@shardflux/sdk 0.14.0 → 0.15.0

package/dist/generated/app-api.d.ts

@@ -1533,6 +1533,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/workspaces/{workspace_id}/computer-use": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Switch computer use on or off for the workspace (contracts §45.1)
+         * @description enabled: true or false overrides the template’s switch; null follows it. While computer use is on, tool tokens carry the computer tool and the workspace desktop starts on the first computer call. Takes effect on the next tool token. 409 computer_use_unavailable when the workspace’s template version cannot run a desktop, 409 not_supported_for_mode for file-first workspaces (§29), 409 workspace_deleted. Returns the switch.
+         */
+        put: operations["putV1WorkspacesWorkspaceIdComputerUse"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/workspaces/{workspace_id}/suspend": {
         parameters: {
             query?: never;
@@ -1946,6 +1966,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/workspaces/{workspace_id}/computer-use": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Switch computer use on or off for the workspace (contracts §45.1)
+         * @description enabled: true or false overrides the template’s switch; null follows it. While computer use is on, tool tokens carry the computer tool and the workspace desktop starts on the first computer call. Takes effect on the next tool token. 409 computer_use_unavailable when the workspace’s template version cannot run a desktop, 409 not_supported_for_mode for file-first workspaces (§29), 409 workspace_deleted. Returns the switch.
+         */
+        put: operations["putApiV1WorkspacesWorkspaceIdComputerUse"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/workspaces/{workspace_id}/suspend": {
         parameters: {
             query?: never;
@@ -2251,13 +2291,13 @@ export interface paths {
         get?: never;
         /**
          * Expose a port of the workspace at its own HTTPS URL
-         * @description Serves TCP `port` inside the workspace at `https://<port>-<handle>.<ingress domain>` (contracts §39.3). The port is private: every request needs a port token (POST …/tokens), a signed link (POST …/links) or the port’s callback URL (POST …/callback). A request to a suspended workspace resumes it and is held until it runs; a parked one wakes inside the request. 201 when exposed now, 200 when it already was (unchanged: its tokens, links and callback URL stay valid). The handle is the workspace’s for good (kept when ports are closed and exposed again, across suspend, resume and reset; a fork gets none). At most 10 exposed ports: 409 conflict details.reason port_limit (details.limit 10). Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description Serves TCP `port` inside the workspace at `https://<port>-<handle>.<ingress domain>` (contracts §39.3). The port is private: every request needs a port token (POST …/tokens), a signed link (POST …/links) or the port’s callback URL (POST …/callback). A request to a suspended workspace resumes it and is held until it runs; a parked one wakes inside the request. 201 when exposed now, 200 when it already was (unchanged: its tokens, links and callback URL stay valid). The handle is the workspace’s for good (kept when ports are closed and exposed again, across suspend, resume and reset; a fork gets none). At most 10 exposed ports: 409 conflict details.reason port_limit (details.limit 10). Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         put: operations["putV1WorkspacesWorkspaceIdPortsPort"];
         post?: never;
         /**
          * Close an exposed port
-         * @description 204, also when the port was not exposed. Its tokens, links and callback URL stop working at once (the gateway caches for at most 5 s), and stay revoked if the port is exposed again. The workspace keeps its URL handle. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description 204, also when the port was not exposed. Its tokens, links and callback URL stop working at once (the gateway caches for at most 5 s), and stay revoked if the port is exposed again. The workspace keeps its URL handle. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         delete: operations["deleteV1WorkspacesWorkspaceIdPortsPort"];
         options?: never;
@@ -2274,7 +2314,7 @@ export interface paths {
         };
         /**
          * List the workspace’s exposed ports
-         * @description Ordered by port. `callback` is set when the port has a callback URL (its secret is never shown again). Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description Ordered by port. `callback` is set when the port has a callback URL (its secret is never shown again). Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         get: operations["getV1WorkspacesWorkspaceIdPorts"];
         put?: never;
@@ -2296,7 +2336,7 @@ export interface paths {
         put?: never;
         /**
          * Mint a port token for an exposed port
-         * @description A bearer token for requests to the port’s URL: `Authorization: Bearer <token>` (or `X-Shardflux-Token: <token>` when the app uses Authorization itself). `sfp_` + an ES256 JWS (claims iss, aud `shardflux-ports`, sub, pty, org, prj, ws, port, pxid, use `bearer`, iat, exp, jti; keys at GET /v1/.well-known/tool-token-keys). Revoked by closing the port, deleting the workspace, revoking the API key that minted it, or the minting member’s removal or role change. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description A bearer token for requests to the port’s URL: `Authorization: Bearer <token>` (or `X-Shardflux-Token: <token>` when the app uses Authorization itself). `sfp_` + an ES256 JWS (claims iss, aud `shardflux-ports`, sub, pty, org, prj, ws, port, pxid, use `bearer`, iat, exp, jti; keys at GET /v1/.well-known/tool-token-keys). Revoked by closing the port, deleting the workspace, revoking the API key that minted it, or the minting member’s removal or role change. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         post: operations["postV1WorkspacesWorkspaceIdPortsPortTokens"];
         delete?: never;
@@ -2316,7 +2356,7 @@ export interface paths {
         put?: never;
         /**
          * Create a signed link that opens an exposed port in a browser
-         * @description Opening the link sets a session cookie for the port’s host (HttpOnly, Secure, until `expires_at`) and redirects to `path`, so a person can use the app in a browser without a header. Share it like a password: anyone with the link can open the port until it expires. Revoked like a port token (closing the port, deleting the workspace, revoking the minting API key). 422 validation_failed details.field path for a path that does not start with one `/` or has characters other than printable ASCII. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description Opening the link sets a session cookie for the port’s host (HttpOnly, Secure, until `expires_at`) and redirects to `path`, so a person can use the app in a browser without a header. Share it like a password: anyone with the link can open the port until it expires. Revoked like a port token (closing the port, deleting the workspace, revoking the minting API key). 422 validation_failed details.field path for a path that does not start with one `/` or has characters other than printable ASCII. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         post: operations["postV1WorkspacesWorkspaceIdPortsPortLinks"];
         delete?: never;
@@ -2336,12 +2376,12 @@ export interface paths {
         put?: never;
         /**
          * Create or replace the port’s callback URL (webhooks, OAuth redirects)
-         * @description A URL with a secret in its path that reaches the port without a token header: register `<url><your path>` with GitHub, Slack, Stripe or an OAuth provider; a request to `/__shardflux/callback/<secret>/<rest>` reaches `/<rest>` (query kept) and wakes the workspace like any request. Creating it again replaces it (the previous URL stops working). The secret is shown only in this response (stored as a SHA-256 hash). Revoke it with DELETE, by closing the port, or by deleting the workspace; it also stops waking the workspace when its creator can no longer manage the workspace. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description A URL with a secret in its path that reaches the port without a token header: register `<url><your path>` with GitHub, Slack, Stripe or an OAuth provider; a request to `/__shardflux/callback/<secret>/<rest>` reaches `/<rest>` (query kept) and wakes the workspace like any request. Creating it again replaces it (the previous URL stops working). The secret is shown only in this response (stored as a SHA-256 hash). Revoke it with DELETE, by closing the port, or by deleting the workspace; it also stops waking the workspace when its creator can no longer manage the workspace. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         post: operations["postV1WorkspacesWorkspaceIdPortsPortCallback"];
         /**
          * Revoke the port’s callback URL
-         * @description 204, also when the port has no callback URL. The URL stops working at once (the gateway caches for at most 5 s). 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description 204, also when the port has no callback URL. The URL stops working at once (the gateway caches for at most 5 s). 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         delete: operations["deleteV1WorkspacesWorkspaceIdPortsPortCallback"];
         options?: never;
@@ -2359,13 +2399,13 @@ export interface paths {
         get?: never;
         /**
          * Expose a port of the workspace at its own HTTPS URL
-         * @description Serves TCP `port` inside the workspace at `https://<port>-<handle>.<ingress domain>` (contracts §39.3). The port is private: every request needs a port token (POST …/tokens), a signed link (POST …/links) or the port’s callback URL (POST …/callback). A request to a suspended workspace resumes it and is held until it runs; a parked one wakes inside the request. 201 when exposed now, 200 when it already was (unchanged: its tokens, links and callback URL stay valid). The handle is the workspace’s for good (kept when ports are closed and exposed again, across suspend, resume and reset; a fork gets none). At most 10 exposed ports: 409 conflict details.reason port_limit (details.limit 10). Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description Serves TCP `port` inside the workspace at `https://<port>-<handle>.<ingress domain>` (contracts §39.3). The port is private: every request needs a port token (POST …/tokens), a signed link (POST …/links) or the port’s callback URL (POST …/callback). A request to a suspended workspace resumes it and is held until it runs; a parked one wakes inside the request. 201 when exposed now, 200 when it already was (unchanged: its tokens, links and callback URL stay valid). The handle is the workspace’s for good (kept when ports are closed and exposed again, across suspend, resume and reset; a fork gets none). At most 10 exposed ports: 409 conflict details.reason port_limit (details.limit 10). Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         put: operations["putApiV1WorkspacesWorkspaceIdPortsPort"];
         post?: never;
         /**
          * Close an exposed port
-         * @description 204, also when the port was not exposed. Its tokens, links and callback URL stop working at once (the gateway caches for at most 5 s), and stay revoked if the port is exposed again. The workspace keeps its URL handle. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description 204, also when the port was not exposed. Its tokens, links and callback URL stop working at once (the gateway caches for at most 5 s), and stay revoked if the port is exposed again. The workspace keeps its URL handle. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         delete: operations["deleteApiV1WorkspacesWorkspaceIdPortsPort"];
         options?: never;
@@ -2382,7 +2422,7 @@ export interface paths {
         };
         /**
          * List the workspace’s exposed ports
-         * @description Ordered by port. `callback` is set when the port has a callback URL (its secret is never shown again). Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description Ordered by port. `callback` is set when the port has a callback URL (its secret is never shown again). Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         get: operations["getApiV1WorkspacesWorkspaceIdPorts"];
         put?: never;
@@ -2404,7 +2444,7 @@ export interface paths {
         put?: never;
         /**
          * Mint a port token for an exposed port
-         * @description A bearer token for requests to the port’s URL: `Authorization: Bearer <token>` (or `X-Shardflux-Token: <token>` when the app uses Authorization itself). `sfp_` + an ES256 JWS (claims iss, aud `shardflux-ports`, sub, pty, org, prj, ws, port, pxid, use `bearer`, iat, exp, jti; keys at GET /v1/.well-known/tool-token-keys). Revoked by closing the port, deleting the workspace, revoking the API key that minted it, or the minting member’s removal or role change. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description A bearer token for requests to the port’s URL: `Authorization: Bearer <token>` (or `X-Shardflux-Token: <token>` when the app uses Authorization itself). `sfp_` + an ES256 JWS (claims iss, aud `shardflux-ports`, sub, pty, org, prj, ws, port, pxid, use `bearer`, iat, exp, jti; keys at GET /v1/.well-known/tool-token-keys). Revoked by closing the port, deleting the workspace, revoking the API key that minted it, or the minting member’s removal or role change. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         post: operations["postApiV1WorkspacesWorkspaceIdPortsPortTokens"];
         delete?: never;
@@ -2424,7 +2464,7 @@ export interface paths {
         put?: never;
         /**
          * Create a signed link that opens an exposed port in a browser
-         * @description Opening the link sets a session cookie for the port’s host (HttpOnly, Secure, until `expires_at`) and redirects to `path`, so a person can use the app in a browser without a header. Share it like a password: anyone with the link can open the port until it expires. Revoked like a port token (closing the port, deleting the workspace, revoking the minting API key). 422 validation_failed details.field path for a path that does not start with one `/` or has characters other than printable ASCII. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description Opening the link sets a session cookie for the port’s host (HttpOnly, Secure, until `expires_at`) and redirects to `path`, so a person can use the app in a browser without a header. Share it like a password: anyone with the link can open the port until it expires. Revoked like a port token (closing the port, deleting the workspace, revoking the minting API key). 422 validation_failed details.field path for a path that does not start with one `/` or has characters other than printable ASCII. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         post: operations["postApiV1WorkspacesWorkspaceIdPortsPortLinks"];
         delete?: never;
@@ -2444,12 +2484,12 @@ export interface paths {
         put?: never;
         /**
          * Create or replace the port’s callback URL (webhooks, OAuth redirects)
-         * @description A URL with a secret in its path that reaches the port without a token header: register `<url><your path>` with GitHub, Slack, Stripe or an OAuth provider; a request to `/__shardflux/callback/<secret>/<rest>` reaches `/<rest>` (query kept) and wakes the workspace like any request. Creating it again replaces it (the previous URL stops working). The secret is shown only in this response (stored as a SHA-256 hash). Revoke it with DELETE, by closing the port, or by deleting the workspace; it also stops waking the workspace when its creator can no longer manage the workspace. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description A URL with a secret in its path that reaches the port without a token header: register `<url><your path>` with GitHub, Slack, Stripe or an OAuth provider; a request to `/__shardflux/callback/<secret>/<rest>` reaches `/<rest>` (query kept) and wakes the workspace like any request. Creating it again replaces it (the previous URL stops working). The secret is shown only in this response (stored as a SHA-256 hash). Revoke it with DELETE, by closing the port, or by deleting the workspace; it also stops waking the workspace when its creator can no longer manage the workspace. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         post: operations["postApiV1WorkspacesWorkspaceIdPortsPortCallback"];
         /**
          * Revoke the port’s callback URL
-         * @description 204, also when the port has no callback URL. The URL stops working at once (the gateway caches for at most 5 s). 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description 204, also when the port has no callback URL. The URL stops working at once (the gateway caches for at most 5 s). 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         delete: operations["deleteApiV1WorkspacesWorkspaceIdPortsPortCallback"];
         options?: never;
@@ -2757,6 +2797,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/organizations/{organization_id}/templates/{slug}/computer-use": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Switch computer use on or off for the workspaces of an organization template (contracts §45.1)
+         * @description Every workspace of the template follows it unless the workspace sets its own value; takes effect on their next tool token. Owners and admins (sessions) or API keys of the organization with a tool permission. 403 for platform templates (switch a workspace on instead), 404 outside the organization.
+         */
+        put: operations["putV1OrganizationsOrganizationIdTemplatesSlugComputerUse"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/templates/{slug}/computer-use": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Switch computer use on or off for the workspaces of an organization template (contracts §45.1) (the API key’s organization)
+         * @description Every workspace of the template follows it unless the workspace sets its own value; takes effect on their next tool token. Owners and admins (sessions) or API keys of the organization with a tool permission. 403 for platform templates (switch a workspace on instead), 404 outside the organization.
+         */
+        put: operations["putV1TemplatesSlugComputerUse"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/organizations/{organization_id}/template-builds": {
         parameters: {
             query?: never;
@@ -3095,6 +3175,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/organizations/{organization_id}/templates/{slug}/computer-use": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Switch computer use on or off for the workspaces of an organization template (contracts §45.1)
+         * @description Every workspace of the template follows it unless the workspace sets its own value; takes effect on their next tool token. Owners and admins (sessions) or API keys of the organization with a tool permission. 403 for platform templates (switch a workspace on instead), 404 outside the organization.
+         */
+        put: operations["putApiV1OrganizationsOrganizationIdTemplatesSlugComputerUse"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/organizations/{organization_id}/template-builds": {
         parameters: {
             query?: never;
@@ -5849,13 +5949,13 @@ export interface paths {
         };
         /**
          * Describe a hosted MCP connection request (consent page)
-         * @description Validates an authorization request for the hosted MCP endpoint and returns the client, where the browser goes afterwards and the projects the user may connect. 422 `validation_failed` (details.oauth_error) when the client or its redirect_uri cannot be trusted; otherwise a request with another problem still describes the client, and the POST answers it with the OAuth error.
+         * @description Describes the pending authorization request /connect?request=<id> names: the client, where the browser goes afterwards and the projects the user may connect. 422 `validation_failed`: details.reason `request_expired` (unknown, expired after 15 minutes, or already answered), details.oauth_error when the client or its redirect_uri cannot be trusted, or details.redirect_to (the error redirect) for any other problem.
          */
         get: operations["getApiV1OauthAuthorization"];
         put?: never;
         /**
          * Approve or decline a hosted MCP connection request
-         * @description approve (with project_id, a project where the user is owner or admin) creates the connection: a project API key named "<client> (MCP connector)" with every tool permission, held by Shardflux for the client, and a single-use authorization code (5 minutes). deny sends access_denied. Either way the answer is redirect_to, where the browser goes next.
+         * @description Answers the pending request (it is consumed). approve (with project_id, a project where the user is owner or admin; checked before the request is consumed) creates the connection: a project API key named "<client> (MCP connector)" with every tool permission, held by Shardflux for the client, and a single-use authorization code (5 minutes). deny sends access_denied. Either way the answer is redirect_to, where the browser goes next.
          */
         post: operations["postApiV1OauthAuthorization"];
         delete?: never;
@@ -6850,7 +6950,7 @@ export interface components {
                 disk_gib?: number;
             };
             agent_label?: string;
-            tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+            tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
             /** @description Open-time inputs of the template version (contracts §24.3): {NAME: string} for its declared text inputs. A new workspace stores each given value, else the declared default; on an existing key `inputs` replaces them all (omitted = unchanged). Secret inputs are not passed here: they bind the stored secret of the same name. 422 input_unknown (undeclared name, details.names), input_invalid (a secret input, a non-string, or a value over 4096 bytes or with CR, LF or NUL; details.names), input_required (details {names, kind}). */
             inputs?: {
                 [key: string]: unknown;
@@ -6870,7 +6970,7 @@ export interface components {
                 disk_gib?: number;
             };
             agent_label?: string;
-            tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+            tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
             /** @description Open-time inputs of the template version (contracts §24.3): {NAME: string} for its declared text inputs. A new workspace stores each given value, else the declared default; on an existing key `inputs` replaces them all (omitted = unchanged). Secret inputs are not passed here: they bind the stored secret of the same name. 422 input_unknown (undeclared name, details.names), input_invalid (a secret input, a non-string, or a value over 4096 bytes or with CR, LF or NUL; details.names), input_required (details {names, kind}). */
             inputs?: {
                 [key: string]: unknown;
@@ -7065,7 +7165,7 @@ export interface components {
                 disk_gib?: number;
             };
             agent_label?: string;
-            tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+            tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
             /** @description Open-time inputs of the template version (contracts §24.3): {NAME: string} for its declared text inputs. A new workspace stores each given value, else the declared default; on an existing key `inputs` replaces them all (omitted = unchanged). Secret inputs are not passed here: they bind the stored secret of the same name. 422 input_unknown (undeclared name, details.names), input_invalid (a secret input, a non-string, or a value over 4096 bytes or with CR, LF or NUL; details.names), input_required (details {names, kind}). */
             inputs?: {
                 [key: string]: unknown;
@@ -7186,6 +7286,15 @@ export interface components {
                 memory_mib_held?: number;
             };
         };
+        ComputerUse: {
+            /** @description Effective: tool tokens carry the computer tool (the workspace’s value, else the template’s, and the version runs a desktop). */
+            enabled: boolean;
+            workspace: boolean | null;
+            /** @description The template’s switch for its workspaces. */
+            template: boolean;
+            /** @description The workspace’s template version can run a desktop (its guest agent has desktop.v1). */
+            available: boolean;
+        };
         Workspace: {
             /**
              * Format: uuid
@@ -7314,6 +7423,7 @@ export interface components {
             mode: components["schemas"]["WorkspaceMode"];
             /** @description file_first: the latest revision of the file tree (0 = the empty tree the workspace starts with; each mutating file call or execution publishes the next one; cell file responses carry it as X-Tree-Revision). Always 0 for processful workspaces. */
             tree_revision: number;
+            computer_use: components["schemas"]["ComputerUse"];
             /**
              * Format: date-time
              * @description RFC 3339 UTC timestamp with Z.
@@ -7386,7 +7496,7 @@ export interface components {
              */
             agent_session_id: string;
             ownership_epoch: number;
-            tools: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+            tools: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
             cell_endpoint: string;
         };
         /** @description An exposed port of a workspace (contracts §39.3). Private: every request needs a credential. */
@@ -10198,7 +10308,7 @@ export interface operations {
                              * @description UUIDv7, lowercase canonical form.
                              */
                             project_id: string;
-                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                         } | null;
                     };
                 };
@@ -11041,7 +11151,7 @@ export interface operations {
                              */
                             project_id: string;
                             name: string;
-                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                             /**
                              * Format: date-time
                              * @description RFC 3339 UTC timestamp with Z.
@@ -11089,7 +11199,7 @@ export interface operations {
             content: {
                 "application/json": {
                     name: string;
-                    tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                     /**
                      * Format: date-time
                      * @description RFC 3339 UTC timestamp with Z.
@@ -11125,7 +11235,7 @@ export interface operations {
                              */
                             project_id: string;
                             name: string;
-                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                             /**
                              * Format: date-time
                              * @description RFC 3339 UTC timestamp with Z.
@@ -11257,7 +11367,7 @@ export interface operations {
                              * @description UUIDv7, lowercase canonical form.
                              */
                             project_id: string;
-                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                         } | null;
                     };
                 };
@@ -12100,7 +12210,7 @@ export interface operations {
                              */
                             project_id: string;
                             name: string;
-                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                             /**
                              * Format: date-time
                              * @description RFC 3339 UTC timestamp with Z.
@@ -12148,7 +12258,7 @@ export interface operations {
             content: {
                 "application/json": {
                     name: string;
-                    tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                     /**
                      * Format: date-time
                      * @description RFC 3339 UTC timestamp with Z.
@@ -12184,7 +12294,7 @@ export interface operations {
                              */
                             project_id: string;
                             name: string;
-                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                             /**
                              * Format: date-time
                              * @description RFC 3339 UTC timestamp with Z.
@@ -12301,7 +12411,7 @@ export interface operations {
                     project_id?: string;
                     /** @description Attribution label; one agent session per (workspace, principal, label). */
                     agent_label?: string;
-                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                     /** @description Secret names bound to the workspace (max 50, unique): injected as environment variables into every exec and PTY start (terminal sessions included), together with the call’s own `secret_refs`. Each must name a live secret this workspace may use (its project, its id, and allowed_tools including exec and pty), else 422 details.reason secret_not_available with details.names. */
                     secrets?: string[];
                     /** @description Open-time inputs of the template version (contracts §24.3): {NAME: string} for its declared text inputs. A new workspace stores each given value, else the declared default; on an existing key `inputs` replaces them all (omitted = unchanged). Secret inputs are not passed here: they bind the stored secret of the same name. 422 input_unknown (undeclared name, details.names), input_invalid (a secret input, a non-string, or a value over 4096 bytes or with CR, LF or NUL; details.names), input_required (details {names, kind}). */
@@ -12312,6 +12422,8 @@ export interface operations {
                     /** @description adaptive (the learned timeout, default), never, or fixed:<seconds> (60..604800). Contracts §20.7. */
                     idle_policy?: string;
                     mode?: components["schemas"]["WorkspaceMode"];
+                    /** @description Contracts §45.1: the workspace’s computer use switch (null follows the template); set on create, replaced on an existing key when given. */
+                    computer_use?: boolean | null;
                 };
             };
         };
@@ -12327,6 +12439,8 @@ export interface operations {
                         operation: components["schemas"]["Operation"] | null;
                         cell_endpoint: string | null;
                         tool_token: components["schemas"]["ToolToken"] | null;
+                        /** @description Contracts §46.2: true when this request created the workspace (a new key, or a key whose session ended), false when it reconnected to or resumed an existing one. Of concurrent opens of one new key exactly one says true; a replay with the same Idempotency-Key repeats it. */
+                        created: boolean;
                     };
                 };
             };
@@ -12341,6 +12455,8 @@ export interface operations {
                         operation: components["schemas"]["Operation"] | null;
                         cell_endpoint: string | null;
                         tool_token: components["schemas"]["ToolToken"] | null;
+                        /** @description Contracts §46.2: true when this request created the workspace (a new key, or a key whose session ended), false when it reconnected to or resumed an existing one. Of concurrent opens of one new key exactly one says true; a replay with the same Idempotency-Key repeats it. */
+                        created: boolean;
                     };
                 };
             };
@@ -12706,6 +12822,54 @@ export interface operations {
             };
         };
     };
+    putV1WorkspacesWorkspaceIdComputerUse: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description true or false overrides the template; null follows it. */
+                    enabled: boolean | null;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ComputerUse"];
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
     postV1WorkspacesWorkspaceIdSuspend: {
         parameters: {
             query?: never;
@@ -12769,7 +12933,7 @@ export interface operations {
                 "application/json": {
                     /** @description Attribution label; one agent session per (workspace, principal, label). */
                     agent_label?: string;
-                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                 };
             };
         };
@@ -13056,7 +13220,7 @@ export interface operations {
                     lifetime?: components["schemas"]["WorkspaceLifetime"];
                     /** @description Attribution label; one agent session per (workspace, principal, label). */
                     agent_label?: string;
-                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                 };
             };
         };
@@ -13364,7 +13528,7 @@ export interface operations {
                 "application/json": {
                     /** @description Attribution label; one agent session per (workspace, principal, label). */
                     agent_label?: string;
-                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                 };
             };
         };
@@ -13585,7 +13749,7 @@ export interface operations {
                     project_id?: string;
                     /** @description Attribution label; one agent session per (workspace, principal, label). */
                     agent_label?: string;
-                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                     /** @description Secret names bound to the workspace (max 50, unique): injected as environment variables into every exec and PTY start (terminal sessions included), together with the call’s own `secret_refs`. Each must name a live secret this workspace may use (its project, its id, and allowed_tools including exec and pty), else 422 details.reason secret_not_available with details.names. */
                     secrets?: string[];
                     /** @description Open-time inputs of the template version (contracts §24.3): {NAME: string} for its declared text inputs. A new workspace stores each given value, else the declared default; on an existing key `inputs` replaces them all (omitted = unchanged). Secret inputs are not passed here: they bind the stored secret of the same name. 422 input_unknown (undeclared name, details.names), input_invalid (a secret input, a non-string, or a value over 4096 bytes or with CR, LF or NUL; details.names), input_required (details {names, kind}). */
@@ -13596,6 +13760,8 @@ export interface operations {
                     /** @description adaptive (the learned timeout, default), never, or fixed:<seconds> (60..604800). Contracts §20.7. */
                     idle_policy?: string;
                     mode?: components["schemas"]["WorkspaceMode"];
+                    /** @description Contracts §45.1: the workspace’s computer use switch (null follows the template); set on create, replaced on an existing key when given. */
+                    computer_use?: boolean | null;
                 };
             };
         };
@@ -13611,6 +13777,8 @@ export interface operations {
                         operation: components["schemas"]["Operation"] | null;
                         cell_endpoint: string | null;
                         tool_token: components["schemas"]["ToolToken"] | null;
+                        /** @description Contracts §46.2: true when this request created the workspace (a new key, or a key whose session ended), false when it reconnected to or resumed an existing one. Of concurrent opens of one new key exactly one says true; a replay with the same Idempotency-Key repeats it. */
+                        created: boolean;
                     };
                 };
             };
@@ -13625,6 +13793,8 @@ export interface operations {
                         operation: components["schemas"]["Operation"] | null;
                         cell_endpoint: string | null;
                         tool_token: components["schemas"]["ToolToken"] | null;
+                        /** @description Contracts §46.2: true when this request created the workspace (a new key, or a key whose session ended), false when it reconnected to or resumed an existing one. Of concurrent opens of one new key exactly one says true; a replay with the same Idempotency-Key repeats it. */
+                        created: boolean;
                     };
                 };
             };
@@ -13990,6 +14160,54 @@ export interface operations {
             };
         };
     };
+    putApiV1WorkspacesWorkspaceIdComputerUse: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description true or false overrides the template; null follows it. */
+                    enabled: boolean | null;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ComputerUse"];
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
     postApiV1WorkspacesWorkspaceIdSuspend: {
         parameters: {
             query?: never;
@@ -14053,7 +14271,7 @@ export interface operations {
                 "application/json": {
                     /** @description Attribution label; one agent session per (workspace, principal, label). */
                     agent_label?: string;
-                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                 };
             };
         };
@@ -14340,7 +14558,7 @@ export interface operations {
                     lifetime?: components["schemas"]["WorkspaceLifetime"];
                     /** @description Attribution label; one agent session per (workspace, principal, label). */
                     agent_label?: string;
-                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                 };
             };
         };
@@ -14648,7 +14866,7 @@ export interface operations {
                 "application/json": {
                     /** @description Attribution label; one agent session per (workspace, principal, label). */
                     agent_label?: string;
-                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                 };
             };
         };
@@ -14795,8 +15013,11 @@ export interface operations {
                          * @description UUIDv7, lowercase canonical form.
                          */
                         workspace_id: string;
-                        /** @enum {string} */
-                        tool: "exec" | "files" | "pty" | "process" | "git" | "browser";
+                        /**
+                         * @description computer (contracts §45): the workspace desktop; a tool token carries it only while the workspace’s computer use is on.
+                         * @enum {string}
+                         */
+                        tool: "exec" | "files" | "pty" | "process" | "git" | "browser" | "computer";
                         /**
                          * Format: uuid
                          * @description UUIDv7, lowercase canonical form.
@@ -16570,6 +16791,8 @@ export interface operations {
                                 memory_mib: number | null;
                                 idle_policy: string | null;
                             };
+                            /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                            computer_use: boolean;
                             open_version: {
                                 /**
                                  * Format: uuid
@@ -16787,6 +17010,8 @@ export interface operations {
                             memory_mib: number | null;
                             idle_policy: string | null;
                         };
+                        /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                        computer_use: boolean;
                         open_version: {
                             /**
                              * Format: uuid
@@ -17135,6 +17360,8 @@ export interface operations {
                                 memory_mib: number | null;
                                 idle_policy: string | null;
                             };
+                            /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                            computer_use: boolean;
                             open_version: {
                                 /**
                                  * Format: uuid
@@ -17350,6 +17577,8 @@ export interface operations {
                             memory_mib: number | null;
                             idle_policy: string | null;
                         };
+                        /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                        computer_use: boolean;
                         open_version: {
                             /**
                              * Format: uuid
@@ -17652,6 +17881,104 @@ export interface operations {
             };
         };
     };
+    putV1OrganizationsOrganizationIdTemplatesSlugComputerUse: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                organization_id: string;
+                slug: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    enabled: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        enabled: boolean;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    putV1TemplatesSlugComputerUse: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                slug: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    enabled: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        enabled: boolean;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
     getV1OrganizationsOrganizationIdTemplateBuilds: {
         parameters: {
             query?: {
@@ -19735,6 +20062,8 @@ export interface operations {
                             memory_mib: number | null;
                             idle_policy: string | null;
                         };
+                        /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                        computer_use: boolean;
                         open_version: {
                             /**
                              * Format: uuid
@@ -20081,6 +20410,8 @@ export interface operations {
                             memory_mib: number | null;
                             idle_policy: string | null;
                         };
+                        /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                        computer_use: boolean;
                         open_version: {
                             /**
                              * Format: uuid
@@ -20432,6 +20763,8 @@ export interface operations {
                                 memory_mib: number | null;
                                 idle_policy: string | null;
                             };
+                            /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                            computer_use: boolean;
                             open_version: {
                                 /**
                                  * Format: uuid
@@ -20649,6 +20982,8 @@ export interface operations {
                             memory_mib: number | null;
                             idle_policy: string | null;
                         };
+                        /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                        computer_use: boolean;
                         open_version: {
                             /**
                              * Format: uuid
@@ -20951,6 +21286,56 @@ export interface operations {
             };
         };
     };
+    putApiV1OrganizationsOrganizationIdTemplatesSlugComputerUse: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                organization_id: string;
+                slug: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    enabled: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        enabled: boolean;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
     getApiV1OrganizationsOrganizationIdTemplateBuilds: {
         parameters: {
             query?: {
@@ -22854,6 +23239,8 @@ export interface operations {
                             memory_mib: number | null;
                             idle_policy: string | null;
                         };
+                        /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                        computer_use: boolean;
                         open_version: {
                             /**
                              * Format: uuid
@@ -23200,6 +23587,8 @@ export interface operations {
                             memory_mib: number | null;
                             idle_policy: string | null;
                         };
+                        /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                        computer_use: boolean;
                         open_version: {
                             /**
                              * Format: uuid
@@ -26332,8 +26721,11 @@ export interface operations {
                                  */
                                 id: string;
                             };
-                            /** @enum {string} */
-                            tool: "exec" | "files" | "pty" | "process" | "git" | "browser";
+                            /**
+                             * @description computer (contracts §45): the workspace desktop; a tool token carries it only while the workspace’s computer use is on.
+                             * @enum {string}
+                             */
+                            tool: "exec" | "files" | "pty" | "process" | "git" | "browser" | "computer";
                             outcome: "granted" | "denied" | "failed";
                             reason: string | null;
                             ownership_epoch: number | null;
@@ -26384,8 +26776,11 @@ export interface operations {
                      * @description UUIDv7, lowercase canonical form.
                      */
                     workspace_id: string;
-                    /** @enum {string} */
-                    tool: "exec" | "files" | "pty" | "process" | "git" | "browser";
+                    /**
+                     * @description computer (contracts §45): the workspace desktop; a tool token carries it only while the workspace’s computer use is on.
+                     * @enum {string}
+                     */
+                    tool: "exec" | "files" | "pty" | "process" | "git" | "browser" | "computer";
                     /** @description The start’s `secret_refs` together with the workspace’s bound names (app.workspace_secret_bindings), each name once: at most 50 + 50. */
                     names: string[];
                     /** @description The cell’s exec/PTY session id, recorded for correlation. */
@@ -26406,8 +26801,11 @@ export interface operations {
                          * @description UUIDv7, lowercase canonical form.
                          */
                         workspace_id: string;
-                        /** @enum {string} */
-                        tool: "exec" | "files" | "pty" | "process" | "git" | "browser";
+                        /**
+                         * @description computer (contracts §45): the workspace desktop; a tool token carries it only while the workspace’s computer use is on.
+                         * @enum {string}
+                         */
+                        tool: "exec" | "files" | "pty" | "process" | "git" | "browser" | "computer";
                         /**
                          * Format: uuid
                          * @description UUIDv7, lowercase canonical form.
@@ -27420,8 +27818,11 @@ export interface operations {
                                  */
                                 id: string;
                             };
-                            /** @enum {string} */
-                            tool: "exec" | "files" | "pty" | "process" | "git" | "browser";
+                            /**
+                             * @description computer (contracts §45): the workspace desktop; a tool token carries it only while the workspace’s computer use is on.
+                             * @enum {string}
+                             */
+                            tool: "exec" | "files" | "pty" | "process" | "git" | "browser" | "computer";
                             outcome: "granted" | "denied" | "failed";
                             reason: string | null;
                             ownership_epoch: number | null;
@@ -38700,15 +39101,9 @@ export interface operations {
     };
     getApiV1OauthAuthorization: {
         parameters: {
-            query?: {
-                response_type?: string;
-                client_id?: string;
-                redirect_uri?: string;
-                code_challenge?: string;
-                code_challenge_method?: string;
-                scope?: string;
-                state?: string;
-                resource?: string;
+            query: {
+                /** @description The `request` parameter of /connect: the pending authorization request /oauth/authorize stored. */
+                request: string;
             };
             header?: never;
             path?: never;
@@ -38755,19 +39150,8 @@ export interface operations {
         requestBody: {
             content: {
                 "application/json": {
-                    /** @description The authorization request exactly as /oauth/authorize received it (RFC 6749 §4.1.1, PKCE S256, RFC 8707 resource). */
-                    request: {
-                        response_type?: string;
-                        client_id?: string;
-                        redirect_uri?: string;
-                        code_challenge?: string;
-                        code_challenge_method?: string;
-                        scope?: string;
-                        state?: string;
-                        resource?: string;
-                    } & {
-                        [key: string]: unknown;
-                    };
+                    /** @description The `request` parameter of /connect: the pending authorization request /oauth/authorize stored. */
+                    request: string;
                     decision: "approve" | "deny";
                     /**
                      * Format: uuid