npm - @sealant/sdk-next - Versions diffs - 0.39.0-next.708 → 0.39.0-next.709 - Mend

@sealant/sdk-next 0.39.0-next.708 → 0.39.0-next.709

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/dist/effect/api-client.d.ts +148 -148
package/dist/effect/operations.d.ts +49 -49
package/dist/facade/workspace.js +39 -3
package/dist/types.d.ts +9 -1
package/package.json +3 -3

package/dist/effect/api-client.d.ts CHANGED Viewed

@@ -24,7 +24,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly revokedAt?: string | undefined;
             readonly createdAt: string;
             readonly token: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").AccessTokenBadRequestError | import("@sealant/api-contracts").AccessTokenInternalServerError | import("@sealant/api-contracts").AccessTokenNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").AccessTokenBadRequestError | import("@sealant/api-contracts").AccessTokenInternalServerError | import("@sealant/api-contracts").AccessTokenNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly listAccessTokens: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly query: {
                 readonly ownerUserId: string;
@@ -41,7 +41,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly revokedAt?: string | undefined;
                 readonly createdAt: string;
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").AccessTokenBadRequestError | import("@sealant/api-contracts").AccessTokenInternalServerError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").AccessTokenBadRequestError | import("@sealant/api-contracts").AccessTokenInternalServerError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly revokeAccessToken: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly tokenId: string;
@@ -59,7 +59,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly expiresAt?: string | undefined;
             readonly revokedAt?: string | undefined;
             readonly createdAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").AccessTokenBadRequestError | import("@sealant/api-contracts").AccessTokenInternalServerError | import("@sealant/api-contracts").AccessTokenNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").AccessTokenBadRequestError | import("@sealant/api-contracts").AccessTokenInternalServerError | import("@sealant/api-contracts").AccessTokenNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
     };
     readonly connectedAccounts: {
         readonly archiveConnectedAccount: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
@@ -90,7 +90,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly lastRefreshAt: string | null;
                 readonly lastRefreshOutcome: "failed" | "fresh" | "refreshed" | null;
             };
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly createConnectedAccount: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly payload: {
                 readonly ownerUserId: string;
@@ -119,7 +119,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly lastRefreshAt: string | null;
                 readonly lastRefreshOutcome: "failed" | "fresh" | "refreshed" | null;
             };
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ConnectedAccountBadRequestError | import("@sealant/api-contracts").ConnectedAccountConflictError | import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("@sealant/api-contracts").ConnectedAccountServiceUnavailableError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ConnectedAccountBadRequestError | import("@sealant/api-contracts").ConnectedAccountConflictError | import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("@sealant/api-contracts").ConnectedAccountServiceUnavailableError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly listConnectedAccounts: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly query: {
                 readonly ownerUserId: string;
@@ -147,7 +147,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                     readonly lastRefreshOutcome: "failed" | "fresh" | "refreshed" | null;
                 };
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly markConnectedAccountInvalid: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly connectedAccountId: string;
@@ -176,7 +176,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly lastRefreshAt: string | null;
                 readonly lastRefreshOutcome: "failed" | "fresh" | "refreshed" | null;
             };
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
     };
     readonly github: {
         readonly handleWebhook: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
@@ -190,7 +190,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly deliveryId: string;
             readonly status: "failed" | "ignored" | "processed" | "received";
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").GitHubBadRequestError | import("@sealant/api-contracts").GitHubInternalServerError | import("@sealant/api-contracts").GitHubServiceUnavailableError | import("@sealant/api-contracts").GitHubUnauthorizedError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").GitHubBadRequestError | import("@sealant/api-contracts").GitHubInternalServerError | import("@sealant/api-contracts").GitHubServiceUnavailableError | import("@sealant/api-contracts").GitHubUnauthorizedError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly importInstallation: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly payload: {
                 readonly userId: string;
@@ -209,7 +209,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             };
             readonly syncedRepositoryCount: number;
             readonly syncedAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").GitHubInternalServerError | import("@sealant/api-contracts").GitHubNotFoundError | import("@sealant/api-contracts").GitHubServiceUnavailableError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").GitHubInternalServerError | import("@sealant/api-contracts").GitHubNotFoundError | import("@sealant/api-contracts").GitHubServiceUnavailableError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly listInstallationRepositories: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly installationId: string;
@@ -233,7 +233,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly isArchived: boolean;
                 readonly lastSyncedAt?: string | undefined;
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").GitHubForbiddenError | import("@sealant/api-contracts").GitHubInternalServerError | import("@sealant/api-contracts").GitHubNotFoundError | import("@sealant/api-contracts").GitHubServiceUnavailableError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").GitHubForbiddenError | import("@sealant/api-contracts").GitHubInternalServerError | import("@sealant/api-contracts").GitHubNotFoundError | import("@sealant/api-contracts").GitHubServiceUnavailableError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly listInstallations: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly query: {
                 readonly userId: string;
@@ -249,7 +249,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly repositorySelection: "all" | "selected";
                 readonly lastSyncedAt?: string | undefined;
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").GitHubInternalServerError | import("@sealant/api-contracts").GitHubServiceUnavailableError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").GitHubInternalServerError | import("@sealant/api-contracts").GitHubServiceUnavailableError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly syncInstallation: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly installationId: string;
@@ -262,7 +262,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly installationId: string;
             readonly syncedRepositoryCount: number;
             readonly syncedAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").GitHubForbiddenError | import("@sealant/api-contracts").GitHubInternalServerError | import("@sealant/api-contracts").GitHubNotFoundError | import("@sealant/api-contracts").GitHubServiceUnavailableError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").GitHubForbiddenError | import("@sealant/api-contracts").GitHubInternalServerError | import("@sealant/api-contracts").GitHubNotFoundError | import("@sealant/api-contracts").GitHubServiceUnavailableError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
     };
     readonly inference: {
         readonly respond: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
@@ -312,7 +312,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly inputTokens: number;
                 readonly outputTokens: number;
             } | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").BudgetExceededError | import("@sealant/api-contracts").InferenceBadRequestError | import("@sealant/api-contracts").InferenceConflictError | import("@sealant/api-contracts").InferenceInternalServerError | import("@sealant/api-contracts").InferenceNotFoundError | import("@sealant/api-contracts").InferenceUnavailableError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").BudgetExceededError | import("@sealant/api-contracts").InferenceBadRequestError | import("@sealant/api-contracts").InferenceConflictError | import("@sealant/api-contracts").InferenceInternalServerError | import("@sealant/api-contracts").InferenceNotFoundError | import("@sealant/api-contracts").InferenceUnavailableError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
     };
     readonly packages: {
         readonly resolvePackage: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
@@ -367,7 +367,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             }[];
             readonly fetchedAt: string;
             readonly expiresAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").PackagesBadGatewayError | import("@sealant/api-contracts").PackagesInternalServerError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").PackagesBadGatewayError | import("@sealant/api-contracts").PackagesInternalServerError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
     };
     readonly profiles: {
         readonly listProfileCredentialBindings: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
@@ -405,7 +405,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                     };
                 };
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ProfileInternalServerError | import("@sealant/api-contracts").ProfileNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ProfileInternalServerError | import("@sealant/api-contracts").ProfileNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly listProfiles: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly query: {
                 readonly ownerUserId: string;
@@ -423,7 +423,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly createdAt: string;
                 readonly updatedAt: string;
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ProfileInternalServerError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ProfileInternalServerError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly setProfileCredentialBinding: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly profileId: string;
@@ -461,7 +461,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                     };
                 };
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ProfileBadRequestError | import("@sealant/api-contracts").ProfileConflictError | import("@sealant/api-contracts").ProfileInternalServerError | import("@sealant/api-contracts").ProfileNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ProfileBadRequestError | import("@sealant/api-contracts").ProfileConflictError | import("@sealant/api-contracts").ProfileInternalServerError | import("@sealant/api-contracts").ProfileNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
     };
     readonly registries: {
         readonly getRegistry: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
@@ -474,7 +474,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly baseUrl: string;
             readonly pushRegistry: string;
             readonly hasBasicAuth: boolean;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RegistriesNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RegistriesNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly getRegistryManifest: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly registryId: string;
@@ -490,7 +490,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly digest?: string | undefined;
             readonly contentType: string | null;
             readonly manifest: unknown;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RegistriesBadGatewayError | import("@sealant/api-contracts").RegistriesNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RegistriesBadGatewayError | import("@sealant/api-contracts").RegistriesNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly listRegistryExtensions: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly registryId: string;
@@ -503,7 +503,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly description?: string | undefined;
                 readonly endpoints: readonly string[];
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RegistriesBadGatewayError | import("@sealant/api-contracts").RegistriesNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RegistriesBadGatewayError | import("@sealant/api-contracts").RegistriesNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly listRegistryTags: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly registryId: string;
@@ -515,7 +515,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly repository: string;
             readonly tags: readonly string[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RegistriesBadGatewayError | import("@sealant/api-contracts").RegistriesNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RegistriesBadGatewayError | import("@sealant/api-contracts").RegistriesNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly pingRegistry: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly registryId: string;
@@ -524,7 +524,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly name: string;
             readonly reachable: true;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RegistriesBadGatewayError | import("@sealant/api-contracts").RegistriesNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RegistriesBadGatewayError | import("@sealant/api-contracts").RegistriesNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
     };
     readonly runs: {
         readonly createRun: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
@@ -572,7 +572,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly recordDeletedAt?: string | undefined;
             readonly createdAt: string;
             readonly updatedAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").BudgetExceededError | import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").BudgetExceededError | import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly getRun: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly runId: string;
@@ -608,7 +608,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly recordDeletedAt?: string | undefined;
             readonly createdAt: string;
             readonly updatedAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").BudgetExceededError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").BudgetExceededError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly getRunChanges: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly runId: string;
@@ -626,7 +626,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly diff: string;
             readonly available?: boolean | undefined;
             readonly unavailableReason?: string | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly getRunEvent: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly runId: string;
@@ -653,7 +653,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly payloadCase: string;
             readonly payload: unknown;
             readonly ingestedAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly getRunLoss: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly runId: string;
@@ -676,7 +676,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly detectedVia: "gap" | "marker";
                 readonly reason?: string | undefined;
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly getRunScrollback: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly runId: string;
@@ -695,7 +695,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly stream: "pty" | "stderr" | "stdout";
             readonly byteCount: number;
             readonly contentBase64: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly getRunTimeline: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly runId: string;
@@ -720,7 +720,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly captureMethod: number;
                 readonly confidence: number;
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly listRuns: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly query: {
                 readonly workspaceId?: string | undefined;
@@ -758,7 +758,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly createdAt: string;
                 readonly updatedAt: string;
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly updateRun: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly runId: string;
@@ -804,7 +804,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly recordDeletedAt?: string | undefined;
             readonly createdAt: string;
             readonly updatedAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
     };
     readonly sessions: {
         readonly closeSession: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
@@ -840,7 +840,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly outputHighWater: string;
             readonly createdAt: string;
             readonly endedAt?: string | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadGatewayError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadGatewayError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
         readonly createSession: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly headers: {
                 readonly authorization?: string | undefined;
@@ -885,7 +885,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly outputHighWater: string;
             readonly createdAt: string;
             readonly endedAt?: string | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadGatewayError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionConflictError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadGatewayError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionConflictError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
         readonly createSessionAsUser: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly headers: {
                 readonly authorization?: string | undefined;
@@ -930,7 +930,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly outputHighWater: string;
             readonly createdAt: string;
             readonly endedAt?: string | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadGatewayError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionConflictError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadGatewayError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionConflictError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
         readonly getSession: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly sessionId: string;
@@ -964,7 +964,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly outputHighWater: string;
             readonly createdAt: string;
             readonly endedAt?: string | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
         readonly getSessionOutput: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly sessionId: string;
@@ -986,7 +986,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             }[];
             readonly nextFrom: string;
             readonly status: "exited" | "failed" | "running" | "starting";
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
         readonly listSessions: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly query: {
                 readonly ownerUserId: string;
@@ -1022,7 +1022,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly createdAt: string;
                 readonly endedAt?: string | undefined;
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
         readonly resizeSession: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly sessionId: string;
@@ -1038,7 +1038,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly ok: boolean;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadGatewayError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionConflictError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadGatewayError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionConflictError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
         readonly sendSessionInput: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly sessionId: string;
@@ -1053,7 +1053,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly ok: boolean;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadGatewayError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionConflictError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadGatewayError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionConflictError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
         readonly signalSession: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly sessionId: string;
@@ -1068,7 +1068,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly ok: boolean;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadGatewayError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionConflictError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadGatewayError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionConflictError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
     };
     readonly sshKeys: {
         readonly archiveSshKey: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
@@ -1086,7 +1086,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly algorithm: string;
             readonly fingerprint: string;
             readonly createdAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SshKeyInternalServerError | import("@sealant/api-contracts").SshKeyNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SshKeyInternalServerError | import("@sealant/api-contracts").SshKeyNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly createSshKey: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly payload: {
                 readonly ownerUserId: string;
@@ -1101,7 +1101,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly algorithm: string;
             readonly fingerprint: string;
             readonly createdAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SshKeyBadRequestError | import("@sealant/api-contracts").SshKeyConflictError | import("@sealant/api-contracts").SshKeyInternalServerError | import("@sealant/api-contracts").SshKeyNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SshKeyBadRequestError | import("@sealant/api-contracts").SshKeyConflictError | import("@sealant/api-contracts").SshKeyInternalServerError | import("@sealant/api-contracts").SshKeyNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly listSshKeys: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly query: {
                 readonly ownerUserId: string;
@@ -1116,7 +1116,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly fingerprint: string;
                 readonly createdAt: string;
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SshKeyInternalServerError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SshKeyInternalServerError), [Mode] extends ["response-only"] ? never : never>;
         readonly resolveSshPrincipal: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly headers: {
                 readonly "x-sealant-gateway-token"?: string | undefined;
@@ -1130,7 +1130,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly principalId: string;
             readonly sshKeyId: string;
             readonly fingerprint: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SshKeyInternalServerError | import("@sealant/api-contracts").SshKeyNotFoundError | import("@sealant/api-contracts").SshKeyServiceUnavailableError | import("@sealant/api-contracts").SshKeyUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SshKeyInternalServerError | import("@sealant/api-contracts").SshKeyNotFoundError | import("@sealant/api-contracts").SshKeyServiceUnavailableError | import("@sealant/api-contracts").SshKeyUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
     };
     readonly system: {
         readonly getIndex: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: void | {
@@ -1148,7 +1148,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly credentialsPiOpencode?: boolean | undefined;
                 readonly captureOwnerMap?: boolean | undefined;
             } | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly getSetupState: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: void | {
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
@@ -1158,17 +1158,17 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly port: number;
                 readonly usernamePrefix: string;
             } | null;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SystemInternalServerError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SystemInternalServerError), [Mode] extends ["response-only"] ? never : never>;
         readonly health: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: void | {
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly status: "ok";
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly ready: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: void | {
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly status: "ok";
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
     };
     readonly users: {
         readonly ensureUser: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
@@ -1184,7 +1184,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly name: string;
             readonly createdAt: string;
             readonly created: boolean;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").UserBadRequestError | import("@sealant/api-contracts").UserInternalServerError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").UserBadRequestError | import("@sealant/api-contracts").UserInternalServerError), [Mode] extends ["response-only"] ? never : never>;
         readonly getUser: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly userId: string;
@@ -1195,7 +1195,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly email: string;
             readonly name: string;
             readonly createdAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").UserInternalServerError | import("@sealant/api-contracts").UserNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").UserInternalServerError | import("@sealant/api-contracts").UserNotFoundError), [Mode] extends ["response-only"] ? never : never>;
     };
     readonly workspaces: {
         readonly applyWorkspaceDotfiles: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
@@ -1250,7 +1250,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly recordDeletedAt?: string | undefined;
             readonly createdAt: string;
             readonly updatedAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
         readonly bindWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -1266,7 +1266,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly mountPath: string;
                 readonly subpath: string;
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly cancelWorkspaceCreate: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly idempotencyKey: string;
@@ -1281,7 +1281,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly workspaceId?: string | undefined;
             readonly runId?: string | undefined;
             readonly launchId?: string | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError), [Mode] extends ["response-only"] ? never : never>;
         readonly createWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly headers: {
                 readonly "idempotency-key"?: string | undefined;
@@ -1340,7 +1340,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             } | undefined;
             readonly replayed?: boolean | undefined;
             readonly launchId?: string | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").BudgetExceededError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceDockerServiceUnsupportedError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceRuntimeEnvReferencesUnsupportedError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").BudgetExceededError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceDockerServiceUnsupportedError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceRuntimeEnvReferencesUnsupportedError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
         readonly execWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -1382,7 +1382,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly recordDeletedAt?: string | undefined;
             readonly createdAt: string;
             readonly updatedAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly execWorkspaceAsUser: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -1424,7 +1424,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly recordDeletedAt?: string | undefined;
             readonly createdAt: string;
             readonly updatedAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly expireWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -1437,7 +1437,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly workspaceId: string;
             readonly expiresAt: string | null;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly flushWorkspaceCapture: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -1499,7 +1499,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly boundMs: number;
             } | undefined;
             readonly ownerMap?: boolean | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly getWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -1601,7 +1601,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                     } | undefined;
                 } | undefined;
             } | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly getWorkspaceCaptureStatus: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -1660,7 +1660,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly boundMs: number;
             } | undefined;
             readonly ownerMap?: boolean | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly getWorkspaceCreate: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly idempotencyKey: string;
@@ -1675,7 +1675,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly workspaceId?: string | undefined;
             readonly runId?: string | undefined;
             readonly launchId?: string | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError), [Mode] extends ["response-only"] ? never : never>;
         readonly getWorkspaceSshTarget: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -1695,7 +1695,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly status: "failed" | "pending" | "ready" | "running" | "stopped";
                 readonly endpoint: string;
             };
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError | import("@sealant/api-contracts").WorkspaceUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError | import("@sealant/api-contracts").WorkspaceUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
         readonly inspectWorkspaceImage: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly payload: {
                 readonly ownerUserId: string;
@@ -1724,7 +1724,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly runtime: string;
                 readonly acl: "supported" | "unknown" | "unsupported";
             };
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly listWorkspaceAttempts: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -1776,7 +1776,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly finishedAt?: string | undefined;
                 readonly durationMs?: number | undefined;
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly listWorkspaceCredentials: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -1814,7 +1814,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                     } | undefined;
                 };
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly listWorkspaceEvents: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -1834,7 +1834,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly message?: string | undefined;
                 readonly data?: unknown;
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly listWorkspaces: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly query: {
                 readonly ownerUserId: string;
@@ -1896,7 +1896,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly finishedAt?: string | undefined;
                 readonly expiresAt?: string | undefined;
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError), [Mode] extends ["response-only"] ? never : never>;
         readonly putWorkspaceCredentials: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -1949,7 +1949,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly code: "connected-account-invalid" | "connected-account-missing" | "connected-account-unsupported" | "login-file-unusable";
                 readonly message: string;
             }[] | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
         readonly recoverWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -1962,7 +1962,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly workspaceId: string;
             readonly state: "not-retained" | "requested";
             readonly recoverable?: boolean | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly releaseWorkspaceCredentials: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -1977,7 +1977,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly runId: string;
             readonly home: string;
             readonly released: boolean;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
         readonly renameWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -1991,7 +1991,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly workspaceId: string;
             readonly name: string;
             readonly updatedAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly replanWorkspaceCapture: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -2019,7 +2019,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly bytesSkipped: number;
             readonly removed: number;
             readonly unchanged: boolean;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly restartWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -2032,7 +2032,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
             readonly workspaceId: string;
             readonly runId: string;
             readonly status: "cancelled" | "failed" | "queued" | "ready" | "retained" | "running" | "stopped";
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").BudgetExceededError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").BudgetExceededError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly stopWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -2064,7 +2064,7 @@ declare const buildControlPlaneClient: (config: SealantInternalConfig) => Effect
                 readonly outcome: "accepted" | "ignored";
                 readonly detail?: string | undefined;
             } | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
     };
 }, never, HttpClient.HttpClient>;
 /** The fully-typed control-plane client, derived from the `@sealant/api-contracts` HttpApi. */
@@ -2090,7 +2090,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly revokedAt?: string | undefined;
             readonly createdAt: string;
             readonly token: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").AccessTokenBadRequestError | import("@sealant/api-contracts").AccessTokenInternalServerError | import("@sealant/api-contracts").AccessTokenNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").AccessTokenBadRequestError | import("@sealant/api-contracts").AccessTokenInternalServerError | import("@sealant/api-contracts").AccessTokenNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly listAccessTokens: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly query: {
                 readonly ownerUserId: string;
@@ -2107,7 +2107,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly revokedAt?: string | undefined;
                 readonly createdAt: string;
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").AccessTokenBadRequestError | import("@sealant/api-contracts").AccessTokenInternalServerError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").AccessTokenBadRequestError | import("@sealant/api-contracts").AccessTokenInternalServerError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly revokeAccessToken: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly tokenId: string;
@@ -2125,7 +2125,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly expiresAt?: string | undefined;
             readonly revokedAt?: string | undefined;
             readonly createdAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").AccessTokenBadRequestError | import("@sealant/api-contracts").AccessTokenInternalServerError | import("@sealant/api-contracts").AccessTokenNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").AccessTokenBadRequestError | import("@sealant/api-contracts").AccessTokenInternalServerError | import("@sealant/api-contracts").AccessTokenNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
     };
     readonly connectedAccounts: {
         readonly archiveConnectedAccount: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
@@ -2156,7 +2156,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly lastRefreshAt: string | null;
                 readonly lastRefreshOutcome: "failed" | "fresh" | "refreshed" | null;
             };
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly createConnectedAccount: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly payload: {
                 readonly ownerUserId: string;
@@ -2185,7 +2185,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly lastRefreshAt: string | null;
                 readonly lastRefreshOutcome: "failed" | "fresh" | "refreshed" | null;
             };
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ConnectedAccountBadRequestError | import("@sealant/api-contracts").ConnectedAccountConflictError | import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("@sealant/api-contracts").ConnectedAccountServiceUnavailableError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ConnectedAccountBadRequestError | import("@sealant/api-contracts").ConnectedAccountConflictError | import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("@sealant/api-contracts").ConnectedAccountServiceUnavailableError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly listConnectedAccounts: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly query: {
                 readonly ownerUserId: string;
@@ -2213,7 +2213,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                     readonly lastRefreshOutcome: "failed" | "fresh" | "refreshed" | null;
                 };
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly markConnectedAccountInvalid: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly connectedAccountId: string;
@@ -2242,7 +2242,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly lastRefreshAt: string | null;
                 readonly lastRefreshOutcome: "failed" | "fresh" | "refreshed" | null;
             };
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ConnectedAccountInternalServerError | import("@sealant/api-contracts").ConnectedAccountNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
     };
     readonly github: {
         readonly handleWebhook: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
@@ -2256,7 +2256,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly deliveryId: string;
             readonly status: "failed" | "ignored" | "processed" | "received";
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").GitHubBadRequestError | import("@sealant/api-contracts").GitHubInternalServerError | import("@sealant/api-contracts").GitHubServiceUnavailableError | import("@sealant/api-contracts").GitHubUnauthorizedError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").GitHubBadRequestError | import("@sealant/api-contracts").GitHubInternalServerError | import("@sealant/api-contracts").GitHubServiceUnavailableError | import("@sealant/api-contracts").GitHubUnauthorizedError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly importInstallation: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly payload: {
                 readonly userId: string;
@@ -2275,7 +2275,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             };
             readonly syncedRepositoryCount: number;
             readonly syncedAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").GitHubInternalServerError | import("@sealant/api-contracts").GitHubNotFoundError | import("@sealant/api-contracts").GitHubServiceUnavailableError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").GitHubInternalServerError | import("@sealant/api-contracts").GitHubNotFoundError | import("@sealant/api-contracts").GitHubServiceUnavailableError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly listInstallationRepositories: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly installationId: string;
@@ -2299,7 +2299,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly isArchived: boolean;
                 readonly lastSyncedAt?: string | undefined;
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").GitHubForbiddenError | import("@sealant/api-contracts").GitHubInternalServerError | import("@sealant/api-contracts").GitHubNotFoundError | import("@sealant/api-contracts").GitHubServiceUnavailableError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").GitHubForbiddenError | import("@sealant/api-contracts").GitHubInternalServerError | import("@sealant/api-contracts").GitHubNotFoundError | import("@sealant/api-contracts").GitHubServiceUnavailableError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly listInstallations: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly query: {
                 readonly userId: string;
@@ -2315,7 +2315,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly repositorySelection: "all" | "selected";
                 readonly lastSyncedAt?: string | undefined;
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").GitHubInternalServerError | import("@sealant/api-contracts").GitHubServiceUnavailableError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").GitHubInternalServerError | import("@sealant/api-contracts").GitHubServiceUnavailableError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly syncInstallation: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly installationId: string;
@@ -2328,7 +2328,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly installationId: string;
             readonly syncedRepositoryCount: number;
             readonly syncedAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").GitHubForbiddenError | import("@sealant/api-contracts").GitHubInternalServerError | import("@sealant/api-contracts").GitHubNotFoundError | import("@sealant/api-contracts").GitHubServiceUnavailableError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").GitHubForbiddenError | import("@sealant/api-contracts").GitHubInternalServerError | import("@sealant/api-contracts").GitHubNotFoundError | import("@sealant/api-contracts").GitHubServiceUnavailableError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
     };
     readonly inference: {
         readonly respond: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
@@ -2378,7 +2378,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly inputTokens: number;
                 readonly outputTokens: number;
             } | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").BudgetExceededError | import("@sealant/api-contracts").InferenceBadRequestError | import("@sealant/api-contracts").InferenceConflictError | import("@sealant/api-contracts").InferenceInternalServerError | import("@sealant/api-contracts").InferenceNotFoundError | import("@sealant/api-contracts").InferenceUnavailableError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").BudgetExceededError | import("@sealant/api-contracts").InferenceBadRequestError | import("@sealant/api-contracts").InferenceConflictError | import("@sealant/api-contracts").InferenceInternalServerError | import("@sealant/api-contracts").InferenceNotFoundError | import("@sealant/api-contracts").InferenceUnavailableError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
     };
     readonly packages: {
         readonly resolvePackage: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
@@ -2433,7 +2433,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             }[];
             readonly fetchedAt: string;
             readonly expiresAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").PackagesBadGatewayError | import("@sealant/api-contracts").PackagesInternalServerError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").PackagesBadGatewayError | import("@sealant/api-contracts").PackagesInternalServerError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
     };
     readonly profiles: {
         readonly listProfileCredentialBindings: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
@@ -2471,7 +2471,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                     };
                 };
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ProfileInternalServerError | import("@sealant/api-contracts").ProfileNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ProfileInternalServerError | import("@sealant/api-contracts").ProfileNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly listProfiles: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly query: {
                 readonly ownerUserId: string;
@@ -2489,7 +2489,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly createdAt: string;
                 readonly updatedAt: string;
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ProfileInternalServerError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ProfileInternalServerError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly setProfileCredentialBinding: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly profileId: string;
@@ -2527,7 +2527,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                     };
                 };
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ProfileBadRequestError | import("@sealant/api-contracts").ProfileConflictError | import("@sealant/api-contracts").ProfileInternalServerError | import("@sealant/api-contracts").ProfileNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").ProfileBadRequestError | import("@sealant/api-contracts").ProfileConflictError | import("@sealant/api-contracts").ProfileInternalServerError | import("@sealant/api-contracts").ProfileNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
     };
     readonly registries: {
         readonly getRegistry: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
@@ -2540,7 +2540,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly baseUrl: string;
             readonly pushRegistry: string;
             readonly hasBasicAuth: boolean;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RegistriesNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RegistriesNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly getRegistryManifest: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly registryId: string;
@@ -2556,7 +2556,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly digest?: string | undefined;
             readonly contentType: string | null;
             readonly manifest: unknown;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RegistriesBadGatewayError | import("@sealant/api-contracts").RegistriesNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RegistriesBadGatewayError | import("@sealant/api-contracts").RegistriesNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly listRegistryExtensions: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly registryId: string;
@@ -2569,7 +2569,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly description?: string | undefined;
                 readonly endpoints: readonly string[];
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RegistriesBadGatewayError | import("@sealant/api-contracts").RegistriesNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RegistriesBadGatewayError | import("@sealant/api-contracts").RegistriesNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly listRegistryTags: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly registryId: string;
@@ -2581,7 +2581,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly repository: string;
             readonly tags: readonly string[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RegistriesBadGatewayError | import("@sealant/api-contracts").RegistriesNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RegistriesBadGatewayError | import("@sealant/api-contracts").RegistriesNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly pingRegistry: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly registryId: string;
@@ -2590,7 +2590,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly name: string;
             readonly reachable: true;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RegistriesBadGatewayError | import("@sealant/api-contracts").RegistriesNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RegistriesBadGatewayError | import("@sealant/api-contracts").RegistriesNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
     };
     readonly runs: {
         readonly createRun: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
@@ -2638,7 +2638,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly recordDeletedAt?: string | undefined;
             readonly createdAt: string;
             readonly updatedAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").BudgetExceededError | import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").BudgetExceededError | import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly getRun: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly runId: string;
@@ -2674,7 +2674,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly recordDeletedAt?: string | undefined;
             readonly createdAt: string;
             readonly updatedAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").BudgetExceededError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").BudgetExceededError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly getRunChanges: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly runId: string;
@@ -2692,7 +2692,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly diff: string;
             readonly available?: boolean | undefined;
             readonly unavailableReason?: string | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly getRunEvent: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly runId: string;
@@ -2719,7 +2719,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly payloadCase: string;
             readonly payload: unknown;
             readonly ingestedAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly getRunLoss: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly runId: string;
@@ -2742,7 +2742,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly detectedVia: "gap" | "marker";
                 readonly reason?: string | undefined;
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly getRunScrollback: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly runId: string;
@@ -2761,7 +2761,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly stream: "pty" | "stderr" | "stdout";
             readonly byteCount: number;
             readonly contentBase64: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly getRunTimeline: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly runId: string;
@@ -2786,7 +2786,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly captureMethod: number;
                 readonly confidence: number;
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly listRuns: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly query: {
                 readonly workspaceId?: string | undefined;
@@ -2824,7 +2824,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly createdAt: string;
                 readonly updatedAt: string;
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly updateRun: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly runId: string;
@@ -2870,7 +2870,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly recordDeletedAt?: string | undefined;
             readonly createdAt: string;
             readonly updatedAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").RunBadRequestError | import("@sealant/api-contracts").RunInternalServerError | import("@sealant/api-contracts").RunNotFoundError | import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
     };
     readonly sessions: {
         readonly closeSession: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
@@ -2906,7 +2906,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly outputHighWater: string;
             readonly createdAt: string;
             readonly endedAt?: string | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadGatewayError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadGatewayError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
         readonly createSession: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly headers: {
                 readonly authorization?: string | undefined;
@@ -2951,7 +2951,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly outputHighWater: string;
             readonly createdAt: string;
             readonly endedAt?: string | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadGatewayError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionConflictError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadGatewayError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionConflictError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
         readonly createSessionAsUser: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly headers: {
                 readonly authorization?: string | undefined;
@@ -2996,7 +2996,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly outputHighWater: string;
             readonly createdAt: string;
             readonly endedAt?: string | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadGatewayError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionConflictError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadGatewayError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionConflictError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
         readonly getSession: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly sessionId: string;
@@ -3030,7 +3030,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly outputHighWater: string;
             readonly createdAt: string;
             readonly endedAt?: string | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
         readonly getSessionOutput: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly sessionId: string;
@@ -3052,7 +3052,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             }[];
             readonly nextFrom: string;
             readonly status: "exited" | "failed" | "running" | "starting";
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
         readonly listSessions: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly query: {
                 readonly ownerUserId: string;
@@ -3088,7 +3088,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly createdAt: string;
                 readonly endedAt?: string | undefined;
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
         readonly resizeSession: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly sessionId: string;
@@ -3104,7 +3104,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly ok: boolean;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadGatewayError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionConflictError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadGatewayError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionConflictError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
         readonly sendSessionInput: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly sessionId: string;
@@ -3119,7 +3119,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly ok: boolean;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadGatewayError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionConflictError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadGatewayError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionConflictError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
         readonly signalSession: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly sessionId: string;
@@ -3134,7 +3134,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly ok: boolean;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadGatewayError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionConflictError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SessionBadGatewayError | import("@sealant/api-contracts").SessionBadRequestError | import("@sealant/api-contracts").SessionConflictError | import("@sealant/api-contracts").SessionForbiddenError | import("@sealant/api-contracts").SessionInternalServerError | import("@sealant/api-contracts").SessionNotFoundError | import("@sealant/api-contracts").SessionUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
     };
     readonly sshKeys: {
         readonly archiveSshKey: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
@@ -3152,7 +3152,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly algorithm: string;
             readonly fingerprint: string;
             readonly createdAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SshKeyInternalServerError | import("@sealant/api-contracts").SshKeyNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SshKeyInternalServerError | import("@sealant/api-contracts").SshKeyNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly createSshKey: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly payload: {
                 readonly ownerUserId: string;
@@ -3167,7 +3167,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly algorithm: string;
             readonly fingerprint: string;
             readonly createdAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SshKeyBadRequestError | import("@sealant/api-contracts").SshKeyConflictError | import("@sealant/api-contracts").SshKeyInternalServerError | import("@sealant/api-contracts").SshKeyNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SshKeyBadRequestError | import("@sealant/api-contracts").SshKeyConflictError | import("@sealant/api-contracts").SshKeyInternalServerError | import("@sealant/api-contracts").SshKeyNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly listSshKeys: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly query: {
                 readonly ownerUserId: string;
@@ -3182,7 +3182,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly fingerprint: string;
                 readonly createdAt: string;
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SshKeyInternalServerError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SshKeyInternalServerError), [Mode] extends ["response-only"] ? never : never>;
         readonly resolveSshPrincipal: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly headers: {
                 readonly "x-sealant-gateway-token"?: string | undefined;
@@ -3196,7 +3196,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly principalId: string;
             readonly sshKeyId: string;
             readonly fingerprint: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SshKeyInternalServerError | import("@sealant/api-contracts").SshKeyNotFoundError | import("@sealant/api-contracts").SshKeyServiceUnavailableError | import("@sealant/api-contracts").SshKeyUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SshKeyInternalServerError | import("@sealant/api-contracts").SshKeyNotFoundError | import("@sealant/api-contracts").SshKeyServiceUnavailableError | import("@sealant/api-contracts").SshKeyUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
     };
     readonly system: {
         readonly getIndex: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: void | {
@@ -3214,7 +3214,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly credentialsPiOpencode?: boolean | undefined;
                 readonly captureOwnerMap?: boolean | undefined;
             } | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly getSetupState: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: void | {
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
@@ -3224,17 +3224,17 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly port: number;
                 readonly usernamePrefix: string;
             } | null;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SystemInternalServerError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").SystemInternalServerError), [Mode] extends ["response-only"] ? never : never>;
         readonly health: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: void | {
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly status: "ok";
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
         readonly ready: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: void | {
             readonly responseMode?: Mode;
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly status: "ok";
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError), [Mode] extends ["response-only"] ? never : never>;
     };
     readonly users: {
         readonly ensureUser: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
@@ -3250,7 +3250,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly name: string;
             readonly createdAt: string;
             readonly created: boolean;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").UserBadRequestError | import("@sealant/api-contracts").UserInternalServerError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").UserBadRequestError | import("@sealant/api-contracts").UserInternalServerError), [Mode] extends ["response-only"] ? never : never>;
         readonly getUser: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly userId: string;
@@ -3261,7 +3261,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly email: string;
             readonly name: string;
             readonly createdAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").UserInternalServerError | import("@sealant/api-contracts").UserNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").UserInternalServerError | import("@sealant/api-contracts").UserNotFoundError), [Mode] extends ["response-only"] ? never : never>;
     };
     readonly workspaces: {
         readonly applyWorkspaceDotfiles: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
@@ -3316,7 +3316,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly recordDeletedAt?: string | undefined;
             readonly createdAt: string;
             readonly updatedAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
         readonly bindWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -3332,7 +3332,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly mountPath: string;
                 readonly subpath: string;
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly cancelWorkspaceCreate: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly idempotencyKey: string;
@@ -3347,7 +3347,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly workspaceId?: string | undefined;
             readonly runId?: string | undefined;
             readonly launchId?: string | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError), [Mode] extends ["response-only"] ? never : never>;
         readonly createWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly headers: {
                 readonly "idempotency-key"?: string | undefined;
@@ -3406,7 +3406,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             } | undefined;
             readonly replayed?: boolean | undefined;
             readonly launchId?: string | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").BudgetExceededError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceDockerServiceUnsupportedError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceRuntimeEnvReferencesUnsupportedError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").BudgetExceededError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceDockerServiceUnsupportedError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceRuntimeEnvReferencesUnsupportedError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
         readonly execWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -3448,7 +3448,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly recordDeletedAt?: string | undefined;
             readonly createdAt: string;
             readonly updatedAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly execWorkspaceAsUser: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -3490,7 +3490,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly recordDeletedAt?: string | undefined;
             readonly createdAt: string;
             readonly updatedAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly expireWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -3503,7 +3503,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
         }) => Effect.Effect<HttpApiClient.Client.Response<{
             readonly workspaceId: string;
             readonly expiresAt: string | null;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly flushWorkspaceCapture: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -3565,7 +3565,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly boundMs: number;
             } | undefined;
             readonly ownerMap?: boolean | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly getWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -3667,7 +3667,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                     } | undefined;
                 } | undefined;
             } | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly getWorkspaceCaptureStatus: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -3726,7 +3726,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly boundMs: number;
             } | undefined;
             readonly ownerMap?: boolean | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly getWorkspaceCreate: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly idempotencyKey: string;
@@ -3741,7 +3741,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly workspaceId?: string | undefined;
             readonly runId?: string | undefined;
             readonly launchId?: string | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError), [Mode] extends ["response-only"] ? never : never>;
         readonly getWorkspaceSshTarget: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -3761,7 +3761,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly status: "failed" | "pending" | "ready" | "running" | "stopped";
                 readonly endpoint: string;
             };
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError | import("@sealant/api-contracts").WorkspaceUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError | import("@sealant/api-contracts").WorkspaceUnauthorizedError), [Mode] extends ["response-only"] ? never : never>;
         readonly inspectWorkspaceImage: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly payload: {
                 readonly ownerUserId: string;
@@ -3790,7 +3790,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly runtime: string;
                 readonly acl: "supported" | "unknown" | "unsupported";
             };
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly listWorkspaceAttempts: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -3842,7 +3842,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly finishedAt?: string | undefined;
                 readonly durationMs?: number | undefined;
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly listWorkspaceCredentials: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -3880,7 +3880,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                     } | undefined;
                 };
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly listWorkspaceEvents: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -3900,7 +3900,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly message?: string | undefined;
                 readonly data?: unknown;
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly listWorkspaces: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly query: {
                 readonly ownerUserId: string;
@@ -3962,7 +3962,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly finishedAt?: string | undefined;
                 readonly expiresAt?: string | undefined;
             }[];
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceInternalServerError), [Mode] extends ["response-only"] ? never : never>;
         readonly putWorkspaceCredentials: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -4015,7 +4015,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly code: "connected-account-invalid" | "connected-account-missing" | "connected-account-unsupported" | "login-file-unusable";
                 readonly message: string;
             }[] | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
         readonly recoverWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -4028,7 +4028,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly workspaceId: string;
             readonly state: "not-retained" | "requested";
             readonly recoverable?: boolean | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly releaseWorkspaceCredentials: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -4043,7 +4043,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly runId: string;
             readonly home: string;
             readonly released: boolean;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceForbiddenError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError | import("@sealant/api-contracts").WorkspaceServiceUnavailableError), [Mode] extends ["response-only"] ? never : never>;
         readonly renameWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -4057,7 +4057,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly workspaceId: string;
             readonly name: string;
             readonly updatedAt: string;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly replanWorkspaceCapture: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -4085,7 +4085,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly bytesSkipped: number;
             readonly removed: number;
             readonly unchanged: boolean;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly restartWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -4098,7 +4098,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
             readonly workspaceId: string;
             readonly runId: string;
             readonly status: "cancelled" | "failed" | "queued" | "ready" | "retained" | "running" | "stopped";
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").BudgetExceededError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("@sealant/api-contracts").BudgetExceededError | import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
         readonly stopWorkspace: <Mode extends import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode = import("effect/unstable/httpapi/HttpApiEndpoint").ClientResponseMode>(request: {
             readonly params: {
                 readonly workspaceId: string;
@@ -4130,7 +4130,7 @@ declare const SealantApiClient_base: Context.ServiceClass<SealantApiClient, "@se
                 readonly outcome: "accepted" | "ignored";
                 readonly detail?: string | undefined;
             } | undefined;
-        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
+        }, Mode>, import("effect/unstable/http/HttpClientError").HttpClientError | import("@sealant/api-contracts").RequestRefusedError | ([Mode] extends ["response-only"] ? never : import("effect/Schema").SchemaError | import("@sealant/api-contracts").WorkspaceBadGatewayError | import("@sealant/api-contracts").WorkspaceBadRequestError | import("@sealant/api-contracts").WorkspaceConflictError | import("@sealant/api-contracts").WorkspaceInternalServerError | import("@sealant/api-contracts").WorkspaceNotFoundError), [Mode] extends ["response-only"] ? never : never>;
     };
 }>;
 export declare class SealantApiClient extends SealantApiClient_base {