@shardflux/sdk 0.13.1 → 0.15.0

package/dist/generated/app-api.d.ts

@@ -125,8 +125,8 @@ export interface paths {
             cookie?: never;
         };
         /**
-         * Public keys (JWKS) for verifying ES256 workspace tool tokens
-         * @description Consumed by the cell gateway. Tokens carry `kid`; TTL <= 15 min.
+         * Public keys (JWKS) for verifying ES256 workspace tool tokens and port tokens
+         * @description Consumed by the cell gateway. Tokens carry `kid`. Tool tokens live at most 15 min; port tokens (`sfp_` + JWS, aud shardflux-ports, contracts §39.3) at most 1 day (bearer) or 7 days (link): keep a rotated-out key in TOOL_TOKEN_KMS_VERIFY_KEYS for 7 days.
          */
         get: operations["getV1WellKnownToolTokenKeys"];
         put?: never;
@@ -602,6 +602,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/auth/signup": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Sign up from an agent, without a browser or an email round-trip
+         * @description Returns a CLI session at once. With `codex_id_token` (a Codex CLI login, contracts §44.2) the email is verified and the request signs in to the account of that ChatGPT identity or email, creating it when there is none (201 when created, 200 when it signed in; `mfa_required` when the account has TOTP). With `email` only, a new unverified account is created (201) with `access: provisional` (resource routes on the default plan before verification) or `verification_required`; an address that already has an account is 409 conflict, details.reason `email_registered`. Verify later with POST /v1/auth/verify-email/code.
+         */
+        post: operations["postV1AuthSignup"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/auth/verify-email/code": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Verify the email with a 6-digit code
+         * @description Without `code`: emails a 6-digit code to the account address (202; valid 15 minutes, once; a new one ends the previous). With `code`: verifies the address (200). The code proves that whoever holds this session reads the inbox, so nothing is signed out; the signup trial is granted when it applies. 5 wrong attempts end a code: 400 token_invalid.
+         */
+        post: operations["postV1AuthVerifyEmailCode"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/auth/login": {
         parameters: {
             query?: never;
@@ -724,7 +764,7 @@ export interface paths {
         put?: never;
         /**
          * Re-authenticate for sensitive actions
-         * @description Password, plus a TOTP or recovery code when MFA is enabled. Rotates the session; valid for STEP_UP_WINDOW_SECONDS.
+         * @description Password, or a Codex identity proof (`codex_id_token`) of a Codex login linked to the account (contracts §44.2), plus a TOTP or recovery code when MFA is enabled. Rotates the session; valid for STEP_UP_WINDOW_SECONDS.
          */
         post: operations["postV1AuthStepUp"];
         delete?: never;
@@ -1493,6 +1533,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/workspaces/{workspace_id}/computer-use": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Switch computer use on or off for the workspace (contracts §45.1)
+         * @description enabled: true or false overrides the template’s switch; null follows it. While computer use is on, tool tokens carry the computer tool and the workspace desktop starts on the first computer call. Takes effect on the next tool token. 409 computer_use_unavailable when the workspace’s template version cannot run a desktop, 409 not_supported_for_mode for file-first workspaces (§29), 409 workspace_deleted. Returns the switch.
+         */
+        put: operations["putV1WorkspacesWorkspaceIdComputerUse"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/workspaces/{workspace_id}/suspend": {
         parameters: {
             query?: never;
@@ -1553,6 +1613,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/workspaces/{workspace_id}/caps": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        /**
+         * Resize a workspace: memory, its allocation mode, CPU and disk, running or suspended
+         * @description Changes the caps of any workspace, fixed or elastic, running or suspended, without restarting or forking it. Each given field replaces the stored one (omitted fields keep theirs); every later start uses the new caps. Each value is bounded like caps at open: by the plan’s per-workspace maximum and the template’s limit (`limit_reason` plan or template). A running workspace changes live where it can (memory plugged or unplugged, CPU within its boot vCPUs, disk grown online); a suspended one gets the change right after its next resume, before the first call; what cannot apply now says `applies_at: next_start` and applies at the next start. The request is held until the resize finishes, up to `Prefer: wait=<seconds>` (default 20, at most 55): 200 ResizeResult (per resource: `applies_at` now | resume | next_start, requested, target, previous and applied values, `limit_reason`, `reason`) with the workspace caps; otherwise 202 with the `resize` operation, whose `result` carries the same per-resource fields when it succeeds. A resize that fails answers with its error. Errors (nothing changes): 409 conflict reason resize_not_available (not enabled for the organization), workspace_deleted, operation_in_progress (another lifecycle operation is active; details.active_operation_id, retryable); 422 validation_failed reason not_supported_for_mode (file-first workspace), shrink_not_supported (disk_gib below the current disk; details.current_disk_gib), requires_elastic (memory_mib_held without an elastic mode), exceeds_memory_mib (memory_mib_held above the maximum), allocation_mode_not_available (elastic memory is not available to the organization); 402 as for a start (no plan, new starts on hold). Owners, admins and members, and API keys with a tool permission. Supports Idempotency-Key.
+         */
+        patch: operations["patchV1WorkspacesWorkspaceIdCaps"];
+        trace?: never;
+    };
     "/v1/workspaces/{workspace_id}/suspend-when-idle": {
         parameters: {
             query?: never;
@@ -1886,6 +1966,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/workspaces/{workspace_id}/computer-use": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Switch computer use on or off for the workspace (contracts §45.1)
+         * @description enabled: true or false overrides the template’s switch; null follows it. While computer use is on, tool tokens carry the computer tool and the workspace desktop starts on the first computer call. Takes effect on the next tool token. 409 computer_use_unavailable when the workspace’s template version cannot run a desktop, 409 not_supported_for_mode for file-first workspaces (§29), 409 workspace_deleted. Returns the switch.
+         */
+        put: operations["putApiV1WorkspacesWorkspaceIdComputerUse"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/workspaces/{workspace_id}/suspend": {
         parameters: {
             query?: never;
@@ -1946,6 +2046,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/workspaces/{workspace_id}/caps": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        /**
+         * Resize a workspace: memory, its allocation mode, CPU and disk, running or suspended
+         * @description Changes the caps of any workspace, fixed or elastic, running or suspended, without restarting or forking it. Each given field replaces the stored one (omitted fields keep theirs); every later start uses the new caps. Each value is bounded like caps at open: by the plan’s per-workspace maximum and the template’s limit (`limit_reason` plan or template). A running workspace changes live where it can (memory plugged or unplugged, CPU within its boot vCPUs, disk grown online); a suspended one gets the change right after its next resume, before the first call; what cannot apply now says `applies_at: next_start` and applies at the next start. The request is held until the resize finishes, up to `Prefer: wait=<seconds>` (default 20, at most 55): 200 ResizeResult (per resource: `applies_at` now | resume | next_start, requested, target, previous and applied values, `limit_reason`, `reason`) with the workspace caps; otherwise 202 with the `resize` operation, whose `result` carries the same per-resource fields when it succeeds. A resize that fails answers with its error. Errors (nothing changes): 409 conflict reason resize_not_available (not enabled for the organization), workspace_deleted, operation_in_progress (another lifecycle operation is active; details.active_operation_id, retryable); 422 validation_failed reason not_supported_for_mode (file-first workspace), shrink_not_supported (disk_gib below the current disk; details.current_disk_gib), requires_elastic (memory_mib_held without an elastic mode), exceeds_memory_mib (memory_mib_held above the maximum), allocation_mode_not_available (elastic memory is not available to the organization); 402 as for a start (no plan, new starts on hold). Owners, admins and members, and API keys with a tool permission. Supports Idempotency-Key.
+         */
+        patch: operations["patchApiV1WorkspacesWorkspaceIdCaps"];
+        trace?: never;
+    };
     "/api/v1/workspaces/{workspace_id}/suspend-when-idle": {
         parameters: {
             query?: never;
@@ -2161,6 +2281,242 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/workspaces/{workspace_id}/ports/{port}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Expose a port of the workspace at its own HTTPS URL
+         * @description Serves TCP `port` inside the workspace at `https://<port>-<handle>.<ingress domain>` (contracts §39.3). The port is private: every request needs a port token (POST …/tokens), a signed link (POST …/links) or the port’s callback URL (POST …/callback). A request to a suspended workspace resumes it and is held until it runs; a parked one wakes inside the request. 201 when exposed now, 200 when it already was (unchanged: its tokens, links and callback URL stay valid). The handle is the workspace’s for good (kept when ports are closed and exposed again, across suspend, resume and reset; a fork gets none). At most 10 exposed ports: 409 conflict details.reason port_limit (details.limit 10). Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
+         */
+        put: operations["putV1WorkspacesWorkspaceIdPortsPort"];
+        post?: never;
+        /**
+         * Close an exposed port
+         * @description 204, also when the port was not exposed. Its tokens, links and callback URL stop working at once (the gateway caches for at most 5 s), and stay revoked if the port is exposed again. The workspace keeps its URL handle. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
+         */
+        delete: operations["deleteV1WorkspacesWorkspaceIdPortsPort"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspace_id}/ports": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the workspace’s exposed ports
+         * @description Ordered by port. `callback` is set when the port has a callback URL (its secret is never shown again). Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
+         */
+        get: operations["getV1WorkspacesWorkspaceIdPorts"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspace_id}/ports/{port}/tokens": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Mint a port token for an exposed port
+         * @description A bearer token for requests to the port’s URL: `Authorization: Bearer <token>` (or `X-Shardflux-Token: <token>` when the app uses Authorization itself). `sfp_` + an ES256 JWS (claims iss, aud `shardflux-ports`, sub, pty, org, prj, ws, port, pxid, use `bearer`, iat, exp, jti; keys at GET /v1/.well-known/tool-token-keys). Revoked by closing the port, deleting the workspace, revoking the API key that minted it, or the minting member’s removal or role change. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
+         */
+        post: operations["postV1WorkspacesWorkspaceIdPortsPortTokens"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspace_id}/ports/{port}/links": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Create a signed link that opens an exposed port in a browser
+         * @description Opening the link sets a session cookie for the port’s host (HttpOnly, Secure, until `expires_at`) and redirects to `path`, so a person can use the app in a browser without a header. Share it like a password: anyone with the link can open the port until it expires. Revoked like a port token (closing the port, deleting the workspace, revoking the minting API key). 422 validation_failed details.field path for a path that does not start with one `/` or has characters other than printable ASCII. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
+         */
+        post: operations["postV1WorkspacesWorkspaceIdPortsPortLinks"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/workspaces/{workspace_id}/ports/{port}/callback": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Create or replace the port’s callback URL (webhooks, OAuth redirects)
+         * @description A URL with a secret in its path that reaches the port without a token header: register `<url><your path>` with GitHub, Slack, Stripe or an OAuth provider; a request to `/__shardflux/callback/<secret>/<rest>` reaches `/<rest>` (query kept) and wakes the workspace like any request. Creating it again replaces it (the previous URL stops working). The secret is shown only in this response (stored as a SHA-256 hash). Revoke it with DELETE, by closing the port, or by deleting the workspace; it also stops waking the workspace when its creator can no longer manage the workspace. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
+         */
+        post: operations["postV1WorkspacesWorkspaceIdPortsPortCallback"];
+        /**
+         * Revoke the port’s callback URL
+         * @description 204, also when the port has no callback URL. The URL stops working at once (the gateway caches for at most 5 s). 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
+         */
+        delete: operations["deleteV1WorkspacesWorkspaceIdPortsPortCallback"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/workspaces/{workspace_id}/ports/{port}": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Expose a port of the workspace at its own HTTPS URL
+         * @description Serves TCP `port` inside the workspace at `https://<port>-<handle>.<ingress domain>` (contracts §39.3). The port is private: every request needs a port token (POST …/tokens), a signed link (POST …/links) or the port’s callback URL (POST …/callback). A request to a suspended workspace resumes it and is held until it runs; a parked one wakes inside the request. 201 when exposed now, 200 when it already was (unchanged: its tokens, links and callback URL stay valid). The handle is the workspace’s for good (kept when ports are closed and exposed again, across suspend, resume and reset; a fork gets none). At most 10 exposed ports: 409 conflict details.reason port_limit (details.limit 10). Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
+         */
+        put: operations["putApiV1WorkspacesWorkspaceIdPortsPort"];
+        post?: never;
+        /**
+         * Close an exposed port
+         * @description 204, also when the port was not exposed. Its tokens, links and callback URL stop working at once (the gateway caches for at most 5 s), and stay revoked if the port is exposed again. The workspace keeps its URL handle. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
+         */
+        delete: operations["deleteApiV1WorkspacesWorkspaceIdPortsPort"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/workspaces/{workspace_id}/ports": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * List the workspace’s exposed ports
+         * @description Ordered by port. `callback` is set when the port has a callback URL (its secret is never shown again). Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
+         */
+        get: operations["getApiV1WorkspacesWorkspaceIdPorts"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/workspaces/{workspace_id}/ports/{port}/tokens": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Mint a port token for an exposed port
+         * @description A bearer token for requests to the port’s URL: `Authorization: Bearer <token>` (or `X-Shardflux-Token: <token>` when the app uses Authorization itself). `sfp_` + an ES256 JWS (claims iss, aud `shardflux-ports`, sub, pty, org, prj, ws, port, pxid, use `bearer`, iat, exp, jti; keys at GET /v1/.well-known/tool-token-keys). Revoked by closing the port, deleting the workspace, revoking the API key that minted it, or the minting member’s removal or role change. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
+         */
+        post: operations["postApiV1WorkspacesWorkspaceIdPortsPortTokens"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/workspaces/{workspace_id}/ports/{port}/links": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Create a signed link that opens an exposed port in a browser
+         * @description Opening the link sets a session cookie for the port’s host (HttpOnly, Secure, until `expires_at`) and redirects to `path`, so a person can use the app in a browser without a header. Share it like a password: anyone with the link can open the port until it expires. Revoked like a port token (closing the port, deleting the workspace, revoking the minting API key). 422 validation_failed details.field path for a path that does not start with one `/` or has characters other than printable ASCII. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
+         */
+        post: operations["postApiV1WorkspacesWorkspaceIdPortsPortLinks"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/api/v1/workspaces/{workspace_id}/ports/{port}/callback": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Create or replace the port’s callback URL (webhooks, OAuth redirects)
+         * @description A URL with a secret in its path that reaches the port without a token header: register `<url><your path>` with GitHub, Slack, Stripe or an OAuth provider; a request to `/__shardflux/callback/<secret>/<rest>` reaches `/<rest>` (query kept) and wakes the workspace like any request. Creating it again replaces it (the previous URL stops working). The secret is shown only in this response (stored as a SHA-256 hash). Revoke it with DELETE, by closing the port, or by deleting the workspace; it also stops waking the workspace when its creator can no longer manage the workspace. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
+         */
+        post: operations["postApiV1WorkspacesWorkspaceIdPortsPortCallback"];
+        /**
+         * Revoke the port’s callback URL
+         * @description 204, also when the port has no callback URL. The URL stops working at once (the gateway caches for at most 5 s). 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
+         */
+        delete: operations["deleteApiV1WorkspacesWorkspaceIdPortsPortCallback"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/internal/port-wakes": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Wake a workspace for an inbound port request (called by the cell gateway)
+         * @description Contracts §39.3. The credential is the ingress request’s port token, forwarded unchanged as `Authorization: Bearer sfp_…` (`use` bearer or link), or the callback URL’s secret in `callback_secret`. The API verifies it as the gateway does: ES256 with its own keys, iss, aud shardflux-ports, iat/exp, workspace and port of the token (403 port_token_scope), the port exposed (404 port_not_exposed) under the token’s exposure (`pxid`), the revocation watermarks of the minting principal and the workspace and the minting API key (401 port_token_revoked), or the callback secret’s SHA-256 and its creator’s lifecycle permission (401 callback_invalid); then the organization’s `policy.inbound_ports` (403 inbound_ports_not_enabled). A deleted workspace is 404 unknown_host. It then resumes the workspace as that principal exactly like POST /v1/workspaces/{id}/resume (joins an active resume/open, recovers a failed workspace with an open, refuses with its admission errors, which the gateway passes through), audited workspace.resume with details.via inbound_port. With `Prefer: wait=<seconds>` (at most 20) it holds like a held resume: 200 {workspace, operation} once the operation succeeded, 202 with the operation otherwise (also without the preference). A running workspace answers 200 at once with operation null. 401 port_auth_required (no credential), port_token_invalid; 429 rate_limited per workspace. `Cache-Control: no-store`.
+         */
+        post: operations["postV1InternalPortWakes"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/projects/{project_id}/volumes": {
         parameters: {
             query?: never;
@@ -2441,6 +2797,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/organizations/{organization_id}/templates/{slug}/computer-use": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Switch computer use on or off for the workspaces of an organization template (contracts §45.1)
+         * @description Every workspace of the template follows it unless the workspace sets its own value; takes effect on their next tool token. Owners and admins (sessions) or API keys of the organization with a tool permission. 403 for platform templates (switch a workspace on instead), 404 outside the organization.
+         */
+        put: operations["putV1OrganizationsOrganizationIdTemplatesSlugComputerUse"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/templates/{slug}/computer-use": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Switch computer use on or off for the workspaces of an organization template (contracts §45.1) (the API key’s organization)
+         * @description Every workspace of the template follows it unless the workspace sets its own value; takes effect on their next tool token. Owners and admins (sessions) or API keys of the organization with a tool permission. 403 for platform templates (switch a workspace on instead), 404 outside the organization.
+         */
+        put: operations["putV1TemplatesSlugComputerUse"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/organizations/{organization_id}/template-builds": {
         parameters: {
             query?: never;
@@ -2779,6 +3175,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/organizations/{organization_id}/templates/{slug}/computer-use": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Switch computer use on or off for the workspaces of an organization template (contracts §45.1)
+         * @description Every workspace of the template follows it unless the workspace sets its own value; takes effect on their next tool token. Owners and admins (sessions) or API keys of the organization with a tool permission. 403 for platform templates (switch a workspace on instead), 404 outside the organization.
+         */
+        put: operations["putApiV1OrganizationsOrganizationIdTemplatesSlugComputerUse"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/organizations/{organization_id}/template-builds": {
         parameters: {
             query?: never;
@@ -5524,6 +5940,30 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/oauth/authorization": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Describe a hosted MCP connection request (consent page)
+         * @description Describes the pending authorization request /connect?request=<id> names: the client, where the browser goes afterwards and the projects the user may connect. 422 `validation_failed`: details.reason `request_expired` (unknown, expired after 15 minutes, or already answered), details.oauth_error when the client or its redirect_uri cannot be trusted, or details.redirect_to (the error redirect) for any other problem.
+         */
+        get: operations["getApiV1OauthAuthorization"];
+        put?: never;
+        /**
+         * Approve or decline a hosted MCP connection request
+         * @description Answers the pending request (it is consumed). approve (with project_id, a project where the user is owner or admin; checked before the request is consumed) creates the connection: a project API key named "<client> (MCP connector)" with every tool permission, held by Shardflux for the client, and a single-use authorization code (5 minutes). deny sends access_denied. Either way the answer is redirect_to, where the browser goes next.
+         */
+        post: operations["postApiV1OauthAuthorization"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
 }
 export type webhooks = Record<string, never>;
 export interface components {
@@ -6510,7 +6950,7 @@ export interface components {
                 disk_gib?: number;
             };
             agent_label?: string;
-            tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+            tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
             /** @description Open-time inputs of the template version (contracts §24.3): {NAME: string} for its declared text inputs. A new workspace stores each given value, else the declared default; on an existing key `inputs` replaces them all (omitted = unchanged). Secret inputs are not passed here: they bind the stored secret of the same name. 422 input_unknown (undeclared name, details.names), input_invalid (a secret input, a non-string, or a value over 4096 bytes or with CR, LF or NUL; details.names), input_required (details {names, kind}). */
             inputs?: {
                 [key: string]: unknown;
@@ -6530,7 +6970,7 @@ export interface components {
                 disk_gib?: number;
             };
             agent_label?: string;
-            tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+            tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
             /** @description Open-time inputs of the template version (contracts §24.3): {NAME: string} for its declared text inputs. A new workspace stores each given value, else the declared default; on an existing key `inputs` replaces them all (omitted = unchanged). Secret inputs are not passed here: they bind the stored secret of the same name. 422 input_unknown (undeclared name, details.names), input_invalid (a secret input, a non-string, or a value over 4096 bytes or with CR, LF or NUL; details.names), input_required (details {names, kind}). */
             inputs?: {
                 [key: string]: unknown;
@@ -6725,7 +7165,7 @@ export interface components {
                 disk_gib?: number;
             };
             agent_label?: string;
-            tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+            tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
             /** @description Open-time inputs of the template version (contracts §24.3): {NAME: string} for its declared text inputs. A new workspace stores each given value, else the declared default; on an existing key `inputs` replaces them all (omitted = unchanged). Secret inputs are not passed here: they bind the stored secret of the same name. 422 input_unknown (undeclared name, details.names), input_invalid (a secret input, a non-string, or a value over 4096 bytes or with CR, LF or NUL; details.names), input_required (details {names, kind}). */
             inputs?: {
                 [key: string]: unknown;
@@ -6750,6 +7190,111 @@ export interface components {
              */
             not_before: string;
         };
+        /** @description At least one field. Each given value replaces the stored one; omitted fields keep theirs. */
+        ResizeWorkspaceBody: {
+            /** @description Memory (MiB): the size of a fixed workspace, the maximum of an elastic one. Bounded by the plan and the template (`limit_reason`). */
+            memory_mib?: number;
+            /** @description Elastic only: the memory held while idle (MiB), at most the maximum. */
+            memory_mib_held?: number;
+            /**
+             * @description fixed: memory_mib is plugged and held; elastic: the workspace holds memory_mib_held and grows to memory_mib when a command needs it.
+             * @enum {string}
+             */
+            allocation_mode?: "fixed" | "elastic";
+            /** @description CPU (millicores). Bounded by the plan and the template. */
+            cpu_millis?: number;
+            /** @description Disk (GiB). Grow only. Bounded by the plan and the template. */
+            disk_gib?: number;
+        };
+        /** @description Per resource the request named (allocation_mode and memory_mib_held report under memory): what applied now and what applies later. caps: the workspace caps every later start uses. */
+        ResizeResult: {
+            /**
+             * Format: uuid
+             * @description UUIDv7, lowercase canonical form.
+             */
+            workspace_id: string;
+            /**
+             * Format: uuid
+             * @description UUIDv7, lowercase canonical form.
+             */
+            operation_id: string;
+            /** @description The workspace state the resize found (running, suspended, ...). */
+            state: string;
+            memory?: {
+                /**
+                 * @description now: live; resume: right after the next resume, before its first call; next_start: at the next start that boots the workspace.
+                 * @enum {string}
+                 */
+                applies_at: "now" | "resume" | "next_start";
+                /**
+                 * @description The memory layout after the resize.
+                 * @enum {string}
+                 */
+                allocation_mode: "fixed" | "elastic";
+                requested_mib: number | null;
+                target_mib: number | null;
+                previous_mib: number | null;
+                applied_mib: number | null;
+                held_mib: number | null;
+                converged: boolean | null;
+                /** @description Why the target or the applied value is below what was requested: plan or template (bounded like caps at open), host_capacity (the rest did not fit on the host at once), shrink_stalled (the guest kept the memory its processes use). */
+                limit_reason: ("plan" | "template" | "host_capacity" | "shrink_stalled") | null;
+                /** @description Why it does not apply now (null when it does). */
+                reason: ("region" | "below_base" | "legacy_layout" | "boot_vcpus" | "suspended" | "stopped") | null;
+            };
+            cpu?: {
+                /**
+                 * @description now: live; resume: right after the next resume, before its first call; next_start: at the next start that boots the workspace.
+                 * @enum {string}
+                 */
+                applies_at: "now" | "resume" | "next_start";
+                requested_millis: number | null;
+                target_millis: number | null;
+                previous_millis: number | null;
+                applied_millis: number | null;
+                /** @description Why the target or the applied value is below what was requested: plan or template (bounded like caps at open), host_capacity (the rest did not fit on the host at once), shrink_stalled (the guest kept the memory its processes use). */
+                limit_reason: ("plan" | "template" | "host_capacity" | "shrink_stalled") | null;
+                /** @description Why it does not apply now (null when it does). */
+                reason: ("region" | "below_base" | "legacy_layout" | "boot_vcpus" | "suspended" | "stopped") | null;
+            };
+            disk?: {
+                /**
+                 * @description now: live; resume: right after the next resume, before its first call; next_start: at the next start that boots the workspace.
+                 * @enum {string}
+                 */
+                applies_at: "now" | "resume" | "next_start";
+                requested_gib: number | null;
+                target_gib: number | null;
+                previous_gib: number | null;
+                applied_gib: number | null;
+                /** @description Why the target or the applied value is below what was requested: plan or template (bounded like caps at open), host_capacity (the rest did not fit on the host at once), shrink_stalled (the guest kept the memory its processes use). */
+                limit_reason: ("plan" | "template" | "host_capacity" | "shrink_stalled") | null;
+                /** @description Why it does not apply now (null when it does). */
+                reason: ("region" | "below_base" | "legacy_layout" | "boot_vcpus" | "suspended" | "stopped") | null;
+            };
+            /** @description User caps for this workspace (null = no user restriction) and its memory allocation mode. */
+            caps: {
+                cpu_millis: number | null;
+                memory_mib: number | null;
+                disk_gib: number | null;
+                /**
+                 * @description Memory allocation (contracts §32): fixed (default) boots memory_mib and holds it; elastic holds memory_mib_held while idle and is grown up to memory_mib (the promise) when a command needs it. The mode the next VM start uses: an elastic request whose promise does not exceed the held floor by at least 512 MiB is fixed at the promise.
+                 * @enum {string}
+                 */
+                allocation_mode: "fixed" | "elastic";
+                /** @description Elastic only: the memory held while idle (MiB). */
+                memory_mib_held?: number;
+            };
+        };
+        ComputerUse: {
+            /** @description Effective: tool tokens carry the computer tool (the workspace’s value, else the template’s, and the version runs a desktop). */
+            enabled: boolean;
+            workspace: boolean | null;
+            /** @description The template’s switch for its workspaces. */
+            template: boolean;
+            /** @description The workspace’s template version can run a desktop (its guest agent has desktop.v1). */
+            available: boolean;
+        };
         Workspace: {
             /**
              * Format: uuid
@@ -6878,6 +7423,7 @@ export interface components {
             mode: components["schemas"]["WorkspaceMode"];
             /** @description file_first: the latest revision of the file tree (0 = the empty tree the workspace starts with; each mutating file call or execution publishes the next one; cell file responses carry it as X-Tree-Revision). Always 0 for processful workspaces. */
             tree_revision: number;
+            computer_use: components["schemas"]["ComputerUse"];
             /**
              * Format: date-time
              * @description RFC 3339 UTC timestamp with Z.
@@ -6950,9 +7496,28 @@ export interface components {
              */
             agent_session_id: string;
             ownership_epoch: number;
-            tools: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+            tools: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
             cell_endpoint: string;
         };
+        /** @description An exposed port of a workspace (contracts §39.3). Private: every request needs a credential. */
+        Port: {
+            /** @description TCP port inside the workspace (1-65535). */
+            port: number;
+            /** @description https://<port>-<handle>.<ingress domain>: requests need a port token (Authorization: Bearer sfp_…), a signed link’s cookie, or the callback URL. */
+            url: string;
+            /**
+             * Format: date-time
+             * @description RFC 3339 UTC timestamp with Z.
+             */
+            created_at: string;
+            callback: {
+                /**
+                 * Format: date-time
+                 * @description RFC 3339 UTC timestamp with Z.
+                 */
+                created_at: string;
+            } | null;
+        };
         Volume: {
             /**
              * Format: uuid
@@ -7131,6 +7696,39 @@ export interface components {
             /** @description When the charges reach the effective cap at the average burn of this period so far. Null when not accruing or when it would fall after resets_at. */
             projected_reached_at: string | null;
         };
+        OAuthConsentView: {
+            client: {
+                client_id: string;
+                /** @description client_name from its registration or metadata document. Self-declared: show it with redirect_host. */
+                name: string;
+                uri: string | null;
+                logo_uri: string | null;
+                /** @description `metadata_document`: client_id is an https URL its owner serves (the host is verified by that); `registered`: dynamic client registration. */
+                kind: "registered" | "metadata_document";
+                client_id_host: string | null;
+            };
+            /** @description Where the browser goes after the decision (host, or scheme://host for a native app). */
+            redirect_host: string;
+            scope: string;
+            /** @description The MCP endpoint the client will be able to use. */
+            resource: string;
+            /** @description Projects the user may connect (owner or admin of the organization), by organization then project name; at most 200. */
+            projects: {
+                /**
+                 * Format: uuid
+                 * @description UUIDv7, lowercase canonical form.
+                 */
+                organization_id: string;
+                organization_name: string;
+                /**
+                 * Format: uuid
+                 * @description UUIDv7, lowercase canonical form.
+                 */
+                project_id: string;
+                project_name: string;
+                role: "owner" | "admin";
+            }[];
+        };
     };
     responses: never;
     parameters: never;
@@ -8678,7 +9276,7 @@ export interface operations {
             };
         };
     };
-    postV1AuthLogin: {
+    postV1AuthSignup: {
         parameters: {
             query?: never;
             header?: never;
@@ -8689,9 +9287,10 @@ export interface operations {
             content: {
                 "application/json": {
                     /** @description Email address. */
-                    email: string;
-                    /** @description Password (12-256 characters). */
-                    password: string;
+                    email?: string;
+                    display_name?: string;
+                    /** @description The OpenAI ID token of a Codex CLI login (`tokens.id_token` in `~/.codex/auth.json`, refreshed by Codex within CODEX_PROOF_MAX_AGE_SECONDS). Proves a verified email; it is not a credential to OpenAI. */
+                    codex_id_token?: string;
                 };
             };
         };
@@ -8704,6 +9303,43 @@ export interface operations {
                 content: {
                     "application/json": {
                         status: "authenticated" | "mfa_required";
+                        /** @description True when this request created the account; false: it signed in to an existing one (a Codex proof only). */
+                        created: boolean;
+                        /** @description verified: the email is verified (a Codex proof, or verified before). provisional: unverified, and the account may use resource routes on its default plan now; the signup trial comes when the email is verified. verification_required: unverified, and resource routes answer 403 email_unverified until POST /v1/auth/verify-email/code. */
+                        access: "verified" | "provisional" | "verification_required";
+                        user: {
+                            /**
+                             * Format: uuid
+                             * @description UUIDv7, lowercase canonical form.
+                             */
+                            id: string;
+                            email: string;
+                            email_verified: boolean;
+                            display_name: string | null;
+                            mfa_enabled: boolean;
+                        } | null;
+                        /** @description The session: send `Authorization: Bearer <session_token>` from now on (a previous token of this session is revoked). */
+                        session_token: string;
+                        /**
+                         * Format: date-time
+                         * @description RFC 3339 UTC timestamp with Z.
+                         */
+                        session_expires_at: string;
+                    };
+                };
+            };
+            /** @description Default Response */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        status: "authenticated" | "mfa_required";
+                        /** @description True when this request created the account; false: it signed in to an existing one (a Codex proof only). */
+                        created: boolean;
+                        /** @description verified: the email is verified (a Codex proof, or verified before). provisional: unverified, and the account may use resource routes on its default plan now; the signup trial comes when the email is verified. verification_required: unverified, and resource routes answer 403 email_unverified until POST /v1/auth/verify-email/code. */
+                        access: "verified" | "provisional" | "verification_required";
                         user: {
                             /**
                              * Format: uuid
@@ -8745,7 +9381,7 @@ export interface operations {
             };
         };
     };
-    postV1AuthMfaChallenge: {
+    postV1AuthVerifyEmailCode: {
         parameters: {
             query?: never;
             header?: never;
@@ -8755,10 +9391,70 @@ export interface operations {
         requestBody: {
             content: {
                 "application/json": {
-                    /** @description Current 6-digit TOTP code. */
+                    /** @description The 6-digit code from the email. */
                     code?: string;
-                    /** @description One-time recovery code. */
-                    recovery_code?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @enum {string} */
+                        status: "verified";
+                    };
+                };
+            };
+            /** @description Default Response */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @enum {string} */
+                        status: "accepted";
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    postV1AuthLogin: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Email address. */
+                    email: string;
+                    /** @description Password (12-256 characters). */
+                    password: string;
                 };
             };
         };
@@ -8812,21 +9508,88 @@ export interface operations {
             };
         };
     };
-    postV1AuthLogout: {
+    postV1AuthMfaChallenge: {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Current 6-digit TOTP code. */
+                    code?: string;
+                    /** @description One-time recovery code. */
+                    recovery_code?: string;
+                };
+            };
+        };
         responses: {
-            /** @description No content. */
-            204: {
+            /** @description Default Response */
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content?: never;
+                content: {
+                    "application/json": {
+                        status: "authenticated" | "mfa_required";
+                        user: {
+                            /**
+                             * Format: uuid
+                             * @description UUIDv7, lowercase canonical form.
+                             */
+                            id: string;
+                            email: string;
+                            email_verified: boolean;
+                            display_name: string | null;
+                            mfa_enabled: boolean;
+                        } | null;
+                        /** @description The session: send `Authorization: Bearer <session_token>` from now on (a previous token of this session is revoked). */
+                        session_token: string;
+                        /**
+                         * Format: date-time
+                         * @description RFC 3339 UTC timestamp with Z.
+                         */
+                        session_expires_at: string;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    postV1AuthLogout: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description No content. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
             };
             /** @description Default Response */
             "4XX": {
@@ -9002,7 +9765,9 @@ export interface operations {
             content: {
                 "application/json": {
                     /** @description Password (12-256 characters). */
-                    password: string;
+                    password?: string;
+                    /** @description The OpenAI ID token of a Codex CLI login (`tokens.id_token` in `~/.codex/auth.json`, refreshed by Codex within CODEX_PROOF_MAX_AGE_SECONDS). Proves a verified email; it is not a credential to OpenAI. */
+                    codex_id_token?: string;
                     /** @description Current 6-digit TOTP code. */
                     code?: string;
                     /** @description One-time recovery code. */
@@ -9543,7 +10308,7 @@ export interface operations {
                              * @description UUIDv7, lowercase canonical form.
                              */
                             project_id: string;
-                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                         } | null;
                     };
                 };
@@ -10386,7 +11151,7 @@ export interface operations {
                              */
                             project_id: string;
                             name: string;
-                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                             /**
                              * Format: date-time
                              * @description RFC 3339 UTC timestamp with Z.
@@ -10434,7 +11199,7 @@ export interface operations {
             content: {
                 "application/json": {
                     name: string;
-                    tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                     /**
                      * Format: date-time
                      * @description RFC 3339 UTC timestamp with Z.
@@ -10470,7 +11235,7 @@ export interface operations {
                              */
                             project_id: string;
                             name: string;
-                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                             /**
                              * Format: date-time
                              * @description RFC 3339 UTC timestamp with Z.
@@ -10602,7 +11367,7 @@ export interface operations {
                              * @description UUIDv7, lowercase canonical form.
                              */
                             project_id: string;
-                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                         } | null;
                     };
                 };
@@ -11445,7 +12210,7 @@ export interface operations {
                              */
                             project_id: string;
                             name: string;
-                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                             /**
                              * Format: date-time
                              * @description RFC 3339 UTC timestamp with Z.
@@ -11493,7 +12258,7 @@ export interface operations {
             content: {
                 "application/json": {
                     name: string;
-                    tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                     /**
                      * Format: date-time
                      * @description RFC 3339 UTC timestamp with Z.
@@ -11529,7 +12294,7 @@ export interface operations {
                              */
                             project_id: string;
                             name: string;
-                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                             /**
                              * Format: date-time
                              * @description RFC 3339 UTC timestamp with Z.
@@ -11626,14 +12391,13 @@ export interface operations {
                     };
                     /** @description Template slug; new workspaces use its latest published version. */
                     template: string;
-                    /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction (allocation_mode: fixed). Given caps replace the stored ones. */
+                    /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction. Given caps replace the stored ones (a reopen keeps an elastic workspace’s mode when elastic is the organization’s default and allocation_mode is omitted). */
                     caps?: {
                         cpu_millis?: number;
                         memory_mib?: number;
                         disk_gib?: number;
                         /**
-                         * @description Memory allocation (contracts §32): fixed (default) boots memory_mib and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Takes effect at the next VM start.
-                         * @default fixed
+                         * @description Memory allocation (contracts §32): fixed boots memory_mib and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Omitted: fixed, or elastic where that is the organization’s default (a reopen then keeps the stored mode). Takes effect at the next VM start.
                          * @enum {string}
                          */
                         allocation_mode?: "fixed" | "elastic";
@@ -11647,7 +12411,7 @@ export interface operations {
                     project_id?: string;
                     /** @description Attribution label; one agent session per (workspace, principal, label). */
                     agent_label?: string;
-                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                     /** @description Secret names bound to the workspace (max 50, unique): injected as environment variables into every exec and PTY start (terminal sessions included), together with the call’s own `secret_refs`. Each must name a live secret this workspace may use (its project, its id, and allowed_tools including exec and pty), else 422 details.reason secret_not_available with details.names. */
                     secrets?: string[];
                     /** @description Open-time inputs of the template version (contracts §24.3): {NAME: string} for its declared text inputs. A new workspace stores each given value, else the declared default; on an existing key `inputs` replaces them all (omitted = unchanged). Secret inputs are not passed here: they bind the stored secret of the same name. 422 input_unknown (undeclared name, details.names), input_invalid (a secret input, a non-string, or a value over 4096 bytes or with CR, LF or NUL; details.names), input_required (details {names, kind}). */
@@ -11658,6 +12422,8 @@ export interface operations {
                     /** @description adaptive (the learned timeout, default), never, or fixed:<seconds> (60..604800). Contracts §20.7. */
                     idle_policy?: string;
                     mode?: components["schemas"]["WorkspaceMode"];
+                    /** @description Contracts §45.1: the workspace’s computer use switch (null follows the template); set on create, replaced on an existing key when given. */
+                    computer_use?: boolean | null;
                 };
             };
         };
@@ -11673,6 +12439,8 @@ export interface operations {
                         operation: components["schemas"]["Operation"] | null;
                         cell_endpoint: string | null;
                         tool_token: components["schemas"]["ToolToken"] | null;
+                        /** @description Contracts §46.2: true when this request created the workspace (a new key, or a key whose session ended), false when it reconnected to or resumed an existing one. Of concurrent opens of one new key exactly one says true; a replay with the same Idempotency-Key repeats it. */
+                        created: boolean;
                     };
                 };
             };
@@ -11687,6 +12455,8 @@ export interface operations {
                         operation: components["schemas"]["Operation"] | null;
                         cell_endpoint: string | null;
                         tool_token: components["schemas"]["ToolToken"] | null;
+                        /** @description Contracts §46.2: true when this request created the workspace (a new key, or a key whose session ended), false when it reconnected to or resumed an existing one. Of concurrent opens of one new key exactly one says true; a replay with the same Idempotency-Key repeats it. */
+                        created: boolean;
                     };
                 };
             };
@@ -12052,6 +12822,54 @@ export interface operations {
             };
         };
     };
+    putV1WorkspacesWorkspaceIdComputerUse: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description true or false overrides the template; null follows it. */
+                    enabled: boolean | null;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ComputerUse"];
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
     postV1WorkspacesWorkspaceIdSuspend: {
         parameters: {
             query?: never;
@@ -12115,7 +12933,7 @@ export interface operations {
                 "application/json": {
                     /** @description Attribution label; one agent session per (workspace, principal, label). */
                     agent_label?: string;
-                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                 };
             };
         };
@@ -12216,6 +13034,66 @@ export interface operations {
             };
         };
     };
+    patchV1WorkspacesWorkspaceIdCaps: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description RFC 7240 preference, e.g. `wait=30` (at most 55; default 20). */
+                prefer?: string;
+            };
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ResizeWorkspaceBody"];
+            };
+        };
+        responses: {
+            /** @description Per resource the request named (allocation_mode and memory_mib_held report under memory): what applied now and what applies later. caps: the workspace caps every later start uses. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ResizeResult"];
+                };
+            };
+            /** @description Default Response */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        operation: components["schemas"]["Operation"];
+                        workspace: components["schemas"]["Workspace"];
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
     postV1WorkspacesWorkspaceIdSuspendWhenIdle: {
         parameters: {
             query?: never;
@@ -12326,14 +13204,13 @@ export interface operations {
                 "application/json": {
                     /** @description Stable workspace key, unique per organization (e.g. `${customerId}/${projectId}`). */
                     key: string;
-                    /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction (allocation_mode: fixed). Given caps replace the stored ones. */
+                    /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction. Given caps replace the stored ones (a reopen keeps an elastic workspace’s mode when elastic is the organization’s default and allocation_mode is omitted). */
                     caps?: {
                         cpu_millis?: number;
                         memory_mib?: number;
                         disk_gib?: number;
                         /**
-                         * @description Memory allocation (contracts §32): fixed (default) boots memory_mib and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Takes effect at the next VM start.
-                         * @default fixed
+                         * @description Memory allocation (contracts §32): fixed boots memory_mib and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Omitted: fixed, or elastic where that is the organization’s default (a reopen then keeps the stored mode). Takes effect at the next VM start.
                          * @enum {string}
                          */
                         allocation_mode?: "fixed" | "elastic";
@@ -12343,7 +13220,7 @@ export interface operations {
                     lifetime?: components["schemas"]["WorkspaceLifetime"];
                     /** @description Attribution label; one agent session per (workspace, principal, label). */
                     agent_label?: string;
-                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                 };
             };
         };
@@ -12651,7 +13528,7 @@ export interface operations {
                 "application/json": {
                     /** @description Attribution label; one agent session per (workspace, principal, label). */
                     agent_label?: string;
-                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                 };
             };
         };
@@ -12852,14 +13729,13 @@ export interface operations {
                     };
                     /** @description Template slug; new workspaces use its latest published version. */
                     template: string;
-                    /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction (allocation_mode: fixed). Given caps replace the stored ones. */
+                    /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction. Given caps replace the stored ones (a reopen keeps an elastic workspace’s mode when elastic is the organization’s default and allocation_mode is omitted). */
                     caps?: {
                         cpu_millis?: number;
                         memory_mib?: number;
                         disk_gib?: number;
                         /**
-                         * @description Memory allocation (contracts §32): fixed (default) boots memory_mib and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Takes effect at the next VM start.
-                         * @default fixed
+                         * @description Memory allocation (contracts §32): fixed boots memory_mib and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Omitted: fixed, or elastic where that is the organization’s default (a reopen then keeps the stored mode). Takes effect at the next VM start.
                          * @enum {string}
                          */
                         allocation_mode?: "fixed" | "elastic";
@@ -12873,7 +13749,7 @@ export interface operations {
                     project_id?: string;
                     /** @description Attribution label; one agent session per (workspace, principal, label). */
                     agent_label?: string;
-                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                     /** @description Secret names bound to the workspace (max 50, unique): injected as environment variables into every exec and PTY start (terminal sessions included), together with the call’s own `secret_refs`. Each must name a live secret this workspace may use (its project, its id, and allowed_tools including exec and pty), else 422 details.reason secret_not_available with details.names. */
                     secrets?: string[];
                     /** @description Open-time inputs of the template version (contracts §24.3): {NAME: string} for its declared text inputs. A new workspace stores each given value, else the declared default; on an existing key `inputs` replaces them all (omitted = unchanged). Secret inputs are not passed here: they bind the stored secret of the same name. 422 input_unknown (undeclared name, details.names), input_invalid (a secret input, a non-string, or a value over 4096 bytes or with CR, LF or NUL; details.names), input_required (details {names, kind}). */
@@ -12884,6 +13760,8 @@ export interface operations {
                     /** @description adaptive (the learned timeout, default), never, or fixed:<seconds> (60..604800). Contracts §20.7. */
                     idle_policy?: string;
                     mode?: components["schemas"]["WorkspaceMode"];
+                    /** @description Contracts §45.1: the workspace’s computer use switch (null follows the template); set on create, replaced on an existing key when given. */
+                    computer_use?: boolean | null;
                 };
             };
         };
@@ -12899,6 +13777,8 @@ export interface operations {
                         operation: components["schemas"]["Operation"] | null;
                         cell_endpoint: string | null;
                         tool_token: components["schemas"]["ToolToken"] | null;
+                        /** @description Contracts §46.2: true when this request created the workspace (a new key, or a key whose session ended), false when it reconnected to or resumed an existing one. Of concurrent opens of one new key exactly one says true; a replay with the same Idempotency-Key repeats it. */
+                        created: boolean;
                     };
                 };
             };
@@ -12913,6 +13793,8 @@ export interface operations {
                         operation: components["schemas"]["Operation"] | null;
                         cell_endpoint: string | null;
                         tool_token: components["schemas"]["ToolToken"] | null;
+                        /** @description Contracts §46.2: true when this request created the workspace (a new key, or a key whose session ended), false when it reconnected to or resumed an existing one. Of concurrent opens of one new key exactly one says true; a replay with the same Idempotency-Key repeats it. */
+                        created: boolean;
                     };
                 };
             };
@@ -13278,121 +14160,7 @@ export interface operations {
             };
         };
     };
-    postApiV1WorkspacesWorkspaceIdSuspend: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                /** @description UUIDv7, lowercase canonical form. */
-                workspace_id: string;
-            };
-            cookie?: never;
-        };
-        requestBody?: never;
-        responses: {
-            /** @description Default Response */
-            202: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": {
-                        operation: components["schemas"]["Operation"];
-                        workspace: components["schemas"]["Workspace"];
-                    };
-                };
-            };
-            /** @description Default Response */
-            "4XX": {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorBody"];
-                };
-            };
-            /** @description Default Response */
-            "5XX": {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorBody"];
-                };
-            };
-        };
-    };
-    postApiV1WorkspacesWorkspaceIdResume: {
-        parameters: {
-            query?: never;
-            header?: {
-                /** @description RFC 7240 preference, e.g. `wait=20` (held resume). */
-                prefer?: string;
-            };
-            path: {
-                /** @description UUIDv7, lowercase canonical form. */
-                workspace_id: string;
-            };
-            cookie?: never;
-        };
-        /** @description The tool token a held resume returns (as for open): agent label and tools (default all the principal may use). */
-        requestBody?: {
-            content: {
-                "application/json": {
-                    /** @description Attribution label; one agent session per (workspace, principal, label). */
-                    agent_label?: string;
-                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
-                };
-            };
-        };
-        responses: {
-            /** @description Held resume (`Prefer: wait`) that ended with the workspace running: the view, the succeeded resume (or the joined open/resume; null when the workspace was already running) and a tool token for the requested tools (null when one could not be issued: request it from POST …/tool-tokens). */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": {
-                        workspace: components["schemas"]["Workspace"];
-                        operation: components["schemas"]["Operation"] | null;
-                        cell_endpoint: string | null;
-                        tool_token: components["schemas"]["ToolToken"] | null;
-                    };
-                };
-            };
-            /** @description Default Response */
-            202: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": {
-                        operation: components["schemas"]["Operation"];
-                        workspace: components["schemas"]["Workspace"];
-                    };
-                };
-            };
-            /** @description Default Response */
-            "4XX": {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorBody"];
-                };
-            };
-            /** @description Default Response */
-            "5XX": {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorBody"];
-                };
-            };
-        };
-    };
-    postApiV1WorkspacesWorkspaceIdSnapshot: {
+    putApiV1WorkspacesWorkspaceIdComputerUse: {
         parameters: {
             query?: never;
             header?: never;
@@ -13405,21 +14173,243 @@ export interface operations {
         requestBody: {
             content: {
                 "application/json": {
-                    label?: string;
+                    /** @description true or false overrides the template; null follows it. */
+                    enabled: boolean | null;
                 };
             };
         };
         responses: {
             /** @description Default Response */
-            202: {
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": {
-                        operation: components["schemas"]["Operation"];
-                        workspace: components["schemas"]["Workspace"];
-                    };
+                    "application/json": components["schemas"]["ComputerUse"];
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    postApiV1WorkspacesWorkspaceIdSuspend: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        operation: components["schemas"]["Operation"];
+                        workspace: components["schemas"]["Workspace"];
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    postApiV1WorkspacesWorkspaceIdResume: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description RFC 7240 preference, e.g. `wait=20` (held resume). */
+                prefer?: string;
+            };
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        /** @description The tool token a held resume returns (as for open): agent label and tools (default all the principal may use). */
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /** @description Attribution label; one agent session per (workspace, principal, label). */
+                    agent_label?: string;
+                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
+                };
+            };
+        };
+        responses: {
+            /** @description Held resume (`Prefer: wait`) that ended with the workspace running: the view, the succeeded resume (or the joined open/resume; null when the workspace was already running) and a tool token for the requested tools (null when one could not be issued: request it from POST …/tool-tokens). */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        workspace: components["schemas"]["Workspace"];
+                        operation: components["schemas"]["Operation"] | null;
+                        cell_endpoint: string | null;
+                        tool_token: components["schemas"]["ToolToken"] | null;
+                    };
+                };
+            };
+            /** @description Default Response */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        operation: components["schemas"]["Operation"];
+                        workspace: components["schemas"]["Workspace"];
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    postApiV1WorkspacesWorkspaceIdSnapshot: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    label?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        operation: components["schemas"]["Operation"];
+                        workspace: components["schemas"]["Workspace"];
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    patchApiV1WorkspacesWorkspaceIdCaps: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description RFC 7240 preference, e.g. `wait=30` (at most 55; default 20). */
+                prefer?: string;
+            };
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["ResizeWorkspaceBody"];
+            };
+        };
+        responses: {
+            /** @description Per resource the request named (allocation_mode and memory_mib_held report under memory): what applied now and what applies later. caps: the workspace caps every later start uses. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ResizeResult"];
+                };
+            };
+            /** @description Default Response */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        operation: components["schemas"]["Operation"];
+                        workspace: components["schemas"]["Workspace"];
+                    };
                 };
             };
             /** @description Default Response */
@@ -13552,14 +14542,13 @@ export interface operations {
                 "application/json": {
                     /** @description Stable workspace key, unique per organization (e.g. `${customerId}/${projectId}`). */
                     key: string;
-                    /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction (allocation_mode: fixed). Given caps replace the stored ones. */
+                    /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction. Given caps replace the stored ones (a reopen keeps an elastic workspace’s mode when elastic is the organization’s default and allocation_mode is omitted). */
                     caps?: {
                         cpu_millis?: number;
                         memory_mib?: number;
                         disk_gib?: number;
                         /**
-                         * @description Memory allocation (contracts §32): fixed (default) boots memory_mib and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Takes effect at the next VM start.
-                         * @default fixed
+                         * @description Memory allocation (contracts §32): fixed boots memory_mib and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Omitted: fixed, or elastic where that is the organization’s default (a reopen then keeps the stored mode). Takes effect at the next VM start.
                          * @enum {string}
                          */
                         allocation_mode?: "fixed" | "elastic";
@@ -13569,7 +14558,7 @@ export interface operations {
                     lifetime?: components["schemas"]["WorkspaceLifetime"];
                     /** @description Attribution label; one agent session per (workspace, principal, label). */
                     agent_label?: string;
-                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                 };
             };
         };
@@ -13877,7 +14866,7 @@ export interface operations {
                 "application/json": {
                     /** @description Attribution label; one agent session per (workspace, principal, label). */
                     agent_label?: string;
-                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                 };
             };
         };
@@ -14024,8 +15013,11 @@ export interface operations {
                          * @description UUIDv7, lowercase canonical form.
                          */
                         workspace_id: string;
-                        /** @enum {string} */
-                        tool: "exec" | "files" | "pty" | "process" | "git" | "browser";
+                        /**
+                         * @description computer (contracts §45): the workspace desktop; a tool token carries it only while the workspace’s computer use is on.
+                         * @enum {string}
+                         */
+                        tool: "exec" | "files" | "pty" | "process" | "git" | "browser" | "computer";
                         /**
                          * Format: uuid
                          * @description UUIDv7, lowercase canonical form.
@@ -14130,34 +15122,36 @@ export interface operations {
             };
         };
     };
-    getV1ProjectsProjectIdVolumes: {
+    putV1WorkspacesWorkspaceIdPortsPort: {
         parameters: {
-            query?: {
-                limit?: number;
-                cursor?: string;
-                /** @description Also list org-shared volumes owned by other projects of the organization (attachable here). */
-                include_org_shared?: boolean;
-                include_deleted?: boolean;
-            };
+            query?: never;
             header?: never;
             path: {
                 /** @description UUIDv7, lowercase canonical form. */
-                project_id: string;
+                workspace_id: string;
+                /** @description TCP port inside the workspace (1-65535). */
+                port: number;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Default Response */
+            /** @description An exposed port of a workspace (contracts §39.3). Private: every request needs a credential. */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": {
-                        data: components["schemas"]["Volume"][];
-                        next_cursor: string | null;
-                    };
+                    "application/json": components["schemas"]["Port"];
+                };
+            };
+            /** @description An exposed port of a workspace (contracts §39.3). Private: every request needs a credential. */
+            201: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Port"];
                 };
             };
             /** @description Default Response */
@@ -14180,39 +15174,26 @@ export interface operations {
             };
         };
     };
-    postV1ProjectsProjectIdVolumes: {
+    deleteV1WorkspacesWorkspaceIdPortsPort: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 /** @description UUIDv7, lowercase canonical form. */
-                project_id: string;
+                workspace_id: string;
+                /** @description TCP port inside the workspace (1-65535). */
+                port: number;
             };
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": {
-                    /** @description Unique among the project’s live volumes. */
-                    name: string;
-                    quota_gib: number;
-                    /** @default false */
-                    org_shared?: boolean;
-                };
-            };
-        };
+        requestBody?: never;
         responses: {
-            /** @description Default Response */
-            202: {
+            /** @description No content. */
+            204: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content: {
-                    "application/json": {
-                        volume: components["schemas"]["Volume"];
-                        operation: components["schemas"]["Operation"];
-                    };
-                };
+                content?: never;
             };
             /** @description Default Response */
             "4XX": {
@@ -14234,15 +15215,13 @@ export interface operations {
             };
         };
     };
-    getV1ProjectsProjectIdVolumesVolumeId: {
+    getV1WorkspacesWorkspaceIdPorts: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 /** @description UUIDv7, lowercase canonical form. */
-                project_id: string;
-                /** @description UUIDv7, lowercase canonical form. */
-                volume_id: string;
+                workspace_id: string;
             };
             cookie?: never;
         };
@@ -14254,7 +15233,9 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["Volume"];
+                    "application/json": {
+                        ports: components["schemas"]["Port"][];
+                    };
                 };
             };
             /** @description Default Response */
@@ -14277,32 +15258,46 @@ export interface operations {
             };
         };
     };
-    deleteV1ProjectsProjectIdVolumesVolumeId: {
+    postV1WorkspacesWorkspaceIdPortsPortTokens: {
         parameters: {
-            query?: {
-                force?: boolean;
-                confirm_name?: string;
-            };
+            query?: never;
             header?: never;
             path: {
                 /** @description UUIDv7, lowercase canonical form. */
-                project_id: string;
-                /** @description UUIDv7, lowercase canonical form. */
-                volume_id: string;
+                workspace_id: string;
+                /** @description TCP port inside the workspace (1-65535). */
+                port: number;
             };
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description Lifetime in seconds (60-86400, default 3600).
+                     * @default 3600
+                     */
+                    ttl_seconds?: number;
+                };
+            };
+        };
         responses: {
             /** @description Default Response */
-            202: {
+            201: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        volume: components["schemas"]["Volume"];
-                        operation: components["schemas"]["Operation"];
+                        /** @description sfp_…: send as `Authorization: Bearer <token>` (or `X-Shardflux-Token`) to `url`. Revoked when the port is closed. */
+                        token: string;
+                        /**
+                         * Format: date-time
+                         * @description RFC 3339 UTC timestamp with Z.
+                         */
+                        expires_at: string;
+                        /** @description The port’s URL. */
+                        url: string;
                     };
                 };
             };
@@ -14326,33 +15321,46 @@ export interface operations {
             };
         };
     };
-    getV1ProjectsProjectIdVolumesVolumeIdAttachments: {
+    postV1WorkspacesWorkspaceIdPortsPortLinks: {
         parameters: {
-            query?: {
-                limit?: number;
-                cursor?: string;
-                include_detached?: boolean;
-            };
+            query?: never;
             header?: never;
             path: {
                 /** @description UUIDv7, lowercase canonical form. */
-                project_id: string;
-                /** @description UUIDv7, lowercase canonical form. */
-                volume_id: string;
+                workspace_id: string;
+                /** @description TCP port inside the workspace (1-65535). */
+                port: number;
             };
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description Lifetime of the link and of the browser session it starts (60-604800 s, default 86400).
+                     * @default 86400
+                     */
+                    ttl_seconds?: number;
+                    /** @description Where the link lands (default `/`): a path starting with one `/`, printable ASCII, query allowed. */
+                    path?: string;
+                };
+            };
+        };
         responses: {
             /** @description Default Response */
-            200: {
+            201: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        data: components["schemas"]["VolumeAttachment"][];
-                        next_cursor: string | null;
+                        /** @description Open in a browser: it sets a session cookie for the port’s host (until expires_at) and redirects to `path`. */
+                        url: string;
+                        /**
+                         * Format: date-time
+                         * @description RFC 3339 UTC timestamp with Z.
+                         */
+                        expires_at: string;
                     };
                 };
             };
@@ -14376,31 +15384,34 @@ export interface operations {
             };
         };
     };
-    getV1WorkspacesWorkspaceIdVolumes: {
+    postV1WorkspacesWorkspaceIdPortsPortCallback: {
         parameters: {
-            query?: {
-                limit?: number;
-                cursor?: string;
-                include_detached?: boolean;
-            };
+            query?: never;
             header?: never;
             path: {
                 /** @description UUIDv7, lowercase canonical form. */
                 workspace_id: string;
+                /** @description TCP port inside the workspace (1-65535). */
+                port: number;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
             /** @description Default Response */
-            200: {
+            201: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        data: components["schemas"]["VolumeAttachment"][];
-                        next_cursor: string | null;
+                        /** @description https://<port>-<handle>.<domain>/__shardflux/callback/sfcb_…/: append your own path. Shown once. */
+                        url: string;
+                        /**
+                         * Format: date-time
+                         * @description RFC 3339 UTC timestamp with Z.
+                         */
+                        created_at: string;
                     };
                 };
             };
@@ -14424,57 +15435,77 @@ export interface operations {
             };
         };
     };
-    postV1WorkspacesWorkspaceIdVolumes: {
+    deleteV1WorkspacesWorkspaceIdPortsPortCallback: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 /** @description UUIDv7, lowercase canonical form. */
                 workspace_id: string;
+                /** @description TCP port inside the workspace (1-65535). */
+                port: number;
             };
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": {
-                    /**
-                     * Format: uuid
-                     * @description UUIDv7, lowercase canonical form.
-                     */
-                    volume_id: string;
-                    /** @description Absolute guest path (e.g. /mnt/data); segments of A-Z a-z 0-9 . _ - not starting with "."; system directories (/etc, /usr, /proc, /tmp, /var, ...) and nesting with another mount are refused. */
-                    mount_path: string;
-                    /**
-                     * @default rw
-                     * @enum {string}
-                     */
-                    mode?: "ro" | "rw";
+        requestBody?: never;
+        responses: {
+            /** @description No content. */
+            204: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content?: never;
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
                 };
             };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    putApiV1WorkspacesWorkspaceIdPortsPort: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+                /** @description TCP port inside the workspace (1-65535). */
+                port: number;
+            };
+            cookie?: never;
         };
+        requestBody?: never;
         responses: {
-            /** @description operation is null only for an idempotent re-attach of an already attached volume (200). */
+            /** @description An exposed port of a workspace (contracts §39.3). Private: every request needs a credential. */
             200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": {
-                        attachment: components["schemas"]["VolumeAttachment"];
-                        operation: components["schemas"]["Operation"] | null;
-                    };
+                    "application/json": components["schemas"]["Port"];
                 };
             };
-            /** @description operation is null only for an idempotent re-attach of an already attached volume (200). */
-            202: {
+            /** @description An exposed port of a workspace (contracts §39.3). Private: every request needs a credential. */
+            201: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": {
-                        attachment: components["schemas"]["VolumeAttachment"];
-                        operation: components["schemas"]["Operation"] | null;
-                    };
+                    "application/json": components["schemas"]["Port"];
                 };
             };
             /** @description Default Response */
@@ -14497,31 +15528,26 @@ export interface operations {
             };
         };
     };
-    deleteV1WorkspacesWorkspaceIdVolumesVolumeId: {
+    deleteApiV1WorkspacesWorkspaceIdPortsPort: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 /** @description UUIDv7, lowercase canonical form. */
                 workspace_id: string;
-                /** @description UUIDv7, lowercase canonical form. */
-                volume_id: string;
+                /** @description TCP port inside the workspace (1-65535). */
+                port: number;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description operation is null only for an idempotent re-attach of an already attached volume (200). */
-            202: {
+            /** @description No content. */
+            204: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content: {
-                    "application/json": {
-                        attachment: components["schemas"]["VolumeAttachment"];
-                        operation: components["schemas"]["Operation"] | null;
-                    };
-                };
+                content?: never;
             };
             /** @description Default Response */
             "4XX": {
@@ -14543,19 +15569,13 @@ export interface operations {
             };
         };
     };
-    getApiV1ProjectsProjectIdVolumes: {
+    getApiV1WorkspacesWorkspaceIdPorts: {
         parameters: {
-            query?: {
-                limit?: number;
-                cursor?: string;
-                /** @description Also list org-shared volumes owned by other projects of the organization (attachable here). */
-                include_org_shared?: boolean;
-                include_deleted?: boolean;
-            };
+            query?: never;
             header?: never;
             path: {
                 /** @description UUIDv7, lowercase canonical form. */
-                project_id: string;
+                workspace_id: string;
             };
             cookie?: never;
         };
@@ -14568,8 +15588,7 @@ export interface operations {
                 };
                 content: {
                     "application/json": {
-                        data: components["schemas"]["Volume"][];
-                        next_cursor: string | null;
+                        ports: components["schemas"]["Port"][];
                     };
                 };
             };
@@ -14593,37 +15612,46 @@ export interface operations {
             };
         };
     };
-    postApiV1ProjectsProjectIdVolumes: {
+    postApiV1WorkspacesWorkspaceIdPortsPortTokens: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 /** @description UUIDv7, lowercase canonical form. */
-                project_id: string;
+                workspace_id: string;
+                /** @description TCP port inside the workspace (1-65535). */
+                port: number;
             };
             cookie?: never;
         };
-        requestBody: {
+        requestBody?: {
             content: {
                 "application/json": {
-                    /** @description Unique among the project’s live volumes. */
-                    name: string;
-                    quota_gib: number;
-                    /** @default false */
-                    org_shared?: boolean;
+                    /**
+                     * @description Lifetime in seconds (60-86400, default 3600).
+                     * @default 3600
+                     */
+                    ttl_seconds?: number;
                 };
             };
         };
         responses: {
             /** @description Default Response */
-            202: {
+            201: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        volume: components["schemas"]["Volume"];
-                        operation: components["schemas"]["Operation"];
+                        /** @description sfp_…: send as `Authorization: Bearer <token>` (or `X-Shardflux-Token`) to `url`. Revoked when the port is closed. */
+                        token: string;
+                        /**
+                         * Format: date-time
+                         * @description RFC 3339 UTC timestamp with Z.
+                         */
+                        expires_at: string;
+                        /** @description The port’s URL. */
+                        url: string;
                     };
                 };
             };
@@ -14647,27 +15675,47 @@ export interface operations {
             };
         };
     };
-    getApiV1ProjectsProjectIdVolumesVolumeId: {
+    postApiV1WorkspacesWorkspaceIdPortsPortLinks: {
         parameters: {
             query?: never;
             header?: never;
             path: {
                 /** @description UUIDv7, lowercase canonical form. */
-                project_id: string;
-                /** @description UUIDv7, lowercase canonical form. */
-                volume_id: string;
+                workspace_id: string;
+                /** @description TCP port inside the workspace (1-65535). */
+                port: number;
             };
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody?: {
+            content: {
+                "application/json": {
+                    /**
+                     * @description Lifetime of the link and of the browser session it starts (60-604800 s, default 86400).
+                     * @default 86400
+                     */
+                    ttl_seconds?: number;
+                    /** @description Where the link lands (default `/`): a path starting with one `/`, printable ASCII, query allowed. */
+                    path?: string;
+                };
+            };
+        };
         responses: {
             /** @description Default Response */
-            200: {
+            201: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["Volume"];
+                    "application/json": {
+                        /** @description Open in a browser: it sets a session cookie for the port’s host (until expires_at) and redirects to `path`. */
+                        url: string;
+                        /**
+                         * Format: date-time
+                         * @description RFC 3339 UTC timestamp with Z.
+                         */
+                        expires_at: string;
+                    };
                 };
             };
             /** @description Default Response */
@@ -14690,32 +15738,34 @@ export interface operations {
             };
         };
     };
-    deleteApiV1ProjectsProjectIdVolumesVolumeId: {
+    postApiV1WorkspacesWorkspaceIdPortsPortCallback: {
         parameters: {
-            query?: {
-                force?: boolean;
-                confirm_name?: string;
-            };
+            query?: never;
             header?: never;
             path: {
                 /** @description UUIDv7, lowercase canonical form. */
-                project_id: string;
-                /** @description UUIDv7, lowercase canonical form. */
-                volume_id: string;
+                workspace_id: string;
+                /** @description TCP port inside the workspace (1-65535). */
+                port: number;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
             /** @description Default Response */
-            202: {
+            201: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
                     "application/json": {
-                        volume: components["schemas"]["Volume"];
-                        operation: components["schemas"]["Operation"];
+                        /** @description https://<port>-<handle>.<domain>/__shardflux/callback/sfcb_…/: append your own path. Shown once. */
+                        url: string;
+                        /**
+                         * Format: date-time
+                         * @description RFC 3339 UTC timestamp with Z.
+                         */
+                        created_at: string;
                     };
                 };
             };
@@ -14739,35 +15789,771 @@ export interface operations {
             };
         };
     };
-    getApiV1ProjectsProjectIdVolumesVolumeIdAttachments: {
+    deleteApiV1WorkspacesWorkspaceIdPortsPortCallback: {
         parameters: {
-            query?: {
-                limit?: number;
-                cursor?: string;
-                include_detached?: boolean;
-            };
+            query?: never;
             header?: never;
             path: {
                 /** @description UUIDv7, lowercase canonical form. */
-                project_id: string;
-                /** @description UUIDv7, lowercase canonical form. */
-                volume_id: string;
+                workspace_id: string;
+                /** @description TCP port inside the workspace (1-65535). */
+                port: number;
             };
             cookie?: never;
         };
         requestBody?: never;
         responses: {
-            /** @description Default Response */
-            200: {
+            /** @description No content. */
+            204: {
                 headers: {
                     [name: string]: unknown;
                 };
-                content: {
-                    "application/json": {
-                        data: components["schemas"]["VolumeAttachment"][];
-                        next_cursor: string | null;
-                    };
-                };
+                content?: never;
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    postV1InternalPortWakes: {
+        parameters: {
+            query?: never;
+            header?: {
+                /** @description RFC 7240 preference, e.g. `wait=20` (held wake). */
+                prefer?: string;
+            };
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * Format: uuid
+                     * @description UUIDv7, lowercase canonical form.
+                     */
+                    workspace_id: string;
+                    /** @description TCP port inside the workspace (1-65535). */
+                    port: number;
+                    /** @description The callback URL’s secret (`sfcb_…`) when the request came in on the callback path; omit when Authorization carries a port token. */
+                    callback_secret?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description 200: running (operation null: it already was) or the resume succeeded during the hold. 202: the resume/open to wait for. */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        workspace: {
+                            /**
+                             * Format: uuid
+                             * @description UUIDv7, lowercase canonical form.
+                             */
+                            id: string;
+                            observed_state: string;
+                            ownership_epoch: number;
+                        };
+                        operation: components["schemas"]["Operation"] | null;
+                    };
+                };
+            };
+            /** @description 200: running (operation null: it already was) or the resume succeeded during the hold. 202: the resume/open to wait for. */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        workspace: {
+                            /**
+                             * Format: uuid
+                             * @description UUIDv7, lowercase canonical form.
+                             */
+                            id: string;
+                            observed_state: string;
+                            ownership_epoch: number;
+                        };
+                        operation: components["schemas"]["Operation"] | null;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    getV1ProjectsProjectIdVolumes: {
+        parameters: {
+            query?: {
+                limit?: number;
+                cursor?: string;
+                /** @description Also list org-shared volumes owned by other projects of the organization (attachable here). */
+                include_org_shared?: boolean;
+                include_deleted?: boolean;
+            };
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                project_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["Volume"][];
+                        next_cursor: string | null;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    postV1ProjectsProjectIdVolumes: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                project_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Unique among the project’s live volumes. */
+                    name: string;
+                    quota_gib: number;
+                    /** @default false */
+                    org_shared?: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        volume: components["schemas"]["Volume"];
+                        operation: components["schemas"]["Operation"];
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    getV1ProjectsProjectIdVolumesVolumeId: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                project_id: string;
+                /** @description UUIDv7, lowercase canonical form. */
+                volume_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Volume"];
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    deleteV1ProjectsProjectIdVolumesVolumeId: {
+        parameters: {
+            query?: {
+                force?: boolean;
+                confirm_name?: string;
+            };
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                project_id: string;
+                /** @description UUIDv7, lowercase canonical form. */
+                volume_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        volume: components["schemas"]["Volume"];
+                        operation: components["schemas"]["Operation"];
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    getV1ProjectsProjectIdVolumesVolumeIdAttachments: {
+        parameters: {
+            query?: {
+                limit?: number;
+                cursor?: string;
+                include_detached?: boolean;
+            };
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                project_id: string;
+                /** @description UUIDv7, lowercase canonical form. */
+                volume_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["VolumeAttachment"][];
+                        next_cursor: string | null;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    getV1WorkspacesWorkspaceIdVolumes: {
+        parameters: {
+            query?: {
+                limit?: number;
+                cursor?: string;
+                include_detached?: boolean;
+            };
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["VolumeAttachment"][];
+                        next_cursor: string | null;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    postV1WorkspacesWorkspaceIdVolumes: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /**
+                     * Format: uuid
+                     * @description UUIDv7, lowercase canonical form.
+                     */
+                    volume_id: string;
+                    /** @description Absolute guest path (e.g. /mnt/data); segments of A-Z a-z 0-9 . _ - not starting with "."; system directories (/etc, /usr, /proc, /tmp, /var, ...) and nesting with another mount are refused. */
+                    mount_path: string;
+                    /**
+                     * @default rw
+                     * @enum {string}
+                     */
+                    mode?: "ro" | "rw";
+                };
+            };
+        };
+        responses: {
+            /** @description operation is null only for an idempotent re-attach of an already attached volume (200). */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        attachment: components["schemas"]["VolumeAttachment"];
+                        operation: components["schemas"]["Operation"] | null;
+                    };
+                };
+            };
+            /** @description operation is null only for an idempotent re-attach of an already attached volume (200). */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        attachment: components["schemas"]["VolumeAttachment"];
+                        operation: components["schemas"]["Operation"] | null;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    deleteV1WorkspacesWorkspaceIdVolumesVolumeId: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+                /** @description UUIDv7, lowercase canonical form. */
+                volume_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description operation is null only for an idempotent re-attach of an already attached volume (200). */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        attachment: components["schemas"]["VolumeAttachment"];
+                        operation: components["schemas"]["Operation"] | null;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    getApiV1ProjectsProjectIdVolumes: {
+        parameters: {
+            query?: {
+                limit?: number;
+                cursor?: string;
+                /** @description Also list org-shared volumes owned by other projects of the organization (attachable here). */
+                include_org_shared?: boolean;
+                include_deleted?: boolean;
+            };
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                project_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["Volume"][];
+                        next_cursor: string | null;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    postApiV1ProjectsProjectIdVolumes: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                project_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Unique among the project’s live volumes. */
+                    name: string;
+                    quota_gib: number;
+                    /** @default false */
+                    org_shared?: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        volume: components["schemas"]["Volume"];
+                        operation: components["schemas"]["Operation"];
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    getApiV1ProjectsProjectIdVolumesVolumeId: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                project_id: string;
+                /** @description UUIDv7, lowercase canonical form. */
+                volume_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Volume"];
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    deleteApiV1ProjectsProjectIdVolumesVolumeId: {
+        parameters: {
+            query?: {
+                force?: boolean;
+                confirm_name?: string;
+            };
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                project_id: string;
+                /** @description UUIDv7, lowercase canonical form. */
+                volume_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        volume: components["schemas"]["Volume"];
+                        operation: components["schemas"]["Operation"];
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    getApiV1ProjectsProjectIdVolumesVolumeIdAttachments: {
+        parameters: {
+            query?: {
+                limit?: number;
+                cursor?: string;
+                include_detached?: boolean;
+            };
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                project_id: string;
+                /** @description UUIDv7, lowercase canonical form. */
+                volume_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        data: components["schemas"]["VolumeAttachment"][];
+                        next_cursor: string | null;
+                    };
+                };
             };
             /** @description Default Response */
             "4XX": {
@@ -15005,6 +16791,8 @@ export interface operations {
                                 memory_mib: number | null;
                                 idle_policy: string | null;
                             };
+                            /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                            computer_use: boolean;
                             open_version: {
                                 /**
                                  * Format: uuid
@@ -15222,6 +17010,8 @@ export interface operations {
                             memory_mib: number | null;
                             idle_policy: string | null;
                         };
+                        /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                        computer_use: boolean;
                         open_version: {
                             /**
                              * Format: uuid
@@ -15570,6 +17360,8 @@ export interface operations {
                                 memory_mib: number | null;
                                 idle_policy: string | null;
                             };
+                            /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                            computer_use: boolean;
                             open_version: {
                                 /**
                                  * Format: uuid
@@ -15785,6 +17577,8 @@ export interface operations {
                             memory_mib: number | null;
                             idle_policy: string | null;
                         };
+                        /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                        computer_use: boolean;
                         open_version: {
                             /**
                              * Format: uuid
@@ -16087,6 +17881,104 @@ export interface operations {
             };
         };
     };
+    putV1OrganizationsOrganizationIdTemplatesSlugComputerUse: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                organization_id: string;
+                slug: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    enabled: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        enabled: boolean;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    putV1TemplatesSlugComputerUse: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                slug: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    enabled: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        enabled: boolean;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
     getV1OrganizationsOrganizationIdTemplateBuilds: {
         parameters: {
             query?: {
@@ -18170,6 +20062,8 @@ export interface operations {
                             memory_mib: number | null;
                             idle_policy: string | null;
                         };
+                        /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                        computer_use: boolean;
                         open_version: {
                             /**
                              * Format: uuid
@@ -18516,6 +20410,8 @@ export interface operations {
                             memory_mib: number | null;
                             idle_policy: string | null;
                         };
+                        /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                        computer_use: boolean;
                         open_version: {
                             /**
                              * Format: uuid
@@ -18867,6 +20763,8 @@ export interface operations {
                                 memory_mib: number | null;
                                 idle_policy: string | null;
                             };
+                            /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                            computer_use: boolean;
                             open_version: {
                                 /**
                                  * Format: uuid
@@ -19084,6 +20982,8 @@ export interface operations {
                             memory_mib: number | null;
                             idle_policy: string | null;
                         };
+                        /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                        computer_use: boolean;
                         open_version: {
                             /**
                              * Format: uuid
@@ -19386,6 +21286,56 @@ export interface operations {
             };
         };
     };
+    putApiV1OrganizationsOrganizationIdTemplatesSlugComputerUse: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                organization_id: string;
+                slug: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    enabled: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        enabled: boolean;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
     getApiV1OrganizationsOrganizationIdTemplateBuilds: {
         parameters: {
             query?: {
@@ -21289,6 +23239,8 @@ export interface operations {
                             memory_mib: number | null;
                             idle_policy: string | null;
                         };
+                        /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                        computer_use: boolean;
                         open_version: {
                             /**
                              * Format: uuid
@@ -21635,6 +23587,8 @@ export interface operations {
                             memory_mib: number | null;
                             idle_policy: string | null;
                         };
+                        /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                        computer_use: boolean;
                         open_version: {
                             /**
                              * Format: uuid
@@ -24767,8 +26721,11 @@ export interface operations {
                                  */
                                 id: string;
                             };
-                            /** @enum {string} */
-                            tool: "exec" | "files" | "pty" | "process" | "git" | "browser";
+                            /**
+                             * @description computer (contracts §45): the workspace desktop; a tool token carries it only while the workspace’s computer use is on.
+                             * @enum {string}
+                             */
+                            tool: "exec" | "files" | "pty" | "process" | "git" | "browser" | "computer";
                             outcome: "granted" | "denied" | "failed";
                             reason: string | null;
                             ownership_epoch: number | null;
@@ -24819,8 +26776,11 @@ export interface operations {
                      * @description UUIDv7, lowercase canonical form.
                      */
                     workspace_id: string;
-                    /** @enum {string} */
-                    tool: "exec" | "files" | "pty" | "process" | "git" | "browser";
+                    /**
+                     * @description computer (contracts §45): the workspace desktop; a tool token carries it only while the workspace’s computer use is on.
+                     * @enum {string}
+                     */
+                    tool: "exec" | "files" | "pty" | "process" | "git" | "browser" | "computer";
                     /** @description The start’s `secret_refs` together with the workspace’s bound names (app.workspace_secret_bindings), each name once: at most 50 + 50. */
                     names: string[];
                     /** @description The cell’s exec/PTY session id, recorded for correlation. */
@@ -24841,8 +26801,11 @@ export interface operations {
                          * @description UUIDv7, lowercase canonical form.
                          */
                         workspace_id: string;
-                        /** @enum {string} */
-                        tool: "exec" | "files" | "pty" | "process" | "git" | "browser";
+                        /**
+                         * @description computer (contracts §45): the workspace desktop; a tool token carries it only while the workspace’s computer use is on.
+                         * @enum {string}
+                         */
+                        tool: "exec" | "files" | "pty" | "process" | "git" | "browser" | "computer";
                         /**
                          * Format: uuid
                          * @description UUIDv7, lowercase canonical form.
@@ -25855,8 +27818,11 @@ export interface operations {
                                  */
                                 id: string;
                             };
-                            /** @enum {string} */
-                            tool: "exec" | "files" | "pty" | "process" | "git" | "browser";
+                            /**
+                             * @description computer (contracts §45): the workspace desktop; a tool token carries it only while the workspace’s computer use is on.
+                             * @enum {string}
+                             */
+                            tool: "exec" | "files" | "pty" | "process" | "git" | "browser" | "computer";
                             outcome: "granted" | "denied" | "failed";
                             reason: string | null;
                             ownership_epoch: number | null;
@@ -35363,6 +37329,18 @@ export interface operations {
                                 disk_gib: number;
                             }[];
                             heartbeat_stale_after_seconds: number;
+                            /** @description Contracts §42.5: what draining this host costs in memory (cell.hosts.drain_runtime_impact). */
+                            runtime_impact?: {
+                                /** @description known: recorded by the cell’s capacity tick within 15 minutes; unknown: not recorded; stale: older (both reported, neither blocks). */
+                                status: "known" | "unknown" | "stale";
+                                memory_lost: number | null;
+                                waits: number | null;
+                                /** @description Affected snapshot compatibility keys with counts and their outlook without this host (largest first, at most 20). */
+                                keys: {
+                                    [key: string]: unknown;
+                                }[];
+                                computed_at: string | null;
+                            };
                             host: {
                                 /**
                                  * Format: uuid
@@ -35554,6 +37532,18 @@ export interface operations {
                                     disk_gib: number;
                                 }[];
                                 heartbeat_stale_after_seconds: number;
+                                /** @description Contracts §42.5: what draining this host costs in memory (cell.hosts.drain_runtime_impact). */
+                                runtime_impact?: {
+                                    /** @description known: recorded by the cell’s capacity tick within 15 minutes; unknown: not recorded; stale: older (both reported, neither blocks). */
+                                    status: "known" | "unknown" | "stale";
+                                    memory_lost: number | null;
+                                    waits: number | null;
+                                    /** @description Affected snapshot compatibility keys with counts and their outlook without this host (largest first, at most 20). */
+                                    keys: {
+                                        [key: string]: unknown;
+                                    }[];
+                                    computed_at: string | null;
+                                };
                                 host: {
                                     /**
                                      * Format: uuid
@@ -35742,199 +37732,223 @@ export interface operations {
                                 disk_gib: number;
                             }[];
                             heartbeat_stale_after_seconds: number;
-                            host: {
-                                /**
-                                 * Format: uuid
-                                 * @description UUIDv7, lowercase canonical form.
-                                 */
-                                id: string;
-                                cell_id: string;
-                                pool: string;
-                                state: string;
-                                instance_id: string;
-                            };
-                            /**
-                             * Format: date-time
-                             * @description RFC 3339 UTC timestamp with Z.
-                             */
-                            computed_at: string;
-                        };
-                        /**
-                         * Format: uuid
-                         * @description UUIDv7, lowercase canonical form.
-                         */
-                        requested_by: string;
-                        request_id: string | null;
-                        claimed_by: string | null;
-                        claim_expires_at: string | null;
-                        attempt: number;
-                        cell_drain_id: string | null;
-                        result: {
-                            [key: string]: unknown;
-                        } | null;
-                        canceled_by: string | null;
-                        cancel_reason: string | null;
-                        /**
-                         * Format: date-time
-                         * @description RFC 3339 UTC timestamp with Z.
-                         */
-                        created_at: string;
-                        /**
-                         * Format: date-time
-                         * @description RFC 3339 UTC timestamp with Z.
-                         */
-                        updated_at: string;
-                        accepted_at: string | null;
-                        completed_at: string | null;
-                    };
-                };
-            };
-            /** @description Default Response */
-            "4XX": {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorBody"];
-                };
-            };
-            /** @description Default Response */
-            "5XX": {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["ErrorBody"];
-                };
-            };
-        };
-    };
-    postApiV1OperatorDrainRequestsIdCancel: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path: {
-                /** @description UUIDv7, lowercase canonical form. */
-                id: string;
-            };
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": {
-                    /** @description Why (audited). */
-                    reason: string;
-                };
-            };
-        };
-        responses: {
-            /** @description Default Response */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": {
-                        /**
-                         * Format: uuid
-                         * @description UUIDv7, lowercase canonical form.
-                         */
-                        id: string;
-                        cell_id: string;
-                        /**
-                         * Format: uuid
-                         * @description UUIDv7, lowercase canonical form.
-                         */
-                        host_id: string;
-                        pool: string;
-                        instance_id: string | null;
-                        host_state_at_request: string;
-                        state: "requested" | "accepted" | "draining" | "completed" | "refused" | "canceled" | "aborted";
-                        state_reason: string | null;
-                        reason: string;
-                        safety: {
-                            safe: boolean;
-                            reasons: string[];
-                            required: {
-                                cpu_millis: number;
-                                memory_mib: number;
-                                disk_gib: number;
-                                allocations: number;
-                            };
-                            /** @description Suspended/deleted workspaces’ host disks: evacuated to durable checkpoints by the cell drain, not re-placed. */
-                            storage_only: {
-                                allocations: number;
-                                disk_gib: number;
-                            };
-                            available: {
-                                cpu_millis: number;
-                                memory_mib: number;
-                                disk_gib: number;
-                                hosts: number;
-                            };
-                            shortfall: {
-                                cpu_millis: number;
-                                memory_mib: number;
-                                disk_gib: number;
+                            /** @description Contracts §42.5: what draining this host costs in memory (cell.hosts.drain_runtime_impact). */
+                            runtime_impact?: {
+                                /** @description known: recorded by the cell’s capacity tick within 15 minutes; unknown: not recorded; stale: older (both reported, neither blocks). */
+                                status: "known" | "unknown" | "stale";
+                                memory_lost: number | null;
+                                waits: number | null;
+                                /** @description Affected snapshot compatibility keys with counts and their outlook without this host (largest first, at most 20). */
+                                keys: {
+                                    [key: string]: unknown;
+                                }[];
+                                computed_at: string | null;
+                            };
+                            host: {
+                                /**
+                                 * Format: uuid
+                                 * @description UUIDv7, lowercase canonical form.
+                                 */
+                                id: string;
+                                cell_id: string;
+                                pool: string;
+                                state: string;
+                                instance_id: string;
+                            };
+                            /**
+                             * Format: date-time
+                             * @description RFC 3339 UTC timestamp with Z.
+                             */
+                            computed_at: string;
+                        };
+                        /**
+                         * Format: uuid
+                         * @description UUIDv7, lowercase canonical form.
+                         */
+                        requested_by: string;
+                        request_id: string | null;
+                        claimed_by: string | null;
+                        claim_expires_at: string | null;
+                        attempt: number;
+                        cell_drain_id: string | null;
+                        result: {
+                            [key: string]: unknown;
+                        } | null;
+                        canceled_by: string | null;
+                        cancel_reason: string | null;
+                        /**
+                         * Format: date-time
+                         * @description RFC 3339 UTC timestamp with Z.
+                         */
+                        created_at: string;
+                        /**
+                         * Format: date-time
+                         * @description RFC 3339 UTC timestamp with Z.
+                         */
+                        updated_at: string;
+                        accepted_at: string | null;
+                        completed_at: string | null;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    postApiV1OperatorDrainRequestsIdCancel: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Why (audited). */
+                    reason: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * Format: uuid
+                         * @description UUIDv7, lowercase canonical form.
+                         */
+                        id: string;
+                        cell_id: string;
+                        /**
+                         * Format: uuid
+                         * @description UUIDv7, lowercase canonical form.
+                         */
+                        host_id: string;
+                        pool: string;
+                        instance_id: string | null;
+                        host_state_at_request: string;
+                        state: "requested" | "accepted" | "draining" | "completed" | "refused" | "canceled" | "aborted";
+                        state_reason: string | null;
+                        reason: string;
+                        safety: {
+                            safe: boolean;
+                            reasons: string[];
+                            required: {
+                                cpu_millis: number;
+                                memory_mib: number;
+                                disk_gib: number;
+                                allocations: number;
+                            };
+                            /** @description Suspended/deleted workspaces’ host disks: evacuated to durable checkpoints by the cell drain, not re-placed. */
+                            storage_only: {
+                                allocations: number;
+                                disk_gib: number;
+                            };
+                            available: {
+                                cpu_millis: number;
+                                memory_mib: number;
+                                disk_gib: number;
+                                hosts: number;
+                            };
+                            shortfall: {
+                                cpu_millis: number;
+                                memory_mib: number;
+                                disk_gib: number;
+                            };
+                            targets: {
+                                /**
+                                 * Format: uuid
+                                 * @description UUIDv7, lowercase canonical form.
+                                 */
+                                host_id: string;
+                                instance_id: string;
+                                free: {
+                                    cpu_millis: number;
+                                    memory_mib: number;
+                                    disk_gib: number;
+                                };
+                                memory_free_allocatable_mib: number;
+                                memory_free_commit_limit_mib: number | null;
+                            }[];
+                            excluded_hosts: {
+                                /**
+                                 * Format: uuid
+                                 * @description UUIDv7, lowercase canonical form.
+                                 */
+                                host_id: string;
+                                state: string;
+                                /** @description not_ready | drain_requested | heartbeat_stale | no_live_incarnation */
+                                reason: string;
+                            }[];
+                            placement: {
+                                /**
+                                 * Format: uuid
+                                 * @description UUIDv7, lowercase canonical form.
+                                 */
+                                allocation_id: string;
+                                /**
+                                 * Format: uuid
+                                 * @description UUIDv7, lowercase canonical form.
+                                 */
+                                workspace_id: string;
+                                /**
+                                 * Format: uuid
+                                 * @description UUIDv7, lowercase canonical form.
+                                 */
+                                host_id: string;
+                            }[];
+                            unplaceable: {
+                                /**
+                                 * Format: uuid
+                                 * @description UUIDv7, lowercase canonical form.
+                                 */
+                                allocation_id: string;
+                                /**
+                                 * Format: uuid
+                                 * @description UUIDv7, lowercase canonical form.
+                                 */
+                                workspace_id: string;
+                                cpu_millis: number;
+                                memory_mib: number;
+                                disk_gib: number;
+                            }[];
+                            heartbeat_stale_after_seconds: number;
+                            /** @description Contracts §42.5: what draining this host costs in memory (cell.hosts.drain_runtime_impact). */
+                            runtime_impact?: {
+                                /** @description known: recorded by the cell’s capacity tick within 15 minutes; unknown: not recorded; stale: older (both reported, neither blocks). */
+                                status: "known" | "unknown" | "stale";
+                                memory_lost: number | null;
+                                waits: number | null;
+                                /** @description Affected snapshot compatibility keys with counts and their outlook without this host (largest first, at most 20). */
+                                keys: {
+                                    [key: string]: unknown;
+                                }[];
+                                computed_at: string | null;
                             };
-                            targets: {
-                                /**
-                                 * Format: uuid
-                                 * @description UUIDv7, lowercase canonical form.
-                                 */
-                                host_id: string;
-                                instance_id: string;
-                                free: {
-                                    cpu_millis: number;
-                                    memory_mib: number;
-                                    disk_gib: number;
-                                };
-                                memory_free_allocatable_mib: number;
-                                memory_free_commit_limit_mib: number | null;
-                            }[];
-                            excluded_hosts: {
-                                /**
-                                 * Format: uuid
-                                 * @description UUIDv7, lowercase canonical form.
-                                 */
-                                host_id: string;
-                                state: string;
-                                /** @description not_ready | drain_requested | heartbeat_stale | no_live_incarnation */
-                                reason: string;
-                            }[];
-                            placement: {
-                                /**
-                                 * Format: uuid
-                                 * @description UUIDv7, lowercase canonical form.
-                                 */
-                                allocation_id: string;
-                                /**
-                                 * Format: uuid
-                                 * @description UUIDv7, lowercase canonical form.
-                                 */
-                                workspace_id: string;
-                                /**
-                                 * Format: uuid
-                                 * @description UUIDv7, lowercase canonical form.
-                                 */
-                                host_id: string;
-                            }[];
-                            unplaceable: {
-                                /**
-                                 * Format: uuid
-                                 * @description UUIDv7, lowercase canonical form.
-                                 */
-                                allocation_id: string;
-                                /**
-                                 * Format: uuid
-                                 * @description UUIDv7, lowercase canonical form.
-                                 */
-                                workspace_id: string;
-                                cpu_millis: number;
-                                memory_mib: number;
-                                disk_gib: number;
-                            }[];
-                            heartbeat_stale_after_seconds: number;
                             host: {
                                 /**
                                  * Format: uuid
@@ -37085,4 +39099,99 @@ export interface operations {
             };
         };
     };
+    getApiV1OauthAuthorization: {
+        parameters: {
+            query: {
+                /** @description The `request` parameter of /connect: the pending authorization request /oauth/authorize stored. */
+                request: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["OAuthConsentView"];
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    postApiV1OauthAuthorization: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description The `request` parameter of /connect: the pending authorization request /oauth/authorize stored. */
+                    request: string;
+                    decision: "approve" | "deny";
+                    /**
+                     * Format: uuid
+                     * @description UUIDv7, lowercase canonical form.
+                     */
+                    project_id?: string;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /** @description Send the browser here (the client’s redirect_uri with code or error, state and iss). */
+                        redirect_to: string;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
 }