@standards/schema 1.0.0-alpha.433 → 1.0.0-alpha.435

package/dist/{record-query-Bki3Qcvc.d.mts → record-query-DTK1hCGH.d.mts}

@@ -1482,509 +1482,867 @@ export interface PresetNode {
 }
 /** Max depth allowed for preset.structure to keep instantiation predictable. */
 export declare const MAX_PRESET_DEPTH = 5;
-/** What the reading actor may do with a resource (spec §6.6); records never produce `runner`. */
-export declare const viewerAccessSchema: z$2.ZodEnum<{
-  editor: "editor";
-  owner: "owner";
-  reader: "reader";
-  runner: "runner";
-  workspace: "workspace";
-}>;
-type Values = readonly [string, ...string[]];
-/** One beneficiary of a private resource: its effective role and every source that grants it. */
-export declare function accessGrantSchema<const Role extends Values, const Source extends Values>(roles: Role, sources: Source): z$2.ZodObject<{
-  actorId: z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>;
-  role: z$2.ZodEnum<{ [k in Role[number]]: k; } extends (infer T) ? { [k in keyof T]: T[k]; } : never>;
-  sources: z$2.ZodArray<z$2.ZodEnum<{ [k in Source[number]]: k; } extends (infer T_1) ? { [k in keyof T_1]: T_1[k]; } : never>>;
-}, z$2.core.$strip>;
-/** Who can reach a record beyond its owner (`GET /records/:object/:id/access`). */
-export declare const recordAudienceSchema: z$2.ZodObject<{
-  recordId: z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>;
-  visibility: z$2.ZodEnum<{
-    private: "private";
-    workspace: "workspace";
-  }>;
-  ownedBy: z$2.ZodNullable<z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>>;
-  viewerAccess: z$2.ZodEnum<{
-    editor: "editor";
-    owner: "owner";
-    reader: "reader";
-    runner: "runner";
-    workspace: "workspace";
+export declare const DOCUMENT_KINDS: readonly ["file", "folder"];
+export type DocumentKind = (typeof DOCUMENT_KINDS)[number];
+export declare const documentSchema: z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodString;
+  title: z$2.ZodString;
+  kind: z$2.ZodEnum<{
+    file: "file";
+    folder: "folder";
   }>;
-  grants: z$2.ZodArray<z$2.ZodObject<{
-    actorId: z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>;
-    role: z$2.ZodEnum<{
-      editor: "editor";
-      reader: "reader";
-    }>;
-    sources: z$2.ZodArray<z$2.ZodEnum<{
-      manual: "manual";
-      meeting_attendee: "meeting_attendee";
-    }>>;
-  }, z$2.core.$strip>>;
+  parentId: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  description: z$2.ZodOptional<z$2.ZodString>;
+  contentHash: z$2.ZodOptional<z$2.ZodString>;
+  createdBy: z$2.ZodOptional<z$2.ZodString>;
+  updatedBy: z$2.ZodOptional<z$2.ZodString>;
+  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  position: z$2.ZodNumber;
+  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
 }, z$2.core.$strip>;
-/** Who may run commands on a device beyond its owner (`GET /devices/:id/access`). */
-export declare const deviceAudienceSchema: z$2.ZodObject<{
-  deviceId: z$2.ZodString;
-  visibility: z$2.ZodEnum<{
-    private: "private";
-    workspace: "workspace";
-  }>;
-  ownedBy: z$2.ZodNullable<z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>>;
-  viewerAccess: z$2.ZodEnum<{
-    editor: "editor";
-    owner: "owner";
-    reader: "reader";
-    runner: "runner";
-    workspace: "workspace";
+export type Document = z$2.output<typeof documentSchema>;
+export declare const documentWithSubCountSchema: z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodString;
+  title: z$2.ZodString;
+  kind: z$2.ZodEnum<{
+    file: "file";
+    folder: "folder";
   }>;
-  grants: z$2.ZodArray<z$2.ZodObject<{
-    actorId: z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>;
-    role: z$2.ZodEnum<{
-      runner: "runner";
-    }>;
-    sources: z$2.ZodArray<z$2.ZodEnum<{
-      manual: "manual";
-    }>>;
-  }, z$2.core.$strip>>;
+  parentId: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  description: z$2.ZodOptional<z$2.ZodString>;
+  contentHash: z$2.ZodOptional<z$2.ZodString>;
+  createdBy: z$2.ZodOptional<z$2.ZodString>;
+  updatedBy: z$2.ZodOptional<z$2.ZodString>;
+  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  position: z$2.ZodNumber;
+  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  subCount: z$2.ZodNullable<z$2.ZodNumber>;
 }, z$2.core.$strip>;
-/** Who can reach a private page beyond its owner (`GET /pages/:id/access`). */
-export declare const pageAudienceSchema: z$2.ZodObject<{
-  pageId: z$2.ZodString;
-  visibility: z$2.ZodEnum<{
-    private: "private";
-    workspace: "workspace";
-  }>;
-  ownedBy: z$2.ZodNullable<z$2.ZodString>;
-  viewerAccess: z$2.ZodEnum<{
-    editor: "editor";
-    owner: "owner";
-    reader: "reader";
-    runner: "runner";
-    workspace: "workspace";
+export type DocumentWithSubCount = z$2.output<typeof documentWithSubCountSchema>;
+/**
+ * One hit of a drive-wide name search: a folder or a file of the record's
+ * drive whose title contains the query, with the path that places it. The
+ * walk is the agent tool's (`listRecordDrive` in query mode); this is what
+ * the open-drive loupe reads (#3217).
+ */
+export declare const recordDriveSearchHitSchema: z$2.ZodObject<{
+  id: z$2.ZodString;
+  kind: z$2.ZodEnum<{
+    file: "file";
+    folder: "folder";
   }>;
-  grants: z$2.ZodArray<z$2.ZodObject<{
-    actorId: z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>;
-    role: z$2.ZodEnum<{
-      editor: "editor";
-      reader: "reader";
+  title: z$2.ZodString;
+  path: z$2.ZodString;
+  parentId: z$2.ZodNullable<z$2.ZodString>;
+  depth: z$2.ZodNumber;
+}, z$2.core.$strip>;
+export type RecordDriveSearchHit = z$2.output<typeof recordDriveSearchHitSchema>;
+export declare const recordDriveSearchResultSchema: z$2.ZodObject<{
+  recordId: z$2.ZodString;
+  hits: z$2.ZodArray<z$2.ZodObject<{
+    id: z$2.ZodString;
+    kind: z$2.ZodEnum<{
+      file: "file";
+      folder: "folder";
     }>;
-    sources: z$2.ZodArray<z$2.ZodEnum<{
-      manual: "manual";
-    }>>;
+    title: z$2.ZodString;
+    path: z$2.ZodString;
+    parentId: z$2.ZodNullable<z$2.ZodString>;
+    depth: z$2.ZodNumber;
+  }, z$2.core.$strip>>;
+  truncated: z$2.ZodOptional<z$2.ZodObject<{
+    maxEntries: z$2.ZodNumber;
+    returnedEntries: z$2.ZodNumber;
   }, z$2.core.$strip>>;
 }, z$2.core.$strip>;
-export declare const ACTOR_TYPES: readonly ["user", "agent", "api_key", "system"];
-export type ActorType = (typeof ACTOR_TYPES)[number];
-export type ActorStatus = "active" | "suspended" | "deleted";
-type SubjectActorType = Exclude<ActorType, "system">;
+export type RecordDriveSearchResult = z$2.output<typeof recordDriveSearchResultSchema>;
 /**
- * An actor as every answer carries it, one branch per type and status so the
- * type narrows on both (a discriminated union on `type`, then on `status`, so
- * a check reads two keys rather than trying every branch): a subject actor
- * names its subject until it is deleted (then the subject may be gone); the
- * system actor has none. Timestamps travel as ISO strings and read as `Date`
- * (`isoDateTime`).
+ * Text-extraction lifecycle for a single file within a document pack.
+ * `unsupported` is terminal and is not a failure: the file's type has no text
+ * to extract (an Outlook `.msg`, a `.docx`, a `.zip`), so nothing is queued.
  */
-export declare const actorSchema: z$2.ZodDiscriminatedUnion<[z$2.ZodDiscriminatedUnion<[z$2.ZodObject<{
-  id: z$2.ZodString;
-  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
-  displayName: z$2.ZodString;
-  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
-  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
-  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-} & {
-  type: z$2.ZodLiteral<"user">;
-  status: z$2.ZodLiteral<"active">;
-  subjectId: z$2.ZodString;
-}, z$2.core.$strip>, z$2.ZodObject<{
-  id: z$2.ZodString;
-  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
-  displayName: z$2.ZodString;
-  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
-  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
-  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-} & {
-  type: z$2.ZodLiteral<"user">;
-  status: z$2.ZodLiteral<"suspended">;
-  subjectId: z$2.ZodString;
-}, z$2.core.$strip>, z$2.ZodObject<{
-  id: z$2.ZodString;
-  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
-  displayName: z$2.ZodString;
-  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
-  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
-  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-} & {
-  type: z$2.ZodLiteral<"user">;
-  status: z$2.ZodLiteral<"deleted">;
-  subjectId: z$2.ZodNullable<z$2.ZodString>;
-}, z$2.core.$strip>], "status">, z$2.ZodDiscriminatedUnion<[z$2.ZodObject<{
-  id: z$2.ZodString;
-  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
-  displayName: z$2.ZodString;
-  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
-  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
-  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-} & {
-  type: z$2.ZodLiteral<"agent">;
-  status: z$2.ZodLiteral<"active">;
-  subjectId: z$2.ZodString;
-}, z$2.core.$strip>, z$2.ZodObject<{
-  id: z$2.ZodString;
-  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
-  displayName: z$2.ZodString;
-  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
-  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
-  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-} & {
-  type: z$2.ZodLiteral<"agent">;
-  status: z$2.ZodLiteral<"suspended">;
-  subjectId: z$2.ZodString;
-}, z$2.core.$strip>, z$2.ZodObject<{
-  id: z$2.ZodString;
-  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
-  displayName: z$2.ZodString;
-  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
-  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
-  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-} & {
-  type: z$2.ZodLiteral<"agent">;
-  status: z$2.ZodLiteral<"deleted">;
-  subjectId: z$2.ZodNullable<z$2.ZodString>;
-}, z$2.core.$strip>], "status">, z$2.ZodDiscriminatedUnion<[z$2.ZodObject<{
-  id: z$2.ZodString;
-  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
-  displayName: z$2.ZodString;
-  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
-  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
-  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-} & {
-  type: z$2.ZodLiteral<"api_key">;
-  status: z$2.ZodLiteral<"active">;
-  subjectId: z$2.ZodString;
-}, z$2.core.$strip>, z$2.ZodObject<{
-  id: z$2.ZodString;
-  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
-  displayName: z$2.ZodString;
-  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
-  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
-  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-} & {
-  type: z$2.ZodLiteral<"api_key">;
-  status: z$2.ZodLiteral<"suspended">;
-  subjectId: z$2.ZodString;
-}, z$2.core.$strip>, z$2.ZodObject<{
-  id: z$2.ZodString;
-  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
-  displayName: z$2.ZodString;
-  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
-  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
-  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-} & {
-  type: z$2.ZodLiteral<"api_key">;
-  status: z$2.ZodLiteral<"deleted">;
-  subjectId: z$2.ZodNullable<z$2.ZodString>;
-}, z$2.core.$strip>], "status">, z$2.ZodObject<{
-  id: z$2.ZodString;
-  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
-  displayName: z$2.ZodString;
-  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
-  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
-  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-  type: z$2.ZodLiteral<"system">;
-  status: z$2.ZodEnum<{
-    active: "active";
-    deleted: "deleted";
-    suspended: "suspended";
-  }>;
-  subjectId: z$2.ZodOptional<z$2.ZodNull>;
-}, z$2.core.$strip>], "type">;
-export type Actor = z$2.output<typeof actorSchema>;
-interface CreateActorInputBase {
-  displayName: string;
-  avatarUrl?: string | null;
-  metadata?: Record<string, unknown>;
-}
-type CreateSubjectActorInput = { [Type in SubjectActorType]: {
-  type: Type;
-  subjectId: Uuid;
-}; }[SubjectActorType];
-export type CreateActorInput = (CreateActorInputBase & CreateSubjectActorInput) | (CreateActorInputBase & {
-  type: "system";
-  subjectId?: null;
-});
-export interface UpdateActorInput {
-  displayName?: string;
-  avatarUrl?: string | null;
-  status?: ActorStatus;
-  metadata?: Record<string, unknown>;
-  deletedAt?: Date | null;
-  anonymizedAt?: Date | null;
-}
-export interface ActorRoleAssignment {
-  id: Uuid;
-  tenantId: TenantId;
-  actorId: Uuid;
-  roleId: Uuid;
-  assignedBy?: Uuid | null;
-  createdAt: Date;
-}
-export interface AssignActorRoleInput {
-  actorId: Uuid;
-  roleId: Uuid;
-  assignedBy?: Uuid | null;
-}
-/**
- * Legacy permission payload stored with an API key.
- * Runtime authorization uses the API key actor's effective permissions.
- */
-export interface ApiKeyPermission {
-  scope: PermissionScope;
-  target: string;
-  actions: Action[];
-}
-/**
- * A role an API key's actor holds — the identifying slice only, never the
- * role's permissions.
- */
-export declare const apiKeyRoleSchema: z$2.ZodObject<{
+export declare const FILE_OCR_STATUSES: readonly ["pending", "processing", "completed", "failed", "unsupported"];
+export type FileOcrStatus = (typeof FILE_OCR_STATUSES)[number];
+/**
+ * A single anonymous file belonging to a document pack.
+ * Unlike the slot-based model, files carry no slot name — order within the
+ * pack is `position` only, and `name` is provenance (originalName), never a
+ * label rendered in the UI.
+ */
+export declare const documentFileSchema: z$2.ZodObject<{
   id: z$2.ZodString;
+  documentId: z$2.ZodString;
+  position: z$2.ZodNumber;
   name: z$2.ZodString;
-  label: z$2.ZodString;
+  mimeType: z$2.ZodString;
+  size: z$2.ZodNumber;
+  ocrStatus: z$2.ZodNullable<z$2.ZodEnum<{
+    completed: "completed";
+    failed: "failed";
+    pending: "pending";
+    processing: "processing";
+    unsupported: "unsupported";
+  }>>;
+  ocrText: z$2.ZodNullable<z$2.ZodString>;
+  ocrConfidence: z$2.ZodNullable<z$2.ZodNumber>;
+  processedAt: z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>;
 }, z$2.core.$strip>;
-export type ApiKeyRole = z$2.output<typeof apiKeyRoleSchema>;
-/**
- * An API key as every read answers it. Never its hash: the secret is shown
- * once, by `apiKeyWithSecretSchema`, at creation. Its timestamps were always
- * ISO strings, in the type as on the wire.
- */
-export declare const apiKeySchema: z$2.ZodObject<{
-  id: z$2.ZodString;
-  tenantId: z$2.ZodString;
-  userProfileId: z$2.ZodNullable<z$2.ZodString>;
-  name: z$2.ZodString;
-  prefix: z$2.ZodString;
-  expiresAt: z$2.ZodNullable<z$2.ZodString>;
-  lastUsedAt: z$2.ZodNullable<z$2.ZodString>;
-  revokedAt: z$2.ZodNullable<z$2.ZodString>;
-  createdAt: z$2.ZodString;
-  createdBy: z$2.ZodString;
-  roles: z$2.ZodOptional<z$2.ZodArray<z$2.ZodObject<{
+export type DocumentFile = z$2.output<typeof documentFileSchema>;
+/** What an attach did: a new pack, a file appended to a named pack, or the pack already holding the file linked. */
+export declare const ATTACH_FILE_ACTIONS: readonly ["created", "appended", "linked-existing"];
+export type AttachFileAction = (typeof ATTACH_FILE_ACTIONS)[number];
+/** What attaching a file to a record's document attribute answers: the pack, the file in it, and what happened. */
+export declare const attachedRecordDocumentSchema: z$2.ZodObject<{
+  document: z$2.ZodObject<{
+    id: z$2.ZodString;
+    tenantId: z$2.ZodString;
+    title: z$2.ZodString;
+    kind: z$2.ZodEnum<{
+      file: "file";
+      folder: "folder";
+    }>;
+    parentId: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+    description: z$2.ZodOptional<z$2.ZodString>;
+    contentHash: z$2.ZodOptional<z$2.ZodString>;
+    createdBy: z$2.ZodOptional<z$2.ZodString>;
+    updatedBy: z$2.ZodOptional<z$2.ZodString>;
+    deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+    position: z$2.ZodNumber;
+    createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+    updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  }, z$2.core.$strip>;
+  file: z$2.ZodObject<{
     id: z$2.ZodString;
+    documentId: z$2.ZodString;
+    position: z$2.ZodNumber;
     name: z$2.ZodString;
-    label: z$2.ZodString;
-  }, z$2.core.$strip>>>;
-  authorityActorId: z$2.ZodNullable<z$2.ZodString>;
-  detachedAt: z$2.ZodNullable<z$2.ZodString>;
-  detachedBy: z$2.ZodNullable<z$2.ZodString>;
-  mirrorsOwner: z$2.ZodBoolean;
+    mimeType: z$2.ZodString;
+    size: z$2.ZodNumber;
+    ocrStatus: z$2.ZodNullable<z$2.ZodEnum<{
+      completed: "completed";
+      failed: "failed";
+      pending: "pending";
+      processing: "processing";
+      unsupported: "unsupported";
+    }>>;
+    ocrText: z$2.ZodNullable<z$2.ZodString>;
+    ocrConfidence: z$2.ZodNullable<z$2.ZodNumber>;
+    processedAt: z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>;
+  }, z$2.core.$strip>;
+  action: z$2.ZodEnum<{
+    appended: "appended";
+    created: "created";
+    "linked-existing": "linked-existing";
+  }>;
 }, z$2.core.$strip>;
-export type ApiKey = z$2.output<typeof apiKeySchema>;
-/** Returned only at creation time — the only time the plaintext secret is available. */
-export declare const apiKeyWithSecretSchema: z$2.ZodObject<{
+/** A pack file as a drive row lists it: everything but its OCR text, which only reads need. */
+export declare const driveFileSchema: z$2.ZodObject<{
   id: z$2.ZodString;
-  tenantId: z$2.ZodString;
-  userProfileId: z$2.ZodNullable<z$2.ZodString>;
+  documentId: z$2.ZodString;
+  position: z$2.ZodNumber;
   name: z$2.ZodString;
-  prefix: z$2.ZodString;
-  expiresAt: z$2.ZodNullable<z$2.ZodString>;
-  lastUsedAt: z$2.ZodNullable<z$2.ZodString>;
-  revokedAt: z$2.ZodNullable<z$2.ZodString>;
-  createdAt: z$2.ZodString;
-  createdBy: z$2.ZodString;
-  roles: z$2.ZodOptional<z$2.ZodArray<z$2.ZodObject<{
-    id: z$2.ZodString;
-    name: z$2.ZodString;
-    label: z$2.ZodString;
-  }, z$2.core.$strip>>>;
-  authorityActorId: z$2.ZodNullable<z$2.ZodString>;
-  detachedAt: z$2.ZodNullable<z$2.ZodString>;
-  detachedBy: z$2.ZodNullable<z$2.ZodString>;
-  mirrorsOwner: z$2.ZodBoolean;
-  secret: z$2.ZodString;
+  mimeType: z$2.ZodString;
+  size: z$2.ZodNumber;
+  ocrStatus: z$2.ZodNullable<z$2.ZodEnum<{
+    completed: "completed";
+    failed: "failed";
+    pending: "pending";
+    processing: "processing";
+    unsupported: "unsupported";
+  }>>;
+  ocrConfidence: z$2.ZodNullable<z$2.ZodNumber>;
+  processedAt: z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>;
 }, z$2.core.$strip>;
-export type ApiKeyWithSecret = z$2.output<typeof apiKeyWithSecretSchema>;
+export type DriveFile = z$2.output<typeof driveFileSchema>;
+export type DocumentWithFiles = Document & {
+  files: DocumentFile[];
+};
 /**
- * Returned by validateKey — provides everything downstream needs.
- * Permissions come from actor-native effective permissions.
+ * One row of a record's drive at a given level: the document with its sub
+ * count and its pack files (#4332). A drive-only attachment, one that exists
+ * only as a reference edge and is named nowhere in `record.values`, has no
+ * other source for its files, and without them its row menu cannot offer
+ * Download. A folder has no pack: its `files` is always `[]`.
+ *
+ * A root-level child also names where it sits on the record: the document
+ * attribute whose edge holds it (`attachments` for a plain drive item) and
+ * that edge's qualified properties. A nested child has no edge of its own and
+ * carries neither.
  */
-export interface ApiKeyAuthContext {
-  tenantId: string;
-  userId: string | null;
-  keyId: string;
-  actorId: string;
-  actorType: ActorType;
-  credentialActorId?: string;
-  credentialActorType?: "api_key";
-  permissions: ApiKeyPermission[];
-  createdBy: string;
-  /** The stored authority the key acts for; null when detached. */
-  authorityActorId: string | null;
-  /**
-   * The person a personal key works for, the root of its actor chain as a
-   * person is an agent's: what the key creates is theirs and it sees what
-   * they see, within the key's own grants. Null for a workspace key.
-   */
-  rootActorId: string | null;
-}
-export interface CreateApiKeyInput {
-  name: string;
-  /**
-   * Explicit role to bind the key's actor to.
-   * When omitted, the key's actor holds the `member` role.
-   */
-  roleId?: string;
-  expiresAt?: string;
-  userProfileId?: string;
-  actorMetadata?: Record<string, unknown>;
-  /**
-   * Bind the key to the caller's own profile without naming it — how the CLI
-   * creates personal keys by default. Refused (403) when the caller acts for
-   * no human (a detached workspace key, an agent).
-   */
-  personal?: boolean;
-}
-/**
- * Type of mentionable entity
- */
-export type MentionEntityType = "user" | "record" | (string & {});
+export declare const recordDriveChildSchema: z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodString;
+  title: z$2.ZodString;
+  kind: z$2.ZodEnum<{
+    file: "file";
+    folder: "folder";
+  }>;
+  parentId: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  description: z$2.ZodOptional<z$2.ZodString>;
+  contentHash: z$2.ZodOptional<z$2.ZodString>;
+  createdBy: z$2.ZodOptional<z$2.ZodString>;
+  updatedBy: z$2.ZodOptional<z$2.ZodString>;
+  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  position: z$2.ZodNumber;
+  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  subCount: z$2.ZodNullable<z$2.ZodNumber>;
+  files: z$2.ZodArray<z$2.ZodObject<{
+    id: z$2.ZodString;
+    documentId: z$2.ZodString;
+    position: z$2.ZodNumber;
+    name: z$2.ZodString;
+    mimeType: z$2.ZodString;
+    size: z$2.ZodNumber;
+    ocrStatus: z$2.ZodNullable<z$2.ZodEnum<{
+      completed: "completed";
+      failed: "failed";
+      pending: "pending";
+      processing: "processing";
+      unsupported: "unsupported";
+    }>>;
+    ocrConfidence: z$2.ZodNullable<z$2.ZodNumber>;
+    processedAt: z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>;
+  }, z$2.core.$strip>>;
+  attributeName: z$2.ZodOptional<z$2.ZodString>;
+  properties: z$2.ZodOptional<z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>>;
+}, z$2.core.$strip>;
+export type RecordDriveChild = z$2.output<typeof recordDriveChildSchema>;
 /**
- * A mention reference stored with a message
+ * The orders a drive level is listed in. Every mode puts folders before
+ * files, then sorts on its key, then on `id`:
+ * - `manual`: `position` (the drag order);
+ * - `name-asc` / `name-desc`: the title, numeric and case- and
+ *   accent-insensitive ("File 2" before "file 10", "Éa" equal to "ea");
+ * - `date-desc` / `date-asc`: a file's `createdAt` (the date it was added)
+ *   to the millisecond, so a rename never moves it; folders keep `name-asc`'s
+ *   order in both directions.
+ * The `id` tiebreak is ascending in every mode.
  */
-export interface MentionReference {
-  /** Unique ID for this mention instance */
-  id: string;
-  /** Entity type (user, record, or custom) */
-  type: MentionEntityType;
-  /** Entity ID (user ID or record ID) */
-  entityId: string;
-  /** Display label at time of mention (cached for display even if entity is deleted) */
-  label: string;
-  /** Object name for records, undefined for users */
-  objectName?: string;
-  /** Start position in the message text */
-  startIndex: number;
-  /** End position in the message text */
-  endIndex: number;
-}
+export declare const DOCUMENT_SORT_MODES: readonly ["manual", "name-asc", "name-desc", "date-desc", "date-asc"];
+export type DocumentSortMode = (typeof DOCUMENT_SORT_MODES)[number];
+/** Rows in a page of a drive level when the caller names no `limit`. */
+export declare const RECORD_DRIVE_PAGE_DEFAULT_LIMIT = 100;
+/** The most rows one page of a drive level holds; a larger `limit` is clamped. */
+export declare const RECORD_DRIVE_PAGE_MAX_LIMIT = 500;
 /**
- * Context data for a mentioned entity (sent to AI)
+ * The longest drive page cursor read back. An issued cursor carries one title
+ * (at most 255 characters) plus a few short fields; anything longer is crafted.
  */
-export interface MentionedEntityContext {
-  /** Entity type */
-  type: MentionEntityType;
-  /** Entity ID */
-  entityId: string;
-  /** Display label */
-  label: string;
-  /** Object name for records */
-  objectName?: string;
-  /** Additional context data (record values, user details, etc.) */
-  data?: Record<string, unknown>;
-}
+export declare const RECORD_DRIVE_CURSOR_MAX_LENGTH = 2048;
 /**
- * Full mention context for AI
+ * One page of a record's drive level (#4985), in its sort mode's order.
+ * `nextCursor` resumes strictly after the page's last row, and is `null` on
+ * the last page. A cursor is opaque and only valid for the mode that issued it.
  */
-export interface MentionedContext {
-  /** All mentioned entities with their context data */
-  entities: MentionedEntityContext[];
-  /** Summary text for AI system prompt */
-  summary: string;
+export declare const recordDriveChildrenPageSchema: z$2.ZodObject<{
+  items: z$2.ZodArray<z$2.ZodObject<{
+    id: z$2.ZodString;
+    tenantId: z$2.ZodString;
+    title: z$2.ZodString;
+    kind: z$2.ZodEnum<{
+      file: "file";
+      folder: "folder";
+    }>;
+    parentId: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+    description: z$2.ZodOptional<z$2.ZodString>;
+    contentHash: z$2.ZodOptional<z$2.ZodString>;
+    createdBy: z$2.ZodOptional<z$2.ZodString>;
+    updatedBy: z$2.ZodOptional<z$2.ZodString>;
+    deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+    position: z$2.ZodNumber;
+    createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+    updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+    subCount: z$2.ZodNullable<z$2.ZodNumber>;
+    files: z$2.ZodArray<z$2.ZodObject<{
+      id: z$2.ZodString;
+      documentId: z$2.ZodString;
+      position: z$2.ZodNumber;
+      name: z$2.ZodString;
+      mimeType: z$2.ZodString;
+      size: z$2.ZodNumber;
+      ocrStatus: z$2.ZodNullable<z$2.ZodEnum<{
+        completed: "completed";
+        failed: "failed";
+        pending: "pending";
+        processing: "processing";
+        unsupported: "unsupported";
+      }>>;
+      ocrConfidence: z$2.ZodNullable<z$2.ZodNumber>;
+      processedAt: z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>;
+    }, z$2.core.$strip>>;
+    attributeName: z$2.ZodOptional<z$2.ZodString>;
+    properties: z$2.ZodOptional<z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>>;
+  }, z$2.core.$strip>>;
+  nextCursor: z$2.ZodNullable<z$2.ZodString>;
+}, z$2.core.$strip>;
+export type RecordDriveChildrenPage = z$2.output<typeof recordDriveChildrenPageSchema>;
+export interface CreateDocument {
+  title: string;
+  kind?: DocumentKind;
+  parentId?: Uuid | null;
+  description?: string;
+  position?: number;
 }
 /**
- * A span the person selected in an Artifact preview and carried into their
- * next message as a removable chip (#4117).
- *
- * Deliberately NOT a {@link MentionReference}: that one requires `startIndex`
- * and `endIndex` into the message text, so the transcript can place it inline.
- * A quote chip is not in the text and has no honest value for them. It travels
- * beside `attachments`, which is the message's existing shape for a removable
- * chip that is not part of what was typed.
+ * Reference to a record attribute that should atomically attach a freshly
+ * created Document. Passed alongside `CreateDocument` to make creation
+ * link-aware end-to-end (client → REST → service → repo).
  *
- * `revision` is what closes the loop: `publish_artifact` already takes
- * `artifactId` + `baseRevision`, so the agent can revise exactly the revision
- * the span was read from rather than whatever is newest when it answers.
+ * The server requires this — orphan Documents are not creatable through the
+ * REST API.
  */
-export interface ArtifactQuote {
-  /** Unique per chip, so removing one of two quotes of the same span works. */
-  id: string;
-  artifactId: string;
-  /** The revision the span was read from. */
-  revision: number;
-  selectedText: string;
+export interface CreateDocumentLink {
+  objectName: string;
+  sourceRecordId: string;
+  attributeName: string;
+}
+export interface UpdateDocument {
+  title?: string;
+  parentId?: Uuid | null;
+  position?: number;
+}
+export interface DocumentListOptions {
+  limit?: number;
+  offset?: number;
+}
+export interface RecordDocuments {
+  /** Documents grouped by attribute name (includes system 'attachments' attribute) */
+  byAttribute: Record<string, DocumentWithFiles[]>;
 }
 /**
- * What a decision asks of its recipient (spec 2026-10-29 § 3): `question`,
- * `approval`, `review` and `handoff` await an answer; `report` (work a
- * routine did for you) and `fyi` are informational, shown under « Pour toi ».
+ * One record that holds documents, with how much sits at its drive root and
+ * when it last moved. The wire shape of `GET /documents/record-owners`.
  */
-export declare const DECISION_KINDS: readonly ["question", "approval", "review", "handoff", "report", "fyi"];
-export type DecisionKind = (typeof DECISION_KINDS)[number];
-export declare const DECISION_INBOX_STATES: readonly ["unread", "read", "archived"];
-export type DecisionInboxState = (typeof DECISION_INBOX_STATES)[number];
-/** `pending` open, `completed` answered, `dismissed` withdrawn, `expired` expired; `none` informational. */
-export declare const DECISION_WORK_STATES: readonly ["none", "pending", "completed", "dismissed", "expired"];
-export type DecisionWorkState = (typeof DECISION_WORK_STATES)[number];
-/** What `decisions.list` filters on (`state`); absent = everything not archived. */
-export declare const DECISION_LIST_STATES: readonly [
-/** Pending, not archived, not snoozed (`snoozed_until` null or past): « À trancher ». */
-"open",
-/** Pending and `snoozed_until` in the future: « Plus tard ». */
-"snoozed",
-/** Completed, dismissed or expired: « Tranchées ». */
-"closed", "answered", "withdrawn", "expired", "unread", "read", "archived"];
-export type DecisionListState = (typeof DECISION_LIST_STATES)[number];
-/** What a decision can be about (§ 3): its links' target types. */
-export declare const DECISION_LINK_TARGET_TYPES: readonly ["record", "session", "document", "agent", "routine", "page", "email_thread"];
-export type DecisionLinkTargetType = (typeof DECISION_LINK_TARGET_TYPES)[number];
-/** One thing a decision is about. `objectName` only on a `record` (its page is addressed by its object). */
-export declare const decisionLinkSchema: z$2.ZodObject<{
-  targetType: z$2.ZodEnum<{
-    agent: "agent";
-    document: "document";
-    email_thread: "email_thread";
-    page: "page";
-    record: "record";
-    routine: "routine";
-    session: "session";
-  }>;
-  targetId: z$2.ZodString;
-  objectName: z$2.ZodOptional<z$2.ZodString>;
-  label: z$2.ZodOptional<z$2.ZodString>;
-}, z$2.core.$strip>;
-export type DecisionLink = z$2.output<typeof decisionLinkSchema>;
+export declare const documentRecordOwnerSchema: z$2.ZodObject<{
+  recordId: z$2.ZodString;
+  objectName: z$2.ZodString;
+  label: z$2.ZodString;
+  itemCount: z$2.ZodNumber;
+  fileCount: z$2.ZodNumber;
+  lastActivityAt: z$2.ZodString;
+}, z$2.core.$strip>;
+export type DocumentRecordOwner = z$2.output<typeof documentRecordOwnerSchema>;
+/** One page of {@link DocumentRecordOwner}s; `nextOffset: null` is the last page. */
+export declare const documentRecordOwnerPageSchema: z$2.ZodObject<{
+  data: z$2.ZodArray<z$2.ZodObject<{
+    recordId: z$2.ZodString;
+    objectName: z$2.ZodString;
+    label: z$2.ZodString;
+    itemCount: z$2.ZodNumber;
+    fileCount: z$2.ZodNumber;
+    lastActivityAt: z$2.ZodString;
+  }, z$2.core.$strip>>;
+  nextOffset: z$2.ZodNullable<z$2.ZodNumber>;
+}, z$2.core.$strip>;
+export type DocumentRecordOwnerPage = z$2.output<typeof documentRecordOwnerPageSchema>;
+/** What the reading actor may do with a resource (spec §6.6); records never produce `runner`. */
+export declare const viewerAccessSchema: z$2.ZodEnum<{
+  editor: "editor";
+  owner: "owner";
+  reader: "reader";
+  runner: "runner";
+  workspace: "workspace";
+}>;
+type Values = readonly [string, ...string[]];
+/** One beneficiary of a private resource: its effective role and every source that grants it. */
+export declare function accessGrantSchema<const Role extends Values, const Source extends Values>(roles: Role, sources: Source): z$2.ZodObject<{
+  actorId: z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>;
+  role: z$2.ZodEnum<{ [k in Role[number]]: k; } extends (infer T) ? { [k in keyof T]: T[k]; } : never>;
+  sources: z$2.ZodArray<z$2.ZodEnum<{ [k in Source[number]]: k; } extends (infer T_1) ? { [k in keyof T_1]: T_1[k]; } : never>>;
+}, z$2.core.$strip>;
+/** Who can reach a record beyond its owner (`GET /records/:object/:id/access`). */
+export declare const recordAudienceSchema: z$2.ZodObject<{
+  recordId: z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>;
+  visibility: z$2.ZodEnum<{
+    private: "private";
+    workspace: "workspace";
+  }>;
+  ownedBy: z$2.ZodNullable<z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>>;
+  viewerAccess: z$2.ZodEnum<{
+    editor: "editor";
+    owner: "owner";
+    reader: "reader";
+    runner: "runner";
+    workspace: "workspace";
+  }>;
+  grants: z$2.ZodArray<z$2.ZodObject<{
+    actorId: z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>;
+    role: z$2.ZodEnum<{
+      editor: "editor";
+      reader: "reader";
+    }>;
+    sources: z$2.ZodArray<z$2.ZodEnum<{
+      manual: "manual";
+      meeting_attendee: "meeting_attendee";
+    }>>;
+  }, z$2.core.$strip>>;
+}, z$2.core.$strip>;
+/** Who may run commands on a device beyond its owner (`GET /devices/:id/access`). */
+export declare const deviceAudienceSchema: z$2.ZodObject<{
+  deviceId: z$2.ZodString;
+  visibility: z$2.ZodEnum<{
+    private: "private";
+    workspace: "workspace";
+  }>;
+  ownedBy: z$2.ZodNullable<z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>>;
+  viewerAccess: z$2.ZodEnum<{
+    editor: "editor";
+    owner: "owner";
+    reader: "reader";
+    runner: "runner";
+    workspace: "workspace";
+  }>;
+  grants: z$2.ZodArray<z$2.ZodObject<{
+    actorId: z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>;
+    role: z$2.ZodEnum<{
+      runner: "runner";
+    }>;
+    sources: z$2.ZodArray<z$2.ZodEnum<{
+      manual: "manual";
+    }>>;
+  }, z$2.core.$strip>>;
+}, z$2.core.$strip>;
+/** Who can reach a private page beyond its owner (`GET /pages/:id/access`). */
+export declare const pageAudienceSchema: z$2.ZodObject<{
+  pageId: z$2.ZodString;
+  visibility: z$2.ZodEnum<{
+    private: "private";
+    workspace: "workspace";
+  }>;
+  ownedBy: z$2.ZodNullable<z$2.ZodString>;
+  viewerAccess: z$2.ZodEnum<{
+    editor: "editor";
+    owner: "owner";
+    reader: "reader";
+    runner: "runner";
+    workspace: "workspace";
+  }>;
+  grants: z$2.ZodArray<z$2.ZodObject<{
+    actorId: z$2.ZodType<string, string, z$2.core.$ZodTypeInternals<string, string>>;
+    role: z$2.ZodEnum<{
+      editor: "editor";
+      reader: "reader";
+    }>;
+    sources: z$2.ZodArray<z$2.ZodEnum<{
+      manual: "manual";
+    }>>;
+  }, z$2.core.$strip>>;
+}, z$2.core.$strip>;
+export declare const ACTOR_TYPES: readonly ["user", "agent", "api_key", "system"];
+export type ActorType = (typeof ACTOR_TYPES)[number];
+export type ActorStatus = "active" | "suspended" | "deleted";
+type SubjectActorType = Exclude<ActorType, "system">;
+/**
+ * An actor as every answer carries it, one branch per type and status so the
+ * type narrows on both (a discriminated union on `type`, then on `status`, so
+ * a check reads two keys rather than trying every branch): a subject actor
+ * names its subject until it is deleted (then the subject may be gone); the
+ * system actor has none. Timestamps travel as ISO strings and read as `Date`
+ * (`isoDateTime`).
+ */
+export declare const actorSchema: z$2.ZodDiscriminatedUnion<[z$2.ZodDiscriminatedUnion<[z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
+  displayName: z$2.ZodString;
+  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
+  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+} & {
+  type: z$2.ZodLiteral<"user">;
+  status: z$2.ZodLiteral<"active">;
+  subjectId: z$2.ZodString;
+}, z$2.core.$strip>, z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
+  displayName: z$2.ZodString;
+  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
+  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+} & {
+  type: z$2.ZodLiteral<"user">;
+  status: z$2.ZodLiteral<"suspended">;
+  subjectId: z$2.ZodString;
+}, z$2.core.$strip>, z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
+  displayName: z$2.ZodString;
+  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
+  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+} & {
+  type: z$2.ZodLiteral<"user">;
+  status: z$2.ZodLiteral<"deleted">;
+  subjectId: z$2.ZodNullable<z$2.ZodString>;
+}, z$2.core.$strip>], "status">, z$2.ZodDiscriminatedUnion<[z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
+  displayName: z$2.ZodString;
+  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
+  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+} & {
+  type: z$2.ZodLiteral<"agent">;
+  status: z$2.ZodLiteral<"active">;
+  subjectId: z$2.ZodString;
+}, z$2.core.$strip>, z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
+  displayName: z$2.ZodString;
+  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
+  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+} & {
+  type: z$2.ZodLiteral<"agent">;
+  status: z$2.ZodLiteral<"suspended">;
+  subjectId: z$2.ZodString;
+}, z$2.core.$strip>, z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
+  displayName: z$2.ZodString;
+  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
+  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+} & {
+  type: z$2.ZodLiteral<"agent">;
+  status: z$2.ZodLiteral<"deleted">;
+  subjectId: z$2.ZodNullable<z$2.ZodString>;
+}, z$2.core.$strip>], "status">, z$2.ZodDiscriminatedUnion<[z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
+  displayName: z$2.ZodString;
+  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
+  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+} & {
+  type: z$2.ZodLiteral<"api_key">;
+  status: z$2.ZodLiteral<"active">;
+  subjectId: z$2.ZodString;
+}, z$2.core.$strip>, z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
+  displayName: z$2.ZodString;
+  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
+  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+} & {
+  type: z$2.ZodLiteral<"api_key">;
+  status: z$2.ZodLiteral<"suspended">;
+  subjectId: z$2.ZodString;
+}, z$2.core.$strip>, z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
+  displayName: z$2.ZodString;
+  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
+  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+} & {
+  type: z$2.ZodLiteral<"api_key">;
+  status: z$2.ZodLiteral<"deleted">;
+  subjectId: z$2.ZodNullable<z$2.ZodString>;
+}, z$2.core.$strip>], "status">, z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodType<TenantId, string, z$2.core.$ZodTypeInternals<TenantId, string>>;
+  displayName: z$2.ZodString;
+  avatarUrl: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  metadata: z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>;
+  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  anonymizedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
+  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
+  type: z$2.ZodLiteral<"system">;
+  status: z$2.ZodEnum<{
+    active: "active";
+    deleted: "deleted";
+    suspended: "suspended";
+  }>;
+  subjectId: z$2.ZodOptional<z$2.ZodNull>;
+}, z$2.core.$strip>], "type">;
+export type Actor = z$2.output<typeof actorSchema>;
+interface CreateActorInputBase {
+  displayName: string;
+  avatarUrl?: string | null;
+  metadata?: Record<string, unknown>;
+}
+type CreateSubjectActorInput = { [Type in SubjectActorType]: {
+  type: Type;
+  subjectId: Uuid;
+}; }[SubjectActorType];
+export type CreateActorInput = (CreateActorInputBase & CreateSubjectActorInput) | (CreateActorInputBase & {
+  type: "system";
+  subjectId?: null;
+});
+export interface UpdateActorInput {
+  displayName?: string;
+  avatarUrl?: string | null;
+  status?: ActorStatus;
+  metadata?: Record<string, unknown>;
+  deletedAt?: Date | null;
+  anonymizedAt?: Date | null;
+}
+export interface ActorRoleAssignment {
+  id: Uuid;
+  tenantId: TenantId;
+  actorId: Uuid;
+  roleId: Uuid;
+  assignedBy?: Uuid | null;
+  createdAt: Date;
+}
+export interface AssignActorRoleInput {
+  actorId: Uuid;
+  roleId: Uuid;
+  assignedBy?: Uuid | null;
+}
+/**
+ * Legacy permission payload stored with an API key.
+ * Runtime authorization uses the API key actor's effective permissions.
+ */
+export interface ApiKeyPermission {
+  scope: PermissionScope;
+  target: string;
+  actions: Action[];
+}
+/**
+ * A role an API key's actor holds — the identifying slice only, never the
+ * role's permissions.
+ */
+export declare const apiKeyRoleSchema: z$2.ZodObject<{
+  id: z$2.ZodString;
+  name: z$2.ZodString;
+  label: z$2.ZodString;
+}, z$2.core.$strip>;
+export type ApiKeyRole = z$2.output<typeof apiKeyRoleSchema>;
+/**
+ * An API key as every read answers it. Never its hash: the secret is shown
+ * once, by `apiKeyWithSecretSchema`, at creation. Its timestamps were always
+ * ISO strings, in the type as on the wire.
+ */
+export declare const apiKeySchema: z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodString;
+  userProfileId: z$2.ZodNullable<z$2.ZodString>;
+  name: z$2.ZodString;
+  prefix: z$2.ZodString;
+  expiresAt: z$2.ZodNullable<z$2.ZodString>;
+  lastUsedAt: z$2.ZodNullable<z$2.ZodString>;
+  revokedAt: z$2.ZodNullable<z$2.ZodString>;
+  createdAt: z$2.ZodString;
+  createdBy: z$2.ZodString;
+  roles: z$2.ZodOptional<z$2.ZodArray<z$2.ZodObject<{
+    id: z$2.ZodString;
+    name: z$2.ZodString;
+    label: z$2.ZodString;
+  }, z$2.core.$strip>>>;
+  authorityActorId: z$2.ZodNullable<z$2.ZodString>;
+  detachedAt: z$2.ZodNullable<z$2.ZodString>;
+  detachedBy: z$2.ZodNullable<z$2.ZodString>;
+  mirrorsOwner: z$2.ZodBoolean;
+}, z$2.core.$strip>;
+export type ApiKey = z$2.output<typeof apiKeySchema>;
+/** Returned only at creation time — the only time the plaintext secret is available. */
+export declare const apiKeyWithSecretSchema: z$2.ZodObject<{
+  id: z$2.ZodString;
+  tenantId: z$2.ZodString;
+  userProfileId: z$2.ZodNullable<z$2.ZodString>;
+  name: z$2.ZodString;
+  prefix: z$2.ZodString;
+  expiresAt: z$2.ZodNullable<z$2.ZodString>;
+  lastUsedAt: z$2.ZodNullable<z$2.ZodString>;
+  revokedAt: z$2.ZodNullable<z$2.ZodString>;
+  createdAt: z$2.ZodString;
+  createdBy: z$2.ZodString;
+  roles: z$2.ZodOptional<z$2.ZodArray<z$2.ZodObject<{
+    id: z$2.ZodString;
+    name: z$2.ZodString;
+    label: z$2.ZodString;
+  }, z$2.core.$strip>>>;
+  authorityActorId: z$2.ZodNullable<z$2.ZodString>;
+  detachedAt: z$2.ZodNullable<z$2.ZodString>;
+  detachedBy: z$2.ZodNullable<z$2.ZodString>;
+  mirrorsOwner: z$2.ZodBoolean;
+  secret: z$2.ZodString;
+}, z$2.core.$strip>;
+export type ApiKeyWithSecret = z$2.output<typeof apiKeyWithSecretSchema>;
+/**
+ * Returned by validateKey — provides everything downstream needs.
+ * Permissions come from actor-native effective permissions.
+ */
+export interface ApiKeyAuthContext {
+  tenantId: string;
+  userId: string | null;
+  keyId: string;
+  actorId: string;
+  actorType: ActorType;
+  credentialActorId?: string;
+  credentialActorType?: "api_key";
+  permissions: ApiKeyPermission[];
+  createdBy: string;
+  /** The stored authority the key acts for; null when detached. */
+  authorityActorId: string | null;
+  /**
+   * The person a personal key works for, the root of its actor chain as a
+   * person is an agent's: what the key creates is theirs and it sees what
+   * they see, within the key's own grants. Null for a workspace key.
+   */
+  rootActorId: string | null;
+}
+export interface CreateApiKeyInput {
+  name: string;
+  /**
+   * Explicit role to bind the key's actor to.
+   * When omitted, the key's actor holds the `member` role.
+   */
+  roleId?: string;
+  expiresAt?: string;
+  userProfileId?: string;
+  actorMetadata?: Record<string, unknown>;
+  /**
+   * Bind the key to the caller's own profile without naming it — how the CLI
+   * creates personal keys by default. Refused (403) when the caller acts for
+   * no human (a detached workspace key, an agent).
+   */
+  personal?: boolean;
+}
+/**
+ * Type of mentionable entity
+ */
+export type MentionEntityType = "user" | "record" | (string & {});
+/**
+ * A mention reference stored with a message
+ */
+export interface MentionReference {
+  /** Unique ID for this mention instance */
+  id: string;
+  /** Entity type (user, record, or custom) */
+  type: MentionEntityType;
+  /** Entity ID (user ID or record ID) */
+  entityId: string;
+  /** Display label at time of mention (cached for display even if entity is deleted) */
+  label: string;
+  /** Object name for records, undefined for users */
+  objectName?: string;
+  /** Start position in the message text */
+  startIndex: number;
+  /** End position in the message text */
+  endIndex: number;
+}
+/**
+ * Context data for a mentioned entity (sent to AI)
+ */
+export interface MentionedEntityContext {
+  /** Entity type */
+  type: MentionEntityType;
+  /** Entity ID */
+  entityId: string;
+  /** Display label */
+  label: string;
+  /** Object name for records */
+  objectName?: string;
+  /** Additional context data (record values, user details, etc.) */
+  data?: Record<string, unknown>;
+}
+/**
+ * Full mention context for AI
+ */
+export interface MentionedContext {
+  /** All mentioned entities with their context data */
+  entities: MentionedEntityContext[];
+  /** Summary text for AI system prompt */
+  summary: string;
+}
+/**
+ * A span the person selected in an Artifact preview and carried into their
+ * next message as a removable chip (#4117).
+ *
+ * Deliberately NOT a {@link MentionReference}: that one requires `startIndex`
+ * and `endIndex` into the message text, so the transcript can place it inline.
+ * A quote chip is not in the text and has no honest value for them. It travels
+ * beside `attachments`, which is the message's existing shape for a removable
+ * chip that is not part of what was typed.
+ *
+ * `revision` is what closes the loop: `publish_artifact` already takes
+ * `artifactId` + `baseRevision`, so the agent can revise exactly the revision
+ * the span was read from rather than whatever is newest when it answers.
+ */
+export interface ArtifactQuote {
+  /** Unique per chip, so removing one of two quotes of the same span works. */
+  id: string;
+  artifactId: string;
+  /** The revision the span was read from. */
+  revision: number;
+  selectedText: string;
+}
+/**
+ * What a decision asks of its recipient (spec 2026-10-29 § 3): `question`,
+ * `approval`, `review` and `handoff` await an answer; `report` (work a
+ * routine did for you) and `fyi` are informational, shown under « Pour toi ».
+ */
+export declare const DECISION_KINDS: readonly ["question", "approval", "review", "handoff", "report", "fyi"];
+export type DecisionKind = (typeof DECISION_KINDS)[number];
+export declare const DECISION_INBOX_STATES: readonly ["unread", "read", "archived"];
+export type DecisionInboxState = (typeof DECISION_INBOX_STATES)[number];
+/** `pending` open, `completed` answered, `dismissed` withdrawn, `expired` expired; `none` informational. */
+export declare const DECISION_WORK_STATES: readonly ["none", "pending", "completed", "dismissed", "expired"];
+export type DecisionWorkState = (typeof DECISION_WORK_STATES)[number];
+/** What `decisions.list` filters on (`state`); absent = everything not archived. */
+export declare const DECISION_LIST_STATES: readonly [
+/** Pending, not archived, not snoozed (`snoozed_until` null or past): « À trancher ». */
+"open",
+/** Pending and `snoozed_until` in the future: « Plus tard ». */
+"snoozed",
+/** Completed, dismissed or expired: « Tranchées ». */
+"closed", "answered", "withdrawn", "expired", "unread", "read", "archived"];
+export type DecisionListState = (typeof DECISION_LIST_STATES)[number];
+/** What a decision can be about (§ 3): its links' target types. */
+export declare const DECISION_LINK_TARGET_TYPES: readonly ["record", "session", "document", "agent", "routine", "page", "email_thread"];
+export type DecisionLinkTargetType = (typeof DECISION_LINK_TARGET_TYPES)[number];
+/** One thing a decision is about. `objectName` only on a `record` (its page is addressed by its object). */
+export declare const decisionLinkSchema: z$2.ZodObject<{
+  targetType: z$2.ZodEnum<{
+    agent: "agent";
+    document: "document";
+    email_thread: "email_thread";
+    page: "page";
+    record: "record";
+    routine: "routine";
+    session: "session";
+  }>;
+  targetId: z$2.ZodString;
+  objectName: z$2.ZodOptional<z$2.ZodString>;
+  label: z$2.ZodOptional<z$2.ZodString>;
+}, z$2.core.$strip>;
+export type DecisionLink = z$2.output<typeof decisionLinkSchema>;
 /** `record:<object>:<id>`, or `<targetType>:<id>`: the `link` filter's and `thread_key`'s text form. */
 export declare function formatDecisionLink(link: DecisionLink): string;
 /** The inverse of {@link formatDecisionLink}; `null` for anything else (unknown type, a record without its object, an empty id). */
@@ -2781,6 +3139,13 @@ export declare const objectDefinitionOutputSchema: z$2.ZodObject<{
   metadata: z$2.ZodOptional<z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>>;
   documentLayout: z$2.ZodOptional<z$2.ZodType<DocumentLayout, DocumentLayout, z$2.core.$ZodTypeInternals<DocumentLayout, DocumentLayout>>>;
   hierarchical: z$2.ZodOptional<z$2.ZodBoolean>;
+  defaultDriveSort: z$2.ZodOptional<z$2.ZodEnum<{
+    "date-asc": "date-asc";
+    "date-desc": "date-desc";
+    manual: "manual";
+    "name-asc": "name-asc";
+    "name-desc": "name-desc";
+  }>>;
 }, z$2.core.$strip>;
 export declare const schemaGroupSchema: z$2.ZodObject<{
   kind: z$2.ZodLiteral<"bundle">;
@@ -6576,6 +6941,8 @@ export interface CreateCustomObjectInput {
   image?: ObjectImage;
   /** Its records may have a parent of this object. */
   hierarchical?: boolean;
+  /** The order its records' drives rest in until a person chooses one. */
+  defaultDriveSort?: DocumentSortMode;
   attributes?: (Attribute | {
     build: () => Attribute;
   })[];
@@ -6593,6 +6960,8 @@ export interface UpdateObjectInput {
   labelExpression?: string;
   embeddingExpression?: string;
   hierarchical?: boolean;
+  /** The order its records' drives rest in until a person chooses one. */
+  defaultDriveSort?: DocumentSortMode;
   metadata?: Record<string, unknown>;
 }
 export type RelationOption = z$1.output<typeof relationOptionSchema>;
@@ -10023,980 +10392,629 @@ export interface AIChatMessage {
   /** True on an assistant message whose turn speaks only through `send` ({@link SPEAKS_THROUGH_SEND_METADATA_KEY}). */
   speaksThroughSend?: boolean;
   /** True on an assistant message of a turn a wake's message alone started ({@link WAKE_TURN_METADATA_KEY}). */
-  wakeTurn?: boolean;
-}
-/**
- * Question types supported by the agent
- */
-export type AIQuestionType = "text" | "choice" | "confirm" | "multiselect";
-/**
- * Option for choice/multiselect questions
- */
-export interface AIQuestionOption {
-  value: string;
-  label: string;
-  description?: string;
-}
-/**
- * Question from the agent to the user
- */
-export interface AIQuestion {
-  /** Unique question ID */
-  id: string;
-  /** Question type */
-  type: AIQuestionType;
-  /** Question text */
-  question: string;
-  /** Options for choice/multiselect */
-  options?: AIQuestionOption[];
-  /** Placeholder for text input */
-  placeholder?: string;
-  /** Whether answer is required */
-  required?: boolean;
-  /** Min selections for multiselect */
-  minSelections?: number;
-  /** Max selections for multiselect */
-  maxSelections?: number;
-}
-/**
- * Answer format for questions
- */
-export type AIQuestionAnswer = {
-  type: "text";
-  value: string;
-} | {
-  type: "choice";
-  value: string;
-} | {
-  type: "confirm";
-  value: boolean;
-} | {
-  type: "multiselect";
-  value: string[];
-};
-/**
- * Option for batch questions
- */
-export interface AIBatchQuestionOption {
-  /** Value returned when selected */
-  value: string;
-  /** Display label */
-  label: string;
-  /**
-   * What choosing this option means, or what it costs. Rendered under the
-   * label, in the quiet weight: a batch of bare labels asks the human to
-   * infer the trade-off the agent already knows.
-   */
-  description?: string;
-}
-/**
- * Kind of field a batch question is answered with.
- *
- * `record` (constraining the answer to a real `recordId`) is deliberately
- * absent: it needs a record selector, which is a feature of its own rather
- * than a field variant.
- */
-export type AIBatchQuestionType = "choice" | "text";
-/**
- * Question in a batch (for ask_questions tool)
- */
-export interface AIBatchQuestion {
-  /** Unique question ID */
-  id: string;
-  /** Question text to display */
-  question: string;
-  /**
-   * What the person needs to know to answer this question, in a sentence or
-   * two, read under it. Optional: a question that speaks for itself has none.
-   */
-  context?: string;
-  /**
-   * Kind of field to answer with. Optional for backwards compatibility: when
-   * absent it is derived from the shape — `options` present means `choice`,
-   * otherwise `text`.
-   */
-  type?: AIBatchQuestionType;
-  /** Predefined options (if provided, displayed as buttons) */
-  options?: AIBatchQuestionOption[];
-  /**
-   * Several options may be chosen at once, and the answer comes back as an
-   * array. Decided by the agent per question, because only it knows whether
-   * the choices are mutually exclusive; a human forced to pick one of three
-   * non-exclusive options answers a question nobody asked.
-   */
-  multiSelect?: boolean;
-  /** Allow custom text input in addition to options */
-  allowCustomAnswer?: boolean;
-  /** Placeholder for custom input field */
-  placeholder?: string;
-}
-/**
- * A single answer, in the type the question asked for. A `multiSelect`
- * question answers with the array: joining it into `"a, b"` would hand the
- * server a string to split back apart, and one whose separator can appear
- * inside a value.
- */
-export type AIBatchAnswerValue = string | string[];
-/**
- * Answer returned by the AgentQuestions widget
- */
-export interface AIBatchQuestionAnswer {
-  /** True if user skipped all questions */
-  skipped: boolean;
-  /** Map of question ID to the answer given, in the question's own type */
-  answers: Record<string, AIBatchAnswerValue>;
-  /**
-   * The precisions a person added to the options they chose, by question ID
-   * then option value: « Gagné », precised « facturer en deux fois ». Rare and
-   * optional; only a chosen option's precision is kept.
-   */
-  notes?: Record<string, Record<string, string>>;
-}
-/**
- * Todo item status
- */
-export declare const TODO_STATUSES: readonly ["pending", "in_progress", "completed", "blocked"];
-export type AITodoStatus = (typeof TODO_STATUSES)[number];
-/**
- * Todo item in a task list
- */
-export interface AITodoItem {
-  id: string;
-  description: string;
-  status: AITodoStatus;
-  updatedAt?: number;
-  /**
-   * What an architect build todo is anchored on in the draft. A targeted
-   * todo's status is the server's: `draft_schema` recomputes it from the
-   * folded draft, and `write_todos` keeps the stored one.
-   */
-  target?: AITodoTarget;
-}
-/**
- * The phases of an architect build, always worked in this order: a plan
- * whose targeted todos run out of this order is refused.
- */
-export declare const TODO_PHASES: readonly ["objects", "fields", "relations", "views", "samples"];
-export type AITodoPhase = (typeof TODO_PHASES)[number];
-/** Where a build todo is anchored, by phase. */
-export type AITodoTarget =
-/** Completed when the folded draft has the object. */
-{
-  phase: "objects";
-  objectName: string;
-} |
-/** Completed when every named attribute is on the object. */
-{
-  phase: "fields";
-  objectName: string;
-  attributes: string[];
-} |
-/** Completed when every named relation attribute is on the object. */
-{
-  phase: "relations";
-  objectName: string;
-  attributes: string[];
-} |
-/**
- * Completed when an executed operation of the draft writes that view (and,
- * when named, that content). The empty default views `add_object` folds do
- * not count, nor does a view that is merely published.
- */
-{
-  phase: "views";
-  objectName: string;
-  viewName: string;
-  contentName?: string;
-} | {
-  phase: "views";
-  pageId: string;
-} |
-/** Completed when the draft holds at least one sample record of the object. */
-{
-  phase: "samples";
-  objectName: string;
-};
-/**
- * A todo as clients read it: a target is exposed by its phase, which the
- * progress surfaces read, and by its object when it names one, which picks the
- * builder the cursor follows (R17).
- */
-export interface AgentTodoPlanViewItem extends Omit<AITodoItem, "target"> {
-  target?: {
-    phase: AITodoPhase;
-    objectName?: string;
-  };
+  wakeTurn?: boolean;
 }
 /**
- * Persisted bounds on a todo, beside the type they constrain.
- *
- * Both sides of the wire enforce them: the runtime zod schema when it writes,
- * and the React projection parser when it reads an untrusted payload back.
- * React cannot import the runtime, which is why these numbers used to be
- * copied there under a "keep aligned with the canonical persisted schema"
- * comment — a synchronisation the compiler could not check.
+ * Question types supported by the agent
  */
-export declare const MAX_TODOS = 50;
-export declare const MAX_TODO_ID_CHARS = 80;
-export declare const MAX_TODO_DESCRIPTION_CHARS = 500;
+export type AIQuestionType = "text" | "choice" | "confirm" | "multiselect";
 /**
- * Todo list managed by the agent
+ * Option for choice/multiselect questions
  */
-export interface AITodoList {
-  items: AITodoItem[];
-  progress: number;
-  isComplete: boolean;
+export interface AIQuestionOption {
+  value: string;
+  label: string;
+  description?: string;
 }
 /**
- * Compaction summary for conversation history compression
+ * Question from the agent to the user
  */
-export interface AICompactionSummary {
+export interface AIQuestion {
+  /** Unique question ID */
   id: string;
-  tenantId: string;
-  userId: string;
-  conversationId: string;
-  summary: string;
-  originalMessageCount: number;
-  tokenCountBefore: number;
-  tokenCountAfter: number;
-  compactedAt: Date;
+  /** Question type */
+  type: AIQuestionType;
+  /** Question text */
+  question: string;
+  /** Options for choice/multiselect */
+  options?: AIQuestionOption[];
+  /** Placeholder for text input */
+  placeholder?: string;
+  /** Whether answer is required */
+  required?: boolean;
+  /** Min selections for multiselect */
+  minSelections?: number;
+  /** Max selections for multiselect */
+  maxSelections?: number;
 }
-/** Create-response metadata; these grants were added by this transaction, not prior grants. */
-export type CreateAgentTriggerResult = z$1.output<typeof createAgentTriggerResultSchema>;
 /**
- * The device channel wire protocol, shared by the API server and the CLI
- * shell worker. The server only ever emits `capability: "shell"` and
- * `kind: "shell"`; the enums keep `"browser"` for one more release because
- * every installed CLI parses these frames strictly against that enum.
+ * Answer format for questions
  */
-/** Absolute path of the channel on the API origin (the `/v1` prefix included). */
-export declare const DEVICE_CHANNEL_PATH = "/v1/device-worker/channel";
-export declare const DEVICE_CHANNEL_MAX_FRAME_BYTES = 262144;
-/** A socket that has not sent `authenticate` within this budget is closed 1008. */
-export declare const DEVICE_CHANNEL_AUTHENTICATE_TIMEOUT_MS = 10000;
-/** The server leases the next queued command from the store on this cadence while idle. */
-export declare const DEVICE_CHANNEL_IDLE_POLL_MS = 2000;
-/** The server re-validates the credential and refreshes presence on this cadence. */
-export declare const DEVICE_CHANNEL_PRESENCE_MS = 2000;
+export type AIQuestionAnswer = {
+  type: "text";
+  value: string;
+} | {
+  type: "choice";
+  value: string;
+} | {
+  type: "confirm";
+  value: boolean;
+} | {
+  type: "multiselect";
+  value: string[];
+};
 /**
- * The server sends `{ type: "ping" }` plus a control ping on this cadence; a
- * socket that has not answered the control ping by the next tick is dropped.
+ * Option for batch questions
  */
-export declare const DEVICE_CHANNEL_KEEPALIVE_MS = 20000;
+export interface AIBatchQuestionOption {
+  /** Value returned when selected */
+  value: string;
+  /** Display label */
+  label: string;
+  /**
+   * What choosing this option means, or what it costs. Rendered under the
+   * label, in the quiet weight: a batch of bare labels asks the human to
+   * infer the trade-off the agent already knows.
+   */
+  description?: string;
+}
 /**
- * The code a worker closes with when a frame breaks the protocol. A browser
- * `WebSocket` only accepts 1000 and 3000-4999, so the private-use mirror of
- * 1008 is the one code every worker can actually send.
+ * Kind of field a batch question is answered with.
+ *
+ * `record` (constraining the answer to a real `recordId`) is deliberately
+ * absent: it needs a record selector, which is a feature of its own rather
+ * than a field variant.
  */
-export declare const DEVICE_CHANNEL_WORKER_CLOSE_PROTOCOL_VIOLATION = 4008;
-/** Where an exponential backoff starts, and where it stops doubling. */
-export interface RetryBounds {
-  initialMs: number;
-  maxMs: number;
-}
+export type AIBatchQuestionType = "choice" | "text";
 /**
- * Where the channel is: the path is absolute on the API origin, so a profile's
- * `apiUrl` keeps only its host and the scheme swaps to the socket one. Written
- * as an explicit map rather than a rewrite of the origin string, because a
- * two-letter scheme literal reads to the SDK's egress scan as the `ws` package.
+ * Question in a batch (for ask_questions tool)
  */
-export declare function deviceChannelUrl(apiUrl: string): string;
-/** Exponential backoff within the given bounds, plus the shared jitter window. */
-export declare function computeRetryDelay(attempt: number, random: () => number, bounds: RetryBounds): number;
-/** When to reconnect to the channel: 1 s doubling up to 30 s, plus jitter. */
-export declare function computeReconnectDelay(attempt: number, random?: () => number): number;
-export declare const DEVICE_COMMAND_ERROR_CODES: readonly ["worker_disconnected", "cancelled", "timed_out", "execution_failed"];
-export type DeviceCommandErrorCode = (typeof DEVICE_COMMAND_ERROR_CODES)[number];
-export declare class DeviceChannelProtocolError extends SchemaError {
-  readonly _tag = "DeviceChannelProtocolError";
-  constructor(message: string);
-}
-/** The shells a worker can open a session in; announced at `authenticate`. */
-export declare const DEVICE_SHELLS: readonly ["zsh", "bash", "sh", "fish", "pwsh", "powershell"];
-export type DeviceShell = (typeof DEVICE_SHELLS)[number];
-/** Whether the machine can drive its desktop through `agent-desktop`. */
-export declare const DEVICE_DESKTOP_STATES: readonly ["ready", "permission_missing", "no_session", "unavailable"];
-export type DeviceDesktopState = (typeof DEVICE_DESKTOP_STATES)[number];
-export declare const DeviceDesktopStatusSchema: z$2.ZodObject<{
-  state: z$2.ZodEnum<{
-    no_session: "no_session";
-    permission_missing: "permission_missing";
-    ready: "ready";
-    unavailable: "unavailable";
-  }>;
-  version: z$2.ZodString;
-}, z$2.core.$strict>;
-export type DeviceDesktopStatus = z$2.infer<typeof DeviceDesktopStatusSchema>;
-export declare const DeviceChannelWorkerFrameSchema: z$2.ZodDiscriminatedUnion<[z$2.ZodObject<{
-  type: z$2.ZodLiteral<"authenticate">;
-  credential: z$2.ZodString;
-  protocol: z$2.ZodOptional<z$2.ZodNumber>;
-  desktop: z$2.ZodOptional<z$2.ZodObject<{
-    state: z$2.ZodEnum<{
-      no_session: "no_session";
-      permission_missing: "permission_missing";
-      ready: "ready";
-      unavailable: "unavailable";
-    }>;
-    version: z$2.ZodString;
-  }, z$2.core.$strict>>;
-  shell: z$2.ZodOptional<z$2.ZodEnum<{
-    bash: "bash";
-    fish: "fish";
-    powershell: "powershell";
-    pwsh: "pwsh";
-    sh: "sh";
-    zsh: "zsh";
-  }>>;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  id: z$2.ZodUUID;
-  leaseToken: z$2.ZodString;
-  type: z$2.ZodLiteral<"running">;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  id: z$2.ZodUUID;
-  leaseToken: z$2.ZodString;
-  type: z$2.ZodLiteral<"heartbeat">;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  id: z$2.ZodUUID;
-  leaseToken: z$2.ZodString;
-  type: z$2.ZodLiteral<"output">;
-  stdout: z$2.ZodOptional<z$2.ZodString>;
-  stderr: z$2.ZodOptional<z$2.ZodString>;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  id: z$2.ZodUUID;
-  leaseToken: z$2.ZodString;
-  type: z$2.ZodLiteral<"complete">;
-  result: z$2.ZodObject<{
-    stdout: z$2.ZodOptional<z$2.ZodString>;
-    stderr: z$2.ZodOptional<z$2.ZodString>;
-    exitCode: z$2.ZodNumber;
-    success: z$2.ZodBoolean;
-    errorCode: z$2.ZodOptional<z$2.ZodEnum<{
-      cancelled: "cancelled";
-      execution_failed: "execution_failed";
-      timed_out: "timed_out";
-      worker_disconnected: "worker_disconnected";
-    }>>;
-  }, z$2.core.$strict>;
-  background: z$2.ZodOptional<z$2.ZodObject<{
-    pid: z$2.ZodNumber;
-    logPath: z$2.ZodString;
-  }, z$2.core.$strict>>;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  type: z$2.ZodLiteral<"pong">;
-}, z$2.core.$strict>], "type">;
-export declare const DeviceChannelServerFrameSchema: z$2.ZodDiscriminatedUnion<[z$2.ZodObject<{
-  type: z$2.ZodLiteral<"ready">;
-  device: z$2.ZodObject<{
-    id: z$2.ZodString;
-    name: z$2.ZodString;
-    capability: z$2.ZodEnum<{
-      browser: "browser";
-      shell: "shell";
-    }>;
-  }, z$2.core.$strict>;
-  protocol: z$2.ZodOptional<z$2.ZodNumber>;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  id: z$2.ZodUUID;
-  leaseToken: z$2.ZodString;
-  type: z$2.ZodLiteral<"command">;
-  kind: z$2.ZodEnum<{
-    browser: "browser";
-    shell: "shell";
-  }>;
-  intent: z$2.ZodString;
-  timeoutMs: z$2.ZodNumber;
-  command: z$2.ZodOptional<z$2.ZodString>;
-  cwd: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
-  rootSessionId: z$2.ZodOptional<z$2.ZodString>;
-  background: z$2.ZodOptional<z$2.ZodBoolean>;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  type: z$2.ZodLiteral<"release_session">;
-  rootSessionId: z$2.ZodString;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  type: z$2.ZodLiteral<"cancel">;
-  id: z$2.ZodUUID;
-  reason: z$2.ZodEnum<{
-    cancelled: "cancelled";
-    revoked: "revoked";
-    timed_out: "timed_out";
-  }>;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  type: z$2.ZodLiteral<"reauthenticate">;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  type: z$2.ZodLiteral<"revoked">;
-}, z$2.core.$strict>, z$2.ZodObject<{
-  type: z$2.ZodLiteral<"ping">;
-}, z$2.core.$strict>], "type">;
-export type DeviceChannelWorkerFrame = z$2.infer<typeof DeviceChannelWorkerFrameSchema>;
-export type DeviceChannelServerFrame = z$2.infer<typeof DeviceChannelServerFrameSchema>;
-/** Parses one text frame; a non-JSON or off-protocol frame is a `DeviceChannelProtocolError`. */
-export declare function parseDeviceChannelFrame<T>(schema: z$2.ZodType<T>, raw: string): T;
-export declare function parseWorkerFrame(raw: string): DeviceChannelWorkerFrame;
-export declare function parseServerFrame(raw: string): DeviceChannelServerFrame;
+export interface AIBatchQuestion {
+  /** Unique question ID */
+  id: string;
+  /** Question text to display */
+  question: string;
+  /**
+   * What the person needs to know to answer this question, in a sentence or
+   * two, read under it. Optional: a question that speaks for itself has none.
+   */
+  context?: string;
+  /**
+   * Kind of field to answer with. Optional for backwards compatibility: when
+   * absent it is derived from the shape — `options` present means `choice`,
+   * otherwise `text`.
+   */
+  type?: AIBatchQuestionType;
+  /** Predefined options (if provided, displayed as buttons) */
+  options?: AIBatchQuestionOption[];
+  /**
+   * Several options may be chosen at once, and the answer comes back as an
+   * array. Decided by the agent per question, because only it knows whether
+   * the choices are mutually exclusive; a human forced to pick one of three
+   * non-exclusive options answers a question nobody asked.
+   */
+  multiSelect?: boolean;
+  /** Allow custom text input in addition to options */
+  allowCustomAnswer?: boolean;
+  /** Placeholder for custom input field */
+  placeholder?: string;
+}
 /**
- * The minimum every capability predicate in this file reads: the type, plus
- * whatever else of a full `Attribute` the caller happens to hold. Exported so
- * callers that only have a partial attribute — a plan's proposed attribute, a
- * schema snapshot row — can ask the same questions as callers holding the real
- * thing, instead of restating the rules.
+ * A single answer, in the type the question asked for. A `multiSelect`
+ * question answers with the array: joining it into `"a, b"` would hand the
+ * server a string to split back apart, and one whose separator can appear
+ * inside a value.
  */
-export type AttributeLike = Pick<Attribute, "type"> & Partial<Attribute>;
-export type AttributeLifecycleCapabilities = {
-  active: boolean;
-  deprecated: boolean;
-  visibleInArchitect: boolean;
-  visibleInRuntime: boolean;
-  warningWhenDeprecated: boolean;
-};
-export type AttributeStorageMode = "value" | "edge" | "computed";
-export type AttributeCardinality = "one" | "many";
-export type AttributePolymorphicCapability = "none" | "code-only" | "internal";
-export type AttributeStorageCapabilities = {
-  mode: AttributeStorageMode;
-  cardinality: AttributeCardinality;
-  edgeBacked: boolean;
-  preservesExistingValues: boolean;
-  qualifiedProperties: boolean;
-  polymorphic: AttributePolymorphicCapability;
-  maxItems: boolean;
-};
-export type AttributeRequiredCapability = "allowed" | "forbidden";
-export type AttributeDefaultValueCapability = "static" | "automatic" | "forbidden";
-export type AttributeAuthoringCapabilities = {
-  editable: boolean;
-  readOnly: boolean;
-  directEdit: boolean;
-  required: AttributeRequiredCapability;
-  defaultValue: AttributeDefaultValueCapability;
-  placeholder: boolean;
-  maxItems: boolean;
-};
-export type AttributePresentationCapabilities = {
-  formField: boolean;
-  tableCell: boolean;
-  defaultColumn: boolean;
-  compactDisplay: boolean;
-  popoverEditor: boolean;
-  placeholder: boolean;
-  warningWhenDeprecated: boolean;
-};
-export type AttributeQueryCapabilities = {
-  filterable: boolean;
-  searchable: boolean;
-  sortable: boolean;
-  groupable: boolean;
-  kanbanGroupable: boolean;
-  operators: readonly FilterOperator[];
-};
-export type AttributeAgentCapabilities = {
-  readable: boolean;
-  writable: boolean;
-  compactReadable: boolean;
-  contentReadable: boolean;
-  requiresDedicatedTool: boolean;
-};
-export type AttributeExchangeCapabilities = {
-  importable: boolean;
-  exportable: boolean;
-  schemaExportable: boolean;
-  metadataExportable: boolean;
-};
-export type AttributeCapabilities = {
-  lifecycle: AttributeLifecycleCapabilities;
-  storage: AttributeStorageCapabilities;
-  authoring: AttributeAuthoringCapabilities;
-  presentation: AttributePresentationCapabilities;
-  query: AttributeQueryCapabilities;
-  agent: AttributeAgentCapabilities;
-  exchange: AttributeExchangeCapabilities;
-};
+export type AIBatchAnswerValue = string | string[];
 /**
- * The parts of a location a filter may address (#3118). A location is a
- * JSONB object with no operators of its own; a rule names one of these parts
- * through `property` and compares it as text — `country` holds the ISO3 code.
+ * Answer returned by the AgentQuestions widget
  */
-export declare const LOCATION_FILTER_PROPERTIES: readonly ["city", "postalCode", "country"];
-export type LocationFilterProperty = (typeof LOCATION_FILTER_PROPERTIES)[number];
-export declare function isLocationFilterProperty(name: string): name is LocationFilterProperty;
-export declare const ATTRIBUTE_FILTER_OPERATORS: Readonly<Record<Exclude<AttributeType, "rollup">, readonly FilterOperator[]>>;
+export interface AIBatchQuestionAnswer {
+  /** True if user skipped all questions */
+  skipped: boolean;
+  /** Map of question ID to the answer given, in the question's own type */
+  answers: Record<string, AIBatchAnswerValue>;
+  /**
+   * The precisions a person added to the options they chose, by question ID
+   * then option value: « Gagné », precised « facturer en deux fois ». Rare and
+   * optional; only a chosen option's precision is kept.
+   */
+  notes?: Record<string, Record<string, string>>;
+  /**
+   * The files the person added on the card to go with the answer, each a
+   * `file:<id>` or `document:<id>` ref; empty when none was. Files the
+   * question itself attached are not among them.
+   */
+  addedFiles?: string[];
+}
 /**
- * What an attribute type's value is — the per-type fact most rules branch on:
- * - `plain`: typed in by hand (text, number, date, phone, currency, location)
- * - `boolean`: a checkbox, always true or false, never empty
- * - `options`: a code (or codes) from the attribute's own `options`
- * - `reference`: ids of users, records or files, stored as edges
- * - `computed`: derived from other values (formula, rollup), never written
+ * Todo item status
  */
-export type AttributeValueKind = "plain" | "boolean" | "options" | "reference" | "computed";
+export declare const TODO_STATUSES: readonly ["pending", "in_progress", "completed", "blocked"];
+export type AITodoStatus = (typeof TODO_STATUSES)[number];
 /**
- * - `placeholder`: the editor shows a configurable placeholder
- * - `searchable` / `sortable` / `groupable`: the query surfaces it offers
- * - `content`: a body read whole (rich text, files), not a table cell
- * - `qualified`: its edges may carry qualified properties
+ * Todo item in a task list
  */
-export type AttributeTypeTrait = "placeholder" | "searchable" | "sortable" | "groupable" | "content" | "qualified";
-export interface AttributeTypeDescriptor {
-  readonly value: AttributeValueKind;
-  readonly traits: readonly AttributeTypeTrait[];
+export interface AITodoItem {
+  id: string;
+  description: string;
+  status: AITodoStatus;
+  updatedAt?: number;
+  /**
+   * What an architect build todo is anchored on in the draft. A targeted
+   * todo's status is the server's: `draft_schema` recomputes it from the
+   * folded draft, and `write_todos` keeps the stored one.
+   */
+  target?: AITodoTarget;
 }
 /**
- * The one per-type registry: a new attribute type cannot be added without
- * deciding each of these. Rich text is searched as plain words (the search
- * adapter strips its markdown).
+ * The phases of an architect build, always worked in this order: a plan
+ * whose targeted todos run out of this order is refused.
  */
-export declare const ATTRIBUTE_TYPE_DESCRIPTORS: {
-  readonly text: {
-    readonly value: "plain";
-    readonly traits: readonly ["placeholder", "searchable", "sortable"];
-  };
-  readonly richtext: {
-    readonly value: "plain";
-    readonly traits: readonly ["searchable", "content"];
-  };
-  readonly number: {
-    readonly value: "plain";
-    readonly traits: readonly ["placeholder", "sortable"];
-  };
-  readonly checkbox: {
-    readonly value: "boolean";
-    readonly traits: readonly ["sortable"];
-  };
-  readonly date: {
-    readonly value: "plain";
-    readonly traits: readonly ["placeholder", "sortable"];
-  };
-  readonly phone: {
-    readonly value: "plain";
-    readonly traits: readonly ["placeholder", "searchable", "sortable"];
-  };
-  readonly currency: {
-    readonly value: "plain";
-    readonly traits: readonly ["placeholder", "sortable", "groupable"];
-  };
-  readonly status: {
-    readonly value: "options";
-    readonly traits: readonly ["searchable", "sortable", "groupable"];
-  };
-  readonly location: {
-    readonly value: "plain";
-    readonly traits: readonly [];
-  };
-  readonly select: {
-    readonly value: "options";
-    readonly traits: readonly ["placeholder", "searchable", "sortable"];
-  };
-  readonly multiselect: {
-    readonly value: "options";
-    readonly traits: readonly ["placeholder", "searchable"];
-  };
-  readonly user: {
-    readonly value: "reference";
-    readonly traits: readonly [];
-  };
-  readonly relation: {
-    readonly value: "reference";
-    readonly traits: readonly ["qualified"];
-  };
-  readonly formula: {
-    readonly value: "computed";
-    readonly traits: readonly [];
-  };
-  readonly rollup: {
-    readonly value: "computed";
-    readonly traits: readonly [];
-  };
-  readonly document: {
-    readonly value: "reference";
-    readonly traits: readonly ["content", "qualified"];
-  };
-};
-/** The attribute types whose value is of `kind`, as a literal union. */
-export type AttributeTypeOfKind<K extends AttributeValueKind> = { [T in AttributeType]: (typeof ATTRIBUTE_TYPE_DESCRIPTORS)[T]["value"] extends K ? T : never; }[AttributeType];
-/** Whether `type`'s value is of `kind` (`"computed"`: formula and rollup). */
-export declare function isValueKindType<K extends AttributeValueKind>(type: string, kind: K): type is AttributeTypeOfKind<K>;
-/** Whether `attribute`'s value is of `kind`, narrowing it to the matching attribute types. */
-export declare function hasValueKind<A extends {
-  type: string;
-}, K extends AttributeValueKind>(attribute: A, kind: K): attribute is A & {
-  type: AttributeTypeOfKind<K>;
+export declare const TODO_PHASES: readonly ["objects", "fields", "relations", "views", "samples"];
+export type AITodoPhase = (typeof TODO_PHASES)[number];
+/** Where a build todo is anchored, by phase. */
+export type AITodoTarget =
+/** Completed when the folded draft has the object. */
+{
+  phase: "objects";
+  objectName: string;
+} |
+/** Completed when every named attribute is on the object. */
+{
+  phase: "fields";
+  objectName: string;
+  attributes: string[];
+} |
+/** Completed when every named relation attribute is on the object. */
+{
+  phase: "relations";
+  objectName: string;
+  attributes: string[];
+} |
+/**
+ * Completed when an executed operation of the draft writes that view (and,
+ * when named, that content). The empty default views `add_object` folds do
+ * not count, nor does a view that is merely published.
+ */
+{
+  phase: "views";
+  objectName: string;
+  viewName: string;
+  contentName?: string;
+} | {
+  phase: "views";
+  pageId: string;
+} |
+/** Completed when the draft holds at least one sample record of the object. */
+{
+  phase: "samples";
+  objectName: string;
 };
-/** Whether `type` carries `trait`. */
-export declare function hasTypeTrait(type: string, trait: AttributeTypeTrait): boolean;
-export declare function getAttributeCapabilities(attribute: AttributeLike): AttributeCapabilities;
-export declare function getAttributeFilterOperators(attribute: AttributeLike): readonly FilterOperator[];
-export declare function isAttributeFilterable(attribute: AttributeLike): boolean;
-export declare function isAttributeSearchable(attribute: AttributeLike): boolean;
-export declare function isAttributeGroupable(attribute: AttributeLike): boolean;
-export declare function isAttributeKanbanGroupable(attribute: AttributeLike): boolean;
 /**
- * The type a filter on this attribute actually compares against. Identity for
- * every ordinary attribute; for a rollup it unfolds the aggregation:
- * `earliest`/`latest` compare dates, `original` compares the target attribute's
- * own type, and every other function (count/sum/avg/min/max/…) compares numbers.
+ * A todo as clients read it: a target is exposed by its phase, which the
+ * progress surfaces read, and by its object when it names one, which picks the
+ * builder the cursor follows (R17).
+ */
+export interface AgentTodoPlanViewItem extends Omit<AITodoItem, "target"> {
+  target?: {
+    phase: AITodoPhase;
+    objectName?: string;
+  };
+}
+/**
+ * Persisted bounds on a todo, beside the type they constrain.
  *
- * This is the single place that knowledge lives: operator resolution and value
- * canonicalization both read it, so a rollup can never be offered numeric
- * operators while its value is canonicalized as something else.
+ * Both sides of the wire enforce them: the runtime zod schema when it writes,
+ * and the React projection parser when it reads an untrusted payload back.
+ * React cannot import the runtime, which is why these numbers used to be
+ * copied there under a "keep aligned with the canonical persisted schema"
+ * comment — a synchronisation the compiler could not check.
  */
-export declare function resolveEffectiveFilterType(attribute: AttributeLike): AttributeType;
-export declare const DOCUMENT_KINDS: readonly ["file", "folder"];
-export type DocumentKind = (typeof DOCUMENT_KINDS)[number];
-export declare const documentSchema: z$2.ZodObject<{
-  id: z$2.ZodString;
-  tenantId: z$2.ZodString;
-  title: z$2.ZodString;
-  kind: z$2.ZodEnum<{
-    file: "file";
-    folder: "folder";
-  }>;
-  parentId: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
-  description: z$2.ZodOptional<z$2.ZodString>;
-  contentHash: z$2.ZodOptional<z$2.ZodString>;
-  createdBy: z$2.ZodOptional<z$2.ZodString>;
-  updatedBy: z$2.ZodOptional<z$2.ZodString>;
-  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-  position: z$2.ZodNumber;
-  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-}, z$2.core.$strip>;
-export type Document = z$2.output<typeof documentSchema>;
-export declare const documentWithSubCountSchema: z$2.ZodObject<{
-  id: z$2.ZodString;
-  tenantId: z$2.ZodString;
-  title: z$2.ZodString;
-  kind: z$2.ZodEnum<{
-    file: "file";
-    folder: "folder";
-  }>;
-  parentId: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
-  description: z$2.ZodOptional<z$2.ZodString>;
-  contentHash: z$2.ZodOptional<z$2.ZodString>;
-  createdBy: z$2.ZodOptional<z$2.ZodString>;
-  updatedBy: z$2.ZodOptional<z$2.ZodString>;
-  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-  position: z$2.ZodNumber;
-  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-  subCount: z$2.ZodNullable<z$2.ZodNumber>;
-}, z$2.core.$strip>;
-export type DocumentWithSubCount = z$2.output<typeof documentWithSubCountSchema>;
+export declare const MAX_TODOS = 50;
+export declare const MAX_TODO_ID_CHARS = 80;
+export declare const MAX_TODO_DESCRIPTION_CHARS = 500;
 /**
- * One hit of a drive-wide name search: a folder or a file of the record's
- * drive whose title contains the query, with the path that places it. The
- * walk is the agent tool's (`listRecordDrive` in query mode); this is what
- * the open-drive loupe reads (#3217).
+ * Todo list managed by the agent
  */
-export declare const recordDriveSearchHitSchema: z$2.ZodObject<{
-  id: z$2.ZodString;
-  kind: z$2.ZodEnum<{
-    file: "file";
-    folder: "folder";
-  }>;
-  title: z$2.ZodString;
-  path: z$2.ZodString;
-  parentId: z$2.ZodNullable<z$2.ZodString>;
-  depth: z$2.ZodNumber;
-}, z$2.core.$strip>;
-export type RecordDriveSearchHit = z$2.output<typeof recordDriveSearchHitSchema>;
-export declare const recordDriveSearchResultSchema: z$2.ZodObject<{
-  recordId: z$2.ZodString;
-  hits: z$2.ZodArray<z$2.ZodObject<{
-    id: z$2.ZodString;
-    kind: z$2.ZodEnum<{
-      file: "file";
-      folder: "folder";
-    }>;
-    title: z$2.ZodString;
-    path: z$2.ZodString;
-    parentId: z$2.ZodNullable<z$2.ZodString>;
-    depth: z$2.ZodNumber;
-  }, z$2.core.$strip>>;
-  truncated: z$2.ZodOptional<z$2.ZodObject<{
-    maxEntries: z$2.ZodNumber;
-    returnedEntries: z$2.ZodNumber;
-  }, z$2.core.$strip>>;
-}, z$2.core.$strip>;
-export type RecordDriveSearchResult = z$2.output<typeof recordDriveSearchResultSchema>;
+export interface AITodoList {
+  items: AITodoItem[];
+  progress: number;
+  isComplete: boolean;
+}
 /**
- * Text-extraction lifecycle for a single file within a document pack.
- * `unsupported` is terminal and is not a failure: the file's type has no text
- * to extract (an Outlook `.msg`, a `.docx`, a `.zip`), so nothing is queued.
+ * Compaction summary for conversation history compression
  */
-export declare const FILE_OCR_STATUSES: readonly ["pending", "processing", "completed", "failed", "unsupported"];
-export type FileOcrStatus = (typeof FILE_OCR_STATUSES)[number];
+export interface AICompactionSummary {
+  id: string;
+  tenantId: string;
+  userId: string;
+  conversationId: string;
+  summary: string;
+  originalMessageCount: number;
+  tokenCountBefore: number;
+  tokenCountAfter: number;
+  compactedAt: Date;
+}
+/** Create-response metadata; these grants were added by this transaction, not prior grants. */
+export type CreateAgentTriggerResult = z$1.output<typeof createAgentTriggerResultSchema>;
 /**
- * A single anonymous file belonging to a document pack.
- * Unlike the slot-based model, files carry no slot name — order within the
- * pack is `position` only, and `name` is provenance (originalName), never a
- * label rendered in the UI.
+ * The device channel wire protocol, shared by the API server and the CLI
+ * shell worker. The server only ever emits `capability: "shell"` and
+ * `kind: "shell"`; the enums keep `"browser"` for one more release because
+ * every installed CLI parses these frames strictly against that enum.
  */
-export declare const documentFileSchema: z$2.ZodObject<{
-  id: z$2.ZodString;
-  documentId: z$2.ZodString;
-  position: z$2.ZodNumber;
-  name: z$2.ZodString;
-  mimeType: z$2.ZodString;
-  size: z$2.ZodNumber;
-  ocrStatus: z$2.ZodNullable<z$2.ZodEnum<{
-    completed: "completed";
-    failed: "failed";
-    pending: "pending";
-    processing: "processing";
-    unsupported: "unsupported";
-  }>>;
-  ocrText: z$2.ZodNullable<z$2.ZodString>;
-  ocrConfidence: z$2.ZodNullable<z$2.ZodNumber>;
-  processedAt: z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>;
-}, z$2.core.$strip>;
-export type DocumentFile = z$2.output<typeof documentFileSchema>;
-/** What an attach did: a new pack, a file appended to a named pack, or the pack already holding the file linked. */
-export declare const ATTACH_FILE_ACTIONS: readonly ["created", "appended", "linked-existing"];
-export type AttachFileAction = (typeof ATTACH_FILE_ACTIONS)[number];
-/** What attaching a file to a record's document attribute answers: the pack, the file in it, and what happened. */
-export declare const attachedRecordDocumentSchema: z$2.ZodObject<{
-  document: z$2.ZodObject<{
-    id: z$2.ZodString;
-    tenantId: z$2.ZodString;
-    title: z$2.ZodString;
-    kind: z$2.ZodEnum<{
-      file: "file";
-      folder: "folder";
+/** Absolute path of the channel on the API origin (the `/v1` prefix included). */
+export declare const DEVICE_CHANNEL_PATH = "/v1/device-worker/channel";
+export declare const DEVICE_CHANNEL_MAX_FRAME_BYTES = 262144;
+/** A socket that has not sent `authenticate` within this budget is closed 1008. */
+export declare const DEVICE_CHANNEL_AUTHENTICATE_TIMEOUT_MS = 10000;
+/** The server leases the next queued command from the store on this cadence while idle. */
+export declare const DEVICE_CHANNEL_IDLE_POLL_MS = 2000;
+/** The server re-validates the credential and refreshes presence on this cadence. */
+export declare const DEVICE_CHANNEL_PRESENCE_MS = 2000;
+/**
+ * The server sends `{ type: "ping" }` plus a control ping on this cadence; a
+ * socket that has not answered the control ping by the next tick is dropped.
+ */
+export declare const DEVICE_CHANNEL_KEEPALIVE_MS = 20000;
+/**
+ * The code a worker closes with when a frame breaks the protocol. A browser
+ * `WebSocket` only accepts 1000 and 3000-4999, so the private-use mirror of
+ * 1008 is the one code every worker can actually send.
+ */
+export declare const DEVICE_CHANNEL_WORKER_CLOSE_PROTOCOL_VIOLATION = 4008;
+/** Where an exponential backoff starts, and where it stops doubling. */
+export interface RetryBounds {
+  initialMs: number;
+  maxMs: number;
+}
+/**
+ * Where the channel is: the path is absolute on the API origin, so a profile's
+ * `apiUrl` keeps only its host and the scheme swaps to the socket one. Written
+ * as an explicit map rather than a rewrite of the origin string, because a
+ * two-letter scheme literal reads to the SDK's egress scan as the `ws` package.
+ */
+export declare function deviceChannelUrl(apiUrl: string): string;
+/** Exponential backoff within the given bounds, plus the shared jitter window. */
+export declare function computeRetryDelay(attempt: number, random: () => number, bounds: RetryBounds): number;
+/** When to reconnect to the channel: 1 s doubling up to 30 s, plus jitter. */
+export declare function computeReconnectDelay(attempt: number, random?: () => number): number;
+export declare const DEVICE_COMMAND_ERROR_CODES: readonly ["worker_disconnected", "cancelled", "timed_out", "execution_failed"];
+export type DeviceCommandErrorCode = (typeof DEVICE_COMMAND_ERROR_CODES)[number];
+export declare class DeviceChannelProtocolError extends SchemaError {
+  readonly _tag = "DeviceChannelProtocolError";
+  constructor(message: string);
+}
+/** The shells a worker can open a session in; announced at `authenticate`. */
+export declare const DEVICE_SHELLS: readonly ["zsh", "bash", "sh", "fish", "pwsh", "powershell"];
+export type DeviceShell = (typeof DEVICE_SHELLS)[number];
+/** Whether the machine can drive its desktop through `agent-desktop`. */
+export declare const DEVICE_DESKTOP_STATES: readonly ["ready", "permission_missing", "no_session", "unavailable"];
+export type DeviceDesktopState = (typeof DEVICE_DESKTOP_STATES)[number];
+export declare const DeviceDesktopStatusSchema: z$2.ZodObject<{
+  state: z$2.ZodEnum<{
+    no_session: "no_session";
+    permission_missing: "permission_missing";
+    ready: "ready";
+    unavailable: "unavailable";
+  }>;
+  version: z$2.ZodString;
+}, z$2.core.$strict>;
+export type DeviceDesktopStatus = z$2.infer<typeof DeviceDesktopStatusSchema>;
+export declare const DeviceChannelWorkerFrameSchema: z$2.ZodDiscriminatedUnion<[z$2.ZodObject<{
+  type: z$2.ZodLiteral<"authenticate">;
+  credential: z$2.ZodString;
+  protocol: z$2.ZodOptional<z$2.ZodNumber>;
+  desktop: z$2.ZodOptional<z$2.ZodObject<{
+    state: z$2.ZodEnum<{
+      no_session: "no_session";
+      permission_missing: "permission_missing";
+      ready: "ready";
+      unavailable: "unavailable";
     }>;
-    parentId: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
-    description: z$2.ZodOptional<z$2.ZodString>;
-    contentHash: z$2.ZodOptional<z$2.ZodString>;
-    createdBy: z$2.ZodOptional<z$2.ZodString>;
-    updatedBy: z$2.ZodOptional<z$2.ZodString>;
-    deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-    position: z$2.ZodNumber;
-    createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-    updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-  }, z$2.core.$strip>;
-  file: z$2.ZodObject<{
+    version: z$2.ZodString;
+  }, z$2.core.$strict>>;
+  shell: z$2.ZodOptional<z$2.ZodEnum<{
+    bash: "bash";
+    fish: "fish";
+    powershell: "powershell";
+    pwsh: "pwsh";
+    sh: "sh";
+    zsh: "zsh";
+  }>>;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  id: z$2.ZodUUID;
+  leaseToken: z$2.ZodString;
+  type: z$2.ZodLiteral<"running">;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  id: z$2.ZodUUID;
+  leaseToken: z$2.ZodString;
+  type: z$2.ZodLiteral<"heartbeat">;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  id: z$2.ZodUUID;
+  leaseToken: z$2.ZodString;
+  type: z$2.ZodLiteral<"output">;
+  stdout: z$2.ZodOptional<z$2.ZodString>;
+  stderr: z$2.ZodOptional<z$2.ZodString>;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  id: z$2.ZodUUID;
+  leaseToken: z$2.ZodString;
+  type: z$2.ZodLiteral<"complete">;
+  result: z$2.ZodObject<{
+    stdout: z$2.ZodOptional<z$2.ZodString>;
+    stderr: z$2.ZodOptional<z$2.ZodString>;
+    exitCode: z$2.ZodNumber;
+    success: z$2.ZodBoolean;
+    errorCode: z$2.ZodOptional<z$2.ZodEnum<{
+      cancelled: "cancelled";
+      execution_failed: "execution_failed";
+      timed_out: "timed_out";
+      worker_disconnected: "worker_disconnected";
+    }>>;
+  }, z$2.core.$strict>;
+  background: z$2.ZodOptional<z$2.ZodObject<{
+    pid: z$2.ZodNumber;
+    logPath: z$2.ZodString;
+  }, z$2.core.$strict>>;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  type: z$2.ZodLiteral<"pong">;
+}, z$2.core.$strict>], "type">;
+export declare const DeviceChannelServerFrameSchema: z$2.ZodDiscriminatedUnion<[z$2.ZodObject<{
+  type: z$2.ZodLiteral<"ready">;
+  device: z$2.ZodObject<{
     id: z$2.ZodString;
-    documentId: z$2.ZodString;
-    position: z$2.ZodNumber;
     name: z$2.ZodString;
-    mimeType: z$2.ZodString;
-    size: z$2.ZodNumber;
-    ocrStatus: z$2.ZodNullable<z$2.ZodEnum<{
-      completed: "completed";
-      failed: "failed";
-      pending: "pending";
-      processing: "processing";
-      unsupported: "unsupported";
-    }>>;
-    ocrText: z$2.ZodNullable<z$2.ZodString>;
-    ocrConfidence: z$2.ZodNullable<z$2.ZodNumber>;
-    processedAt: z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>;
-  }, z$2.core.$strip>;
-  action: z$2.ZodEnum<{
-    appended: "appended";
-    created: "created";
-    "linked-existing": "linked-existing";
+    capability: z$2.ZodEnum<{
+      browser: "browser";
+      shell: "shell";
+    }>;
+  }, z$2.core.$strict>;
+  protocol: z$2.ZodOptional<z$2.ZodNumber>;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  id: z$2.ZodUUID;
+  leaseToken: z$2.ZodString;
+  type: z$2.ZodLiteral<"command">;
+  kind: z$2.ZodEnum<{
+    browser: "browser";
+    shell: "shell";
   }>;
-}, z$2.core.$strip>;
-/** A pack file as a drive row lists it: everything but its OCR text, which only reads need. */
-export declare const driveFileSchema: z$2.ZodObject<{
-  id: z$2.ZodString;
-  documentId: z$2.ZodString;
-  position: z$2.ZodNumber;
-  name: z$2.ZodString;
-  mimeType: z$2.ZodString;
-  size: z$2.ZodNumber;
-  ocrStatus: z$2.ZodNullable<z$2.ZodEnum<{
-    completed: "completed";
-    failed: "failed";
-    pending: "pending";
-    processing: "processing";
-    unsupported: "unsupported";
-  }>>;
-  ocrConfidence: z$2.ZodNullable<z$2.ZodNumber>;
-  processedAt: z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>;
-}, z$2.core.$strip>;
-export type DriveFile = z$2.output<typeof driveFileSchema>;
-export type DocumentWithFiles = Document & {
-  files: DocumentFile[];
-};
+  intent: z$2.ZodString;
+  timeoutMs: z$2.ZodNumber;
+  command: z$2.ZodOptional<z$2.ZodString>;
+  cwd: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
+  rootSessionId: z$2.ZodOptional<z$2.ZodString>;
+  background: z$2.ZodOptional<z$2.ZodBoolean>;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  type: z$2.ZodLiteral<"release_session">;
+  rootSessionId: z$2.ZodString;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  type: z$2.ZodLiteral<"cancel">;
+  id: z$2.ZodUUID;
+  reason: z$2.ZodEnum<{
+    cancelled: "cancelled";
+    revoked: "revoked";
+    timed_out: "timed_out";
+  }>;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  type: z$2.ZodLiteral<"reauthenticate">;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  type: z$2.ZodLiteral<"revoked">;
+}, z$2.core.$strict>, z$2.ZodObject<{
+  type: z$2.ZodLiteral<"ping">;
+}, z$2.core.$strict>], "type">;
+export type DeviceChannelWorkerFrame = z$2.infer<typeof DeviceChannelWorkerFrameSchema>;
+export type DeviceChannelServerFrame = z$2.infer<typeof DeviceChannelServerFrameSchema>;
+/** Parses one text frame; a non-JSON or off-protocol frame is a `DeviceChannelProtocolError`. */
+export declare function parseDeviceChannelFrame<T>(schema: z$2.ZodType<T>, raw: string): T;
+export declare function parseWorkerFrame(raw: string): DeviceChannelWorkerFrame;
+export declare function parseServerFrame(raw: string): DeviceChannelServerFrame;
 /**
- * One row of a record's drive at a given level: the document with its sub
- * count and its pack files (#4332). A drive-only attachment, one that exists
- * only as a reference edge and is named nowhere in `record.values`, has no
- * other source for its files, and without them its row menu cannot offer
- * Download. A folder has no pack: its `files` is always `[]`.
- *
- * A root-level child also names where it sits on the record: the document
- * attribute whose edge holds it (`attachments` for a plain drive item) and
- * that edge's qualified properties. A nested child has no edge of its own and
- * carries neither.
+ * The minimum every capability predicate in this file reads: the type, plus
+ * whatever else of a full `Attribute` the caller happens to hold. Exported so
+ * callers that only have a partial attribute — a plan's proposed attribute, a
+ * schema snapshot row — can ask the same questions as callers holding the real
+ * thing, instead of restating the rules.
  */
-export declare const recordDriveChildSchema: z$2.ZodObject<{
-  id: z$2.ZodString;
-  tenantId: z$2.ZodString;
-  title: z$2.ZodString;
-  kind: z$2.ZodEnum<{
-    file: "file";
-    folder: "folder";
-  }>;
-  parentId: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
-  description: z$2.ZodOptional<z$2.ZodString>;
-  contentHash: z$2.ZodOptional<z$2.ZodString>;
-  createdBy: z$2.ZodOptional<z$2.ZodString>;
-  updatedBy: z$2.ZodOptional<z$2.ZodString>;
-  deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-  position: z$2.ZodNumber;
-  createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-  updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-  subCount: z$2.ZodNullable<z$2.ZodNumber>;
-  files: z$2.ZodArray<z$2.ZodObject<{
-    id: z$2.ZodString;
-    documentId: z$2.ZodString;
-    position: z$2.ZodNumber;
-    name: z$2.ZodString;
-    mimeType: z$2.ZodString;
-    size: z$2.ZodNumber;
-    ocrStatus: z$2.ZodNullable<z$2.ZodEnum<{
-      completed: "completed";
-      failed: "failed";
-      pending: "pending";
-      processing: "processing";
-      unsupported: "unsupported";
-    }>>;
-    ocrConfidence: z$2.ZodNullable<z$2.ZodNumber>;
-    processedAt: z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>;
-  }, z$2.core.$strip>>;
-  attributeName: z$2.ZodOptional<z$2.ZodString>;
-  properties: z$2.ZodOptional<z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>>;
-}, z$2.core.$strip>;
-export type RecordDriveChild = z$2.output<typeof recordDriveChildSchema>;
+export type AttributeLike = Pick<Attribute, "type"> & Partial<Attribute>;
+export type AttributeLifecycleCapabilities = {
+  active: boolean;
+  deprecated: boolean;
+  visibleInArchitect: boolean;
+  visibleInRuntime: boolean;
+  warningWhenDeprecated: boolean;
+};
+export type AttributeStorageMode = "value" | "edge" | "computed";
+export type AttributeCardinality = "one" | "many";
+export type AttributePolymorphicCapability = "none" | "code-only" | "internal";
+export type AttributeStorageCapabilities = {
+  mode: AttributeStorageMode;
+  cardinality: AttributeCardinality;
+  edgeBacked: boolean;
+  preservesExistingValues: boolean;
+  qualifiedProperties: boolean;
+  polymorphic: AttributePolymorphicCapability;
+  maxItems: boolean;
+};
+export type AttributeRequiredCapability = "allowed" | "forbidden";
+export type AttributeDefaultValueCapability = "static" | "automatic" | "forbidden";
+export type AttributeAuthoringCapabilities = {
+  editable: boolean;
+  readOnly: boolean;
+  directEdit: boolean;
+  required: AttributeRequiredCapability;
+  defaultValue: AttributeDefaultValueCapability;
+  placeholder: boolean;
+  maxItems: boolean;
+};
+export type AttributePresentationCapabilities = {
+  formField: boolean;
+  tableCell: boolean;
+  defaultColumn: boolean;
+  compactDisplay: boolean;
+  popoverEditor: boolean;
+  placeholder: boolean;
+  warningWhenDeprecated: boolean;
+};
+export type AttributeQueryCapabilities = {
+  filterable: boolean;
+  searchable: boolean;
+  sortable: boolean;
+  groupable: boolean;
+  kanbanGroupable: boolean;
+  operators: readonly FilterOperator[];
+};
+export type AttributeAgentCapabilities = {
+  readable: boolean;
+  writable: boolean;
+  compactReadable: boolean;
+  contentReadable: boolean;
+  requiresDedicatedTool: boolean;
+};
+export type AttributeExchangeCapabilities = {
+  importable: boolean;
+  exportable: boolean;
+  schemaExportable: boolean;
+  metadataExportable: boolean;
+};
+export type AttributeCapabilities = {
+  lifecycle: AttributeLifecycleCapabilities;
+  storage: AttributeStorageCapabilities;
+  authoring: AttributeAuthoringCapabilities;
+  presentation: AttributePresentationCapabilities;
+  query: AttributeQueryCapabilities;
+  agent: AttributeAgentCapabilities;
+  exchange: AttributeExchangeCapabilities;
+};
 /**
- * The orders a drive level is listed in. Every mode puts folders before
- * files, then sorts on its key, then on `id`:
- * - `manual`: `position` (the drag order);
- * - `name-asc` / `name-desc`: the title, numeric and case- and
- *   accent-insensitive ("File 2" before "file 10", "Éa" equal to "ea");
- * - `date-desc` / `date-asc`: `updatedAt ?? createdAt` to the millisecond,
- *   a row with neither last in both directions.
- * The `id` tiebreak is ascending in every mode.
+ * The parts of a location a filter may address (#3118). A location is a
+ * JSONB object with no operators of its own; a rule names one of these parts
+ * through `property` and compares it as text — `country` holds the ISO3 code.
  */
-export declare const DOCUMENT_SORT_MODES: readonly ["manual", "name-asc", "name-desc", "date-desc", "date-asc"];
-export type DocumentSortMode = (typeof DOCUMENT_SORT_MODES)[number];
-/** Rows in a page of a drive level when the caller names no `limit`. */
-export declare const RECORD_DRIVE_PAGE_DEFAULT_LIMIT = 100;
-/** The most rows one page of a drive level holds; a larger `limit` is clamped. */
-export declare const RECORD_DRIVE_PAGE_MAX_LIMIT = 500;
+export declare const LOCATION_FILTER_PROPERTIES: readonly ["city", "postalCode", "country"];
+export type LocationFilterProperty = (typeof LOCATION_FILTER_PROPERTIES)[number];
+export declare function isLocationFilterProperty(name: string): name is LocationFilterProperty;
+export declare const ATTRIBUTE_FILTER_OPERATORS: Readonly<Record<Exclude<AttributeType, "rollup">, readonly FilterOperator[]>>;
 /**
- * The longest drive page cursor read back. An issued cursor carries one title
- * (at most 255 characters) plus a few short fields; anything longer is crafted.
+ * What an attribute type's value is — the per-type fact most rules branch on:
+ * - `plain`: typed in by hand (text, number, date, phone, currency, location)
+ * - `boolean`: a checkbox, always true or false, never empty
+ * - `options`: a code (or codes) from the attribute's own `options`
+ * - `reference`: ids of users, records or files, stored as edges
+ * - `computed`: derived from other values (formula, rollup), never written
  */
-export declare const RECORD_DRIVE_CURSOR_MAX_LENGTH = 2048;
+export type AttributeValueKind = "plain" | "boolean" | "options" | "reference" | "computed";
 /**
- * One page of a record's drive level (#4985), in its sort mode's order.
- * `nextCursor` resumes strictly after the page's last row, and is `null` on
- * the last page. A cursor is opaque and only valid for the mode that issued it.
+ * - `placeholder`: the editor shows a configurable placeholder
+ * - `searchable` / `sortable` / `groupable`: the query surfaces it offers
+ * - `content`: a body read whole (rich text, files), not a table cell
+ * - `qualified`: its edges may carry qualified properties
  */
-export declare const recordDriveChildrenPageSchema: z$2.ZodObject<{
-  items: z$2.ZodArray<z$2.ZodObject<{
-    id: z$2.ZodString;
-    tenantId: z$2.ZodString;
-    title: z$2.ZodString;
-    kind: z$2.ZodEnum<{
-      file: "file";
-      folder: "folder";
-    }>;
-    parentId: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodString>>;
-    description: z$2.ZodOptional<z$2.ZodString>;
-    contentHash: z$2.ZodOptional<z$2.ZodString>;
-    createdBy: z$2.ZodOptional<z$2.ZodString>;
-    updatedBy: z$2.ZodOptional<z$2.ZodString>;
-    deletedAt: z$2.ZodOptional<z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>>;
-    position: z$2.ZodNumber;
-    createdAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-    updatedAt: z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>;
-    subCount: z$2.ZodNullable<z$2.ZodNumber>;
-    files: z$2.ZodArray<z$2.ZodObject<{
-      id: z$2.ZodString;
-      documentId: z$2.ZodString;
-      position: z$2.ZodNumber;
-      name: z$2.ZodString;
-      mimeType: z$2.ZodString;
-      size: z$2.ZodNumber;
-      ocrStatus: z$2.ZodNullable<z$2.ZodEnum<{
-        completed: "completed";
-        failed: "failed";
-        pending: "pending";
-        processing: "processing";
-        unsupported: "unsupported";
-      }>>;
-      ocrConfidence: z$2.ZodNullable<z$2.ZodNumber>;
-      processedAt: z$2.ZodNullable<z$2.ZodCodec<z$2.ZodISODateTime, z$2.ZodDate>>;
-    }, z$2.core.$strip>>;
-    attributeName: z$2.ZodOptional<z$2.ZodString>;
-    properties: z$2.ZodOptional<z$2.ZodRecord<z$2.ZodString, z$2.ZodUnknown>>;
-  }, z$2.core.$strip>>;
-  nextCursor: z$2.ZodNullable<z$2.ZodString>;
-}, z$2.core.$strip>;
-export type RecordDriveChildrenPage = z$2.output<typeof recordDriveChildrenPageSchema>;
-export interface CreateDocument {
-  title: string;
-  kind?: DocumentKind;
-  parentId?: Uuid | null;
-  description?: string;
-  position?: number;
+export type AttributeTypeTrait = "placeholder" | "searchable" | "sortable" | "groupable" | "content" | "qualified";
+export interface AttributeTypeDescriptor {
+  readonly value: AttributeValueKind;
+  readonly traits: readonly AttributeTypeTrait[];
 }
 /**
- * Reference to a record attribute that should atomically attach a freshly
- * created Document. Passed alongside `CreateDocument` to make creation
- * link-aware end-to-end (client → REST → service → repo).
- *
- * The server requires this — orphan Documents are not creatable through the
- * REST API.
+ * The one per-type registry: a new attribute type cannot be added without
+ * deciding each of these. Rich text is searched as plain words (the search
+ * adapter strips its markdown).
  */
-export interface CreateDocumentLink {
-  objectName: string;
-  sourceRecordId: string;
-  attributeName: string;
-}
-export interface UpdateDocument {
-  title?: string;
-  parentId?: Uuid | null;
-  position?: number;
-}
-export interface DocumentListOptions {
-  limit?: number;
-  offset?: number;
-}
-export interface RecordDocuments {
-  /** Documents grouped by attribute name (includes system 'attachments' attribute) */
-  byAttribute: Record<string, DocumentWithFiles[]>;
-}
+export declare const ATTRIBUTE_TYPE_DESCRIPTORS: {
+  readonly text: {
+    readonly value: "plain";
+    readonly traits: readonly ["placeholder", "searchable", "sortable"];
+  };
+  readonly richtext: {
+    readonly value: "plain";
+    readonly traits: readonly ["searchable", "content"];
+  };
+  readonly number: {
+    readonly value: "plain";
+    readonly traits: readonly ["placeholder", "sortable"];
+  };
+  readonly checkbox: {
+    readonly value: "boolean";
+    readonly traits: readonly ["sortable"];
+  };
+  readonly date: {
+    readonly value: "plain";
+    readonly traits: readonly ["placeholder", "sortable"];
+  };
+  readonly phone: {
+    readonly value: "plain";
+    readonly traits: readonly ["placeholder", "searchable", "sortable"];
+  };
+  readonly currency: {
+    readonly value: "plain";
+    readonly traits: readonly ["placeholder", "sortable", "groupable"];
+  };
+  readonly status: {
+    readonly value: "options";
+    readonly traits: readonly ["searchable", "sortable", "groupable"];
+  };
+  readonly location: {
+    readonly value: "plain";
+    readonly traits: readonly [];
+  };
+  readonly select: {
+    readonly value: "options";
+    readonly traits: readonly ["placeholder", "searchable", "sortable"];
+  };
+  readonly multiselect: {
+    readonly value: "options";
+    readonly traits: readonly ["placeholder", "searchable"];
+  };
+  readonly user: {
+    readonly value: "reference";
+    readonly traits: readonly [];
+  };
+  readonly relation: {
+    readonly value: "reference";
+    readonly traits: readonly ["qualified"];
+  };
+  readonly formula: {
+    readonly value: "computed";
+    readonly traits: readonly [];
+  };
+  readonly rollup: {
+    readonly value: "computed";
+    readonly traits: readonly [];
+  };
+  readonly document: {
+    readonly value: "reference";
+    readonly traits: readonly ["content", "qualified"];
+  };
+};
+/** The attribute types whose value is of `kind`, as a literal union. */
+export type AttributeTypeOfKind<K extends AttributeValueKind> = { [T in AttributeType]: (typeof ATTRIBUTE_TYPE_DESCRIPTORS)[T]["value"] extends K ? T : never; }[AttributeType];
+/** Whether `type`'s value is of `kind` (`"computed"`: formula and rollup). */
+export declare function isValueKindType<K extends AttributeValueKind>(type: string, kind: K): type is AttributeTypeOfKind<K>;
+/** Whether `attribute`'s value is of `kind`, narrowing it to the matching attribute types. */
+export declare function hasValueKind<A extends {
+  type: string;
+}, K extends AttributeValueKind>(attribute: A, kind: K): attribute is A & {
+  type: AttributeTypeOfKind<K>;
+};
+/** Whether `type` carries `trait`. */
+export declare function hasTypeTrait(type: string, trait: AttributeTypeTrait): boolean;
+export declare function getAttributeCapabilities(attribute: AttributeLike): AttributeCapabilities;
+export declare function getAttributeFilterOperators(attribute: AttributeLike): readonly FilterOperator[];
+export declare function isAttributeFilterable(attribute: AttributeLike): boolean;
+export declare function isAttributeSearchable(attribute: AttributeLike): boolean;
+export declare function isAttributeGroupable(attribute: AttributeLike): boolean;
+export declare function isAttributeKanbanGroupable(attribute: AttributeLike): boolean;
 /**
- * One record that holds documents, with how much sits at its drive root and
- * when it last moved. The wire shape of `GET /documents/record-owners`.
+ * The type a filter on this attribute actually compares against. Identity for
+ * every ordinary attribute; for a rollup it unfolds the aggregation:
+ * `earliest`/`latest` compare dates, `original` compares the target attribute's
+ * own type, and every other function (count/sum/avg/min/max/…) compares numbers.
+ *
+ * This is the single place that knowledge lives: operator resolution and value
+ * canonicalization both read it, so a rollup can never be offered numeric
+ * operators while its value is canonicalized as something else.
  */
-export declare const documentRecordOwnerSchema: z$2.ZodObject<{
-  recordId: z$2.ZodString;
-  objectName: z$2.ZodString;
-  label: z$2.ZodString;
-  itemCount: z$2.ZodNumber;
-  fileCount: z$2.ZodNumber;
-  lastActivityAt: z$2.ZodString;
-}, z$2.core.$strip>;
-export type DocumentRecordOwner = z$2.output<typeof documentRecordOwnerSchema>;
-/** One page of {@link DocumentRecordOwner}s; `nextOffset: null` is the last page. */
-export declare const documentRecordOwnerPageSchema: z$2.ZodObject<{
-  data: z$2.ZodArray<z$2.ZodObject<{
-    recordId: z$2.ZodString;
-    objectName: z$2.ZodString;
-    label: z$2.ZodString;
-    itemCount: z$2.ZodNumber;
-    fileCount: z$2.ZodNumber;
-    lastActivityAt: z$2.ZodString;
-  }, z$2.core.$strip>>;
-  nextOffset: z$2.ZodNullable<z$2.ZodNumber>;
-}, z$2.core.$strip>;
-export type DocumentRecordOwnerPage = z$2.output<typeof documentRecordOwnerPageSchema>;
+export declare function resolveEffectiveFilterType(attribute: AttributeLike): AttributeType;
 export declare const FORM_FORBIDDEN_ATTRIBUTE_TYPES: readonly ["relation", "multiRelation", "formula", "rollup", "document", "richtext", "user"];
 export interface FormSlotFieldRef {
   type: "slot";
@@ -11929,6 +11947,8 @@ export interface DBObject extends Timestamps {
   documentLayout?: DocumentLayout;
   /** Records of this object may have a parent record of the same object. Stored in `metadata`. */
   hierarchical?: boolean;
+  /** The order its records' drives rest in until a person chooses one. Stored in `metadata`. */
+  defaultDriveSort?: DocumentSortMode;
 }
 /**
  * Data for creating a new object.
@@ -11948,6 +11968,7 @@ export interface CreateDBObject {
   metadata?: Record<string, unknown>;
   documentLayout?: DocumentLayout;
   hierarchical?: boolean;
+  defaultDriveSort?: DocumentSortMode;
 }
 export interface UpdateDBObject {
   label?: string;
@@ -11963,6 +11984,7 @@ export interface UpdateDBObject {
   metadata?: Record<string, unknown>;
   documentLayout?: DocumentLayout;
   hierarchical?: boolean;
+  defaultDriveSort?: DocumentSortMode;
 }
 /**
  * Data for upserting an object.
@@ -13213,6 +13235,10 @@ export declare const ASK_QUESTIONS_MAX_BATCH = 4;
 export declare const ASK_QUESTIONS_ANSWER_MAX_LENGTH = 2000;
 /** Most values one multi-select answer may carry: its options plus one "Other". */
 export declare const ASK_QUESTIONS_ANSWER_MAX_VALUES = 50;
+/** Most files a person may add to one answer: as many as one chat message carries. */
+export declare const ASK_QUESTIONS_MAX_ADDED_FILES = 10;
+/** A file a person added to an answer: a stored file or a document, by ref. */
+export declare const ASK_QUESTIONS_FILE_REF: RegExp;
 /**
  * One answer of an `ask_questions` result, written on the call by the server
  * (#5229). Each carries the option's value AND its label, so the model reads
@@ -13256,6 +13282,7 @@ export declare const askQuestionsOutputSchema: z$2.ZodObject<{
     id: z$2.ZodString;
     name: z$2.ZodString;
   }, z$2.core.$strip>>;
+  addedFiles: z$2.ZodOptional<z$2.ZodArray<z$2.ZodString>>;
 }, z$2.core.$strip>;
 export type AskQuestionsAnswer = z$2.infer<typeof askQuestionsAnswerSchema>;
 export type AskQuestionsResult = z$2.infer<typeof askQuestionsOutputSchema>;
@@ -20991,6 +21018,12 @@ export type MailboxAccount = z$2.output<typeof mailboxAccountSchema>;
 /** How the mailbox lists mail: one row per conversation, or one row per message. */
 export declare const MAILBOX_LIST_MODES: readonly ["threads", "messages"];
 export type MailboxListMode = (typeof MAILBOX_LIST_MODES)[number];
+/**
+ * Where an opened mail reads, as Gmail offers: in a `panel` beside the list,
+ * or `fullscreen` in the list's place, walked with the arrow keys.
+ */
+export declare const MAILBOX_READER_LAYOUTS: readonly ["panel", "fullscreen"];
+export type MailboxReaderLayout = (typeof MAILBOX_READER_LAYOUTS)[number];
 /** Narrows a wire or form value to a list mode without a cast at the call site. */
 export declare function isMailboxListMode(value: unknown): value is MailboxListMode;
 export declare const mailboxCursorSchema: z$2.ZodObject<{
@@ -25378,7 +25411,7 @@ export declare const CORE_PREFERENCES: readonly [PreferenceDeclaration<"workPost
     model: string;
   } | undefined;
   routing?: "auto" | undefined;
-}>, PreferenceDeclaration<"conversationSurface", "fullscreen" | "panel">, PreferenceDeclaration<"mailboxListMode", "messages" | "threads">, PreferenceDeclaration<"home", string | null>, PreferenceDeclaration<"memory.learnFromEmail", boolean>, PreferenceDeclaration<"memory.shareWithTeam", boolean>, PreferenceDeclaration<"onboarding.completed", boolean>, PreferenceDeclaration<"decisions.seenAt", string | null>, PreferenceDeclaration<"decisions.delivery", DecisionDelivery>];
+}>, PreferenceDeclaration<"conversationSurface", "fullscreen" | "panel">, PreferenceDeclaration<"mailboxListMode", "messages" | "threads">, PreferenceDeclaration<"mailboxReaderLayout", "fullscreen" | "panel">, PreferenceDeclaration<"home", string | null>, PreferenceDeclaration<"memory.learnFromEmail", boolean>, PreferenceDeclaration<"memory.shareWithTeam", boolean>, PreferenceDeclaration<"onboarding.completed", boolean>, PreferenceDeclaration<"decisions.seenAt", string | null>, PreferenceDeclaration<"decisions.delivery", DecisionDelivery>];
 export type CorePreference = (typeof CORE_PREFERENCES)[number];
 export type PreferenceKey = CorePreference["key"];
 export type PreferenceValue<Key extends PreferenceKey> = Extract<CorePreference, {
@@ -28611,6 +28644,11 @@ export interface ObjectDefinition {
   documentLayout?: DocumentLayout;
   /** Records of this object may have a parent record of the same object (a tree). */
   hierarchical?: boolean;
+  /**
+   * The order a record's drive rests in for anyone who never chose one on
+   * that object and tab. Absent, the drive rests in `manual`.
+   */
+  defaultDriveSort?: DocumentSortMode;
 }
 /**
  * Links an attribute to an object