@shardflux/sdk 0.14.0 → 0.16.0

package/dist/generated/app-api.d.ts

@@ -1133,6 +1133,27 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/projects/{project_id}/retention": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get project idle deletion default */
+        get: operations["getV1ProjectsProjectIdRetention"];
+        /**
+         * Set or clear project idle deletion default
+         * @description Policy {delete_after_idle_days: 1..3650, labels?: exact-match map}, or null to clear. Applies to persistent workspaces with no own policy. All labels must match. Owner/admin/member role or own project API key required.
+         */
+        put: operations["putV1ProjectsProjectIdRetention"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/projects/{project_id}/api-keys": {
         parameters: {
             query?: never;
@@ -1354,6 +1375,27 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/projects/{project_id}/retention": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /** Get project idle deletion default */
+        get: operations["getApiV1ProjectsProjectIdRetention"];
+        /**
+         * Set or clear project idle deletion default
+         * @description Policy {delete_after_idle_days: 1..3650, labels?: exact-match map}, or null to clear. Applies to persistent workspaces with no own policy. All labels must match. Owner/admin/member role or own project API key required.
+         */
+        put: operations["putApiV1ProjectsProjectIdRetention"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/projects/{project_id}/api-keys": {
         parameters: {
             query?: never;
@@ -1513,6 +1555,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/workspaces/{workspace_id}/retention": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Set or clear idle deletion retention
+         * @description JSON policy {delete_after_idle_days: 1..3650}, or null to follow the project default. Persistent only (422 retention_requires_persistent); deleted workspace 409 workspace_deleted. Returns the workspace with projected deletion time.
+         */
+        put: operations["putV1WorkspacesWorkspaceIdRetention"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/workspaces/{workspace_id}/idle-policy": {
         parameters: {
             query?: never;
@@ -1533,6 +1595,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/workspaces/{workspace_id}/computer-use": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Switch computer use on or off for the workspace (contracts §45.1)
+         * @description enabled: true or false overrides the template’s switch; null follows it. While computer use is on, tool tokens carry the computer tool and the workspace desktop starts on the first computer call. Takes effect on the next tool token. 409 computer_use_unavailable when the workspace’s template version cannot run a desktop, 409 not_supported_for_mode for file-first workspaces (§29), 409 workspace_deleted. Returns the switch.
+         */
+        put: operations["putV1WorkspacesWorkspaceIdComputerUse"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/workspaces/{workspace_id}/suspend": {
         parameters: {
             query?: never;
@@ -1593,6 +1675,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/workspaces/{workspace_id}/upgrade": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Upgrade a workspace in place, preserving its disk
+         * @description Opt-in cold start: preserves files, installed package files and home; drops memory and processes. now boots immediately; next_resume schedules a pinned target. Layered disks refresh the template base and guest; legacy disks upgrade memory only. Returns an upgrade operation. Errors: 409 already_current, legacy_disk_layout, upgrade_base_unavailable, not_upgradable, operation_in_progress, workspace_deleted; 422 not_supported_for_mode. Supports Idempotency-Key.
+         */
+        post: operations["postV1WorkspacesWorkspaceIdUpgrade"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/workspaces/{workspace_id}/caps": {
         parameters: {
             query?: never;
@@ -1926,6 +2028,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/workspaces/{workspace_id}/retention": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Set or clear idle deletion retention
+         * @description JSON policy {delete_after_idle_days: 1..3650}, or null to follow the project default. Persistent only (422 retention_requires_persistent); deleted workspace 409 workspace_deleted. Returns the workspace with projected deletion time.
+         */
+        put: operations["putApiV1WorkspacesWorkspaceIdRetention"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/workspaces/{workspace_id}/idle-policy": {
         parameters: {
             query?: never;
@@ -1946,6 +2068,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/workspaces/{workspace_id}/computer-use": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Switch computer use on or off for the workspace (contracts §45.1)
+         * @description enabled: true or false overrides the template’s switch; null follows it. While computer use is on, tool tokens carry the computer tool and the workspace desktop starts on the first computer call. Takes effect on the next tool token. 409 computer_use_unavailable when the workspace’s template version cannot run a desktop, 409 not_supported_for_mode for file-first workspaces (§29), 409 workspace_deleted. Returns the switch.
+         */
+        put: operations["putApiV1WorkspacesWorkspaceIdComputerUse"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/workspaces/{workspace_id}/suspend": {
         parameters: {
             query?: never;
@@ -2006,6 +2148,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/workspaces/{workspace_id}/upgrade": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Upgrade a workspace in place, preserving its disk
+         * @description Opt-in cold start: preserves files, installed package files and home; drops memory and processes. now boots immediately; next_resume schedules a pinned target. Layered disks refresh the template base and guest; legacy disks upgrade memory only. Returns an upgrade operation. Errors: 409 already_current, legacy_disk_layout, upgrade_base_unavailable, not_upgradable, operation_in_progress, workspace_deleted; 422 not_supported_for_mode. Supports Idempotency-Key.
+         */
+        post: operations["postApiV1WorkspacesWorkspaceIdUpgrade"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/workspaces/{workspace_id}/caps": {
         parameters: {
             query?: never;
@@ -2251,13 +2413,13 @@ export interface paths {
         get?: never;
         /**
          * Expose a port of the workspace at its own HTTPS URL
-         * @description Serves TCP `port` inside the workspace at `https://<port>-<handle>.<ingress domain>` (contracts §39.3). The port is private: every request needs a port token (POST …/tokens), a signed link (POST …/links) or the port’s callback URL (POST …/callback). A request to a suspended workspace resumes it and is held until it runs; a parked one wakes inside the request. 201 when exposed now, 200 when it already was (unchanged: its tokens, links and callback URL stay valid). The handle is the workspace’s for good (kept when ports are closed and exposed again, across suspend, resume and reset; a fork gets none). At most 10 exposed ports: 409 conflict details.reason port_limit (details.limit 10). Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description Serves TCP `port` inside the workspace at `https://<port>-<handle>.<ingress domain>` (contracts §39.3). The port is private: every request needs a port token (POST …/tokens), a signed link (POST …/links) or the port’s callback URL (POST …/callback). A request to a suspended workspace resumes it and is held until it runs; a parked one wakes inside the request. 201 when exposed now, 200 when it already was (unchanged: its tokens, links and callback URL stay valid). The handle is the workspace’s for good (kept when ports are closed and exposed again, across suspend, resume and reset; a fork gets none). At most 10 exposed ports: 409 conflict details.reason port_limit (details.limit 10). Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         put: operations["putV1WorkspacesWorkspaceIdPortsPort"];
         post?: never;
         /**
          * Close an exposed port
-         * @description 204, also when the port was not exposed. Its tokens, links and callback URL stop working at once (the gateway caches for at most 5 s), and stay revoked if the port is exposed again. The workspace keeps its URL handle. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description 204, also when the port was not exposed. Its tokens, links and callback URL stop working at once (the gateway caches for at most 5 s), and stay revoked if the port is exposed again. The workspace keeps its URL handle. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         delete: operations["deleteV1WorkspacesWorkspaceIdPortsPort"];
         options?: never;
@@ -2274,7 +2436,7 @@ export interface paths {
         };
         /**
          * List the workspace’s exposed ports
-         * @description Ordered by port. `callback` is set when the port has a callback URL (its secret is never shown again). Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description Ordered by port. `callback` is set when the port has a callback URL (its secret is never shown again). Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         get: operations["getV1WorkspacesWorkspaceIdPorts"];
         put?: never;
@@ -2296,7 +2458,7 @@ export interface paths {
         put?: never;
         /**
          * Mint a port token for an exposed port
-         * @description A bearer token for requests to the port’s URL: `Authorization: Bearer <token>` (or `X-Shardflux-Token: <token>` when the app uses Authorization itself). `sfp_` + an ES256 JWS (claims iss, aud `shardflux-ports`, sub, pty, org, prj, ws, port, pxid, use `bearer`, iat, exp, jti; keys at GET /v1/.well-known/tool-token-keys). Revoked by closing the port, deleting the workspace, revoking the API key that minted it, or the minting member’s removal or role change. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description A bearer token for requests to the port’s URL: `Authorization: Bearer <token>` (or `X-Shardflux-Token: <token>` when the app uses Authorization itself). `sfp_` + an ES256 JWS (claims iss, aud `shardflux-ports`, sub, pty, org, prj, ws, port, pxid, use `bearer`, iat, exp, jti; keys at GET /v1/.well-known/tool-token-keys). Revoked by closing the port, deleting the workspace, revoking the API key that minted it, or the minting member’s removal or role change. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         post: operations["postV1WorkspacesWorkspaceIdPortsPortTokens"];
         delete?: never;
@@ -2316,7 +2478,7 @@ export interface paths {
         put?: never;
         /**
          * Create a signed link that opens an exposed port in a browser
-         * @description Opening the link sets a session cookie for the port’s host (HttpOnly, Secure, until `expires_at`) and redirects to `path`, so a person can use the app in a browser without a header. Share it like a password: anyone with the link can open the port until it expires. Revoked like a port token (closing the port, deleting the workspace, revoking the minting API key). 422 validation_failed details.field path for a path that does not start with one `/` or has characters other than printable ASCII. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description Opt-in `embed: {origins: ["https://app.example.com"]}` creates a partitioned browser session with a frame-ancestors allowlist (contracts §48). Opening the link sets a session cookie for the port’s host (HttpOnly, Secure, until `expires_at`) and redirects to `path`, so a person can use the app in a browser without a header. Share it like a password: anyone with the link can open the port until it expires. Revoked like a port token (closing the port, deleting the workspace, revoking the minting API key). 422 validation_failed details.field path for a path that does not start with one `/` or has characters other than printable ASCII. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         post: operations["postV1WorkspacesWorkspaceIdPortsPortLinks"];
         delete?: never;
@@ -2336,12 +2498,12 @@ export interface paths {
         put?: never;
         /**
          * Create or replace the port’s callback URL (webhooks, OAuth redirects)
-         * @description A URL with a secret in its path that reaches the port without a token header: register `<url><your path>` with GitHub, Slack, Stripe or an OAuth provider; a request to `/__shardflux/callback/<secret>/<rest>` reaches `/<rest>` (query kept) and wakes the workspace like any request. Creating it again replaces it (the previous URL stops working). The secret is shown only in this response (stored as a SHA-256 hash). Revoke it with DELETE, by closing the port, or by deleting the workspace; it also stops waking the workspace when its creator can no longer manage the workspace. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description A URL with a secret in its path that reaches the port without a token header: register `<url><your path>` with GitHub, Slack, Stripe or an OAuth provider; a request to `/__shardflux/callback/<secret>/<rest>` reaches `/<rest>` (query kept) and wakes the workspace like any request. Creating it again replaces it (the previous URL stops working). The secret is shown only in this response (stored as a SHA-256 hash). Revoke it with DELETE, by closing the port, or by deleting the workspace; it also stops waking the workspace when its creator can no longer manage the workspace. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         post: operations["postV1WorkspacesWorkspaceIdPortsPortCallback"];
         /**
          * Revoke the port’s callback URL
-         * @description 204, also when the port has no callback URL. The URL stops working at once (the gateway caches for at most 5 s). 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description 204, also when the port has no callback URL. The URL stops working at once (the gateway caches for at most 5 s). 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         delete: operations["deleteV1WorkspacesWorkspaceIdPortsPortCallback"];
         options?: never;
@@ -2359,13 +2521,13 @@ export interface paths {
         get?: never;
         /**
          * Expose a port of the workspace at its own HTTPS URL
-         * @description Serves TCP `port` inside the workspace at `https://<port>-<handle>.<ingress domain>` (contracts §39.3). The port is private: every request needs a port token (POST …/tokens), a signed link (POST …/links) or the port’s callback URL (POST …/callback). A request to a suspended workspace resumes it and is held until it runs; a parked one wakes inside the request. 201 when exposed now, 200 when it already was (unchanged: its tokens, links and callback URL stay valid). The handle is the workspace’s for good (kept when ports are closed and exposed again, across suspend, resume and reset; a fork gets none). At most 10 exposed ports: 409 conflict details.reason port_limit (details.limit 10). Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description Serves TCP `port` inside the workspace at `https://<port>-<handle>.<ingress domain>` (contracts §39.3). The port is private: every request needs a port token (POST …/tokens), a signed link (POST …/links) or the port’s callback URL (POST …/callback). A request to a suspended workspace resumes it and is held until it runs; a parked one wakes inside the request. 201 when exposed now, 200 when it already was (unchanged: its tokens, links and callback URL stay valid). The handle is the workspace’s for good (kept when ports are closed and exposed again, across suspend, resume and reset; a fork gets none). At most 10 exposed ports: 409 conflict details.reason port_limit (details.limit 10). Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         put: operations["putApiV1WorkspacesWorkspaceIdPortsPort"];
         post?: never;
         /**
          * Close an exposed port
-         * @description 204, also when the port was not exposed. Its tokens, links and callback URL stop working at once (the gateway caches for at most 5 s), and stay revoked if the port is exposed again. The workspace keeps its URL handle. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description 204, also when the port was not exposed. Its tokens, links and callback URL stop working at once (the gateway caches for at most 5 s), and stay revoked if the port is exposed again. The workspace keeps its URL handle. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         delete: operations["deleteApiV1WorkspacesWorkspaceIdPortsPort"];
         options?: never;
@@ -2382,7 +2544,7 @@ export interface paths {
         };
         /**
          * List the workspace’s exposed ports
-         * @description Ordered by port. `callback` is set when the port has a callback URL (its secret is never shown again). Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description Ordered by port. `callback` is set when the port has a callback URL (its secret is never shown again). Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         get: operations["getApiV1WorkspacesWorkspaceIdPorts"];
         put?: never;
@@ -2404,7 +2566,7 @@ export interface paths {
         put?: never;
         /**
          * Mint a port token for an exposed port
-         * @description A bearer token for requests to the port’s URL: `Authorization: Bearer <token>` (or `X-Shardflux-Token: <token>` when the app uses Authorization itself). `sfp_` + an ES256 JWS (claims iss, aud `shardflux-ports`, sub, pty, org, prj, ws, port, pxid, use `bearer`, iat, exp, jti; keys at GET /v1/.well-known/tool-token-keys). Revoked by closing the port, deleting the workspace, revoking the API key that minted it, or the minting member’s removal or role change. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description A bearer token for requests to the port’s URL: `Authorization: Bearer <token>` (or `X-Shardflux-Token: <token>` when the app uses Authorization itself). `sfp_` + an ES256 JWS (claims iss, aud `shardflux-ports`, sub, pty, org, prj, ws, port, pxid, use `bearer`, iat, exp, jti; keys at GET /v1/.well-known/tool-token-keys). Revoked by closing the port, deleting the workspace, revoking the API key that minted it, or the minting member’s removal or role change. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         post: operations["postApiV1WorkspacesWorkspaceIdPortsPortTokens"];
         delete?: never;
@@ -2424,7 +2586,7 @@ export interface paths {
         put?: never;
         /**
          * Create a signed link that opens an exposed port in a browser
-         * @description Opening the link sets a session cookie for the port’s host (HttpOnly, Secure, until `expires_at`) and redirects to `path`, so a person can use the app in a browser without a header. Share it like a password: anyone with the link can open the port until it expires. Revoked like a port token (closing the port, deleting the workspace, revoking the minting API key). 422 validation_failed details.field path for a path that does not start with one `/` or has characters other than printable ASCII. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description Opt-in `embed: {origins: ["https://app.example.com"]}` creates a partitioned browser session with a frame-ancestors allowlist (contracts §48). Opening the link sets a session cookie for the port’s host (HttpOnly, Secure, until `expires_at`) and redirects to `path`, so a person can use the app in a browser without a header. Share it like a password: anyone with the link can open the port until it expires. Revoked like a port token (closing the port, deleting the workspace, revoking the minting API key). 422 validation_failed details.field path for a path that does not start with one `/` or has characters other than printable ASCII. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         post: operations["postApiV1WorkspacesWorkspaceIdPortsPortLinks"];
         delete?: never;
@@ -2444,12 +2606,12 @@ export interface paths {
         put?: never;
         /**
          * Create or replace the port’s callback URL (webhooks, OAuth redirects)
-         * @description A URL with a secret in its path that reaches the port without a token header: register `<url><your path>` with GitHub, Slack, Stripe or an OAuth provider; a request to `/__shardflux/callback/<secret>/<rest>` reaches `/<rest>` (query kept) and wakes the workspace like any request. Creating it again replaces it (the previous URL stops working). The secret is shown only in this response (stored as a SHA-256 hash). Revoke it with DELETE, by closing the port, or by deleting the workspace; it also stops waking the workspace when its creator can no longer manage the workspace. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description A URL with a secret in its path that reaches the port without a token header: register `<url><your path>` with GitHub, Slack, Stripe or an OAuth provider; a request to `/__shardflux/callback/<secret>/<rest>` reaches `/<rest>` (query kept) and wakes the workspace like any request. Creating it again replaces it (the previous URL stops working). The secret is shown only in this response (stored as a SHA-256 hash). Revoke it with DELETE, by closing the port, or by deleting the workspace; it also stops waking the workspace when its creator can no longer manage the workspace. 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         post: operations["postApiV1WorkspacesWorkspaceIdPortsPortCallback"];
         /**
          * Revoke the port’s callback URL
-         * @description 204, also when the port has no callback URL. The URL stops working at once (the gateway caches for at most 5 s). 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535.
+         * @description 204, also when the port has no callback URL. The URL stops working at once (the gateway caches for at most 5 s). 404 not_found details.reason port_not_exposed. Errors: 403 forbidden details.reason inbound_ports_not_available (inbound ports are not enabled for the organization), 409 conflict not_supported_for_mode (file-first workspace) or workspace_deleted, 422 validation_failed for a port outside 1-65535 (details.reason port_reserved for 61001, the workspace desktop’s control port, contracts §45.5).
          */
         delete: operations["deleteApiV1WorkspacesWorkspaceIdPortsPortCallback"];
         options?: never;
@@ -2757,6 +2919,46 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/v1/organizations/{organization_id}/templates/{slug}/computer-use": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Switch computer use on or off for the workspaces of an organization template (contracts §45.1)
+         * @description Every workspace of the template follows it unless the workspace sets its own value; takes effect on their next tool token. Owners and admins (sessions) or API keys of the organization with a tool permission. 403 for platform templates (switch a workspace on instead), 404 outside the organization.
+         */
+        put: operations["putV1OrganizationsOrganizationIdTemplatesSlugComputerUse"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/v1/templates/{slug}/computer-use": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Switch computer use on or off for the workspaces of an organization template (contracts §45.1) (the API key’s organization)
+         * @description Every workspace of the template follows it unless the workspace sets its own value; takes effect on their next tool token. Owners and admins (sessions) or API keys of the organization with a tool permission. 403 for platform templates (switch a workspace on instead), 404 outside the organization.
+         */
+        put: operations["putV1TemplatesSlugComputerUse"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/organizations/{organization_id}/template-builds": {
         parameters: {
             query?: never;
@@ -3095,6 +3297,26 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/api/v1/organizations/{organization_id}/templates/{slug}/computer-use": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /**
+         * Switch computer use on or off for the workspaces of an organization template (contracts §45.1)
+         * @description Every workspace of the template follows it unless the workspace sets its own value; takes effect on their next tool token. Owners and admins (sessions) or API keys of the organization with a tool permission. 403 for platform templates (switch a workspace on instead), 404 outside the organization.
+         */
+        put: operations["putApiV1OrganizationsOrganizationIdTemplatesSlugComputerUse"];
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/api/v1/organizations/{organization_id}/template-builds": {
         parameters: {
             query?: never;
@@ -5849,13 +6071,13 @@ export interface paths {
         };
         /**
          * Describe a hosted MCP connection request (consent page)
-         * @description Validates an authorization request for the hosted MCP endpoint and returns the client, where the browser goes afterwards and the projects the user may connect. 422 `validation_failed` (details.oauth_error) when the client or its redirect_uri cannot be trusted; otherwise a request with another problem still describes the client, and the POST answers it with the OAuth error.
+         * @description Describes the pending authorization request /connect?request=<id> names: the client, where the browser goes afterwards and the projects the user may connect. 422 `validation_failed`: details.reason `request_expired` (unknown, expired after 15 minutes, or already answered), details.oauth_error when the client or its redirect_uri cannot be trusted, or details.redirect_to (the error redirect) for any other problem.
          */
         get: operations["getApiV1OauthAuthorization"];
         put?: never;
         /**
          * Approve or decline a hosted MCP connection request
-         * @description approve (with project_id, a project where the user is owner or admin) creates the connection: a project API key named "<client> (MCP connector)" with every tool permission, held by Shardflux for the client, and a single-use authorization code (5 minutes). deny sends access_denied. Either way the answer is redirect_to, where the browser goes next.
+         * @description Answers the pending request (it is consumed). approve (with project_id, a project where the user is owner or admin; checked before the request is consumed) creates the connection: a project API key named "<client> (MCP connector)" with every tool permission, held by Shardflux for the client, and a single-use authorization code (5 minutes). deny sends access_denied. Either way the answer is redirect_to, where the browser goes next.
          */
         post: operations["postApiV1OauthAuthorization"];
         delete?: never;
@@ -5896,7 +6118,7 @@ export interface components {
              */
             id: string;
             /** @enum {string} */
-            kind: "open" | "suspend" | "resume" | "fork" | "snapshot" | "restore" | "delete" | "move" | "resize" | "volume_create" | "volume_attach" | "volume_detach" | "volume_delete" | "reset" | "layer_snapshot";
+            kind: "open" | "suspend" | "resume" | "fork" | "snapshot" | "restore" | "delete" | "move" | "resize" | "upgrade" | "volume_create" | "volume_attach" | "volume_detach" | "volume_delete" | "reset" | "layer_snapshot";
             /** @enum {string} */
             state: "queued" | "capacity_pending" | "running" | "succeeded" | "failed" | "canceled";
             workspace_id: string | null;
@@ -6850,7 +7072,7 @@ export interface components {
                 disk_gib?: number;
             };
             agent_label?: string;
-            tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+            tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
             /** @description Open-time inputs of the template version (contracts §24.3): {NAME: string} for its declared text inputs. A new workspace stores each given value, else the declared default; on an existing key `inputs` replaces them all (omitted = unchanged). Secret inputs are not passed here: they bind the stored secret of the same name. 422 input_unknown (undeclared name, details.names), input_invalid (a secret input, a non-string, or a value over 4096 bytes or with CR, LF or NUL; details.names), input_required (details {names, kind}). */
             inputs?: {
                 [key: string]: unknown;
@@ -6870,7 +7092,7 @@ export interface components {
                 disk_gib?: number;
             };
             agent_label?: string;
-            tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+            tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
             /** @description Open-time inputs of the template version (contracts §24.3): {NAME: string} for its declared text inputs. A new workspace stores each given value, else the declared default; on an existing key `inputs` replaces them all (omitted = unchanged). Secret inputs are not passed here: they bind the stored secret of the same name. 422 input_unknown (undeclared name, details.names), input_invalid (a secret input, a non-string, or a value over 4096 bytes or with CR, LF or NUL; details.names), input_required (details {names, kind}). */
             inputs?: {
                 [key: string]: unknown;
@@ -7065,7 +7287,7 @@ export interface components {
                 disk_gib?: number;
             };
             agent_label?: string;
-            tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+            tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
             /** @description Open-time inputs of the template version (contracts §24.3): {NAME: string} for its declared text inputs. A new workspace stores each given value, else the declared default; on an existing key `inputs` replaces them all (omitted = unchanged). Secret inputs are not passed here: they bind the stored secret of the same name. 422 input_unknown (undeclared name, details.names), input_invalid (a secret input, a non-string, or a value over 4096 bytes or with CR, LF or NUL; details.names), input_required (details {names, kind}). */
             inputs?: {
                 [key: string]: unknown;
@@ -7103,8 +7325,10 @@ export interface components {
             allocation_mode?: "fixed" | "elastic";
             /** @description CPU (millicores). Bounded by the plan and the template. */
             cpu_millis?: number;
-            /** @description Disk (GiB). Grow only. Bounded by the plan and the template. */
+            /** @description Disk (GiB). Grow only. With at_least, a smaller or equal disk is unchanged. Bounded by the plan and the template. */
             disk_gib?: number;
+            /** @description Only increase each named numeric resource; values at or below its current configured size leave it unchanged. The explicit allocation mode still switches. */
+            at_least?: boolean;
         };
         /** @description Per resource the request named (allocation_mode and memory_mib_held report under memory): what applied now and what applies later. caps: the workspace caps every later start uses. */
         ResizeResult: {
@@ -7186,6 +7410,15 @@ export interface components {
                 memory_mib_held?: number;
             };
         };
+        ComputerUse: {
+            /** @description Effective: tool tokens carry the computer tool (the workspace’s value, else the template’s, and the version runs a desktop). */
+            enabled: boolean;
+            workspace: boolean | null;
+            /** @description The template’s switch for its workspaces. */
+            template: boolean;
+            /** @description The workspace’s template version can run a desktop (its guest agent has desktop.v1). */
+            available: boolean;
+        };
         Workspace: {
             /**
              * Format: uuid
@@ -7207,12 +7440,16 @@ export interface components {
             labels: {
                 [key: string]: string;
             };
+            retention?: {
+                delete_after_idle_days: number;
+                delete_at: string | null;
+            } | null;
             /**
              * Format: uuid
              * @description UUIDv7, lowercase canonical form.
              */
             template_version_id: string;
-            /** @description The template version this workspace was created from (immutable), and the version its immutable paths show. */
+            /** @description The workspace’s current template base (changed only by an explicit upgrade), and the version its immutable paths show. */
             template: {
                 /**
                  * Format: uuid
@@ -7314,6 +7551,15 @@ export interface components {
             mode: components["schemas"]["WorkspaceMode"];
             /** @description file_first: the latest revision of the file tree (0 = the empty tree the workspace starts with; each mutating file call or execution publishes the next one; cell file responses carry it as X-Tree-Revision). Always 0 for processful workspaces. */
             tree_revision: number;
+            upgrade_available?: {
+                memory_layout: number | null;
+                guest_revision: number | null;
+                template_version: number | null;
+            } | null;
+            upgrade_pending?: {
+                [key: string]: unknown;
+            } | null;
+            computer_use: components["schemas"]["ComputerUse"];
             /**
              * Format: date-time
              * @description RFC 3339 UTC timestamp with Z.
@@ -7386,7 +7632,7 @@ export interface components {
              */
             agent_session_id: string;
             ownership_epoch: number;
-            tools: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+            tools: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
             cell_endpoint: string;
         };
         /** @description An exposed port of a workspace (contracts §39.3). Private: every request needs a credential. */
@@ -10198,7 +10444,7 @@ export interface operations {
                              * @description UUIDv7, lowercase canonical form.
                              */
                             project_id: string;
-                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                         } | null;
                     };
                 };
@@ -11000,6 +11246,107 @@ export interface operations {
             };
         };
     };
+    getV1ProjectsProjectIdRetention: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                project_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        delete_after_idle_days: number;
+                        labels?: {
+                            [key: string]: string;
+                        };
+                    } | null;
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    putV1ProjectsProjectIdRetention: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                project_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    delete_after_idle_days: number;
+                    labels?: {
+                        [key: string]: string;
+                    };
+                } | null;
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        delete_after_idle_days: number;
+                        labels?: {
+                            [key: string]: string;
+                        };
+                    } | null;
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
     getV1ProjectsProjectIdApiKeys: {
         parameters: {
             query?: {
@@ -11041,7 +11388,7 @@ export interface operations {
                              */
                             project_id: string;
                             name: string;
-                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                             /**
                              * Format: date-time
                              * @description RFC 3339 UTC timestamp with Z.
@@ -11089,7 +11436,7 @@ export interface operations {
             content: {
                 "application/json": {
                     name: string;
-                    tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                     /**
                      * Format: date-time
                      * @description RFC 3339 UTC timestamp with Z.
@@ -11125,7 +11472,7 @@ export interface operations {
                              */
                             project_id: string;
                             name: string;
-                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                             /**
                              * Format: date-time
                              * @description RFC 3339 UTC timestamp with Z.
@@ -11257,7 +11604,7 @@ export interface operations {
                              * @description UUIDv7, lowercase canonical form.
                              */
                             project_id: string;
-                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                         } | null;
                     };
                 };
@@ -12000,7 +12347,112 @@ export interface operations {
             };
         };
     };
-    getApiV1ProjectsProjectId: {
+    getApiV1ProjectsProjectId: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                project_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        /**
+                         * Format: uuid
+                         * @description UUIDv7, lowercase canonical form.
+                         */
+                        id: string;
+                        /**
+                         * Format: uuid
+                         * @description UUIDv7, lowercase canonical form.
+                         */
+                        organization_id: string;
+                        name: string;
+                        slug: string;
+                        /**
+                         * Format: date-time
+                         * @description RFC 3339 UTC timestamp with Z.
+                         */
+                        created_at: string;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    getApiV1ProjectsProjectIdRetention: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                project_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        delete_after_idle_days: number;
+                        labels?: {
+                            [key: string]: string;
+                        };
+                    } | null;
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    putApiV1ProjectsProjectIdRetention: {
         parameters: {
             query?: never;
             header?: never;
@@ -12010,7 +12462,16 @@ export interface operations {
             };
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": {
+                    delete_after_idle_days: number;
+                    labels?: {
+                        [key: string]: string;
+                    };
+                } | null;
+            };
+        };
         responses: {
             /** @description Default Response */
             200: {
@@ -12019,24 +12480,11 @@ export interface operations {
                 };
                 content: {
                     "application/json": {
-                        /**
-                         * Format: uuid
-                         * @description UUIDv7, lowercase canonical form.
-                         */
-                        id: string;
-                        /**
-                         * Format: uuid
-                         * @description UUIDv7, lowercase canonical form.
-                         */
-                        organization_id: string;
-                        name: string;
-                        slug: string;
-                        /**
-                         * Format: date-time
-                         * @description RFC 3339 UTC timestamp with Z.
-                         */
-                        created_at: string;
-                    };
+                        delete_after_idle_days: number;
+                        labels?: {
+                            [key: string]: string;
+                        };
+                    } | null;
                 };
             };
             /** @description Default Response */
@@ -12100,7 +12548,7 @@ export interface operations {
                              */
                             project_id: string;
                             name: string;
-                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                             /**
                              * Format: date-time
                              * @description RFC 3339 UTC timestamp with Z.
@@ -12148,7 +12596,7 @@ export interface operations {
             content: {
                 "application/json": {
                     name: string;
-                    tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                     /**
                      * Format: date-time
                      * @description RFC 3339 UTC timestamp with Z.
@@ -12184,7 +12632,7 @@ export interface operations {
                              */
                             project_id: string;
                             name: string;
-                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                            tool_permissions: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                             /**
                              * Format: date-time
                              * @description RFC 3339 UTC timestamp with Z.
@@ -12284,10 +12732,11 @@ export interface operations {
                     /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction. Given caps replace the stored ones (a reopen keeps an elastic workspace’s mode when elastic is the organization’s default and allocation_mode is omitted). */
                     caps?: {
                         cpu_millis?: number;
+                        /** @description Fixed: size in MiB; omitted uses the template default (template defaults.memory_mib, else manifest default_caps.memory_mib_base, else 1024), bounded by plan and template. Elastic: maximum memory promise. */
                         memory_mib?: number;
                         disk_gib?: number;
                         /**
-                         * @description Memory allocation (contracts §32): fixed boots memory_mib and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Omitted: fixed, or elastic where that is the organization’s default (a reopen then keeps the stored mode). Takes effect at the next VM start.
+                         * @description Memory allocation (contracts §32): fixed boots memory_mib (the template default when omitted) and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Omitted: fixed, or elastic where that is the organization’s default (a reopen then keeps the stored mode). Takes effect at the next VM start.
                          * @enum {string}
                          */
                         allocation_mode?: "fixed" | "elastic";
@@ -12301,7 +12750,7 @@ export interface operations {
                     project_id?: string;
                     /** @description Attribution label; one agent session per (workspace, principal, label). */
                     agent_label?: string;
-                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                     /** @description Secret names bound to the workspace (max 50, unique): injected as environment variables into every exec and PTY start (terminal sessions included), together with the call’s own `secret_refs`. Each must name a live secret this workspace may use (its project, its id, and allowed_tools including exec and pty), else 422 details.reason secret_not_available with details.names. */
                     secrets?: string[];
                     /** @description Open-time inputs of the template version (contracts §24.3): {NAME: string} for its declared text inputs. A new workspace stores each given value, else the declared default; on an existing key `inputs` replaces them all (omitted = unchanged). Secret inputs are not passed here: they bind the stored secret of the same name. 422 input_unknown (undeclared name, details.names), input_invalid (a secret input, a non-string, or a value over 4096 bytes or with CR, LF or NUL; details.names), input_required (details {names, kind}). */
@@ -12311,7 +12760,12 @@ export interface operations {
                     lifetime?: components["schemas"]["WorkspaceLifetime"];
                     /** @description adaptive (the learned timeout, default), never, or fixed:<seconds> (60..604800). Contracts §20.7. */
                     idle_policy?: string;
+                    retention?: {
+                        delete_after_idle_days: number;
+                    };
                     mode?: components["schemas"]["WorkspaceMode"];
+                    /** @description Contracts §45.1: the workspace’s computer use switch (null follows the template); set on create, replaced on an existing key when given. */
+                    computer_use?: boolean | null;
                 };
             };
         };
@@ -12327,6 +12781,8 @@ export interface operations {
                         operation: components["schemas"]["Operation"] | null;
                         cell_endpoint: string | null;
                         tool_token: components["schemas"]["ToolToken"] | null;
+                        /** @description Contracts §46.2: true when this request created the workspace (a new key, or a key whose session ended), false when it reconnected to or resumed an existing one. Of concurrent opens of one new key exactly one says true; a replay with the same Idempotency-Key repeats it. */
+                        created: boolean;
                     };
                 };
             };
@@ -12341,6 +12797,8 @@ export interface operations {
                         operation: components["schemas"]["Operation"] | null;
                         cell_endpoint: string | null;
                         tool_token: components["schemas"]["ToolToken"] | null;
+                        /** @description Contracts §46.2: true when this request created the workspace (a new key, or a key whose session ended), false when it reconnected to or resumed an existing one. Of concurrent opens of one new key exactly one says true; a replay with the same Idempotency-Key repeats it. */
+                        created: boolean;
                     };
                 };
             };
@@ -12659,6 +13117,53 @@ export interface operations {
             };
         };
     };
+    putV1WorkspacesWorkspaceIdRetention: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    delete_after_idle_days: number;
+                } | null;
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Workspace"];
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
     putV1WorkspacesWorkspaceIdIdlePolicy: {
         parameters: {
             query?: never;
@@ -12706,6 +13211,54 @@ export interface operations {
             };
         };
     };
+    putV1WorkspacesWorkspaceIdComputerUse: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description true or false overrides the template; null follows it. */
+                    enabled: boolean | null;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ComputerUse"];
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
     postV1WorkspacesWorkspaceIdSuspend: {
         parameters: {
             query?: never;
@@ -12769,7 +13322,7 @@ export interface operations {
                 "application/json": {
                     /** @description Attribution label; one agent session per (workspace, principal, label). */
                     agent_label?: string;
-                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                 };
             };
         };
@@ -12870,6 +13423,57 @@ export interface operations {
             };
         };
     };
+    postV1WorkspacesWorkspaceIdUpgrade: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @enum {string} */
+                    at?: "now" | "next_resume";
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        operation: components["schemas"]["Operation"];
+                        workspace: components["schemas"]["Workspace"];
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
     patchV1WorkspacesWorkspaceIdCaps: {
         parameters: {
             query?: never;
@@ -13043,10 +13647,11 @@ export interface operations {
                     /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction. Given caps replace the stored ones (a reopen keeps an elastic workspace’s mode when elastic is the organization’s default and allocation_mode is omitted). */
                     caps?: {
                         cpu_millis?: number;
+                        /** @description Fixed: size in MiB; omitted uses the template default (template defaults.memory_mib, else manifest default_caps.memory_mib_base, else 1024), bounded by plan and template. Elastic: maximum memory promise. */
                         memory_mib?: number;
                         disk_gib?: number;
                         /**
-                         * @description Memory allocation (contracts §32): fixed boots memory_mib and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Omitted: fixed, or elastic where that is the organization’s default (a reopen then keeps the stored mode). Takes effect at the next VM start.
+                         * @description Memory allocation (contracts §32): fixed boots memory_mib (the template default when omitted) and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Omitted: fixed, or elastic where that is the organization’s default (a reopen then keeps the stored mode). Takes effect at the next VM start.
                          * @enum {string}
                          */
                         allocation_mode?: "fixed" | "elastic";
@@ -13056,7 +13661,7 @@ export interface operations {
                     lifetime?: components["schemas"]["WorkspaceLifetime"];
                     /** @description Attribution label; one agent session per (workspace, principal, label). */
                     agent_label?: string;
-                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                 };
             };
         };
@@ -13306,7 +13911,7 @@ export interface operations {
                 limit?: number;
                 cursor?: string;
                 state?: "queued" | "capacity_pending" | "running" | "succeeded" | "failed" | "canceled";
-                kind?: "open" | "suspend" | "resume" | "fork" | "snapshot" | "restore" | "delete" | "move" | "resize" | "volume_create" | "volume_attach" | "volume_detach" | "volume_delete" | "reset" | "layer_snapshot";
+                kind?: "open" | "suspend" | "resume" | "fork" | "snapshot" | "restore" | "delete" | "move" | "resize" | "upgrade" | "volume_create" | "volume_attach" | "volume_detach" | "volume_delete" | "reset" | "layer_snapshot";
             };
             header?: never;
             path: {
@@ -13364,7 +13969,7 @@ export interface operations {
                 "application/json": {
                     /** @description Attribution label; one agent session per (workspace, principal, label). */
                     agent_label?: string;
-                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                 };
             };
         };
@@ -13568,10 +14173,11 @@ export interface operations {
                     /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction. Given caps replace the stored ones (a reopen keeps an elastic workspace’s mode when elastic is the organization’s default and allocation_mode is omitted). */
                     caps?: {
                         cpu_millis?: number;
+                        /** @description Fixed: size in MiB; omitted uses the template default (template defaults.memory_mib, else manifest default_caps.memory_mib_base, else 1024), bounded by plan and template. Elastic: maximum memory promise. */
                         memory_mib?: number;
                         disk_gib?: number;
                         /**
-                         * @description Memory allocation (contracts §32): fixed boots memory_mib and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Omitted: fixed, or elastic where that is the organization’s default (a reopen then keeps the stored mode). Takes effect at the next VM start.
+                         * @description Memory allocation (contracts §32): fixed boots memory_mib (the template default when omitted) and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Omitted: fixed, or elastic where that is the organization’s default (a reopen then keeps the stored mode). Takes effect at the next VM start.
                          * @enum {string}
                          */
                         allocation_mode?: "fixed" | "elastic";
@@ -13585,7 +14191,7 @@ export interface operations {
                     project_id?: string;
                     /** @description Attribution label; one agent session per (workspace, principal, label). */
                     agent_label?: string;
-                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                     /** @description Secret names bound to the workspace (max 50, unique): injected as environment variables into every exec and PTY start (terminal sessions included), together with the call’s own `secret_refs`. Each must name a live secret this workspace may use (its project, its id, and allowed_tools including exec and pty), else 422 details.reason secret_not_available with details.names. */
                     secrets?: string[];
                     /** @description Open-time inputs of the template version (contracts §24.3): {NAME: string} for its declared text inputs. A new workspace stores each given value, else the declared default; on an existing key `inputs` replaces them all (omitted = unchanged). Secret inputs are not passed here: they bind the stored secret of the same name. 422 input_unknown (undeclared name, details.names), input_invalid (a secret input, a non-string, or a value over 4096 bytes or with CR, LF or NUL; details.names), input_required (details {names, kind}). */
@@ -13595,7 +14201,12 @@ export interface operations {
                     lifetime?: components["schemas"]["WorkspaceLifetime"];
                     /** @description adaptive (the learned timeout, default), never, or fixed:<seconds> (60..604800). Contracts §20.7. */
                     idle_policy?: string;
+                    retention?: {
+                        delete_after_idle_days: number;
+                    };
                     mode?: components["schemas"]["WorkspaceMode"];
+                    /** @description Contracts §45.1: the workspace’s computer use switch (null follows the template); set on create, replaced on an existing key when given. */
+                    computer_use?: boolean | null;
                 };
             };
         };
@@ -13611,6 +14222,8 @@ export interface operations {
                         operation: components["schemas"]["Operation"] | null;
                         cell_endpoint: string | null;
                         tool_token: components["schemas"]["ToolToken"] | null;
+                        /** @description Contracts §46.2: true when this request created the workspace (a new key, or a key whose session ended), false when it reconnected to or resumed an existing one. Of concurrent opens of one new key exactly one says true; a replay with the same Idempotency-Key repeats it. */
+                        created: boolean;
                     };
                 };
             };
@@ -13625,6 +14238,8 @@ export interface operations {
                         operation: components["schemas"]["Operation"] | null;
                         cell_endpoint: string | null;
                         tool_token: components["schemas"]["ToolToken"] | null;
+                        /** @description Contracts §46.2: true when this request created the workspace (a new key, or a key whose session ended), false when it reconnected to or resumed an existing one. Of concurrent opens of one new key exactly one says true; a replay with the same Idempotency-Key repeats it. */
+                        created: boolean;
                     };
                 };
             };
@@ -13767,7 +14382,92 @@ export interface operations {
             };
         };
     };
-    getApiV1WorkspacesWorkspaceId: {
+    getApiV1WorkspacesWorkspaceId: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["Workspace"];
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    deleteApiV1WorkspacesWorkspaceId: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Default Response */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        operation: components["schemas"]["Operation"];
+                        workspace: components["schemas"]["Workspace"];
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    getApiV1WorkspacesWorkspaceIdInputs: {
         parameters: {
             query?: never;
             header?: never;
@@ -13785,7 +14485,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["Workspace"];
+                    "application/json": components["schemas"]["WorkspaceInputs"];
                 };
             };
             /** @description Default Response */
@@ -13808,7 +14508,7 @@ export interface operations {
             };
         };
     };
-    deleteApiV1WorkspacesWorkspaceId: {
+    putApiV1WorkspacesWorkspaceIdLabels: {
         parameters: {
             query?: never;
             header?: never;
@@ -13818,18 +14518,24 @@ export interface operations {
             };
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @description Searchable workspace metadata; not secrets. At most 50 labels. */
+                    labels: {
+                        [key: string]: string;
+                    };
+                };
+            };
+        };
         responses: {
             /** @description Default Response */
-            202: {
+            200: {
                 headers: {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": {
-                        operation: components["schemas"]["Operation"];
-                        workspace: components["schemas"]["Workspace"];
-                    };
+                    "application/json": components["schemas"]["Workspace"];
                 };
             };
             /** @description Default Response */
@@ -13852,7 +14558,7 @@ export interface operations {
             };
         };
     };
-    getApiV1WorkspacesWorkspaceIdInputs: {
+    putApiV1WorkspacesWorkspaceIdRetention: {
         parameters: {
             query?: never;
             header?: never;
@@ -13862,7 +14568,13 @@ export interface operations {
             };
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": {
+                    delete_after_idle_days: number;
+                } | null;
+            };
+        };
         responses: {
             /** @description Default Response */
             200: {
@@ -13870,7 +14582,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["WorkspaceInputs"];
+                    "application/json": components["schemas"]["Workspace"];
                 };
             };
             /** @description Default Response */
@@ -13893,7 +14605,7 @@ export interface operations {
             };
         };
     };
-    putApiV1WorkspacesWorkspaceIdLabels: {
+    putApiV1WorkspacesWorkspaceIdIdlePolicy: {
         parameters: {
             query?: never;
             header?: never;
@@ -13906,10 +14618,7 @@ export interface operations {
         requestBody: {
             content: {
                 "application/json": {
-                    /** @description Searchable workspace metadata; not secrets. At most 50 labels. */
-                    labels: {
-                        [key: string]: string;
-                    };
+                    idle_policy: string | null;
                 };
             };
         };
@@ -13943,7 +14652,7 @@ export interface operations {
             };
         };
     };
-    putApiV1WorkspacesWorkspaceIdIdlePolicy: {
+    putApiV1WorkspacesWorkspaceIdComputerUse: {
         parameters: {
             query?: never;
             header?: never;
@@ -13956,7 +14665,8 @@ export interface operations {
         requestBody: {
             content: {
                 "application/json": {
-                    idle_policy: string | null;
+                    /** @description true or false overrides the template; null follows it. */
+                    enabled: boolean | null;
                 };
             };
         };
@@ -13967,7 +14677,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["Workspace"];
+                    "application/json": components["schemas"]["ComputerUse"];
                 };
             };
             /** @description Default Response */
@@ -14053,7 +14763,7 @@ export interface operations {
                 "application/json": {
                     /** @description Attribution label; one agent session per (workspace, principal, label). */
                     agent_label?: string;
-                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                 };
             };
         };
@@ -14154,6 +14864,57 @@ export interface operations {
             };
         };
     };
+    postApiV1WorkspacesWorkspaceIdUpgrade: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                workspace_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    /** @enum {string} */
+                    at?: "now" | "next_resume";
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            202: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        operation: components["schemas"]["Operation"];
+                        workspace: components["schemas"]["Workspace"];
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
     patchApiV1WorkspacesWorkspaceIdCaps: {
         parameters: {
             query?: never;
@@ -14327,10 +15088,11 @@ export interface operations {
                     /** @description Optional user caps; the ceiling is min(template, cap, plan). Absent fields add no restriction. Given caps replace the stored ones (a reopen keeps an elastic workspace’s mode when elastic is the organization’s default and allocation_mode is omitted). */
                     caps?: {
                         cpu_millis?: number;
+                        /** @description Fixed: size in MiB; omitted uses the template default (template defaults.memory_mib, else manifest default_caps.memory_mib_base, else 1024), bounded by plan and template. Elastic: maximum memory promise. */
                         memory_mib?: number;
                         disk_gib?: number;
                         /**
-                         * @description Memory allocation (contracts §32): fixed boots memory_mib and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Omitted: fixed, or elastic where that is the organization’s default (a reopen then keeps the stored mode). Takes effect at the next VM start.
+                         * @description Memory allocation (contracts §32): fixed boots memory_mib (the template default when omitted) and holds it; elastic makes memory_mib a promise: the VM holds memory_mib_held while idle and is grown towards the promise when a command needs it. Needs the elastic memory entitlement (422 details.reason allocation_mode_not_available). A promise that does not exceed the held floor by at least 512 MiB is fixed at the promise (the response caps say which). Omitted: fixed, or elastic where that is the organization’s default (a reopen then keeps the stored mode). Takes effect at the next VM start.
                          * @enum {string}
                          */
                         allocation_mode?: "fixed" | "elastic";
@@ -14340,7 +15102,7 @@ export interface operations {
                     lifetime?: components["schemas"]["WorkspaceLifetime"];
                     /** @description Attribution label; one agent session per (workspace, principal, label). */
                     agent_label?: string;
-                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                 };
             };
         };
@@ -14590,7 +15352,7 @@ export interface operations {
                 limit?: number;
                 cursor?: string;
                 state?: "queued" | "capacity_pending" | "running" | "succeeded" | "failed" | "canceled";
-                kind?: "open" | "suspend" | "resume" | "fork" | "snapshot" | "restore" | "delete" | "move" | "resize" | "volume_create" | "volume_attach" | "volume_detach" | "volume_delete" | "reset" | "layer_snapshot";
+                kind?: "open" | "suspend" | "resume" | "fork" | "snapshot" | "restore" | "delete" | "move" | "resize" | "upgrade" | "volume_create" | "volume_attach" | "volume_detach" | "volume_delete" | "reset" | "layer_snapshot";
             };
             header?: never;
             path: {
@@ -14648,7 +15410,7 @@ export interface operations {
                 "application/json": {
                     /** @description Attribution label; one agent session per (workspace, principal, label). */
                     agent_label?: string;
-                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser")[];
+                    tools?: ("exec" | "files" | "pty" | "process" | "git" | "browser" | "computer")[];
                 };
             };
         };
@@ -14795,8 +15557,11 @@ export interface operations {
                          * @description UUIDv7, lowercase canonical form.
                          */
                         workspace_id: string;
-                        /** @enum {string} */
-                        tool: "exec" | "files" | "pty" | "process" | "git" | "browser";
+                        /**
+                         * @description computer (contracts §45): the workspace desktop; a tool token carries it only while the workspace’s computer use is on.
+                         * @enum {string}
+                         */
+                        tool: "exec" | "files" | "pty" | "process" | "git" | "browser" | "computer";
                         /**
                          * Format: uuid
                          * @description UUIDv7, lowercase canonical form.
@@ -15120,6 +15885,10 @@ export interface operations {
                      * @default 86400
                      */
                     ttl_seconds?: number;
+                    /** @description Embed in these 1–10 canonical HTTPS origins, at most 2048 total origin characters. */
+                    embed?: {
+                        origins: string[];
+                    };
                     /** @description Where the link lands (default `/`): a path starting with one `/`, printable ASCII, query allowed. */
                     path?: string;
                 };
@@ -15474,6 +16243,10 @@ export interface operations {
                      * @default 86400
                      */
                     ttl_seconds?: number;
+                    /** @description Embed in these 1–10 canonical HTTPS origins, at most 2048 total origin characters. */
+                    embed?: {
+                        origins: string[];
+                    };
                     /** @description Where the link lands (default `/`): a path starting with one `/`, printable ASCII, query allowed. */
                     path?: string;
                 };
@@ -16570,6 +17343,8 @@ export interface operations {
                                 memory_mib: number | null;
                                 idle_policy: string | null;
                             };
+                            /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                            computer_use: boolean;
                             open_version: {
                                 /**
                                  * Format: uuid
@@ -16787,6 +17562,8 @@ export interface operations {
                             memory_mib: number | null;
                             idle_policy: string | null;
                         };
+                        /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                        computer_use: boolean;
                         open_version: {
                             /**
                              * Format: uuid
@@ -17135,6 +17912,8 @@ export interface operations {
                                 memory_mib: number | null;
                                 idle_policy: string | null;
                             };
+                            /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                            computer_use: boolean;
                             open_version: {
                                 /**
                                  * Format: uuid
@@ -17350,6 +18129,8 @@ export interface operations {
                             memory_mib: number | null;
                             idle_policy: string | null;
                         };
+                        /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                        computer_use: boolean;
                         open_version: {
                             /**
                              * Format: uuid
@@ -17652,6 +18433,104 @@ export interface operations {
             };
         };
     };
+    putV1OrganizationsOrganizationIdTemplatesSlugComputerUse: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                organization_id: string;
+                slug: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    enabled: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        enabled: boolean;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
+    putV1TemplatesSlugComputerUse: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                slug: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    enabled: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        enabled: boolean;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
     getV1OrganizationsOrganizationIdTemplateBuilds: {
         parameters: {
             query?: {
@@ -19735,6 +20614,8 @@ export interface operations {
                             memory_mib: number | null;
                             idle_policy: string | null;
                         };
+                        /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                        computer_use: boolean;
                         open_version: {
                             /**
                              * Format: uuid
@@ -20081,6 +20962,8 @@ export interface operations {
                             memory_mib: number | null;
                             idle_policy: string | null;
                         };
+                        /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                        computer_use: boolean;
                         open_version: {
                             /**
                              * Format: uuid
@@ -20432,6 +21315,8 @@ export interface operations {
                                 memory_mib: number | null;
                                 idle_policy: string | null;
                             };
+                            /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                            computer_use: boolean;
                             open_version: {
                                 /**
                                  * Format: uuid
@@ -20649,6 +21534,8 @@ export interface operations {
                             memory_mib: number | null;
                             idle_policy: string | null;
                         };
+                        /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                        computer_use: boolean;
                         open_version: {
                             /**
                              * Format: uuid
@@ -20951,6 +21838,56 @@ export interface operations {
             };
         };
     };
+    putApiV1OrganizationsOrganizationIdTemplatesSlugComputerUse: {
+        parameters: {
+            query?: never;
+            header?: never;
+            path: {
+                /** @description UUIDv7, lowercase canonical form. */
+                organization_id: string;
+                slug: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "application/json": {
+                    enabled: boolean;
+                };
+            };
+        };
+        responses: {
+            /** @description Default Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": {
+                        enabled: boolean;
+                    };
+                };
+            };
+            /** @description Default Response */
+            "4XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+            /** @description Default Response */
+            "5XX": {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["ErrorBody"];
+                };
+            };
+        };
+    };
     getApiV1OrganizationsOrganizationIdTemplateBuilds: {
         parameters: {
             query?: {
@@ -22854,6 +23791,8 @@ export interface operations {
                             memory_mib: number | null;
                             idle_policy: string | null;
                         };
+                        /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                        computer_use: boolean;
                         open_version: {
                             /**
                              * Format: uuid
@@ -23200,6 +24139,8 @@ export interface operations {
                             memory_mib: number | null;
                             idle_policy: string | null;
                         };
+                        /** @description Contracts §45.1: the template’s computer use switch for its workspaces (a workspace may override it). Set by the owning organization; platform templates are off. */
+                        computer_use: boolean;
                         open_version: {
                             /**
                              * Format: uuid
@@ -26332,8 +27273,11 @@ export interface operations {
                                  */
                                 id: string;
                             };
-                            /** @enum {string} */
-                            tool: "exec" | "files" | "pty" | "process" | "git" | "browser";
+                            /**
+                             * @description computer (contracts §45): the workspace desktop; a tool token carries it only while the workspace’s computer use is on.
+                             * @enum {string}
+                             */
+                            tool: "exec" | "files" | "pty" | "process" | "git" | "browser" | "computer";
                             outcome: "granted" | "denied" | "failed";
                             reason: string | null;
                             ownership_epoch: number | null;
@@ -26384,8 +27328,11 @@ export interface operations {
                      * @description UUIDv7, lowercase canonical form.
                      */
                     workspace_id: string;
-                    /** @enum {string} */
-                    tool: "exec" | "files" | "pty" | "process" | "git" | "browser";
+                    /**
+                     * @description computer (contracts §45): the workspace desktop; a tool token carries it only while the workspace’s computer use is on.
+                     * @enum {string}
+                     */
+                    tool: "exec" | "files" | "pty" | "process" | "git" | "browser" | "computer";
                     /** @description The start’s `secret_refs` together with the workspace’s bound names (app.workspace_secret_bindings), each name once: at most 50 + 50. */
                     names: string[];
                     /** @description The cell’s exec/PTY session id, recorded for correlation. */
@@ -26406,8 +27353,11 @@ export interface operations {
                          * @description UUIDv7, lowercase canonical form.
                          */
                         workspace_id: string;
-                        /** @enum {string} */
-                        tool: "exec" | "files" | "pty" | "process" | "git" | "browser";
+                        /**
+                         * @description computer (contracts §45): the workspace desktop; a tool token carries it only while the workspace’s computer use is on.
+                         * @enum {string}
+                         */
+                        tool: "exec" | "files" | "pty" | "process" | "git" | "browser" | "computer";
                         /**
                          * Format: uuid
                          * @description UUIDv7, lowercase canonical form.
@@ -27420,8 +28370,11 @@ export interface operations {
                                  */
                                 id: string;
                             };
-                            /** @enum {string} */
-                            tool: "exec" | "files" | "pty" | "process" | "git" | "browser";
+                            /**
+                             * @description computer (contracts §45): the workspace desktop; a tool token carries it only while the workspace’s computer use is on.
+                             * @enum {string}
+                             */
+                            tool: "exec" | "files" | "pty" | "process" | "git" | "browser" | "computer";
                             outcome: "granted" | "denied" | "failed";
                             reason: string | null;
                             ownership_epoch: number | null;
@@ -35950,7 +36903,7 @@ export interface operations {
         parameters: {
             query?: {
                 state?: "queued" | "capacity_pending" | "running" | "failed" | "canceled";
-                kind?: "open" | "suspend" | "resume" | "fork" | "snapshot" | "restore" | "delete" | "move" | "resize" | "volume_create" | "volume_attach" | "volume_detach" | "volume_delete" | "reset" | "layer_snapshot";
+                kind?: "open" | "suspend" | "resume" | "fork" | "snapshot" | "restore" | "delete" | "move" | "resize" | "upgrade" | "volume_create" | "volume_attach" | "volume_detach" | "volume_delete" | "reset" | "layer_snapshot";
                 /** @description UUIDv7, lowercase canonical form. */
                 organization_id?: string;
                 /** @description UUIDv7, lowercase canonical form. */
@@ -37944,7 +38897,7 @@ export interface operations {
                 /** @description latency: per operation kind; psi: fleet and top hosts. */
                 metric: "latency" | "psi";
                 window?: "7d" | "30d" | "90d";
-                kind?: "open" | "suspend" | "resume" | "fork" | "snapshot" | "restore" | "delete" | "move" | "resize" | "volume_create" | "volume_attach" | "volume_detach" | "volume_delete" | "reset" | "layer_snapshot";
+                kind?: "open" | "suspend" | "resume" | "fork" | "snapshot" | "restore" | "delete" | "move" | "resize" | "upgrade" | "volume_create" | "volume_attach" | "volume_detach" | "volume_delete" | "reset" | "layer_snapshot";
             };
             header?: never;
             path?: never;
@@ -38700,15 +39653,9 @@ export interface operations {
     };
     getApiV1OauthAuthorization: {
         parameters: {
-            query?: {
-                response_type?: string;
-                client_id?: string;
-                redirect_uri?: string;
-                code_challenge?: string;
-                code_challenge_method?: string;
-                scope?: string;
-                state?: string;
-                resource?: string;
+            query: {
+                /** @description The `request` parameter of /connect: the pending authorization request /oauth/authorize stored. */
+                request: string;
             };
             header?: never;
             path?: never;
@@ -38755,19 +39702,8 @@ export interface operations {
         requestBody: {
             content: {
                 "application/json": {
-                    /** @description The authorization request exactly as /oauth/authorize received it (RFC 6749 §4.1.1, PKCE S256, RFC 8707 resource). */
-                    request: {
-                        response_type?: string;
-                        client_id?: string;
-                        redirect_uri?: string;
-                        code_challenge?: string;
-                        code_challenge_method?: string;
-                        scope?: string;
-                        state?: string;
-                        resource?: string;
-                    } & {
-                        [key: string]: unknown;
-                    };
+                    /** @description The `request` parameter of /connect: the pending authorization request /oauth/authorize stored. */
+                    request: string;
                     decision: "approve" | "deny";
                     /**
                      * Format: uuid