@standards/schema 1.0.0-alpha.395 → 1.0.0-alpha.397

package/dist/api/index.d.mts

@@ -2,7 +2,7 @@
 import { SchemaErrorCode, ValidationError, ValidationErrorDetail } from "../exceptions-CeP0QxYo.mjs";
 import { AgentDefinitionAudience, ObjectDefinition, ObjectRecord, PageAudience, RecordAudience } from "../objects-q1d_wU_1.mjs";
 import { Attribute } from "../attributes-ybI2RY0p.mjs";
-import { AIAvailableModel, AIGenerationResult, AIGenerationType, Actor, ActorStatus, ActorType, AgentAsideExchange, AgentConversationOverview, AgentDefinition, AgentDefinitionActivity, AgentDefinitionDailyActivity, AgentMemoryView, AgentMessageAttachment, AgentRun, AgentSession, AgentSessionHistoryPage, AgentSessionLink, AgentSessionMessage, AgentSessionMode, AgentTodoPlanView, AgentToolCatalog, AgentTriggerDefinition, AggregateGroupByInput, ApiKey, ApiKeyWithSecret, ArchitectProjection, ArtifactQuote, ArtifactRevisionView, AuditListOptions, AuditLogEntry, AuthorizedGlobalSearchResult, AuthorizedSearchPage, AvailableBundleSummary, BinaryResponse, BrowserProfileView, BundleAddPlan, BundleAddResult, ClassifyEmailResult, CloudBrowserLiveView, CollectionResponse, ConnectionView, ConnectorProvidersResult, ConnectorTriggerMatch, CreateAgentTriggerResult, CreatePermissionInput, CreateUserProfile, DictationAdmission, DictationCapabilities, DictationUsageSummary, Document, DocumentFile, DocumentRecordOwnerPage, DownloadedFile, DraftAppendCommand, DraftCommandGuard, DraftPublishCommand, EffectivePermissions, EmailCategory, EmailCategoryUsage, EmailSenderRule, EmailVerdict, EnvVarEntry, Environment, EnvironmentDetail, EnvironmentHarnessId, EnvironmentList, File, FileUrlsResponse, FilterGenerationInput, FormDefinition, FormRow, FormStatus, FormSubmission, FormulaGenerationInput, GeocodingAutocompleteParams, GeocodingSuggestion, GithubTriggerSender, GlobalSearchResultItem, HarnessModelList, HttpMethod, ImageModelCatalog, InstalledBundleSummary, LastPublication, LastPublishError, LoginSecretEntry, LogoSearchCandidate, MailDraft, MailDraftAttachment, MailboxAccount, MailboxCursor, MailboxEmail, MailboxListResponse, MailboxQuery, MailboxReadState, MailboxThreadDetail, McpCatalogEntry, McpOAuthAttemptStarted, McpOAuthAttemptView, McpOAuthCompletionMode, McpServerView, Member, MentionReference, ModelDefinition, MutationReceipt, MyPreferences, NativeToolGroup, NewsBody, NewsIndex, NotificationArchiveAllResult, NotificationCounts, NotificationListParams, NotificationListResult, NotificationWithRecipient, ObjectPermissions, Operation, OperationDefinition, OperationInput, OperationObjectPermission, OperationOutput, OperationParsedInput, OperationPermission, OperationResult, OperationStatus, OperationThrottle, OperationUpload, OutputType, PageData, PageRead, PageSummary, PathParams, Permission, PreferenceEntry, ProposalRevision, PublishBlocker, QuotaState, RecipientSuggestion, RecordAggregates, RecordDocuments, RecordDriveChild, RecordDriveChildrenPage, RecordDriveSearchResult, RecordGraphNodeRef, RecordGraphRequest, RecordGraphResponse, RecordOperationResult, RegexGenerationInput, RelationScope, ResolvedRecentActivity, Role, SchemaGroupList, SchemaState, SecretEntry, SessionApprovalMode, SessionImageUsage, SlackTriggerSender, StartConnectorAuthResult, SubmitOutcome, SyncBundleInput, SyncBundleResult, SystemPermissions, TenantInvitation, TenantSettingsResponse, TriggerEventType, UploadedPart, UsageReport, UserProfile, UserStatus, ViewOperation, WalletState, meetingsOperations, meetingsQuery, meetingsQueryFields, operation, operationGroup, recordMeetingsBody, type } from "../index-DCSFAjru.mjs";
+import { AIAvailableModel, AIGenerationResult, AIGenerationType, AccessCapabilities, AccessLevel, Actor, ActorStatus, ActorType, AgentAsideExchange, AgentConversationOverview, AgentDefinition, AgentDefinitionActivity, AgentDefinitionDailyActivity, AgentMemoryView, AgentMessageAttachment, AgentRun, AgentSession, AgentSessionHistoryPage, AgentSessionLink, AgentSessionMessage, AgentSessionMode, AgentTodoPlanView, AgentToolCatalog, AgentTriggerDefinition, AggregateGroupByInput, ApiKey, ApiKeyWithSecret, ArchitectProjection, ArtifactQuote, ArtifactRevisionView, AuditListOptions, AuditLogEntry, AuthorizedGlobalSearchResult, AuthorizedSearchPage, AvailableBundleSummary, BinaryResponse, BrowserProfileView, BundleAddPlan, BundleAddResult, ClassifyEmailResult, CloudBrowserLiveView, CollectionResponse, ConnectionView, ConnectorProvidersResult, ConnectorTriggerMatch, CreateAgentTriggerResult, CreatePermissionInput, CreateUserProfile, DictationAdmission, DictationCapabilities, DictationUsageSummary, Document, DocumentFile, DocumentRecordOwnerPage, DownloadedFile, DraftAppendCommand, DraftCommandGuard, DraftPublishCommand, EffectivePermissions, EmailCategory, EmailCategoryUsage, EmailSenderRule, EmailVerdict, EnvVarEntry, Environment, EnvironmentDetail, EnvironmentHarnessId, EnvironmentList, File, FileUrlsResponse, FilterGenerationInput, FormDefinition, FormRow, FormStatus, FormSubmission, FormulaGenerationInput, GeocodingAutocompleteParams, GeocodingSuggestion, GithubTriggerSender, GlobalSearchResultItem, HarnessModelList, HttpMethod, ImageModelCatalog, InstalledBundleSummary, LastPublication, LastPublishError, LoginSecretEntry, LogoSearchCandidate, MEETINGS_MAX_ONLY_CONNECTIONS, MailDraft, MailDraftAttachment, MailboxAccount, MailboxCursor, MailboxEmail, MailboxListResponse, MailboxQuery, MailboxReadState, MailboxThreadDetail, McpCatalogEntry, McpOAuthAttemptStarted, McpOAuthAttemptView, McpOAuthCompletionMode, McpServerView, Member, MentionReference, ModelDefinition, MutationReceipt, MyPreferences, NativeToolGroup, NewsBody, NewsIndex, NotificationArchiveAllResult, NotificationCounts, NotificationListParams, NotificationListResult, NotificationWithRecipient, ObjectPermissions, Operation, OperationDefinition, OperationInput, OperationObjectPermission, OperationOutput, OperationParsedInput, OperationPermission, OperationResult, OperationStatus, OperationThrottle, OperationUpload, OutputType, PageData, PageRead, PageSummary, PathParams, Permission, PreferenceEntry, ProposalRevision, PublishBlocker, QuotaState, RecipientSuggestion, RecordAggregates, RecordDocuments, RecordDriveChild, RecordDriveChildrenPage, RecordDriveSearchResult, RecordGraphNodeRef, RecordGraphRequest, RecordGraphResponse, RecordOperationResult, RegexGenerationInput, RelationScope, ResolvedRecentActivity, Role, SchemaGroupList, SchemaState, SecretEntry, SessionApprovalMode, SessionImageUsage, SlackTriggerSender, StartConnectorAuthResult, SubmitOutcome, SyncBundleInput, SyncBundleResult, SystemPermissions, TenantInvitation, TenantSettingsResponse, TriggerEventType, UploadedPart, UsageReport, UserProfile, UserStatus, ViewOperation, WalletState, meetingsOperations, meetingsQuery, meetingsQueryFields, operation, operationGroup, recordMeetingsBody, type } from "../index-DpDZ-UoW.mjs";
 import { CollectionContentSource, FilterState, RecordQueryDefinition, SortRule, ViewRead } from "../all-BMhGZOJ4.mjs";
 import { AddAttributeInput, CreateCustomObjectInput, RelationOption, RelationOptionsResponse, UpdateObjectInput } from "../index-bLYmzLtL.mjs";
 import * as z$2 from "zod";
@@ -4528,8 +4528,8 @@ export declare const filesOperations: {
  * query strings to the service unparsed.
  */
 export declare const listDocumentsQuery: z$2.ZodObject<{
-  limit: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>>>;
-  offset: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>>>;
+  limit: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>, unknown>>;
+  offset: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>, unknown>>;
 }, z$2.core.$strip>;
 /**
  * `POST /documents` — the document's own fields plus the record edge it is
@@ -4559,8 +4559,8 @@ export type CreateDocumentBody = z$2.infer<typeof createDocumentBody>;
  * the same bounds for every other caller. Unknown keys are dropped, not refused.
  */
 export declare const documentOwnersQuery: z$2.ZodObject<{
-  limit: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>>>;
-  offset: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>>>;
+  limit: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>, unknown>>;
+  offset: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>, unknown>>;
   q: z$2.ZodOptional<z$2.ZodString>;
   includeDrives: z$2.ZodOptional<z$2.ZodString>;
   ids: z$2.ZodOptional<z$2.ZodString>;
@@ -4597,8 +4597,8 @@ export declare const documentsOperations: {
     readonly method: "GET";
     readonly path: "/documents";
     readonly input: z$2.ZodObject<{
-      limit: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>>>;
-      offset: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>>>;
+      limit: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>, unknown>>;
+      offset: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>, unknown>>;
     }, z$2.core.$strip>;
     readonly output: OutputType<Document[]>;
     readonly permission: readonly ["documents", "read"];
@@ -4612,8 +4612,8 @@ export declare const documentsOperations: {
     readonly method: "GET";
     readonly path: "/documents/record-owners";
     readonly input: z$2.ZodObject<{
-      limit: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>>>;
-      offset: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>>>;
+      limit: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>, unknown>>;
+      offset: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>, unknown>>;
       q: z$2.ZodOptional<z$2.ZodString>;
       includeDrives: z$2.ZodOptional<z$2.ZodString>;
       ids: z$2.ZodOptional<z$2.ZodString>;
@@ -4800,7 +4800,7 @@ export declare const recordDriveChildrenPageQuery: z$2.ZodObject<{
     "date-asc": "date-asc";
   }>>;
   cursor: z$2.ZodOptional<z$2.ZodString>;
-  limit: z$2.ZodPreprocess<z$2.ZodNumber>;
+  limit: z$2.ZodPreprocess<z$2.ZodNumber, unknown>;
 }, z$2.core.$strip>;
 export type RecordDriveChildrenPageQuery = z$2.infer<typeof recordDriveChildrenPageQuery>;
 /**
@@ -4892,7 +4892,7 @@ export declare const foldersOperations: {
         "date-asc": "date-asc";
       }>>;
       cursor: z$2.ZodOptional<z$2.ZodString>;
-      limit: z$2.ZodPreprocess<z$2.ZodNumber>;
+      limit: z$2.ZodPreprocess<z$2.ZodNumber, unknown>;
     }, z$2.core.$strip>;
     readonly output: OutputType<RecordDriveChildrenPage>;
   }>;
@@ -9946,7 +9946,7 @@ export declare const setSessionWorkPostureBody: z$2.ZodObject<{
 export declare const renameSessionInput: z$2.ZodPreprocess<z$2.ZodObject<{
   name: z$2.ZodString;
   id: z$2.ZodString;
-}, z$2.core.$strict>>;
+}, z$2.core.$strict>, unknown>;
 /** The inference patch of one session: at least one override, `null` clears. */
 export declare const sessionInferenceOverridesInput: z$2.ZodObject<{
   model: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodObject<{
@@ -10290,7 +10290,7 @@ export declare const agentSessionsOperations: {
     readonly input: z$2.ZodPreprocess<z$2.ZodObject<{
       name: z$2.ZodString;
       id: z$2.ZodString;
-    }, z$2.core.$strict>>;
+    }, z$2.core.$strict>, unknown>;
     readonly output: OutputType<AgentSession>;
     readonly permission: readonly ["agents", "read"];
     readonly actor: "required";
@@ -12004,6 +12004,102 @@ export declare const devicesOperations: {
   }>;
 };
 //#endregion
+//#region src/api/connected-apps.operations.d.ts
+/** A browser carried by an extension connection; it disconnects with its connection, through `connectedApps.revoke`. */
+export interface ConnectedAppBrowser {
+  deviceId: string;
+  name: string;
+  lastSeenAt: string | null;
+}
+/** One OAuth connection of the caller, on one of their workspaces. */
+export interface ConnectedAppView {
+  grantId: string;
+  clientId: string;
+  clientName: string;
+  /** The host of an HTTPS `clientId` (a client metadata document); null otherwise. */
+  verifiedHost: string | null;
+  /** `extension` for the browser extension (the devices resource), `mcp` for every other client. */
+  kind: "mcp" | "extension";
+  tenantId: string;
+  workspaceName: string;
+  /**
+   * Null for the extension, which has no level, and for a connection whose
+   * scopes match no level (an earlier consent): it reads as custom until the
+   * person picks one.
+   */
+  level: AccessLevel | null;
+  /** The levels the caller's role and the client's request allow; empty for the extension. */
+  selectableLevels: AccessLevel[];
+  /** Each level not selectable, with why: the role lacks it, or the client never requested it. Empty for the extension. */
+  unavailableLevels: {
+    level: AccessLevel;
+    reason: "role" | "notRequested";
+  }[];
+  /** What the connection can do: what its scopes grant, as far as the caller's role allows. */
+  granted: (keyof AccessCapabilities)[];
+  /** Capabilities the connection's scopes grant that the caller's role lacks. */
+  withheld: (keyof AccessCapabilities)[];
+  createdAt: string;
+  lastUsedAt: string | null;
+  browsers: ConnectedAppBrowser[];
+}
+/** An oidc-provider grant id: an opaque string, not a UUID. */
+export declare const connectedAppGrantId: z$2.ZodString;
+export declare const setConnectionLevelBody: z$2.ZodObject<{
+  level: z$2.ZodEnum<{
+    read: "read";
+    full: "full";
+    write: "write";
+  }>;
+}, z$2.core.$strict>;
+export type SetConnectionLevelBody = z$2.infer<typeof setConnectionLevelBody>;
+/**
+ * The caller's OAuth connections across every workspace they belong to.
+ * Served by the host's `ConnectedAppsController` (a person's session only:
+ * the controller refuses API keys, and the host's session validator refuses
+ * OAuth tokens), so these operations have no runtime handler.
+ */
+export declare const connectedAppsOperations: {
+  list: Operation<{
+    readonly name: "connectedApps.list";
+    readonly method: "GET";
+    readonly path: "/connected-apps";
+    readonly input: z$2.ZodObject<{}, z$2.core.$strip>;
+    readonly output: OutputType<{
+      data: ConnectedAppView[];
+    }>;
+  }>;
+  /** Changes the level in place: the next request of the connection carries it. */
+  setLevel: Operation<{
+    readonly name: "connectedApps.setLevel";
+    readonly method: "PATCH";
+    readonly path: "/connected-apps/:grantId";
+    readonly input: z$2.ZodObject<{
+      level: z$2.ZodEnum<{
+        read: "read";
+        full: "full";
+        write: "write";
+      }>;
+      grantId: z$2.ZodString;
+    }, z$2.core.$strict>;
+    readonly output: OutputType<{
+      success: true;
+    }>;
+  }>;
+  /** Revokes the connection, with the browsers it carries. */
+  revoke: Operation<{
+    readonly name: "connectedApps.revoke";
+    readonly method: "DELETE";
+    readonly path: "/connected-apps/:grantId";
+    readonly input: z$2.ZodObject<{
+      grantId: z$2.ZodString;
+    }, z$2.core.$strip>;
+    readonly output: OutputType<{
+      success: true;
+    }>;
+  }>;
+};
+//#endregion
 //#region src/api/dictation.operations.d.ts
 /**
  * Where an admitted dictation session streams its audio: a WebSocket the host
@@ -12041,4 +12137,4 @@ export declare const dictationOperations: {
   }>;
 };
 //#endregion
-export { BinaryResponse, DownloadedFile, HttpMethod, Operation, OperationDefinition, OperationInput, OperationObjectPermission, OperationOutput, OperationParsedInput, OperationPermission, OperationResult, OperationStatus, OperationThrottle, OperationUpload, OutputType, PathParams, UploadedPart, meetingsOperations, meetingsQuery, meetingsQueryFields, operation, operationGroup, recordMeetingsBody, type };
+export { BinaryResponse, DownloadedFile, HttpMethod, MEETINGS_MAX_ONLY_CONNECTIONS, Operation, OperationDefinition, OperationInput, OperationObjectPermission, OperationOutput, OperationParsedInput, OperationPermission, OperationResult, OperationStatus, OperationThrottle, OperationUpload, OutputType, PathParams, UploadedPart, meetingsOperations, meetingsQuery, meetingsQueryFields, operation, operationGroup, recordMeetingsBody, type };

package/dist/api/index.d.ts

@@ -2,7 +2,7 @@
 import { SchemaErrorCode, ValidationError, ValidationErrorDetail } from "../exceptions-CeP0QxYo.js";
 import { AgentDefinitionAudience, ObjectDefinition, ObjectRecord, PageAudience, RecordAudience } from "../objects-DgAAilNd.js";
 import { Attribute } from "../attributes-DHbSq5-c.js";
-import { AIAvailableModel, AIGenerationResult, AIGenerationType, Actor, ActorStatus, ActorType, AgentAsideExchange, AgentConversationOverview, AgentDefinition, AgentDefinitionActivity, AgentDefinitionDailyActivity, AgentMemoryView, AgentMessageAttachment, AgentRun, AgentSession, AgentSessionHistoryPage, AgentSessionLink, AgentSessionMessage, AgentSessionMode, AgentTodoPlanView, AgentToolCatalog, AgentTriggerDefinition, AggregateGroupByInput, ApiKey, ApiKeyWithSecret, ArchitectProjection, ArtifactQuote, ArtifactRevisionView, AuditListOptions, AuditLogEntry, AuthorizedGlobalSearchResult, AuthorizedSearchPage, AvailableBundleSummary, BinaryResponse, BrowserProfileView, BundleAddPlan, BundleAddResult, ClassifyEmailResult, CloudBrowserLiveView, CollectionResponse, ConnectionView, ConnectorProvidersResult, ConnectorTriggerMatch, CreateAgentTriggerResult, CreatePermissionInput, CreateUserProfile, DictationAdmission, DictationCapabilities, DictationUsageSummary, Document, DocumentFile, DocumentRecordOwnerPage, DownloadedFile, DraftAppendCommand, DraftCommandGuard, DraftPublishCommand, EffectivePermissions, EmailCategory, EmailCategoryUsage, EmailSenderRule, EmailVerdict, EnvVarEntry, Environment, EnvironmentDetail, EnvironmentHarnessId, EnvironmentList, File, FileUrlsResponse, FilterGenerationInput, FormDefinition, FormRow, FormStatus, FormSubmission, FormulaGenerationInput, GeocodingAutocompleteParams, GeocodingSuggestion, GithubTriggerSender, GlobalSearchResultItem, HarnessModelList, HttpMethod, ImageModelCatalog, InstalledBundleSummary, LastPublication, LastPublishError, LoginSecretEntry, LogoSearchCandidate, MailDraft, MailDraftAttachment, MailboxAccount, MailboxCursor, MailboxEmail, MailboxListResponse, MailboxQuery, MailboxReadState, MailboxThreadDetail, McpCatalogEntry, McpOAuthAttemptStarted, McpOAuthAttemptView, McpOAuthCompletionMode, McpServerView, Member, MentionReference, ModelDefinition, MutationReceipt, MyPreferences, NativeToolGroup, NewsBody, NewsIndex, NotificationArchiveAllResult, NotificationCounts, NotificationListParams, NotificationListResult, NotificationWithRecipient, ObjectPermissions, Operation, OperationDefinition, OperationInput, OperationObjectPermission, OperationOutput, OperationParsedInput, OperationPermission, OperationResult, OperationStatus, OperationThrottle, OperationUpload, OutputType, PageData, PageRead, PageSummary, PathParams, Permission, PreferenceEntry, ProposalRevision, PublishBlocker, QuotaState, RecipientSuggestion, RecordAggregates, RecordDocuments, RecordDriveChild, RecordDriveChildrenPage, RecordDriveSearchResult, RecordGraphNodeRef, RecordGraphRequest, RecordGraphResponse, RecordOperationResult, RegexGenerationInput, RelationScope, ResolvedRecentActivity, Role, SchemaGroupList, SchemaState, SecretEntry, SessionApprovalMode, SessionImageUsage, SlackTriggerSender, StartConnectorAuthResult, SubmitOutcome, SyncBundleInput, SyncBundleResult, SystemPermissions, TenantInvitation, TenantSettingsResponse, TriggerEventType, UploadedPart, UsageReport, UserProfile, UserStatus, ViewOperation, WalletState, meetingsOperations, meetingsQuery, meetingsQueryFields, operation, operationGroup, recordMeetingsBody, type } from "../index-B-eyWqKV.js";
+import { AIAvailableModel, AIGenerationResult, AIGenerationType, AccessCapabilities, AccessLevel, Actor, ActorStatus, ActorType, AgentAsideExchange, AgentConversationOverview, AgentDefinition, AgentDefinitionActivity, AgentDefinitionDailyActivity, AgentMemoryView, AgentMessageAttachment, AgentRun, AgentSession, AgentSessionHistoryPage, AgentSessionLink, AgentSessionMessage, AgentSessionMode, AgentTodoPlanView, AgentToolCatalog, AgentTriggerDefinition, AggregateGroupByInput, ApiKey, ApiKeyWithSecret, ArchitectProjection, ArtifactQuote, ArtifactRevisionView, AuditListOptions, AuditLogEntry, AuthorizedGlobalSearchResult, AuthorizedSearchPage, AvailableBundleSummary, BinaryResponse, BrowserProfileView, BundleAddPlan, BundleAddResult, ClassifyEmailResult, CloudBrowserLiveView, CollectionResponse, ConnectionView, ConnectorProvidersResult, ConnectorTriggerMatch, CreateAgentTriggerResult, CreatePermissionInput, CreateUserProfile, DictationAdmission, DictationCapabilities, DictationUsageSummary, Document, DocumentFile, DocumentRecordOwnerPage, DownloadedFile, DraftAppendCommand, DraftCommandGuard, DraftPublishCommand, EffectivePermissions, EmailCategory, EmailCategoryUsage, EmailSenderRule, EmailVerdict, EnvVarEntry, Environment, EnvironmentDetail, EnvironmentHarnessId, EnvironmentList, File, FileUrlsResponse, FilterGenerationInput, FormDefinition, FormRow, FormStatus, FormSubmission, FormulaGenerationInput, GeocodingAutocompleteParams, GeocodingSuggestion, GithubTriggerSender, GlobalSearchResultItem, HarnessModelList, HttpMethod, ImageModelCatalog, InstalledBundleSummary, LastPublication, LastPublishError, LoginSecretEntry, LogoSearchCandidate, MEETINGS_MAX_ONLY_CONNECTIONS, MailDraft, MailDraftAttachment, MailboxAccount, MailboxCursor, MailboxEmail, MailboxListResponse, MailboxQuery, MailboxReadState, MailboxThreadDetail, McpCatalogEntry, McpOAuthAttemptStarted, McpOAuthAttemptView, McpOAuthCompletionMode, McpServerView, Member, MentionReference, ModelDefinition, MutationReceipt, MyPreferences, NativeToolGroup, NewsBody, NewsIndex, NotificationArchiveAllResult, NotificationCounts, NotificationListParams, NotificationListResult, NotificationWithRecipient, ObjectPermissions, Operation, OperationDefinition, OperationInput, OperationObjectPermission, OperationOutput, OperationParsedInput, OperationPermission, OperationResult, OperationStatus, OperationThrottle, OperationUpload, OutputType, PageData, PageRead, PageSummary, PathParams, Permission, PreferenceEntry, ProposalRevision, PublishBlocker, QuotaState, RecipientSuggestion, RecordAggregates, RecordDocuments, RecordDriveChild, RecordDriveChildrenPage, RecordDriveSearchResult, RecordGraphNodeRef, RecordGraphRequest, RecordGraphResponse, RecordOperationResult, RegexGenerationInput, RelationScope, ResolvedRecentActivity, Role, SchemaGroupList, SchemaState, SecretEntry, SessionApprovalMode, SessionImageUsage, SlackTriggerSender, StartConnectorAuthResult, SubmitOutcome, SyncBundleInput, SyncBundleResult, SystemPermissions, TenantInvitation, TenantSettingsResponse, TriggerEventType, UploadedPart, UsageReport, UserProfile, UserStatus, ViewOperation, WalletState, meetingsOperations, meetingsQuery, meetingsQueryFields, operation, operationGroup, recordMeetingsBody, type } from "../index-BaxABgqT.js";
 import { CollectionContentSource, FilterState, RecordQueryDefinition, SortRule, ViewRead } from "../all-Cuw60VCF.js";
 import { AddAttributeInput, CreateCustomObjectInput, RelationOption, RelationOptionsResponse, UpdateObjectInput } from "../index-CanuuQuP.js";
 import * as z$2 from "zod";
@@ -4528,8 +4528,8 @@ export declare const filesOperations: {
  * query strings to the service unparsed.
  */
 export declare const listDocumentsQuery: z$2.ZodObject<{
-  limit: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>>>;
-  offset: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>>>;
+  limit: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>, unknown>>;
+  offset: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>, unknown>>;
 }, z$2.core.$strip>;
 /**
  * `POST /documents` — the document's own fields plus the record edge it is
@@ -4559,8 +4559,8 @@ export type CreateDocumentBody = z$2.infer<typeof createDocumentBody>;
  * the same bounds for every other caller. Unknown keys are dropped, not refused.
  */
 export declare const documentOwnersQuery: z$2.ZodObject<{
-  limit: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>>>;
-  offset: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>>>;
+  limit: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>, unknown>>;
+  offset: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>, unknown>>;
   q: z$2.ZodOptional<z$2.ZodString>;
   includeDrives: z$2.ZodOptional<z$2.ZodString>;
   ids: z$2.ZodOptional<z$2.ZodString>;
@@ -4597,8 +4597,8 @@ export declare const documentsOperations: {
     readonly method: "GET";
     readonly path: "/documents";
     readonly input: z$2.ZodObject<{
-      limit: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>>>;
-      offset: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>>>;
+      limit: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>, unknown>>;
+      offset: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>, unknown>>;
     }, z$2.core.$strip>;
     readonly output: OutputType<Document[]>;
     readonly permission: readonly ["documents", "read"];
@@ -4612,8 +4612,8 @@ export declare const documentsOperations: {
     readonly method: "GET";
     readonly path: "/documents/record-owners";
     readonly input: z$2.ZodObject<{
-      limit: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>>>;
-      offset: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>>>;
+      limit: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>, unknown>>;
+      offset: z$2.ZodOptional<z$2.ZodPreprocess<z$2.ZodOptional<z$2.ZodNumber>, unknown>>;
       q: z$2.ZodOptional<z$2.ZodString>;
       includeDrives: z$2.ZodOptional<z$2.ZodString>;
       ids: z$2.ZodOptional<z$2.ZodString>;
@@ -4800,7 +4800,7 @@ export declare const recordDriveChildrenPageQuery: z$2.ZodObject<{
     "date-asc": "date-asc";
   }>>;
   cursor: z$2.ZodOptional<z$2.ZodString>;
-  limit: z$2.ZodPreprocess<z$2.ZodNumber>;
+  limit: z$2.ZodPreprocess<z$2.ZodNumber, unknown>;
 }, z$2.core.$strip>;
 export type RecordDriveChildrenPageQuery = z$2.infer<typeof recordDriveChildrenPageQuery>;
 /**
@@ -4892,7 +4892,7 @@ export declare const foldersOperations: {
         "date-asc": "date-asc";
       }>>;
       cursor: z$2.ZodOptional<z$2.ZodString>;
-      limit: z$2.ZodPreprocess<z$2.ZodNumber>;
+      limit: z$2.ZodPreprocess<z$2.ZodNumber, unknown>;
     }, z$2.core.$strip>;
     readonly output: OutputType<RecordDriveChildrenPage>;
   }>;
@@ -9946,7 +9946,7 @@ export declare const setSessionWorkPostureBody: z$2.ZodObject<{
 export declare const renameSessionInput: z$2.ZodPreprocess<z$2.ZodObject<{
   name: z$2.ZodString;
   id: z$2.ZodString;
-}, z$2.core.$strict>>;
+}, z$2.core.$strict>, unknown>;
 /** The inference patch of one session: at least one override, `null` clears. */
 export declare const sessionInferenceOverridesInput: z$2.ZodObject<{
   model: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodObject<{
@@ -10290,7 +10290,7 @@ export declare const agentSessionsOperations: {
     readonly input: z$2.ZodPreprocess<z$2.ZodObject<{
       name: z$2.ZodString;
       id: z$2.ZodString;
-    }, z$2.core.$strict>>;
+    }, z$2.core.$strict>, unknown>;
     readonly output: OutputType<AgentSession>;
     readonly permission: readonly ["agents", "read"];
     readonly actor: "required";
@@ -12004,6 +12004,102 @@ export declare const devicesOperations: {
   }>;
 };
 //#endregion
+//#region src/api/connected-apps.operations.d.ts
+/** A browser carried by an extension connection; it disconnects with its connection, through `connectedApps.revoke`. */
+export interface ConnectedAppBrowser {
+  deviceId: string;
+  name: string;
+  lastSeenAt: string | null;
+}
+/** One OAuth connection of the caller, on one of their workspaces. */
+export interface ConnectedAppView {
+  grantId: string;
+  clientId: string;
+  clientName: string;
+  /** The host of an HTTPS `clientId` (a client metadata document); null otherwise. */
+  verifiedHost: string | null;
+  /** `extension` for the browser extension (the devices resource), `mcp` for every other client. */
+  kind: "mcp" | "extension";
+  tenantId: string;
+  workspaceName: string;
+  /**
+   * Null for the extension, which has no level, and for a connection whose
+   * scopes match no level (an earlier consent): it reads as custom until the
+   * person picks one.
+   */
+  level: AccessLevel | null;
+  /** The levels the caller's role and the client's request allow; empty for the extension. */
+  selectableLevels: AccessLevel[];
+  /** Each level not selectable, with why: the role lacks it, or the client never requested it. Empty for the extension. */
+  unavailableLevels: {
+    level: AccessLevel;
+    reason: "role" | "notRequested";
+  }[];
+  /** What the connection can do: what its scopes grant, as far as the caller's role allows. */
+  granted: (keyof AccessCapabilities)[];
+  /** Capabilities the connection's scopes grant that the caller's role lacks. */
+  withheld: (keyof AccessCapabilities)[];
+  createdAt: string;
+  lastUsedAt: string | null;
+  browsers: ConnectedAppBrowser[];
+}
+/** An oidc-provider grant id: an opaque string, not a UUID. */
+export declare const connectedAppGrantId: z$2.ZodString;
+export declare const setConnectionLevelBody: z$2.ZodObject<{
+  level: z$2.ZodEnum<{
+    read: "read";
+    full: "full";
+    write: "write";
+  }>;
+}, z$2.core.$strict>;
+export type SetConnectionLevelBody = z$2.infer<typeof setConnectionLevelBody>;
+/**
+ * The caller's OAuth connections across every workspace they belong to.
+ * Served by the host's `ConnectedAppsController` (a person's session only:
+ * the controller refuses API keys, and the host's session validator refuses
+ * OAuth tokens), so these operations have no runtime handler.
+ */
+export declare const connectedAppsOperations: {
+  list: Operation<{
+    readonly name: "connectedApps.list";
+    readonly method: "GET";
+    readonly path: "/connected-apps";
+    readonly input: z$2.ZodObject<{}, z$2.core.$strip>;
+    readonly output: OutputType<{
+      data: ConnectedAppView[];
+    }>;
+  }>;
+  /** Changes the level in place: the next request of the connection carries it. */
+  setLevel: Operation<{
+    readonly name: "connectedApps.setLevel";
+    readonly method: "PATCH";
+    readonly path: "/connected-apps/:grantId";
+    readonly input: z$2.ZodObject<{
+      level: z$2.ZodEnum<{
+        read: "read";
+        full: "full";
+        write: "write";
+      }>;
+      grantId: z$2.ZodString;
+    }, z$2.core.$strict>;
+    readonly output: OutputType<{
+      success: true;
+    }>;
+  }>;
+  /** Revokes the connection, with the browsers it carries. */
+  revoke: Operation<{
+    readonly name: "connectedApps.revoke";
+    readonly method: "DELETE";
+    readonly path: "/connected-apps/:grantId";
+    readonly input: z$2.ZodObject<{
+      grantId: z$2.ZodString;
+    }, z$2.core.$strip>;
+    readonly output: OutputType<{
+      success: true;
+    }>;
+  }>;
+};
+//#endregion
 //#region src/api/dictation.operations.d.ts
 /**
  * Where an admitted dictation session streams its audio: a WebSocket the host
@@ -12041,4 +12137,4 @@ export declare const dictationOperations: {
   }>;
 };
 //#endregion
-export { BinaryResponse, DownloadedFile, HttpMethod, Operation, OperationDefinition, OperationInput, OperationObjectPermission, OperationOutput, OperationParsedInput, OperationPermission, OperationResult, OperationStatus, OperationThrottle, OperationUpload, OutputType, PathParams, UploadedPart, meetingsOperations, meetingsQuery, meetingsQueryFields, operation, operationGroup, recordMeetingsBody, type };
+export { BinaryResponse, DownloadedFile, HttpMethod, MEETINGS_MAX_ONLY_CONNECTIONS, Operation, OperationDefinition, OperationInput, OperationObjectPermission, OperationOutput, OperationParsedInput, OperationPermission, OperationResult, OperationStatus, OperationThrottle, OperationUpload, OutputType, PathParams, UploadedPart, meetingsOperations, meetingsQuery, meetingsQueryFields, operation, operationGroup, recordMeetingsBody, type };