
@@ -13309,7 +13839,29 @@ declare const ReposGroup_base: HttpApiGroup.HttpApiGroup<"repos", HttpApiEndpoin
   readonly visibility: Schema.Literals<readonly ["private", "internal", "public"]>;
   readonly state: Schema.Literals<readonly ["creating", "importing", "ready", "failed"]>;
   readonly createdAt: Schema.DateTimeUtcFromMillis;
-}>>, Schema.toCodecJson<typeof RepoNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"line", "GET", "/v1/repos/:owner/:repo/commits/:commit/lines", Schema.toCodecStringTree<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof RepoNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"import", "POST", "/v1/owners/:owner/repos/import", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+  readonly name: Schema.brand<Schema.String, "RepoName">;
+  readonly project: Schema.optionalKey<Schema.brand<Schema.String, "ProjectName">>;
+  readonly url: Schema.brand<Schema.String, "RepoUrl">;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Struct<{
+  readonly repo: Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">;
+  readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+  readonly project: Schema.brand<Schema.TemplateLiteral<readonly ["project_", Schema.String]>, "ProjectId">;
+  readonly scope: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"project">;
+    readonly name: Schema.brand<Schema.String, "ProjectName">;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"owner">;
+  }>]>;
+  readonly name: Schema.brand<Schema.String, "RepoName">;
+  readonly visibility: Schema.Literals<readonly ["private", "internal", "public"]>;
+  readonly state: Schema.Literals<readonly ["creating", "importing", "ready", "failed"]>;
+  readonly createdAt: Schema.DateTimeUtcFromMillis;
+}>>, Schema.toCodecJson<typeof NameTaken | typeof NameReserved | typeof ProjectNotFound | typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof CommandRefused | typeof ApprovalNeeded | typeof SlowDown>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"line", "GET", "/v1/repos/:owner/:repo/commits/:commit/lines", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   repo: Schema.brand<Schema.String, "RepoName">;
   commit: Schema.brand<Schema.String, "CommitOid">;
@@ -13549,88 +14101,7 @@ declare const ReposGroup_base: HttpApiGroup.HttpApiGroup<"repos", HttpApiEndpoin
     }>;
     readonly threadNumber: Schema.Int;
   }>>;
-}>>, Schema.toCodecJson<typeof RepoNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"create", "POST", "/v1/owners/:owner/repos", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-  readonly name: Schema.brand<Schema.String, "RepoName">;
-  readonly project: Schema.optionalKey<Schema.brand<Schema.String, "ProjectName">>;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Struct<{
-  readonly repo: Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">;
-  readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-  readonly project: Schema.brand<Schema.TemplateLiteral<readonly ["project_", Schema.String]>, "ProjectId">;
-  readonly scope: Schema.Union<readonly [Schema.Struct<{
-    readonly kind: Schema.Literal<"project">;
-    readonly name: Schema.brand<Schema.String, "ProjectName">;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"owner">;
-  }>]>;
-  readonly name: Schema.brand<Schema.String, "RepoName">;
-  readonly visibility: Schema.Literals<readonly ["private", "internal", "public"]>;
-  readonly state: Schema.Literals<readonly ["creating", "importing", "ready", "failed"]>;
-  readonly createdAt: Schema.DateTimeUtcFromMillis;
-}>>, Schema.toCodecJson<typeof NameTaken | typeof NameReserved | typeof ProjectNotFound | typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof CommandRefused | typeof ApprovalNeeded | typeof SlowDown>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"import", "POST", "/v1/owners/:owner/repos/import", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-  readonly name: Schema.brand<Schema.String, "RepoName">;
-  readonly project: Schema.optionalKey<Schema.brand<Schema.String, "ProjectName">>;
-  readonly url: Schema.brand<Schema.String, "RepoUrl">;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Struct<{
-  readonly repo: Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">;
-  readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-  readonly project: Schema.brand<Schema.TemplateLiteral<readonly ["project_", Schema.String]>, "ProjectId">;
-  readonly scope: Schema.Union<readonly [Schema.Struct<{
-    readonly kind: Schema.Literal<"project">;
-    readonly name: Schema.brand<Schema.String, "ProjectName">;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"owner">;
-  }>]>;
-  readonly name: Schema.brand<Schema.String, "RepoName">;
-  readonly visibility: Schema.Literals<readonly ["private", "internal", "public"]>;
-  readonly state: Schema.Literals<readonly ["creating", "importing", "ready", "failed"]>;
-  readonly createdAt: Schema.DateTimeUtcFromMillis;
-}>>, Schema.toCodecJson<typeof NameTaken | typeof NameReserved | typeof ProjectNotFound | typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof CommandRefused | typeof ApprovalNeeded | typeof SlowDown>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"addNeed", "POST", "/v1/repos/:owner/:repo/pulls/:pullRequest/needs", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-  repo: Schema.brand<Schema.String, "RepoName">;
-  pullRequest: Schema.brand<Schema.Int, "PullRequestNumber">;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-  readonly need: Schema.Union<readonly [Schema.Struct<{
-    readonly kind: Schema.Literal<"checks">;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"check">;
-    readonly name: Schema.brand<Schema.String, "CheckName">;
-    readonly params: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
-    readonly source: Schema.optionalKey<Schema.Literal<"project">>;
-    readonly local: Schema.optionalKey<Schema.Literal<true>>;
-    readonly passkey: Schema.optionalKey<Schema.Struct<{
-      readonly from: Schema.Union<readonly [Schema.Literal<"accountable">, Schema.Struct<{
-        readonly person: Schema.brand<Schema.String, "OwnerName">;
-      }>, Schema.Struct<{
-        readonly permission: Schema.brand<Schema.String, "RepoPermissionName">;
-      }>]>;
-    }>>;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"review">;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"accountable">;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"admin">;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"permission">;
-    readonly name: Schema.brand<Schema.String, "RepoPermissionName">;
-  }>]>;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Struct<{
-  readonly pullRequest: Schema.optionalKey<Schema.brand<Schema.Int, "PullRequestNumber">>;
-  readonly outcome: Schema.Literals<readonly ["added", "removed", "unchanged"]>;
-  readonly version: Schema.optionalKey<Schema.brand<Schema.Int, "VersionNumber">>;
-  readonly source: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["needsource_", Schema.String]>, "NeedSourceId">>;
-  readonly removed: Schema.optionalKey<Schema.$Array<Schema.brand<Schema.TemplateLiteral<readonly ["needsource_", Schema.String]>, "NeedSourceId">>>;
-}>>, Schema.toCodecJson<typeof ProjectNotFound | typeof NotPermitted | typeof PullRequestNotFound | typeof ProjectNotReady | typeof RepoNotFound | typeof NeedRefused>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"removeNeeds", "POST", "/v1/repos/:owner/:repo/pulls/:pullRequest/needs/remove", Schema.toCodecStringTree<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof RepoNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"removeNeeds", "POST", "/v1/repos/:owner/:repo/pulls/:pullRequest/needs/remove", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   repo: Schema.brand<Schema.String, "RepoName">;
   pullRequest: Schema.brand<Schema.Int, "PullRequestNumber">;
@@ -16401,7 +16872,11 @@ declare const DecisionsGroup_base: HttpApiGroup.HttpApiGroup<"decisions", HttpAp
   }>>;
   readonly result: Schema.optionalKey<Schema.brand<Schema.String, "AnswerKey">>;
   readonly closedWhy: Schema.optionalKey<Schema.Literals<readonly ["decided", "expired", "withdrawn", "superseded"]>>;
-}>>, Schema.toCodecJson<typeof ProjectNotFound | typeof NotPermitted | typeof DeliveryOutsideWindow | typeof ProjectNotReady | typeof PlanTextRefused | typeof DecisionNotFound | typeof AnswerRefused>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"get", "GET", "/v1/projects/:owner/:project/decisions/:decision", Schema.toCodecStringTree<Schema.Struct<{
+  readonly names: Schema.Struct<{
+    readonly thread: Schema.brand<Schema.String, "WrittenThread">;
+    readonly pullRequest: Schema.optionalKey<Schema.brand<Schema.String, "WrittenPullRequest">>;
+  }>;
+}>>, Schema.toCodecJson<typeof ProjectNotFound | typeof NotPermitted | typeof DeliveryOutsideWindow | typeof ProjectNotReady | typeof PlanTextRefused | typeof DecisionNotFound | typeof AnswerRefused | typeof CommandRefused | typeof ApprovalNeeded | typeof SlowDown>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"get", "GET", "/v1/projects/:owner/:project/decisions/:decision", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   project: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["project_", Schema.String]>, "ProjectId">, Schema.brand<Schema.String, "ProjectName">]>;
 } & {
@@ -16517,6 +16992,10 @@ declare const DecisionsGroup_base: HttpApiGroup.HttpApiGroup<"decisions", HttpAp
   }>>;
   readonly result: Schema.optionalKey<Schema.brand<Schema.String, "AnswerKey">>;
   readonly closedWhy: Schema.optionalKey<Schema.Literals<readonly ["decided", "expired", "withdrawn", "superseded"]>>;
+  readonly names: Schema.Struct<{
+    readonly thread: Schema.brand<Schema.String, "WrittenThread">;
+    readonly pullRequest: Schema.optionalKey<Schema.brand<Schema.String, "WrittenPullRequest">>;
+  }>;
 }>>, Schema.toCodecJson<typeof ProjectNotFound | typeof ProjectNotReady | typeof DecisionNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"waiting", "GET", "/v1/projects/:owner/:project/decisions/", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   project: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["project_", Schema.String]>, "ProjectId">, Schema.brand<Schema.String, "ProjectName">]>;
@@ -16630,6 +17109,11 @@ declare const DecisionsGroup_base: HttpApiGroup.HttpApiGroup<"decisions", HttpAp
     }>>;
     readonly result: Schema.optionalKey<Schema.brand<Schema.String, "AnswerKey">>;
     readonly closedWhy: Schema.optionalKey<Schema.Literals<readonly ["decided", "expired", "withdrawn", "superseded"]>>;
+    readonly names: Schema.Struct<{
+      readonly thread: Schema.brand<Schema.String, "WrittenThread">;
+      readonly pullRequest: Schema.optionalKey<Schema.brand<Schema.String, "WrittenPullRequest">>;
+    }>;
+    readonly waitsOn: Schema.Literals<readonly ["you", "your person"]>;
   }>>;
 }>>, Schema.toCodecJson<typeof ProjectNotFound | typeof ProjectNotReady>, Authorization, never>, false>;
 declare class DecisionsGroup extends DecisionsGroup_base {}
@@ -16751,7 +17235,11 @@ declare const OrgDecisionsGroup_base: HttpApiGroup.HttpApiGroup<"orgDecisions",
   }>>;
   readonly result: Schema.optionalKey<Schema.brand<Schema.String, "AnswerKey">>;
   readonly closedWhy: Schema.optionalKey<Schema.Literals<readonly ["decided", "expired", "withdrawn", "superseded"]>>;
-}>>, Schema.toCodecJson<typeof ProjectNotFound | typeof NotPermitted | typeof DeliveryOutsideWindow | typeof ProjectNotReady | typeof PlanTextRefused | typeof DecisionNotFound | typeof AnswerRefused>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"get", "GET", "/v1/owners/:owner/decisions/:decision", Schema.toCodecStringTree<Schema.Struct<{
+  readonly names: Schema.Struct<{
+    readonly thread: Schema.brand<Schema.String, "WrittenThread">;
+    readonly pullRequest: Schema.optionalKey<Schema.brand<Schema.String, "WrittenPullRequest">>;
+  }>;
+}>>, Schema.toCodecJson<typeof ProjectNotFound | typeof NotPermitted | typeof DeliveryOutsideWindow | typeof ProjectNotReady | typeof PlanTextRefused | typeof DecisionNotFound | typeof AnswerRefused | typeof CommandRefused | typeof ApprovalNeeded | typeof SlowDown>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"get", "GET", "/v1/owners/:owner/decisions/:decision", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
 } & {
   decision: Schema.brand<Schema.TemplateLiteral<readonly ["decision_", Schema.String]>, "DecisionId">;
@@ -16866,6 +17354,10 @@ declare const OrgDecisionsGroup_base: HttpApiGroup.HttpApiGroup<"orgDecisions",
   }>>;
   readonly result: Schema.optionalKey<Schema.brand<Schema.String, "AnswerKey">>;
   readonly closedWhy: Schema.optionalKey<Schema.Literals<readonly ["decided", "expired", "withdrawn", "superseded"]>>;
+  readonly names: Schema.Struct<{
+    readonly thread: Schema.brand<Schema.String, "WrittenThread">;
+    readonly pullRequest: Schema.optionalKey<Schema.brand<Schema.String, "WrittenPullRequest">>;
+  }>;
 }>>, Schema.toCodecJson<typeof ProjectNotFound | typeof ProjectNotReady | typeof DecisionNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"waiting", "GET", "/v1/owners/:owner/decisions/", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
 }>>, never, never, never, Schema.toCodecJson<Schema.Struct<{
@@ -16978,6 +17470,11 @@ declare const OrgDecisionsGroup_base: HttpApiGroup.HttpApiGroup<"orgDecisions",
     }>>;
     readonly result: Schema.optionalKey<Schema.brand<Schema.String, "AnswerKey">>;
     readonly closedWhy: Schema.optionalKey<Schema.Literals<readonly ["decided", "expired", "withdrawn", "superseded"]>>;
+    readonly names: Schema.Struct<{
+      readonly thread: Schema.brand<Schema.String, "WrittenThread">;
+      readonly pullRequest: Schema.optionalKey<Schema.brand<Schema.String, "WrittenPullRequest">>;
+    }>;
+    readonly waitsOn: Schema.Literals<readonly ["you", "your person"]>;
   }>>;
 }>>, Schema.toCodecJson<typeof ProjectNotFound | typeof ProjectNotReady>, Authorization, never>, false>;
 /** The decisions in an organization's own scope, on its org threads, as a project's. */
@@ -17017,19 +17514,43 @@ declare const AgentPermissionsGroup_base: HttpApiGroup.HttpApiGroup<"agentPermis
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   action: Schema.Literals<readonly ["project:read", "project:write", "thread:start", "thread:write", "session:start", "session:change", "agent:attach", "approval:start", "git:read", "git:push", "approval:ask", "repo:add", "project:create", "thread:watch", "check:run"]>;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
-  readonly choice: Schema.Literals<readonly ["ask", "allow", "deny"]>;
+  readonly choice: Schema.Literals<readonly ["ask", "allow", "deny"]>;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Struct<{
+  readonly action: Schema.Literals<readonly ["project:read", "project:write", "thread:start", "thread:write", "session:start", "session:change", "agent:attach", "approval:start", "git:read", "git:push", "approval:ask", "repo:add", "project:create", "thread:watch", "check:run"]>;
+  readonly choice: Schema.Literals<readonly ["ask", "allow", "deny"]>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof CommandRefused | typeof ApprovalNeeded | typeof SlowDown>, Authorization, never>, false>;
+/**
+ * An owner's agent permissions, on `/settings`: reading them, and changing one, which runs by
+ * the person's approval, answered with their passkey in an approving browser.
+ */
+declare class AgentPermissionsGroup extends AgentPermissionsGroup_base {}
+declare const WorkflowsGroup_base: HttpApiGroup.HttpApiGroup<"workflows", HttpApiEndpoint.HttpApiEndpoint<"disable", "POST", "/v1/repos/:owner/:repo/workflows/disable", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+  repo: Schema.brand<Schema.String, "RepoName">;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+  readonly workflows: Schema.Union<readonly [Schema.Literal<"all">, Schema.$Array<Schema.brand<Schema.String, "WorkflowName">>]>;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Struct<{
+  readonly disabled: Schema.$Array<Schema.brand<Schema.String, "WorkflowName">>;
+  readonly alreadyDisabled: Schema.$Array<Schema.brand<Schema.String, "WorkflowName">>;
+  readonly coversUnread: Schema.Boolean;
+}>>, Schema.toCodecJson<typeof ProjectNotFound | typeof NotPermitted | typeof DeliveryOutsideWindow | typeof ProjectNotReady | typeof RepoNotFound | typeof WorkflowNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"enable", "POST", "/v1/repos/:owner/:repo/workflows/enable", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+  repo: Schema.brand<Schema.String, "RepoName">;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+  readonly workflow: Schema.brand<Schema.String, "WorkflowName">;
+  readonly version: Schema.brand<Schema.String, "WorkflowVersion">;
 }>>, Schema.toCodecStringTree<Schema.Struct<{
   'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
 }>>, Schema.toCodecJson<Schema.Struct<{
-  readonly action: Schema.Literals<readonly ["project:read", "project:write", "thread:start", "thread:write", "session:start", "session:change", "agent:attach", "approval:start", "git:read", "git:push", "approval:ask", "repo:add", "project:create", "thread:watch", "check:run"]>;
-  readonly choice: Schema.Literals<readonly ["ask", "allow", "deny"]>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof CommandRefused | typeof ApprovalNeeded | typeof SlowDown>, Authorization, never>, false>;
-/**
- * An owner's agent permissions, on `/settings`: reading them, and changing one, which runs by
- * the person's approval, answered with their passkey in an approving browser.
- */
-declare class AgentPermissionsGroup extends AgentPermissionsGroup_base {}
-declare const WorkflowsGroup_base: HttpApiGroup.HttpApiGroup<"workflows", HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/repos/:owner/:repo/workflows", Schema.toCodecStringTree<Schema.Struct<{
+  readonly workflow: Schema.brand<Schema.String, "WorkflowName">;
+  readonly version: Schema.brand<Schema.String, "WorkflowVersion">;
+  readonly changed: Schema.Boolean;
+  readonly accountable: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+}>>, Schema.toCodecJson<typeof ProjectNotFound | typeof NotPermitted | typeof DeliveryOutsideWindow | typeof ProjectNotReady | typeof RepoNotFound | typeof WorkflowNotFound | typeof WorkflowVersionMoved | typeof WorkflowsBeingRead | typeof WorkflowHasNoVersion>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/repos/:owner/:repo/workflows", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   repo: Schema.brand<Schema.String, "RepoName">;
 }>>, never, never, never, Schema.toCodecJson<Schema.Struct<{
@@ -17261,55 +17782,343 @@ declare const WorkflowsGroup_base: HttpApiGroup.HttpApiGroup<"workflows", HttpAp
         readonly why: Schema.Literals<readonly ["undeclared", "ceiling", "target", "answers", "length", "secret", "audience", "budget", "ended", "invalid", "changed", "access", "need", "key"]>;
         readonly count: Schema.Int;
       }>>;
-      readonly duplicates: Schema.Int;
-      readonly kind: Schema.Literal<"expired">;
-    }>]>>;
-    readonly matchedAt: Schema.DateTimeUtcFromMillis;
-    readonly endedAt: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
-    readonly parent: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["workflowrun_", Schema.String]>, "WorkflowRunId">>;
-    readonly title: Schema.optionalKey<Schema.String>;
-  }>>;
-  readonly before: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["workflowrun_", Schema.String]>, "WorkflowRunId">>;
-}>>, Schema.toCodecJson<typeof RepoNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"disable", "POST", "/v1/repos/:owner/:repo/workflows/disable", Schema.toCodecStringTree<Schema.Struct<{
+      readonly duplicates: Schema.Int;
+      readonly kind: Schema.Literal<"expired">;
+    }>]>>;
+    readonly matchedAt: Schema.DateTimeUtcFromMillis;
+    readonly endedAt: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
+    readonly parent: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["workflowrun_", Schema.String]>, "WorkflowRunId">>;
+    readonly title: Schema.optionalKey<Schema.String>;
+  }>>;
+  readonly before: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["workflowrun_", Schema.String]>, "WorkflowRunId">>;
+}>>, Schema.toCodecJson<typeof RepoNotFound>, Authorization, never>, false>;
+/**
+ * A repo's workflows and their workflow runs, for whoever may read the repo. Turning workflows
+ * off is a person's approved command, which reaches `/v1` with approvals; an agent asks its
+ * person.
+ */
+declare class WorkflowsGroup extends WorkflowsGroup_base {}
+declare const RunsGroup_base: HttpApiGroup.HttpApiGroup<"runs", HttpApiEndpoint.HttpApiEndpoint<"cancel", "POST", "/v1/repos/:owner/:repo/runs/waiting/:start/cancel", Schema.toCodecStringTree<Schema.Struct<{
+  start: Schema.brand<Schema.TemplateLiteral<readonly ["startwait_", Schema.String]>, "StartWaitId">;
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+  repo: Schema.brand<Schema.String, "RepoName">;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  readonly thread: Schema.optionalKey<Schema.brand<Schema.String, "WrittenThread">>;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly cancelled: Schema.Literals<readonly ["start", "yours"]>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof ThreadNotFound | typeof RepoNotFound | typeof StartNotFound | typeof StartPast | typeof RunUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/repos/:owner/:repo/runs", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+  repo: Schema.brand<Schema.String, "RepoName">;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  readonly thread: Schema.optionalKey<Schema.brand<Schema.String, "WrittenThread">>;
+  readonly check: Schema.optionalKey<Schema.brand<Schema.String, "CheckKey">>;
+  readonly before: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly runs: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+    readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+    readonly check: Schema.brand<Schema.String, "CheckName">;
+    readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+    readonly rerun: Schema.Int;
+    readonly rerunOf: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
+    readonly tree: Schema.brand<Schema.String, "TreeOid">;
+    readonly origin: Schema.Literals<readonly ["main", "thread", "project"]>;
+    readonly createdAt: Schema.DateTimeUtcFromMillis;
+    readonly startedAt: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
+    readonly endedAt: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
+    readonly starters: Schema.$Array<Schema.Struct<{
+      readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"person">;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"agent">;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"ref0">;
+        readonly id: Schema.Literals<("ref0:attachments" | "ref0:barrier" | "ref0:blockers" | "ref0:checks" | "ref0:gate" | "ref0:hooks" | "ref0:importer" | "ref0:invitations" | "ref0:listings" | "ref0:mirror" | "ref0:needs" | "ref0:oauth" | "ref0:owners" | "ref0:plans" | "ref0:prepare" | "ref0:project-gate" | "ref0:pushes" | "ref0:queue" | "ref0:rebuilder" | "ref0:sessions" | "ref0:sign-in" | "ref0:stages" | "ref0:sweeper" | "ref0:usage" | "ref0:warm-up" | "ref0:workflows")[]>;
+      }>]>;
+      readonly request: Schema.String;
+      readonly at: Schema.DateTimeUtcFromMillis;
+    }>>;
+    readonly local: Schema.optionalKey<Schema.Struct<{
+      readonly attachment: Schema.Struct<{
+        readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+      }>;
+      readonly agent: Schema.optionalKey<Schema.Struct<{
+        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+      }>>;
+    }>>;
+    readonly routes: Schema.optionalKey<Schema.Struct<{
+      readonly requests: Schema.Int;
+      readonly omitted: Schema.Int;
+      readonly trace: Schema.Literals<readonly ["pending", "kept", "failed"]>;
+      readonly refusals: Schema.$Array<Schema.Struct<{
+        readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+        readonly step: Schema.String;
+        readonly count: Schema.Int;
+        readonly attempt: Schema.Int;
+        readonly provenance: Schema.Literals<readonly ["observed", "reported"]>;
+        readonly why: Schema.Literals<readonly ["scheme", "https", "host", "port", "websocket", "webrtc", "deadline", "ended", "not yours", "closed", "browse closed", "fenced", "not open", "not served", "stopped", "unreachable", "too many", "unavailable"]>;
+        readonly recovery: Schema.String;
+        readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["sbxsession_", Schema.String]>, "SandboxSessionId">;
+        readonly url: Schema.String;
+      }>>;
+      readonly refusalsOmitted: Schema.Int;
+      readonly reported: Schema.$Array<Schema.Struct<{
+        readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+        readonly step: Schema.String;
+        readonly count: Schema.Int;
+        readonly attempt: Schema.Int;
+        readonly provenance: Schema.Literals<readonly ["observed", "reported"]>;
+        readonly why: Schema.Literals<readonly ["scheme", "https", "host", "port", "websocket", "webrtc", "deadline", "ended", "not yours", "closed", "browse closed", "fenced", "not open", "not served", "stopped", "unreachable", "too many", "unavailable"]>;
+        readonly recovery: Schema.String;
+        readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["sbxsession_", Schema.String]>, "SandboxSessionId">;
+        readonly url: Schema.String;
+      }>>;
+      readonly reportedOmitted: Schema.Int;
+    }>>;
+    readonly browsers: Schema.optionalKey<Schema.Struct<{
+      readonly browses: Schema.Int;
+      readonly closing: Schema.Int;
+      readonly unconfirmed: Schema.Int;
+      readonly lastError: Schema.optionalKey<Schema.String>;
+      readonly unresolved: Schema.Int;
+      readonly presumedExpired: Schema.Int;
+      readonly browserMs: Schema.Int;
+      readonly estimated: Schema.Boolean;
+    }>>;
+    readonly state: Schema.Literals<readonly ["waiting", "pending", "starting", "created", "running"]>;
+  }>, Schema.Struct<{
+    readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+    readonly check: Schema.brand<Schema.String, "CheckName">;
+    readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+    readonly rerun: Schema.Int;
+    readonly rerunOf: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
+    readonly tree: Schema.brand<Schema.String, "TreeOid">;
+    readonly origin: Schema.Literals<readonly ["main", "thread", "project"]>;
+    readonly createdAt: Schema.DateTimeUtcFromMillis;
+    readonly startedAt: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
+    readonly endedAt: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
+    readonly starters: Schema.$Array<Schema.Struct<{
+      readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"person">;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"agent">;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"ref0">;
+        readonly id: Schema.Literals<("ref0:attachments" | "ref0:barrier" | "ref0:blockers" | "ref0:checks" | "ref0:gate" | "ref0:hooks" | "ref0:importer" | "ref0:invitations" | "ref0:listings" | "ref0:mirror" | "ref0:needs" | "ref0:oauth" | "ref0:owners" | "ref0:plans" | "ref0:prepare" | "ref0:project-gate" | "ref0:pushes" | "ref0:queue" | "ref0:rebuilder" | "ref0:sessions" | "ref0:sign-in" | "ref0:stages" | "ref0:sweeper" | "ref0:usage" | "ref0:warm-up" | "ref0:workflows")[]>;
+      }>]>;
+      readonly request: Schema.String;
+      readonly at: Schema.DateTimeUtcFromMillis;
+    }>>;
+    readonly local: Schema.optionalKey<Schema.Struct<{
+      readonly attachment: Schema.Struct<{
+        readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+      }>;
+      readonly agent: Schema.optionalKey<Schema.Struct<{
+        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+      }>>;
+    }>>;
+    readonly routes: Schema.optionalKey<Schema.Struct<{
+      readonly requests: Schema.Int;
+      readonly omitted: Schema.Int;
+      readonly trace: Schema.Literals<readonly ["pending", "kept", "failed"]>;
+      readonly refusals: Schema.$Array<Schema.Struct<{
+        readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+        readonly step: Schema.String;
+        readonly count: Schema.Int;
+        readonly attempt: Schema.Int;
+        readonly provenance: Schema.Literals<readonly ["observed", "reported"]>;
+        readonly why: Schema.Literals<readonly ["scheme", "https", "host", "port", "websocket", "webrtc", "deadline", "ended", "not yours", "closed", "browse closed", "fenced", "not open", "not served", "stopped", "unreachable", "too many", "unavailable"]>;
+        readonly recovery: Schema.String;
+        readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["sbxsession_", Schema.String]>, "SandboxSessionId">;
+        readonly url: Schema.String;
+      }>>;
+      readonly refusalsOmitted: Schema.Int;
+      readonly reported: Schema.$Array<Schema.Struct<{
+        readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+        readonly step: Schema.String;
+        readonly count: Schema.Int;
+        readonly attempt: Schema.Int;
+        readonly provenance: Schema.Literals<readonly ["observed", "reported"]>;
+        readonly why: Schema.Literals<readonly ["scheme", "https", "host", "port", "websocket", "webrtc", "deadline", "ended", "not yours", "closed", "browse closed", "fenced", "not open", "not served", "stopped", "unreachable", "too many", "unavailable"]>;
+        readonly recovery: Schema.String;
+        readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["sbxsession_", Schema.String]>, "SandboxSessionId">;
+        readonly url: Schema.String;
+      }>>;
+      readonly reportedOmitted: Schema.Int;
+    }>>;
+    readonly browsers: Schema.optionalKey<Schema.Struct<{
+      readonly browses: Schema.Int;
+      readonly closing: Schema.Int;
+      readonly unconfirmed: Schema.Int;
+      readonly lastError: Schema.optionalKey<Schema.String>;
+      readonly unresolved: Schema.Int;
+      readonly presumedExpired: Schema.Int;
+      readonly browserMs: Schema.Int;
+      readonly estimated: Schema.Boolean;
+    }>>;
+    readonly state: Schema.Literal<"ended">;
+    readonly conclusion: Schema.Literals<readonly ["success", "failure", "neutral"]>;
+  }>, Schema.Struct<{
+    readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+    readonly check: Schema.brand<Schema.String, "CheckName">;
+    readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+    readonly rerun: Schema.Int;
+    readonly rerunOf: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
+    readonly tree: Schema.brand<Schema.String, "TreeOid">;
+    readonly origin: Schema.Literals<readonly ["main", "thread", "project"]>;
+    readonly createdAt: Schema.DateTimeUtcFromMillis;
+    readonly startedAt: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
+    readonly endedAt: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
+    readonly starters: Schema.$Array<Schema.Struct<{
+      readonly actor: Schema.Union<readonly [Schema.Struct<{
+        readonly kind: Schema.Literal<"person">;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"agent">;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+      }>, Schema.Struct<{
+        readonly kind: Schema.Literal<"ref0">;
+        readonly id: Schema.Literals<("ref0:attachments" | "ref0:barrier" | "ref0:blockers" | "ref0:checks" | "ref0:gate" | "ref0:hooks" | "ref0:importer" | "ref0:invitations" | "ref0:listings" | "ref0:mirror" | "ref0:needs" | "ref0:oauth" | "ref0:owners" | "ref0:plans" | "ref0:prepare" | "ref0:project-gate" | "ref0:pushes" | "ref0:queue" | "ref0:rebuilder" | "ref0:sessions" | "ref0:sign-in" | "ref0:stages" | "ref0:sweeper" | "ref0:usage" | "ref0:warm-up" | "ref0:workflows")[]>;
+      }>]>;
+      readonly request: Schema.String;
+      readonly at: Schema.DateTimeUtcFromMillis;
+    }>>;
+    readonly local: Schema.optionalKey<Schema.Struct<{
+      readonly attachment: Schema.Struct<{
+        readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+      }>;
+      readonly agent: Schema.optionalKey<Schema.Struct<{
+        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+      }>>;
+    }>>;
+    readonly routes: Schema.optionalKey<Schema.Struct<{
+      readonly requests: Schema.Int;
+      readonly omitted: Schema.Int;
+      readonly trace: Schema.Literals<readonly ["pending", "kept", "failed"]>;
+      readonly refusals: Schema.$Array<Schema.Struct<{
+        readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+        readonly step: Schema.String;
+        readonly count: Schema.Int;
+        readonly attempt: Schema.Int;
+        readonly provenance: Schema.Literals<readonly ["observed", "reported"]>;
+        readonly why: Schema.Literals<readonly ["scheme", "https", "host", "port", "websocket", "webrtc", "deadline", "ended", "not yours", "closed", "browse closed", "fenced", "not open", "not served", "stopped", "unreachable", "too many", "unavailable"]>;
+        readonly recovery: Schema.String;
+        readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["sbxsession_", Schema.String]>, "SandboxSessionId">;
+        readonly url: Schema.String;
+      }>>;
+      readonly refusalsOmitted: Schema.Int;
+      readonly reported: Schema.$Array<Schema.Struct<{
+        readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+        readonly step: Schema.String;
+        readonly count: Schema.Int;
+        readonly attempt: Schema.Int;
+        readonly provenance: Schema.Literals<readonly ["observed", "reported"]>;
+        readonly why: Schema.Literals<readonly ["scheme", "https", "host", "port", "websocket", "webrtc", "deadline", "ended", "not yours", "closed", "browse closed", "fenced", "not open", "not served", "stopped", "unreachable", "too many", "unavailable"]>;
+        readonly recovery: Schema.String;
+        readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["sbxsession_", Schema.String]>, "SandboxSessionId">;
+        readonly url: Schema.String;
+      }>>;
+      readonly reportedOmitted: Schema.Int;
+    }>>;
+    readonly browsers: Schema.optionalKey<Schema.Struct<{
+      readonly browses: Schema.Int;
+      readonly closing: Schema.Int;
+      readonly unconfirmed: Schema.Int;
+      readonly lastError: Schema.optionalKey<Schema.String>;
+      readonly unresolved: Schema.Int;
+      readonly presumedExpired: Schema.Int;
+      readonly browserMs: Schema.Int;
+      readonly estimated: Schema.Boolean;
+    }>>;
+    readonly state: Schema.Literal<"ended">;
+    readonly error: Schema.Literals<readonly ["timeout", "threw", "invalid output", "unavailable", "expired", "cancelled"]>;
+  }>]>>;
+  readonly before: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
+}>>, Schema.toCodecJson<typeof ThreadNotFound | typeof RepoNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"local", "GET", "/v1/repos/:owner/:repo/runs/local", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   repo: Schema.brand<Schema.String, "RepoName">;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-  readonly workflows: Schema.Union<readonly [Schema.Literal<"all">, Schema.$Array<Schema.brand<Schema.String, "WorkflowName">>]>;
 }>>, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Struct<{
-  readonly disabled: Schema.$Array<Schema.brand<Schema.String, "WorkflowName">>;
-  readonly alreadyDisabled: Schema.$Array<Schema.brand<Schema.String, "WorkflowName">>;
-  readonly coversUnread: Schema.Boolean;
-}>>, Schema.toCodecJson<typeof ProjectNotFound | typeof NotPermitted | typeof DeliveryOutsideWindow | typeof ProjectNotReady | typeof RepoNotFound | typeof WorkflowNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"enable", "POST", "/v1/repos/:owner/:repo/workflows/enable", Schema.toCodecStringTree<Schema.Struct<{
+  readonly thread: Schema.brand<Schema.String, "WrittenThread">;
+  readonly check: Schema.brand<Schema.String, "CheckKey">;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly pullRequest: Schema.brand<Schema.Int, "PullRequestNumber">;
+  readonly version: Schema.brand<Schema.Int, "VersionNumber">;
+  readonly tree: Schema.brand<Schema.String, "TreeOid">;
+  readonly check: Schema.brand<Schema.String, "CheckName">;
+  readonly code: Schema.Struct<{
+    readonly version: Schema.brand<Schema.String, "CheckCodeVersion">;
+    readonly origin: Schema.Literals<readonly ["main", "thread", "project"]>;
+  }>;
+  readonly timeoutSeconds: Schema.Int;
+  readonly runs: Schema.$Array<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
+  readonly compiled: Schema.Struct<{
+    readonly entry: Schema.Struct<{
+      readonly name: Schema.String;
+      readonly module: Schema.String;
+      readonly manifest: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
+      readonly files: Schema.$Array<Schema.String>;
+      readonly templates: Schema.optionalKey<Schema.$Array<Schema.$Array<Schema.String>>>;
+      readonly sourceMap: Schema.optionalKey<Schema.String>;
+      readonly reaches: Schema.optionalKey<Schema.Struct<{
+        readonly tree: Schema.Boolean;
+        readonly browser: Schema.Boolean;
+      }>>;
+      readonly sandboxes: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+        readonly name: Schema.String;
+        readonly manifest: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+        readonly pin: Schema.String;
+        readonly format: Schema.Int;
+      }>>>;
+      readonly codeHash: Schema.brand<Schema.String, "CheckCodeVersion">;
+    }>;
+    readonly modules: Schema.$Record<Schema.String, Schema.String>;
+  }>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof ThreadNotFound | typeof RepoNotFound | typeof RunUnavailable | typeof LocalRunRefused>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"report", "POST", "/v1/repos/:owner/:repo/runs/local", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   repo: Schema.brand<Schema.String, "RepoName">;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
-  readonly workflow: Schema.brand<Schema.String, "WorkflowName">;
-  readonly version: Schema.brand<Schema.String, "WorkflowVersion">;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Struct<{
-  readonly workflow: Schema.brand<Schema.String, "WorkflowName">;
-  readonly version: Schema.brand<Schema.String, "WorkflowVersion">;
-  readonly changed: Schema.Boolean;
-  readonly accountable: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-}>>, Schema.toCodecJson<typeof ProjectNotFound | typeof NotPermitted | typeof DeliveryOutsideWindow | typeof ProjectNotReady | typeof RepoNotFound | typeof WorkflowNotFound | typeof WorkflowVersionMoved | typeof WorkflowsBeingRead | typeof WorkflowHasNoVersion>, Authorization, never>, false>;
-/**
- * A repo's workflows and their workflow runs, for whoever may read the repo. Turning workflows
- * off is a person's approved command, which reaches `/v1` with approvals; an agent asks its
- * person.
- */
-declare class WorkflowsGroup extends WorkflowsGroup_base {}
-declare const RunsGroup_base: HttpApiGroup.HttpApiGroup<"runs", HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/repos/:owner/:repo/runs", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-  repo: Schema.brand<Schema.String, "RepoName">;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  readonly thread: Schema.optionalKey<Schema.brand<Schema.String, "WrittenThread">>;
-  readonly check: Schema.optionalKey<Schema.brand<Schema.String, "CheckKey">>;
-  readonly before: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-}>>, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly runs: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+  readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+  readonly thread: Schema.brand<Schema.String, "WrittenThread">;
+  readonly check: Schema.brand<Schema.String, "CheckName">;
+  readonly code: Schema.Struct<{
+    readonly version: Schema.brand<Schema.String, "CheckCodeVersion">;
+    readonly origin: Schema.Literals<readonly ["main", "thread", "project"]>;
+  }>;
+  readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+  readonly tree: Schema.brand<Schema.String, "TreeOid">;
+  readonly result: Schema.Union<readonly [Schema.Struct<{
+    readonly conclusion: Schema.Literals<readonly ["success", "failure", "neutral"]>;
+    readonly output: Schema.optionalKey<Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+    readonly needs: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+      readonly kind: Schema.Literal<"review">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"accountable">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"admin">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"permission">;
+      readonly name: Schema.brand<Schema.String, "RepoPermissionName">;
+    }>]>>>;
+  }>, Schema.Struct<{
+    readonly error: Schema.Literals<readonly ["threw", "invalid output", "timeout"]>;
+    readonly why: Schema.optionalKey<Schema.String>;
+  }>]>;
+  readonly outputsHash: Schema.String;
+  readonly attachment: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">>;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+  readonly run: Schema.Union<readonly [Schema.Struct<{
     readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
     readonly check: Schema.brand<Schema.String, "CheckName">;
     readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
@@ -17539,48 +18348,107 @@ declare const RunsGroup_base: HttpApiGroup.HttpApiGroup<"runs", HttpApiEndpoint.
     }>>;
     readonly state: Schema.Literal<"ended">;
     readonly error: Schema.Literals<readonly ["timeout", "threw", "invalid output", "unavailable", "expired", "cancelled"]>;
-  }>]>>;
-  readonly before: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-}>>, Schema.toCodecJson<typeof ThreadNotFound | typeof RepoNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"local", "GET", "/v1/repos/:owner/:repo/runs/local", Schema.toCodecStringTree<Schema.Struct<{
+  }>]>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof ThreadNotFound | typeof RepoNotFound | typeof RequestChanged | typeof RunsBusy | typeof RunUnavailable | typeof LocalRunRefused>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"restoreSigner", "POST", "/v1/repos/:owner/:repo/checks/signers/restore", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   repo: Schema.brand<Schema.String, "RepoName">;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  readonly thread: Schema.brand<Schema.String, "WrittenThread">;
+}>>, never, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
   readonly check: Schema.brand<Schema.String, "CheckKey">;
-}>>, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly pullRequest: Schema.brand<Schema.Int, "PullRequestNumber">;
-  readonly version: Schema.brand<Schema.Int, "VersionNumber">;
-  readonly tree: Schema.brand<Schema.String, "TreeOid">;
-  readonly check: Schema.brand<Schema.String, "CheckName">;
-  readonly code: Schema.Struct<{
-    readonly version: Schema.brand<Schema.String, "CheckCodeVersion">;
-    readonly origin: Schema.Literals<readonly ["main", "thread", "project"]>;
-  }>;
-  readonly timeoutSeconds: Schema.Int;
-  readonly runs: Schema.$Array<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
-  readonly compiled: Schema.Struct<{
-    readonly entry: Schema.Struct<{
-      readonly name: Schema.String;
-      readonly module: Schema.String;
-      readonly manifest: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
-      readonly files: Schema.$Array<Schema.String>;
-      readonly templates: Schema.optionalKey<Schema.$Array<Schema.$Array<Schema.String>>>;
-      readonly sourceMap: Schema.optionalKey<Schema.String>;
-      readonly reaches: Schema.optionalKey<Schema.Struct<{
-        readonly tree: Schema.Boolean;
-        readonly browser: Schema.Boolean;
+  readonly attachment: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+}>, Schema.Struct<{
+  readonly check: Schema.brand<Schema.String, "CheckKey">;
+  readonly person: Schema.brand<Schema.String, "OwnerName">;
+}>]>>, never, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
+  readonly check: Schema.brand<Schema.String, "CheckKey">;
+  readonly attachment: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+}>, Schema.Struct<{
+  readonly check: Schema.brand<Schema.String, "CheckKey">;
+  readonly person: Schema.brand<Schema.String, "OwnerName">;
+}>]>>, Schema.toCodecJson<typeof NotPermitted | typeof RepoNotFound | typeof SignerNotRevoked>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"start", "POST", "/v1/repos/:owner/:repo/runs", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+  repo: Schema.brand<Schema.String, "RepoName">;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+  readonly check: Schema.brand<Schema.String, "CheckKey">;
+  readonly on: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"main">;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"thread">;
+    readonly thread: Schema.brand<Schema.String, "WrittenThread">;
+    readonly branch: Schema.optionalKey<Schema.String>;
+  }>]>;
+  readonly params: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
+  readonly rerun: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
+  readonly runs: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+    readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+    readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+    readonly rerun: Schema.Int;
+    readonly rerunOf: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
+    readonly got: Schema.Literals<readonly ["new", "joined", "answered"]>;
+    readonly reusedFrom: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
+    readonly readsMoved: Schema.optionalKey<Schema.String>;
+    readonly reuseSkipped: Schema.optionalKey<Schema.String>;
+    readonly state: Schema.Literals<readonly ["waiting", "pending", "starting", "created", "running"]>;
+  }>, Schema.Struct<{
+    readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+    readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+    readonly rerun: Schema.Int;
+    readonly rerunOf: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
+    readonly got: Schema.Literals<readonly ["new", "joined", "answered"]>;
+    readonly reusedFrom: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
+    readonly readsMoved: Schema.optionalKey<Schema.String>;
+    readonly reuseSkipped: Schema.optionalKey<Schema.String>;
+    readonly state: Schema.Literal<"ended">;
+    readonly conclusion: Schema.Literals<readonly ["success", "failure", "neutral"]>;
+    readonly reused: Schema.optionalKey<Schema.Literal<true>>;
+  }>, Schema.Struct<{
+    readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
+    readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+    readonly rerun: Schema.Int;
+    readonly rerunOf: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
+    readonly got: Schema.Literals<readonly ["new", "joined", "answered"]>;
+    readonly reusedFrom: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
+    readonly readsMoved: Schema.optionalKey<Schema.String>;
+    readonly reuseSkipped: Schema.optionalKey<Schema.String>;
+    readonly state: Schema.Literal<"ended">;
+    readonly error: Schema.Literals<readonly ["timeout", "threw", "invalid output", "unavailable", "expired", "cancelled"]>;
+  }>]>>;
+}>, Schema.Struct<{
+  readonly waiting: Schema.Struct<{
+    readonly start: Schema.brand<Schema.TemplateLiteral<readonly ["startwait_", Schema.String]>, "StartWaitId">;
+    readonly check: Schema.brand<Schema.String, "CheckName">;
+    readonly params: Schema.$Array<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
+    readonly thread: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["thread_", Schema.String]>, "ThreadId">>;
+    readonly waitingSince: Schema.DateTimeUtcFromString;
+    readonly endsAt: Schema.DateTimeUtcFromString;
+    readonly runs: Schema.$Array<Schema.Struct<{
+      readonly workflow: Schema.brand<Schema.String, "WorkflowName">;
+      readonly run: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["workflowrun_", Schema.String]>, "WorkflowRunId">>;
+      readonly title: Schema.optionalKey<Schema.String>;
+      readonly state: Schema.Literals<readonly ["starting", "going", "allowed", "refused", "failed"]>;
+      readonly leaves: Schema.$Array<Schema.Struct<{
+        readonly kind: Schema.Literals<readonly ["ask", "passkey"]>;
+        readonly state: Schema.Literals<readonly ["waiting", "answered", "ended"]>;
+        readonly since: Schema.DateTimeUtcFromString;
+        readonly who: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
+          readonly kind: Schema.Literal<"person">;
+          readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+          readonly name: Schema.optionalKey<Schema.brand<Schema.String, "OwnerName">>;
+        }>, Schema.Struct<{
+          readonly kind: Schema.Literal<"agent">;
+          readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+        }>, Schema.Struct<{
+          readonly kind: Schema.Literal<"holders">;
+          readonly permission: Schema.String;
+        }>]>>;
+        readonly what: Schema.optionalKey<Schema.String>;
+        readonly answer: Schema.optionalKey<Schema.String>;
       }>>;
-      readonly sandboxes: Schema.optionalKey<Schema.$Array<Schema.Struct<{
-        readonly name: Schema.String;
-        readonly manifest: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-        readonly pin: Schema.String;
-        readonly format: Schema.Int;
-      }>>>;
-      readonly codeHash: Schema.brand<Schema.String, "CheckCodeVersion">;
-    }>;
-    readonly modules: Schema.$Record<Schema.String, Schema.String>;
+    }>>;
   }>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof ThreadNotFound | typeof RepoNotFound | typeof RunUnavailable | typeof LocalRunRefused>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"trace", "GET", "/v1/repos/:owner/:repo/runs/:run/trace", Schema.toCodecStringTree<Schema.Struct<{
+}>]>>, Schema.toCodecJson<typeof NotPermitted | typeof ThreadNotFound | typeof RepoNotFound | typeof RequestChanged | typeof RunsBusy | typeof RunRefused | typeof RunUnavailable | typeof CheckNotFound | typeof NoThreadHead>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"trace", "GET", "/v1/repos/:owner/:repo/runs/:run/trace", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   repo: Schema.brand<Schema.String, "RepoName">;
   run: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">, Schema.brand<Schema.TemplateLiteral<readonly ["workflowrun_", Schema.String]>, "WorkflowRunId">]>;
@@ -17728,430 +18596,59 @@ declare const RunsGroup_base: HttpApiGroup.HttpApiGroup<"runs", HttpApiEndpoint.
     readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
     readonly rerun: Schema.Int;
     readonly rerunOf: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-    readonly got: Schema.Literals<readonly ["new", "joined", "answered"]>;
-    readonly reusedFrom: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-    readonly readsMoved: Schema.optionalKey<Schema.String>;
-    readonly reuseSkipped: Schema.optionalKey<Schema.String>;
-    readonly state: Schema.Literal<"ended">;
-    readonly conclusion: Schema.Literals<readonly ["success", "failure", "neutral"]>;
-    readonly reused: Schema.optionalKey<Schema.Literal<true>>;
-  }>, Schema.Struct<{
-    readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
-    readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-    readonly rerun: Schema.Int;
-    readonly rerunOf: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-    readonly got: Schema.Literals<readonly ["new", "joined", "answered"]>;
-    readonly reusedFrom: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-    readonly readsMoved: Schema.optionalKey<Schema.String>;
-    readonly reuseSkipped: Schema.optionalKey<Schema.String>;
-    readonly state: Schema.Literal<"ended">;
-    readonly error: Schema.Literals<readonly ["timeout", "threw", "invalid output", "unavailable", "expired", "cancelled"]>;
-  }>]>>;
-}>, Schema.Struct<{
-  readonly waiting: Schema.Struct<{
-    readonly start: Schema.brand<Schema.TemplateLiteral<readonly ["startwait_", Schema.String]>, "StartWaitId">;
-    readonly check: Schema.brand<Schema.String, "CheckName">;
-    readonly params: Schema.$Array<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
-    readonly thread: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["thread_", Schema.String]>, "ThreadId">>;
-    readonly waitingSince: Schema.DateTimeUtcFromString;
-    readonly endsAt: Schema.DateTimeUtcFromString;
-    readonly runs: Schema.$Array<Schema.Struct<{
-      readonly workflow: Schema.brand<Schema.String, "WorkflowName">;
-      readonly run: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["workflowrun_", Schema.String]>, "WorkflowRunId">>;
-      readonly title: Schema.optionalKey<Schema.String>;
-      readonly state: Schema.Literals<readonly ["starting", "going", "allowed", "refused", "failed"]>;
-      readonly leaves: Schema.$Array<Schema.Struct<{
-        readonly kind: Schema.Literals<readonly ["ask", "passkey"]>;
-        readonly state: Schema.Literals<readonly ["waiting", "answered", "ended"]>;
-        readonly since: Schema.DateTimeUtcFromString;
-        readonly who: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
-          readonly kind: Schema.Literal<"person">;
-          readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-          readonly name: Schema.optionalKey<Schema.brand<Schema.String, "OwnerName">>;
-        }>, Schema.Struct<{
-          readonly kind: Schema.Literal<"agent">;
-          readonly handle: Schema.brand<Schema.String, "AgentHandle">;
-        }>, Schema.Struct<{
-          readonly kind: Schema.Literal<"holders">;
-          readonly permission: Schema.String;
-        }>]>>;
-        readonly what: Schema.optionalKey<Schema.String>;
-        readonly answer: Schema.optionalKey<Schema.String>;
-      }>>;
-    }>>;
-  }>;
-}>]>>, Schema.toCodecJson<typeof NotPermitted | typeof ThreadNotFound | typeof RepoNotFound | typeof RequestChanged | typeof RunsBusy | typeof RunRefused | typeof StartNotFound | typeof RunUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"cancel", "POST", "/v1/repos/:owner/:repo/runs/waiting/:start/cancel", Schema.toCodecStringTree<Schema.Struct<{
-  start: Schema.brand<Schema.TemplateLiteral<readonly ["startwait_", Schema.String]>, "StartWaitId">;
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-  repo: Schema.brand<Schema.String, "RepoName">;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  readonly thread: Schema.optionalKey<Schema.brand<Schema.String, "WrittenThread">>;
-}>>, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly cancelled: Schema.Literals<readonly ["start", "yours"]>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof ThreadNotFound | typeof RepoNotFound | typeof StartNotFound | typeof StartPast | typeof RunUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"start", "POST", "/v1/repos/:owner/:repo/runs", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-  repo: Schema.brand<Schema.String, "RepoName">;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-  readonly check: Schema.brand<Schema.String, "CheckKey">;
-  readonly on: Schema.Union<readonly [Schema.Struct<{
-    readonly kind: Schema.Literal<"main">;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"thread">;
-    readonly thread: Schema.brand<Schema.String, "WrittenThread">;
-    readonly branch: Schema.optionalKey<Schema.String>;
-  }>]>;
-  readonly params: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
-  readonly rerun: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
-  readonly runs: Schema.$Array<Schema.Union<readonly [Schema.Struct<{
-    readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
-    readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-    readonly rerun: Schema.Int;
-    readonly rerunOf: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-    readonly got: Schema.Literals<readonly ["new", "joined", "answered"]>;
-    readonly reusedFrom: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-    readonly readsMoved: Schema.optionalKey<Schema.String>;
-    readonly reuseSkipped: Schema.optionalKey<Schema.String>;
-    readonly state: Schema.Literals<readonly ["waiting", "pending", "starting", "created", "running"]>;
-  }>, Schema.Struct<{
-    readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
-    readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-    readonly rerun: Schema.Int;
-    readonly rerunOf: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-    readonly got: Schema.Literals<readonly ["new", "joined", "answered"]>;
-    readonly reusedFrom: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-    readonly readsMoved: Schema.optionalKey<Schema.String>;
-    readonly reuseSkipped: Schema.optionalKey<Schema.String>;
-    readonly state: Schema.Literal<"ended">;
-    readonly conclusion: Schema.Literals<readonly ["success", "failure", "neutral"]>;
-    readonly reused: Schema.optionalKey<Schema.Literal<true>>;
-  }>, Schema.Struct<{
-    readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
-    readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-    readonly rerun: Schema.Int;
-    readonly rerunOf: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-    readonly got: Schema.Literals<readonly ["new", "joined", "answered"]>;
-    readonly reusedFrom: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-    readonly readsMoved: Schema.optionalKey<Schema.String>;
-    readonly reuseSkipped: Schema.optionalKey<Schema.String>;
-    readonly state: Schema.Literal<"ended">;
-    readonly error: Schema.Literals<readonly ["timeout", "threw", "invalid output", "unavailable", "expired", "cancelled"]>;
-  }>]>>;
-}>, Schema.Struct<{
-  readonly waiting: Schema.Struct<{
-    readonly start: Schema.brand<Schema.TemplateLiteral<readonly ["startwait_", Schema.String]>, "StartWaitId">;
-    readonly check: Schema.brand<Schema.String, "CheckName">;
-    readonly params: Schema.$Array<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
-    readonly thread: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["thread_", Schema.String]>, "ThreadId">>;
-    readonly waitingSince: Schema.DateTimeUtcFromString;
-    readonly endsAt: Schema.DateTimeUtcFromString;
-    readonly runs: Schema.$Array<Schema.Struct<{
-      readonly workflow: Schema.brand<Schema.String, "WorkflowName">;
-      readonly run: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["workflowrun_", Schema.String]>, "WorkflowRunId">>;
-      readonly title: Schema.optionalKey<Schema.String>;
-      readonly state: Schema.Literals<readonly ["starting", "going", "allowed", "refused", "failed"]>;
-      readonly leaves: Schema.$Array<Schema.Struct<{
-        readonly kind: Schema.Literals<readonly ["ask", "passkey"]>;
-        readonly state: Schema.Literals<readonly ["waiting", "answered", "ended"]>;
-        readonly since: Schema.DateTimeUtcFromString;
-        readonly who: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
-          readonly kind: Schema.Literal<"person">;
-          readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-          readonly name: Schema.optionalKey<Schema.brand<Schema.String, "OwnerName">>;
-        }>, Schema.Struct<{
-          readonly kind: Schema.Literal<"agent">;
-          readonly handle: Schema.brand<Schema.String, "AgentHandle">;
-        }>, Schema.Struct<{
-          readonly kind: Schema.Literal<"holders">;
-          readonly permission: Schema.String;
-        }>]>>;
-        readonly what: Schema.optionalKey<Schema.String>;
-        readonly answer: Schema.optionalKey<Schema.String>;
-      }>>;
-    }>>;
-  }>;
-}>]>>, Schema.toCodecJson<typeof NotPermitted | typeof ThreadNotFound | typeof RepoNotFound | typeof RequestChanged | typeof RunsBusy | typeof RunRefused | typeof RunUnavailable | typeof CheckNotFound | typeof NoThreadHead>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"report", "POST", "/v1/repos/:owner/:repo/runs/local", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-  repo: Schema.brand<Schema.String, "RepoName">;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-  readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
-  readonly thread: Schema.brand<Schema.String, "WrittenThread">;
-  readonly check: Schema.brand<Schema.String, "CheckName">;
-  readonly code: Schema.Struct<{
-    readonly version: Schema.brand<Schema.String, "CheckCodeVersion">;
-    readonly origin: Schema.Literals<readonly ["main", "thread", "project"]>;
-  }>;
-  readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-  readonly tree: Schema.brand<Schema.String, "TreeOid">;
-  readonly result: Schema.Union<readonly [Schema.Struct<{
-    readonly conclusion: Schema.Literals<readonly ["success", "failure", "neutral"]>;
-    readonly output: Schema.optionalKey<Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-    readonly needs: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
-      readonly kind: Schema.Literal<"review">;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"accountable">;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"admin">;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"permission">;
-      readonly name: Schema.brand<Schema.String, "RepoPermissionName">;
-    }>]>>>;
-  }>, Schema.Struct<{
-    readonly error: Schema.Literals<readonly ["threw", "invalid output", "timeout"]>;
-    readonly why: Schema.optionalKey<Schema.String>;
-  }>]>;
-  readonly outputsHash: Schema.String;
-  readonly attachment: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">>;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-  readonly run: Schema.Union<readonly [Schema.Struct<{
-    readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
-    readonly check: Schema.brand<Schema.String, "CheckName">;
-    readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-    readonly rerun: Schema.Int;
-    readonly rerunOf: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-    readonly tree: Schema.brand<Schema.String, "TreeOid">;
-    readonly origin: Schema.Literals<readonly ["main", "thread", "project"]>;
-    readonly createdAt: Schema.DateTimeUtcFromMillis;
-    readonly startedAt: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
-    readonly endedAt: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
-    readonly starters: Schema.$Array<Schema.Struct<{
-      readonly actor: Schema.Union<readonly [Schema.Struct<{
-        readonly kind: Schema.Literal<"person">;
-        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-      }>, Schema.Struct<{
-        readonly kind: Schema.Literal<"agent">;
-        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-      }>, Schema.Struct<{
-        readonly kind: Schema.Literal<"ref0">;
-        readonly id: Schema.Literals<("ref0:attachments" | "ref0:barrier" | "ref0:blockers" | "ref0:checks" | "ref0:gate" | "ref0:hooks" | "ref0:importer" | "ref0:invitations" | "ref0:listings" | "ref0:mirror" | "ref0:needs" | "ref0:oauth" | "ref0:owners" | "ref0:plans" | "ref0:prepare" | "ref0:project-gate" | "ref0:pushes" | "ref0:queue" | "ref0:rebuilder" | "ref0:sessions" | "ref0:sign-in" | "ref0:stages" | "ref0:sweeper" | "ref0:usage" | "ref0:warm-up" | "ref0:workflows")[]>;
-      }>]>;
-      readonly request: Schema.String;
-      readonly at: Schema.DateTimeUtcFromMillis;
-    }>>;
-    readonly local: Schema.optionalKey<Schema.Struct<{
-      readonly attachment: Schema.Struct<{
-        readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
-      }>;
-      readonly agent: Schema.optionalKey<Schema.Struct<{
-        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-      }>>;
-    }>>;
-    readonly routes: Schema.optionalKey<Schema.Struct<{
-      readonly requests: Schema.Int;
-      readonly omitted: Schema.Int;
-      readonly trace: Schema.Literals<readonly ["pending", "kept", "failed"]>;
-      readonly refusals: Schema.$Array<Schema.Struct<{
-        readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
-        readonly step: Schema.String;
-        readonly count: Schema.Int;
-        readonly attempt: Schema.Int;
-        readonly provenance: Schema.Literals<readonly ["observed", "reported"]>;
-        readonly why: Schema.Literals<readonly ["scheme", "https", "host", "port", "websocket", "webrtc", "deadline", "ended", "not yours", "closed", "browse closed", "fenced", "not open", "not served", "stopped", "unreachable", "too many", "unavailable"]>;
-        readonly recovery: Schema.String;
-        readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["sbxsession_", Schema.String]>, "SandboxSessionId">;
-        readonly url: Schema.String;
-      }>>;
-      readonly refusalsOmitted: Schema.Int;
-      readonly reported: Schema.$Array<Schema.Struct<{
-        readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
-        readonly step: Schema.String;
-        readonly count: Schema.Int;
-        readonly attempt: Schema.Int;
-        readonly provenance: Schema.Literals<readonly ["observed", "reported"]>;
-        readonly why: Schema.Literals<readonly ["scheme", "https", "host", "port", "websocket", "webrtc", "deadline", "ended", "not yours", "closed", "browse closed", "fenced", "not open", "not served", "stopped", "unreachable", "too many", "unavailable"]>;
-        readonly recovery: Schema.String;
-        readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["sbxsession_", Schema.String]>, "SandboxSessionId">;
-        readonly url: Schema.String;
-      }>>;
-      readonly reportedOmitted: Schema.Int;
-    }>>;
-    readonly browsers: Schema.optionalKey<Schema.Struct<{
-      readonly browses: Schema.Int;
-      readonly closing: Schema.Int;
-      readonly unconfirmed: Schema.Int;
-      readonly lastError: Schema.optionalKey<Schema.String>;
-      readonly unresolved: Schema.Int;
-      readonly presumedExpired: Schema.Int;
-      readonly browserMs: Schema.Int;
-      readonly estimated: Schema.Boolean;
-    }>>;
-    readonly state: Schema.Literals<readonly ["waiting", "pending", "starting", "created", "running"]>;
-  }>, Schema.Struct<{
-    readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
-    readonly check: Schema.brand<Schema.String, "CheckName">;
-    readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-    readonly rerun: Schema.Int;
-    readonly rerunOf: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-    readonly tree: Schema.brand<Schema.String, "TreeOid">;
-    readonly origin: Schema.Literals<readonly ["main", "thread", "project"]>;
-    readonly createdAt: Schema.DateTimeUtcFromMillis;
-    readonly startedAt: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
-    readonly endedAt: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
-    readonly starters: Schema.$Array<Schema.Struct<{
-      readonly actor: Schema.Union<readonly [Schema.Struct<{
-        readonly kind: Schema.Literal<"person">;
-        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-      }>, Schema.Struct<{
-        readonly kind: Schema.Literal<"agent">;
-        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-      }>, Schema.Struct<{
-        readonly kind: Schema.Literal<"ref0">;
-        readonly id: Schema.Literals<("ref0:attachments" | "ref0:barrier" | "ref0:blockers" | "ref0:checks" | "ref0:gate" | "ref0:hooks" | "ref0:importer" | "ref0:invitations" | "ref0:listings" | "ref0:mirror" | "ref0:needs" | "ref0:oauth" | "ref0:owners" | "ref0:plans" | "ref0:prepare" | "ref0:project-gate" | "ref0:pushes" | "ref0:queue" | "ref0:rebuilder" | "ref0:sessions" | "ref0:sign-in" | "ref0:stages" | "ref0:sweeper" | "ref0:usage" | "ref0:warm-up" | "ref0:workflows")[]>;
-      }>]>;
-      readonly request: Schema.String;
-      readonly at: Schema.DateTimeUtcFromMillis;
-    }>>;
-    readonly local: Schema.optionalKey<Schema.Struct<{
-      readonly attachment: Schema.Struct<{
-        readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
-      }>;
-      readonly agent: Schema.optionalKey<Schema.Struct<{
-        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-      }>>;
-    }>>;
-    readonly routes: Schema.optionalKey<Schema.Struct<{
-      readonly requests: Schema.Int;
-      readonly omitted: Schema.Int;
-      readonly trace: Schema.Literals<readonly ["pending", "kept", "failed"]>;
-      readonly refusals: Schema.$Array<Schema.Struct<{
-        readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
-        readonly step: Schema.String;
-        readonly count: Schema.Int;
-        readonly attempt: Schema.Int;
-        readonly provenance: Schema.Literals<readonly ["observed", "reported"]>;
-        readonly why: Schema.Literals<readonly ["scheme", "https", "host", "port", "websocket", "webrtc", "deadline", "ended", "not yours", "closed", "browse closed", "fenced", "not open", "not served", "stopped", "unreachable", "too many", "unavailable"]>;
-        readonly recovery: Schema.String;
-        readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["sbxsession_", Schema.String]>, "SandboxSessionId">;
-        readonly url: Schema.String;
-      }>>;
-      readonly refusalsOmitted: Schema.Int;
-      readonly reported: Schema.$Array<Schema.Struct<{
-        readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
-        readonly step: Schema.String;
-        readonly count: Schema.Int;
-        readonly attempt: Schema.Int;
-        readonly provenance: Schema.Literals<readonly ["observed", "reported"]>;
-        readonly why: Schema.Literals<readonly ["scheme", "https", "host", "port", "websocket", "webrtc", "deadline", "ended", "not yours", "closed", "browse closed", "fenced", "not open", "not served", "stopped", "unreachable", "too many", "unavailable"]>;
-        readonly recovery: Schema.String;
-        readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["sbxsession_", Schema.String]>, "SandboxSessionId">;
-        readonly url: Schema.String;
-      }>>;
-      readonly reportedOmitted: Schema.Int;
-    }>>;
-    readonly browsers: Schema.optionalKey<Schema.Struct<{
-      readonly browses: Schema.Int;
-      readonly closing: Schema.Int;
-      readonly unconfirmed: Schema.Int;
-      readonly lastError: Schema.optionalKey<Schema.String>;
-      readonly unresolved: Schema.Int;
-      readonly presumedExpired: Schema.Int;
-      readonly browserMs: Schema.Int;
-      readonly estimated: Schema.Boolean;
-    }>>;
+    readonly got: Schema.Literals<readonly ["new", "joined", "answered"]>;
+    readonly reusedFrom: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
+    readonly readsMoved: Schema.optionalKey<Schema.String>;
+    readonly reuseSkipped: Schema.optionalKey<Schema.String>;
     readonly state: Schema.Literal<"ended">;
     readonly conclusion: Schema.Literals<readonly ["success", "failure", "neutral"]>;
+    readonly reused: Schema.optionalKey<Schema.Literal<true>>;
   }>, Schema.Struct<{
     readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
-    readonly check: Schema.brand<Schema.String, "CheckName">;
     readonly params: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
     readonly rerun: Schema.Int;
     readonly rerunOf: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
-    readonly tree: Schema.brand<Schema.String, "TreeOid">;
-    readonly origin: Schema.Literals<readonly ["main", "thread", "project"]>;
-    readonly createdAt: Schema.DateTimeUtcFromMillis;
-    readonly startedAt: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
-    readonly endedAt: Schema.optionalKey<Schema.DateTimeUtcFromMillis>;
-    readonly starters: Schema.$Array<Schema.Struct<{
-      readonly actor: Schema.Union<readonly [Schema.Struct<{
-        readonly kind: Schema.Literal<"person">;
-        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-      }>, Schema.Struct<{
-        readonly kind: Schema.Literal<"agent">;
-        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-      }>, Schema.Struct<{
-        readonly kind: Schema.Literal<"ref0">;
-        readonly id: Schema.Literals<("ref0:attachments" | "ref0:barrier" | "ref0:blockers" | "ref0:checks" | "ref0:gate" | "ref0:hooks" | "ref0:importer" | "ref0:invitations" | "ref0:listings" | "ref0:mirror" | "ref0:needs" | "ref0:oauth" | "ref0:owners" | "ref0:plans" | "ref0:prepare" | "ref0:project-gate" | "ref0:pushes" | "ref0:queue" | "ref0:rebuilder" | "ref0:sessions" | "ref0:sign-in" | "ref0:stages" | "ref0:sweeper" | "ref0:usage" | "ref0:warm-up" | "ref0:workflows")[]>;
-      }>]>;
-      readonly request: Schema.String;
-      readonly at: Schema.DateTimeUtcFromMillis;
-    }>>;
-    readonly local: Schema.optionalKey<Schema.Struct<{
-      readonly attachment: Schema.Struct<{
-        readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
-      }>;
-      readonly agent: Schema.optionalKey<Schema.Struct<{
-        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-      }>>;
-    }>>;
-    readonly routes: Schema.optionalKey<Schema.Struct<{
-      readonly requests: Schema.Int;
-      readonly omitted: Schema.Int;
-      readonly trace: Schema.Literals<readonly ["pending", "kept", "failed"]>;
-      readonly refusals: Schema.$Array<Schema.Struct<{
-        readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
-        readonly step: Schema.String;
-        readonly count: Schema.Int;
-        readonly attempt: Schema.Int;
-        readonly provenance: Schema.Literals<readonly ["observed", "reported"]>;
-        readonly why: Schema.Literals<readonly ["scheme", "https", "host", "port", "websocket", "webrtc", "deadline", "ended", "not yours", "closed", "browse closed", "fenced", "not open", "not served", "stopped", "unreachable", "too many", "unavailable"]>;
-        readonly recovery: Schema.String;
-        readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["sbxsession_", Schema.String]>, "SandboxSessionId">;
-        readonly url: Schema.String;
-      }>>;
-      readonly refusalsOmitted: Schema.Int;
-      readonly reported: Schema.$Array<Schema.Struct<{
-        readonly run: Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">;
-        readonly step: Schema.String;
-        readonly count: Schema.Int;
-        readonly attempt: Schema.Int;
-        readonly provenance: Schema.Literals<readonly ["observed", "reported"]>;
-        readonly why: Schema.Literals<readonly ["scheme", "https", "host", "port", "websocket", "webrtc", "deadline", "ended", "not yours", "closed", "browse closed", "fenced", "not open", "not served", "stopped", "unreachable", "too many", "unavailable"]>;
-        readonly recovery: Schema.String;
-        readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["sbxsession_", Schema.String]>, "SandboxSessionId">;
-        readonly url: Schema.String;
-      }>>;
-      readonly reportedOmitted: Schema.Int;
-    }>>;
-    readonly browsers: Schema.optionalKey<Schema.Struct<{
-      readonly browses: Schema.Int;
-      readonly closing: Schema.Int;
-      readonly unconfirmed: Schema.Int;
-      readonly lastError: Schema.optionalKey<Schema.String>;
-      readonly unresolved: Schema.Int;
-      readonly presumedExpired: Schema.Int;
-      readonly browserMs: Schema.Int;
-      readonly estimated: Schema.Boolean;
-    }>>;
+    readonly got: Schema.Literals<readonly ["new", "joined", "answered"]>;
+    readonly reusedFrom: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["checkrun_", Schema.String]>, "CheckRunId">>;
+    readonly readsMoved: Schema.optionalKey<Schema.String>;
+    readonly reuseSkipped: Schema.optionalKey<Schema.String>;
     readonly state: Schema.Literal<"ended">;
     readonly error: Schema.Literals<readonly ["timeout", "threw", "invalid output", "unavailable", "expired", "cancelled"]>;
-  }>]>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof ThreadNotFound | typeof RepoNotFound | typeof RequestChanged | typeof RunsBusy | typeof RunUnavailable | typeof LocalRunRefused>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"restoreSigner", "POST", "/v1/repos/:owner/:repo/checks/signers/restore", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-  repo: Schema.brand<Schema.String, "RepoName">;
-}>>, never, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
-  readonly check: Schema.brand<Schema.String, "CheckKey">;
-  readonly attachment: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
-}>, Schema.Struct<{
-  readonly check: Schema.brand<Schema.String, "CheckKey">;
-  readonly person: Schema.brand<Schema.String, "OwnerName">;
-}>]>>, never, Schema.toCodecJson<Schema.Union<readonly [Schema.Struct<{
-  readonly check: Schema.brand<Schema.String, "CheckKey">;
-  readonly attachment: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+  }>]>>;
 }>, Schema.Struct<{
-  readonly check: Schema.brand<Schema.String, "CheckKey">;
-  readonly person: Schema.brand<Schema.String, "OwnerName">;
-}>]>>, Schema.toCodecJson<typeof NotPermitted | typeof RepoNotFound | typeof SignerNotRevoked>, Authorization, never>, false>;
+  readonly waiting: Schema.Struct<{
+    readonly start: Schema.brand<Schema.TemplateLiteral<readonly ["startwait_", Schema.String]>, "StartWaitId">;
+    readonly check: Schema.brand<Schema.String, "CheckName">;
+    readonly params: Schema.$Array<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
+    readonly thread: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["thread_", Schema.String]>, "ThreadId">>;
+    readonly waitingSince: Schema.DateTimeUtcFromString;
+    readonly endsAt: Schema.DateTimeUtcFromString;
+    readonly runs: Schema.$Array<Schema.Struct<{
+      readonly workflow: Schema.brand<Schema.String, "WorkflowName">;
+      readonly run: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["workflowrun_", Schema.String]>, "WorkflowRunId">>;
+      readonly title: Schema.optionalKey<Schema.String>;
+      readonly state: Schema.Literals<readonly ["starting", "going", "allowed", "refused", "failed"]>;
+      readonly leaves: Schema.$Array<Schema.Struct<{
+        readonly kind: Schema.Literals<readonly ["ask", "passkey"]>;
+        readonly state: Schema.Literals<readonly ["waiting", "answered", "ended"]>;
+        readonly since: Schema.DateTimeUtcFromString;
+        readonly who: Schema.optionalKey<Schema.Union<readonly [Schema.Struct<{
+          readonly kind: Schema.Literal<"person">;
+          readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+          readonly name: Schema.optionalKey<Schema.brand<Schema.String, "OwnerName">>;
+        }>, Schema.Struct<{
+          readonly kind: Schema.Literal<"agent">;
+          readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+        }>, Schema.Struct<{
+          readonly kind: Schema.Literal<"holders">;
+          readonly permission: Schema.String;
+        }>]>>;
+        readonly what: Schema.optionalKey<Schema.String>;
+        readonly answer: Schema.optionalKey<Schema.String>;
+      }>>;
+    }>>;
+  }>;
+}>]>>, Schema.toCodecJson<typeof NotPermitted | typeof ThreadNotFound | typeof RepoNotFound | typeof RequestChanged | typeof RunsBusy | typeof RunRefused | typeof StartNotFound | typeof RunUnavailable>, Authorization, never>, false>;
 /**
  * A repo's check runs: starting them, on `main` or a thread's head, for whoever's token reaches
  * `check:run` there, and listing them, one scope at a time, for whoever sees it. A person's start
@@ -18179,6 +18676,15 @@ declare const ClientGrantsGroup_base: HttpApiGroup.HttpApiGroup<"clientGrants",
   readonly request: Schema.String;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
   readonly redirect: Schema.String;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof ConsentRefused>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"finish", "POST", "/v1/owners/:owner/client-grants/:grant/finish", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+  grant: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+  readonly request: Schema.String;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Struct<{
+  readonly redirect: Schema.String;
 }>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof ConsentRefused>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"grant", "POST", "/v1/owners/:owner/client-grants", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
@@ -18195,23 +18701,24 @@ declare const ClientGrantsGroup_base: HttpApiGroup.HttpApiGroup<"clientGrants",
 }>>, Schema.toCodecJson<Schema.Struct<{
   readonly grant: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
   readonly client: Schema.String;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof CommandRefused | typeof ApprovalNeeded | typeof SlowDown | typeof ConsentRefused>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"finish", "POST", "/v1/owners/:owner/client-grants/:grant/finish", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-  grant: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-  readonly request: Schema.String;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Struct<{
-  readonly redirect: Schema.String;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof ConsentRefused>, Authorization, never>, false>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof CommandRefused | typeof ApprovalNeeded | typeof SlowDown | typeof ConsentRefused>, Authorization, never>, false>;
 /**
  * Client grants (layer 4, PR 11a): an outside MCP client's consent on `/connect/app`. Granting
  * runs by the person's approval, answered with their passkey; finishing, from the browser that
  * consented, hands the client its code.
  */
 declare class ClientGrantsGroup extends ClientGrantsGroup_base {}
-declare const OrganizationsGroup_base: HttpApiGroup.HttpApiGroup<"organizations", HttpApiEndpoint.HttpApiEndpoint<"leave", "DELETE", "/v1/me/organizations/:owner", Schema.toCodecStringTree<Schema.Struct<{
+declare const OrganizationsGroup_base: HttpApiGroup.HttpApiGroup<"organizations", HttpApiEndpoint.HttpApiEndpoint<"create", "POST", "/v1/organizations", never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly name: Schema.brand<Schema.String, "OwnerName">;
+  readonly displayName: Schema.optionalKey<Schema.String>;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Struct<{
+  readonly owner: Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">;
+  readonly name: Schema.brand<Schema.String, "OwnerName">;
+  readonly displayName: Schema.String;
+  readonly state: Schema.Literals<readonly ["initializing", "ready"]>;
+}>>, Schema.toCodecJson<typeof NameTaken | typeof NameReserved | typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"leave", "DELETE", "/v1/me/organizations/:owner", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
 }>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
   'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
@@ -18454,40 +18961,13 @@ declare const OrganizationsGroup_base: HttpApiGroup.HttpApiGroup<"organizations"
     }>>;
   }>;
   readonly pricesAsOf: Schema.String;
-}>]>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof UsageRangeRefused | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"create", "POST", "/v1/organizations", never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly name: Schema.brand<Schema.String, "OwnerName">;
-  readonly displayName: Schema.optionalKey<Schema.String>;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Struct<{
-  readonly owner: Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">;
-  readonly name: Schema.brand<Schema.String, "OwnerName">;
-  readonly displayName: Schema.String;
-  readonly state: Schema.Literals<readonly ["initializing", "ready"]>;
-}>>, Schema.toCodecJson<typeof NameTaken | typeof NameReserved | typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow>, Authorization, never>, false>;
+}>]>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof UsageRangeRefused | typeof OrganizationNotFound>, Authorization, never>, false>;
 /**
  * Organizations (layer 1): making one, the person's own list of theirs, leaving one, and its
  * usage. Every change is a person's, by approval; agents never change members.
  */
 declare class OrganizationsGroup extends OrganizationsGroup_base {}
-declare const MembersGroup_base: HttpApiGroup.HttpApiGroup<"members", HttpApiEndpoint.HttpApiEndpoint<"remove", "DELETE", "/v1/owners/:owner/members/:member", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-  member: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-}>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Struct<{
-  readonly member: Schema.Union<readonly [Schema.Struct<{
-    readonly kind: Schema.Literal<"person">;
-    readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-  }>, Schema.Struct<{
-    readonly kind: Schema.Literal<"agent">;
-    readonly agent: Schema.Struct<{
-      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-    }>;
-  }>]>;
-  readonly why: Schema.Literals<readonly ["removed", "left"]>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof MemberNotFound | typeof LastAdmin | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/owners/:owner/members", Schema.toCodecStringTree<Schema.Struct<{
+declare const MembersGroup_base: HttpApiGroup.HttpApiGroup<"members", HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/owners/:owner/members", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
 }>>, Schema.toCodecStringTree<Schema.Struct<{
   cursor: Schema.optionalKey<Schema.brand<Schema.String, "MemberCursor">>;
@@ -18508,7 +18988,24 @@ declare const MembersGroup_base: HttpApiGroup.HttpApiGroup<"members", HttpApiEnd
     readonly addedAt: Schema.DateTimeUtcFromMillis;
   }>>;
   readonly next: Schema.optionalKey<Schema.brand<Schema.String, "MemberCursor">>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"setRole", "PATCH", "/v1/owners/:owner/members/:member", Schema.toCodecStringTree<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"remove", "DELETE", "/v1/owners/:owner/members/:member", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+  member: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+}>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Struct<{
+  readonly member: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"person">;
+    readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"agent">;
+    readonly agent: Schema.Struct<{
+      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+    }>;
+  }>]>;
+  readonly why: Schema.Literals<readonly ["removed", "left"]>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof MemberNotFound | typeof LastAdmin | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"setRole", "PATCH", "/v1/owners/:owner/members/:member", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   member: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
@@ -18530,14 +19027,25 @@ declare const MembersGroup_base: HttpApiGroup.HttpApiGroup<"members", HttpApiEnd
 }>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof MemberNotFound | typeof LastAdmin | typeof OrganizationNotFound>, Authorization, never>, false>;
 /** An organization's members: any member lists them; an admin changes a role or removes one. */
 declare class MembersGroup extends MembersGroup_base {}
-declare const InvitationsGroup_base: HttpApiGroup.HttpApiGroup<"invitations", HttpApiEndpoint.HttpApiEndpoint<"withdraw", "DELETE", "/v1/owners/:owner/invitations/:invitation", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+declare const InvitationsGroup_base: HttpApiGroup.HttpApiGroup<"invitations", HttpApiEndpoint.HttpApiEndpoint<"accept", "POST", "/v1/me/invitations/:invitation/accept", Schema.toCodecStringTree<Schema.Struct<{
+  invitation: Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">;
+}>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Struct<{
+  readonly invitation: Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">;
+  readonly organization: Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">;
+  readonly answer: Schema.Literals<readonly ["accept", "decline"]>;
+  readonly role: Schema.Literals<readonly ["admin", "member"]>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof InvitationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"decline", "POST", "/v1/me/invitations/:invitation/decline", Schema.toCodecStringTree<Schema.Struct<{
   invitation: Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">;
 }>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
   'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
 }>>, Schema.toCodecJson<Schema.Struct<{
   readonly invitation: Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof InvitationNotFound | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/owners/:owner/invitations", Schema.toCodecStringTree<Schema.Struct<{
+  readonly organization: Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">;
+  readonly answer: Schema.Literals<readonly ["accept", "decline"]>;
+  readonly role: Schema.Literals<readonly ["admin", "member"]>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof InvitationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/owners/:owner/invitations", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
 }>>, Schema.toCodecStringTree<Schema.Struct<{
   cursor: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">>;
@@ -18569,25 +19077,7 @@ declare const InvitationsGroup_base: HttpApiGroup.HttpApiGroup<"invitations", Ht
     readonly expiresAt: Schema.DateTimeUtcFromMillis;
   }>>;
   readonly next: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"accept", "POST", "/v1/me/invitations/:invitation/accept", Schema.toCodecStringTree<Schema.Struct<{
-  invitation: Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">;
-}>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Struct<{
-  readonly invitation: Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">;
-  readonly organization: Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">;
-  readonly answer: Schema.Literals<readonly ["accept", "decline"]>;
-  readonly role: Schema.Literals<readonly ["admin", "member"]>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof InvitationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"decline", "POST", "/v1/me/invitations/:invitation/decline", Schema.toCodecStringTree<Schema.Struct<{
-  invitation: Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">;
-}>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Struct<{
-  readonly invitation: Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">;
-  readonly organization: Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">;
-  readonly answer: Schema.Literals<readonly ["accept", "decline"]>;
-  readonly role: Schema.Literals<readonly ["admin", "member"]>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof InvitationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"send", "POST", "/v1/owners/:owner/invitations", Schema.toCodecStringTree<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"send", "POST", "/v1/owners/:owner/invitations", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
   readonly invitee: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
@@ -18602,13 +19092,69 @@ declare const InvitationsGroup_base: HttpApiGroup.HttpApiGroup<"invitations", Ht
   }>;
   readonly role: Schema.Literals<readonly ["admin", "member"]>;
   readonly expiresAt: Schema.DateTimeUtcFromMillis;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof AlreadyMember | typeof InvitationOpen | typeof OrganizationNotFound | typeof PersonNotFound>, Authorization, never>, false>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof AlreadyMember | typeof InvitationOpen | typeof OrganizationNotFound | typeof PersonNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"withdraw", "DELETE", "/v1/owners/:owner/invitations/:invitation", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+  invitation: Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">;
+}>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Struct<{
+  readonly invitation: Schema.brand<Schema.TemplateLiteral<readonly ["invitation_", Schema.String]>, "InvitationId">;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof InvitationNotFound | typeof OrganizationNotFound>, Authorization, never>, false>;
 /**
  * Invitations: an organization's admins send, list and withdraw them; the person invited lists
  * theirs and accepts or declines one, which is found from their own list, never the client.
  */
 declare class InvitationsGroup extends InvitationsGroup_base {}
-declare const GrantsGroup_base: HttpApiGroup.HttpApiGroup<"grants", HttpApiEndpoint.HttpApiEndpoint<"revoke", "DELETE", "/v1/owners/:owner/grants", Schema.toCodecStringTree<Schema.Struct<{
+declare const GrantsGroup_base: HttpApiGroup.HttpApiGroup<"grants", HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/owners/:owner/grants", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  after: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["event_", Schema.String]>, "EventId">>;
+  limit: Schema.optionalKey<Schema.Int>;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly grants: Schema.$Array<Schema.Struct<{
+    readonly grant: Schema.brand<Schema.TemplateLiteral<readonly ["event_", Schema.String]>, "EventId">;
+    readonly subject: Schema.Union<readonly [Schema.Struct<{
+      readonly kind: Schema.Literal<"owner">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"project">;
+      readonly project: Schema.brand<Schema.String, "ProjectName">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"thread">;
+      readonly thread: Schema.brand<Schema.String, "WrittenThread">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"agent">;
+      readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+    }>]>;
+    readonly principal: Schema.Union<readonly [Schema.Struct<{
+      readonly kind: Schema.Literal<"person">;
+      readonly name: Schema.brand<Schema.String, "OwnerName">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"agent">;
+      readonly owner: Schema.brand<Schema.String, "OwnerName">;
+      readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"agent">;
+      readonly agent: Schema.Struct<{
+        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+      }>;
+    }>]>;
+    readonly role: Schema.Literals<readonly ["read", "write", "attach", "manage"]>;
+    readonly grantedBy: Schema.Union<readonly [Schema.Struct<{
+      readonly kind: Schema.Literal<"person">;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"agent">;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+    }>, Schema.Struct<{
+      readonly kind: Schema.Literal<"ref0">;
+      readonly id: Schema.Literals<("ref0:attachments" | "ref0:barrier" | "ref0:blockers" | "ref0:checks" | "ref0:gate" | "ref0:hooks" | "ref0:importer" | "ref0:invitations" | "ref0:listings" | "ref0:mirror" | "ref0:needs" | "ref0:oauth" | "ref0:owners" | "ref0:plans" | "ref0:prepare" | "ref0:project-gate" | "ref0:pushes" | "ref0:queue" | "ref0:rebuilder" | "ref0:sessions" | "ref0:sign-in" | "ref0:stages" | "ref0:sweeper" | "ref0:usage" | "ref0:warm-up" | "ref0:workflows")[]>;
+    }>]>;
+    readonly grantedAt: Schema.DateTimeUtcFromMillis;
+  }>>;
+  readonly nextAfter: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["event_", Schema.String]>, "EventId">>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"revoke", "DELETE", "/v1/owners/:owner/grants", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
   readonly subject: Schema.Union<readonly [Schema.Struct<{
@@ -18664,56 +19210,7 @@ declare const GrantsGroup_base: HttpApiGroup.HttpApiGroup<"grants", HttpApiEndpo
     }>;
   }>]>;
   readonly role: Schema.Literals<readonly ["read", "write", "attach", "manage"]>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof MemberNotFound | typeof OrganizationNotFound | typeof SubjectNotFound | typeof RoleNotFitting>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/owners/:owner/grants", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  after: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["event_", Schema.String]>, "EventId">>;
-  limit: Schema.optionalKey<Schema.Int>;
-}>>, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly grants: Schema.$Array<Schema.Struct<{
-    readonly grant: Schema.brand<Schema.TemplateLiteral<readonly ["event_", Schema.String]>, "EventId">;
-    readonly subject: Schema.Union<readonly [Schema.Struct<{
-      readonly kind: Schema.Literal<"owner">;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"project">;
-      readonly project: Schema.brand<Schema.String, "ProjectName">;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"thread">;
-      readonly thread: Schema.brand<Schema.String, "WrittenThread">;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"agent">;
-      readonly handle: Schema.brand<Schema.String, "AgentHandle">;
-    }>]>;
-    readonly principal: Schema.Union<readonly [Schema.Struct<{
-      readonly kind: Schema.Literal<"person">;
-      readonly name: Schema.brand<Schema.String, "OwnerName">;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"agent">;
-      readonly owner: Schema.brand<Schema.String, "OwnerName">;
-      readonly handle: Schema.brand<Schema.String, "AgentHandle">;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"agent">;
-      readonly agent: Schema.Struct<{
-        readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-        readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-      }>;
-    }>]>;
-    readonly role: Schema.Literals<readonly ["read", "write", "attach", "manage"]>;
-    readonly grantedBy: Schema.Union<readonly [Schema.Struct<{
-      readonly kind: Schema.Literal<"person">;
-      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"agent">;
-      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-    }>, Schema.Struct<{
-      readonly kind: Schema.Literal<"ref0">;
-      readonly id: Schema.Literals<("ref0:attachments" | "ref0:barrier" | "ref0:blockers" | "ref0:checks" | "ref0:gate" | "ref0:hooks" | "ref0:importer" | "ref0:invitations" | "ref0:listings" | "ref0:mirror" | "ref0:needs" | "ref0:oauth" | "ref0:owners" | "ref0:plans" | "ref0:prepare" | "ref0:project-gate" | "ref0:pushes" | "ref0:queue" | "ref0:rebuilder" | "ref0:sessions" | "ref0:sign-in" | "ref0:stages" | "ref0:sweeper" | "ref0:usage" | "ref0:warm-up" | "ref0:workflows")[]>;
-    }>]>;
-    readonly grantedAt: Schema.DateTimeUtcFromMillis;
-  }>>;
-  readonly nextAfter: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["event_", Schema.String]>, "EventId">>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"set", "PUT", "/v1/owners/:owner/grants", Schema.toCodecStringTree<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof MemberNotFound | typeof OrganizationNotFound | typeof SubjectNotFound | typeof RoleNotFitting>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"set", "PUT", "/v1/owners/:owner/grants", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
   readonly subject: Schema.Union<readonly [Schema.Struct<{
@@ -18777,10 +19274,13 @@ declare const GrantsGroup_base: HttpApiGroup.HttpApiGroup<"grants", HttpApiEndpo
  * `OrganizationNotFound`.
  */
 declare class GrantsGroup extends GrantsGroup_base {}
-declare const AgentsGroup_base: HttpApiGroup.HttpApiGroup<"agents", HttpApiEndpoint.HttpApiEndpoint<"get", "GET", "/v1/owners/:owner/agents/:agent", Schema.toCodecStringTree<Schema.Struct<{
+declare const AgentsGroup_base: HttpApiGroup.HttpApiGroup<"agents", HttpApiEndpoint.HttpApiEndpoint<"add", "POST", "/v1/owners/:owner/agents", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-  agent: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">, Schema.brand<Schema.String, "AgentHandle">]>;
-}>>, never, never, never, Schema.toCodecJson<Schema.Struct<{
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+  readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
+}>>, Schema.toCodecJson<Schema.Struct<{
   readonly agent: Schema.Struct<{
     readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
     readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
@@ -18788,25 +19288,7 @@ declare const AgentsGroup_base: HttpApiGroup.HttpApiGroup<"agents", HttpApiEndpo
   readonly handle: Schema.brand<Schema.String, "AgentHandle">;
   readonly generation: Schema.Int;
   readonly turnedOff: Schema.Boolean;
-  readonly addedAt: Schema.DateTimeUtcFromMillis;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/owners/:owner/agents", Schema.toCodecStringTree<Schema.Struct<{
-  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  after: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">>;
-  limit: Schema.optionalKey<Schema.Int>;
-}>>, never, never, Schema.toCodecJson<Schema.Struct<{
-  readonly agents: Schema.$Array<Schema.Struct<{
-    readonly agent: Schema.Struct<{
-      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
-      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
-    }>;
-    readonly handle: Schema.brand<Schema.String, "AgentHandle">;
-    readonly generation: Schema.Int;
-    readonly turnedOff: Schema.Boolean;
-    readonly addedAt: Schema.DateTimeUtcFromMillis;
-  }>>;
-  readonly nextAfter: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"disable", "POST", "/v1/owners/:owner/agents/:agent/disable", Schema.toCodecStringTree<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof HandleTaken | typeof DeliveryOutsideWindow | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"disable", "POST", "/v1/owners/:owner/agents/:agent/disable", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
   agent: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">, Schema.brand<Schema.String, "AgentHandle">]>;
 }>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
@@ -18832,13 +19314,10 @@ declare const AgentsGroup_base: HttpApiGroup.HttpApiGroup<"agents", HttpApiEndpo
   readonly handle: Schema.brand<Schema.String, "AgentHandle">;
   readonly generation: Schema.Int;
   readonly turnedOff: Schema.Boolean;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof DeliveryOutsideWindow | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"add", "POST", "/v1/owners/:owner/agents", Schema.toCodecStringTree<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof DeliveryOutsideWindow | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"get", "GET", "/v1/owners/:owner/agents/:agent", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-  readonly handle: Schema.brand<Schema.String, "AgentHandle">;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
-  'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
-}>>, Schema.toCodecJson<Schema.Struct<{
+  agent: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">, Schema.brand<Schema.String, "AgentHandle">]>;
+}>>, never, never, never, Schema.toCodecJson<Schema.Struct<{
   readonly agent: Schema.Struct<{
     readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
     readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
@@ -18846,7 +19325,25 @@ declare const AgentsGroup_base: HttpApiGroup.HttpApiGroup<"agents", HttpApiEndpo
   readonly handle: Schema.brand<Schema.String, "AgentHandle">;
   readonly generation: Schema.Int;
   readonly turnedOff: Schema.Boolean;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof HandleTaken | typeof DeliveryOutsideWindow | typeof OrganizationNotFound>, Authorization, never>, false>;
+  readonly addedAt: Schema.DateTimeUtcFromMillis;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/v1/owners/:owner/agents", Schema.toCodecStringTree<Schema.Struct<{
+  owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
+  after: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">>;
+  limit: Schema.optionalKey<Schema.Int>;
+}>>, never, never, Schema.toCodecJson<Schema.Struct<{
+  readonly agents: Schema.$Array<Schema.Struct<{
+    readonly agent: Schema.Struct<{
+      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+    }>;
+    readonly handle: Schema.brand<Schema.String, "AgentHandle">;
+    readonly generation: Schema.Int;
+    readonly turnedOff: Schema.Boolean;
+    readonly addedAt: Schema.DateTimeUtcFromMillis;
+  }>>;
+  readonly nextAfter: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof OrganizationNotFound>, Authorization, never>, false>;
 /**
  * An owner's agents (layer 1): an organization's members, or a person themselves, read them and
  * turn one off everywhere, or on again; an organization's admin adds one, and only an admin turns
@@ -18854,10 +19351,15 @@ declare const AgentsGroup_base: HttpApiGroup.HttpApiGroup<"agents", HttpApiEndpo
  * its machines' host grants by the agent's ID.
  */
 declare class AgentsGroup extends AgentsGroup_base {}
-declare const AuthorizationsGroup_base: HttpApiGroup.HttpApiGroup<"authorizations", HttpApiEndpoint.HttpApiEndpoint<"remove", "DELETE", "/v1/owners/:owner/authorizations/:attachment", Schema.toCodecStringTree<Schema.Struct<{
+declare const AuthorizationsGroup_base: HttpApiGroup.HttpApiGroup<"authorizations", HttpApiEndpoint.HttpApiEndpoint<"add", "POST", "/v1/owners/:owner/authorizations", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-  attachment: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
-}>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+  readonly agent: Schema.Struct<{
+    readonly owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
+    readonly agent: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">, Schema.brand<Schema.String, "AgentHandle">]>;
+  }>;
+  readonly attachment: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+}>>, Schema.toCodecStringTree<Schema.Struct<{
   'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
 }>>, Schema.toCodecJson<Schema.Struct<{
   readonly agent: Schema.Struct<{
@@ -18870,15 +19372,10 @@ declare const AuthorizationsGroup_base: HttpApiGroup.HttpApiGroup<"authorization
   }>;
   readonly generation: Schema.Int;
   readonly authorized: Schema.Boolean;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof AttachmentNotFound | typeof OrganizationNotFound | typeof AuthorizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"add", "POST", "/v1/owners/:owner/authorizations", Schema.toCodecStringTree<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof AgentTurnedOff | typeof DeliveryOutsideWindow | typeof AttachmentNotFound | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"remove", "DELETE", "/v1/owners/:owner/authorizations/:attachment", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-  readonly agent: Schema.Struct<{
-    readonly owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
-    readonly agent: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">, Schema.brand<Schema.String, "AgentHandle">]>;
-  }>;
-  readonly attachment: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
-}>>, Schema.toCodecStringTree<Schema.Struct<{
+  attachment: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+}>>, never, never, Schema.toCodecStringTree<Schema.Struct<{
   'idempotency-key': Schema.brand<Schema.TemplateLiteral<readonly ["request_", Schema.String]>, "RequestId">;
 }>>, Schema.toCodecJson<Schema.Struct<{
   readonly agent: Schema.Struct<{
@@ -18891,7 +19388,7 @@ declare const AuthorizationsGroup_base: HttpApiGroup.HttpApiGroup<"authorization
   }>;
   readonly generation: Schema.Int;
   readonly authorized: Schema.Boolean;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof AgentNotFound | typeof AgentTurnedOff | typeof DeliveryOutsideWindow | typeof AttachmentNotFound | typeof OrganizationNotFound>, Authorization, never>, false>;
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof DeliveryOutsideWindow | typeof AttachmentNotFound | typeof OrganizationNotFound | typeof AuthorizationNotFound>, Authorization, never>, false>;
 /**
  * A member's own agent working in an organization (layer 1): its person authorizes an attachment
  * of it there, by its credential's ID, or takes that back. The Worker checks the attachment is
@@ -18899,7 +19396,7 @@ declare const AuthorizationsGroup_base: HttpApiGroup.HttpApiGroup<"authorization
  * decides. People only, by approval.
  */
 declare class AuthorizationsGroup extends AuthorizationsGroup_base {}
-declare const AgentDisablesGroup_base: HttpApiGroup.HttpApiGroup<"agentDisables", HttpApiEndpoint.HttpApiEndpoint<"remove", "DELETE", "/v1/owners/:owner/agent-disables", Schema.toCodecStringTree<Schema.Struct<{
+declare const AgentDisablesGroup_base: HttpApiGroup.HttpApiGroup<"agentDisables", HttpApiEndpoint.HttpApiEndpoint<"add", "POST", "/v1/owners/:owner/agent-disables", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
   readonly agent: Schema.Struct<{
@@ -18942,7 +19439,7 @@ declare const AgentDisablesGroup_base: HttpApiGroup.HttpApiGroup<"agentDisables"
     readonly disabledAt: Schema.DateTimeUtcFromMillis;
   }>>;
   readonly nextAfter: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">>;
-}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"add", "POST", "/v1/owners/:owner/agent-disables", Schema.toCodecStringTree<Schema.Struct<{
+}>>, Schema.toCodecJson<typeof NotPermitted | typeof AuthorityUnavailable | typeof OrganizationNotFound>, Authorization, never> | HttpApiEndpoint.HttpApiEndpoint<"remove", "DELETE", "/v1/owners/:owner/agent-disables", Schema.toCodecStringTree<Schema.Struct<{
   owner: Schema.Union<readonly [Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>, Schema.brand<Schema.String, "OwnerName">]>;
 }>>, never, Schema.toCodecJson<Schema.Struct<{
   readonly agent: Schema.Struct<{
@@ -19526,6 +20023,9 @@ declare const CheckStartAnswer: Schema.Union<readonly [Schema.Struct<{
   readonly why: Schema.String;
 }>]>;
 type CheckStartAnswer = typeof CheckStartAnswer.Type;
+/** An answer's key: `yes`, `no`, or an ask's own, such as `close`. */
+declare const AnswerKey: Schema.brand<Schema.String, "AnswerKey">;
+type AnswerKey = typeof AnswerKey.Type;
 //#endregion
 //#region src/workflows.d.ts
 /**
@@ -21703,6 +22203,60 @@ declare const ReadEvent: Schema.Union<readonly [Schema.Union<readonly [Schema.St
   }>;
 } & {
   readonly seq: Schema.Int;
+}>, Schema.Struct<{
+  readonly log: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">, Schema.brand<Schema.TemplateLiteral<readonly ["project_", Schema.String]>, "ProjectId">]>;
+  readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["event_", Schema.String]>, "EventId">;
+  readonly writer: Schema.Union<readonly [Schema.Literal<"directory">, Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">, Schema.brand<Schema.TemplateLiteral<readonly ["project_", Schema.String]>, "ProjectId">, Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">, Schema.brand<Schema.TemplateLiteral<readonly ["usage:", Schema.String]>, "UsageLogId">]>;
+  readonly writerSeq: Schema.Int;
+  readonly at: Schema.DateTimeUtcFromMillis;
+  readonly schemaVersion: Schema.Literal<1>;
+  readonly actor: Schema.Union<readonly [Schema.Struct<{
+    readonly kind: Schema.Literal<"person">;
+    readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"agent">;
+    readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+    readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+  }>, Schema.Struct<{
+    readonly kind: Schema.Literal<"ref0">;
+    readonly id: Schema.Literals<("ref0:attachments" | "ref0:barrier" | "ref0:blockers" | "ref0:checks" | "ref0:gate" | "ref0:hooks" | "ref0:importer" | "ref0:invitations" | "ref0:listings" | "ref0:mirror" | "ref0:needs" | "ref0:oauth" | "ref0:owners" | "ref0:plans" | "ref0:prepare" | "ref0:project-gate" | "ref0:pushes" | "ref0:queue" | "ref0:rebuilder" | "ref0:sessions" | "ref0:sign-in" | "ref0:stages" | "ref0:sweeper" | "ref0:usage" | "ref0:warm-up" | "ref0:workflows")[]>;
+  }>]>;
+  readonly token: Schema.optionalKey<Schema.Struct<{
+    readonly person: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+    readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["token_", Schema.String]>, "TokenId">;
+  }>>;
+  readonly draftedBy: Schema.optionalKey<Schema.Struct<{
+    readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+    readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+  }>>;
+  readonly cause: Schema.optionalKey<Schema.Struct<{
+    readonly log: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">, Schema.brand<Schema.TemplateLiteral<readonly ["project_", Schema.String]>, "ProjectId">, Schema.brand<Schema.TemplateLiteral<readonly ["usage:", Schema.String]>, "UsageLogId">]>;
+    readonly event: Schema.brand<Schema.TemplateLiteral<readonly ["event_", Schema.String]>, "EventId">;
+  }>>;
+  readonly thread: Schema.optionalKey<Schema.brand<Schema.TemplateLiteral<readonly ["thread_", Schema.String]>, "ThreadId">>;
+  readonly refs: Schema.$Array<Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["thread_", Schema.String]>, "ThreadId">, Schema.brand<Schema.TemplateLiteral<readonly ["repo_", Schema.String]>, "RepoId">]>>;
+  readonly source: Schema.optionalKey<Schema.Struct<{
+    readonly system: Schema.String;
+    readonly deliveryId: Schema.String;
+  }>>;
+  readonly trace: Schema.optionalKey<Schema.String>;
+  readonly kind: Schema.Literal<"identity_token.issued">;
+  readonly data: Schema.Struct<{
+    readonly session: Schema.brand<Schema.TemplateLiteral<readonly ["session_", Schema.String]>, "SessionId">;
+    readonly agent: Schema.Struct<{
+      readonly owner: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">]>;
+      readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["agent_", Schema.String]>, "AgentId">;
+    }>;
+    readonly accountable: Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">;
+    readonly jti: Schema.brand<Schema.String, "IdentityTokenId">;
+    readonly audience: Schema.brand<Schema.String, "IdentityAudience">;
+    readonly issuer: Schema.brand<Schema.String, "ApiOrigin">;
+    readonly keyId: Schema.brand<Schema.String, "SigningKeyId">;
+    readonly issuedAt: Schema.DateTimeUtcFromMillis;
+    readonly expiresAt: Schema.DateTimeUtcFromMillis;
+  }>;
+} & {
+  readonly seq: Schema.Int;
 }>, Schema.Struct<{
   readonly log: Schema.Union<readonly [Schema.brand<Schema.TemplateLiteral<readonly ["person_", Schema.String]>, "PersonId">, Schema.brand<Schema.TemplateLiteral<readonly ["org_", Schema.String]>, "OrgId">, Schema.brand<Schema.TemplateLiteral<readonly ["project_", Schema.String]>, "ProjectId">]>;
   readonly id: Schema.brand<Schema.TemplateLiteral<readonly ["event_", Schema.String]>, "EventId">;
@@ -28669,11 +29223,20 @@ type ThreadStage = typeof ThreadStage.Type;
 /** A project, `owner/project`. */
 declare const WrittenProject: Schema.brand<Schema.String, "WrittenProject">;
 type WrittenProject = typeof WrittenProject.Type;
+/** A thread, `owner/project#number`, or an org thread, `owner#number`. */
+declare const WrittenThread: Schema.brand<Schema.String, "WrittenThread">;
+type WrittenThread = typeof WrittenThread.Type;
 /** A written project's parts, as an endpoint's path takes them. */
 declare const projectParts: (written: WrittenProject) => {
   owner: string;
   project: string;
 };
+/** A written thread's parts, as an endpoint's path takes them: no project for an org thread. */
+declare const threadParts: (written: WrittenThread) => {
+  owner: string;
+  project: string | undefined;
+  number: string;
+};
 /** An action a run's code asks for, at its place in the run. */
 declare const WorkflowAction: Schema.Struct<{
   readonly place: Schema.Struct<{
@@ -29206,5 +29769,5 @@ declare const SandboxExecAnswer: Schema.Union<readonly [Schema.Struct<{
 }>]>;
 type SandboxExecAnswer = typeof SandboxExecAnswer.Type;
 //#endregion
-export { MirrorEntry as $, WorkflowAskClosed as $t, ConnectionCallAnswer as A, WorkflowPreview as An, ScopeAction as At, EventRunInput as B, commandLine as Bn, StatementView as Bt, ConnectAgent as C, WorkflowOwn as Cn, SandboxExec as Ct, ConnectOptions as D, WorkflowPasskeyRead as Dn, SandboxPush as Dt, ConnectFolderOption as E, WorkflowPasskeyEnded as En, SandboxOpenAnswer as Et, ConsentAsked as F, WorkflowStartState as Fn, SignInDestination as Ft, GetIssueInput as G, isRef0Path as Gn, TrackThread as Gt, ForkAnswer as H, encodeSecret as Hn, ThreadStage as Ht, ConsentClient as I, WorkflowText as In, SignedIn as It, LiveTicket as J, repoNameKey as Jn, Welcome as Jt, Harness as K, liveSocketUrl as Kn, TypedApprovalCode as Kt, ConsentProject as L, WorkflowThreadStart as Ln, SocketUrl as Lt, ConnectionKind as M, WorkflowPullRequestOpen as Mn, SentryOrg as Mt, ConnectionName as N, WorkflowRequestRefusal as Nn, SentryRegion as Nt, ConnectableAgent as O, WorkflowPasskeyState as On, SandboxPushAnswer as Ot, ConnectionView as P, WorkflowStartEnded as Pn, SentryToken as Pt, MirrorChoice as Q, WorkflowAsk as Qt, CredentialView as R, WorkflowTrigger as Rn, StartActor as Rt, ClientGranted as S, WorkflowFilters as Sn, RequestFolder as St, ConnectFolderChoices as T, WorkflowPasskeyAsked as Tn, SandboxOpen as Tt, ForkCreate as U, hookTokenPrefix as Un, TrackClosed as Ut, FoldersConnected as V, connectEndpoint as Vn, ThreadId as Vt, GateOwn as W, hookUrl as Wn, TrackSession as Wt, LiveTrackName as X, WorkflowActionAnswer as Xt, LiveTicketRequest as Y, surfaceOf as Yn, WorkflowAction as Yt, MachineConnected as Z, WorkflowAnswerer as Zt, CheckOwn as _, WorkflowCheckStatesAnswer as _n, ReadEvent as _t, Api as a, WorkflowCallRefused as an, OwnerTrackMessage as at, CheckTreeEntry as b, WorkflowConnections as bn, RepoUrl as bt, ApprovalId as c, WorkflowCheckRefusal as cn, PasskeyCreationOptions as ct, ApprovalView as d, WorkflowCheckResultsAnswer as dn, PasskeyRequestOptions as dt, WorkflowCall as en, MirrorView as et, AttachmentFailed as f, WorkflowCheckRun as fn, PreviewEcho as ft, CheckOn as g, WorkflowCheckStates as gn, RanOf as gt, ChangeAuthor as h, WorkflowCheckStartAnswer as hn, ProjectTrackMessage as ht, AgentView as i, WorkflowCallRefusal as in, OwnerThreadView as it, ConnectionChanged as j, WorkflowPullRequestAnswer as jn, SecretHash as jt, ConnectionCall as k, WorkflowPermissions as kn, SandboxSize as kt, ApprovalPreview as l, WorkflowCheckRefused as ln, PasskeyFrom as lt, Authorization as m, WorkflowCheckStart as mn, ProjectName as mt, AgentPermissionChoice as n, WorkflowCallEnded as nn, OwnerName as nt, ApiOrigin as o, WorkflowCalledState as on, PasskeyAsserted as ot, AttachmentRequestView as p, WorkflowCheckRunEnded as pn, PreviewUnavailable as pt, ImportFailure as q, projectParts as qn, VersionFile as qt, AgentPermissionSetting as r, WorkflowCallInput as rn, OwnerThreadPage as rt, ApprovalAnswer as s, WorkflowCalledStateAnswer as sn, PasskeyCreated as st, AgentHandle as t, WorkflowCallAnswer as tn, OwnerId as tt, ApprovalState as u, WorkflowCheckResults as un, PasskeyRefusal as ut, CheckRunError as v, WorkflowCheckWhere as vn, Ref0Owned as vt, ConnectChosen as w, WorkflowPasskeyAsk as wn, SandboxExecAnswer as wt, ClientAccess as x, WorkflowEvent as xn, RepoView as xt, CheckRunParams as y, WorkflowComment as yn, RepoName as yt, EndpointName as z, WrittenProject as zn, StartRun as zt };
-//# sourceMappingURL=index-Db86z11q.d.mts.map
+export { MirrorChoice as $, WorkflowAnswerer as $t, ConnectionCall as A, WorkflowPasskeyState as An, SandboxPushAnswer as At, EndpointName as B, WorkflowTrigger as Bn, StartActor as Bt, ClientGranted as C, WorkflowEvent as Cn, RepoView as Ct, ConnectFolderOption as D, WorkflowPasskeyAsked as Dn, SandboxOpen as Dt, ConnectFolderChoices as E, WorkflowPasskeyAsk as En, SandboxExecAnswer as Et, ConnectionView as F, WorkflowRequestRefusal as Fn, SentryRegion as Ft, GateOwn as G, hookTokenPrefix as Gn, TrackClosed as Gt, FoldersConnected as H, commandLine as Hn, StatementView as Ht, ConsentAsked as I, WorkflowStartEnded as In, SentryToken as It, ImportFailure as J, liveSocketUrl as Jn, TypedApprovalCode as Jt, GetIssueInput as K, hookUrl as Kn, TrackSession as Kt, ConsentClient as L, WorkflowStartState as Ln, SignInDestination as Lt, ConnectionChanged as M, WorkflowPreview as Mn, ScopeAction as Mt, ConnectionKind as N, WorkflowPullRequestAnswer as Nn, SecretHash as Nt, ConnectOptions as O, WorkflowPasskeyEnded as On, SandboxOpenAnswer as Ot, ConnectionName as P, WorkflowPullRequestOpen as Pn, SentryOrg as Pt, MachineConnected as Q, threadParts as Qn, WorkflowActionAnswer as Qt, ConsentProject as R, WorkflowText as Rn, SignedIn as Rt, ClientAccess as S, WorkflowConnections as Sn, RepoUrl as St, ConnectChosen as T, WorkflowOwn as Tn, SandboxExec as Tt, ForkAnswer as U, connectEndpoint as Un, ThreadId as Ut, EventRunInput as V, WrittenProject as Vn, StartRun as Vt, ForkCreate as W, encodeSecret as Wn, ThreadStage as Wt, LiveTicketRequest as X, repoNameKey as Xn, Welcome as Xt, LiveTicket as Y, projectParts as Yn, VersionFile as Yt, LiveTrackName as Z, surfaceOf as Zn, WorkflowAction as Zt, CheckOn as _, WorkflowCheckStartAnswer as _n, ProjectTrackMessage as _t, AnswerKey as a, WorkflowCallInput as an, OwnerThreadPage as at, CheckRunParams as b, WorkflowCheckWhere as bn, Ref0Owned as bt, ApprovalAnswer as c, WorkflowCalledState as cn, PasskeyAsserted as ct, ApprovalState as d, WorkflowCheckRefused as dn, PasskeyFrom as dt, WorkflowAsk as en, MirrorEntry as et, ApprovalView as f, WorkflowCheckResults as fn, PasskeyRefusal as ft, ChangeAuthor as g, WorkflowCheckStart as gn, ProjectName as gt, Authorization as h, WorkflowCheckRunEnded as hn, PreviewUnavailable as ht, AgentView as i, WorkflowCallEnded as in, OwnerName as it, ConnectionCallAnswer as j, WorkflowPermissions as jn, SandboxSize as jt, ConnectableAgent as k, WorkflowPasskeyRead as kn, SandboxPush as kt, ApprovalId as l, WorkflowCalledStateAnswer as ln, PasskeyCreated as lt, AttachmentRequestView as m, WorkflowCheckRun as mn, PreviewEcho as mt, AgentPermissionChoice as n, WorkflowCall as nn, NamedDecision as nt, Api as o, WorkflowCallRefusal as on, OwnerThreadView as ot, AttachmentFailed as p, WorkflowCheckResultsAnswer as pn, PasskeyRequestOptions as pt, Harness as q, isRef0Path as qn, TrackThread as qt, AgentPermissionSetting as r, WorkflowCallAnswer as rn, OwnerId as rt, ApiOrigin as s, WorkflowCallRefused as sn, OwnerTrackMessage as st, AgentHandle as t, WorkflowAskClosed as tn, MirrorView as tt, ApprovalPreview as u, WorkflowCheckRefusal as un, PasskeyCreationOptions as ut, CheckOwn as v, WorkflowCheckStates as vn, RanOf as vt, ConnectAgent as w, WorkflowFilters as wn, RequestFolder as wt, CheckTreeEntry as x, WorkflowComment as xn, RepoName as xt, CheckRunError as y, WorkflowCheckStatesAnswer as yn, ReadEvent as yt, CredentialView as z, WorkflowThreadStart as zn, SocketUrl as zt };
+//# sourceMappingURL=index-Cc-mPnNF.d.mts.map