@shardflux/sdk 0.13.0 → 0.14.0

package/dist/generated/app-api.d.ts

@@ -125,8 +125,8 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Public keys (JWKS) for verifying ES256 workspace tool tokens
-         * @description Consumed by the cell gateway. Tokens carry `kid`; TTL <= 15 min.
+         * Public keys (JWKS) for verifying ES256 workspace tool tokens and port tokens
+         * @description Consumed by the cell gateway. Tokens carry `kid`. Tool tokens live at most 15 min; port tokens (`sfp_` + JWS, aud shardflux-ports, contracts §39.3) at most 1 day (bearer) or 7 days (link): keep a rotated-out key in TOOL_TOKEN_KMS_VERIFY_KEYS for 7 days.
          */
         get: operations["getV1WellKnownToolTokenKeys"];
         put?: never;
@@ -602,6 +602,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/auth/signup": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Sign up from an agent, without a browser or an email round-trip
+         * @description Returns a CLI session at once. With `codex_id_token` (a Codex CLI login, contracts §44.2) the email is verified and the request signs in to the account of that ChatGPT identity or email, creating it when there is none (201 when created, 200 when it signed in; `mfa_required` when the account has TOTP). With `email` only, a new unverified account is created (201) with `access: provisional` (resource routes on the default plan before verification) or `verification_required`; an address that already has an account is 409 conflict, details.reason `email_registered`. Verify later with POST /v1/auth/verify-email/code.
+         */
+        post: operations["postV1AuthSignup"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/verify-email/code": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Verify the email with a 6-digit code
+         * @description Without `code`: emails a 6-digit code to the account address (202; valid 15 minutes, once; a new one ends the previous). With `code`: verifies the address (200). The code proves that whoever holds this session reads the inbox, so nothing is signed out; the signup trial is granted when it applies. 5 wrong attempts end a code: 400 token_invalid.
+         */
+        post: operations["postV1AuthVerifyEmailCode"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/auth/login": {
         parameters: {
             query?: never;
@@ -724,7 +764,7 @@ export interface paths {
         put?: never;
         /**
          * Re-authenticate for sensitive actions
-         * @description Password, plus a TOTP or recovery code when MFA is enabled. Rotates the session; valid for STEP_UP_WINDOW_SECONDS.
+         * @description Password, or a Codex identity proof (`codex_id_token`) of a Codex login linked to the account (contracts §44.2), plus a TOTP or recovery code when MFA is enabled. Rotates the session; valid for STEP_UP_WINDOW_SECONDS.
          */
         post: operations["postV1AuthStepUp"];
         delete?: never;
@@ -1553,6 +1593,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/workspaces/{workspace_id}/caps": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        /**
+         * Resize a workspace: memory, its allocation mode, CPU and disk, running or suspended
+         * @description Changes the caps of any workspace, fixed or elastic, running or suspended, without restarting or forking it. Each given field replaces the stored one (omitted fields keep theirs); every later start uses the new caps. Each value is bounded like caps at open: by the plan’s per-workspace maximum and the template’s limit (`limit_reason` plan or template). A running workspace changes live where it can (memory plugged or unplugged, CPU within its boot vCPUs, disk grown online); a suspended one gets the change right after its next resume, before the first call; what cannot apply now says `applies_at: next_start` and applies at the next start. The request is held until the resize finishes, up to `Prefer: wait=<seconds>` (default 20, at most 55): 200 ResizeResult (per resource: `applies_at` now | resume | next_start, requested, target, previous and applied values, `limit_reason`, `reason`) with the workspace caps; otherwise 202 with the `resize` operation, whose `result` carries the same per-resource fields when it succeeds. A resize that fails answers with its error. Errors (nothing changes): 409 conflict reason resize_not_available (not enabled for the organization), workspace_deleted, operation_in_progress (another lifecycle operation is active; details.active_operation_id, retryable); 422 validation_failed reason not_supported_for_mode (file-first workspace), shrink_not_supported (disk_gib below the current disk; details.current_disk_gib), requires_elastic (memory_mib_held without an elastic mode), exceeds_memory_mib (memory_mib_held above the maximum), allocation_mode_not_available (elastic memory is not available to the organization); 402 as for a start (no plan, new starts on hold). Owners, admins and members, and API keys with a tool permission. Supports Idempotency-Key.
+         */
+        patch: operations["patchV1WorkspacesWorkspaceIdCaps"];
+        trace?: never;
+    };
     "/v1/workspaces/{workspace_id}/suspend-when-idle": {
         parameters: {
             query?: never;
@@ -1946,6 +2006,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/workspaces/{workspace_id}/caps": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        /**
+         * Resize a workspace: memory, its allocation mode, CPU and disk, running or suspended
+         * @description Changes the caps of any workspace, fixed or elastic, running or suspended, without restarting or forking it. Each given field replaces the stored one (omitted fields keep theirs); every later start uses the new caps. Each value is bounded like caps at open: by the plan’s per-workspace maximum and the template’s limit (`limit_reason` plan or template). A running workspace changes live where it can (memory plugged or unplugged, CPU within its boot vCPUs, disk grown online); a suspended one gets the change right after its next resume, before the first call; what cannot apply now says `applies_at: next_start` and applies at the next start. The request is held until the resize finishes, up to `Prefer: wait=<seconds>` (default 20, at most 55): 200 ResizeResult (per resource: `applies_at` now | resume | next_start, requested, target, previous and applied values, `limit_reason`, `reason`) with the workspace caps; otherwise 202 with the `resize` operation, whose `result` carries the same per-resource fields when it succeeds. A resize that fails answers with its error. Errors (nothing changes): 409 conflict reason resize_not_available (not enabled for the organization), workspace_deleted, operation_in_progress (another lifecycle operation is active; details.active_operation_id, retryable); 422 validation_failed reason not_supported_for_mode (file-first workspace), shrink_not_supported (disk_gib below the current disk; details.current_disk_gib), requires_elastic (memory_mib_held without an elastic mode), exceeds_memory_mib (memory_mib_held above the maximum), allocation_mode_not_available (elastic memory is not available to the organization); 402 as for a start (no plan, new starts on hold). Owners, admins and members, and API keys with a tool permission. Supports Idempotency-Key.
+         */
+        patch: operations["patchApiV1WorkspacesWorkspaceIdCaps"];
+        trace?: never;
+    };
     "/api/v1/workspaces/{workspace_id}/suspend-when-idle": {
         parameters: {
             query?: never;
@@ -2161,6 +2241,242 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/workspaces/{workspace_id}/ports/{port}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Expose a port of the workspace at its own HTTPS URL
+         * @description Serves TCP `port` inside the workspace at `https://<port>-<handle>.<ingress domain>` (contracts §39.3). The port is private: every request needs a port token (POST …/tokens), a signed link (POST …/links) or the port’s callback URL (POST …/callback). A request to a suspended workspace resumes it and is held until it runs; a parked one wakes inside the request. 201 when exposed now, 200 when it already was (unchanged: its tokens, links and callback URL stay valid). The handle is the workspace’s for good (kept when ports are closed and exposed again, across suspend, resume and reset; a fork gets none). At most 10 exposed ports: 409 conflict details.reason port_limit (details.limit 10). Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         */
+        put: operations["putV1WorkspacesWorkspaceIdPortsPort"];
+        post?: never;
+        /**
+         * Close an exposed port
+         * @description 204, also when the port was not exposed. Its tokens, links and callback URL stop working at once (the gateway caches for at most 5 s), and stay revoked if the port is exposed again. The workspace keeps its URL handle. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         */
+        delete: operations["deleteV1WorkspacesWorkspaceIdPortsPort"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspace_id}/ports": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the workspace’s exposed ports
+         * @description Ordered by port. `callback` is set when the port has a callback URL (its secret is never shown again). Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         */
+        get: operations["getV1WorkspacesWorkspaceIdPorts"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspace_id}/ports/{port}/tokens": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Mint a port token for an exposed port
+         * @description A bearer token for requests to the port’s URL: `Authorization: Bearer <token>` (or `X-Shardflux-Token: <token>` when the app uses Authorization itself). `sfp_` + an ES256 JWS (claims iss, aud `shardflux-ports`, sub, pty, org, prj, ws, port, pxid, use `bearer`, iat, exp, jti; keys at GET /v1/.well-known/tool-token-keys). Revoked by closing the port, deleting the workspace, revoking the API key that minted it, or the minting member’s removal or role change. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         */
+        post: operations["postV1WorkspacesWorkspaceIdPortsPortTokens"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspace_id}/ports/{port}/links": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Create a signed link that opens an exposed port in a browser
+         * @description Opening the link sets a session cookie for the port’s host (HttpOnly, Secure, until `expires_at`) and redirects to `path`, so a person can use the app in a browser without a header. Share it like a password: anyone with the link can open the port until it expires. Revoked like a port token (closing the port, deleting the workspace, revoking the minting API key). 422 validation_failed details.field path for a path that does not start with one `/` or has characters other than printable ASCII. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         */
+        post: operations["postV1WorkspacesWorkspaceIdPortsPortLinks"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspace_id}/ports/{port}/callback": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Create or replace the port’s callback URL (webhooks, OAuth redirects)
+         * @description A URL with a secret in its path that reaches the port without a token header: register `<url><your path>` with GitHub, Slack, Stripe or an OAuth provider; a request to `/__shardflux/callback/<secret>/<rest>` reaches `/<rest>` (query kept) and wakes the workspace like any request. Creating it again replaces it (the previous URL stops working). The secret is shown only in this response (stored as a SHA-256 hash). Revoke it with DELETE, by closing the port, or by deleting the workspace; it also stops waking the workspace when its creator can no longer manage the workspace. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         */
+        post: operations["postV1WorkspacesWorkspaceIdPortsPortCallback"];
+        /**
+         * Revoke the port’s callback URL
+         * @description 204, also when the port has no callback URL. The URL stops working at once (the gateway caches for at most 5 s). 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         */
+        delete: operations["deleteV1WorkspacesWorkspaceIdPortsPortCallback"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/workspaces/{workspace_id}/ports/{port}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Expose a port of the workspace at its own HTTPS URL
+         * @description Serves TCP `port` inside the workspace at `https://<port>-<handle>.<ingress domain>` (contracts §39.3). The port is private: every request needs a port token (POST …/tokens), a signed link (POST …/links) or the port’s callback URL (POST …/callback). A request to a suspended workspace resumes it and is held until it runs; a parked one wakes inside the request. 201 when exposed now, 200 when it already was (unchanged: its tokens, links and callback URL stay valid). The handle is the workspace’s for good (kept when ports are closed and exposed again, across suspend, resume and reset; a fork gets none). At most 10 exposed ports: 409 conflict details.reason port_limit (details.limit 10). Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         */
+        put: operations["putApiV1WorkspacesWorkspaceIdPortsPort"];
+        post?: never;
+        /**
+         * Close an exposed port
+         * @description 204, also when the port was not exposed. Its tokens, links and callback URL stop working at once (the gateway caches for at most 5 s), and stay revoked if the port is exposed again. The workspace keeps its URL handle. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         */
+        delete: operations["deleteApiV1WorkspacesWorkspaceIdPortsPort"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/workspaces/{workspace_id}/ports": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the workspace’s exposed ports
+         * @description Ordered by port. `callback` is set when the port has a callback URL (its secret is never shown again). Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         */
+        get: operations["getApiV1WorkspacesWorkspaceIdPorts"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/workspaces/{workspace_id}/ports/{port}/tokens": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Mint a port token for an exposed port
+         * @description A bearer token for requests to the port’s URL: `Authorization: Bearer <token>` (or `X-Shardflux-Token: <token>` when the app uses Authorization itself). `sfp_` + an ES256 JWS (claims iss, aud `shardflux-ports`, sub, pty, org, prj, ws, port, pxid, use `bearer`, iat, exp, jti; keys at GET /v1/.well-known/tool-token-keys). Revoked by closing the port, deleting the workspace, revoking the API key that minted it, or the minting member’s removal or role change. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         */
+        post: operations["postApiV1WorkspacesWorkspaceIdPortsPortTokens"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/workspaces/{workspace_id}/ports/{port}/links": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Create a signed link that opens an exposed port in a browser
+         * @description Opening the link sets a session cookie for the port’s host (HttpOnly, Secure, until `expires_at`) and redirects to `path`, so a person can use the app in a browser without a header. Share it like a password: anyone with the link can open the port until it expires. Revoked like a port token (closing the port, deleting the workspace, revoking the minting API key). 422 validation_failed details.field path for a path that does not start with one `/` or has characters other than printable ASCII. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         */
+        post: operations["postApiV1WorkspacesWorkspaceIdPortsPortLinks"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/workspaces/{workspace_id}/ports/{port}/callback": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Create or replace the port’s callback URL (webhooks, OAuth redirects)
+         * @description A URL with a secret in its path that reaches the port without a token header: register `<url><your path>` with GitHub, Slack, Stripe or an OAuth provider; a request to `/__shardflux/callback/<secret>/<rest>` reaches `/<rest>` (query kept) and wakes the workspace like any request. Creating it again replaces it (the previous URL stops working). The secret is shown only in this response (stored as a SHA-256 hash). Revoke it with DELETE, by closing the port, or by deleting the workspace; it also stops waking the workspace when its creator can no longer manage the workspace. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         */
+        post: operations["postApiV1WorkspacesWorkspaceIdPortsPortCallback"];
+        /**
+         * Revoke the port’s callback URL
+         * @description 204, also when the port has no callback URL. The URL stops working at once (the gateway caches for at most 5 s). 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         */
+        delete: operations["deleteApiV1WorkspacesWorkspaceIdPortsPortCallback"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/internal/port-wakes": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Wake a workspace for an inbound port request (called by the cell gateway)
+         * @description Contracts §39.3. The credential is the ingress request’s port token, forwarded unchanged as `Authorization: Bearer sfp_…` (`use` bearer or link), or the callback URL’s secret in `callback_secret`. The API verifies it as the gateway does: ES256 with its own keys, iss, aud shardflux-ports, iat/exp, workspace and port of the token (403 port_token_scope), the port exposed (404 port_not_exposed) under the token’s exposure (`pxid`), the revocation watermarks of the minting principal and the workspace and the minting API key (401 port_token_revoked), or the callback secret’s SHA-256 and its creator’s lifecycle permission (401 callback_invalid); then the organization’s `policy.inbound_ports` (403 inbound_ports_not_enabled). A deleted workspace is 404 unknown_host. It then resumes the workspace as that principal exactly like POST /v1/workspaces/{id}/resume (joins an active resume/open, recovers a failed workspace with an open, refuses with its admission errors, which the gateway passes through), audited workspace.resume with details.via inbound_port. With `Prefer: wait=<seconds>` (at most 20) it holds like a held resume: 200 {workspace, operation} once the operation succeeded, 202 with the operation otherwise (also without the preference). A running workspace answers 200 at once with operation null. 401 port_auth_required (no credential), port_token_invalid; 429 rate_limited per workspace. `Cache-Control: no-store`.
+         */
+        post: operations["postV1InternalPortWakes"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/projects/{project_id}/volumes": {
         parameters: {
             query?: never;
@@ -5524,6 +5840,30 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/oauth/authorization": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Describe a hosted MCP connection request (consent page)
+         * @description Validates an authorization request for the hosted MCP endpoint and returns the client, where the browser goes afterwards and the projects the user may connect. 422 `validation_failed` (details.oauth_error) when the client or its redirect_uri cannot be trusted; otherwise a request with another problem still describes the client, and the POST answers it with the OAuth error.
+         */
+        get: operations["getApiV1OauthAuthorization"];
+        put?: never;
+        /**
+         * Approve or decline a hosted MCP connection request
+         * @description approve (with project_id, a project where the user is owner or admin) creates the connection: a project API key named "<client> (MCP connector)" with every tool permission, held by Shardflux for the client, and a single-use authorization code (5 minutes). deny sends access_denied. Either way the answer is redirect_to, where the browser goes next.
+         */
+        post: operations["postApiV1OauthAuthorization"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
 }
 export type webhooks = Record<string, never>;
 export interface components {
@@ -5630,6 +5970,21 @@ export interface components {
                 } & {
                     [key: string]: unknown;
                 };
+                host_lost?: {
+                    /** @description RFC 3339: when the host failure was detected; the workspace was suspended then. */
+                    detected_at: string;
+                    /**
+                     * @description resume and open: disk when the workspace booted from its disk (files kept, processes and memory not); checkpoint when it was restored from its newest checkpoint (see state_as_of). Absent on a suspend.
+                     * @enum {string}
+                     */
+                    restored_from?: "disk" | "checkpoint";
+                    /** @description restored_from checkpoint: the checkpoint this resume restored. */
+                    restored_checkpoint_id?: string;
+                    /** @description restored_from checkpoint, RFC 3339: when that checkpoint committed; the workspace state is as of then. */
+                    state_as_of?: string;
+                } & {
+                    [key: string]: unknown;
+                };
             } & {
                 [key: string]: unknown;
             };
@@ -6735,6 +7090,102 @@ export interface components {
              */
             not_before: string;
         };
+        /** @description At least one field. Each given value replaces the stored one; omitted fields keep theirs. */
+        ResizeWorkspaceBody: {
+            /** @description Memory (MiB): the size of a fixed workspace, the maximum of an elastic one. Bounded by the plan and the template (`limit_reason`). */
+            memory_mib?: number;
+            /** @description Elastic only: the memory held while idle (MiB), at most the maximum. */
+            memory_mib_held?: number;
+            /**
+             * @description fixed: memory_mib is plugged and held; elastic: the workspace holds memory_mib_held and grows to memory_mib when a command needs it.
+             * @enum {string}
+             */
+            allocation_mode?: "fixed" | "elastic";
+            /** @description CPU (millicores). Bounded by the plan and the template. */
+            cpu_millis?: number;
+            /** @description Disk (GiB). Grow only. Bounded by the plan and the template. */
+            disk_gib?: number;
+        };
+        /** @description Per resource the request named (allocation_mode and memory_mib_held report under memory): what applied now and what applies later. caps: the workspace caps every later start uses. */
+        ResizeResult: {
+            /**
+             * Format: uuid
+             * @description UUIDv7, lowercase canonical form.
+             */
+            workspace_id: string;
+            /**
+             * Format: uuid
+             * @description UUIDv7, lowercase canonical form.
+             */
+            operation_id: string;
+            /** @description The workspace state the resize found (running, suspended, ...). */
+            state: string;
+            memory?: {
+                /**
+                 * @description now: live; resume: right after the next resume, before its first call; next_start: at the next start that boots the workspace.
+                 * @enum {string}
+                 */
+                applies_at: "now" | "resume" | "next_start";
+                /**
+                 * @description The memory layout after the resize.
+                 * @enum {string}
+                 */
+                allocation_mode: "fixed" | "elastic";
+                requested_mib: number | null;
+                target_mib: number | null;
+                previous_mib: number | null;
+                applied_mib: number | null;
+                held_mib: number | null;
+                converged: boolean | null;
+                /** @description Why the target or the applied value is below what was requested: plan or template (bounded like caps at open), host_capacity (the rest did not fit on the host at once), shrink_stalled (the guest kept the memory its processes use). */
+                limit_reason: ("plan" | "template" | "host_capacity" | "shrink_stalled") | null;
+                /** @description Why it does not apply now (null when it does). */
+                reason: ("region" | "below_base" | "legacy_layout" | "boot_vcpus" | "suspended" | "stopped") | null;
+            };
+            cpu?: {
+                /**
+                 * @description now: live; resume: right after the next resume, before its first call; next_start: at the next start that boots the workspace.
+                 * @enum {string}
+                 */
+                applies_at: "now" | "resume" | "next_start";
+                requested_millis: number | null;
+                target_millis: number | null;
+                previous_millis: number | null;
+                applied_millis: number | null;
+                /** @description Why the target or the applied value is below what was requested: plan or template (bounded like caps at open), host_capacity (the rest did not fit on the host at once), shrink_stalled (the guest kept the memory its processes use). */
+                limit_reason: ("plan" | "template" | "host_capacity" | "shrink_stalled") | null;
+                /** @description Why it does not apply now (null when it does). */
+                reason: ("region" | "below_base" | "legacy_layout" | "boot_vcpus" | "suspended" | "stopped") | null;
+            };
+            disk?: {
+                /**
+                 * @description now: live; resume: right after the next resume, before its first call; next_start: at the next start that boots the workspace.
+                 * @enum {string}
+                 */
+                applies_at: "now" | "resume" | "next_start";
+                requested_gib: number | null;
+                target_gib: number | null;
+                previous_gib: number | null;
+                applied_gib: number | null;
+                /** @description Why the target or the applied value is below what was requested: plan or template (bounded like caps at open), host_capacity (the rest did not fit on the host at once), shrink_stalled (the guest kept the memory its processes use). */
+                limit_reason: ("plan" | "template" | "host_capacity" | "shrink_stalled") | null;
+                /** @description Why it does not apply now (null when it does). */
+                reason: ("region" | "below_base" | "legacy_layout" | "boot_vcpus" | "suspended" | "stopped") | null;
+            };
+            /** @description User caps for this workspace (null = no user restriction) and its memory allocation mode. */
+            caps: {
+                cpu_millis: number | null;
+                memory_mib: number | null;
+                disk_gib: number | null;
+                /**
+                 * @description Memory allocation (contracts §32): fixed (default) boots memory_mib and holds it; elastic holds memory_mib_held while idle and is grown up to memory_mib (the promise) when a command needs it. The mode the next VM start uses: an elastic request whose promise does not exceed the held floor by at least 512 MiB is fixed at the promise.
+                 * @enum {string}
+                 */
+                allocation_mode: "fixed" | "elastic";
+                /** @description Elastic only: the memory held while idle (MiB). */
+                memory_mib_held?: number;
+            };
+        };
         Workspace: {
             /**
              * Format: uuid
@@ -6938,6 +7389,25 @@ export interface components {
             tools: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
             cell_endpoint: string;
         };
+        /** @description An exposed port of a workspace (contracts §39.3). Private: every request needs a credential. */
+        Port: {
+            /** @description TCP port inside the workspace (1-65535). */
+            port: number;
+            /** @description https://<port>-<handle>.<ingress domain>: requests need a port token (Authorization: Bearer sfp_…), a signed link’s cookie, or the callback URL. */
+            url: string;
+            /**
+             * Format: date-time
+             * @description RFC 3339 UTC timestamp with Z.
+             */
+            created_at: string;
+            callback: {
+                /**
+                 * Format: date-time
+                 * @description RFC 3339 UTC timestamp with Z.
+                 */
+                created_at: string;
+            } | null;
+        };
         Volume: {
             /**
              * Format: uuid
@@ -7116,6 +7586,39 @@ export interface components {
             /** @description When the charges reach the effective cap at the average burn of this period so far. Null when not accruing or when it would fall after resets_at. */
             projected_reached_at: string | null;
         };
+        OAuthConsentView: {
+            client: {
+                client_id: string;
+                /** @description client_name from its registration or metadata document. Self-declared: show it with redirect_host. */
+                name: string;
+                uri: string | null;
+                logo_uri: string | null;
+                /** @description `metadata_document`: client_id is an https URL its owner serves (the host is verified by that); `registered`: dynamic client registration. */
+                kind: "registered" | "metadata_document";
+                client_id_host: string | null;
+            };
+            /** @description Where the browser goes after the decision (host, or scheme://host for a native app). */
+            redirect_host: string;
+            scope: string;
+            /** @description The MCP endpoint the client will be able to use. */
+            resource: string;
+            /** @description Projects the user may connect (owner or admin of the organization), by organization then project name; at most 200. */
+            projects: {
+                /**
+                 * Format: uuid
+                 * @description UUIDv7, lowercase canonical form.
+                 */
+                organization_id: string;
+                organization_name: string;
+                /**
+                 * Format: uuid
+                 * @description UUIDv7, lowercase canonical form.
+                 */
+                project_id: string;
+                project_name: string;
+                role: "owner" | "admin";
+            }[];
+        };
     };
     responses: never;
     parameters: never;
@@ -8663,7 +9166,7 @@ export interface operations {
             };
         };
     };
-    postV1AuthLogin: {
+    postV1AuthSignup: {
         parameters: {
             query?: never;
             header?: never;
@@ -8674,9 +9177,10 @@ export interface operations {
             content: {
                 "application/json": {
                     /** @description Email address. */
-                    email: string;
-                    /** @description Password (12-256 characters). */
-                    password: string;
+                    email?: string;
+                    display_name?: string;
+                    /** @description The OpenAI ID token of a Codex CLI login (`tokens.id_token` in `~/.codex/auth.json`, refreshed by Codex within CODEX_PROOF_MAX_AGE_SECONDS). Proves a verified email; it is not a credential to OpenAI. */
+                    codex_id_token?: string;
                 };
             };
         };
@@ -8689,6 +9193,10 @@ export interface operations {
                 content: {
                     "application/json": {
                         status: "authenticated" | "mfa_required";
+                        /** @description True when this request created the account; false: it signed in to an existing one (a Codex proof only). */
+                        created: boolean;
+                        /** @description verified: the email is verified (a Codex proof, or verified before). provisional: unverified, and the account may use resource routes on its default plan now; the signup trial comes when the email is verified. verification_required: unverified, and resource routes answer 403 email_unverified until POST /v1/auth/verify-email/code. */
+                        access: "verified" | "provisional" | "verification_required";
                         user: {
                             /**
                              * Format: uuid
@@ -8711,51 +9219,17 @@ export interface operations {
                 };
             };
             /** @description Default Response */
-            "4XX": {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorBody"];
-                };
-            };
-            /** @description Default Response */
-            "5XX": {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorBody"];
-                };
-            };
-        };
-    };
-    postV1AuthMfaChallenge: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": {
-                    /** @description Current 6-digit TOTP code. */
-                    code?: string;
-                    /** @description One-time recovery code. */
-                    recovery_code?: string;
-                };
-            };
-        };
-        responses: {
-            /** @description Default Response */
-            200: {
+            201: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
                         status: "authenticated" | "mfa_required";
+                        /** @description True when this request created the account; false: it signed in to an existing one (a Codex proof only). */
+                        created: boolean;
+                        /** @description verified: the email is verified (a Codex proof, or verified before). provisional: unverified, and the account may use resource routes on its default plan now; the signup trial comes when the email is verified. verification_required: unverified, and resource routes answer 403 email_unverified until POST /v1/auth/verify-email/code. */
+                        access: "verified" | "provisional" | "verification_required";
                         user: {
                             /**
                              * Format: uuid
@@ -8797,57 +9271,45 @@ export interface operations {
             };
         };
     };
-    postV1AuthLogout: {
+    postV1AuthVerifyEmailCode: {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        requestBody?: never;
-        responses: {
-            /** @description No content. */
-            204: {
-                headers: {
-                    [name: string]: unknown;
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description The 6-digit code from the email. */
+                    code?: string;
                 };
-                content?: never;
             };
+        };
+        responses: {
             /** @description Default Response */
-            "4XX": {
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["ErrorBody"];
+                    "application/json": {
+                        /** @enum {string} */
+                        status: "verified";
+                    };
                 };
             };
             /** @description Default Response */
-            "5XX": {
+            202: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["ErrorBody"];
-                };
-            };
-        };
-    };
-    postV1AuthLogoutAll: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description No content. */
-            204: {
-                headers: {
-                    [name: string]: unknown;
+                    "application/json": {
+                        /** @enum {string} */
+                        status: "accepted";
+                    };
                 };
-                content?: never;
             };
             /** @description Default Response */
             "4XX": {
@@ -8869,14 +9331,23 @@ export interface operations {
             };
         };
     };
-    getV1AuthSessions: {
+    postV1AuthLogin: {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Email address. */
+                    email: string;
+                    /** @description Password (12-256 characters). */
+                    password: string;
+                };
+            };
+        };
         responses: {
             /** @description Default Response */
             200: {
@@ -8885,35 +9356,25 @@ export interface operations {
                 };
                 content: {
                     "application/json": {
-                        data: {
+                        status: "authenticated" | "mfa_required";
+                        user: {
                             /**
                              * Format: uuid
                              * @description UUIDv7, lowercase canonical form.
                              */
                             id: string;
-                            current: boolean;
-                            aal: number;
-                            /**
-                             * Format: date-time
-                             * @description RFC 3339 UTC timestamp with Z.
-                             */
-                            created_at: string;
-                            /**
-                             * Format: date-time
-                             * @description RFC 3339 UTC timestamp with Z.
-                             */
-                            last_seen_at: string;
-                            /**
-                             * Format: date-time
-                             * @description RFC 3339 UTC timestamp with Z.
-                             */
-                            absolute_expires_at: string;
-                            client_ip: string | null;
-                            user_agent: string | null;
-                            /** @description browser: a web app sign-in; cli: `shard auth login` or an SDK account client (contracts §30.1). */
-                            client: "browser" | "cli";
-                        }[];
-                        next_cursor: null;
+                            email: string;
+                            email_verified: boolean;
+                            display_name: string | null;
+                            mfa_enabled: boolean;
+                        } | null;
+                        /** @description The session: send `Authorization: Bearer <session_token>` from now on (a previous token of this session is revoked). */
+                        session_token: string;
+                        /**
+                         * Format: date-time
+                         * @description RFC 3339 UTC timestamp with Z.
+                         */
+                        session_expires_at: string;
                     };
                 };
             };
@@ -8937,24 +9398,231 @@ export interface operations {
             };
         };
     };
-    deleteV1AuthSessionsSessionId: {
+    postV1AuthMfaChallenge: {
         parameters: {
             query?: never;
             header?: never;
-            path: {
-                /** @description UUIDv7, lowercase canonical form. */
-                session_id: string;
-            };
+            path?: never;
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Current 6-digit TOTP code. */
+                    code?: string;
+                    /** @description One-time recovery code. */
+                    recovery_code?: string;
+                };
+            };
+        };
         responses: {
-            /** @description No content. */
-            204: {
+            /** @description Default Response */
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": {
+                        status: "authenticated" | "mfa_required";
+                        user: {
+                            /**
+                             * Format: uuid
+                             * @description UUIDv7, lowercase canonical form.
+                             */
+                            id: string;
+                            email: string;
+                            email_verified: boolean;
+                            display_name: string | null;
+                            mfa_enabled: boolean;
+                        } | null;
+                        /** @description The session: send `Authorization: Bearer <session_token>` from now on (a previous token of this session is revoked). */
+                        session_token: string;
+                        /**
+                         * Format: date-time
+                         * @description RFC 3339 UTC timestamp with Z.
+                         */
+                        session_expires_at: string;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    postV1AuthLogout: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description No content. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    postV1AuthLogoutAll: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description No content. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    getV1AuthSessions: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: {
+                            /**
+                             * Format: uuid
+                             * @description UUIDv7, lowercase canonical form.
+                             */
+                            id: string;
+                            current: boolean;
+                            aal: number;
+                            /**
+                             * Format: date-time
+                             * @description RFC 3339 UTC timestamp with Z.
+                             */
+                            created_at: string;
+                            /**
+                             * Format: date-time
+                             * @description RFC 3339 UTC timestamp with Z.
+                             */
+                            last_seen_at: string;
+                            /**
+                             * Format: date-time
+                             * @description RFC 3339 UTC timestamp with Z.
+                             */
+                            absolute_expires_at: string;
+                            client_ip: string | null;
+                            user_agent: string | null;
+                            /** @description browser: a web app sign-in; cli: `shard auth login` or an SDK account client (contracts §30.1). */
+                            client: "browser" | "cli";
+                        }[];
+                        next_cursor: null;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    deleteV1AuthSessionsSessionId: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                session_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description No content. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
             };
             /** @description Default Response */
             "4XX": {
@@ -8987,7 +9655,9 @@ export interface operations {
             content: {
                 "application/json": {
                     /** @description Password (12-256 characters). */
-                    password: string;
+                    password?: string;
+                    /** @description The OpenAI ID token of a Codex CLI login (`tokens.id_token` in `~/.codex/auth.json`, refreshed by Codex within CODEX_PROOF_MAX_AGE_SECONDS). Proves a verified email; it is not a credential to OpenAI. */
+                    codex_id_token?: string;
                     /** @description Current 6-digit TOTP code. */
                     code?: string;
                     /** @description One-time recovery code. */
@@ -11611,14 +12281,13 @@ export interface operations {
                     };
                     /** @description Template slug; new workspaces use its latest published version. */
                     template: string;
-                    /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction (allocation_mode: fixed). Given caps replace the stored ones. */
+                    /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction. Given caps replace the stored ones (a reopen keeps an elastic workspace’s mode when elastic is the organization’s default and allocation_mode is omitted). */
                     caps?: {
                         cpu_millis?: number;
                         memory_mib?: number;
                         disk_gib?: number;
                         /**
-                         * @description Memory allocation (contracts §32): fixed (default) boots memory_mib and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Takes effect at the next VM start.
-                         * @default fixed
+                         * @description Memory allocation (contracts §32): fixed boots memory_mib and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Omitted: fixed, or elastic where that is the organization’s default (a reopen then keeps the stored mode). Takes effect at the next VM start.
                          * @enum {string}
                          */
                         allocation_mode?: "fixed" | "elastic";
@@ -12201,6 +12870,66 @@ export interface operations {
             };
         };
     };
+    patchV1WorkspacesWorkspaceIdCaps: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description RFC 7240 preference, e.g. `wait=30` (at most 55; default 20). */
+                prefer?: string;
+            };
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ResizeWorkspaceBody"];
+            };
+        };
+        responses: {
+            /** @description Per resource the request named (allocation_mode and memory_mib_held report under memory): what applied now and what applies later. caps: the workspace caps every later start uses. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ResizeResult"];
+                };
+            };
+            /** @description Default Response */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        operation: components["schemas"]["Operation"];
+                        workspace: components["schemas"]["Workspace"];
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
     postV1WorkspacesWorkspaceIdSuspendWhenIdle: {
         parameters: {
             query?: never;
@@ -12311,14 +13040,13 @@ export interface operations {
                 "application/json": {
                     /** @description Stable workspace key, unique per organization (e.g. `${customerId}/${projectId}`). */
                     key: string;
-                    /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction (allocation_mode: fixed). Given caps replace the stored ones. */
+                    /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction. Given caps replace the stored ones (a reopen keeps an elastic workspace’s mode when elastic is the organization’s default and allocation_mode is omitted). */
                     caps?: {
                         cpu_millis?: number;
                         memory_mib?: number;
                         disk_gib?: number;
                         /**
-                         * @description Memory allocation (contracts §32): fixed (default) boots memory_mib and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Takes effect at the next VM start.
-                         * @default fixed
+                         * @description Memory allocation (contracts §32): fixed boots memory_mib and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Omitted: fixed, or elastic where that is the organization’s default (a reopen then keeps the stored mode). Takes effect at the next VM start.
                          * @enum {string}
                          */
                         allocation_mode?: "fixed" | "elastic";
@@ -12837,14 +13565,13 @@ export interface operations {
                     };
                     /** @description Template slug; new workspaces use its latest published version. */
                     template: string;
-                    /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction (allocation_mode: fixed). Given caps replace the stored ones. */
+                    /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction. Given caps replace the stored ones (a reopen keeps an elastic workspace’s mode when elastic is the organization’s default and allocation_mode is omitted). */
                     caps?: {
                         cpu_millis?: number;
                         memory_mib?: number;
                         disk_gib?: number;
                         /**
-                         * @description Memory allocation (contracts §32): fixed (default) boots memory_mib and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Takes effect at the next VM start.
-                         * @default fixed
+                         * @description Memory allocation (contracts §32): fixed boots memory_mib and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Omitted: fixed, or elastic where that is the organization’s default (a reopen then keeps the stored mode). Takes effect at the next VM start.
                          * @enum {string}
                          */
                         allocation_mode?: "fixed" | "elastic";
@@ -13427,10 +14154,13 @@ export interface operations {
             };
         };
     };
-    postApiV1WorkspacesWorkspaceIdSuspendWhenIdle: {
+    patchApiV1WorkspacesWorkspaceIdCaps: {
         parameters: {
             query?: never;
-            header?: never;
+            header?: {
+                /** @description RFC 7240 preference, e.g. `wait=30` (at most 55; default 20). */
+                prefer?: string;
+            };
             path: {
                 /** @description UUIDv7, lowercase canonical form. */
                 workspace_id: string;
@@ -13439,23 +14169,28 @@ export interface operations {
         };
         requestBody: {
             content: {
-                "application/json": {
-                    /** @description Seconds from now the workspace must stay idle before it is suspended (0..3600; 0 = as soon as it is idle). */
-                    after_seconds: number;
-                };
+                "application/json": components["schemas"]["ResizeWorkspaceBody"];
             };
         };
         responses: {
-            /** @description suspend_request: the recorded request. operation: set (and suspend_request null) only when a suspend was already in progress. */
+            /** @description Per resource the request named (allocation_mode and memory_mib_held report under memory): what applied now and what applies later. caps: the workspace caps every later start uses. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ResizeResult"];
+                };
+            };
+            /** @description Default Response */
             202: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
+                        operation: components["schemas"]["Operation"];
                         workspace: components["schemas"]["Workspace"];
-                        operation: components["schemas"]["Operation"] | null;
-                        suspend_request: components["schemas"]["SuspendRequest"] | null;
                     };
                 };
             };
@@ -13479,7 +14214,7 @@ export interface operations {
             };
         };
     };
-    deleteApiV1WorkspacesWorkspaceIdSuspendWhenIdle: {
+    postApiV1WorkspacesWorkspaceIdSuspendWhenIdle: {
         parameters: {
             query?: never;
             header?: never;
@@ -13489,15 +14224,67 @@ export interface operations {
             };
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Seconds from now the workspace must stay idle before it is suspended (0..3600; 0 = as soon as it is idle). */
+                    after_seconds: number;
+                };
+            };
+        };
         responses: {
-            /** @description Default Response */
-            200: {
+            /** @description suspend_request: the recorded request. operation: set (and suspend_request null) only when a suspend was already in progress. */
+            202: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["Workspace"];
+                    "application/json": {
+                        workspace: components["schemas"]["Workspace"];
+                        operation: components["schemas"]["Operation"] | null;
+                        suspend_request: components["schemas"]["SuspendRequest"] | null;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    deleteApiV1WorkspacesWorkspaceIdSuspendWhenIdle: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Workspace"];
                 };
             };
             /** @description Default Response */
@@ -13537,14 +14324,13 @@ export interface operations {
                 "application/json": {
                     /** @description Stable workspace key, unique per organization (e.g. `${customerId}/${projectId}`). */
                     key: string;
-                    /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction (allocation_mode: fixed). Given caps replace the stored ones. */
+                    /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction. Given caps replace the stored ones (a reopen keeps an elastic workspace’s mode when elastic is the organization’s default and allocation_mode is omitted). */
                     caps?: {
                         cpu_millis?: number;
                         memory_mib?: number;
                         disk_gib?: number;
                         /**
-                         * @description Memory allocation (contracts §32): fixed (default) boots memory_mib and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Takes effect at the next VM start.
-                         * @default fixed
+                         * @description Memory allocation (contracts §32): fixed boots memory_mib and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Omitted: fixed, or elastic where that is the organization’s default (a reopen then keeps the stored mode). Takes effect at the next VM start.
                          * @enum {string}
                          */
                         allocation_mode?: "fixed" | "elastic";
@@ -13896,56 +14682,869 @@ export interface operations {
             };
         };
     };
-    getApiV1WorkspacesWorkspaceIdAgentSessions: {
+    getApiV1WorkspacesWorkspaceIdAgentSessions: {
+        parameters: {
+            query?: {
+                limit?: number;
+                cursor?: string;
+            };
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: {
+                            /**
+                             * Format: uuid
+                             * @description UUIDv7, lowercase canonical form.
+                             */
+                            id: string;
+                            /**
+                             * Format: uuid
+                             * @description UUIDv7, lowercase canonical form.
+                             */
+                            workspace_id: string;
+                            agent_label: string;
+                            principal_type: "user" | "api_key";
+                            /**
+                             * Format: uuid
+                             * @description UUIDv7, lowercase canonical form.
+                             */
+                            principal_id: string;
+                            /**
+                             * Format: date-time
+                             * @description RFC 3339 UTC timestamp with Z.
+                             */
+                            created_at: string;
+                            last_token_issued_at: string | null;
+                            tokens_issued: number;
+                            revoked_at: string | null;
+                        }[];
+                        next_cursor: string | null;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    postApiV1WorkspacesWorkspaceIdStreamTickets: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @enum {string} */
+                    tool: "exec" | "files" | "pty" | "process" | "git" | "browser";
+                    /** @description Attribution label; one agent session per (workspace, principal, label). */
+                    agent_label?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Single use, valid 30 s; pass as `?ticket=` on the cell WebSocket upgrade from the same Origin. */
+                        ticket: string;
+                        /**
+                         * Format: date-time
+                         * @description RFC 3339 UTC timestamp with Z.
+                         */
+                        expires_at: string;
+                        /**
+                         * Format: uuid
+                         * @description UUIDv7, lowercase canonical form.
+                         */
+                        workspace_id: string;
+                        /** @enum {string} */
+                        tool: "exec" | "files" | "pty" | "process" | "git" | "browser";
+                        /**
+                         * Format: uuid
+                         * @description UUIDv7, lowercase canonical form.
+                         */
+                        agent_session_id: string;
+                        origin: string;
+                        ownership_epoch: number;
+                        cell_endpoint: string;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    getApiV1OrganizationsOrganizationIdEntitlements: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                organization_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * Format: uuid
+                         * @description UUIDv7, lowercase canonical form.
+                         */
+                        organization_id: string;
+                        plan: {
+                            plan_key: string;
+                            catalog_version: string;
+                            source: "override" | "subscription" | "trial" | "default";
+                            /** @description When this plan grant stops applying (a trial or partner grant); null when it lasts until changed. */
+                            ends_at: string | null;
+                        } | null;
+                        /** @description Resolved plan limits (null = unlimited). */
+                        limits: {
+                            [key: string]: unknown;
+                        };
+                        allowances: {
+                            [key: string]: unknown;
+                        };
+                        policies: {
+                            [key: string]: unknown;
+                        };
+                        /** @description Active admission restrictions, e.g. `new_starts` {reason, since, grace_until} after a payment grace period ended. */
+                        restrictions: {
+                            [key: string]: unknown;
+                        };
+                        /**
+                         * Format: date-time
+                         * @description RFC 3339 UTC timestamp with Z.
+                         */
+                        resolved_at: string;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    putV1WorkspacesWorkspaceIdPortsPort: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+                /** @description TCP port inside the workspace (1-65535). */
+                port: number;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description An exposed port of a workspace (contracts §39.3). Private: every request needs a credential. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Port"];
+                };
+            };
+            /** @description An exposed port of a workspace (contracts §39.3). Private: every request needs a credential. */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Port"];
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    deleteV1WorkspacesWorkspaceIdPortsPort: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+                /** @description TCP port inside the workspace (1-65535). */
+                port: number;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description No content. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    getV1WorkspacesWorkspaceIdPorts: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ports: components["schemas"]["Port"][];
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    postV1WorkspacesWorkspaceIdPortsPortTokens: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+                /** @description TCP port inside the workspace (1-65535). */
+                port: number;
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description Lifetime in seconds (60-86400, default 3600).
+                     * @default 3600
+                     */
+                    ttl_seconds?: number;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description sfp_…: send as `Authorization: Bearer <token>` (or `X-Shardflux-Token`) to `url`. Revoked when the port is closed. */
+                        token: string;
+                        /**
+                         * Format: date-time
+                         * @description RFC 3339 UTC timestamp with Z.
+                         */
+                        expires_at: string;
+                        /** @description The port’s URL. */
+                        url: string;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    postV1WorkspacesWorkspaceIdPortsPortLinks: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+                /** @description TCP port inside the workspace (1-65535). */
+                port: number;
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description Lifetime of the link and of the browser session it starts (60-604800 s, default 86400).
+                     * @default 86400
+                     */
+                    ttl_seconds?: number;
+                    /** @description Where the link lands (default `/`): a path starting with one `/`, printable ASCII, query allowed. */
+                    path?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Open in a browser: it sets a session cookie for the port’s host (until expires_at) and redirects to `path`. */
+                        url: string;
+                        /**
+                         * Format: date-time
+                         * @description RFC 3339 UTC timestamp with Z.
+                         */
+                        expires_at: string;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    postV1WorkspacesWorkspaceIdPortsPortCallback: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+                /** @description TCP port inside the workspace (1-65535). */
+                port: number;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description https://<port>-<handle>.<domain>/__shardflux/callback/sfcb_…/: append your own path. Shown once. */
+                        url: string;
+                        /**
+                         * Format: date-time
+                         * @description RFC 3339 UTC timestamp with Z.
+                         */
+                        created_at: string;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    deleteV1WorkspacesWorkspaceIdPortsPortCallback: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+                /** @description TCP port inside the workspace (1-65535). */
+                port: number;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description No content. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    putApiV1WorkspacesWorkspaceIdPortsPort: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+                /** @description TCP port inside the workspace (1-65535). */
+                port: number;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description An exposed port of a workspace (contracts §39.3). Private: every request needs a credential. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Port"];
+                };
+            };
+            /** @description An exposed port of a workspace (contracts §39.3). Private: every request needs a credential. */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Port"];
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    deleteApiV1WorkspacesWorkspaceIdPortsPort: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+                /** @description TCP port inside the workspace (1-65535). */
+                port: number;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description No content. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    getApiV1WorkspacesWorkspaceIdPorts: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        ports: components["schemas"]["Port"][];
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    postApiV1WorkspacesWorkspaceIdPortsPortTokens: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+                /** @description TCP port inside the workspace (1-65535). */
+                port: number;
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description Lifetime in seconds (60-86400, default 3600).
+                     * @default 3600
+                     */
+                    ttl_seconds?: number;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description sfp_…: send as `Authorization: Bearer <token>` (or `X-Shardflux-Token`) to `url`. Revoked when the port is closed. */
+                        token: string;
+                        /**
+                         * Format: date-time
+                         * @description RFC 3339 UTC timestamp with Z.
+                         */
+                        expires_at: string;
+                        /** @description The port’s URL. */
+                        url: string;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    postApiV1WorkspacesWorkspaceIdPortsPortLinks: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+                /** @description TCP port inside the workspace (1-65535). */
+                port: number;
+            };
+            cookie?: never;
+        };
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description Lifetime of the link and of the browser session it starts (60-604800 s, default 86400).
+                     * @default 86400
+                     */
+                    ttl_seconds?: number;
+                    /** @description Where the link lands (default `/`): a path starting with one `/`, printable ASCII, query allowed. */
+                    path?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Open in a browser: it sets a session cookie for the port’s host (until expires_at) and redirects to `path`. */
+                        url: string;
+                        /**
+                         * Format: date-time
+                         * @description RFC 3339 UTC timestamp with Z.
+                         */
+                        expires_at: string;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    postApiV1WorkspacesWorkspaceIdPortsPortCallback: {
         parameters: {
-            query?: {
-                limit?: number;
-                cursor?: string;
-            };
+            query?: never;
             header?: never;
             path: {
                 /** @description UUIDv7, lowercase canonical form. */
                 workspace_id: string;
+                /** @description TCP port inside the workspace (1-65535). */
+                port: number;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
             /** @description Default Response */
-            200: {
+            201: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        data: {
-                            /**
-                             * Format: uuid
-                             * @description UUIDv7, lowercase canonical form.
-                             */
-                            id: string;
-                            /**
-                             * Format: uuid
-                             * @description UUIDv7, lowercase canonical form.
-                             */
-                            workspace_id: string;
-                            agent_label: string;
-                            principal_type: "user" | "api_key";
-                            /**
-                             * Format: uuid
-                             * @description UUIDv7, lowercase canonical form.
-                             */
-                            principal_id: string;
-                            /**
-                             * Format: date-time
-                             * @description RFC 3339 UTC timestamp with Z.
-                             */
-                            created_at: string;
-                            last_token_issued_at: string | null;
-                            tokens_issued: number;
-                            revoked_at: string | null;
-                        }[];
-                        next_cursor: string | null;
+                        /** @description https://<port>-<handle>.<domain>/__shardflux/callback/sfcb_…/: append your own path. Shown once. */
+                        url: string;
+                        /**
+                         * Format: date-time
+                         * @description RFC 3339 UTC timestamp with Z.
+                         */
+                        created_at: string;
                     };
                 };
             };
@@ -13969,58 +15568,26 @@ export interface operations {
             };
         };
     };
-    postApiV1WorkspacesWorkspaceIdStreamTickets: {
+    deleteApiV1WorkspacesWorkspaceIdPortsPortCallback: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 /** @description UUIDv7, lowercase canonical form. */
                 workspace_id: string;
+                /** @description TCP port inside the workspace (1-65535). */
+                port: number;
             };
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": {
-                    /** @enum {string} */
-                    tool: "exec" | "files" | "pty" | "process" | "git" | "browser";
-                    /** @description Attribution label; one agent session per (workspace, principal, label). */
-                    agent_label?: string;
-                };
-            };
-        };
+        requestBody?: never;
         responses: {
-            /** @description Default Response */
-            201: {
+            /** @description No content. */
+            204: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content: {
-                    "application/json": {
-                        /** @description Single use, valid 30 s; pass as `?ticket=` on the cell WebSocket upgrade from the same Origin. */
-                        ticket: string;
-                        /**
-                         * Format: date-time
-                         * @description RFC 3339 UTC timestamp with Z.
-                         */
-                        expires_at: string;
-                        /**
-                         * Format: uuid
-                         * @description UUIDv7, lowercase canonical form.
-                         */
-                        workspace_id: string;
-                        /** @enum {string} */
-                        tool: "exec" | "files" | "pty" | "process" | "git" | "browser";
-                        /**
-                         * Format: uuid
-                         * @description UUIDv7, lowercase canonical form.
-                         */
-                        agent_session_id: string;
-                        origin: string;
-                        ownership_epoch: number;
-                        cell_endpoint: string;
-                    };
-                };
+                content?: never;
             };
             /** @description Default Response */
             "4XX": {
@@ -14042,56 +15609,69 @@ export interface operations {
             };
         };
     };
-    getApiV1OrganizationsOrganizationIdEntitlements: {
+    postV1InternalPortWakes: {
         parameters: {
             query?: never;
-            header?: never;
-            path: {
-                /** @description UUIDv7, lowercase canonical form. */
-                organization_id: string;
+            header?: {
+                /** @description RFC 7240 preference, e.g. `wait=20` (held wake). */
+                prefer?: string;
             };
+            path?: never;
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * Format: uuid
+                     * @description UUIDv7, lowercase canonical form.
+                     */
+                    workspace_id: string;
+                    /** @description TCP port inside the workspace (1-65535). */
+                    port: number;
+                    /** @description The callback URL’s secret (`sfcb_…`) when the request came in on the callback path; omit when Authorization carries a port token. */
+                    callback_secret?: string;
+                };
+            };
+        };
         responses: {
-            /** @description Default Response */
+            /** @description 200: running (operation null: it already was) or the resume succeeded during the hold. 202: the resume/open to wait for. */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        /**
-                         * Format: uuid
-                         * @description UUIDv7, lowercase canonical form.
-                         */
-                        organization_id: string;
-                        plan: {
-                            plan_key: string;
-                            catalog_version: string;
-                            source: "override" | "subscription" | "trial" | "default";
-                            /** @description When this plan grant stops applying (a trial or partner grant); null when it lasts until changed. */
-                            ends_at: string | null;
-                        } | null;
-                        /** @description Resolved plan limits (null = unlimited). */
-                        limits: {
-                            [key: string]: unknown;
-                        };
-                        allowances: {
-                            [key: string]: unknown;
-                        };
-                        policies: {
-                            [key: string]: unknown;
+                        workspace: {
+                            /**
+                             * Format: uuid
+                             * @description UUIDv7, lowercase canonical form.
+                             */
+                            id: string;
+                            observed_state: string;
+                            ownership_epoch: number;
                         };
-                        /** @description Active admission restrictions, e.g. `new_starts` {reason, since, grace_until} after a payment grace period ended. */
-                        restrictions: {
-                            [key: string]: unknown;
+                        operation: components["schemas"]["Operation"] | null;
+                    };
+                };
+            };
+            /** @description 200: running (operation null: it already was) or the resume succeeded during the hold. 202: the resume/open to wait for. */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        workspace: {
+                            /**
+                             * Format: uuid
+                             * @description UUIDv7, lowercase canonical form.
+                             */
+                            id: string;
+                            observed_state: string;
+                            ownership_epoch: number;
                         };
-                        /**
-                         * Format: date-time
-                         * @description RFC 3339 UTC timestamp with Z.
-                         */
-                        resolved_at: string;
+                        operation: components["schemas"]["Operation"] | null;
                     };
                 };
             };
@@ -28007,8 +29587,8 @@ export interface operations {
                             display_name: string;
                             unit: string;
                             meters: ("cpu_seconds" | "memory_gib_seconds" | "storage_gib_seconds" | "egress_bytes" | "ingress_bytes" | "volume_storage_gib_seconds")[];
-                            /** @description hard_cap: exhausting it refuses opens/resumes (402 allowance_exhausted) and running workspaces are suspended; spare_capacity: no allowance cap (runs on reclaimable spare capacity); reported: shown and notified, never enforced by refusing access; egress_block (outbound_transfer_gb, contracts §18): at 100% outbound internet traffic is blocked by an organization egress override until upgrade, purchase or the next period (workspaces keep running, starts are not refused). */
-                            enforcement: "hard_cap" | "spare_capacity" | "reported" | "egress_block";
+                            /** @description hard_cap: exhausting it refuses opens/resumes (402 allowance_exhausted) and running workspaces are suspended; spare_capacity: no allowance cap (runs on reclaimable spare capacity); reported: shown and notified, never enforced by refusing access; egress_block (outbound_transfer_gb, contracts §18): at 100% outbound internet traffic is blocked by an organization egress override until upgrade, purchase or the next period (workspaces keep running, starts are not refused); storage_block (retained_state_gib, contracts §40): at 100% opening a new workspace key and forking are refused (403 quota_exceeded, details.limit retained_state) until retained state is below the allowance (existing workspaces keep running, waking, suspending and resuming; nothing is deleted or charged). */
+                            enforcement: "hard_cap" | "spare_capacity" | "reported" | "egress_block" | "storage_block";
                             included: number | null;
                             used: number;
                             remaining: number | null;
@@ -28016,8 +29596,8 @@ export interface operations {
                             included_meter_units: number | null;
                             used_meter_units: number | null;
                             remaining_meter_units: number | null;
-                            /** @description ok: below 80 %. warning: 80 % or more of the allowance. exhausted: a hard cap is used up and starts are refused (402 allowance_exhausted; see exhausted_reason). overage: a CPU-hours or RAM GiB-hours allowance is used up while opt-in overage is on and below its spend cap, so starts are admitted and the usage past it is charged (spend_cap). over_allowance: a reported allowance is exceeded (never refused). egress_blocked: the outbound transfer allowance is used up and outbound traffic is blocked. uncapped: runs on spare capacity. not_included: the plan does not define it. */
-                            cap_state: "ok" | "warning" | "exhausted" | "overage" | "over_allowance" | "egress_blocked" | "uncapped" | "not_included";
+                            /** @description ok: below 80 %. warning: 80 % or more of the allowance. exhausted: a hard cap is used up and starts are refused (402 allowance_exhausted; see exhausted_reason). overage: a CPU-hours or RAM GiB-hours allowance is used up while opt-in overage is on and below its spend cap, so starts are admitted and the usage past it is charged (spend_cap). over_allowance: a reported allowance is exceeded (never refused). egress_blocked: the outbound transfer allowance is used up and outbound traffic is blocked. storage_blocked: the retained state allowance is used up and new workspaces and forks are refused (403 quota_exceeded). uncapped: runs on spare capacity. not_included: the plan does not define it. */
+                            cap_state: "ok" | "warning" | "exhausted" | "overage" | "over_allowance" | "egress_blocked" | "storage_blocked" | "uncapped" | "not_included";
                         }[];
                         meters: {
                             /** @enum {string} */
@@ -29062,8 +30642,8 @@ export interface operations {
                             display_name: string;
                             unit: string;
                             meters: ("cpu_seconds" | "memory_gib_seconds" | "storage_gib_seconds" | "egress_bytes" | "ingress_bytes" | "volume_storage_gib_seconds")[];
-                            /** @description hard_cap: exhausting it refuses opens/resumes (402 allowance_exhausted) and running workspaces are suspended; spare_capacity: no allowance cap (runs on reclaimable spare capacity); reported: shown and notified, never enforced by refusing access; egress_block (outbound_transfer_gb, contracts §18): at 100% outbound internet traffic is blocked by an organization egress override until upgrade, purchase or the next period (workspaces keep running, starts are not refused). */
-                            enforcement: "hard_cap" | "spare_capacity" | "reported" | "egress_block";
+                            /** @description hard_cap: exhausting it refuses opens/resumes (402 allowance_exhausted) and running workspaces are suspended; spare_capacity: no allowance cap (runs on reclaimable spare capacity); reported: shown and notified, never enforced by refusing access; egress_block (outbound_transfer_gb, contracts §18): at 100% outbound internet traffic is blocked by an organization egress override until upgrade, purchase or the next period (workspaces keep running, starts are not refused); storage_block (retained_state_gib, contracts §40): at 100% opening a new workspace key and forking are refused (403 quota_exceeded, details.limit retained_state) until retained state is below the allowance (existing workspaces keep running, waking, suspending and resuming; nothing is deleted or charged). */
+                            enforcement: "hard_cap" | "spare_capacity" | "reported" | "egress_block" | "storage_block";
                             included: number | null;
                             used: number;
                             remaining: number | null;
@@ -29071,8 +30651,8 @@ export interface operations {
                             included_meter_units: number | null;
                             used_meter_units: number | null;
                             remaining_meter_units: number | null;
-                            /** @description ok: below 80 %. warning: 80 % or more of the allowance. exhausted: a hard cap is used up and starts are refused (402 allowance_exhausted; see exhausted_reason). overage: a CPU-hours or RAM GiB-hours allowance is used up while opt-in overage is on and below its spend cap, so starts are admitted and the usage past it is charged (spend_cap). over_allowance: a reported allowance is exceeded (never refused). egress_blocked: the outbound transfer allowance is used up and outbound traffic is blocked. uncapped: runs on spare capacity. not_included: the plan does not define it. */
-                            cap_state: "ok" | "warning" | "exhausted" | "overage" | "over_allowance" | "egress_blocked" | "uncapped" | "not_included";
+                            /** @description ok: below 80 %. warning: 80 % or more of the allowance. exhausted: a hard cap is used up and starts are refused (402 allowance_exhausted; see exhausted_reason). overage: a CPU-hours or RAM GiB-hours allowance is used up while opt-in overage is on and below its spend cap, so starts are admitted and the usage past it is charged (spend_cap). over_allowance: a reported allowance is exceeded (never refused). egress_blocked: the outbound transfer allowance is used up and outbound traffic is blocked. storage_blocked: the retained state allowance is used up and new workspaces and forks are refused (403 quota_exceeded). uncapped: runs on spare capacity. not_included: the plan does not define it. */
+                            cap_state: "ok" | "warning" | "exhausted" | "overage" | "over_allowance" | "egress_blocked" | "storage_blocked" | "uncapped" | "not_included";
                         }[];
                         meters: {
                             /** @enum {string} */
@@ -35348,6 +36928,18 @@ export interface operations {
                                 disk_gib: number;
                             }[];
                             heartbeat_stale_after_seconds: number;
+                            /** @description Contracts §42.5: what draining this host costs in memory (cell.hosts.drain_runtime_impact). */
+                            runtime_impact?: {
+                                /** @description known: recorded by the cell’s capacity tick within 15 minutes; unknown: not recorded; stale: older (both reported, neither blocks). */
+                                status: "known" | "unknown" | "stale";
+                                memory_lost: number | null;
+                                waits: number | null;
+                                /** @description Affected snapshot compatibility keys with counts and their outlook without this host (largest first, at most 20). */
+                                keys: {
+                                    [key: string]: unknown;
+                                }[];
+                                computed_at: string | null;
+                            };
                             host: {
                                 /**
                                  * Format: uuid
@@ -35539,6 +37131,18 @@ export interface operations {
                                     disk_gib: number;
                                 }[];
                                 heartbeat_stale_after_seconds: number;
+                                /** @description Contracts §42.5: what draining this host costs in memory (cell.hosts.drain_runtime_impact). */
+                                runtime_impact?: {
+                                    /** @description known: recorded by the cell’s capacity tick within 15 minutes; unknown: not recorded; stale: older (both reported, neither blocks). */
+                                    status: "known" | "unknown" | "stale";
+                                    memory_lost: number | null;
+                                    waits: number | null;
+                                    /** @description Affected snapshot compatibility keys with counts and their outlook without this host (largest first, at most 20). */
+                                    keys: {
+                                        [key: string]: unknown;
+                                    }[];
+                                    computed_at: string | null;
+                                };
                                 host: {
                                     /**
                                      * Format: uuid
@@ -35727,6 +37331,18 @@ export interface operations {
                                 disk_gib: number;
                             }[];
                             heartbeat_stale_after_seconds: number;
+                            /** @description Contracts §42.5: what draining this host costs in memory (cell.hosts.drain_runtime_impact). */
+                            runtime_impact?: {
+                                /** @description known: recorded by the cell’s capacity tick within 15 minutes; unknown: not recorded; stale: older (both reported, neither blocks). */
+                                status: "known" | "unknown" | "stale";
+                                memory_lost: number | null;
+                                waits: number | null;
+                                /** @description Affected snapshot compatibility keys with counts and their outlook without this host (largest first, at most 20). */
+                                keys: {
+                                    [key: string]: unknown;
+                                }[];
+                                computed_at: string | null;
+                            };
                             host: {
                                 /**
                                  * Format: uuid
@@ -35920,6 +37536,18 @@ export interface operations {
                                 disk_gib: number;
                             }[];
                             heartbeat_stale_after_seconds: number;
+                            /** @description Contracts §42.5: what draining this host costs in memory (cell.hosts.drain_runtime_impact). */
+                            runtime_impact?: {
+                                /** @description known: recorded by the cell’s capacity tick within 15 minutes; unknown: not recorded; stale: older (both reported, neither blocks). */
+                                status: "known" | "unknown" | "stale";
+                                memory_lost: number | null;
+                                waits: number | null;
+                                /** @description Affected snapshot compatibility keys with counts and their outlook without this host (largest first, at most 20). */
+                                keys: {
+                                    [key: string]: unknown;
+                                }[];
+                                computed_at: string | null;
+                            };
                             host: {
                                 /**
                                  * Format: uuid
@@ -37070,4 +38698,116 @@ export interface operations {
             };
         };
     };
+    getApiV1OauthAuthorization: {
+        parameters: {
+            query?: {
+                response_type?: string;
+                client_id?: string;
+                redirect_uri?: string;
+                code_challenge?: string;
+                code_challenge_method?: string;
+                scope?: string;
+                state?: string;
+                resource?: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["OAuthConsentView"];
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    postApiV1OauthAuthorization: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description The authorization request exactly as /oauth/authorize received it (RFC 6749 §4.1.1, PKCE S256, RFC 8707 resource). */
+                    request: {
+                        response_type?: string;
+                        client_id?: string;
+                        redirect_uri?: string;
+                        code_challenge?: string;
+                        code_challenge_method?: string;
+                        scope?: string;
+                        state?: string;
+                        resource?: string;
+                    } & {
+                        [key: string]: unknown;
+                    };
+                    decision: "approve" | "deny";
+                    /**
+                     * Format: uuid
+                     * @description UUIDv7, lowercase canonical form.
+                     */
+                    project_id?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Send the browser here (the client’s redirect_uri with code or error, state and iss). */
+                        redirect_to: string;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
 }