@standards/schema 1.0.0-alpha.433 → 1.0.0-alpha.434

package/dist/{index-CiAuyPuA.d.ts → index-D15KKwMX.d.ts}

@@ -2420,1959 +2420,1960 @@ export interface PresetNode {
 }
 /** Max depth allowed for preset.structure to keep instantiation predictable. */
 export declare const MAX_PRESET_DEPTH = 5;
-/** What the reading actor may do with a resource (spec §6.6); records never produce `runner`. */
-export declare const viewerAccessSchema: z$2.ZodEnum<{
-  editor: "editor";
-  owner: "owner";
-  reader: "reader";
-  runner: "runner";
-  workspace: "workspace";
-}>;
-type Values = readonly [string, ...string[]];
-/** One beneficiary of a private resource: its effective role and every source that grants it. */
-export declare function accessGrantSchema<const Role extends Values, const Source extends Values>(roles: Role, sources: Source): z$2.ZodObject<{
-  actorId: z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>;
-  role: z$2.ZodEnum<{ [k in Role[number]]: k; } extends (infer T) ? { [k in keyof T]: T[k]; } : never>;
-  sources: z$2.ZodArray<z$2.ZodEnum<{ [k in Source[number]]: k; } extends (infer T_1) ? { [k in keyof T_1]: T_1[k]; } : never>>;
-}, z$2.core.$strip>;
-/** Who can reach a record beyond its owner (`GET /records/:object/:id/access`). */
-export declare const recordAudienceSchema: z$2.ZodObject<{
-  recordId: z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>;
-  visibility: z$2.ZodEnum<{
-    private: "private";
-    workspace: "workspace";
-  }>;
-  ownedBy: z$2.ZodNullable<z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>>;
-  viewerAccess: z$2.ZodEnum<{
-    editor: "editor";
-    owner: "owner";
-    reader: "reader";
-    runner: "runner";
-    workspace: "workspace";
+export declare const DOCUMENT_KINDS: readonly ["file", "folder"];
+export type DocumentKind = (typeof DOCUMENT_KINDS)[number];
+export declare const documentSchema: z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodString;
+  title: z$2.ZodString;
+  kind: z$2.ZodEnum<{
+    file: "file";
+    folder: "folder";
   }>;
-  grants: z$2.ZodArray<z$2.ZodObject<{
-    actorId: z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>;
-    role: z$2.ZodEnum<{
-      editor: "editor";
-      reader: "reader";
-    }>;
-    sources: z$2.ZodArray<z$2.ZodEnum<{
-      manual: "manual";
-      meeting_attendee: "meeting_attendee";
-    }>>;
-  }, z$2.core.$strip>>;
+  parentId: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  description: z$2.ZodOptional<z$2.ZodString>;
+  contentHash: z$2.ZodOptional<z$2.ZodString>;
+  createdBy: z$2.ZodOptional<z$2.ZodString>;
+  updatedBy: z$2.ZodOptional<z$2.ZodString>;
+  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  position: z$2.ZodNumber;
+  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
 }, z$2.core.$strip>;
-/** Who may run commands on a device beyond its owner (`GET /devices/:id/access`). */
-export declare const deviceAudienceSchema: z$2.ZodObject<{
-  deviceId: z$2.ZodString;
-  visibility: z$2.ZodEnum<{
-    private: "private";
-    workspace: "workspace";
+export type Document = z$2.output<typeof documentSchema>;
+export declare const documentWithSubCountSchema: z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodString;
+  title: z$2.ZodString;
+  kind: z$2.ZodEnum<{
+    file: "file";
+    folder: "folder";
   }>;
-  ownedBy: z$2.ZodNullable<z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>>;
-  viewerAccess: z$2.ZodEnum<{
-    editor: "editor";
-    owner: "owner";
-    reader: "reader";
-    runner: "runner";
-    workspace: "workspace";
+  parentId: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  description: z$2.ZodOptional<z$2.ZodString>;
+  contentHash: z$2.ZodOptional<z$2.ZodString>;
+  createdBy: z$2.ZodOptional<z$2.ZodString>;
+  updatedBy: z$2.ZodOptional<z$2.ZodString>;
+  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  position: z$2.ZodNumber;
+  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  subCount: z$2.ZodNullable<z$2.ZodNumber>;
+}, z$2.core.$strip>;
+export type DocumentWithSubCount = z$2.output<typeof documentWithSubCountSchema>;
+/**
+ * One hit of a drive-wide name search: a folder or a file of the record's
+ * drive whose title contains the query, with the path that places it. The
+ * walk is the agent tool's (`listRecordDrive` in query mode); this is what
+ * the open-drive loupe reads (#3217).
+ */
+export declare const recordDriveSearchHitSchema: z$2.ZodObject<{
+  id: z$2.ZodString;
+  kind: z$2.ZodEnum<{
+    file: "file";
+    folder: "folder";
   }>;
-  grants: z$2.ZodArray<z$2.ZodObject<{
-    actorId: z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>;
-    role: z$2.ZodEnum<{
-      runner: "runner";
+  title: z$2.ZodString;
+  path: z$2.ZodString;
+  parentId: z$2.ZodNullable<z$2.ZodString>;
+  depth: z$2.ZodNumber;
+}, z$2.core.$strip>;
+export type RecordDriveSearchHit = z$2.output<typeof recordDriveSearchHitSchema>;
+export declare const recordDriveSearchResultSchema: z$2.ZodObject<{
+  recordId: z$2.ZodString;
+  hits: z$2.ZodArray<z$2.ZodObject<{
+    id: z$2.ZodString;
+    kind: z$2.ZodEnum<{
+      file: "file";
+      folder: "folder";
     }>;
-    sources: z$2.ZodArray<z$2.ZodEnum<{
-      manual: "manual";
-    }>>;
+    title: z$2.ZodString;
+    path: z$2.ZodString;
+    parentId: z$2.ZodNullable<z$2.ZodString>;
+    depth: z$2.ZodNumber;
+  }, z$2.core.$strip>>;
+  truncated: z$2.ZodOptional<z$2.ZodObject<{
+    maxEntries: z$2.ZodNumber;
+    returnedEntries: z$2.ZodNumber;
   }, z$2.core.$strip>>;
 }, z$2.core.$strip>;
-/** Who can reach a private page beyond its owner (`GET /pages/:id/access`). */
-export declare const pageAudienceSchema: z$2.ZodObject<{
-  pageId: z$2.ZodString;
-  visibility: z$2.ZodEnum<{
-    private: "private";
-    workspace: "workspace";
-  }>;
-  ownedBy: z$2.ZodNullable<z$2.ZodString>;
-  viewerAccess: z$2.ZodEnum<{
-    editor: "editor";
-    owner: "owner";
-    reader: "reader";
-    runner: "runner";
-    workspace: "workspace";
-  }>;
-  grants: z$2.ZodArray<z$2.ZodObject<{
-    actorId: z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>;
-    role: z$2.ZodEnum<{
-      editor: "editor";
-      reader: "reader";
+export type RecordDriveSearchResult = z$2.output<typeof recordDriveSearchResultSchema>;
+/**
+ * Text-extraction lifecycle for a single file within a document pack.
+ * `unsupported` is terminal and is not a failure: the file's type has no text
+ * to extract (an Outlook `.msg`, a `.docx`, a `.zip`), so nothing is queued.
+ */
+export declare const FILE_OCR_STATUSES: readonly ["pending", "processing", "completed", "failed", "unsupported"];
+export type FileOcrStatus = (typeof FILE_OCR_STATUSES)[number];
+/**
+ * A single anonymous file belonging to a document pack.
+ * Unlike the slot-based model, files carry no slot name — order within the
+ * pack is `position` only, and `name` is provenance (originalName), never a
+ * label rendered in the UI.
+ */
+export declare const documentFileSchema: z$2.ZodObject<{
+  id: z$2.ZodString;
+  documentId: z$2.ZodString;
+  position: z$2.ZodNumber;
+  name: z$2.ZodString;
+  mimeType: z$2.ZodString;
+  size: z$2.ZodNumber;
+  ocrStatus: z$2.ZodNullable<z$2.ZodEnum<{
+    completed: "completed";
+    failed: "failed";
+    pending: "pending";
+    processing: "processing";
+    unsupported: "unsupported";
+  }>>;
+  ocrText: z$2.ZodNullable<z$2.ZodString>;
+  ocrConfidence: z$2.ZodNullable<z$2.ZodNumber>;
+  processedAt: z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>;
+}, z$2.core.$strip>;
+export type DocumentFile = z$2.output<typeof documentFileSchema>;
+/** What an attach did: a new pack, a file appended to a named pack, or the pack already holding the file linked. */
+export declare const ATTACH_FILE_ACTIONS: readonly ["created", "appended", "linked-existing"];
+export type AttachFileAction = (typeof ATTACH_FILE_ACTIONS)[number];
+/** What attaching a file to a record's document attribute answers: the pack, the file in it, and what happened. */
+export declare const attachedRecordDocumentSchema: z$2.ZodObject<{
+  document: z$2.ZodObject<{
+    id: z$2.ZodString;
+    tenantId: z$2.ZodString;
+    title: z$2.ZodString;
+    kind: z$2.ZodEnum<{
+      file: "file";
+      folder: "folder";
     }>;
-    sources: z$2.ZodArray<z$2.ZodEnum<{
-      manual: "manual";
+    parentId: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+    description: z$2.ZodOptional<z$2.ZodString>;
+    contentHash: z$2.ZodOptional<z$2.ZodString>;
+    createdBy: z$2.ZodOptional<z$2.ZodString>;
+    updatedBy: z$2.ZodOptional<z$2.ZodString>;
+    deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+    position: z$2.ZodNumber;
+    createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+    updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  }, z$2.core.$strip>;
+  file: z$2.ZodObject<{
+    id: z$2.ZodString;
+    documentId: z$2.ZodString;
+    position: z$2.ZodNumber;
+    name: z$2.ZodString;
+    mimeType: z$2.ZodString;
+    size: z$2.ZodNumber;
+    ocrStatus: z$2.ZodNullable<z$2.ZodEnum<{
+      completed: "completed";
+      failed: "failed";
+      pending: "pending";
+      processing: "processing";
+      unsupported: "unsupported";
     }>>;
-  }, z$2.core.$strip>>;
+    ocrText: z$2.ZodNullable<z$2.ZodString>;
+    ocrConfidence: z$2.ZodNullable<z$2.ZodNumber>;
+    processedAt: z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>;
+  }, z$2.core.$strip>;
+  action: z$2.ZodEnum<{
+    appended: "appended";
+    created: "created";
+    "linked-existing": "linked-existing";
+  }>;
 }, z$2.core.$strip>;
-/** Canonical normalized actions and legal condition fields (trigger catalogue F). */
-export declare const GITHUB_TRIGGER_CATALOG: {
-  readonly pull_request: {
-    readonly events: readonly ["pull_request"];
-    readonly actions: readonly ["opened", "ready_for_review", "synchronize", "merged", "closed", "labeled"];
-    readonly conditions: readonly ["baseBranch", "headBranch", "draft", "label", "issueLabels", "changedPaths", "prAuthor"];
-  };
-  readonly review: {
-    readonly events: readonly ["pull_request_review"];
-    readonly actions: readonly ["submitted"];
-    readonly conditions: readonly ["reviewState", "prAuthor"];
-  };
-  readonly comment: {
-    readonly events: readonly ["issue_comment", "pull_request_review_comment"];
-    readonly actions: readonly ["created"];
-    readonly conditions: readonly ["text", "issueAuthor", "prAuthor"];
-  };
-  readonly push: {
-    readonly events: readonly ["push"];
-    readonly actions: readonly ["pushed"];
-    readonly conditions: readonly ["branch", "changedPaths", "forced"];
-  };
-  readonly workflow: {
-    readonly events: readonly ["workflow_run"];
-    readonly actions: readonly ["completed"];
-    readonly conditions: readonly ["workflowName", "conclusion", "branch", "originEvent"];
-  };
-  readonly check: {
-    readonly events: readonly ["check_suite", "check_run"];
-    readonly actions: readonly ["completed"];
-    readonly conditions: readonly ["checkApp", "checkName", "conclusion"];
-  };
-};
-export declare const SLACK_TRIGGER_CATALOG: {
-  readonly mention: {
-    readonly events: readonly ["app_mention"];
-    readonly conditions: readonly ["text"];
-  };
-  readonly message: {
-    readonly events: readonly ["message"];
-    readonly conditions: readonly ["position", "text", "hasFile"];
-  };
-  readonly dm: {
-    readonly events: readonly ["message"];
-    readonly conditions: readonly ["text", "hasFile"];
-  };
-  readonly reaction: {
-    readonly events: readonly ["reaction_added"];
-    readonly conditions: readonly ["messageAuthor"];
-  };
-};
-export declare const githubConditionSchema: z$2.ZodDiscriminatedUnion<[z$2.ZodObject<{
-  field: z$2.ZodLiteral<"text">;
-  operator: z$2.ZodEnum<{
-    contains: "contains";
-    starts_with: "starts_with";
-  }>;
-  value: z$2.ZodString;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  field: z$2.ZodLiteral<"label">;
-  value: z$2.ZodString;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  field: z$2.ZodLiteral<"issueLabels">;
-  operator: z$2.ZodDefault<z$2.ZodEnum<{
-    all: "all";
-    any: "any";
+/** A pack file as a drive row lists it: everything but its OCR text, which only reads need. */
+export declare const driveFileSchema: z$2.ZodObject<{
+  id: z$2.ZodString;
+  documentId: z$2.ZodString;
+  position: z$2.ZodNumber;
+  name: z$2.ZodString;
+  mimeType: z$2.ZodString;
+  size: z$2.ZodNumber;
+  ocrStatus: z$2.ZodNullable<z$2.ZodEnum<{
+    completed: "completed";
+    failed: "failed";
+    pending: "pending";
+    processing: "processing";
+    unsupported: "unsupported";
   }>>;
-  value: z$2.ZodArray<z$2.ZodString>;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  field: z$2.ZodLiteral<"baseBranch">;
-  value: z$2.ZodString;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  field: z$2.ZodLiteral<"headBranch">;
-  value: z$2.ZodString;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  field: z$2.ZodLiteral<"branch">;
-  value: z$2.ZodString;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  field: z$2.ZodLiteral<"draft">;
-  value: z$2.ZodBoolean;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  field: z$2.ZodLiteral<"changedPaths">;
-  value: z$2.ZodString;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  field: z$2.ZodLiteral<"forced">;
-  value: z$2.ZodBoolean;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  field: z$2.ZodLiteral<"prAuthor">;
-  value: z$2.ZodString;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  field: z$2.ZodLiteral<"issueAuthor">;
-  value: z$2.ZodString;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  field: z$2.ZodLiteral<"reviewState">;
-  value: z$2.ZodEnum<{
-    approved: "approved";
-    changes_requested: "changes_requested";
-    commented: "commented";
-  }>;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  field: z$2.ZodLiteral<"workflowName">;
-  value: z$2.ZodString;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  field: z$2.ZodLiteral<"checkApp">;
-  value: z$2.ZodString;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  field: z$2.ZodLiteral<"checkName">;
-  value: z$2.ZodString;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  field: z$2.ZodLiteral<"conclusion">;
-  value: z$2.ZodString;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  field: z$2.ZodLiteral<"originEvent">;
-  value: z$2.ZodString;
-}, z$2.core.$strict>], "field">;
-export declare const slackConditionSchema: z$2.ZodDiscriminatedUnion<[z$2.ZodObject<{
-  field: z$2.ZodLiteral<"text">;
-  operator: z$2.ZodEnum<{
-    contains: "contains";
-    starts_with: "starts_with";
-  }>;
-  value: z$2.ZodString;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  field: z$2.ZodLiteral<"position">;
-  value: z$2.ZodEnum<{
-    reply: "reply";
-    top_level: "top_level";
-  }>;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  field: z$2.ZodLiteral<"hasFile">;
-  value: z$2.ZodBoolean;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  field: z$2.ZodLiteral<"messageAuthor">;
-  value: z$2.ZodString;
-}, z$2.core.$strict>], "field">;
-export type GithubCondition = z$2.output<typeof githubConditionSchema>;
-export type SlackCondition = z$2.output<typeof slackConditionSchema>;
-export type GithubTriggerFamily = keyof typeof GITHUB_TRIGGER_CATALOG;
-export type SlackTriggerOn = keyof typeof SLACK_TRIGGER_CATALOG;
-/** Every GitHub family, in the catalogue's order. */
-export declare const GITHUB_TRIGGER_FAMILIES: [GithubTriggerFamily, ...GithubTriggerFamily[]];
-/** Every Slack event a trigger listens to, in the catalogue's order. */
-export declare const SLACK_TRIGGER_EVENTS: [SlackTriggerOn, ...SlackTriggerOn[]];
-export type GithubTriggerAction<F extends GithubTriggerFamily = GithubTriggerFamily> = (typeof GITHUB_TRIGGER_CATALOG)[F]["actions"][number];
-export type GithubTriggerSender = "human" | "me" | "any" | {
-  logins: string[];
-};
-export type SlackTriggerSender = "human" | "me" | "any" | {
-  users: string[];
+  ocrConfidence: z$2.ZodNullable<z$2.ZodNumber>;
+  processedAt: z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>;
+}, z$2.core.$strip>;
+export type DriveFile = z$2.output<typeof driveFileSchema>;
+export type DocumentWithFiles = Document & {
+  files: DocumentFile[];
 };
-export type GithubTriggerMatch = { [F in GithubTriggerFamily]: {
-  family: F;
-  actions: GithubTriggerAction<F>[];
-  repositories: string[];
-  sender: GithubTriggerSender;
-  conditions: Extract<GithubCondition, {
-    field: (typeof GITHUB_TRIGGER_CATALOG)[F]["conditions"][number];
-  }>[];
-}; }[GithubTriggerFamily];
-export type SlackTriggerMatch = { [O in SlackTriggerOn]: {
-  on: O;
-  channels: string[];
-  sender: SlackTriggerSender;
-  conditions: Extract<SlackCondition, {
-    field: (typeof SLACK_TRIGGER_CATALOG)[O]["conditions"][number];
-  }>[];
-} & (O extends "reaction" ? {
-  reactions?: string[];
-} : {
-  reactions?: never;
-}); }[SlackTriggerOn];
-export type ConnectorTriggerMatch = GithubTriggerMatch | SlackTriggerMatch;
-/** The suffix of `owner/*`: every repository of that owner, installed now or later. */
-export declare const REPOSITORY_WILDCARD = "/*";
-/** Whether a stored repository (`owner/repo` or `owner/*`) covers a full name. Case-insensitive. */
-export declare function matchesRepositoryPattern(pattern: string, fullName: string): boolean;
-/** The refinements establish the family/condition/action correlation of the output union. */
-export declare const githubTriggerMatchSchema: z$2.ZodPipe<z$2.ZodObject<{
-  family: z$2.ZodEnum<{
-    check: "check";
-    comment: "comment";
-    pull_request: "pull_request";
-    push: "push";
-    review: "review";
-    workflow: "workflow";
+/**
+ * One row of a record's drive at a given level: the document with its sub
+ * count and its pack files (#4332). A drive-only attachment, one that exists
+ * only as a reference edge and is named nowhere in `record.values`, has no
+ * other source for its files, and without them its row menu cannot offer
+ * Download. A folder has no pack: its `files` is always `[]`.
+ *
+ * A root-level child also names where it sits on the record: the document
+ * attribute whose edge holds it (`attachments` for a plain drive item) and
+ * that edge's qualified properties. A nested child has no edge of its own and
+ * carries neither.
+ */
+export declare const recordDriveChildSchema: z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodString;
+  title: z$2.ZodString;
+  kind: z$2.ZodEnum<{
+    file: "file";
+    folder: "folder";
   }>;
-  actions: z$2.ZodDefault<z$2.ZodArray<z$2.ZodString>>;
-  repositories: z$2.ZodDefault<z$2.ZodArray<z$2.ZodString>>;
-  sender: z$2.ZodDefault<z$2.ZodUnion<readonly [z$2.ZodEnum<{
-    any: "any";
-    human: "human";
-    me: "me";
-  }>, z$2.ZodObject<{
-    logins: z$2.ZodArray<z$2.ZodString>;
-  }, z$2.core.$strict>]>>;
-  conditions: z$2.ZodDefault<z$2.ZodArray<z$2.ZodDiscriminatedUnion<[z$2.ZodObject<{
-    field: z$2.ZodLiteral<"text">;
-    operator: z$2.ZodEnum<{
-      contains: "contains";
-      starts_with: "starts_with";
-    }>;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"label">;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"issueLabels">;
-    operator: z$2.ZodDefault<z$2.ZodEnum<{
-      all: "all";
-      any: "any";
+  parentId: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  description: z$2.ZodOptional<z$2.ZodString>;
+  contentHash: z$2.ZodOptional<z$2.ZodString>;
+  createdBy: z$2.ZodOptional<z$2.ZodString>;
+  updatedBy: z$2.ZodOptional<z$2.ZodString>;
+  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  position: z$2.ZodNumber;
+  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  subCount: z$2.ZodNullable<z$2.ZodNumber>;
+  files: z$2.ZodArray<z$2.ZodObject<{
+    id: z$2.ZodString;
+    documentId: z$2.ZodString;
+    position: z$2.ZodNumber;
+    name: z$2.ZodString;
+    mimeType: z$2.ZodString;
+    size: z$2.ZodNumber;
+    ocrStatus: z$2.ZodNullable<z$2.ZodEnum<{
+      completed: "completed";
+      failed: "failed";
+      pending: "pending";
+      processing: "processing";
+      unsupported: "unsupported";
     }>>;
-    value: z$2.ZodArray<z$2.ZodString>;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"baseBranch">;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"headBranch">;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"branch">;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"draft">;
-    value: z$2.ZodBoolean;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"changedPaths">;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"forced">;
-    value: z$2.ZodBoolean;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"prAuthor">;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"issueAuthor">;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"reviewState">;
-    value: z$2.ZodEnum<{
-      approved: "approved";
-      changes_requested: "changes_requested";
-      commented: "commented";
-    }>;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"workflowName">;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"checkApp">;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"checkName">;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"conclusion">;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"originEvent">;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>], "field">>>;
-}, z$2.core.$strict>, z$2.ZodTransform<{
-  family: "check";
-  actions: "completed"[];
-  repositories: string[];
-  sender: GithubTriggerSender;
-  conditions: ({
-    field: "checkApp";
-    value: string;
-  } | {
-    field: "checkName";
-    value: string;
-  } | {
-    field: "conclusion";
-    value: string;
-  })[];
-} | {
-  family: "comment";
-  actions: "created"[];
-  repositories: string[];
-  sender: GithubTriggerSender;
-  conditions: ({
-    field: "text";
-    operator: "contains" | "starts_with";
-    value: string;
-  } | {
-    field: "issueAuthor";
-    value: string;
-  } | {
-    field: "prAuthor";
-    value: string;
-  })[];
-} | {
-  family: "pull_request";
-  actions: ("closed" | "labeled" | "merged" | "opened" | "ready_for_review" | "synchronize")[];
-  repositories: string[];
-  sender: GithubTriggerSender;
-  conditions: ({
-    field: "baseBranch";
-    value: string;
-  } | {
-    field: "changedPaths";
-    value: string;
-  } | {
-    field: "headBranch";
-    value: string;
-  } | {
-    field: "label";
-    value: string;
-  } | {
-    field: "prAuthor";
-    value: string;
-  } | {
-    field: "draft";
-    value: boolean;
-  } | {
-    field: "issueLabels";
-    operator: "all" | "any";
-    value: string[];
-  })[];
-} | {
-  family: "push";
-  actions: "pushed"[];
-  repositories: string[];
-  sender: GithubTriggerSender;
-  conditions: ({
-    field: "branch";
-    value: string;
-  } | {
-    field: "changedPaths";
-    value: string;
-  } | {
-    field: "forced";
-    value: boolean;
-  })[];
-} | {
-  family: "review";
-  actions: "submitted"[];
-  repositories: string[];
-  sender: GithubTriggerSender;
-  conditions: ({
-    field: "prAuthor";
-    value: string;
-  } | {
-    field: "reviewState";
-    value: "approved" | "changes_requested" | "commented";
-  })[];
-} | {
-  family: "workflow";
-  actions: "completed"[];
-  repositories: string[];
-  sender: GithubTriggerSender;
-  conditions: ({
-    field: "branch";
-    value: string;
-  } | {
-    field: "conclusion";
-    value: string;
-  } | {
-    field: "originEvent";
-    value: string;
-  } | {
-    field: "workflowName";
-    value: string;
-  })[];
-}, {
-  family: "check" | "comment" | "pull_request" | "push" | "review" | "workflow";
-  actions: string[];
-  repositories: string[];
-  sender: "any" | "human" | "me" | {
-    logins: string[];
-  };
-  conditions: ({
-    field: "text";
-    operator: "contains" | "starts_with";
-    value: string;
-  } | {
-    field: "baseBranch";
-    value: string;
-  } | {
-    field: "branch";
-    value: string;
-  } | {
-    field: "changedPaths";
-    value: string;
-  } | {
-    field: "checkApp";
-    value: string;
-  } | {
-    field: "checkName";
-    value: string;
-  } | {
-    field: "conclusion";
-    value: string;
-  } | {
-    field: "headBranch";
-    value: string;
-  } | {
-    field: "issueAuthor";
-    value: string;
-  } | {
-    field: "label";
-    value: string;
-  } | {
-    field: "originEvent";
-    value: string;
-  } | {
-    field: "prAuthor";
-    value: string;
-  } | {
-    field: "workflowName";
-    value: string;
-  } | {
-    field: "draft";
-    value: boolean;
-  } | {
-    field: "forced";
-    value: boolean;
-  } | {
-    field: "issueLabels";
-    operator: "all" | "any";
-    value: string[];
-  } | {
-    field: "reviewState";
-    value: "approved" | "changes_requested" | "commented";
-  })[];
-}>>;
-export declare const slackTriggerMatchSchema: z$2.ZodPipe<z$2.ZodObject<{
-  on: z$2.ZodEnum<{
-    dm: "dm";
-    mention: "mention";
-    message: "message";
-    reaction: "reaction";
-  }>;
-  channels: z$2.ZodDefault<z$2.ZodArray<z$2.ZodString>>;
-  reactions: z$2.ZodOptional<z$2.ZodArray<z$2.ZodString>>;
-  sender: z$2.ZodDefault<z$2.ZodUnion<readonly [z$2.ZodEnum<{
-    any: "any";
-    human: "human";
-    me: "me";
-  }>, z$2.ZodObject<{
-    users: z$2.ZodArray<z$2.ZodString>;
-  }, z$2.core.$strict>]>>;
-  conditions: z$2.ZodDefault<z$2.ZodArray<z$2.ZodDiscriminatedUnion<[z$2.ZodObject<{
-    field: z$2.ZodLiteral<"text">;
-    operator: z$2.ZodEnum<{
-      contains: "contains";
-      starts_with: "starts_with";
-    }>;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"position">;
-    value: z$2.ZodEnum<{
-      reply: "reply";
-      top_level: "top_level";
-    }>;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"hasFile">;
-    value: z$2.ZodBoolean;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"messageAuthor">;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>], "field">>>;
-}, z$2.core.$strict>, z$2.ZodTransform<({
-  on: "dm";
-  channels: string[];
-  sender: SlackTriggerSender;
-  conditions: ({
-    field: "text";
-    operator: "contains" | "starts_with";
-    value: string;
-  } | {
-    field: "hasFile";
-    value: boolean;
-  })[];
-} & {
-  reactions?: never;
-}) | ({
-  on: "mention";
-  channels: string[];
-  sender: SlackTriggerSender;
-  conditions: {
-    field: "text";
-    operator: "contains" | "starts_with";
-    value: string;
-  }[];
-} & {
-  reactions?: never;
-}) | ({
-  on: "message";
-  channels: string[];
-  sender: SlackTriggerSender;
-  conditions: ({
-    field: "text";
-    operator: "contains" | "starts_with";
-    value: string;
-  } | {
-    field: "hasFile";
-    value: boolean;
-  } | {
-    field: "position";
-    value: "reply" | "top_level";
-  })[];
-} & {
-  reactions?: never;
-}) | ({
-  on: "reaction";
-  channels: string[];
-  sender: SlackTriggerSender;
-  conditions: {
-    field: "messageAuthor";
-    value: string;
-  }[];
-} & {
-  reactions?: string[];
-}), {
-  on: "dm" | "mention" | "message" | "reaction";
-  channels: string[];
-  reactions?: string[] | undefined;
-  sender: "any" | "human" | "me" | {
-    users: string[];
-  };
-  conditions: ({
-    field: "text";
-    operator: "contains" | "starts_with";
-    value: string;
-  } | {
-    field: "messageAuthor";
-    value: string;
-  } | {
-    field: "hasFile";
-    value: boolean;
-  } | {
-    field: "position";
-    value: "reply" | "top_level";
-  })[];
-}>>;
-export declare const connectorTriggerMatchSchema: z$2.ZodUnion<readonly [z$2.ZodPipe<z$2.ZodObject<{
-  family: z$2.ZodEnum<{
-    check: "check";
-    comment: "comment";
-    pull_request: "pull_request";
-    push: "push";
-    review: "review";
-    workflow: "workflow";
-  }>;
-  actions: z$2.ZodDefault<z$2.ZodArray<z$2.ZodString>>;
-  repositories: z$2.ZodDefault<z$2.ZodArray<z$2.ZodString>>;
-  sender: z$2.ZodDefault<z$2.ZodUnion<readonly [z$2.ZodEnum<{
-    any: "any";
-    human: "human";
-    me: "me";
-  }>, z$2.ZodObject<{
-    logins: z$2.ZodArray<z$2.ZodString>;
-  }, z$2.core.$strict>]>>;
-  conditions: z$2.ZodDefault<z$2.ZodArray<z$2.ZodDiscriminatedUnion<[z$2.ZodObject<{
-    field: z$2.ZodLiteral<"text">;
-    operator: z$2.ZodEnum<{
-      contains: "contains";
-      starts_with: "starts_with";
-    }>;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"label">;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"issueLabels">;
-    operator: z$2.ZodDefault<z$2.ZodEnum<{
-      all: "all";
-      any: "any";
-    }>>;
-    value: z$2.ZodArray<z$2.ZodString>;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"baseBranch">;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"headBranch">;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"branch">;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"draft">;
-    value: z$2.ZodBoolean;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"changedPaths">;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"forced">;
-    value: z$2.ZodBoolean;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"prAuthor">;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"issueAuthor">;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"reviewState">;
-    value: z$2.ZodEnum<{
-      approved: "approved";
-      changes_requested: "changes_requested";
-      commented: "commented";
-    }>;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"workflowName">;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"checkApp">;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"checkName">;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"conclusion">;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"originEvent">;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>], "field">>>;
-}, z$2.core.$strict>, z$2.ZodTransform<{
-  family: "check";
-  actions: "completed"[];
-  repositories: string[];
-  sender: GithubTriggerSender;
-  conditions: ({
-    field: "checkApp";
-    value: string;
-  } | {
-    field: "checkName";
-    value: string;
-  } | {
-    field: "conclusion";
-    value: string;
-  })[];
-} | {
-  family: "comment";
-  actions: "created"[];
-  repositories: string[];
-  sender: GithubTriggerSender;
-  conditions: ({
-    field: "text";
-    operator: "contains" | "starts_with";
-    value: string;
-  } | {
-    field: "issueAuthor";
-    value: string;
-  } | {
-    field: "prAuthor";
-    value: string;
-  })[];
-} | {
-  family: "pull_request";
-  actions: ("closed" | "labeled" | "merged" | "opened" | "ready_for_review" | "synchronize")[];
-  repositories: string[];
-  sender: GithubTriggerSender;
-  conditions: ({
-    field: "baseBranch";
-    value: string;
-  } | {
-    field: "changedPaths";
-    value: string;
-  } | {
-    field: "headBranch";
-    value: string;
-  } | {
-    field: "label";
-    value: string;
-  } | {
-    field: "prAuthor";
-    value: string;
-  } | {
-    field: "draft";
-    value: boolean;
-  } | {
-    field: "issueLabels";
-    operator: "all" | "any";
-    value: string[];
-  })[];
-} | {
-  family: "push";
-  actions: "pushed"[];
-  repositories: string[];
-  sender: GithubTriggerSender;
-  conditions: ({
-    field: "branch";
-    value: string;
-  } | {
-    field: "changedPaths";
-    value: string;
-  } | {
-    field: "forced";
-    value: boolean;
-  })[];
-} | {
-  family: "review";
-  actions: "submitted"[];
-  repositories: string[];
-  sender: GithubTriggerSender;
-  conditions: ({
-    field: "prAuthor";
-    value: string;
-  } | {
-    field: "reviewState";
-    value: "approved" | "changes_requested" | "commented";
-  })[];
-} | {
-  family: "workflow";
-  actions: "completed"[];
-  repositories: string[];
-  sender: GithubTriggerSender;
-  conditions: ({
-    field: "branch";
-    value: string;
-  } | {
-    field: "conclusion";
-    value: string;
-  } | {
-    field: "originEvent";
-    value: string;
-  } | {
-    field: "workflowName";
-    value: string;
-  })[];
-}, {
-  family: "check" | "comment" | "pull_request" | "push" | "review" | "workflow";
-  actions: string[];
-  repositories: string[];
-  sender: "any" | "human" | "me" | {
-    logins: string[];
-  };
-  conditions: ({
-    field: "text";
-    operator: "contains" | "starts_with";
-    value: string;
-  } | {
-    field: "baseBranch";
-    value: string;
-  } | {
-    field: "branch";
-    value: string;
-  } | {
-    field: "changedPaths";
-    value: string;
-  } | {
-    field: "checkApp";
-    value: string;
-  } | {
-    field: "checkName";
-    value: string;
-  } | {
-    field: "conclusion";
-    value: string;
-  } | {
-    field: "headBranch";
-    value: string;
-  } | {
-    field: "issueAuthor";
-    value: string;
-  } | {
-    field: "label";
-    value: string;
-  } | {
-    field: "originEvent";
-    value: string;
-  } | {
-    field: "prAuthor";
-    value: string;
-  } | {
-    field: "workflowName";
-    value: string;
-  } | {
-    field: "draft";
-    value: boolean;
-  } | {
-    field: "forced";
-    value: boolean;
-  } | {
-    field: "issueLabels";
-    operator: "all" | "any";
-    value: string[];
-  } | {
-    field: "reviewState";
-    value: "approved" | "changes_requested" | "commented";
-  })[];
-}>>, z$2.ZodPipe<z$2.ZodObject<{
-  on: z$2.ZodEnum<{
-    dm: "dm";
-    mention: "mention";
-    message: "message";
-    reaction: "reaction";
-  }>;
-  channels: z$2.ZodDefault<z$2.ZodArray<z$2.ZodString>>;
-  reactions: z$2.ZodOptional<z$2.ZodArray<z$2.ZodString>>;
-  sender: z$2.ZodDefault<z$2.ZodUnion<readonly [z$2.ZodEnum<{
-    any: "any";
-    human: "human";
-    me: "me";
-  }>, z$2.ZodObject<{
-    users: z$2.ZodArray<z$2.ZodString>;
-  }, z$2.core.$strict>]>>;
-  conditions: z$2.ZodDefault<z$2.ZodArray<z$2.ZodDiscriminatedUnion<[z$2.ZodObject<{
-    field: z$2.ZodLiteral<"text">;
-    operator: z$2.ZodEnum<{
-      contains: "contains";
-      starts_with: "starts_with";
-    }>;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"position">;
-    value: z$2.ZodEnum<{
-      reply: "reply";
-      top_level: "top_level";
-    }>;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"hasFile">;
-    value: z$2.ZodBoolean;
-  }, z$2.core.$strict>, z$2.ZodObject<{
-    field: z$2.ZodLiteral<"messageAuthor">;
-    value: z$2.ZodString;
-  }, z$2.core.$strict>], "field">>>;
-}, z$2.core.$strict>, z$2.ZodTransform<({
-  on: "dm";
-  channels: string[];
-  sender: SlackTriggerSender;
-  conditions: ({
-    field: "text";
-    operator: "contains" | "starts_with";
-    value: string;
-  } | {
-    field: "hasFile";
-    value: boolean;
-  })[];
-} & {
-  reactions?: never;
-}) | ({
-  on: "mention";
-  channels: string[];
-  sender: SlackTriggerSender;
-  conditions: {
-    field: "text";
-    operator: "contains" | "starts_with";
-    value: string;
-  }[];
-} & {
-  reactions?: never;
-}) | ({
-  on: "message";
-  channels: string[];
-  sender: SlackTriggerSender;
-  conditions: ({
-    field: "text";
-    operator: "contains" | "starts_with";
-    value: string;
-  } | {
-    field: "hasFile";
-    value: boolean;
-  } | {
-    field: "position";
-    value: "reply" | "top_level";
-  })[];
-} & {
-  reactions?: never;
-}) | ({
-  on: "reaction";
-  channels: string[];
-  sender: SlackTriggerSender;
-  conditions: {
-    field: "messageAuthor";
-    value: string;
-  }[];
-} & {
-  reactions?: string[];
-}), {
-  on: "dm" | "mention" | "message" | "reaction";
-  channels: string[];
-  reactions?: string[] | undefined;
-  sender: "any" | "human" | "me" | {
-    users: string[];
-  };
-  conditions: ({
-    field: "text";
-    operator: "contains" | "starts_with";
-    value: string;
-  } | {
-    field: "messageAuthor";
-    value: string;
-  } | {
-    field: "hasFile";
-    value: boolean;
-  } | {
-    field: "position";
-    value: "reply" | "top_level";
-  })[];
-}>>]>;
-/** Immutable identity shared by transport admission, coalescing and retries. */
-export interface ConnectorEventIdentity {
-  connectionId: string;
-  /** Provider delivery identity, not the Standards outbox id. */
-  sourceEventId: string;
-  /** Same Slack message delivered as message/app_mention has the same identity. */
-  semanticEventId: string;
-  /** ISO timestamp of the original admission, unchanged on retry. */
-  receivedAt: string;
-  /**
-   * Provider payload kept in the tenant outbox. A fired run reads it pruned of
-   * credentials, rendering and repeats, every id kept (#5234), never verbatim.
-   */
-  payload: Record<string, unknown>;
-}
-/** Facts enriched by the worker; missing data never satisfies a condition. */
-export interface GithubEventFacts {
-  text?: string;
-  label?: string;
-  issueLabels?: string[];
-  baseBranch?: string;
-  headBranch?: string;
-  branch?: string;
-  draft?: boolean;
-  changedPaths?: string[];
-  forced?: boolean;
-  prAuthor?: string;
-  issueAuthor?: string;
-  reviewState?: "approved" | "changes_requested" | "commented";
-  workflowName?: string;
-  checkApp?: string;
-  checkName?: string;
-  conclusion?: string;
-  originEvent?: string;
-}
-export type NormalizedGithubEvent = ConnectorEventIdentity & {
-  provider: "github";
-  installationId: string;
-  eventName: string;
-  repository?: string;
-  number?: number;
-  threadKey?: string;
-  /**
-   * The repository a pull request's head lives in (machines and links §2):
-   * `repository` itself unless the PR comes from a fork. Set on events that
-   * concern a pull request, with `facts.headBranch` and `defaultBranch`.
-   */
-  headRepository?: string;
-  /** The base repository's default branch, on events that concern a pull request. */
-  defaultBranch?: string;
-  sender: {
-    login: string;
-    isBot: boolean;
-    performedViaAppId?: string;
-  };
-  title?: string;
-  url?: string;
-  facts: GithubEventFacts;
-} & { [F in GithubTriggerFamily]: {
-  family: F;
-  action: GithubTriggerAction<F>;
-}; }[GithubTriggerFamily];
-export interface NormalizedSlackEvent extends ConnectorEventIdentity {
-  provider: "slack";
-  teamId: string;
-  /** A mentioned channel message can match both mention and message triggers. */
-  kinds: SlackTriggerOn[];
-  channel: string;
-  ts: string;
-  threadTs?: string;
-  threadKey?: string;
-  sender: {
-    userId: string;
-    isBot: boolean;
-    isOurApp: boolean;
-    name?: string;
-    email?: string;
-  };
-  text?: string;
-  position?: "top_level" | "reply";
-  hasFile?: boolean;
-  reaction?: string;
-  messageAuthor?: string;
-  files?: {
-    id: string;
-    name?: string;
-    urlPrivate?: string;
-  }[];
-  history?: {
-    ts: string;
-    userId?: string;
-    text: string;
-  }[];
-}
-export type NormalizedConnectorEvent = NormalizedGithubEvent | NormalizedSlackEvent;
+    ocrConfidence: z$2.ZodNullable<z$2.ZodNumber>;
+    processedAt: z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>;
+  }, z$2.core.$strip>>;
+  attributeName: z$2.ZodOptional<z$2.ZodString>;
+  properties: z$2.ZodOptional<z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>>;
+}, z$2.core.$strip>;
+export type RecordDriveChild = z$2.output<typeof recordDriveChildSchema>;
 /**
- * Typed agent references: `<kind>:<id>`. The one parser shared by the runtime
- * verbs and the UI tool views; it never guesses a kind from a bare id.
+ * The orders a drive level is listed in. Every mode puts folders before
+ * files, then sorts on its key, then on `id`:
+ * - `manual`: `position` (the drag order);
+ * - `name-asc` / `name-desc`: the title, numeric and case- and
+ *   accent-insensitive ("File 2" before "file 10", "Éa" equal to "ea");
+ * - `date-desc` / `date-asc`: a file's `createdAt` (the date it was added)
+ *   to the millisecond, so a rename never moves it; folders keep `name-asc`'s
+ *   order in both directions.
+ * The `id` tiebreak is ascending in every mode.
  */
-export declare const REFERENCE_KINDS: readonly ["record", "document", "file", "email", "thread", "event", "memory", "skill", "schema", "user", "guide", "bundle", "draft", "decision", "session", "catalog", "wake"];
-export type ReferenceKind = (typeof REFERENCE_KINDS)[number];
-export type Reference = {
-  kind: ReferenceKind;
-  id: string;
-};
-export type ReferenceRefusalReason = "bare_uuid" | "unknown_kind" | "malformed" | "legacy_mention";
-export type ParsedReference = {
-  ok: true;
-  ref: Reference;
-} | {
-  ok: false;
-  reason: ReferenceRefusalReason;
-  expected: string;
-};
-export declare function parseReference(raw: string): ParsedReference;
-export declare function formatReference(ref: Reference): string;
-export declare function isWildcard(ref: Reference): boolean;
-/** Built-in external connector providers. Mirrors the runtime's
- * `ConnectorProvider`: mail and calendar are separate keys per vendor, because
- * the scopes differ and a user may connect one without the other. */
-export declare const CONNECTOR_PROVIDER_IDS: readonly ["gmail", "outlook", "google-calendar", "outlook-calendar", "github", "slack"];
-export type ConnectorProviderId = (typeof CONNECTOR_PROVIDER_IDS)[number];
-/** Providers that sync a mailbox. */
-export type EmailConnectorProviderId = Extract<ConnectorProviderId, "gmail" | "outlook">;
-/** Providers that sync a calendar. */
-export type CalendarConnectorProviderId = Extract<ConnectorProviderId, "google-calendar" | "outlook-calendar">;
-/** Connection lifecycle status, mirrored from `connector_connections.status`. */
-export declare const CONNECTION_STATUS_IDS: readonly ["active", "reauth_required", "error", "disconnected"];
-export type ConnectionStatusId = (typeof CONNECTION_STATUS_IDS)[number];
-/** What a connection may do on its provider; each maps to a scope tier per provider. */
-export type ConnectorCapability = "read" | "modify" | "send";
-/** Derived from the scopes the provider actually granted, never from what was requested. */
-export declare const connectionCapabilitiesSchema: z$2.ZodObject<{
-  canRead: z$2.ZodBoolean;
-  canModify: z$2.ZodBoolean;
-  canSend: z$2.ZodBoolean;
-}, z$2.core.$strip>;
-export type ConnectionCapabilities = z$2.output<typeof connectionCapabilitiesSchema>;
-/** What to ask for so a re-consent keeps what the connection already holds: the held flags beyond `read`, in capability order. */
-export declare function requestedCapabilities(held: ConnectionCapabilities): Exclude<ConnectorCapability, "read">[];
+export declare const DOCUMENT_SORT_MODES: readonly ["manual", "name-asc", "name-desc", "date-desc", "date-asc"];
+export type DocumentSortMode = (typeof DOCUMENT_SORT_MODES)[number];
+/** Rows in a page of a drive level when the caller names no `limit`. */
+export declare const RECORD_DRIVE_PAGE_DEFAULT_LIMIT = 100;
+/** The most rows one page of a drive level holds; a larger `limit` is clamped. */
+export declare const RECORD_DRIVE_PAGE_MAX_LIMIT = 500;
 /**
- * How far a connection's full-history walk (backfill) has gone.
- *
- * `processed` counts the items the current walk has stored so far, across every
- * continuation job; once the walk ends it keeps the final count. `total` is what
- * the provider says the walk will cover, captured when the walk starts: exact or
- * an estimate (Gmail's `resultSizeEstimate`), so `processed` may end above or
- * below it. It is `null` when the provider offers no total (calendars), so a
- * bar stays indeterminate rather than inventing a 100%. A connection that has
- * never walked reads `{ processed: 0, total: null, backfilling: false }`.
+ * The longest drive page cursor read back. An issued cursor carries one title
+ * (at most 255 characters) plus a few short fields; anything longer is crafted.
  */
-export declare const connectionSyncProgressSchema: z$2.ZodObject<{
-  processed: z$2.ZodNumber;
-  total: z$2.ZodNullable<z$2.ZodNumber>;
-  backfilling: z$2.ZodBoolean;
-}, z$2.core.$strip>;
-export type ConnectionSyncProgress = z$2.output<typeof connectionSyncProgressSchema>;
+export declare const RECORD_DRIVE_CURSOR_MAX_LENGTH = 2048;
 /**
- * Token-free projection of a connection for client/UI consumption.
- * Access/refresh tokens NEVER cross this boundary.
+ * One page of a record's drive level (#4985), in its sort mode's order.
+ * `nextCursor` resumes strictly after the page's last row, and is `null` on
+ * the last page. A cursor is opaque and only valid for the mode that issued it.
  */
-export declare const connectionViewSchema: z$2.ZodObject<{
-  id: z$2.ZodString;
-  provider: z$2.ZodEnum<{
-    github: "github";
-    gmail: "gmail";
-    "google-calendar": "google-calendar";
-    outlook: "outlook";
-    "outlook-calendar": "outlook-calendar";
-    slack: "slack";
-  }>;
-  ownerActorId: z$2.ZodNullable<z$2.ZodString>;
-  parentConnectionId: z$2.ZodNullable<z$2.ZodString>;
-  connectedByActorId: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
-  externalAccountId: z$2.ZodString;
-  displayName: z$2.ZodOptional<z$2.ZodString>;
-  status: z$2.ZodEnum<{
-    active: "active";
-    disconnected: "disconnected";
-    error: "error";
-    reauth_required: "reauth_required";
-  }>;
-  lastSyncedAt: z$2.ZodNullable<z$2.ZodString>;
-  createdAt: z$2.ZodString;
-  capabilities: z$2.ZodObject<{
-    canRead: z$2.ZodBoolean;
-    canModify: z$2.ZodBoolean;
-    canSend: z$2.ZodBoolean;
-  }, z$2.core.$strip>;
-  syncProgress: z$2.ZodObject<{
-    processed: z$2.ZodNumber;
-    total: z$2.ZodNullable<z$2.ZodNumber>;
-    backfilling: z$2.ZodBoolean;
-  }, z$2.core.$strip>;
-  usedBy: z$2.ZodOptional<z$2.ZodObject<{
-    visible: z$2.ZodArray<z$2.ZodObject<{
+export declare const recordDriveChildrenPageSchema: z$2.ZodObject<{
+  items: z$2.ZodArray<z$2.ZodObject<{
+    id: z$2.ZodString;
+    tenantId: z$2.ZodString;
+    title: z$2.ZodString;
+    kind: z$2.ZodEnum<{
+      file: "file";
+      folder: "folder";
+    }>;
+    parentId: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+    description: z$2.ZodOptional<z$2.ZodString>;
+    contentHash: z$2.ZodOptional<z$2.ZodString>;
+    createdBy: z$2.ZodOptional<z$2.ZodString>;
+    updatedBy: z$2.ZodOptional<z$2.ZodString>;
+    deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+    position: z$2.ZodNumber;
+    createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+    updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+    subCount: z$2.ZodNullable<z$2.ZodNumber>;
+    files: z$2.ZodArray<z$2.ZodObject<{
       id: z$2.ZodString;
+      documentId: z$2.ZodString;
+      position: z$2.ZodNumber;
       name: z$2.ZodString;
-    }, z$2.core.$strip>>;
-    hiddenCount: z$2.ZodNumber;
-  }, z$2.core.$strip>>;
-}, z$2.core.$strip>;
-export type ConnectionView = z$2.output<typeof connectionViewSchema>;
-/** Scope a connection is created under. Implied by the originating settings section. */
-export declare const CONNECTOR_SCOPES: readonly ["actor", "tenant"];
-export type ConnectorScope = (typeof CONNECTOR_SCOPES)[number];
-/** Input to start an OAuth authorization flow. */
-export interface StartConnectorAuthInput {
-  provider: ConnectorProviderId;
-  scope: ConnectorScope;
-  /** Page the callback 302s back to, on a configured allowed origin. Exactly one of this or `mode`. */
-  returnUrl?: string;
-  mode?: "desktop";
-  /** Beyond `read`, which is always requested. */
-  capabilities?: Exclude<ConnectorCapability, "read">[];
-  /**
-   * The account a reconnect names (its address): the provider offers it first.
-   * A hint only: the person may still choose another account.
-   */
-  loginHint?: string;
+      mimeType: z$2.ZodString;
+      size: z$2.ZodNumber;
+      ocrStatus: z$2.ZodNullable<z$2.ZodEnum<{
+        completed: "completed";
+        failed: "failed";
+        pending: "pending";
+        processing: "processing";
+        unsupported: "unsupported";
+      }>>;
+      ocrConfidence: z$2.ZodNullable<z$2.ZodNumber>;
+      processedAt: z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>;
+    }, z$2.core.$strip>>;
+    attributeName: z$2.ZodOptional<z$2.ZodString>;
+    properties: z$2.ZodOptional<z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>>;
+  }, z$2.core.$strip>>;
+  nextCursor: z$2.ZodNullable<z$2.ZodString>;
+}, z$2.core.$strip>;
+export type RecordDriveChildrenPage = z$2.output<typeof recordDriveChildrenPageSchema>;
+export interface CreateDocument {
+  title: string;
+  kind?: DocumentKind;
+  parentId?: Uuid | null;
+  description?: string;
+  position?: number;
 }
 /**
- * Providers this deployment holds OAuth credentials for. A provider absent from
- * the list cannot start an authorization flow, so its card is not offered.
+ * Reference to a record attribute that should atomically attach a freshly
+ * created Document. Passed alongside `CreateDocument` to make creation
+ * link-aware end-to-end (client → REST → service → repo).
+ *
+ * The server requires this — orphan Documents are not creatable through the
+ * REST API.
  */
-export declare const connectorProvidersResultSchema: z$2.ZodObject<{
-  providers: z$2.ZodArray<z$2.ZodEnum<{
-    github: "github";
-    gmail: "gmail";
-    "google-calendar": "google-calendar";
-    outlook: "outlook";
-    "outlook-calendar": "outlook-calendar";
-    slack: "slack";
-  }>>;
-  mailTriageProviders: z$2.ZodArray<z$2.ZodEnum<{
-    github: "github";
-    gmail: "gmail";
-    "google-calendar": "google-calendar";
-    outlook: "outlook";
-    "outlook-calendar": "outlook-calendar";
-    slack: "slack";
-  }>>;
-}, z$2.core.$strip>;
-export type ConnectorProvidersResult = z$2.output<typeof connectorProvidersResultSchema>;
-/** Input to attach a Microsoft shared mailbox to an existing Outlook connection. */
-export interface AddSharedMailboxInput {
-  /** Shared mailbox SMTP address (e.g. contact@company.com). */
-  address: string;
-  /** Visibility of the synced emails: tenant (default UX) or only the adding actor. */
-  scope: ConnectorScope;
+export interface CreateDocumentLink {
+  objectName: string;
+  sourceRecordId: string;
+  attributeName: string;
+}
+export interface UpdateDocument {
+  title?: string;
+  parentId?: Uuid | null;
+  position?: number;
+}
+export interface DocumentListOptions {
+  limit?: number;
+  offset?: number;
+}
+export interface RecordDocuments {
+  /** Documents grouped by attribute name (includes system 'attachments' attribute) */
+  byAttribute: Record<string, DocumentWithFiles[]>;
 }
-/** How a connector's consent ended, as the app's surfaces read it. */
-export type ConnectorCallbackStatusValue = "connected" | "error";
-/** The unified verbs an agent calls on typed references. */
-export declare const VERB_NAMES: readonly ["search", "query", "read", "write", "delete", "organize", "copy", "send"];
-export type VerbName = (typeof VERB_NAMES)[number];
-/** The one verb by which an agent reaches a person, a session or a draft. */
-export declare const SEND_VERB_NAME = "send";
-/** The verb that moves bytes between the sandbox, a mailbox and Standards' own files. */
-export declare const COPY_VERB_NAME = "copy";
-/** Record, document and file tools: always loaded, bounded by data permissions. */
-export declare const CORE_RECORD_TOOL_NAMES: readonly ["search", "query", "read", "write", "delete", "organize", "copy", "send", "edit_content"];
-/** Core: always loaded, never removable (D2). */
-export declare const CORE_TOOL_NAMES: readonly ["search", "query", "read", "write", "delete", "organize", "copy", "send", "edit_content", "compact_context", "request_work_mode", "write_todos"];
 /**
- * The one browser tool: it opens a cloud browser that `agent-browser` drives
- * through `exec_command`, so a browser grant always comes with the sandbox.
+ * One record that holds documents, with how much sits at its drive root and
+ * when it last moved. The wire shape of `GET /documents/record-owners`.
  */
-export declare const BROWSER_TOOL_NAMES: readonly ["browser_launch"];
-/** Capabilities a grant switches on inside the verbs. */
-export type VerbCapability = "bulk" | "activity" | "transcript" | "copy_email";
-/** Reference kinds available without any grant (`user` is gated by `userDirectory`, not a grant). */
-export declare const ALWAYS_KINDS: readonly ReferenceKind[];
-/** What a grant enables: the kinds and capabilities on the verbs, plus its non-verb tools. */
-export type GrantEnables = {
-  kinds: readonly ReferenceKind[];
-  capabilities: readonly VerbCapability[];
-  tools: readonly string[];
-};
-/** A closed allowlist, written per verb: allowed actions, kinds, includes, batch size, aggregation. */
-export type VerbAllowlist = { [V in VerbName]?: {
-  actions?: readonly string[];
-  kinds?: readonly ReferenceKind[];
-  includes?: readonly string[];
-  batch?: number;
-  aggregate?: boolean;
-  /** `send` only: who the verb may reach. Absent means every target. */
-  targets?: readonly ("person" | "session" | "draft")[];
-}; };
-export declare const NATIVE_TOOL_GROUP_CATALOG: {
-  readonly sandbox: {
-    readonly icon: "terminal";
-    readonly tools: readonly ["exec_command", "publish_artifact", "sandbox_validate_payload"];
-  };
-  readonly web: {
-    readonly icon: "globe";
-    readonly tools: readonly ["read_webpage", "web_search"];
-  };
-  readonly image: {
-    readonly icon: "image";
-    readonly tools: readonly ["generate_image"];
-  };
-  readonly memory: {
-    readonly icon: "book-open";
-    readonly tools: readonly ["propose_memory"];
-  };
-  readonly bulk: {
-    readonly icon: "layers-two";
-    readonly tools: readonly [];
-  };
-  readonly activity: {
-    readonly icon: "activity";
-    readonly tools: readonly [];
-  };
-  readonly orchestration: {
-    readonly icon: "git-branch";
-    readonly tools: readonly ["spawn_agent"];
-  };
-  readonly host: {
-    readonly icon: "wrench";
-    readonly tools: readonly [];
-  };
-  readonly "cloud-browser": {
-    readonly icon: "globe";
-    readonly tools: readonly ["browser_launch"];
-  };
-  readonly "agent-config": {
-    readonly icon: "sparkles";
-    readonly tools: readonly ["get_agents", "upsert_agent"];
-  };
-};
-export declare const RESOURCE_KIND_CATALOG: {
-  readonly mcp: {
-    readonly icon: "puzzle";
-    readonly tools: readonly [];
-  };
-  readonly "email.read": {
-    readonly icon: "envelope";
-    readonly tools: readonly [];
-  };
-  readonly "email.send": {
-    readonly icon: "send";
-    readonly tools: readonly [];
-  };
-  readonly "calendar.read": {
-    readonly icon: "calendar";
-    readonly tools: readonly [];
-  };
-  readonly github: {
-    readonly icon: "brand-github";
-    readonly tools: readonly [];
+export declare const documentRecordOwnerSchema: z$2.ZodObject<{
+  recordId: z$2.ZodString;
+  objectName: z$2.ZodString;
+  label: z$2.ZodString;
+  itemCount: z$2.ZodNumber;
+  fileCount: z$2.ZodNumber;
+  lastActivityAt: z$2.ZodString;
+}, z$2.core.$strip>;
+export type DocumentRecordOwner = z$2.output<typeof documentRecordOwnerSchema>;
+/** One page of {@link DocumentRecordOwner}s; `nextOffset: null` is the last page. */
+export declare const documentRecordOwnerPageSchema: z$2.ZodObject<{
+  data: z$2.ZodArray<z$2.ZodObject<{
+    recordId: z$2.ZodString;
+    objectName: z$2.ZodString;
+    label: z$2.ZodString;
+    itemCount: z$2.ZodNumber;
+    fileCount: z$2.ZodNumber;
+    lastActivityAt: z$2.ZodString;
+  }, z$2.core.$strip>>;
+  nextOffset: z$2.ZodNullable<z$2.ZodNumber>;
+}, z$2.core.$strip>;
+export type DocumentRecordOwnerPage = z$2.output<typeof documentRecordOwnerPageSchema>;
+/** What the reading actor may do with a resource (spec §6.6); records never produce `runner`. */
+export declare const viewerAccessSchema: z$2.ZodEnum<{
+  editor: "editor";
+  owner: "owner";
+  reader: "reader";
+  runner: "runner";
+  workspace: "workspace";
+}>;
+type Values = readonly [string, ...string[]];
+/** One beneficiary of a private resource: its effective role and every source that grants it. */
+export declare function accessGrantSchema<const Role extends Values, const Source extends Values>(roles: Role, sources: Source): z$2.ZodObject<{
+  actorId: z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>;
+  role: z$2.ZodEnum<{ [k in Role[number]]: k; } extends (infer T) ? { [k in keyof T]: T[k]; } : never>;
+  sources: z$2.ZodArray<z$2.ZodEnum<{ [k in Source[number]]: k; } extends (infer T_1) ? { [k in keyof T_1]: T_1[k]; } : never>>;
+}, z$2.core.$strip>;
+/** Who can reach a record beyond its owner (`GET /records/:object/:id/access`). */
+export declare const recordAudienceSchema: z$2.ZodObject<{
+  recordId: z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>;
+  visibility: z$2.ZodEnum<{
+    private: "private";
+    workspace: "workspace";
+  }>;
+  ownedBy: z$2.ZodNullable<z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>>;
+  viewerAccess: z$2.ZodEnum<{
+    editor: "editor";
+    owner: "owner";
+    reader: "reader";
+    runner: "runner";
+    workspace: "workspace";
+  }>;
+  grants: z$2.ZodArray<z$2.ZodObject<{
+    actorId: z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>;
+    role: z$2.ZodEnum<{
+      editor: "editor";
+      reader: "reader";
+    }>;
+    sources: z$2.ZodArray<z$2.ZodEnum<{
+      manual: "manual";
+      meeting_attendee: "meeting_attendee";
+    }>>;
+  }, z$2.core.$strip>>;
+}, z$2.core.$strip>;
+/** Who may run commands on a device beyond its owner (`GET /devices/:id/access`). */
+export declare const deviceAudienceSchema: z$2.ZodObject<{
+  deviceId: z$2.ZodString;
+  visibility: z$2.ZodEnum<{
+    private: "private";
+    workspace: "workspace";
+  }>;
+  ownedBy: z$2.ZodNullable<z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>>;
+  viewerAccess: z$2.ZodEnum<{
+    editor: "editor";
+    owner: "owner";
+    reader: "reader";
+    runner: "runner";
+    workspace: "workspace";
+  }>;
+  grants: z$2.ZodArray<z$2.ZodObject<{
+    actorId: z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>;
+    role: z$2.ZodEnum<{
+      runner: "runner";
+    }>;
+    sources: z$2.ZodArray<z$2.ZodEnum<{
+      manual: "manual";
+    }>>;
+  }, z$2.core.$strip>>;
+}, z$2.core.$strip>;
+/** Who can reach a private page beyond its owner (`GET /pages/:id/access`). */
+export declare const pageAudienceSchema: z$2.ZodObject<{
+  pageId: z$2.ZodString;
+  visibility: z$2.ZodEnum<{
+    private: "private";
+    workspace: "workspace";
+  }>;
+  ownedBy: z$2.ZodNullable<z$2.ZodString>;
+  viewerAccess: z$2.ZodEnum<{
+    editor: "editor";
+    owner: "owner";
+    reader: "reader";
+    runner: "runner";
+    workspace: "workspace";
+  }>;
+  grants: z$2.ZodArray<z$2.ZodObject<{
+    actorId: z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>;
+    role: z$2.ZodEnum<{
+      editor: "editor";
+      reader: "reader";
+    }>;
+    sources: z$2.ZodArray<z$2.ZodEnum<{
+      manual: "manual";
+    }>>;
+  }, z$2.core.$strip>>;
+}, z$2.core.$strip>;
+/** Canonical normalized actions and legal condition fields (trigger catalogue F). */
+export declare const GITHUB_TRIGGER_CATALOG: {
+  readonly pull_request: {
+    readonly events: readonly ["pull_request"];
+    readonly actions: readonly ["opened", "ready_for_review", "synchronize", "merged", "closed", "labeled"];
+    readonly conditions: readonly ["baseBranch", "headBranch", "draft", "label", "issueLabels", "changedPaths", "prAuthor"];
   };
-  readonly "slack.read": {
-    readonly icon: "brand-slack";
-    readonly tools: readonly ["slack_read", "slack_find", "slack_download_file"];
+  readonly review: {
+    readonly events: readonly ["pull_request_review"];
+    readonly actions: readonly ["submitted"];
+    readonly conditions: readonly ["reviewState", "prAuthor"];
   };
-  readonly "slack.write": {
-    readonly icon: "brand-slack";
-    readonly tools: readonly ["slack_send", "slack_react"];
+  readonly comment: {
+    readonly events: readonly ["issue_comment", "pull_request_review_comment"];
+    readonly actions: readonly ["created"];
+    readonly conditions: readonly ["text", "issueAuthor", "prAuthor"];
   };
-  readonly device: {
-    readonly icon: "desktop";
-    readonly tools: readonly ["exec_command"];
+  readonly push: {
+    readonly events: readonly ["push"];
+    readonly actions: readonly ["pushed"];
+    readonly conditions: readonly ["branch", "changedPaths", "forced"];
   };
-  readonly "browser-profile": {
-    readonly icon: "globe";
-    readonly tools: readonly ["browser_launch"];
+  readonly workflow: {
+    readonly events: readonly ["workflow_run"];
+    readonly actions: readonly ["completed"];
+    readonly conditions: readonly ["workflowName", "conclusion", "branch", "originEvent"];
   };
-  readonly login: {
-    readonly icon: "key";
-    readonly tools: readonly [];
+  readonly check: {
+    readonly events: readonly ["check_suite", "check_run"];
+    readonly actions: readonly ["completed"];
+    readonly conditions: readonly ["checkApp", "checkName", "conclusion"];
   };
 };
-/** The single source of which grant enables which kinds, capabilities and tools. */
-export declare const GRANT_ENABLES: {
-  readonly sandbox: {
-    readonly kinds: readonly [];
-    readonly capabilities: readonly [];
-    readonly tools: readonly ["exec_command", "publish_artifact", "sandbox_validate_payload"];
-  };
-  readonly web: {
-    readonly kinds: readonly [];
-    readonly capabilities: readonly [];
-    readonly tools: readonly ["read_webpage", "web_search"];
-  };
-  readonly image: {
-    readonly kinds: readonly [];
-    readonly capabilities: readonly [];
-    readonly tools: readonly ["generate_image"];
-  };
-  readonly memory: {
-    readonly kinds: readonly ["memory"];
-    readonly capabilities: readonly [];
-    readonly tools: readonly ["propose_memory"];
-  };
-  readonly bulk: {
-    readonly kinds: readonly [];
-    readonly capabilities: readonly ["bulk"];
-    readonly tools: readonly [];
-  };
-  readonly activity: {
-    readonly kinds: readonly [];
-    readonly capabilities: readonly ["activity"];
-    readonly tools: readonly [];
-  };
-  readonly orchestration: {
-    readonly kinds: readonly [];
-    readonly capabilities: readonly [];
-    readonly tools: readonly ["spawn_agent"];
-  };
-  readonly host: {
-    readonly kinds: readonly [];
-    readonly capabilities: readonly [];
-    readonly tools: readonly [];
-  };
-  readonly "cloud-browser": {
-    readonly kinds: readonly [];
-    readonly capabilities: readonly [];
-    readonly tools: readonly ["browser_launch"];
-  };
-  readonly "agent-config": {
-    readonly kinds: readonly [];
-    readonly capabilities: readonly [];
-    readonly tools: readonly ["get_agents", "upsert_agent"];
-  };
-  readonly mcp: {
-    readonly kinds: readonly [];
-    readonly capabilities: readonly [];
-    readonly tools: readonly [];
+export declare const SLACK_TRIGGER_CATALOG: {
+  readonly mention: {
+    readonly events: readonly ["app_mention"];
+    readonly conditions: readonly ["text"];
   };
-  readonly "email.read": {
-    readonly kinds: readonly ["email", "thread"];
-    readonly capabilities: readonly ["copy_email"];
-    readonly tools: readonly [];
+  readonly message: {
+    readonly events: readonly ["message"];
+    readonly conditions: readonly ["position", "text", "hasFile"];
   };
-  readonly "email.send": {
-    readonly kinds: readonly ["email", "thread", "draft"];
-    readonly capabilities: readonly ["copy_email"];
-    readonly tools: readonly [];
+  readonly dm: {
+    readonly events: readonly ["message"];
+    readonly conditions: readonly ["text", "hasFile"];
   };
-  readonly "calendar.read": {
-    readonly kinds: readonly ["event"];
-    readonly capabilities: readonly ["transcript"];
-    readonly tools: readonly [];
+  readonly reaction: {
+    readonly events: readonly ["reaction_added"];
+    readonly conditions: readonly ["messageAuthor"];
   };
-  readonly github: {
-    readonly kinds: readonly [];
-    readonly capabilities: readonly [];
-    readonly tools: readonly [];
+};
+export declare const githubConditionSchema: z$2.ZodDiscriminatedUnion<[z$2.ZodObject<{
+  field: z$2.ZodLiteral<"text">;
+  operator: z$2.ZodEnum<{
+    contains: "contains";
+    starts_with: "starts_with";
+  }>;
+  value: z$2.ZodString;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  field: z$2.ZodLiteral<"label">;
+  value: z$2.ZodString;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  field: z$2.ZodLiteral<"issueLabels">;
+  operator: z$2.ZodDefault<z$2.ZodEnum<{
+    all: "all";
+    any: "any";
+  }>>;
+  value: z$2.ZodArray<z$2.ZodString>;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  field: z$2.ZodLiteral<"baseBranch">;
+  value: z$2.ZodString;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  field: z$2.ZodLiteral<"headBranch">;
+  value: z$2.ZodString;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  field: z$2.ZodLiteral<"branch">;
+  value: z$2.ZodString;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  field: z$2.ZodLiteral<"draft">;
+  value: z$2.ZodBoolean;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  field: z$2.ZodLiteral<"changedPaths">;
+  value: z$2.ZodString;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  field: z$2.ZodLiteral<"forced">;
+  value: z$2.ZodBoolean;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  field: z$2.ZodLiteral<"prAuthor">;
+  value: z$2.ZodString;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  field: z$2.ZodLiteral<"issueAuthor">;
+  value: z$2.ZodString;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  field: z$2.ZodLiteral<"reviewState">;
+  value: z$2.ZodEnum<{
+    approved: "approved";
+    changes_requested: "changes_requested";
+    commented: "commented";
+  }>;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  field: z$2.ZodLiteral<"workflowName">;
+  value: z$2.ZodString;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  field: z$2.ZodLiteral<"checkApp">;
+  value: z$2.ZodString;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  field: z$2.ZodLiteral<"checkName">;
+  value: z$2.ZodString;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  field: z$2.ZodLiteral<"conclusion">;
+  value: z$2.ZodString;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  field: z$2.ZodLiteral<"originEvent">;
+  value: z$2.ZodString;
+}, z$2.core.$strict>], "field">;
+export declare const slackConditionSchema: z$2.ZodDiscriminatedUnion<[z$2.ZodObject<{
+  field: z$2.ZodLiteral<"text">;
+  operator: z$2.ZodEnum<{
+    contains: "contains";
+    starts_with: "starts_with";
+  }>;
+  value: z$2.ZodString;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  field: z$2.ZodLiteral<"position">;
+  value: z$2.ZodEnum<{
+    reply: "reply";
+    top_level: "top_level";
+  }>;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  field: z$2.ZodLiteral<"hasFile">;
+  value: z$2.ZodBoolean;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  field: z$2.ZodLiteral<"messageAuthor">;
+  value: z$2.ZodString;
+}, z$2.core.$strict>], "field">;
+export type GithubCondition = z$2.output<typeof githubConditionSchema>;
+export type SlackCondition = z$2.output<typeof slackConditionSchema>;
+export type GithubTriggerFamily = keyof typeof GITHUB_TRIGGER_CATALOG;
+export type SlackTriggerOn = keyof typeof SLACK_TRIGGER_CATALOG;
+/** Every GitHub family, in the catalogue's order. */
+export declare const GITHUB_TRIGGER_FAMILIES: [GithubTriggerFamily, ...GithubTriggerFamily[]];
+/** Every Slack event a trigger listens to, in the catalogue's order. */
+export declare const SLACK_TRIGGER_EVENTS: [SlackTriggerOn, ...SlackTriggerOn[]];
+export type GithubTriggerAction<F extends GithubTriggerFamily = GithubTriggerFamily> = (typeof GITHUB_TRIGGER_CATALOG)[F]["actions"][number];
+export type GithubTriggerSender = "human" | "me" | "any" | {
+  logins: string[];
+};
+export type SlackTriggerSender = "human" | "me" | "any" | {
+  users: string[];
+};
+export type GithubTriggerMatch = { [F in GithubTriggerFamily]: {
+  family: F;
+  actions: GithubTriggerAction<F>[];
+  repositories: string[];
+  sender: GithubTriggerSender;
+  conditions: Extract<GithubCondition, {
+    field: (typeof GITHUB_TRIGGER_CATALOG)[F]["conditions"][number];
+  }>[];
+}; }[GithubTriggerFamily];
+export type SlackTriggerMatch = { [O in SlackTriggerOn]: {
+  on: O;
+  channels: string[];
+  sender: SlackTriggerSender;
+  conditions: Extract<SlackCondition, {
+    field: (typeof SLACK_TRIGGER_CATALOG)[O]["conditions"][number];
+  }>[];
+} & (O extends "reaction" ? {
+  reactions?: string[];
+} : {
+  reactions?: never;
+}); }[SlackTriggerOn];
+export type ConnectorTriggerMatch = GithubTriggerMatch | SlackTriggerMatch;
+/** The suffix of `owner/*`: every repository of that owner, installed now or later. */
+export declare const REPOSITORY_WILDCARD = "/*";
+/** Whether a stored repository (`owner/repo` or `owner/*`) covers a full name. Case-insensitive. */
+export declare function matchesRepositoryPattern(pattern: string, fullName: string): boolean;
+/** The refinements establish the family/condition/action correlation of the output union. */
+export declare const githubTriggerMatchSchema: z$2.ZodPipe<z$2.ZodObject<{
+  family: z$2.ZodEnum<{
+    check: "check";
+    comment: "comment";
+    pull_request: "pull_request";
+    push: "push";
+    review: "review";
+    workflow: "workflow";
+  }>;
+  actions: z$2.ZodDefault<z$2.ZodArray<z$2.ZodString>>;
+  repositories: z$2.ZodDefault<z$2.ZodArray<z$2.ZodString>>;
+  sender: z$2.ZodDefault<z$2.ZodUnion<readonly [z$2.ZodEnum<{
+    any: "any";
+    human: "human";
+    me: "me";
+  }>, z$2.ZodObject<{
+    logins: z$2.ZodArray<z$2.ZodString>;
+  }, z$2.core.$strict>]>>;
+  conditions: z$2.ZodDefault<z$2.ZodArray<z$2.ZodDiscriminatedUnion<[z$2.ZodObject<{
+    field: z$2.ZodLiteral<"text">;
+    operator: z$2.ZodEnum<{
+      contains: "contains";
+      starts_with: "starts_with";
+    }>;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"label">;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"issueLabels">;
+    operator: z$2.ZodDefault<z$2.ZodEnum<{
+      all: "all";
+      any: "any";
+    }>>;
+    value: z$2.ZodArray<z$2.ZodString>;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"baseBranch">;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"headBranch">;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"branch">;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"draft">;
+    value: z$2.ZodBoolean;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"changedPaths">;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"forced">;
+    value: z$2.ZodBoolean;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"prAuthor">;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"issueAuthor">;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"reviewState">;
+    value: z$2.ZodEnum<{
+      approved: "approved";
+      changes_requested: "changes_requested";
+      commented: "commented";
+    }>;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"workflowName">;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"checkApp">;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"checkName">;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"conclusion">;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"originEvent">;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>], "field">>>;
+}, z$2.core.$strict>, z$2.ZodTransform<{
+  family: "check";
+  actions: "completed"[];
+  repositories: string[];
+  sender: GithubTriggerSender;
+  conditions: ({
+    field: "checkApp";
+    value: string;
+  } | {
+    field: "checkName";
+    value: string;
+  } | {
+    field: "conclusion";
+    value: string;
+  })[];
+} | {
+  family: "comment";
+  actions: "created"[];
+  repositories: string[];
+  sender: GithubTriggerSender;
+  conditions: ({
+    field: "text";
+    operator: "contains" | "starts_with";
+    value: string;
+  } | {
+    field: "issueAuthor";
+    value: string;
+  } | {
+    field: "prAuthor";
+    value: string;
+  })[];
+} | {
+  family: "pull_request";
+  actions: ("closed" | "labeled" | "merged" | "opened" | "ready_for_review" | "synchronize")[];
+  repositories: string[];
+  sender: GithubTriggerSender;
+  conditions: ({
+    field: "baseBranch";
+    value: string;
+  } | {
+    field: "changedPaths";
+    value: string;
+  } | {
+    field: "headBranch";
+    value: string;
+  } | {
+    field: "label";
+    value: string;
+  } | {
+    field: "prAuthor";
+    value: string;
+  } | {
+    field: "draft";
+    value: boolean;
+  } | {
+    field: "issueLabels";
+    operator: "all" | "any";
+    value: string[];
+  })[];
+} | {
+  family: "push";
+  actions: "pushed"[];
+  repositories: string[];
+  sender: GithubTriggerSender;
+  conditions: ({
+    field: "branch";
+    value: string;
+  } | {
+    field: "changedPaths";
+    value: string;
+  } | {
+    field: "forced";
+    value: boolean;
+  })[];
+} | {
+  family: "review";
+  actions: "submitted"[];
+  repositories: string[];
+  sender: GithubTriggerSender;
+  conditions: ({
+    field: "prAuthor";
+    value: string;
+  } | {
+    field: "reviewState";
+    value: "approved" | "changes_requested" | "commented";
+  })[];
+} | {
+  family: "workflow";
+  actions: "completed"[];
+  repositories: string[];
+  sender: GithubTriggerSender;
+  conditions: ({
+    field: "branch";
+    value: string;
+  } | {
+    field: "conclusion";
+    value: string;
+  } | {
+    field: "originEvent";
+    value: string;
+  } | {
+    field: "workflowName";
+    value: string;
+  })[];
+}, {
+  family: "check" | "comment" | "pull_request" | "push" | "review" | "workflow";
+  actions: string[];
+  repositories: string[];
+  sender: "any" | "human" | "me" | {
+    logins: string[];
   };
-  readonly "slack.read": {
-    readonly kinds: readonly [];
-    readonly capabilities: readonly [];
-    readonly tools: readonly ["slack_read", "slack_find", "slack_download_file"];
+  conditions: ({
+    field: "text";
+    operator: "contains" | "starts_with";
+    value: string;
+  } | {
+    field: "baseBranch";
+    value: string;
+  } | {
+    field: "branch";
+    value: string;
+  } | {
+    field: "changedPaths";
+    value: string;
+  } | {
+    field: "checkApp";
+    value: string;
+  } | {
+    field: "checkName";
+    value: string;
+  } | {
+    field: "conclusion";
+    value: string;
+  } | {
+    field: "headBranch";
+    value: string;
+  } | {
+    field: "issueAuthor";
+    value: string;
+  } | {
+    field: "label";
+    value: string;
+  } | {
+    field: "originEvent";
+    value: string;
+  } | {
+    field: "prAuthor";
+    value: string;
+  } | {
+    field: "workflowName";
+    value: string;
+  } | {
+    field: "draft";
+    value: boolean;
+  } | {
+    field: "forced";
+    value: boolean;
+  } | {
+    field: "issueLabels";
+    operator: "all" | "any";
+    value: string[];
+  } | {
+    field: "reviewState";
+    value: "approved" | "changes_requested" | "commented";
+  })[];
+}>>;
+export declare const slackTriggerMatchSchema: z$2.ZodPipe<z$2.ZodObject<{
+  on: z$2.ZodEnum<{
+    dm: "dm";
+    mention: "mention";
+    message: "message";
+    reaction: "reaction";
+  }>;
+  channels: z$2.ZodDefault<z$2.ZodArray<z$2.ZodString>>;
+  reactions: z$2.ZodOptional<z$2.ZodArray<z$2.ZodString>>;
+  sender: z$2.ZodDefault<z$2.ZodUnion<readonly [z$2.ZodEnum<{
+    any: "any";
+    human: "human";
+    me: "me";
+  }>, z$2.ZodObject<{
+    users: z$2.ZodArray<z$2.ZodString>;
+  }, z$2.core.$strict>]>>;
+  conditions: z$2.ZodDefault<z$2.ZodArray<z$2.ZodDiscriminatedUnion<[z$2.ZodObject<{
+    field: z$2.ZodLiteral<"text">;
+    operator: z$2.ZodEnum<{
+      contains: "contains";
+      starts_with: "starts_with";
+    }>;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"position">;
+    value: z$2.ZodEnum<{
+      reply: "reply";
+      top_level: "top_level";
+    }>;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"hasFile">;
+    value: z$2.ZodBoolean;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"messageAuthor">;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>], "field">>>;
+}, z$2.core.$strict>, z$2.ZodTransform<({
+  on: "dm";
+  channels: string[];
+  sender: SlackTriggerSender;
+  conditions: ({
+    field: "text";
+    operator: "contains" | "starts_with";
+    value: string;
+  } | {
+    field: "hasFile";
+    value: boolean;
+  })[];
+} & {
+  reactions?: never;
+}) | ({
+  on: "mention";
+  channels: string[];
+  sender: SlackTriggerSender;
+  conditions: {
+    field: "text";
+    operator: "contains" | "starts_with";
+    value: string;
+  }[];
+} & {
+  reactions?: never;
+}) | ({
+  on: "message";
+  channels: string[];
+  sender: SlackTriggerSender;
+  conditions: ({
+    field: "text";
+    operator: "contains" | "starts_with";
+    value: string;
+  } | {
+    field: "hasFile";
+    value: boolean;
+  } | {
+    field: "position";
+    value: "reply" | "top_level";
+  })[];
+} & {
+  reactions?: never;
+}) | ({
+  on: "reaction";
+  channels: string[];
+  sender: SlackTriggerSender;
+  conditions: {
+    field: "messageAuthor";
+    value: string;
+  }[];
+} & {
+  reactions?: string[];
+}), {
+  on: "dm" | "mention" | "message" | "reaction";
+  channels: string[];
+  reactions?: string[] | undefined;
+  sender: "any" | "human" | "me" | {
+    users: string[];
   };
-  readonly "slack.write": {
-    readonly kinds: readonly [];
-    readonly capabilities: readonly [];
-    readonly tools: readonly ["slack_send", "slack_react"];
+  conditions: ({
+    field: "text";
+    operator: "contains" | "starts_with";
+    value: string;
+  } | {
+    field: "messageAuthor";
+    value: string;
+  } | {
+    field: "hasFile";
+    value: boolean;
+  } | {
+    field: "position";
+    value: "reply" | "top_level";
+  })[];
+}>>;
+export declare const connectorTriggerMatchSchema: z$2.ZodUnion<readonly [z$2.ZodPipe<z$2.ZodObject<{
+  family: z$2.ZodEnum<{
+    check: "check";
+    comment: "comment";
+    pull_request: "pull_request";
+    push: "push";
+    review: "review";
+    workflow: "workflow";
+  }>;
+  actions: z$2.ZodDefault<z$2.ZodArray<z$2.ZodString>>;
+  repositories: z$2.ZodDefault<z$2.ZodArray<z$2.ZodString>>;
+  sender: z$2.ZodDefault<z$2.ZodUnion<readonly [z$2.ZodEnum<{
+    any: "any";
+    human: "human";
+    me: "me";
+  }>, z$2.ZodObject<{
+    logins: z$2.ZodArray<z$2.ZodString>;
+  }, z$2.core.$strict>]>>;
+  conditions: z$2.ZodDefault<z$2.ZodArray<z$2.ZodDiscriminatedUnion<[z$2.ZodObject<{
+    field: z$2.ZodLiteral<"text">;
+    operator: z$2.ZodEnum<{
+      contains: "contains";
+      starts_with: "starts_with";
+    }>;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"label">;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"issueLabels">;
+    operator: z$2.ZodDefault<z$2.ZodEnum<{
+      all: "all";
+      any: "any";
+    }>>;
+    value: z$2.ZodArray<z$2.ZodString>;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"baseBranch">;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"headBranch">;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"branch">;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"draft">;
+    value: z$2.ZodBoolean;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"changedPaths">;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"forced">;
+    value: z$2.ZodBoolean;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"prAuthor">;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"issueAuthor">;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"reviewState">;
+    value: z$2.ZodEnum<{
+      approved: "approved";
+      changes_requested: "changes_requested";
+      commented: "commented";
+    }>;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"workflowName">;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"checkApp">;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"checkName">;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"conclusion">;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"originEvent">;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>], "field">>>;
+}, z$2.core.$strict>, z$2.ZodTransform<{
+  family: "check";
+  actions: "completed"[];
+  repositories: string[];
+  sender: GithubTriggerSender;
+  conditions: ({
+    field: "checkApp";
+    value: string;
+  } | {
+    field: "checkName";
+    value: string;
+  } | {
+    field: "conclusion";
+    value: string;
+  })[];
+} | {
+  family: "comment";
+  actions: "created"[];
+  repositories: string[];
+  sender: GithubTriggerSender;
+  conditions: ({
+    field: "text";
+    operator: "contains" | "starts_with";
+    value: string;
+  } | {
+    field: "issueAuthor";
+    value: string;
+  } | {
+    field: "prAuthor";
+    value: string;
+  })[];
+} | {
+  family: "pull_request";
+  actions: ("closed" | "labeled" | "merged" | "opened" | "ready_for_review" | "synchronize")[];
+  repositories: string[];
+  sender: GithubTriggerSender;
+  conditions: ({
+    field: "baseBranch";
+    value: string;
+  } | {
+    field: "changedPaths";
+    value: string;
+  } | {
+    field: "headBranch";
+    value: string;
+  } | {
+    field: "label";
+    value: string;
+  } | {
+    field: "prAuthor";
+    value: string;
+  } | {
+    field: "draft";
+    value: boolean;
+  } | {
+    field: "issueLabels";
+    operator: "all" | "any";
+    value: string[];
+  })[];
+} | {
+  family: "push";
+  actions: "pushed"[];
+  repositories: string[];
+  sender: GithubTriggerSender;
+  conditions: ({
+    field: "branch";
+    value: string;
+  } | {
+    field: "changedPaths";
+    value: string;
+  } | {
+    field: "forced";
+    value: boolean;
+  })[];
+} | {
+  family: "review";
+  actions: "submitted"[];
+  repositories: string[];
+  sender: GithubTriggerSender;
+  conditions: ({
+    field: "prAuthor";
+    value: string;
+  } | {
+    field: "reviewState";
+    value: "approved" | "changes_requested" | "commented";
+  })[];
+} | {
+  family: "workflow";
+  actions: "completed"[];
+  repositories: string[];
+  sender: GithubTriggerSender;
+  conditions: ({
+    field: "branch";
+    value: string;
+  } | {
+    field: "conclusion";
+    value: string;
+  } | {
+    field: "originEvent";
+    value: string;
+  } | {
+    field: "workflowName";
+    value: string;
+  })[];
+}, {
+  family: "check" | "comment" | "pull_request" | "push" | "review" | "workflow";
+  actions: string[];
+  repositories: string[];
+  sender: "any" | "human" | "me" | {
+    logins: string[];
   };
-  readonly device: {
-    readonly kinds: readonly [];
-    readonly capabilities: readonly [];
-    readonly tools: readonly ["exec_command"];
+  conditions: ({
+    field: "text";
+    operator: "contains" | "starts_with";
+    value: string;
+  } | {
+    field: "baseBranch";
+    value: string;
+  } | {
+    field: "branch";
+    value: string;
+  } | {
+    field: "changedPaths";
+    value: string;
+  } | {
+    field: "checkApp";
+    value: string;
+  } | {
+    field: "checkName";
+    value: string;
+  } | {
+    field: "conclusion";
+    value: string;
+  } | {
+    field: "headBranch";
+    value: string;
+  } | {
+    field: "issueAuthor";
+    value: string;
+  } | {
+    field: "label";
+    value: string;
+  } | {
+    field: "originEvent";
+    value: string;
+  } | {
+    field: "prAuthor";
+    value: string;
+  } | {
+    field: "workflowName";
+    value: string;
+  } | {
+    field: "draft";
+    value: boolean;
+  } | {
+    field: "forced";
+    value: boolean;
+  } | {
+    field: "issueLabels";
+    operator: "all" | "any";
+    value: string[];
+  } | {
+    field: "reviewState";
+    value: "approved" | "changes_requested" | "commented";
+  })[];
+}>>, z$2.ZodPipe<z$2.ZodObject<{
+  on: z$2.ZodEnum<{
+    dm: "dm";
+    mention: "mention";
+    message: "message";
+    reaction: "reaction";
+  }>;
+  channels: z$2.ZodDefault<z$2.ZodArray<z$2.ZodString>>;
+  reactions: z$2.ZodOptional<z$2.ZodArray<z$2.ZodString>>;
+  sender: z$2.ZodDefault<z$2.ZodUnion<readonly [z$2.ZodEnum<{
+    any: "any";
+    human: "human";
+    me: "me";
+  }>, z$2.ZodObject<{
+    users: z$2.ZodArray<z$2.ZodString>;
+  }, z$2.core.$strict>]>>;
+  conditions: z$2.ZodDefault<z$2.ZodArray<z$2.ZodDiscriminatedUnion<[z$2.ZodObject<{
+    field: z$2.ZodLiteral<"text">;
+    operator: z$2.ZodEnum<{
+      contains: "contains";
+      starts_with: "starts_with";
+    }>;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"position">;
+    value: z$2.ZodEnum<{
+      reply: "reply";
+      top_level: "top_level";
+    }>;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"hasFile">;
+    value: z$2.ZodBoolean;
+  }, z$2.core.$strict>, z$2.ZodObject<{
+    field: z$2.ZodLiteral<"messageAuthor">;
+    value: z$2.ZodString;
+  }, z$2.core.$strict>], "field">>>;
+}, z$2.core.$strict>, z$2.ZodTransform<({
+  on: "dm";
+  channels: string[];
+  sender: SlackTriggerSender;
+  conditions: ({
+    field: "text";
+    operator: "contains" | "starts_with";
+    value: string;
+  } | {
+    field: "hasFile";
+    value: boolean;
+  })[];
+} & {
+  reactions?: never;
+}) | ({
+  on: "mention";
+  channels: string[];
+  sender: SlackTriggerSender;
+  conditions: {
+    field: "text";
+    operator: "contains" | "starts_with";
+    value: string;
+  }[];
+} & {
+  reactions?: never;
+}) | ({
+  on: "message";
+  channels: string[];
+  sender: SlackTriggerSender;
+  conditions: ({
+    field: "text";
+    operator: "contains" | "starts_with";
+    value: string;
+  } | {
+    field: "hasFile";
+    value: boolean;
+  } | {
+    field: "position";
+    value: "reply" | "top_level";
+  })[];
+} & {
+  reactions?: never;
+}) | ({
+  on: "reaction";
+  channels: string[];
+  sender: SlackTriggerSender;
+  conditions: {
+    field: "messageAuthor";
+    value: string;
+  }[];
+} & {
+  reactions?: string[];
+}), {
+  on: "dm" | "mention" | "message" | "reaction";
+  channels: string[];
+  reactions?: string[] | undefined;
+  sender: "any" | "human" | "me" | {
+    users: string[];
   };
-  readonly "browser-profile": {
-    readonly kinds: readonly [];
-    readonly capabilities: readonly [];
-    readonly tools: readonly ["browser_launch"];
+  conditions: ({
+    field: "text";
+    operator: "contains" | "starts_with";
+    value: string;
+  } | {
+    field: "messageAuthor";
+    value: string;
+  } | {
+    field: "hasFile";
+    value: boolean;
+  } | {
+    field: "position";
+    value: "reply" | "top_level";
+  })[];
+}>>]>;
+/** Immutable identity shared by transport admission, coalescing and retries. */
+export interface ConnectorEventIdentity {
+  connectionId: string;
+  /** Provider delivery identity, not the Standards outbox id. */
+  sourceEventId: string;
+  /** Same Slack message delivered as message/app_mention has the same identity. */
+  semanticEventId: string;
+  /** ISO timestamp of the original admission, unchanged on retry. */
+  receivedAt: string;
+  /**
+   * Provider payload kept in the tenant outbox. A fired run reads it pruned of
+   * credentials, rendering and repeats, every id kept (#5234), never verbatim.
+   */
+  payload: Record<string, unknown>;
+}
+/** Facts enriched by the worker; missing data never satisfies a condition. */
+export interface GithubEventFacts {
+  text?: string;
+  label?: string;
+  issueLabels?: string[];
+  baseBranch?: string;
+  headBranch?: string;
+  branch?: string;
+  draft?: boolean;
+  changedPaths?: string[];
+  forced?: boolean;
+  prAuthor?: string;
+  issueAuthor?: string;
+  reviewState?: "approved" | "changes_requested" | "commented";
+  workflowName?: string;
+  checkApp?: string;
+  checkName?: string;
+  conclusion?: string;
+  originEvent?: string;
+}
+export type NormalizedGithubEvent = ConnectorEventIdentity & {
+  provider: "github";
+  installationId: string;
+  eventName: string;
+  repository?: string;
+  number?: number;
+  threadKey?: string;
+  /**
+   * The repository a pull request's head lives in (machines and links §2):
+   * `repository` itself unless the PR comes from a fork. Set on events that
+   * concern a pull request, with `facts.headBranch` and `defaultBranch`.
+   */
+  headRepository?: string;
+  /** The base repository's default branch, on events that concern a pull request. */
+  defaultBranch?: string;
+  sender: {
+    login: string;
+    isBot: boolean;
+    performedViaAppId?: string;
   };
-  readonly login: {
-    readonly kinds: readonly [];
-    readonly capabilities: readonly [];
-    readonly tools: readonly [];
+  title?: string;
+  url?: string;
+  facts: GithubEventFacts;
+} & { [F in GithubTriggerFamily]: {
+  family: F;
+  action: GithubTriggerAction<F>;
+}; }[GithubTriggerFamily];
+export interface NormalizedSlackEvent extends ConnectorEventIdentity {
+  provider: "slack";
+  teamId: string;
+  /** A mentioned channel message can match both mention and message triggers. */
+  kinds: SlackTriggerOn[];
+  channel: string;
+  ts: string;
+  threadTs?: string;
+  threadKey?: string;
+  sender: {
+    userId: string;
+    isBot: boolean;
+    isOurApp: boolean;
+    name?: string;
+    email?: string;
   };
-};
-/** Tools of the work-mode and interactive surfaces: architect mode, setup, default-chat loading. `agent-config` is also a grant, for a routine that proposes. */
-export declare const SURFACE_TOOL_NAMES: {
-  readonly schema: readonly ["discard_architect_draft", "draft_schema", "get_architect_draft", "get_schema_history", "request_design_review", "search_icons"];
-  readonly "agent-config": readonly ["get_agents", "upsert_agent"];
-  readonly setup: readonly ["request_setup"];
-  readonly internal: readonly ["load_toolset"];
-};
-type GroupToolName = (typeof NATIVE_TOOL_GROUP_CATALOG)[NativeToolGroup]["tools"][number];
-type KindToolName = (typeof RESOURCE_KIND_CATALOG)[ResourceGrantKind]["tools"][number];
-/** Every tool id the product names for people (§7.1). MCP and host tools are open-ended and not listed. */
-export type CatalogToolName = (typeof CORE_TOOL_NAMES)[number] | GroupToolName | KindToolName;
-export declare const ALL_CATALOG_TOOL_NAMES: readonly CatalogToolName[];
+  text?: string;
+  position?: "top_level" | "reply";
+  hasFile?: boolean;
+  reaction?: string;
+  messageAuthor?: string;
+  files?: {
+    id: string;
+    name?: string;
+    urlPrivate?: string;
+  }[];
+  history?: {
+    ts: string;
+    userId?: string;
+    text: string;
+  }[];
+}
+export type NormalizedConnectorEvent = NormalizedGithubEvent | NormalizedSlackEvent;
 /**
- * The grant kinds of a connected account, one account each: reading a mailbox
- * or a calendar, and sending from a mailbox (`email.send`, behind an approval).
+ * Typed agent references: `<kind>:<id>`. The one parser shared by the runtime
+ * verbs and the UI tool views; it never guesses a kind from a bare id.
  */
-export type ConnectionGrantKind = Extract<ResourceGrantKind, "email.read" | "email.send" | "calendar.read">;
-/** The providers each connection kind reads: a calendar connection is not a mailbox, and the reverse. */
-export declare const CONNECTION_GRANT_PROVIDERS: {
-  readonly "email.read": readonly ["gmail", "outlook"];
-  readonly "email.send": readonly ["gmail", "outlook"];
-  readonly "calendar.read": readonly ["google-calendar", "outlook-calendar"];
+export declare const REFERENCE_KINDS: readonly ["record", "document", "file", "email", "thread", "event", "memory", "skill", "schema", "user", "guide", "bundle", "draft", "decision", "session", "catalog", "wake"];
+export type ReferenceKind = (typeof REFERENCE_KINDS)[number];
+export type Reference = {
+  kind: ReferenceKind;
+  id: string;
 };
-/** Every grant on a connection: used for catalogue usage and deletion expansion. */
-export declare function connectionGrantKindsOf(provider: ConnectorProviderId): readonly ResourceGrantKind[];
-/**
- * What an agent or routine created in the product starts with (D12, amended
- * 2026-10-04): every built-in, removable. `host` joins only where the host
- * provides tools, and an unattended definition created without
- * `agents:manage` drops what D13 gates (the runtime's create path decides
- * both). Canonical order.
- */
-export declare const DEFAULT_AGENT_TOOL_GROUPS: readonly ["activity", "bulk", "image", "memory", "orchestration", "sandbox", "web"];
-/**
- * What a code-defined agent (`agent()` builder, blueprints) holds when it
- * lists no `toolGroups`: memory only. System agents sync on boot, so a wider
- * default would grant them more silently — scheduled ones past D13 included.
- */
-export declare const DEFAULT_BLUEPRINT_TOOL_GROUPS: readonly ["memory"];
-/**
- * D13: whether adding `grant` to something that runs with nobody present (a
- * routine, an enabled schedule or trigger) needs `agents:manage` — `sandbox`,
- * `host`, `cloud-browser` and every resource grant.
- */
-export declare function needsManageWhenUnattended(grant: string): boolean;
-export type ParsedToolGroupGrant = {
-  type: "native";
-  group: NativeToolGroup;
+export type ReferenceRefusalReason = "bare_uuid" | "unknown_kind" | "malformed" | "legacy_mention";
+export type ParsedReference = {
+  ok: true;
+  ref: Reference;
 } | {
-  type: "resource";
-  kind: ResourceGrantKind;
-  id: string;
+  ok: false;
+  reason: ReferenceRefusalReason;
+  expected: string;
 };
-export declare function isNativeToolGroup(value: string): value is NativeToolGroup;
-export declare function parseToolGroupGrant(value: string): ParsedToolGroupGrant | null;
-/** The kind of a resource grant; `null` for a native group or a malformed grant. */
-export declare function grantKindOf(grant: string): ResourceGrantKind | null;
-export declare function isResourceGrant(value: string): value is ResourceGrant;
-export declare function resourceGrant(kind: ResourceGrantKind, id: string): ResourceGrant;
-/** Deduplicated, sorted by UTF-16 code unit (the JS default sort): the stored form of every grant list. */
-export declare function canonicalToolGroups<T extends string>(grants: readonly T[]): T[];
-/** Native tool groups an agent may be granted, in catalogue order. */
-export declare const NATIVE_TOOL_GROUPS: readonly ["sandbox", "web", "image", "memory", "bulk", "activity", "orchestration", "host", "cloud-browser", "agent-config"];
-export type NativeToolGroup = (typeof NATIVE_TOOL_GROUPS)[number];
-/** The tool that starts the session's cloud browser — read by the runtime and the chat. */
-export declare const BROWSER_LAUNCH_TOOL_NAME = "browser_launch";
-/** Resource kinds granted one resource at a time (`kind:id`). Write kinds arrive with their tools. */
-export declare const RESOURCE_GRANT_KINDS: readonly ["mcp", "email.read", "email.send", "calendar.read", "github", "slack.read", "slack.write", "device", "browser-profile", "login"];
-export type ResourceGrantKind = (typeof RESOURCE_GRANT_KINDS)[number];
-export type ResourceGrant = `${ResourceGrantKind}:${string}`;
-export type ToolGroupGrant = NativeToolGroup | ResourceGrant;
-/** Where a session's effective tool grants come from. */
-export declare const AGENT_SESSION_ORIGINS: readonly ["definition", "default", "child", "inline"];
-export type AgentSessionOrigin = (typeof AGENT_SESSION_ORIGINS)[number];
-/** Why a catalogue row cannot be granted or used; translated by `agentTools.reasons`. */
-export type ToolGrantReason = "private_on_workspace_definition" | "private_of_viewer" | "not_creator" | "needs_manage" | "harness" | "needs_person" | "scope_missing" | "requires_sandbox" | "disconnected" | "reauth_required" | "error" | "offline" | "revoked" | "not_authorized" | "inactive_on_automatic_runs" | "stops_without_person" | "never_prepared";
-export type ToolSummaryRisk = "read" | "mutation" | "destructive" | "outward" | "internal" | "conditional";
-export interface ToolSummary {
-  name: string;
-  /** MCP and host tools only: the tool's own title. */
-  title?: string;
-  /** MCP and host tools only. */
-  description?: string;
-  risk: ToolSummaryRisk;
-  /** Asks a person before running in a manual session. */
-  approval: boolean;
-}
-export interface DeviceGrantDetail {
-  platform: "darwin" | "linux" | "win32";
-  status: "online" | "offline" | "revoked";
-  agentExecutionAuthorized: boolean;
-}
-/** What a grant switches on inside the verbs: kinds on `search`/`read`, capabilities on the rest. */
-export interface ToolGrantEnables {
-  kinds: ReferenceKind[];
-  capabilities: VerbCapability[];
-}
-export interface NativeToolGroupEntry {
-  name: NativeToolGroup;
-  granted: boolean;
-  grantable: boolean;
-  reason?: ToolGrantReason;
-  /** The kinds and capabilities the group enables on the verbs. */
-  enables: ToolGrantEnables;
-  tools: ToolSummary[];
-}
-export interface ResourceGrantEntry {
-  id: string;
-  label: string;
-  visibility: ResourceVisibility;
-  granted: boolean;
-  grantable: boolean;
-  usable: boolean;
-  /** Why it is not grantable, else why it is not usable. */
-  reason?: ToolGrantReason;
-  /** Informational flags (`inactive_on_automatic_runs`, `stops_without_person`). */
-  notes?: ToolGrantReason[];
-  /**
-   * Number of definitions holding this resource: those visible to the caller
-   * plus the hidden ones. Absent when none.
-   */
-  usedBy?: number;
-  device?: DeviceGrantDetail;
-  /** The kinds and capabilities the grant enables on the verbs. */
-  enables: ToolGrantEnables;
-  tools: ToolSummary[];
-}
-export interface ResourceKindEntry {
-  kind: ResourceGrantKind;
-  resources: ResourceGrantEntry[];
-}
-/** `GET /agents/definitions/:id/tool-catalog`, for the caller. */
-export type AgentToolCatalog = z$1.output<typeof agentToolCatalogSchema>;
-/** The definitions that lose a grant when a resource is deleted. */
-export type ResourceUsedBy = z$1.output<typeof resourceUsedBySchema>;
-export declare const DOCUMENT_KINDS: readonly ["file", "folder"];
-export type DocumentKind = (typeof DOCUMENT_KINDS)[number];
-export declare const documentSchema: z$2.ZodObject<{
-  id: z$2.ZodString;
-  tenantId: z$2.ZodString;
-  title: z$2.ZodString;
-  kind: z$2.ZodEnum<{
-    file: "file";
-    folder: "folder";
-  }>;
-  parentId: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
-  description: z$2.ZodOptional<z$2.ZodString>;
-  contentHash: z$2.ZodOptional<z$2.ZodString>;
-  createdBy: z$2.ZodOptional<z$2.ZodString>;
-  updatedBy: z$2.ZodOptional<z$2.ZodString>;
-  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-  position: z$2.ZodNumber;
-  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+export declare function parseReference(raw: string): ParsedReference;
+export declare function formatReference(ref: Reference): string;
+export declare function isWildcard(ref: Reference): boolean;
+/** Built-in external connector providers. Mirrors the runtime's
+ * `ConnectorProvider`: mail and calendar are separate keys per vendor, because
+ * the scopes differ and a user may connect one without the other. */
+export declare const CONNECTOR_PROVIDER_IDS: readonly ["gmail", "outlook", "google-calendar", "outlook-calendar", "github", "slack"];
+export type ConnectorProviderId = (typeof CONNECTOR_PROVIDER_IDS)[number];
+/** Providers that sync a mailbox. */
+export type EmailConnectorProviderId = Extract<ConnectorProviderId, "gmail" | "outlook">;
+/** Providers that sync a calendar. */
+export type CalendarConnectorProviderId = Extract<ConnectorProviderId, "google-calendar" | "outlook-calendar">;
+/** Connection lifecycle status, mirrored from `connector_connections.status`. */
+export declare const CONNECTION_STATUS_IDS: readonly ["active", "reauth_required", "error", "disconnected"];
+export type ConnectionStatusId = (typeof CONNECTION_STATUS_IDS)[number];
+/** What a connection may do on its provider; each maps to a scope tier per provider. */
+export type ConnectorCapability = "read" | "modify" | "send";
+/** Derived from the scopes the provider actually granted, never from what was requested. */
+export declare const connectionCapabilitiesSchema: z$2.ZodObject<{
+  canRead: z$2.ZodBoolean;
+  canModify: z$2.ZodBoolean;
+  canSend: z$2.ZodBoolean;
 }, z$2.core.$strip>;
-export type Document = z$2.output<typeof documentSchema>;
-export declare const documentWithSubCountSchema: z$2.ZodObject<{
-  id: z$2.ZodString;
-  tenantId: z$2.ZodString;
-  title: z$2.ZodString;
-  kind: z$2.ZodEnum<{
-    file: "file";
-    folder: "folder";
-  }>;
-  parentId: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
-  description: z$2.ZodOptional<z$2.ZodString>;
-  contentHash: z$2.ZodOptional<z$2.ZodString>;
-  createdBy: z$2.ZodOptional<z$2.ZodString>;
-  updatedBy: z$2.ZodOptional<z$2.ZodString>;
-  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-  position: z$2.ZodNumber;
-  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-  subCount: z$2.ZodNullable<z$2.ZodNumber>;
+export type ConnectionCapabilities = z$2.output<typeof connectionCapabilitiesSchema>;
+/** What to ask for so a re-consent keeps what the connection already holds: the held flags beyond `read`, in capability order. */
+export declare function requestedCapabilities(held: ConnectionCapabilities): Exclude<ConnectorCapability, "read">[];
+/**
+ * How far a connection's full-history walk (backfill) has gone.
+ *
+ * `processed` counts the items the current walk has stored so far, across every
+ * continuation job; once the walk ends it keeps the final count. `total` is what
+ * the provider says the walk will cover, captured when the walk starts: exact or
+ * an estimate (Gmail's `resultSizeEstimate`), so `processed` may end above or
+ * below it. It is `null` when the provider offers no total (calendars), so a
+ * bar stays indeterminate rather than inventing a 100%. A connection that has
+ * never walked reads `{ processed: 0, total: null, backfilling: false }`.
+ */
+export declare const connectionSyncProgressSchema: z$2.ZodObject<{
+  processed: z$2.ZodNumber;
+  total: z$2.ZodNullable<z$2.ZodNumber>;
+  backfilling: z$2.ZodBoolean;
 }, z$2.core.$strip>;
-export type DocumentWithSubCount = z$2.output<typeof documentWithSubCountSchema>;
+export type ConnectionSyncProgress = z$2.output<typeof connectionSyncProgressSchema>;
 /**
- * One hit of a drive-wide name search: a folder or a file of the record's
- * drive whose title contains the query, with the path that places it. The
- * walk is the agent tool's (`listRecordDrive` in query mode); this is what
- * the open-drive loupe reads (#3217).
+ * Token-free projection of a connection for client/UI consumption.
+ * Access/refresh tokens NEVER cross this boundary.
  */
-export declare const recordDriveSearchHitSchema: z$2.ZodObject<{
+export declare const connectionViewSchema: z$2.ZodObject<{
   id: z$2.ZodString;
-  kind: z$2.ZodEnum<{
-    file: "file";
-    folder: "folder";
+  provider: z$2.ZodEnum<{
+    github: "github";
+    gmail: "gmail";
+    "google-calendar": "google-calendar";
+    outlook: "outlook";
+    "outlook-calendar": "outlook-calendar";
+    slack: "slack";
   }>;
-  title: z$2.ZodString;
-  path: z$2.ZodString;
-  parentId: z$2.ZodNullable<z$2.ZodString>;
-  depth: z$2.ZodNumber;
-}, z$2.core.$strip>;
-export type RecordDriveSearchHit = z$2.output<typeof recordDriveSearchHitSchema>;
-export declare const recordDriveSearchResultSchema: z$2.ZodObject<{
-  recordId: z$2.ZodString;
-  hits: z$2.ZodArray<z$2.ZodObject<{
-    id: z$2.ZodString;
-    kind: z$2.ZodEnum<{
-      file: "file";
-      folder: "folder";
-    }>;
-    title: z$2.ZodString;
-    path: z$2.ZodString;
-    parentId: z$2.ZodNullable<z$2.ZodString>;
-    depth: z$2.ZodNumber;
-  }, z$2.core.$strip>>;
-  truncated: z$2.ZodOptional<z$2.ZodObject<{
-    maxEntries: z$2.ZodNumber;
-    returnedEntries: z$2.ZodNumber;
+  ownerActorId: z$2.ZodNullable<z$2.ZodString>;
+  parentConnectionId: z$2.ZodNullable<z$2.ZodString>;
+  connectedByActorId: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  externalAccountId: z$2.ZodString;
+  displayName: z$2.ZodOptional<z$2.ZodString>;
+  status: z$2.ZodEnum<{
+    active: "active";
+    disconnected: "disconnected";
+    error: "error";
+    reauth_required: "reauth_required";
+  }>;
+  lastSyncedAt: z$2.ZodNullable<z$2.ZodString>;
+  createdAt: z$2.ZodString;
+  capabilities: z$2.ZodObject<{
+    canRead: z$2.ZodBoolean;
+    canModify: z$2.ZodBoolean;
+    canSend: z$2.ZodBoolean;
+  }, z$2.core.$strip>;
+  syncProgress: z$2.ZodObject<{
+    processed: z$2.ZodNumber;
+    total: z$2.ZodNullable<z$2.ZodNumber>;
+    backfilling: z$2.ZodBoolean;
+  }, z$2.core.$strip>;
+  usedBy: z$2.ZodOptional<z$2.ZodObject<{
+    visible: z$2.ZodArray<z$2.ZodObject<{
+      id: z$2.ZodString;
+      name: z$2.ZodString;
+    }, z$2.core.$strip>>;
+    hiddenCount: z$2.ZodNumber;
   }, z$2.core.$strip>>;
 }, z$2.core.$strip>;
-export type RecordDriveSearchResult = z$2.output<typeof recordDriveSearchResultSchema>;
-/**
- * Text-extraction lifecycle for a single file within a document pack.
- * `unsupported` is terminal and is not a failure: the file's type has no text
- * to extract (an Outlook `.msg`, a `.docx`, a `.zip`), so nothing is queued.
- */
-export declare const FILE_OCR_STATUSES: readonly ["pending", "processing", "completed", "failed", "unsupported"];
-export type FileOcrStatus = (typeof FILE_OCR_STATUSES)[number];
+export type ConnectionView = z$2.output<typeof connectionViewSchema>;
+/** Scope a connection is created under. Implied by the originating settings section. */
+export declare const CONNECTOR_SCOPES: readonly ["actor", "tenant"];
+export type ConnectorScope = (typeof CONNECTOR_SCOPES)[number];
+/** Input to start an OAuth authorization flow. */
+export interface StartConnectorAuthInput {
+  provider: ConnectorProviderId;
+  scope: ConnectorScope;
+  /** Page the callback 302s back to, on a configured allowed origin. Exactly one of this or `mode`. */
+  returnUrl?: string;
+  mode?: "desktop";
+  /** Beyond `read`, which is always requested. */
+  capabilities?: Exclude<ConnectorCapability, "read">[];
+  /**
+   * The account a reconnect names (its address): the provider offers it first.
+   * A hint only: the person may still choose another account.
+   */
+  loginHint?: string;
+}
 /**
- * A single anonymous file belonging to a document pack.
- * Unlike the slot-based model, files carry no slot name — order within the
- * pack is `position` only, and `name` is provenance (originalName), never a
- * label rendered in the UI.
+ * Providers this deployment holds OAuth credentials for. A provider absent from
+ * the list cannot start an authorization flow, so its card is not offered.
  */
-export declare const documentFileSchema: z$2.ZodObject<{
-  id: z$2.ZodString;
-  documentId: z$2.ZodString;
-  position: z$2.ZodNumber;
-  name: z$2.ZodString;
-  mimeType: z$2.ZodString;
-  size: z$2.ZodNumber;
-  ocrStatus: z$2.ZodNullable<z$2.ZodEnum<{
-    completed: "completed";
-    failed: "failed";
-    pending: "pending";
-    processing: "processing";
-    unsupported: "unsupported";
+export declare const connectorProvidersResultSchema: z$2.ZodObject<{
+  providers: z$2.ZodArray<z$2.ZodEnum<{
+    github: "github";
+    gmail: "gmail";
+    "google-calendar": "google-calendar";
+    outlook: "outlook";
+    "outlook-calendar": "outlook-calendar";
+    slack: "slack";
   }>>;
-  ocrText: z$2.ZodNullable<z$2.ZodString>;
-  ocrConfidence: z$2.ZodNullable<z$2.ZodNumber>;
-  processedAt: z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>;
-}, z$2.core.$strip>;
-export type DocumentFile = z$2.output<typeof documentFileSchema>;
-/** What an attach did: a new pack, a file appended to a named pack, or the pack already holding the file linked. */
-export declare const ATTACH_FILE_ACTIONS: readonly ["created", "appended", "linked-existing"];
-export type AttachFileAction = (typeof ATTACH_FILE_ACTIONS)[number];
-/** What attaching a file to a record's document attribute answers: the pack, the file in it, and what happened. */
-export declare const attachedRecordDocumentSchema: z$2.ZodObject<{
-  document: z$2.ZodObject<{
-    id: z$2.ZodString;
-    tenantId: z$2.ZodString;
-    title: z$2.ZodString;
-    kind: z$2.ZodEnum<{
-      file: "file";
-      folder: "folder";
-    }>;
-    parentId: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
-    description: z$2.ZodOptional<z$2.ZodString>;
-    contentHash: z$2.ZodOptional<z$2.ZodString>;
-    createdBy: z$2.ZodOptional<z$2.ZodString>;
-    updatedBy: z$2.ZodOptional<z$2.ZodString>;
-    deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-    position: z$2.ZodNumber;
-    createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-    updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-  }, z$2.core.$strip>;
-  file: z$2.ZodObject<{
-    id: z$2.ZodString;
-    documentId: z$2.ZodString;
-    position: z$2.ZodNumber;
-    name: z$2.ZodString;
-    mimeType: z$2.ZodString;
-    size: z$2.ZodNumber;
-    ocrStatus: z$2.ZodNullable<z$2.ZodEnum<{
-      completed: "completed";
-      failed: "failed";
-      pending: "pending";
-      processing: "processing";
-      unsupported: "unsupported";
-    }>>;
-    ocrText: z$2.ZodNullable<z$2.ZodString>;
-    ocrConfidence: z$2.ZodNullable<z$2.ZodNumber>;
-    processedAt: z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>;
-  }, z$2.core.$strip>;
-  action: z$2.ZodEnum<{
-    appended: "appended";
-    created: "created";
-    "linked-existing": "linked-existing";
-  }>;
-}, z$2.core.$strip>;
-/** A pack file as a drive row lists it: everything but its OCR text, which only reads need. */
-export declare const driveFileSchema: z$2.ZodObject<{
-  id: z$2.ZodString;
-  documentId: z$2.ZodString;
-  position: z$2.ZodNumber;
-  name: z$2.ZodString;
-  mimeType: z$2.ZodString;
-  size: z$2.ZodNumber;
-  ocrStatus: z$2.ZodNullable<z$2.ZodEnum<{
-    completed: "completed";
-    failed: "failed";
-    pending: "pending";
-    processing: "processing";
-    unsupported: "unsupported";
+  mailTriageProviders: z$2.ZodArray<z$2.ZodEnum<{
+    github: "github";
+    gmail: "gmail";
+    "google-calendar": "google-calendar";
+    outlook: "outlook";
+    "outlook-calendar": "outlook-calendar";
+    slack: "slack";
   }>>;
-  ocrConfidence: z$2.ZodNullable<z$2.ZodNumber>;
-  processedAt: z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>;
 }, z$2.core.$strip>;
-export type DriveFile = z$2.output<typeof driveFileSchema>;
-export type DocumentWithFiles = Document & {
-  files: DocumentFile[];
-};
+export type ConnectorProvidersResult = z$2.output<typeof connectorProvidersResultSchema>;
+/** Input to attach a Microsoft shared mailbox to an existing Outlook connection. */
+export interface AddSharedMailboxInput {
+  /** Shared mailbox SMTP address (e.g. contact@company.com). */
+  address: string;
+  /** Visibility of the synced emails: tenant (default UX) or only the adding actor. */
+  scope: ConnectorScope;
+}
+/** How a connector's consent ended, as the app's surfaces read it. */
+export type ConnectorCallbackStatusValue = "connected" | "error";
+/** The unified verbs an agent calls on typed references. */
+export declare const VERB_NAMES: readonly ["search", "query", "read", "write", "delete", "organize", "copy", "send"];
+export type VerbName = (typeof VERB_NAMES)[number];
+/** The one verb by which an agent reaches a person, a session or a draft. */
+export declare const SEND_VERB_NAME = "send";
+/** The verb that moves bytes between the sandbox, a mailbox and Standards' own files. */
+export declare const COPY_VERB_NAME = "copy";
+/** Record, document and file tools: always loaded, bounded by data permissions. */
+export declare const CORE_RECORD_TOOL_NAMES: readonly ["search", "query", "read", "write", "delete", "organize", "copy", "send", "edit_content"];
+/** Core: always loaded, never removable (D2). */
+export declare const CORE_TOOL_NAMES: readonly ["search", "query", "read", "write", "delete", "organize", "copy", "send", "edit_content", "compact_context", "request_work_mode", "write_todos"];
 /**
- * One row of a record's drive at a given level: the document with its sub
- * count and its pack files (#4332). A drive-only attachment, one that exists
- * only as a reference edge and is named nowhere in `record.values`, has no
- * other source for its files, and without them its row menu cannot offer
- * Download. A folder has no pack: its `files` is always `[]`.
- *
- * A root-level child also names where it sits on the record: the document
- * attribute whose edge holds it (`attachments` for a plain drive item) and
- * that edge's qualified properties. A nested child has no edge of its own and
- * carries neither.
+ * The one browser tool: it opens a cloud browser that `agent-browser` drives
+ * through `exec_command`, so a browser grant always comes with the sandbox.
  */
-export declare const recordDriveChildSchema: z$2.ZodObject<{
-  id: z$2.ZodString;
-  tenantId: z$2.ZodString;
-  title: z$2.ZodString;
-  kind: z$2.ZodEnum<{
-    file: "file";
-    folder: "folder";
-  }>;
-  parentId: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
-  description: z$2.ZodOptional<z$2.ZodString>;
-  contentHash: z$2.ZodOptional<z$2.ZodString>;
-  createdBy: z$2.ZodOptional<z$2.ZodString>;
-  updatedBy: z$2.ZodOptional<z$2.ZodString>;
-  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-  position: z$2.ZodNumber;
-  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-  subCount: z$2.ZodNullable<z$2.ZodNumber>;
-  files: z$2.ZodArray<z$2.ZodObject<{
-    id: z$2.ZodString;
-    documentId: z$2.ZodString;
-    position: z$2.ZodNumber;
-    name: z$2.ZodString;
-    mimeType: z$2.ZodString;
-    size: z$2.ZodNumber;
-    ocrStatus: z$2.ZodNullable<z$2.ZodEnum<{
-      completed: "completed";
-      failed: "failed";
-      pending: "pending";
-      processing: "processing";
-      unsupported: "unsupported";
-    }>>;
-    ocrConfidence: z$2.ZodNullable<z$2.ZodNumber>;
-    processedAt: z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>;
-  }, z$2.core.$strip>>;
-  attributeName: z$2.ZodOptional<z$2.ZodString>;
-  properties: z$2.ZodOptional<z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>>;
-}, z$2.core.$strip>;
-export type RecordDriveChild = z$2.output<typeof recordDriveChildSchema>;
+export declare const BROWSER_TOOL_NAMES: readonly ["browser_launch"];
+/** Capabilities a grant switches on inside the verbs. */
+export type VerbCapability = "bulk" | "activity" | "transcript" | "copy_email";
+/** Reference kinds available without any grant (`user` is gated by `userDirectory`, not a grant). */
+export declare const ALWAYS_KINDS: readonly ReferenceKind[];
+/** What a grant enables: the kinds and capabilities on the verbs, plus its non-verb tools. */
+export type GrantEnables = {
+  kinds: readonly ReferenceKind[];
+  capabilities: readonly VerbCapability[];
+  tools: readonly string[];
+};
+/** A closed allowlist, written per verb: allowed actions, kinds, includes, batch size, aggregation. */
+export type VerbAllowlist = { [V in VerbName]?: {
+  actions?: readonly string[];
+  kinds?: readonly ReferenceKind[];
+  includes?: readonly string[];
+  batch?: number;
+  aggregate?: boolean;
+  /** `send` only: who the verb may reach. Absent means every target. */
+  targets?: readonly ("person" | "session" | "draft")[];
+}; };
+export declare const NATIVE_TOOL_GROUP_CATALOG: {
+  readonly sandbox: {
+    readonly icon: "terminal";
+    readonly tools: readonly ["exec_command", "publish_artifact", "sandbox_validate_payload"];
+  };
+  readonly web: {
+    readonly icon: "globe";
+    readonly tools: readonly ["read_webpage", "web_search"];
+  };
+  readonly image: {
+    readonly icon: "image";
+    readonly tools: readonly ["generate_image"];
+  };
+  readonly memory: {
+    readonly icon: "book-open";
+    readonly tools: readonly ["propose_memory"];
+  };
+  readonly bulk: {
+    readonly icon: "layers-two";
+    readonly tools: readonly [];
+  };
+  readonly activity: {
+    readonly icon: "activity";
+    readonly tools: readonly [];
+  };
+  readonly orchestration: {
+    readonly icon: "git-branch";
+    readonly tools: readonly ["spawn_agent"];
+  };
+  readonly host: {
+    readonly icon: "wrench";
+    readonly tools: readonly [];
+  };
+  readonly "cloud-browser": {
+    readonly icon: "globe";
+    readonly tools: readonly ["browser_launch"];
+  };
+  readonly "agent-config": {
+    readonly icon: "sparkles";
+    readonly tools: readonly ["get_agents", "upsert_agent"];
+  };
+};
+export declare const RESOURCE_KIND_CATALOG: {
+  readonly mcp: {
+    readonly icon: "puzzle";
+    readonly tools: readonly [];
+  };
+  readonly "email.read": {
+    readonly icon: "envelope";
+    readonly tools: readonly [];
+  };
+  readonly "email.send": {
+    readonly icon: "send";
+    readonly tools: readonly [];
+  };
+  readonly "calendar.read": {
+    readonly icon: "calendar";
+    readonly tools: readonly [];
+  };
+  readonly github: {
+    readonly icon: "brand-github";
+    readonly tools: readonly [];
+  };
+  readonly "slack.read": {
+    readonly icon: "brand-slack";
+    readonly tools: readonly ["slack_read", "slack_find", "slack_download_file"];
+  };
+  readonly "slack.write": {
+    readonly icon: "brand-slack";
+    readonly tools: readonly ["slack_send", "slack_react"];
+  };
+  readonly device: {
+    readonly icon: "desktop";
+    readonly tools: readonly ["exec_command"];
+  };
+  readonly "browser-profile": {
+    readonly icon: "globe";
+    readonly tools: readonly ["browser_launch"];
+  };
+  readonly login: {
+    readonly icon: "key";
+    readonly tools: readonly [];
+  };
+};
+/** The single source of which grant enables which kinds, capabilities and tools. */
+export declare const GRANT_ENABLES: {
+  readonly sandbox: {
+    readonly kinds: readonly [];
+    readonly capabilities: readonly [];
+    readonly tools: readonly ["exec_command", "publish_artifact", "sandbox_validate_payload"];
+  };
+  readonly web: {
+    readonly kinds: readonly [];
+    readonly capabilities: readonly [];
+    readonly tools: readonly ["read_webpage", "web_search"];
+  };
+  readonly image: {
+    readonly kinds: readonly [];
+    readonly capabilities: readonly [];
+    readonly tools: readonly ["generate_image"];
+  };
+  readonly memory: {
+    readonly kinds: readonly ["memory"];
+    readonly capabilities: readonly [];
+    readonly tools: readonly ["propose_memory"];
+  };
+  readonly bulk: {
+    readonly kinds: readonly [];
+    readonly capabilities: readonly ["bulk"];
+    readonly tools: readonly [];
+  };
+  readonly activity: {
+    readonly kinds: readonly [];
+    readonly capabilities: readonly ["activity"];
+    readonly tools: readonly [];
+  };
+  readonly orchestration: {
+    readonly kinds: readonly [];
+    readonly capabilities: readonly [];
+    readonly tools: readonly ["spawn_agent"];
+  };
+  readonly host: {
+    readonly kinds: readonly [];
+    readonly capabilities: readonly [];
+    readonly tools: readonly [];
+  };
+  readonly "cloud-browser": {
+    readonly kinds: readonly [];
+    readonly capabilities: readonly [];
+    readonly tools: readonly ["browser_launch"];
+  };
+  readonly "agent-config": {
+    readonly kinds: readonly [];
+    readonly capabilities: readonly [];
+    readonly tools: readonly ["get_agents", "upsert_agent"];
+  };
+  readonly mcp: {
+    readonly kinds: readonly [];
+    readonly capabilities: readonly [];
+    readonly tools: readonly [];
+  };
+  readonly "email.read": {
+    readonly kinds: readonly ["email", "thread"];
+    readonly capabilities: readonly ["copy_email"];
+    readonly tools: readonly [];
+  };
+  readonly "email.send": {
+    readonly kinds: readonly ["email", "thread", "draft"];
+    readonly capabilities: readonly ["copy_email"];
+    readonly tools: readonly [];
+  };
+  readonly "calendar.read": {
+    readonly kinds: readonly ["event"];
+    readonly capabilities: readonly ["transcript"];
+    readonly tools: readonly [];
+  };
+  readonly github: {
+    readonly kinds: readonly [];
+    readonly capabilities: readonly [];
+    readonly tools: readonly [];
+  };
+  readonly "slack.read": {
+    readonly kinds: readonly [];
+    readonly capabilities: readonly [];
+    readonly tools: readonly ["slack_read", "slack_find", "slack_download_file"];
+  };
+  readonly "slack.write": {
+    readonly kinds: readonly [];
+    readonly capabilities: readonly [];
+    readonly tools: readonly ["slack_send", "slack_react"];
+  };
+  readonly device: {
+    readonly kinds: readonly [];
+    readonly capabilities: readonly [];
+    readonly tools: readonly ["exec_command"];
+  };
+  readonly "browser-profile": {
+    readonly kinds: readonly [];
+    readonly capabilities: readonly [];
+    readonly tools: readonly ["browser_launch"];
+  };
+  readonly login: {
+    readonly kinds: readonly [];
+    readonly capabilities: readonly [];
+    readonly tools: readonly [];
+  };
+};
+/** Tools of the work-mode and interactive surfaces: architect mode, setup, default-chat loading. `agent-config` is also a grant, for a routine that proposes. */
+export declare const SURFACE_TOOL_NAMES: {
+  readonly schema: readonly ["discard_architect_draft", "draft_schema", "get_architect_draft", "get_schema_history", "request_design_review", "search_icons"];
+  readonly "agent-config": readonly ["get_agents", "upsert_agent"];
+  readonly setup: readonly ["request_setup"];
+  readonly internal: readonly ["load_toolset"];
+};
+type GroupToolName = (typeof NATIVE_TOOL_GROUP_CATALOG)[NativeToolGroup]["tools"][number];
+type KindToolName = (typeof RESOURCE_KIND_CATALOG)[ResourceGrantKind]["tools"][number];
+/** Every tool id the product names for people (§7.1). MCP and host tools are open-ended and not listed. */
+export type CatalogToolName = (typeof CORE_TOOL_NAMES)[number] | GroupToolName | KindToolName;
+export declare const ALL_CATALOG_TOOL_NAMES: readonly CatalogToolName[];
 /**
- * The orders a drive level is listed in. Every mode puts folders before
- * files, then sorts on its key, then on `id`:
- * - `manual`: `position` (the drag order);
- * - `name-asc` / `name-desc`: the title, numeric and case- and
- *   accent-insensitive ("File 2" before "file 10", "Éa" equal to "ea");
- * - `date-desc` / `date-asc`: `updatedAt ?? createdAt` to the millisecond,
- *   a row with neither last in both directions.
- * The `id` tiebreak is ascending in every mode.
+ * The grant kinds of a connected account, one account each: reading a mailbox
+ * or a calendar, and sending from a mailbox (`email.send`, behind an approval).
  */
-export declare const DOCUMENT_SORT_MODES: readonly ["manual", "name-asc", "name-desc", "date-desc", "date-asc"];
-export type DocumentSortMode = (typeof DOCUMENT_SORT_MODES)[number];
-/** Rows in a page of a drive level when the caller names no `limit`. */
-export declare const RECORD_DRIVE_PAGE_DEFAULT_LIMIT = 100;
-/** The most rows one page of a drive level holds; a larger `limit` is clamped. */
-export declare const RECORD_DRIVE_PAGE_MAX_LIMIT = 500;
+export type ConnectionGrantKind = Extract<ResourceGrantKind, "email.read" | "email.send" | "calendar.read">;
+/** The providers each connection kind reads: a calendar connection is not a mailbox, and the reverse. */
+export declare const CONNECTION_GRANT_PROVIDERS: {
+  readonly "email.read": readonly ["gmail", "outlook"];
+  readonly "email.send": readonly ["gmail", "outlook"];
+  readonly "calendar.read": readonly ["google-calendar", "outlook-calendar"];
+};
+/** Every grant on a connection: used for catalogue usage and deletion expansion. */
+export declare function connectionGrantKindsOf(provider: ConnectorProviderId): readonly ResourceGrantKind[];
 /**
- * The longest drive page cursor read back. An issued cursor carries one title
- * (at most 255 characters) plus a few short fields; anything longer is crafted.
+ * What an agent or routine created in the product starts with (D12, amended
+ * 2026-10-04): every built-in, removable. `host` joins only where the host
+ * provides tools, and an unattended definition created without
+ * `agents:manage` drops what D13 gates (the runtime's create path decides
+ * both). Canonical order.
  */
-export declare const RECORD_DRIVE_CURSOR_MAX_LENGTH = 2048;
+export declare const DEFAULT_AGENT_TOOL_GROUPS: readonly ["activity", "bulk", "image", "memory", "orchestration", "sandbox", "web"];
 /**
- * One page of a record's drive level (#4985), in its sort mode's order.
- * `nextCursor` resumes strictly after the page's last row, and is `null` on
- * the last page. A cursor is opaque and only valid for the mode that issued it.
+ * What a code-defined agent (`agent()` builder, blueprints) holds when it
+ * lists no `toolGroups`: memory only. System agents sync on boot, so a wider
+ * default would grant them more silently — scheduled ones past D13 included.
  */
-export declare const recordDriveChildrenPageSchema: z$2.ZodObject<{
-  items: z$2.ZodArray<z$2.ZodObject<{
-    id: z$2.ZodString;
-    tenantId: z$2.ZodString;
-    title: z$2.ZodString;
-    kind: z$2.ZodEnum<{
-      file: "file";
-      folder: "folder";
-    }>;
-    parentId: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
-    description: z$2.ZodOptional<z$2.ZodString>;
-    contentHash: z$2.ZodOptional<z$2.ZodString>;
-    createdBy: z$2.ZodOptional<z$2.ZodString>;
-    updatedBy: z$2.ZodOptional<z$2.ZodString>;
-    deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-    position: z$2.ZodNumber;
-    createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-    updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-    subCount: z$2.ZodNullable<z$2.ZodNumber>;
-    files: z$2.ZodArray<z$2.ZodObject<{
-      id: z$2.ZodString;
-      documentId: z$2.ZodString;
-      position: z$2.ZodNumber;
-      name: z$2.ZodString;
-      mimeType: z$2.ZodString;
-      size: z$2.ZodNumber;
-      ocrStatus: z$2.ZodNullable<z$2.ZodEnum<{
-        completed: "completed";
-        failed: "failed";
-        pending: "pending";
-        processing: "processing";
-        unsupported: "unsupported";
-      }>>;
-      ocrConfidence: z$2.ZodNullable<z$2.ZodNumber>;
-      processedAt: z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>;
-    }, z$2.core.$strip>>;
-    attributeName: z$2.ZodOptional<z$2.ZodString>;
-    properties: z$2.ZodOptional<z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>>;
-  }, z$2.core.$strip>>;
-  nextCursor: z$2.ZodNullable<z$2.ZodString>;
-}, z$2.core.$strip>;
-export type RecordDriveChildrenPage = z$2.output<typeof recordDriveChildrenPageSchema>;
-export interface CreateDocument {
-  title: string;
-  kind?: DocumentKind;
-  parentId?: Uuid | null;
-  description?: string;
-  position?: number;
-}
+export declare const DEFAULT_BLUEPRINT_TOOL_GROUPS: readonly ["memory"];
 /**
- * Reference to a record attribute that should atomically attach a freshly
- * created Document. Passed alongside `CreateDocument` to make creation
- * link-aware end-to-end (client → REST → service → repo).
- *
- * The server requires this — orphan Documents are not creatable through the
- * REST API.
+ * D13: whether adding `grant` to something that runs with nobody present (a
+ * routine, an enabled schedule or trigger) needs `agents:manage` — `sandbox`,
+ * `host`, `cloud-browser` and every resource grant.
  */
-export interface CreateDocumentLink {
-  objectName: string;
-  sourceRecordId: string;
-  attributeName: string;
-}
-export interface UpdateDocument {
+export declare function needsManageWhenUnattended(grant: string): boolean;
+export type ParsedToolGroupGrant = {
+  type: "native";
+  group: NativeToolGroup;
+} | {
+  type: "resource";
+  kind: ResourceGrantKind;
+  id: string;
+};
+export declare function isNativeToolGroup(value: string): value is NativeToolGroup;
+export declare function parseToolGroupGrant(value: string): ParsedToolGroupGrant | null;
+/** The kind of a resource grant; `null` for a native group or a malformed grant. */
+export declare function grantKindOf(grant: string): ResourceGrantKind | null;
+export declare function isResourceGrant(value: string): value is ResourceGrant;
+export declare function resourceGrant(kind: ResourceGrantKind, id: string): ResourceGrant;
+/** Deduplicated, sorted by UTF-16 code unit (the JS default sort): the stored form of every grant list. */
+export declare function canonicalToolGroups<T extends string>(grants: readonly T[]): T[];
+/** Native tool groups an agent may be granted, in catalogue order. */
+export declare const NATIVE_TOOL_GROUPS: readonly ["sandbox", "web", "image", "memory", "bulk", "activity", "orchestration", "host", "cloud-browser", "agent-config"];
+export type NativeToolGroup = (typeof NATIVE_TOOL_GROUPS)[number];
+/** The tool that starts the session's cloud browser — read by the runtime and the chat. */
+export declare const BROWSER_LAUNCH_TOOL_NAME = "browser_launch";
+/** Resource kinds granted one resource at a time (`kind:id`). Write kinds arrive with their tools. */
+export declare const RESOURCE_GRANT_KINDS: readonly ["mcp", "email.read", "email.send", "calendar.read", "github", "slack.read", "slack.write", "device", "browser-profile", "login"];
+export type ResourceGrantKind = (typeof RESOURCE_GRANT_KINDS)[number];
+export type ResourceGrant = `${ResourceGrantKind}:${string}`;
+export type ToolGroupGrant = NativeToolGroup | ResourceGrant;
+/** Where a session's effective tool grants come from. */
+export declare const AGENT_SESSION_ORIGINS: readonly ["definition", "default", "child", "inline"];
+export type AgentSessionOrigin = (typeof AGENT_SESSION_ORIGINS)[number];
+/** Why a catalogue row cannot be granted or used; translated by `agentTools.reasons`. */
+export type ToolGrantReason = "private_on_workspace_definition" | "private_of_viewer" | "not_creator" | "needs_manage" | "harness" | "needs_person" | "scope_missing" | "requires_sandbox" | "disconnected" | "reauth_required" | "error" | "offline" | "revoked" | "not_authorized" | "inactive_on_automatic_runs" | "stops_without_person" | "never_prepared";
+export type ToolSummaryRisk = "read" | "mutation" | "destructive" | "outward" | "internal" | "conditional";
+export interface ToolSummary {
+  name: string;
+  /** MCP and host tools only: the tool's own title. */
   title?: string;
-  parentId?: Uuid | null;
-  position?: number;
+  /** MCP and host tools only. */
+  description?: string;
+  risk: ToolSummaryRisk;
+  /** Asks a person before running in a manual session. */
+  approval: boolean;
 }
-export interface DocumentListOptions {
-  limit?: number;
-  offset?: number;
+export interface DeviceGrantDetail {
+  platform: "darwin" | "linux" | "win32";
+  status: "online" | "offline" | "revoked";
+  agentExecutionAuthorized: boolean;
 }
-export interface RecordDocuments {
-  /** Documents grouped by attribute name (includes system 'attachments' attribute) */
-  byAttribute: Record<string, DocumentWithFiles[]>;
+/** What a grant switches on inside the verbs: kinds on `search`/`read`, capabilities on the rest. */
+export interface ToolGrantEnables {
+  kinds: ReferenceKind[];
+  capabilities: VerbCapability[];
 }
-/**
- * One record that holds documents, with how much sits at its drive root and
- * when it last moved. The wire shape of `GET /documents/record-owners`.
- */
-export declare const documentRecordOwnerSchema: z$2.ZodObject<{
-  recordId: z$2.ZodString;
-  objectName: z$2.ZodString;
-  label: z$2.ZodString;
-  itemCount: z$2.ZodNumber;
-  fileCount: z$2.ZodNumber;
-  lastActivityAt: z$2.ZodString;
-}, z$2.core.$strip>;
-export type DocumentRecordOwner = z$2.output<typeof documentRecordOwnerSchema>;
-/** One page of {@link DocumentRecordOwner}s; `nextOffset: null` is the last page. */
-export declare const documentRecordOwnerPageSchema: z$2.ZodObject<{
-  data: z$2.ZodArray<z$2.ZodObject<{
-    recordId: z$2.ZodString;
-    objectName: z$2.ZodString;
-    label: z$2.ZodString;
-    itemCount: z$2.ZodNumber;
-    fileCount: z$2.ZodNumber;
-    lastActivityAt: z$2.ZodString;
-  }, z$2.core.$strip>>;
-  nextOffset: z$2.ZodNullable<z$2.ZodNumber>;
-}, z$2.core.$strip>;
-export type DocumentRecordOwnerPage = z$2.output<typeof documentRecordOwnerPageSchema>;
+export interface NativeToolGroupEntry {
+  name: NativeToolGroup;
+  granted: boolean;
+  grantable: boolean;
+  reason?: ToolGrantReason;
+  /** The kinds and capabilities the group enables on the verbs. */
+  enables: ToolGrantEnables;
+  tools: ToolSummary[];
+}
+export interface ResourceGrantEntry {
+  id: string;
+  label: string;
+  visibility: ResourceVisibility;
+  granted: boolean;
+  grantable: boolean;
+  usable: boolean;
+  /** Why it is not grantable, else why it is not usable. */
+  reason?: ToolGrantReason;
+  /** Informational flags (`inactive_on_automatic_runs`, `stops_without_person`). */
+  notes?: ToolGrantReason[];
+  /**
+   * Number of definitions holding this resource: those visible to the caller
+   * plus the hidden ones. Absent when none.
+   */
+  usedBy?: number;
+  device?: DeviceGrantDetail;
+  /** The kinds and capabilities the grant enables on the verbs. */
+  enables: ToolGrantEnables;
+  tools: ToolSummary[];
+}
+export interface ResourceKindEntry {
+  kind: ResourceGrantKind;
+  resources: ResourceGrantEntry[];
+}
+/** `GET /agents/definitions/:id/tool-catalog`, for the caller. */
+export type AgentToolCatalog = z$1.output<typeof agentToolCatalogSchema>;
+/** The definitions that lose a grant when a resource is deleted. */
+export type ResourceUsedBy = z$1.output<typeof resourceUsedBySchema>;
 /**
  * Storage provider type
  */
@@ -7599,6 +7600,11 @@ export interface ObjectDefinition {
   documentLayout?: DocumentLayout;
   /** Records of this object may have a parent record of the same object (a tree). */
   hierarchical?: boolean;
+  /**
+   * The order a record's drive rests in for anyone who never chose one on
+   * that object and tab. Absent, the drive rests in `manual`.
+   */
+  defaultDriveSort?: DocumentSortMode;
 }
 /**
  * Links an attribute to an object
@@ -8089,6 +8095,13 @@ export declare const objectDefinitionOutputSchema: z$2.ZodObject<{
   metadata: z$2.ZodOptional<z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>>;
   documentLayout: z$2.ZodOptional<z$2.ZodType<DocumentLayout, DocumentLayout, z$2.core.$ZodTypeInternals<DocumentLayout, DocumentLayout>>>;
   hierarchical: z$2.ZodOptional<z$2.ZodBoolean>;
+  defaultDriveSort: z$2.ZodOptional<z$2.ZodEnum<{
+    "date-asc": "date-asc";
+    "date-desc": "date-desc";
+    manual: "manual";
+    "name-asc": "name-asc";
+    "name-desc": "name-desc";
+  }>>;
 }, z$2.core.$strip>;
 export declare const schemaGroupSchema: z$2.ZodObject<{
   kind: z$2.ZodLiteral<"bundle">;
@@ -12064,6 +12077,8 @@ export interface CreateCustomObjectInput {
   image?: ObjectImage;
   /** Its records may have a parent of this object. */
   hierarchical?: boolean;
+  /** The order its records' drives rest in until a person chooses one. */
+  defaultDriveSort?: DocumentSortMode;
   attributes?: (Attribute | {
     build: () => Attribute;
   })[];
@@ -12081,6 +12096,8 @@ export interface UpdateObjectInput {
   labelExpression?: string;
   embeddingExpression?: string;
   hierarchical?: boolean;
+  /** The order its records' drives rest in until a person chooses one. */
+  defaultDriveSort?: DocumentSortMode;
   metadata?: Record<string, unknown>;
 }
 export type RelationOption = z$1.output<typeof relationOptionSchema>;
@@ -15557,6 +15574,8 @@ export interface DBObject extends Timestamps {
   documentLayout?: DocumentLayout;
   /** Records of this object may have a parent record of the same object. Stored in `metadata`. */
   hierarchical?: boolean;
+  /** The order its records' drives rest in until a person chooses one. Stored in `metadata`. */
+  defaultDriveSort?: DocumentSortMode;
 }
 /**
  * Data for creating a new object.
@@ -15576,6 +15595,7 @@ export interface CreateDBObject {
   metadata?: Record<string, unknown>;
   documentLayout?: DocumentLayout;
   hierarchical?: boolean;
+  defaultDriveSort?: DocumentSortMode;
 }
 export interface UpdateDBObject {
   label?: string;
@@ -15591,6 +15611,7 @@ export interface UpdateDBObject {
   metadata?: Record<string, unknown>;
   documentLayout?: DocumentLayout;
   hierarchical?: boolean;
+  defaultDriveSort?: DocumentSortMode;
 }
 /**
  * Data for upserting an object.