@sealant/api-contracts-next 0.0.0-next.0 → 0.39.0-next.682

package/dist/core-api/workspaces.d.ts

@@ -0,0 +1,1880 @@
+import { Schema } from "effect";
+import { HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
+import { BudgetExceededError } from "./budgets.js";
+/**
+ * `retained`: the workspace's executor ended (or its capture launch failed after it started)
+ * with work on its disk not confirmed saved. It is kept, not dead: the control plane drains or
+ * recovers it with the capture token it was launched with, and reports `stopped` or `failed`
+ * again only once the retention ends (saved and removed, discarded, or lost). A caller keeps
+ * what the recovery needs — the session's lease and token — while it reads `retained`. See
+ * `captureDrain.retained` for why and the recovery attempts.
+ */
+export declare const workspaceStatusSchema: Schema.Literals<readonly ["queued", "running", "ready", "failed", "cancelled", "stopped", "retained"]>;
+export type WorkspaceStatus = typeof workspaceStatusSchema.Type;
+export declare const workspaceRuntimeSchema: Schema.Struct<{
+    readonly adapter: Schema.Literals<readonly ["docker", "k8s", "k3s", "cloudflare", "microvm"]>;
+    /**
+     * The executor's identity on its runtime: the Docker container id, the Pod name, the MicroVM
+     * id. This is the id a caller records at launch and names in a stop's `completion`.
+     */
+    readonly resourceId: Schema.String;
+    readonly reference: Schema.String;
+    /** `retained`: the executor is kept with its disk for recovery (see `workspaceStatusSchema`). */
+    readonly status: Schema.Literals<readonly ["pending", "running", "ready", "failed", "stopped", "retained"]>;
+    readonly endpoint: Schema.optional<Schema.String>;
+    /**
+     * ISO-8601 instant the runtime itself ends the executor, whatever anyone asks: a Lambda
+     * MicroVM's maximum duration from its start. `null` where the runtime imposes no lifetime
+     * (Docker, Kubernetes). A caller holding unsaved work on the executor drains before it. Absent
+     * only from control planes that predate it.
+     */
+    readonly deadline: Schema.optional<Schema.NullOr<Schema.String>>;
+    /** The run (launch attempt) this executor belongs to. Absent from older control planes. */
+    readonly runId: Schema.optional<Schema.String>;
+    /** The launch identity the create named for this executor (`launchId`), when it named one. */
+    readonly launchId: Schema.optional<Schema.String>;
+}>;
+export type WorkspaceRuntime = typeof workspaceRuntimeSchema.Type;
+export declare const workspaceSshTargetSchema: Schema.Struct<{
+    readonly workspaceId: Schema.String;
+    readonly attemptId: Schema.String;
+    readonly runtime: Schema.Struct<{
+        readonly adapter: Schema.Literals<readonly ["docker", "k8s", "k3s", "cloudflare", "microvm"]>;
+        readonly resourceId: Schema.String;
+        readonly reference: Schema.String;
+        readonly status: Schema.Literals<readonly ["pending", "running", "ready", "failed", "stopped"]>;
+        readonly endpoint: Schema.String;
+    }>;
+}>;
+export type WorkspaceSshTarget = typeof workspaceSshTargetSchema.Type;
+export declare const workspacePublishedImageSchema: Schema.Struct<{
+    readonly reference: Schema.String;
+    readonly digestReference: Schema.String;
+    readonly digest: Schema.String;
+}>;
+export declare const workspaceErrorSchema: Schema.Struct<{
+    readonly message: Schema.String;
+    readonly code: Schema.optional<Schema.String>;
+}>;
+export declare const githubWorkspaceSourceSelectionSchema: Schema.Struct<{
+    readonly provider: Schema.Literal<"github">;
+    readonly installationId: Schema.String;
+    readonly installationRepositoryId: Schema.String;
+    readonly ref: Schema.optional<Schema.String>;
+}>;
+export type GitHubWorkspaceSourceSelection = typeof githubWorkspaceSourceSelectionSchema.Type;
+export declare const createWorkspaceCredentialsSchema: Schema.Struct<{
+    readonly profileId: Schema.optional<Schema.String>;
+    readonly claude: Schema.optional<Schema.String>;
+    readonly codex: Schema.optional<Schema.String>;
+    readonly github: Schema.optional<Schema.String>;
+}>;
+export type CreateWorkspaceCredentials = typeof createWorkspaceCredentialsSchema.Type;
+export declare const createWorkspaceRequestSchema: Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+    readonly registryId: Schema.String;
+    readonly repository: Schema.String;
+    readonly tag: Schema.String;
+    readonly name: Schema.optional<Schema.String>;
+    readonly sourceSelection: Schema.optional<Schema.Struct<{
+        readonly provider: Schema.Literal<"github">;
+        readonly installationId: Schema.String;
+        readonly installationRepositoryId: Schema.String;
+        readonly ref: Schema.optional<Schema.String>;
+    }>>;
+    readonly dotfilesSelection: Schema.optional<Schema.Struct<{
+        readonly provider: Schema.Literal<"github">;
+        readonly installationId: Schema.String;
+        readonly installationRepositoryId: Schema.String;
+        readonly ref: Schema.optional<Schema.String>;
+    }>>;
+    readonly credentials: Schema.optional<Schema.Struct<{
+        readonly profileId: Schema.optional<Schema.String>;
+        readonly claude: Schema.optional<Schema.String>;
+        readonly codex: Schema.optional<Schema.String>;
+        readonly github: Schema.optional<Schema.String>;
+    }>>;
+    readonly spec: Schema.Unknown;
+    readonly secretEnv: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+    readonly captureToken: Schema.optional<Schema.String>;
+    readonly ttlSeconds: Schema.optional<Schema.Int>;
+    /**
+     * Makes the create idempotent for this owner: a repeated create with the same key returns the
+     * workspace the first one made (`replayed: true`) instead of creating another, so a caller that
+     * lost the answer (a crash, a timeout) can repeat it or look the workspace up
+     * (`GET /v1/workspaces?idempotencyKey=`). Scoped to `ownerUserId`. The `idempotency-key` header
+     * means the same; this field wins when both are sent.
+     */
+    readonly idempotencyKey: Schema.optional<Schema.String>;
+    /**
+     * The caller's immutable identity for the ONE physical executor this create launches, minted
+     * before create (a caller that makes the create idempotent can reuse its idempotency key). It is
+     * recorded on the launch attempt and reported with the executor (`runtime.launchId`); a stop's
+     * completion attestation that names a launch must name this one.
+     */
+    readonly launchId: Schema.optional<Schema.String>;
+}>;
+export type CreateWorkspaceRequest = typeof createWorkspaceRequestSchema.Type;
+export declare const createWorkspaceHeadersSchema: Schema.Struct<{
+    readonly "idempotency-key": Schema.optional<Schema.String>;
+}>;
+export type CreateWorkspaceHeaders = typeof createWorkspaceHeadersSchema.Type;
+/**
+ * The `harnessId` stamped on runs created by the deterministic-exec endpoint, so consumers can tell
+ * check runs apart from harness runs when listing/reading runs.
+ */
+export declare const execRunHarnessId = "exec";
+/**
+ * Deterministic exec: run an ORDERED LIST of commands in the workspace, recorded as ONE run (a
+ * "check run") — e.g. a causal proof `base fails · head passes · revert fails` as three commands
+ * with three recorded exit codes.
+ *
+ * Semantics differ deliberately from harness runs: every command executes IN ORDER regardless of
+ * exit codes (a nonzero exit is a check DATUM, not an execution failure), and the run completes iff
+ * every command executed and was recorded. The run's `exitCode` is the LAST command's; per-command
+ * exit codes live in the execution record (`processExited` events). The run FAILS only when the
+ * execution machinery broke (workspace gone, transport dropped mid-command) — so `status` answers
+ * "can I trust these exit codes", not "did the checks pass".
+ */
+export declare const execWorkspaceRequestSchema: Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+    /** Commands execute sequentially in the workspace, each recorded like any other process. */
+    readonly commands: Schema.$Array<Schema.Struct<{
+        readonly executable: Schema.String;
+        readonly args: Schema.$Array<Schema.String>;
+        readonly cwd: Schema.optional<Schema.String>;
+    }>>;
+}>;
+export type ExecWorkspaceRequest = typeof execWorkspaceRequestSchema.Type;
+/**
+ * Bind a standby workspace's working directory, or a bindable extra mount, to one subdirectory of
+ * its root (sealantd ADR-0014). `mountPath` defaults to the working directory; an empty `subpath`
+ * unbinds. The reply is the workspace's full set of live bindings, which every relaunch re-applies.
+ */
+export declare const bindWorkspaceRequestSchema: Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+    readonly mountPath: Schema.optional<Schema.String>;
+    readonly subpath: Schema.String;
+}>;
+export type BindWorkspaceRequest = typeof bindWorkspaceRequestSchema.Type;
+export declare const workspaceBindSchema: Schema.Struct<{
+    readonly mountPath: Schema.String;
+    readonly subpath: Schema.String;
+}>;
+export declare const workspaceBindsSchema: Schema.Struct<{
+    readonly binds: Schema.$Array<Schema.Struct<{
+        readonly mountPath: Schema.String;
+        readonly subpath: Schema.String;
+    }>>;
+}>;
+export type WorkspaceBinds = typeof workspaceBindsSchema.Type;
+/** Which flush sealantd runs: `final` (the executor is ending) or `suspend` (a checkpoint). */
+export declare const workspaceCaptureFlushKindSchema: Schema.Literals<readonly ["final", "suspend"]>;
+export type WorkspaceCaptureFlushKind = typeof workspaceCaptureFlushKindSchema.Type;
+/**
+ * Flush a capture-sourced workspace's captures (sealantd ADR-0015 `capture.flush`): a capture,
+ * then everything staged is shipped and registered on the session channel. Synchronous over the
+ * daemon's control connection, bounded by `deadlineMs`. The reply is the daemon's capture status.
+ *
+ * `kind: "final"` says the executor is ending: the daemon stops its managed processes (SIGTERM,
+ * then SIGKILL after `graceMs`), snapshots both capture classes, ships, and reports `complete`.
+ * Only `complete === true` means the executor's work is saved. After a final flush the daemon
+ * refuses new work for good. A final flush that runs past its deadline answers `complete: false`
+ * and keeps shipping in the daemon, so later status reads and repeated finals converge.
+ * `kind: "suspend"` (the default) is a checkpoint: the executor keeps running.
+ */
+export declare const flushWorkspaceCaptureRequestSchema: Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+    /** `final` or `suspend` (the default). */
+    readonly kind: Schema.optional<Schema.Literals<readonly ["final", "suspend"]>>;
+    /** How long the daemon may take before it answers, in milliseconds. Absent: its own default. */
+    readonly deadlineMs: Schema.optional<Schema.Int>;
+    /**
+     * Final only: how long managed processes get between SIGTERM and SIGKILL, in milliseconds,
+     * counted inside `deadlineMs`. Absent: the daemon's default.
+     */
+    readonly graceMs: Schema.optional<Schema.Int>;
+}>;
+export type FlushWorkspaceCaptureRequest = typeof flushWorkspaceCaptureRequestSchema.Type;
+/**
+ * Read a capture-sourced workspace's capture status (sealantd `capture.status`) without flushing:
+ * what a drain polls to show `saving · N left` and to know when the executor may go away.
+ */
+export declare const getWorkspaceCaptureStatusQuerySchema: Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+}>;
+export type GetWorkspaceCaptureStatusQuery = typeof getWorkspaceCaptureStatusQuerySchema.Type;
+export declare const captureClassSchema: Schema.Literals<readonly ["small", "bulk"]>;
+export type CaptureClass = typeof captureClassSchema.Type;
+/** One capture class's snaps (sealantd `CaptureClassSnaps`). */
+export declare const captureClassSnapsSchema: Schema.Struct<{
+    readonly class: Schema.Literals<readonly ["small", "bulk"]>;
+    /** Snaps of this class that failed since the daemon started. */
+    readonly snapsFailed: Schema.Number;
+    /** The last snap's error, while the last snap failed; absent once one succeeds. */
+    readonly lastSnapError: Schema.optional<Schema.String>;
+    /** When the current run of failed snaps began (Unix ms), while the last snap failed. */
+    readonly snapFailingSinceUnixMs: Schema.optional<Schema.Number>;
+}>;
+export type CaptureClassSnaps = typeof captureClassSnapsSchema.Type;
+/**
+ * Where in an executor's own history it made an answer or a seal (sealantd's stamp, decision 17):
+ * its capture lease epoch, the launch it runs as, the daemon boot that answered, how many daemon
+ * boots opened its disk (0: unknown), an observation number that only grows within that boot, and
+ * the capture head. Evidence about one executor is ordered by it, never by any clock: of the same
+ * epoch, launch and boot by `observation`; of the same epoch and launch and different boots whose
+ * generations are both above 0 and differ, by (`bootGeneration`, `observation`); anything else
+ * cannot be ordered.
+ */
+export declare const captureExecutorOriginSchema: Schema.Struct<{
+    readonly epoch: Schema.Int;
+    readonly launch: Schema.String;
+    readonly bootId: Schema.String;
+    readonly bootGeneration: Schema.Int;
+    readonly observation: Schema.Int;
+    readonly headN: Schema.optional<Schema.Int>;
+}>;
+export type CaptureExecutorOrigin = typeof captureExecutorOriginSchema.Type;
+/**
+ * A capture step running past its bound (sealantd `CaptureOverdue`): what is running, outermost
+ * first and `›`-separated (`small snap › git cat-file --batch-check`), when it started (Unix ms,
+ * display only), how long it had been running when the answer was made, and its bound (ms).
+ */
+export declare const captureOverdueSchema: Schema.Struct<{
+    readonly step: Schema.String;
+    readonly startedUnixMs: Schema.Number;
+    readonly runningMs: Schema.Number;
+    readonly boundMs: Schema.Number;
+}>;
+export type CaptureOverdue = typeof captureOverdueSchema.Type;
+export declare const workspaceCaptureStatusSchema: Schema.Struct<{
+    readonly epoch: Schema.Number;
+    readonly worktreeId: Schema.String;
+    /** The newest capture the session channel has registered for this worktree. */
+    readonly headN: Schema.optional<Schema.Number>;
+    /** Captures staged on the executor and not yet registered: the unsaved queue. */
+    readonly pending: Schema.Number;
+    readonly stagedBytes: Schema.Number;
+    readonly uploadedObjects: Schema.Number;
+    readonly uploadedBytes: Schema.Number;
+    readonly registered: Schema.Number;
+    readonly fenced: Schema.Boolean;
+    readonly paused: Schema.Boolean;
+    readonly lastSnapUnixMs: Schema.optional<Schema.Number>;
+    /**
+     * Capture classes the registrar refused for the session's byte quota: nothing of these ships
+     * until the next epoch or re-plan, whatever `pending` says. Non-empty means work is NOT being
+     * saved. Absent from control planes that predate it.
+     */
+    readonly refused: Schema.optional<Schema.$Array<Schema.Literals<readonly ["small", "bulk"]>>>;
+    /**
+     * Bytes still to ship, and bulk captures still pending (sealantd's `pending_bytes` /
+     * `pending_bulk`). Every field below `refused` is absent until the daemon reports it (the
+     * control plane's pinned sealantd wire predates them).
+     */
+    readonly pendingBytes: Schema.optional<Schema.Number>;
+    readonly pendingBulk: Schema.optional<Schema.Number>;
+    /**
+     * The daemon's own account of its last FINAL flush: true only when it quiesced every managed
+     * process, snapshotted both capture classes and registered everything. The only proof that an
+     * executor may go away; `pending === 0` alone is not. Absent until sealantd reports it (read
+     * absent as not complete).
+     */
+    readonly complete: Schema.optional<Schema.Boolean>;
+    /**
+     * Why the last final flush is not complete (`not-final`, `in-progress`, `processes-remain`,
+     * `sweep-unavailable`, `snapshot-failed`, `unreadable`, `fenced`, `conflict`, `deadline`,
+     * `ship-failed`, `pending`, `internal`). A class whose last snap failed is `snapshot-failed`.
+     */
+    readonly incompleteReason: Schema.optional<Schema.String>;
+    /**
+     * Paths the last snap of each class could not read (listed, stat'ed or opened), summed over
+     * both classes. Never taken as deleted: an automatic snap carries a path's last captured
+     * content forward, a final snap fails instead.
+     */
+    readonly unreadable: Schema.optional<Schema.Number>;
+    /** Of `unreadable`, the paths whose last captured content was carried forward. */
+    readonly carried: Schema.optional<Schema.Number>;
+    /**
+     * The first unreadable paths (at most 20), virtual: `tree/<path>` under the worktree,
+     * `.git/<path>`, `harness/<path>`; small class first.
+     */
+    readonly unreadablePaths: Schema.optional<Schema.$Array<Schema.String>>;
+    /**
+     * A capture the registrar refused to register that the executor is working through:
+     * `missing-objects` (an object it names is not in the store) or `unrestorable` (a section's
+     * tree would not restore). Nothing is dropped: its objects are uploaded again and it is
+     * rebuilt from disk in its place.
+     */
+    readonly registerRefused: Schema.optional<Schema.String>;
+    /** That refused capture's chain position. */
+    readonly registerRefusedN: Schema.optional<Schema.Number>;
+    /** The first keys (at most 20) the registrar named as missing. */
+    readonly registerMissing: Schema.optional<Schema.$Array<Schema.String>>;
+    /** Register refusals the daemon has seen since it started. */
+    readonly registerRefusals: Schema.optional<Schema.Number>;
+    /** The refused capture waits to be rebuilt from disk; nothing behind it registers first. */
+    readonly repairing: Schema.optional<Schema.Boolean>;
+    /**
+     * A bulk build is in progress: its capture is not queued yet, so `pending` and `pendingBulk`
+     * do not count it (`pendingBytes` counts what it has staged). A drain is not done while true.
+     */
+    readonly bulkBuilding: Schema.optional<Schema.Boolean>;
+    /**
+     * Each captured class's snaps: how many failed since the daemon started, and the last one's
+     * error while it fails. A snap that fails stages nothing: what changed since the last capture
+     * is on the executor's disk only.
+     */
+    readonly snaps: Schema.optional<Schema.$Array<Schema.Struct<{
+        readonly class: Schema.Literals<readonly ["small", "bulk"]>;
+        /** Snaps of this class that failed since the daemon started. */
+        readonly snapsFailed: Schema.Number;
+        /** The last snap's error, while the last snap failed; absent once one succeeds. */
+        readonly lastSnapError: Schema.optional<Schema.String>;
+        /** When the current run of failed snaps began (Unix ms), while the last snap failed. */
+        readonly snapFailingSinceUnixMs: Schema.optional<Schema.Number>;
+    }>>>;
+    /**
+     * Derived from `snaps`: the error of the class that has been failing longest. Present means the
+     * executor's newest work is NOT being captured, whatever `pending` says.
+     */
+    readonly lastSnapError: Schema.optional<Schema.String>;
+    /** Derived from `snaps`: when the earliest current run of failed snaps began (Unix ms). */
+    readonly snapFailingSinceUnixMs: Schema.optional<Schema.Number>;
+    /** Derived from `snaps`: failed snaps of every class since the daemon started. */
+    readonly snapsFailed: Schema.optional<Schema.Number>;
+    /**
+     * Where in the executor's own history this answer was made. Absent from a daemon that predates
+     * the stamp: such answers cannot be ordered by position.
+     */
+    readonly origin: Schema.optional<Schema.Struct<{
+        readonly epoch: Schema.Int;
+        readonly launch: Schema.String;
+        readonly bootId: Schema.String;
+        readonly bootGeneration: Schema.Int;
+        readonly observation: Schema.Int;
+        readonly headN: Schema.optional<Schema.Int>;
+    }>>;
+    /**
+     * A capture step past its bound, while one is: the executor's capture is stuck there now. Not a
+     * verdict: the step's own limit ends it and the snap fails (`snaps`). Absent while nothing is
+     * past its bound, and from a daemon or control plane that predates it.
+     */
+    readonly overdue: Schema.optional<Schema.Struct<{
+        readonly step: Schema.String;
+        readonly startedUnixMs: Schema.Number;
+        readonly runningMs: Schema.Number;
+        readonly boundMs: Schema.Number;
+    }>>;
+}>;
+export type WorkspaceCaptureStatus = typeof workspaceCaptureStatusSchema.Type;
+/**
+ * Re-plan a capture-sourced workspace (sealantd 0.15 `capture.replan`, the claim hook): the daemon
+ * asks the session channel for its plan again with no worktree named, delta-materialises the
+ * answer over what is on disk, and captures under the answered worktree and epoch from then on.
+ * Synchronous over the daemon's control connection. Idempotent: `unchanged` is true when the
+ * answer named the worktree and epoch already in force.
+ */
+export declare const replanWorkspaceCaptureRequestSchema: Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+}>;
+export type ReplanWorkspaceCaptureRequest = typeof replanWorkspaceCaptureRequestSchema.Type;
+export declare const workspaceCaptureReplannedSchema: Schema.Struct<{
+    readonly worktreeId: Schema.String;
+    readonly epoch: Schema.Number;
+    readonly headN: Schema.optional<Schema.Number>;
+    readonly headCaptureId: Schema.optional<Schema.String>;
+    readonly filesWritten: Schema.Number;
+    readonly bytesWritten: Schema.Number;
+    readonly filesSkipped: Schema.Number;
+    readonly bytesSkipped: Schema.Number;
+    readonly removed: Schema.Number;
+    readonly unchanged: Schema.Boolean;
+}>;
+export type WorkspaceCaptureReplanned = typeof workspaceCaptureReplannedSchema.Type;
+export declare const renameWorkspaceRequestSchema: Schema.Struct<{
+    readonly name: Schema.String;
+    /** The workspace's owner. Required by the control plane: a rename that names none finds nothing. */
+    readonly ownerUserId: Schema.optional<Schema.String>;
+}>;
+export type RenameWorkspaceRequest = typeof renameWorkspaceRequestSchema.Type;
+export declare const stopWorkspaceRequestSchema: Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+    /**
+     * End the workspace WITHOUT saving its unsaved captures. A capture-sourced workspace is
+     * otherwise drained before it stops, and kept running for as long as its work cannot be
+     * confirmed saved; this is the owner's explicit way out. The request is recorded (who, when)
+     * and every stop path honours it: the runtime is terminated at once, and the workspace's
+     * `captureDrain` reads `discarded`. Accepted on a workspace already stopped whose runtime is
+     * still up (a kept one). Owner only.
+     */
+    readonly discardUnsaved: Schema.optional<Schema.Boolean>;
+    /**
+     * The caller's attestation that its capture store holds a SEALED final capture of this
+     * workspace's current executor: a FINAL flush that completed (every writer stopped, both
+     * classes snapshotted, everything registered) and was recorded durably by the store. It is
+     * permission to remove that executor's disk once it has ended, even when this control plane
+     * never read `complete: true` from it itself (the FINAL reply was lost, the daemon exited
+     * before a drain reached it). Accepted only when `executorId` names the current executor — the
+     * run id, or the runtime's `resourceId` / `reference` (`workspace.details().runtime`) — and
+     * nothing the control plane observed from the executor contradicts it: an older `epoch` than
+     * the executor reported, a capture past `captureN`, or — in the same epoch — a report that its
+     * work is NOT saved (incomplete, changed, unreadable, a failed snapshot) that the executor's
+     * own history does not place before the seal (`origin`; without it, any such report at or past
+     * `captureN` counts against the seal). Otherwise ignored, and the executor is kept as before.
+     * Weighed again
+     * when it is used: a later report that the work is not saved revokes it. A seal stands in for
+     * a lost FINAL answer, never for a received one that said the work is not saved. Never a
+     * reason to skip the drain of a running executor.
+     */
+    readonly completion: Schema.optional<Schema.Struct<{
+        /** The sealed capture's chain position (`n`). */
+        readonly captureN: Schema.Int;
+        /** The capture lease epoch the seal was made under. */
+        readonly epoch: Schema.Int;
+        /** The executor the seal names: run id, or runtime `resourceId` / `reference`. */
+        readonly executorId: Schema.String;
+        /**
+         * The launch identity the seal names (`final_seal.executor`). Required when the create named
+         * a `launchId`, and then it must be that one; an attestation without it, or naming another
+         * launch, is ignored (a seal never transfers between executors).
+         */
+        readonly launchId: Schema.optional<Schema.String>;
+        /**
+         * When the store recorded the seal (ISO 8601). Kept for display: clocks order nothing. It
+         * must still read as a time.
+         */
+        readonly sealedAt: Schema.optional<Schema.String>;
+        /**
+         * Where in the executor's own history the seal was made (sealantd stamps it on the
+         * `final_seal`): the one thing that orders the seal against a report of the same capture
+         * that its work is not saved. Without it, such a report at or past `captureN` counts
+         * against the seal.
+         */
+        readonly origin: Schema.optional<Schema.Struct<{
+            readonly epoch: Schema.Int;
+            readonly launch: Schema.String;
+            readonly bootId: Schema.String;
+            readonly bootGeneration: Schema.Int;
+            readonly observation: Schema.Int;
+            readonly headN: Schema.optional<Schema.Int>;
+        }>>;
+    }>>;
+}>;
+export type StopWorkspaceRequest = typeof stopWorkspaceRequestSchema.Type;
+export declare const stopWorkspaceResponseSchema: Schema.Struct<{
+    readonly workspaceId: Schema.String;
+    readonly status: Schema.Literals<readonly ["queued", "running", "ready", "failed", "cancelled", "stopped", "retained"]>;
+    /**
+     * What became of a `completion` attestation on the request: `accepted` (recorded; it lets the
+     * executor's disk go once it has ended) or `ignored` (it does not name this executor, or is for
+     * an older epoch; `detail` says which). Absent when the request carried none.
+     */
+    readonly completion: Schema.optional<Schema.Struct<{
+        readonly outcome: Schema.Literals<readonly ["accepted", "ignored"]>;
+        readonly detail: Schema.optional<Schema.String>;
+    }>>;
+}>;
+export type StopWorkspaceResponse = typeof stopWorkspaceResponseSchema.Type;
+/** Owner-scoped: ask the control plane to recover the workspace's retained executor now. */
+export declare const recoverWorkspaceRequestSchema: Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+}>;
+export type RecoverWorkspaceRequest = typeof recoverWorkspaceRequestSchema.Type;
+/**
+ * `requested`: the workspace's executor is retained (its disk holds work not confirmed saved) and
+ * a recovery attempt is due now; `recoverable` says whether its runtime can restart it on its own
+ * disk (Docker) or only report it (Kubernetes, MicroVM). `not-retained`: nothing is retained for
+ * the workspace's current run; nothing was done.
+ */
+export declare const recoverWorkspaceResponseSchema: Schema.Struct<{
+    readonly workspaceId: Schema.String;
+    readonly state: Schema.Literals<readonly ["requested", "not-retained"]>;
+    readonly recoverable: Schema.optional<Schema.Boolean>;
+}>;
+export type RecoverWorkspaceResponse = typeof recoverWorkspaceResponseSchema.Type;
+export declare const restartWorkspaceRequestSchema: Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+}>;
+export type RestartWorkspaceRequest = typeof restartWorkspaceRequestSchema.Type;
+export declare const restartWorkspaceResponseSchema: Schema.Struct<{
+    readonly workspaceId: Schema.String;
+    /** The new attempt driving the fresh launch. */
+    readonly runId: Schema.String;
+    readonly status: Schema.Literals<readonly ["queued", "running", "ready", "failed", "cancelled", "stopped", "retained"]>;
+}>;
+export type RestartWorkspaceResponse = typeof restartWorkspaceResponseSchema.Type;
+export declare const expireWorkspaceRequestSchema: Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+    readonly ttlSeconds: Schema.optional<Schema.NullOr<Schema.Int>>;
+}>;
+export type ExpireWorkspaceRequest = typeof expireWorkspaceRequestSchema.Type;
+export declare const expireWorkspaceResponseSchema: Schema.Struct<{
+    readonly workspaceId: Schema.String;
+    readonly expiresAt: Schema.NullOr<Schema.String>;
+}>;
+export type ExpireWorkspaceResponse = typeof expireWorkspaceResponseSchema.Type;
+export declare const renameWorkspaceResponseSchema: Schema.Struct<{
+    readonly workspaceId: Schema.String;
+    readonly name: Schema.String;
+    readonly updatedAt: Schema.String;
+}>;
+export type RenameWorkspaceResponse = typeof renameWorkspaceResponseSchema.Type;
+export declare const createWorkspaceResponseSchema: Schema.Struct<{
+    readonly workspaceId: Schema.String;
+    readonly name: Schema.String;
+    readonly status: Schema.Literals<readonly ["queued", "running", "ready", "failed", "cancelled", "stopped", "retained"]>;
+    readonly registryId: Schema.String;
+    readonly repository: Schema.String;
+    readonly tag: Schema.String;
+    /** The launch attempt this create started (or, replayed, the workspace's latest). */
+    readonly runId: Schema.optional<Schema.String>;
+    /**
+     * The executor, once one exists: on a fresh create there is none yet (the launch is
+     * asynchronous); a replayed create carries the workspace's current one.
+     */
+    readonly runtime: Schema.optional<Schema.Struct<{
+        readonly adapter: Schema.Literals<readonly ["docker", "k8s", "k3s", "cloudflare", "microvm"]>;
+        /**
+         * The executor's identity on its runtime: the Docker container id, the Pod name, the MicroVM
+         * id. This is the id a caller records at launch and names in a stop's `completion`.
+         */
+        readonly resourceId: Schema.String;
+        readonly reference: Schema.String;
+        /** `retained`: the executor is kept with its disk for recovery (see `workspaceStatusSchema`). */
+        readonly status: Schema.Literals<readonly ["pending", "running", "ready", "failed", "stopped", "retained"]>;
+        readonly endpoint: Schema.optional<Schema.String>;
+        /**
+         * ISO-8601 instant the runtime itself ends the executor, whatever anyone asks: a Lambda
+         * MicroVM's maximum duration from its start. `null` where the runtime imposes no lifetime
+         * (Docker, Kubernetes). A caller holding unsaved work on the executor drains before it. Absent
+         * only from control planes that predate it.
+         */
+        readonly deadline: Schema.optional<Schema.NullOr<Schema.String>>;
+        /** The run (launch attempt) this executor belongs to. Absent from older control planes. */
+        readonly runId: Schema.optional<Schema.String>;
+        /** The launch identity the create named for this executor (`launchId`), when it named one. */
+        readonly launchId: Schema.optional<Schema.String>;
+    }>>;
+    /** `true` when an earlier create with the same `idempotencyKey` made this workspace. */
+    readonly replayed: Schema.optional<Schema.Boolean>;
+    /** The launch identity the create named (`launchId`), recorded on its attempt. */
+    readonly launchId: Schema.optional<Schema.String>;
+}>;
+export type CreateWorkspaceResponse = typeof createWorkspaceResponseSchema.Type;
+/**
+ * What became of an idempotent create, by its key (owner-scoped):
+ *
+ *  - `pending`: a create with the key started and has not committed — it may still be in flight,
+ *    or it died before it committed. A repeat of the create finishes it; `cancel` makes sure it
+ *    never does. `workspaceId` names a half-made workspace a create from before this record
+ *    left, which a repeat of the create completes.
+ *  - `found`: the create committed; `workspaceId` (and `runId`, `launchId`) name what it made.
+ *  - `cancelled`: the key was cancelled; no create with it ever commits.
+ *  - `none`: no create with the key has reached this control plane (yet). Point-in-time only: a
+ *    delayed request can still arrive — `cancel` is the answer that stays true.
+ */
+export declare const workspaceCreateStateSchema: Schema.Struct<{
+    readonly idempotencyKey: Schema.String;
+    readonly state: Schema.Literals<readonly ["pending", "found", "cancelled", "none"]>;
+    readonly workspaceId: Schema.optional<Schema.String>;
+    readonly runId: Schema.optional<Schema.String>;
+    readonly launchId: Schema.optional<Schema.String>;
+}>;
+export type WorkspaceCreateState = typeof workspaceCreateStateSchema.Type;
+export declare const getWorkspaceCreateQuerySchema: Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+}>;
+export type GetWorkspaceCreateQuery = typeof getWorkspaceCreateQuerySchema.Type;
+/** Owner-scoped: cancel the create with this key, so it never commits. */
+export declare const cancelWorkspaceCreateRequestSchema: Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+}>;
+export type CancelWorkspaceCreateRequest = typeof cancelWorkspaceCreateRequestSchema.Type;
+export declare const workspaceSummarySchema: Schema.Struct<{
+    readonly workspaceId: Schema.String;
+    readonly name: Schema.String;
+    readonly ownerUserId: Schema.String;
+    readonly status: Schema.Literals<readonly ["queued", "running", "ready", "failed", "cancelled", "stopped", "retained"]>;
+    readonly registryId: Schema.optional<Schema.String>;
+    readonly repository: Schema.optional<Schema.String>;
+    readonly tag: Schema.optional<Schema.String>;
+    readonly runtime: Schema.optional<Schema.Struct<{
+        readonly adapter: Schema.Literals<readonly ["docker", "k8s", "k3s", "cloudflare", "microvm"]>;
+        /**
+         * The executor's identity on its runtime: the Docker container id, the Pod name, the MicroVM
+         * id. This is the id a caller records at launch and names in a stop's `completion`.
+         */
+        readonly resourceId: Schema.String;
+        readonly reference: Schema.String;
+        /** `retained`: the executor is kept with its disk for recovery (see `workspaceStatusSchema`). */
+        readonly status: Schema.Literals<readonly ["pending", "running", "ready", "failed", "stopped", "retained"]>;
+        readonly endpoint: Schema.optional<Schema.String>;
+        /**
+         * ISO-8601 instant the runtime itself ends the executor, whatever anyone asks: a Lambda
+         * MicroVM's maximum duration from its start. `null` where the runtime imposes no lifetime
+         * (Docker, Kubernetes). A caller holding unsaved work on the executor drains before it. Absent
+         * only from control planes that predate it.
+         */
+        readonly deadline: Schema.optional<Schema.NullOr<Schema.String>>;
+        /** The run (launch attempt) this executor belongs to. Absent from older control planes. */
+        readonly runId: Schema.optional<Schema.String>;
+        /** The launch identity the create named for this executor (`launchId`), when it named one. */
+        readonly launchId: Schema.optional<Schema.String>;
+    }>>;
+    readonly publishedImage: Schema.optional<Schema.Struct<{
+        readonly reference: Schema.String;
+        readonly digestReference: Schema.String;
+        readonly digest: Schema.String;
+    }>>;
+    readonly error: Schema.optional<Schema.Struct<{
+        readonly message: Schema.String;
+        readonly code: Schema.optional<Schema.String>;
+    }>>;
+    readonly createdAt: Schema.String;
+    readonly updatedAt: Schema.String;
+    readonly startedAt: Schema.optional<Schema.String>;
+    readonly finishedAt: Schema.optional<Schema.String>;
+    readonly expiresAt: Schema.optional<Schema.String>;
+}>;
+export type WorkspaceSummary = typeof workspaceSummarySchema.Type;
+/**
+ * What the control plane last OBSERVED of a capture-sourced workspace's drain — the FINAL flush
+ * and queue polling every platform stop runs before it removes the runtime. A stop request is
+ * not a stop: until the runtime is gone, this is what is happening.
+ *
+ *  - `draining`: the queue is still moving; the stop continues on the server.
+ *  - `kept`: nothing will stop the runtime — the work is not confirmed saved (the queue stalled,
+ *    a class was refused, the daemon is silent while the executor runs, or the daemon did not
+ *    report its final flush complete). `detail` says which.
+ *  - `saved`: the daemon reported its final flush complete; the runtime is being removed.
+ *  - `gone`: the daemon is silent and the runtime reports the executor ended.
+ *  - `stop-failed`: the drain let the stop through but removing the runtime failed (`detail`
+ *    has the error); the control plane retries the stop.
+ *  - `stopped`: the runtime was removed after its drain let it go.
+ *  - `discarded`: the owner discarded the unsaved captures (`stop({ discardUnsaved: true })`);
+ *    the runtime was terminated without a drain. `discard` records who asked, and when.
+ *
+ * `preservationStartsAt` is when the control plane starts that drain on its own ahead of the
+ * runtime's deadline (`runtime.deadline`), once it has planned one.
+ */
+export declare const workspaceCaptureDrainSchema: Schema.Struct<{
+    readonly state: Schema.Literals<readonly ["draining", "kept", "saved", "gone", "stop-failed", "stopped", "discarded"]>;
+    readonly detail: Schema.optional<Schema.String>;
+    /** ISO-8601: when this was observed. */
+    readonly observedAt: Schema.optional<Schema.String>;
+    /** ISO-8601: when the deadline sweep starts (or started) the final drain. */
+    readonly preservationStartsAt: Schema.optional<Schema.String>;
+    /** The owner's request to discard the unsaved captures: who asked, and when (ISO-8601). */
+    readonly discard: Schema.optional<Schema.Struct<{
+        readonly requestedBy: Schema.String;
+        readonly requestedAt: Schema.String;
+    }>>;
+    /**
+     * The executor is RETAINED: kept because its disk holds work not confirmed saved. `since` and
+     * `reason` say when and why; recovery is attempted on a backoff (`recoveryAttempts`,
+     * `nextRecoveryAt`, `lastRecoveryError`); `recoverable` says whether its runtime can restart it
+     * on its own disk (Docker) or only report it (Kubernetes, MicroVM). Absent when nothing is
+     * retained.
+     */
+    readonly retained: Schema.optional<Schema.Struct<{
+        readonly since: Schema.String;
+        readonly reason: Schema.String;
+        readonly recoverable: Schema.Boolean;
+        readonly recoveryAttempts: Schema.Int;
+        readonly nextRecoveryAt: Schema.optional<Schema.String>;
+        readonly lastRecoveryError: Schema.optional<Schema.String>;
+    }>>;
+    /**
+     * The executor this observation is about: the run and its runtime identity (`resourceId` is
+     * the id a stop's `completion` names).
+     */
+    readonly executor: Schema.optional<Schema.Struct<{
+        readonly runId: Schema.String;
+        readonly adapter: Schema.String;
+        readonly resourceId: Schema.String;
+        readonly reference: Schema.optional<Schema.String>;
+        /** The launch identity the create named for this executor (`launchId`), when it named one. */
+        readonly launchId: Schema.optional<Schema.String>;
+    }>>;
+    /** The latest `completion` attestation accepted for this executor (see `stop`). */
+    readonly completion: Schema.optional<Schema.Struct<{
+        readonly executorId: Schema.String;
+        readonly epoch: Schema.Int;
+        readonly captureN: Schema.Int;
+        readonly attestedAt: Schema.String;
+        readonly launchId: Schema.optional<Schema.String>;
+        /** When the store recorded the seal, when the attestation said. */
+        readonly sealedAt: Schema.optional<Schema.String>;
+        /** Where in the executor's own history the seal was made, when the attestation said. */
+        readonly origin: Schema.optional<Schema.Struct<{
+            readonly epoch: Schema.Int;
+            readonly launch: Schema.String;
+            readonly bootId: Schema.String;
+            readonly bootGeneration: Schema.Int;
+            readonly observation: Schema.Int;
+            readonly headN: Schema.optional<Schema.Int>;
+        }>>;
+    }>>;
+}>;
+export type WorkspaceCaptureDrain = typeof workspaceCaptureDrainSchema.Type;
+export declare const workspaceDetailsSchema: Schema.Struct<{
+    readonly workspaceId: Schema.String;
+    readonly name: Schema.String;
+    readonly ownerUserId: Schema.String;
+    readonly status: Schema.Literals<readonly ["queued", "running", "ready", "failed", "cancelled", "stopped", "retained"]>;
+    readonly registryId: Schema.optional<Schema.String>;
+    readonly repository: Schema.optional<Schema.String>;
+    readonly tag: Schema.optional<Schema.String>;
+    readonly runtime: Schema.optional<Schema.Struct<{
+        readonly adapter: Schema.Literals<readonly ["docker", "k8s", "k3s", "cloudflare", "microvm"]>;
+        /**
+         * The executor's identity on its runtime: the Docker container id, the Pod name, the MicroVM
+         * id. This is the id a caller records at launch and names in a stop's `completion`.
+         */
+        readonly resourceId: Schema.String;
+        readonly reference: Schema.String;
+        /** `retained`: the executor is kept with its disk for recovery (see `workspaceStatusSchema`). */
+        readonly status: Schema.Literals<readonly ["pending", "running", "ready", "failed", "stopped", "retained"]>;
+        readonly endpoint: Schema.optional<Schema.String>;
+        /**
+         * ISO-8601 instant the runtime itself ends the executor, whatever anyone asks: a Lambda
+         * MicroVM's maximum duration from its start. `null` where the runtime imposes no lifetime
+         * (Docker, Kubernetes). A caller holding unsaved work on the executor drains before it. Absent
+         * only from control planes that predate it.
+         */
+        readonly deadline: Schema.optional<Schema.NullOr<Schema.String>>;
+        /** The run (launch attempt) this executor belongs to. Absent from older control planes. */
+        readonly runId: Schema.optional<Schema.String>;
+        /** The launch identity the create named for this executor (`launchId`), when it named one. */
+        readonly launchId: Schema.optional<Schema.String>;
+    }>>;
+    readonly publishedImage: Schema.optional<Schema.Struct<{
+        readonly reference: Schema.String;
+        readonly digestReference: Schema.String;
+        readonly digest: Schema.String;
+    }>>;
+    readonly error: Schema.optional<Schema.Struct<{
+        readonly message: Schema.String;
+        readonly code: Schema.optional<Schema.String>;
+    }>>;
+    readonly createdAt: Schema.String;
+    readonly updatedAt: Schema.String;
+    readonly startedAt: Schema.optional<Schema.String>;
+    readonly finishedAt: Schema.optional<Schema.String>;
+    readonly expiresAt: Schema.optional<Schema.String>;
+    readonly spec: Schema.optional<Schema.Unknown>;
+    /**
+     * The current runtime's capture drain as last observed (see `workspaceCaptureDrainSchema`).
+     * Absent while no drain or preservation schedule exists, and from older control planes.
+     */
+    readonly captureDrain: Schema.optional<Schema.Struct<{
+        readonly state: Schema.Literals<readonly ["draining", "kept", "saved", "gone", "stop-failed", "stopped", "discarded"]>;
+        readonly detail: Schema.optional<Schema.String>;
+        /** ISO-8601: when this was observed. */
+        readonly observedAt: Schema.optional<Schema.String>;
+        /** ISO-8601: when the deadline sweep starts (or started) the final drain. */
+        readonly preservationStartsAt: Schema.optional<Schema.String>;
+        /** The owner's request to discard the unsaved captures: who asked, and when (ISO-8601). */
+        readonly discard: Schema.optional<Schema.Struct<{
+            readonly requestedBy: Schema.String;
+            readonly requestedAt: Schema.String;
+        }>>;
+        /**
+         * The executor is RETAINED: kept because its disk holds work not confirmed saved. `since` and
+         * `reason` say when and why; recovery is attempted on a backoff (`recoveryAttempts`,
+         * `nextRecoveryAt`, `lastRecoveryError`); `recoverable` says whether its runtime can restart it
+         * on its own disk (Docker) or only report it (Kubernetes, MicroVM). Absent when nothing is
+         * retained.
+         */
+        readonly retained: Schema.optional<Schema.Struct<{
+            readonly since: Schema.String;
+            readonly reason: Schema.String;
+            readonly recoverable: Schema.Boolean;
+            readonly recoveryAttempts: Schema.Int;
+            readonly nextRecoveryAt: Schema.optional<Schema.String>;
+            readonly lastRecoveryError: Schema.optional<Schema.String>;
+        }>>;
+        /**
+         * The executor this observation is about: the run and its runtime identity (`resourceId` is
+         * the id a stop's `completion` names).
+         */
+        readonly executor: Schema.optional<Schema.Struct<{
+            readonly runId: Schema.String;
+            readonly adapter: Schema.String;
+            readonly resourceId: Schema.String;
+            readonly reference: Schema.optional<Schema.String>;
+            /** The launch identity the create named for this executor (`launchId`), when it named one. */
+            readonly launchId: Schema.optional<Schema.String>;
+        }>>;
+        /** The latest `completion` attestation accepted for this executor (see `stop`). */
+        readonly completion: Schema.optional<Schema.Struct<{
+            readonly executorId: Schema.String;
+            readonly epoch: Schema.Int;
+            readonly captureN: Schema.Int;
+            readonly attestedAt: Schema.String;
+            readonly launchId: Schema.optional<Schema.String>;
+            /** When the store recorded the seal, when the attestation said. */
+            readonly sealedAt: Schema.optional<Schema.String>;
+            /** Where in the executor's own history the seal was made, when the attestation said. */
+            readonly origin: Schema.optional<Schema.Struct<{
+                readonly epoch: Schema.Int;
+                readonly launch: Schema.String;
+                readonly bootId: Schema.String;
+                readonly bootGeneration: Schema.Int;
+                readonly observation: Schema.Int;
+                readonly headN: Schema.optional<Schema.Int>;
+            }>>;
+        }>>;
+    }>>;
+}>;
+export type WorkspaceDetails = typeof workspaceDetailsSchema.Type;
+/**
+ * Owner scoping on a single read: the workspace must belong to `ownerUserId` (uniform 404).
+ * Optional on the wire for older callers; the control plane requires it.
+ */
+export declare const getWorkspaceQuerySchema: Schema.Struct<{
+    readonly ownerUserId: Schema.optional<Schema.String>;
+}>;
+export type GetWorkspaceQuery = typeof getWorkspaceQuerySchema.Type;
+export declare const listWorkspacesQuerySchema: Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+    readonly status: Schema.optional<Schema.Literals<readonly ["queued", "running", "ready", "failed", "cancelled", "stopped", "retained"]>>;
+    readonly limit: Schema.optional<Schema.String>;
+    /** Only the owner's workspace created with this `idempotencyKey` (none or one item). */
+    readonly idempotencyKey: Schema.optional<Schema.String>;
+}>;
+export type ListWorkspacesQuery = typeof listWorkspacesQuerySchema.Type;
+export declare const listWorkspacesResponseSchema: Schema.Struct<{
+    readonly items: Schema.$Array<Schema.Struct<{
+        readonly workspaceId: Schema.String;
+        readonly name: Schema.String;
+        readonly ownerUserId: Schema.String;
+        readonly status: Schema.Literals<readonly ["queued", "running", "ready", "failed", "cancelled", "stopped", "retained"]>;
+        readonly registryId: Schema.optional<Schema.String>;
+        readonly repository: Schema.optional<Schema.String>;
+        readonly tag: Schema.optional<Schema.String>;
+        readonly runtime: Schema.optional<Schema.Struct<{
+            readonly adapter: Schema.Literals<readonly ["docker", "k8s", "k3s", "cloudflare", "microvm"]>;
+            /**
+             * The executor's identity on its runtime: the Docker container id, the Pod name, the MicroVM
+             * id. This is the id a caller records at launch and names in a stop's `completion`.
+             */
+            readonly resourceId: Schema.String;
+            readonly reference: Schema.String;
+            /** `retained`: the executor is kept with its disk for recovery (see `workspaceStatusSchema`). */
+            readonly status: Schema.Literals<readonly ["pending", "running", "ready", "failed", "stopped", "retained"]>;
+            readonly endpoint: Schema.optional<Schema.String>;
+            /**
+             * ISO-8601 instant the runtime itself ends the executor, whatever anyone asks: a Lambda
+             * MicroVM's maximum duration from its start. `null` where the runtime imposes no lifetime
+             * (Docker, Kubernetes). A caller holding unsaved work on the executor drains before it. Absent
+             * only from control planes that predate it.
+             */
+            readonly deadline: Schema.optional<Schema.NullOr<Schema.String>>;
+            /** The run (launch attempt) this executor belongs to. Absent from older control planes. */
+            readonly runId: Schema.optional<Schema.String>;
+            /** The launch identity the create named for this executor (`launchId`), when it named one. */
+            readonly launchId: Schema.optional<Schema.String>;
+        }>>;
+        readonly publishedImage: Schema.optional<Schema.Struct<{
+            readonly reference: Schema.String;
+            readonly digestReference: Schema.String;
+            readonly digest: Schema.String;
+        }>>;
+        readonly error: Schema.optional<Schema.Struct<{
+            readonly message: Schema.String;
+            readonly code: Schema.optional<Schema.String>;
+        }>>;
+        readonly createdAt: Schema.String;
+        readonly updatedAt: Schema.String;
+        readonly startedAt: Schema.optional<Schema.String>;
+        readonly finishedAt: Schema.optional<Schema.String>;
+        readonly expiresAt: Schema.optional<Schema.String>;
+    }>>;
+}>;
+export type ListWorkspacesResponse = typeof listWorkspacesResponseSchema.Type;
+export declare const listWorkspaceAttemptsQuerySchema: Schema.Struct<{
+    readonly ownerUserId: Schema.optional<Schema.String>;
+    readonly limit: Schema.optional<Schema.String>;
+}>;
+export type ListWorkspaceAttemptsQuery = typeof listWorkspaceAttemptsQuerySchema.Type;
+export declare const workspaceAttemptSummarySchema: Schema.Struct<{
+    readonly attemptId: Schema.String;
+    readonly relation: Schema.Literals<readonly ["launch", "rebuild", "retry", "resume"]>;
+    readonly status: Schema.Literals<readonly ["queued", "running", "ready", "failed", "cancelled", "stopped", "retained"]>;
+    readonly triggerType: Schema.Literals<readonly ["manual", "schedule", "api", "retry"]>;
+    readonly triggerRef: Schema.optional<Schema.String>;
+    readonly runtime: Schema.optional<Schema.Struct<{
+        readonly adapter: Schema.Literals<readonly ["docker", "k8s", "k3s", "cloudflare", "microvm"]>;
+        /**
+         * The executor's identity on its runtime: the Docker container id, the Pod name, the MicroVM
+         * id. This is the id a caller records at launch and names in a stop's `completion`.
+         */
+        readonly resourceId: Schema.String;
+        readonly reference: Schema.String;
+        /** `retained`: the executor is kept with its disk for recovery (see `workspaceStatusSchema`). */
+        readonly status: Schema.Literals<readonly ["pending", "running", "ready", "failed", "stopped", "retained"]>;
+        readonly endpoint: Schema.optional<Schema.String>;
+        /**
+         * ISO-8601 instant the runtime itself ends the executor, whatever anyone asks: a Lambda
+         * MicroVM's maximum duration from its start. `null` where the runtime imposes no lifetime
+         * (Docker, Kubernetes). A caller holding unsaved work on the executor drains before it. Absent
+         * only from control planes that predate it.
+         */
+        readonly deadline: Schema.optional<Schema.NullOr<Schema.String>>;
+        /** The run (launch attempt) this executor belongs to. Absent from older control planes. */
+        readonly runId: Schema.optional<Schema.String>;
+        /** The launch identity the create named for this executor (`launchId`), when it named one. */
+        readonly launchId: Schema.optional<Schema.String>;
+    }>>;
+    readonly publishedImage: Schema.optional<Schema.Struct<{
+        readonly reference: Schema.String;
+        readonly digestReference: Schema.String;
+        readonly digest: Schema.String;
+    }>>;
+    readonly error: Schema.optional<Schema.Struct<{
+        readonly message: Schema.String;
+        readonly code: Schema.optional<Schema.String>;
+    }>>;
+    readonly spec: Schema.optional<Schema.Unknown>;
+    readonly queuedAt: Schema.String;
+    readonly createdAt: Schema.String;
+    readonly updatedAt: Schema.String;
+    readonly linkedAt: Schema.String;
+    readonly startedAt: Schema.optional<Schema.String>;
+    readonly finishedAt: Schema.optional<Schema.String>;
+    readonly durationMs: Schema.optional<Schema.Number>;
+}>;
+export type WorkspaceAttemptSummary = typeof workspaceAttemptSummarySchema.Type;
+export declare const listWorkspaceAttemptsResponseSchema: Schema.Struct<{
+    readonly items: Schema.$Array<Schema.Struct<{
+        readonly attemptId: Schema.String;
+        readonly relation: Schema.Literals<readonly ["launch", "rebuild", "retry", "resume"]>;
+        readonly status: Schema.Literals<readonly ["queued", "running", "ready", "failed", "cancelled", "stopped", "retained"]>;
+        readonly triggerType: Schema.Literals<readonly ["manual", "schedule", "api", "retry"]>;
+        readonly triggerRef: Schema.optional<Schema.String>;
+        readonly runtime: Schema.optional<Schema.Struct<{
+            readonly adapter: Schema.Literals<readonly ["docker", "k8s", "k3s", "cloudflare", "microvm"]>;
+            /**
+             * The executor's identity on its runtime: the Docker container id, the Pod name, the MicroVM
+             * id. This is the id a caller records at launch and names in a stop's `completion`.
+             */
+            readonly resourceId: Schema.String;
+            readonly reference: Schema.String;
+            /** `retained`: the executor is kept with its disk for recovery (see `workspaceStatusSchema`). */
+            readonly status: Schema.Literals<readonly ["pending", "running", "ready", "failed", "stopped", "retained"]>;
+            readonly endpoint: Schema.optional<Schema.String>;
+            /**
+             * ISO-8601 instant the runtime itself ends the executor, whatever anyone asks: a Lambda
+             * MicroVM's maximum duration from its start. `null` where the runtime imposes no lifetime
+             * (Docker, Kubernetes). A caller holding unsaved work on the executor drains before it. Absent
+             * only from control planes that predate it.
+             */
+            readonly deadline: Schema.optional<Schema.NullOr<Schema.String>>;
+            /** The run (launch attempt) this executor belongs to. Absent from older control planes. */
+            readonly runId: Schema.optional<Schema.String>;
+            /** The launch identity the create named for this executor (`launchId`), when it named one. */
+            readonly launchId: Schema.optional<Schema.String>;
+        }>>;
+        readonly publishedImage: Schema.optional<Schema.Struct<{
+            readonly reference: Schema.String;
+            readonly digestReference: Schema.String;
+            readonly digest: Schema.String;
+        }>>;
+        readonly error: Schema.optional<Schema.Struct<{
+            readonly message: Schema.String;
+            readonly code: Schema.optional<Schema.String>;
+        }>>;
+        readonly spec: Schema.optional<Schema.Unknown>;
+        readonly queuedAt: Schema.String;
+        readonly createdAt: Schema.String;
+        readonly updatedAt: Schema.String;
+        readonly linkedAt: Schema.String;
+        readonly startedAt: Schema.optional<Schema.String>;
+        readonly finishedAt: Schema.optional<Schema.String>;
+        readonly durationMs: Schema.optional<Schema.Number>;
+    }>>;
+}>;
+export type ListWorkspaceAttemptsResponse = typeof listWorkspaceAttemptsResponseSchema.Type;
+export declare const listWorkspaceEventsQuerySchema: Schema.Struct<{
+    readonly ownerUserId: Schema.optional<Schema.String>;
+    readonly limit: Schema.optional<Schema.String>;
+}>;
+export type ListWorkspaceEventsQuery = typeof listWorkspaceEventsQuerySchema.Type;
+export declare const workspaceEventTypeSchema: Schema.Literals<readonly ["workspace.created", "attempt.queued", "attempt.running", "attempt.succeeded", "attempt.failed", "attempt.cancelled", "image.published", "runtime.pending", "runtime.running", "runtime.ready", "runtime.failed", "runtime.stopped"]>;
+export type WorkspaceEventType = typeof workspaceEventTypeSchema.Type;
+export declare const workspaceEventSchema: Schema.Struct<{
+    readonly eventId: Schema.String;
+    readonly workspaceId: Schema.String;
+    readonly attemptId: Schema.optional<Schema.String>;
+    readonly type: Schema.Literals<readonly ["workspace.created", "attempt.queued", "attempt.running", "attempt.succeeded", "attempt.failed", "attempt.cancelled", "image.published", "runtime.pending", "runtime.running", "runtime.ready", "runtime.failed", "runtime.stopped"]>;
+    readonly occurredAt: Schema.String;
+    readonly message: Schema.optional<Schema.String>;
+    readonly data: Schema.optional<Schema.Unknown>;
+}>;
+export type WorkspaceEvent = typeof workspaceEventSchema.Type;
+export declare const listWorkspaceEventsResponseSchema: Schema.Struct<{
+    readonly items: Schema.$Array<Schema.Struct<{
+        readonly eventId: Schema.String;
+        readonly workspaceId: Schema.String;
+        readonly attemptId: Schema.optional<Schema.String>;
+        readonly type: Schema.Literals<readonly ["workspace.created", "attempt.queued", "attempt.running", "attempt.succeeded", "attempt.failed", "attempt.cancelled", "image.published", "runtime.pending", "runtime.running", "runtime.ready", "runtime.failed", "runtime.stopped"]>;
+        readonly occurredAt: Schema.String;
+        readonly message: Schema.optional<Schema.String>;
+        readonly data: Schema.optional<Schema.Unknown>;
+    }>>;
+}>;
+export type ListWorkspaceEventsResponse = typeof listWorkspaceEventsResponseSchema.Type;
+export declare const workspaceGatewayHeadersSchema: Schema.Struct<{
+    readonly "x-sealant-gateway-token": Schema.optional<Schema.String>;
+    readonly "x-sealant-principal-id": Schema.optional<Schema.String>;
+}>;
+export type WorkspaceGatewayHeaders = typeof workspaceGatewayHeadersSchema.Type;
+declare const WorkspaceBadRequestError_base: Schema.Class<WorkspaceBadRequestError, Schema.TaggedStruct<"WorkspaceBadRequestError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class WorkspaceBadRequestError extends WorkspaceBadRequestError_base {
+}
+declare const WorkspaceRuntimeEnvReferencesUnsupportedError_base: Schema.Class<WorkspaceRuntimeEnvReferencesUnsupportedError, Schema.TaggedStruct<"WorkspaceRuntimeEnvReferencesUnsupportedError", {
+    readonly message: Schema.String;
+    readonly code: Schema.Literals<readonly ["runtime-env-references-unsupported"]>;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * Kubernetes-only create-time inputs (cluster env sources `runtime.envFrom`, a workspace
+ * `kubernetes.serviceAccountName`) on a deployment whose workspaces do not run on Kubernetes.
+ * Refused synchronously at POST /v1/workspaces — no workspace row, no build job, no failure
+ * minutes later. The stable `code` doubles as the SDK consumer's capability probe: mapping this
+ * code is how a caller learns the install cannot resolve cluster bindings, instead of trusting a
+ * config flag that can lie.
+ */
+export declare class WorkspaceRuntimeEnvReferencesUnsupportedError extends WorkspaceRuntimeEnvReferencesUnsupportedError_base {
+}
+declare const WorkspaceDockerServiceUnsupportedError_base: Schema.Class<WorkspaceDockerServiceUnsupportedError, Schema.TaggedStruct<"WorkspaceDockerServiceUnsupportedError", {
+    readonly message: Schema.String;
+    readonly code: Schema.Literals<readonly ["workspace-docker-unsupported"]>;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * `services.docker` requested on an install whose workspace runtime cannot serve it. Kubernetes
+ * needs its operator-enabled rootless sidecar. Lambda MicroVMs need a separate Docker-capable
+ * image, leaving the default image at its restricted Linux capability set. Refused synchronously
+ * at POST /v1/workspaces; the stable `code` is the consumer's capability probe.
+ */
+export declare class WorkspaceDockerServiceUnsupportedError extends WorkspaceDockerServiceUnsupportedError_base {
+}
+declare const WorkspaceUnauthorizedError_base: Schema.Class<WorkspaceUnauthorizedError, Schema.TaggedStruct<"WorkspaceUnauthorizedError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class WorkspaceUnauthorizedError extends WorkspaceUnauthorizedError_base {
+}
+declare const WorkspaceForbiddenError_base: Schema.Class<WorkspaceForbiddenError, Schema.TaggedStruct<"WorkspaceForbiddenError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class WorkspaceForbiddenError extends WorkspaceForbiddenError_base {
+}
+declare const WorkspaceNotFoundError_base: Schema.Class<WorkspaceNotFoundError, Schema.TaggedStruct<"WorkspaceNotFoundError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class WorkspaceNotFoundError extends WorkspaceNotFoundError_base {
+}
+declare const WorkspaceConflictError_base: Schema.Class<WorkspaceConflictError, Schema.TaggedStruct<"WorkspaceConflictError", {
+    readonly message: Schema.String;
+    /** A stable reason, where one applies (`create-cancelled`: the create's key was cancelled). */
+    readonly code: Schema.optional<Schema.String>;
+}>, import("effect/Cause").YieldableError>;
+export declare class WorkspaceConflictError extends WorkspaceConflictError_base {
+}
+declare const WorkspaceBadGatewayError_base: Schema.Class<WorkspaceBadGatewayError, Schema.TaggedStruct<"WorkspaceBadGatewayError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class WorkspaceBadGatewayError extends WorkspaceBadGatewayError_base {
+}
+declare const WorkspaceServiceUnavailableError_base: Schema.Class<WorkspaceServiceUnavailableError, Schema.TaggedStruct<"WorkspaceServiceUnavailableError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class WorkspaceServiceUnavailableError extends WorkspaceServiceUnavailableError_base {
+}
+declare const WorkspaceInternalServerError_base: Schema.Class<WorkspaceInternalServerError, Schema.TaggedStruct<"WorkspaceInternalServerError", {
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+export declare class WorkspaceInternalServerError extends WorkspaceInternalServerError_base {
+}
+export declare const WorkspacesGroup: HttpApiGroup.HttpApiGroup<"workspaces", HttpApiEndpoint.HttpApiEndpoint<"bindWorkspace", "POST", "/:workspaceId/bind", HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+    readonly mountPath: Schema.optional<Schema.String>;
+    readonly subpath: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly binds: Schema.$Array<Schema.Struct<{
+        readonly mountPath: Schema.String;
+        readonly subpath: Schema.String;
+    }>>;
+}>>, HttpApiEndpoint.Json<typeof WorkspaceBadRequestError | typeof WorkspaceNotFoundError | typeof WorkspaceConflictError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"cancelWorkspaceCreate", "POST", "/idempotency-keys/:idempotencyKey/cancel", HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly idempotencyKey: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly idempotencyKey: Schema.String;
+    readonly state: Schema.Literals<readonly ["pending", "found", "cancelled", "none"]>;
+    readonly workspaceId: Schema.optional<Schema.String>;
+    readonly runId: Schema.optional<Schema.String>;
+    readonly launchId: Schema.optional<Schema.String>;
+}>>, HttpApiEndpoint.Json<typeof WorkspaceBadRequestError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"createWorkspace", "POST", "/", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+    readonly registryId: Schema.String;
+    readonly repository: Schema.String;
+    readonly tag: Schema.String;
+    readonly name: Schema.optional<Schema.String>;
+    readonly sourceSelection: Schema.optional<Schema.Struct<{
+        readonly provider: Schema.Literal<"github">;
+        readonly installationId: Schema.String;
+        readonly installationRepositoryId: Schema.String;
+        readonly ref: Schema.optional<Schema.String>;
+    }>>;
+    readonly dotfilesSelection: Schema.optional<Schema.Struct<{
+        readonly provider: Schema.Literal<"github">;
+        readonly installationId: Schema.String;
+        readonly installationRepositoryId: Schema.String;
+        readonly ref: Schema.optional<Schema.String>;
+    }>>;
+    readonly credentials: Schema.optional<Schema.Struct<{
+        readonly profileId: Schema.optional<Schema.String>;
+        readonly claude: Schema.optional<Schema.String>;
+        readonly codex: Schema.optional<Schema.String>;
+        readonly github: Schema.optional<Schema.String>;
+    }>>;
+    readonly spec: Schema.Unknown;
+    readonly secretEnv: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
+    readonly captureToken: Schema.optional<Schema.String>;
+    readonly ttlSeconds: Schema.optional<Schema.Int>;
+    /**
+     * Makes the create idempotent for this owner: a repeated create with the same key returns the
+     * workspace the first one made (`replayed: true`) instead of creating another, so a caller that
+     * lost the answer (a crash, a timeout) can repeat it or look the workspace up
+     * (`GET /v1/workspaces?idempotencyKey=`). Scoped to `ownerUserId`. The `idempotency-key` header
+     * means the same; this field wins when both are sent.
+     */
+    readonly idempotencyKey: Schema.optional<Schema.String>;
+    /**
+     * The caller's immutable identity for the ONE physical executor this create launches, minted
+     * before create (a caller that makes the create idempotent can reuse its idempotency key). It is
+     * recorded on the launch attempt and reported with the executor (`runtime.launchId`); a stop's
+     * completion attestation that names a launch must name this one.
+     */
+    readonly launchId: Schema.optional<Schema.String>;
+}>>, HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly "idempotency-key": Schema.optional<Schema.String>;
+}>>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+    readonly name: Schema.String;
+    readonly status: Schema.Literals<readonly ["queued", "running", "ready", "failed", "cancelled", "stopped", "retained"]>;
+    readonly registryId: Schema.String;
+    readonly repository: Schema.String;
+    readonly tag: Schema.String;
+    /** The launch attempt this create started (or, replayed, the workspace's latest). */
+    readonly runId: Schema.optional<Schema.String>;
+    /**
+     * The executor, once one exists: on a fresh create there is none yet (the launch is
+     * asynchronous); a replayed create carries the workspace's current one.
+     */
+    readonly runtime: Schema.optional<Schema.Struct<{
+        readonly adapter: Schema.Literals<readonly ["docker", "k8s", "k3s", "cloudflare", "microvm"]>;
+        /**
+         * The executor's identity on its runtime: the Docker container id, the Pod name, the MicroVM
+         * id. This is the id a caller records at launch and names in a stop's `completion`.
+         */
+        readonly resourceId: Schema.String;
+        readonly reference: Schema.String;
+        /** `retained`: the executor is kept with its disk for recovery (see `workspaceStatusSchema`). */
+        readonly status: Schema.Literals<readonly ["pending", "running", "ready", "failed", "stopped", "retained"]>;
+        readonly endpoint: Schema.optional<Schema.String>;
+        /**
+         * ISO-8601 instant the runtime itself ends the executor, whatever anyone asks: a Lambda
+         * MicroVM's maximum duration from its start. `null` where the runtime imposes no lifetime
+         * (Docker, Kubernetes). A caller holding unsaved work on the executor drains before it. Absent
+         * only from control planes that predate it.
+         */
+        readonly deadline: Schema.optional<Schema.NullOr<Schema.String>>;
+        /** The run (launch attempt) this executor belongs to. Absent from older control planes. */
+        readonly runId: Schema.optional<Schema.String>;
+        /** The launch identity the create named for this executor (`launchId`), when it named one. */
+        readonly launchId: Schema.optional<Schema.String>;
+    }>>;
+    /** `true` when an earlier create with the same `idempotencyKey` made this workspace. */
+    readonly replayed: Schema.optional<Schema.Boolean>;
+    /** The launch identity the create named (`launchId`), recorded on its attempt. */
+    readonly launchId: Schema.optional<Schema.String>;
+}>>, HttpApiEndpoint.Json<typeof BudgetExceededError | typeof WorkspaceBadRequestError | typeof WorkspaceRuntimeEnvReferencesUnsupportedError | typeof WorkspaceDockerServiceUnsupportedError | typeof WorkspaceForbiddenError | typeof WorkspaceNotFoundError | typeof WorkspaceConflictError | typeof WorkspaceBadGatewayError | typeof WorkspaceServiceUnavailableError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"execWorkspace", "POST", "/:workspaceId/exec", HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+    /** Commands execute sequentially in the workspace, each recorded like any other process. */
+    readonly commands: Schema.$Array<Schema.Struct<{
+        readonly executable: Schema.String;
+        readonly args: Schema.$Array<Schema.String>;
+        readonly cwd: Schema.optional<Schema.String>;
+    }>>;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly runId: Schema.String;
+    readonly workspaceId: Schema.String;
+    readonly attemptId: Schema.optional<Schema.String>;
+    readonly ownerUserId: Schema.String;
+    readonly harnessId: Schema.String;
+    readonly mode: Schema.Literals<readonly ["one-shot", "interactive"]>;
+    readonly status: Schema.Literals<readonly ["queued", "running", "completed", "failed", "cancelled"]>;
+    readonly prompt: Schema.optional<Schema.String>;
+    readonly command: Schema.optional<Schema.Struct<{
+        readonly executable: Schema.String;
+        readonly args: Schema.$Array<Schema.String>;
+        readonly cwd: Schema.optional<Schema.String>;
+    }>>;
+    readonly metadata: Schema.optional<Schema.$Record<Schema.String, Schema.Unknown>>;
+    readonly exitCode: Schema.optional<Schema.Number>;
+    readonly errorMessage: Schema.optional<Schema.String>;
+    readonly startedAt: Schema.optional<Schema.String>;
+    readonly finishedAt: Schema.optional<Schema.String>;
+    readonly createdAt: Schema.String;
+    readonly updatedAt: Schema.String;
+}>>, HttpApiEndpoint.Json<typeof WorkspaceBadRequestError | typeof WorkspaceNotFoundError | typeof WorkspaceConflictError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"expireWorkspace", "POST", "/:workspaceId/expire", HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+    readonly ttlSeconds: Schema.optional<Schema.NullOr<Schema.Int>>;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+    readonly expiresAt: Schema.NullOr<Schema.String>;
+}>>, HttpApiEndpoint.Json<typeof WorkspaceBadRequestError | typeof WorkspaceNotFoundError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"flushWorkspaceCapture", "POST", "/:workspaceId/capture/flush", HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+    /** `final` or `suspend` (the default). */
+    readonly kind: Schema.optional<Schema.Literals<readonly ["final", "suspend"]>>;
+    /** How long the daemon may take before it answers, in milliseconds. Absent: its own default. */
+    readonly deadlineMs: Schema.optional<Schema.Int>;
+    /**
+     * Final only: how long managed processes get between SIGTERM and SIGKILL, in milliseconds,
+     * counted inside `deadlineMs`. Absent: the daemon's default.
+     */
+    readonly graceMs: Schema.optional<Schema.Int>;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly epoch: Schema.Number;
+    readonly worktreeId: Schema.String;
+    /** The newest capture the session channel has registered for this worktree. */
+    readonly headN: Schema.optional<Schema.Number>;
+    /** Captures staged on the executor and not yet registered: the unsaved queue. */
+    readonly pending: Schema.Number;
+    readonly stagedBytes: Schema.Number;
+    readonly uploadedObjects: Schema.Number;
+    readonly uploadedBytes: Schema.Number;
+    readonly registered: Schema.Number;
+    readonly fenced: Schema.Boolean;
+    readonly paused: Schema.Boolean;
+    readonly lastSnapUnixMs: Schema.optional<Schema.Number>;
+    /**
+     * Capture classes the registrar refused for the session's byte quota: nothing of these ships
+     * until the next epoch or re-plan, whatever `pending` says. Non-empty means work is NOT being
+     * saved. Absent from control planes that predate it.
+     */
+    readonly refused: Schema.optional<Schema.$Array<Schema.Literals<readonly ["small", "bulk"]>>>;
+    /**
+     * Bytes still to ship, and bulk captures still pending (sealantd's `pending_bytes` /
+     * `pending_bulk`). Every field below `refused` is absent until the daemon reports it (the
+     * control plane's pinned sealantd wire predates them).
+     */
+    readonly pendingBytes: Schema.optional<Schema.Number>;
+    readonly pendingBulk: Schema.optional<Schema.Number>;
+    /**
+     * The daemon's own account of its last FINAL flush: true only when it quiesced every managed
+     * process, snapshotted both capture classes and registered everything. The only proof that an
+     * executor may go away; `pending === 0` alone is not. Absent until sealantd reports it (read
+     * absent as not complete).
+     */
+    readonly complete: Schema.optional<Schema.Boolean>;
+    /**
+     * Why the last final flush is not complete (`not-final`, `in-progress`, `processes-remain`,
+     * `sweep-unavailable`, `snapshot-failed`, `unreadable`, `fenced`, `conflict`, `deadline`,
+     * `ship-failed`, `pending`, `internal`). A class whose last snap failed is `snapshot-failed`.
+     */
+    readonly incompleteReason: Schema.optional<Schema.String>;
+    /**
+     * Paths the last snap of each class could not read (listed, stat'ed or opened), summed over
+     * both classes. Never taken as deleted: an automatic snap carries a path's last captured
+     * content forward, a final snap fails instead.
+     */
+    readonly unreadable: Schema.optional<Schema.Number>;
+    /** Of `unreadable`, the paths whose last captured content was carried forward. */
+    readonly carried: Schema.optional<Schema.Number>;
+    /**
+     * The first unreadable paths (at most 20), virtual: `tree/<path>` under the worktree,
+     * `.git/<path>`, `harness/<path>`; small class first.
+     */
+    readonly unreadablePaths: Schema.optional<Schema.$Array<Schema.String>>;
+    /**
+     * A capture the registrar refused to register that the executor is working through:
+     * `missing-objects` (an object it names is not in the store) or `unrestorable` (a section's
+     * tree would not restore). Nothing is dropped: its objects are uploaded again and it is
+     * rebuilt from disk in its place.
+     */
+    readonly registerRefused: Schema.optional<Schema.String>;
+    /** That refused capture's chain position. */
+    readonly registerRefusedN: Schema.optional<Schema.Number>;
+    /** The first keys (at most 20) the registrar named as missing. */
+    readonly registerMissing: Schema.optional<Schema.$Array<Schema.String>>;
+    /** Register refusals the daemon has seen since it started. */
+    readonly registerRefusals: Schema.optional<Schema.Number>;
+    /** The refused capture waits to be rebuilt from disk; nothing behind it registers first. */
+    readonly repairing: Schema.optional<Schema.Boolean>;
+    /**
+     * A bulk build is in progress: its capture is not queued yet, so `pending` and `pendingBulk`
+     * do not count it (`pendingBytes` counts what it has staged). A drain is not done while true.
+     */
+    readonly bulkBuilding: Schema.optional<Schema.Boolean>;
+    /**
+     * Each captured class's snaps: how many failed since the daemon started, and the last one's
+     * error while it fails. A snap that fails stages nothing: what changed since the last capture
+     * is on the executor's disk only.
+     */
+    readonly snaps: Schema.optional<Schema.$Array<Schema.Struct<{
+        readonly class: Schema.Literals<readonly ["small", "bulk"]>;
+        /** Snaps of this class that failed since the daemon started. */
+        readonly snapsFailed: Schema.Number;
+        /** The last snap's error, while the last snap failed; absent once one succeeds. */
+        readonly lastSnapError: Schema.optional<Schema.String>;
+        /** When the current run of failed snaps began (Unix ms), while the last snap failed. */
+        readonly snapFailingSinceUnixMs: Schema.optional<Schema.Number>;
+    }>>>;
+    /**
+     * Derived from `snaps`: the error of the class that has been failing longest. Present means the
+     * executor's newest work is NOT being captured, whatever `pending` says.
+     */
+    readonly lastSnapError: Schema.optional<Schema.String>;
+    /** Derived from `snaps`: when the earliest current run of failed snaps began (Unix ms). */
+    readonly snapFailingSinceUnixMs: Schema.optional<Schema.Number>;
+    /** Derived from `snaps`: failed snaps of every class since the daemon started. */
+    readonly snapsFailed: Schema.optional<Schema.Number>;
+    /**
+     * Where in the executor's own history this answer was made. Absent from a daemon that predates
+     * the stamp: such answers cannot be ordered by position.
+     */
+    readonly origin: Schema.optional<Schema.Struct<{
+        readonly epoch: Schema.Int;
+        readonly launch: Schema.String;
+        readonly bootId: Schema.String;
+        readonly bootGeneration: Schema.Int;
+        readonly observation: Schema.Int;
+        readonly headN: Schema.optional<Schema.Int>;
+    }>>;
+    /**
+     * A capture step past its bound, while one is: the executor's capture is stuck there now. Not a
+     * verdict: the step's own limit ends it and the snap fails (`snaps`). Absent while nothing is
+     * past its bound, and from a daemon or control plane that predates it.
+     */
+    readonly overdue: Schema.optional<Schema.Struct<{
+        readonly step: Schema.String;
+        readonly startedUnixMs: Schema.Number;
+        readonly runningMs: Schema.Number;
+        readonly boundMs: Schema.Number;
+    }>>;
+}>>, HttpApiEndpoint.Json<typeof WorkspaceBadRequestError | typeof WorkspaceNotFoundError | typeof WorkspaceConflictError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"getWorkspace", "GET", "/:workspaceId", HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly ownerUserId: Schema.optional<Schema.String>;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+    readonly name: Schema.String;
+    readonly ownerUserId: Schema.String;
+    readonly status: Schema.Literals<readonly ["queued", "running", "ready", "failed", "cancelled", "stopped", "retained"]>;
+    readonly registryId: Schema.optional<Schema.String>;
+    readonly repository: Schema.optional<Schema.String>;
+    readonly tag: Schema.optional<Schema.String>;
+    readonly runtime: Schema.optional<Schema.Struct<{
+        readonly adapter: Schema.Literals<readonly ["docker", "k8s", "k3s", "cloudflare", "microvm"]>;
+        /**
+         * The executor's identity on its runtime: the Docker container id, the Pod name, the MicroVM
+         * id. This is the id a caller records at launch and names in a stop's `completion`.
+         */
+        readonly resourceId: Schema.String;
+        readonly reference: Schema.String;
+        /** `retained`: the executor is kept with its disk for recovery (see `workspaceStatusSchema`). */
+        readonly status: Schema.Literals<readonly ["pending", "running", "ready", "failed", "stopped", "retained"]>;
+        readonly endpoint: Schema.optional<Schema.String>;
+        /**
+         * ISO-8601 instant the runtime itself ends the executor, whatever anyone asks: a Lambda
+         * MicroVM's maximum duration from its start. `null` where the runtime imposes no lifetime
+         * (Docker, Kubernetes). A caller holding unsaved work on the executor drains before it. Absent
+         * only from control planes that predate it.
+         */
+        readonly deadline: Schema.optional<Schema.NullOr<Schema.String>>;
+        /** The run (launch attempt) this executor belongs to. Absent from older control planes. */
+        readonly runId: Schema.optional<Schema.String>;
+        /** The launch identity the create named for this executor (`launchId`), when it named one. */
+        readonly launchId: Schema.optional<Schema.String>;
+    }>>;
+    readonly publishedImage: Schema.optional<Schema.Struct<{
+        readonly reference: Schema.String;
+        readonly digestReference: Schema.String;
+        readonly digest: Schema.String;
+    }>>;
+    readonly error: Schema.optional<Schema.Struct<{
+        readonly message: Schema.String;
+        readonly code: Schema.optional<Schema.String>;
+    }>>;
+    readonly createdAt: Schema.String;
+    readonly updatedAt: Schema.String;
+    readonly startedAt: Schema.optional<Schema.String>;
+    readonly finishedAt: Schema.optional<Schema.String>;
+    readonly expiresAt: Schema.optional<Schema.String>;
+    readonly spec: Schema.optional<Schema.Unknown>;
+    /**
+     * The current runtime's capture drain as last observed (see `workspaceCaptureDrainSchema`).
+     * Absent while no drain or preservation schedule exists, and from older control planes.
+     */
+    readonly captureDrain: Schema.optional<Schema.Struct<{
+        readonly state: Schema.Literals<readonly ["draining", "kept", "saved", "gone", "stop-failed", "stopped", "discarded"]>;
+        readonly detail: Schema.optional<Schema.String>;
+        /** ISO-8601: when this was observed. */
+        readonly observedAt: Schema.optional<Schema.String>;
+        /** ISO-8601: when the deadline sweep starts (or started) the final drain. */
+        readonly preservationStartsAt: Schema.optional<Schema.String>;
+        /** The owner's request to discard the unsaved captures: who asked, and when (ISO-8601). */
+        readonly discard: Schema.optional<Schema.Struct<{
+            readonly requestedBy: Schema.String;
+            readonly requestedAt: Schema.String;
+        }>>;
+        /**
+         * The executor is RETAINED: kept because its disk holds work not confirmed saved. `since` and
+         * `reason` say when and why; recovery is attempted on a backoff (`recoveryAttempts`,
+         * `nextRecoveryAt`, `lastRecoveryError`); `recoverable` says whether its runtime can restart it
+         * on its own disk (Docker) or only report it (Kubernetes, MicroVM). Absent when nothing is
+         * retained.
+         */
+        readonly retained: Schema.optional<Schema.Struct<{
+            readonly since: Schema.String;
+            readonly reason: Schema.String;
+            readonly recoverable: Schema.Boolean;
+            readonly recoveryAttempts: Schema.Int;
+            readonly nextRecoveryAt: Schema.optional<Schema.String>;
+            readonly lastRecoveryError: Schema.optional<Schema.String>;
+        }>>;
+        /**
+         * The executor this observation is about: the run and its runtime identity (`resourceId` is
+         * the id a stop's `completion` names).
+         */
+        readonly executor: Schema.optional<Schema.Struct<{
+            readonly runId: Schema.String;
+            readonly adapter: Schema.String;
+            readonly resourceId: Schema.String;
+            readonly reference: Schema.optional<Schema.String>;
+            /** The launch identity the create named for this executor (`launchId`), when it named one. */
+            readonly launchId: Schema.optional<Schema.String>;
+        }>>;
+        /** The latest `completion` attestation accepted for this executor (see `stop`). */
+        readonly completion: Schema.optional<Schema.Struct<{
+            readonly executorId: Schema.String;
+            readonly epoch: Schema.Int;
+            readonly captureN: Schema.Int;
+            readonly attestedAt: Schema.String;
+            readonly launchId: Schema.optional<Schema.String>;
+            /** When the store recorded the seal, when the attestation said. */
+            readonly sealedAt: Schema.optional<Schema.String>;
+            /** Where in the executor's own history the seal was made, when the attestation said. */
+            readonly origin: Schema.optional<Schema.Struct<{
+                readonly epoch: Schema.Int;
+                readonly launch: Schema.String;
+                readonly bootId: Schema.String;
+                readonly bootGeneration: Schema.Int;
+                readonly observation: Schema.Int;
+                readonly headN: Schema.optional<Schema.Int>;
+            }>>;
+        }>>;
+    }>>;
+}>>, HttpApiEndpoint.Json<typeof WorkspaceNotFoundError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"getWorkspaceCaptureStatus", "GET", "/:workspaceId/capture", HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly epoch: Schema.Number;
+    readonly worktreeId: Schema.String;
+    /** The newest capture the session channel has registered for this worktree. */
+    readonly headN: Schema.optional<Schema.Number>;
+    /** Captures staged on the executor and not yet registered: the unsaved queue. */
+    readonly pending: Schema.Number;
+    readonly stagedBytes: Schema.Number;
+    readonly uploadedObjects: Schema.Number;
+    readonly uploadedBytes: Schema.Number;
+    readonly registered: Schema.Number;
+    readonly fenced: Schema.Boolean;
+    readonly paused: Schema.Boolean;
+    readonly lastSnapUnixMs: Schema.optional<Schema.Number>;
+    /**
+     * Capture classes the registrar refused for the session's byte quota: nothing of these ships
+     * until the next epoch or re-plan, whatever `pending` says. Non-empty means work is NOT being
+     * saved. Absent from control planes that predate it.
+     */
+    readonly refused: Schema.optional<Schema.$Array<Schema.Literals<readonly ["small", "bulk"]>>>;
+    /**
+     * Bytes still to ship, and bulk captures still pending (sealantd's `pending_bytes` /
+     * `pending_bulk`). Every field below `refused` is absent until the daemon reports it (the
+     * control plane's pinned sealantd wire predates them).
+     */
+    readonly pendingBytes: Schema.optional<Schema.Number>;
+    readonly pendingBulk: Schema.optional<Schema.Number>;
+    /**
+     * The daemon's own account of its last FINAL flush: true only when it quiesced every managed
+     * process, snapshotted both capture classes and registered everything. The only proof that an
+     * executor may go away; `pending === 0` alone is not. Absent until sealantd reports it (read
+     * absent as not complete).
+     */
+    readonly complete: Schema.optional<Schema.Boolean>;
+    /**
+     * Why the last final flush is not complete (`not-final`, `in-progress`, `processes-remain`,
+     * `sweep-unavailable`, `snapshot-failed`, `unreadable`, `fenced`, `conflict`, `deadline`,
+     * `ship-failed`, `pending`, `internal`). A class whose last snap failed is `snapshot-failed`.
+     */
+    readonly incompleteReason: Schema.optional<Schema.String>;
+    /**
+     * Paths the last snap of each class could not read (listed, stat'ed or opened), summed over
+     * both classes. Never taken as deleted: an automatic snap carries a path's last captured
+     * content forward, a final snap fails instead.
+     */
+    readonly unreadable: Schema.optional<Schema.Number>;
+    /** Of `unreadable`, the paths whose last captured content was carried forward. */
+    readonly carried: Schema.optional<Schema.Number>;
+    /**
+     * The first unreadable paths (at most 20), virtual: `tree/<path>` under the worktree,
+     * `.git/<path>`, `harness/<path>`; small class first.
+     */
+    readonly unreadablePaths: Schema.optional<Schema.$Array<Schema.String>>;
+    /**
+     * A capture the registrar refused to register that the executor is working through:
+     * `missing-objects` (an object it names is not in the store) or `unrestorable` (a section's
+     * tree would not restore). Nothing is dropped: its objects are uploaded again and it is
+     * rebuilt from disk in its place.
+     */
+    readonly registerRefused: Schema.optional<Schema.String>;
+    /** That refused capture's chain position. */
+    readonly registerRefusedN: Schema.optional<Schema.Number>;
+    /** The first keys (at most 20) the registrar named as missing. */
+    readonly registerMissing: Schema.optional<Schema.$Array<Schema.String>>;
+    /** Register refusals the daemon has seen since it started. */
+    readonly registerRefusals: Schema.optional<Schema.Number>;
+    /** The refused capture waits to be rebuilt from disk; nothing behind it registers first. */
+    readonly repairing: Schema.optional<Schema.Boolean>;
+    /**
+     * A bulk build is in progress: its capture is not queued yet, so `pending` and `pendingBulk`
+     * do not count it (`pendingBytes` counts what it has staged). A drain is not done while true.
+     */
+    readonly bulkBuilding: Schema.optional<Schema.Boolean>;
+    /**
+     * Each captured class's snaps: how many failed since the daemon started, and the last one's
+     * error while it fails. A snap that fails stages nothing: what changed since the last capture
+     * is on the executor's disk only.
+     */
+    readonly snaps: Schema.optional<Schema.$Array<Schema.Struct<{
+        readonly class: Schema.Literals<readonly ["small", "bulk"]>;
+        /** Snaps of this class that failed since the daemon started. */
+        readonly snapsFailed: Schema.Number;
+        /** The last snap's error, while the last snap failed; absent once one succeeds. */
+        readonly lastSnapError: Schema.optional<Schema.String>;
+        /** When the current run of failed snaps began (Unix ms), while the last snap failed. */
+        readonly snapFailingSinceUnixMs: Schema.optional<Schema.Number>;
+    }>>>;
+    /**
+     * Derived from `snaps`: the error of the class that has been failing longest. Present means the
+     * executor's newest work is NOT being captured, whatever `pending` says.
+     */
+    readonly lastSnapError: Schema.optional<Schema.String>;
+    /** Derived from `snaps`: when the earliest current run of failed snaps began (Unix ms). */
+    readonly snapFailingSinceUnixMs: Schema.optional<Schema.Number>;
+    /** Derived from `snaps`: failed snaps of every class since the daemon started. */
+    readonly snapsFailed: Schema.optional<Schema.Number>;
+    /**
+     * Where in the executor's own history this answer was made. Absent from a daemon that predates
+     * the stamp: such answers cannot be ordered by position.
+     */
+    readonly origin: Schema.optional<Schema.Struct<{
+        readonly epoch: Schema.Int;
+        readonly launch: Schema.String;
+        readonly bootId: Schema.String;
+        readonly bootGeneration: Schema.Int;
+        readonly observation: Schema.Int;
+        readonly headN: Schema.optional<Schema.Int>;
+    }>>;
+    /**
+     * A capture step past its bound, while one is: the executor's capture is stuck there now. Not a
+     * verdict: the step's own limit ends it and the snap fails (`snaps`). Absent while nothing is
+     * past its bound, and from a daemon or control plane that predates it.
+     */
+    readonly overdue: Schema.optional<Schema.Struct<{
+        readonly step: Schema.String;
+        readonly startedUnixMs: Schema.Number;
+        readonly runningMs: Schema.Number;
+        readonly boundMs: Schema.Number;
+    }>>;
+}>>, HttpApiEndpoint.Json<typeof WorkspaceBadRequestError | typeof WorkspaceNotFoundError | typeof WorkspaceConflictError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"getWorkspaceCreate", "GET", "/idempotency-keys/:idempotencyKey", HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly idempotencyKey: Schema.String;
+}>>, HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly idempotencyKey: Schema.String;
+    readonly state: Schema.Literals<readonly ["pending", "found", "cancelled", "none"]>;
+    readonly workspaceId: Schema.optional<Schema.String>;
+    readonly runId: Schema.optional<Schema.String>;
+    readonly launchId: Schema.optional<Schema.String>;
+}>>, HttpApiEndpoint.Json<typeof WorkspaceBadRequestError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"getWorkspaceSshTarget", "GET", "/:workspaceId/ssh-target", HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly "x-sealant-gateway-token": Schema.optional<Schema.String>;
+    readonly "x-sealant-principal-id": Schema.optional<Schema.String>;
+}>>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+    readonly attemptId: Schema.String;
+    readonly runtime: Schema.Struct<{
+        readonly adapter: Schema.Literals<readonly ["docker", "k8s", "k3s", "cloudflare", "microvm"]>;
+        readonly resourceId: Schema.String;
+        readonly reference: Schema.String;
+        readonly status: Schema.Literals<readonly ["pending", "running", "ready", "failed", "stopped"]>;
+        readonly endpoint: Schema.String;
+    }>;
+}>>, HttpApiEndpoint.Json<typeof WorkspaceUnauthorizedError | typeof WorkspaceNotFoundError | typeof WorkspaceConflictError | typeof WorkspaceServiceUnavailableError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"listWorkspaceAttempts", "GET", "/:workspaceId/attempts", HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly ownerUserId: Schema.optional<Schema.String>;
+    readonly limit: Schema.optional<Schema.String>;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly items: Schema.$Array<Schema.Struct<{
+        readonly attemptId: Schema.String;
+        readonly relation: Schema.Literals<readonly ["launch", "rebuild", "retry", "resume"]>;
+        readonly status: Schema.Literals<readonly ["queued", "running", "ready", "failed", "cancelled", "stopped", "retained"]>;
+        readonly triggerType: Schema.Literals<readonly ["manual", "schedule", "api", "retry"]>;
+        readonly triggerRef: Schema.optional<Schema.String>;
+        readonly runtime: Schema.optional<Schema.Struct<{
+            readonly adapter: Schema.Literals<readonly ["docker", "k8s", "k3s", "cloudflare", "microvm"]>;
+            /**
+             * The executor's identity on its runtime: the Docker container id, the Pod name, the MicroVM
+             * id. This is the id a caller records at launch and names in a stop's `completion`.
+             */
+            readonly resourceId: Schema.String;
+            readonly reference: Schema.String;
+            /** `retained`: the executor is kept with its disk for recovery (see `workspaceStatusSchema`). */
+            readonly status: Schema.Literals<readonly ["pending", "running", "ready", "failed", "stopped", "retained"]>;
+            readonly endpoint: Schema.optional<Schema.String>;
+            /**
+             * ISO-8601 instant the runtime itself ends the executor, whatever anyone asks: a Lambda
+             * MicroVM's maximum duration from its start. `null` where the runtime imposes no lifetime
+             * (Docker, Kubernetes). A caller holding unsaved work on the executor drains before it. Absent
+             * only from control planes that predate it.
+             */
+            readonly deadline: Schema.optional<Schema.NullOr<Schema.String>>;
+            /** The run (launch attempt) this executor belongs to. Absent from older control planes. */
+            readonly runId: Schema.optional<Schema.String>;
+            /** The launch identity the create named for this executor (`launchId`), when it named one. */
+            readonly launchId: Schema.optional<Schema.String>;
+        }>>;
+        readonly publishedImage: Schema.optional<Schema.Struct<{
+            readonly reference: Schema.String;
+            readonly digestReference: Schema.String;
+            readonly digest: Schema.String;
+        }>>;
+        readonly error: Schema.optional<Schema.Struct<{
+            readonly message: Schema.String;
+            readonly code: Schema.optional<Schema.String>;
+        }>>;
+        readonly spec: Schema.optional<Schema.Unknown>;
+        readonly queuedAt: Schema.String;
+        readonly createdAt: Schema.String;
+        readonly updatedAt: Schema.String;
+        readonly linkedAt: Schema.String;
+        readonly startedAt: Schema.optional<Schema.String>;
+        readonly finishedAt: Schema.optional<Schema.String>;
+        readonly durationMs: Schema.optional<Schema.Number>;
+    }>>;
+}>>, HttpApiEndpoint.Json<typeof WorkspaceBadRequestError | typeof WorkspaceNotFoundError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"listWorkspaceEvents", "GET", "/:workspaceId/events", HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly ownerUserId: Schema.optional<Schema.String>;
+    readonly limit: Schema.optional<Schema.String>;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly items: Schema.$Array<Schema.Struct<{
+        readonly eventId: Schema.String;
+        readonly workspaceId: Schema.String;
+        readonly attemptId: Schema.optional<Schema.String>;
+        readonly type: Schema.Literals<readonly ["workspace.created", "attempt.queued", "attempt.running", "attempt.succeeded", "attempt.failed", "attempt.cancelled", "image.published", "runtime.pending", "runtime.running", "runtime.ready", "runtime.failed", "runtime.stopped"]>;
+        readonly occurredAt: Schema.String;
+        readonly message: Schema.optional<Schema.String>;
+        readonly data: Schema.optional<Schema.Unknown>;
+    }>>;
+}>>, HttpApiEndpoint.Json<typeof WorkspaceBadRequestError | typeof WorkspaceNotFoundError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"listWorkspaces", "GET", "/", HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+    readonly status: Schema.optional<Schema.Literals<readonly ["queued", "running", "ready", "failed", "cancelled", "stopped", "retained"]>>;
+    readonly limit: Schema.optional<Schema.String>;
+    /** Only the owner's workspace created with this `idempotencyKey` (none or one item). */
+    readonly idempotencyKey: Schema.optional<Schema.String>;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly items: Schema.$Array<Schema.Struct<{
+        readonly workspaceId: Schema.String;
+        readonly name: Schema.String;
+        readonly ownerUserId: Schema.String;
+        readonly status: Schema.Literals<readonly ["queued", "running", "ready", "failed", "cancelled", "stopped", "retained"]>;
+        readonly registryId: Schema.optional<Schema.String>;
+        readonly repository: Schema.optional<Schema.String>;
+        readonly tag: Schema.optional<Schema.String>;
+        readonly runtime: Schema.optional<Schema.Struct<{
+            readonly adapter: Schema.Literals<readonly ["docker", "k8s", "k3s", "cloudflare", "microvm"]>;
+            /**
+             * The executor's identity on its runtime: the Docker container id, the Pod name, the MicroVM
+             * id. This is the id a caller records at launch and names in a stop's `completion`.
+             */
+            readonly resourceId: Schema.String;
+            readonly reference: Schema.String;
+            /** `retained`: the executor is kept with its disk for recovery (see `workspaceStatusSchema`). */
+            readonly status: Schema.Literals<readonly ["pending", "running", "ready", "failed", "stopped", "retained"]>;
+            readonly endpoint: Schema.optional<Schema.String>;
+            /**
+             * ISO-8601 instant the runtime itself ends the executor, whatever anyone asks: a Lambda
+             * MicroVM's maximum duration from its start. `null` where the runtime imposes no lifetime
+             * (Docker, Kubernetes). A caller holding unsaved work on the executor drains before it. Absent
+             * only from control planes that predate it.
+             */
+            readonly deadline: Schema.optional<Schema.NullOr<Schema.String>>;
+            /** The run (launch attempt) this executor belongs to. Absent from older control planes. */
+            readonly runId: Schema.optional<Schema.String>;
+            /** The launch identity the create named for this executor (`launchId`), when it named one. */
+            readonly launchId: Schema.optional<Schema.String>;
+        }>>;
+        readonly publishedImage: Schema.optional<Schema.Struct<{
+            readonly reference: Schema.String;
+            readonly digestReference: Schema.String;
+            readonly digest: Schema.String;
+        }>>;
+        readonly error: Schema.optional<Schema.Struct<{
+            readonly message: Schema.String;
+            readonly code: Schema.optional<Schema.String>;
+        }>>;
+        readonly createdAt: Schema.String;
+        readonly updatedAt: Schema.String;
+        readonly startedAt: Schema.optional<Schema.String>;
+        readonly finishedAt: Schema.optional<Schema.String>;
+        readonly expiresAt: Schema.optional<Schema.String>;
+    }>>;
+}>>, HttpApiEndpoint.Json<typeof WorkspaceBadRequestError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"recoverWorkspace", "POST", "/:workspaceId/recover", HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+    readonly state: Schema.Literals<readonly ["requested", "not-retained"]>;
+    readonly recoverable: Schema.optional<Schema.Boolean>;
+}>>, HttpApiEndpoint.Json<typeof WorkspaceBadRequestError | typeof WorkspaceNotFoundError | typeof WorkspaceConflictError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"renameWorkspace", "PATCH", "/:workspaceId/name", HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly name: Schema.String;
+    /** The workspace's owner. Required by the control plane: a rename that names none finds nothing. */
+    readonly ownerUserId: Schema.optional<Schema.String>;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+    readonly name: Schema.String;
+    readonly updatedAt: Schema.String;
+}>>, HttpApiEndpoint.Json<typeof WorkspaceNotFoundError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"replanWorkspaceCapture", "POST", "/:workspaceId/capture/replan", HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly worktreeId: Schema.String;
+    readonly epoch: Schema.Number;
+    readonly headN: Schema.optional<Schema.Number>;
+    readonly headCaptureId: Schema.optional<Schema.String>;
+    readonly filesWritten: Schema.Number;
+    readonly bytesWritten: Schema.Number;
+    readonly filesSkipped: Schema.Number;
+    readonly bytesSkipped: Schema.Number;
+    readonly removed: Schema.Number;
+    readonly unchanged: Schema.Boolean;
+}>>, HttpApiEndpoint.Json<typeof WorkspaceBadRequestError | typeof WorkspaceNotFoundError | typeof WorkspaceConflictError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"restartWorkspace", "POST", "/:workspaceId/restart", HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+    /** The new attempt driving the fresh launch. */
+    readonly runId: Schema.String;
+    readonly status: Schema.Literals<readonly ["queued", "running", "ready", "failed", "cancelled", "stopped", "retained"]>;
+}>>, HttpApiEndpoint.Json<typeof BudgetExceededError | typeof WorkspaceBadRequestError | typeof WorkspaceNotFoundError | typeof WorkspaceConflictError | typeof WorkspaceBadGatewayError | typeof WorkspaceInternalServerError>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"stopWorkspace", "POST", "/:workspaceId/stop", HttpApiEndpoint.StringTree<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly ownerUserId: Schema.String;
+    /**
+     * End the workspace WITHOUT saving its unsaved captures. A capture-sourced workspace is
+     * otherwise drained before it stops, and kept running for as long as its work cannot be
+     * confirmed saved; this is the owner's explicit way out. The request is recorded (who, when)
+     * and every stop path honours it: the runtime is terminated at once, and the workspace's
+     * `captureDrain` reads `discarded`. Accepted on a workspace already stopped whose runtime is
+     * still up (a kept one). Owner only.
+     */
+    readonly discardUnsaved: Schema.optional<Schema.Boolean>;
+    /**
+     * The caller's attestation that its capture store holds a SEALED final capture of this
+     * workspace's current executor: a FINAL flush that completed (every writer stopped, both
+     * classes snapshotted, everything registered) and was recorded durably by the store. It is
+     * permission to remove that executor's disk once it has ended, even when this control plane
+     * never read `complete: true` from it itself (the FINAL reply was lost, the daemon exited
+     * before a drain reached it). Accepted only when `executorId` names the current executor — the
+     * run id, or the runtime's `resourceId` / `reference` (`workspace.details().runtime`) — and
+     * nothing the control plane observed from the executor contradicts it: an older `epoch` than
+     * the executor reported, a capture past `captureN`, or — in the same epoch — a report that its
+     * work is NOT saved (incomplete, changed, unreadable, a failed snapshot) that the executor's
+     * own history does not place before the seal (`origin`; without it, any such report at or past
+     * `captureN` counts against the seal). Otherwise ignored, and the executor is kept as before.
+     * Weighed again
+     * when it is used: a later report that the work is not saved revokes it. A seal stands in for
+     * a lost FINAL answer, never for a received one that said the work is not saved. Never a
+     * reason to skip the drain of a running executor.
+     */
+    readonly completion: Schema.optional<Schema.Struct<{
+        /** The sealed capture's chain position (`n`). */
+        readonly captureN: Schema.Int;
+        /** The capture lease epoch the seal was made under. */
+        readonly epoch: Schema.Int;
+        /** The executor the seal names: run id, or runtime `resourceId` / `reference`. */
+        readonly executorId: Schema.String;
+        /**
+         * The launch identity the seal names (`final_seal.executor`). Required when the create named
+         * a `launchId`, and then it must be that one; an attestation without it, or naming another
+         * launch, is ignored (a seal never transfers between executors).
+         */
+        readonly launchId: Schema.optional<Schema.String>;
+        /**
+         * When the store recorded the seal (ISO 8601). Kept for display: clocks order nothing. It
+         * must still read as a time.
+         */
+        readonly sealedAt: Schema.optional<Schema.String>;
+        /**
+         * Where in the executor's own history the seal was made (sealantd stamps it on the
+         * `final_seal`): the one thing that orders the seal against a report of the same capture
+         * that its work is not saved. Without it, such a report at or past `captureN` counts
+         * against the seal.
+         */
+        readonly origin: Schema.optional<Schema.Struct<{
+            readonly epoch: Schema.Int;
+            readonly launch: Schema.String;
+            readonly bootId: Schema.String;
+            readonly bootGeneration: Schema.Int;
+            readonly observation: Schema.Int;
+            readonly headN: Schema.optional<Schema.Int>;
+        }>>;
+    }>>;
+}>>, HttpApiEndpoint.StringTree<never>, HttpApiEndpoint.Json<Schema.Struct<{
+    readonly workspaceId: Schema.String;
+    readonly status: Schema.Literals<readonly ["queued", "running", "ready", "failed", "cancelled", "stopped", "retained"]>;
+    /**
+     * What became of a `completion` attestation on the request: `accepted` (recorded; it lets the
+     * executor's disk go once it has ended) or `ignored` (it does not name this executor, or is for
+     * an older epoch; `detail` says which). Absent when the request carried none.
+     */
+    readonly completion: Schema.optional<Schema.Struct<{
+        readonly outcome: Schema.Literals<readonly ["accepted", "ignored"]>;
+        readonly detail: Schema.optional<Schema.String>;
+    }>>;
+}>>, HttpApiEndpoint.Json<typeof WorkspaceBadRequestError | typeof WorkspaceNotFoundError | typeof WorkspaceConflictError | typeof WorkspaceBadGatewayError | typeof WorkspaceInternalServerError>, never, never>, false>;
+export {};