@themoltnet/agent-daemon 0.11.0 → 0.12.0

package/dist/main.js

@@ -4190,6 +4190,60 @@ var CuratePackOutput = Type$2.Object({
 	additionalProperties: false
 });
 //#endregion
+//#region ../../libs/tasks/src/task-types/freeform.ts
+var FREEFORM_TYPE = "freeform";
+var FreeformExecutionOptions = Type$2.Object({ workspace: Type$2.Optional(Type$2.Union([
+	Type$2.Literal("none"),
+	Type$2.Literal("shared_mount"),
+	Type$2.Literal("dedicated_worktree")
+])) }, {
+	$id: "FreeformExecutionOptions",
+	additionalProperties: false
+});
+var FreeformTaskTypeProposal = Type$2.Object({
+	name: Type$2.String({ minLength: 1 }),
+	rationale: Type$2.String({ minLength: 1 }),
+	inputShape: Type$2.Optional(Type$2.Record(Type$2.String(), Type$2.Unknown())),
+	outputShape: Type$2.Optional(Type$2.Record(Type$2.String(), Type$2.Unknown()))
+}, {
+	$id: "FreeformTaskTypeProposal",
+	additionalProperties: false
+});
+var FreeformInput = Type$2.Object({
+	title: Type$2.Optional(Type$2.String({ minLength: 1 })),
+	brief: Type$2.String({ minLength: 1 }),
+	expectedOutput: Type$2.Optional(Type$2.String({ minLength: 1 })),
+	constraints: Type$2.Optional(Type$2.Array(Type$2.String({ minLength: 1 }), { maxItems: 20 })),
+	suggestedTaskType: Type$2.Optional(Type$2.String({ minLength: 1 })),
+	successCriteria: Type$2.Optional(SuccessCriteria),
+	context: Type$2.Optional(TaskContext),
+	execution: Type$2.Optional(FreeformExecutionOptions)
+}, {
+	$id: "FreeformInput",
+	additionalProperties: false
+});
+var FreeformArtifact = Type$2.Object({
+	kind: Type$2.String({ minLength: 1 }),
+	title: Type$2.String({ minLength: 1 }),
+	description: Type$2.Optional(Type$2.String({ minLength: 1 })),
+	url: Type$2.Optional(Type$2.String({ minLength: 1 })),
+	path: Type$2.Optional(Type$2.String({ minLength: 1 })),
+	body: Type$2.Optional(Type$2.String({ maxLength: 65536 }))
+}, {
+	$id: "FreeformArtifact",
+	additionalProperties: false
+});
+var FreeformOutput = Type$2.Object({
+	summary: Type$2.String({ minLength: 1 }),
+	artifacts: Type$2.Optional(Type$2.Array(FreeformArtifact, { maxItems: 20 })),
+	proposedTaskType: Type$2.Optional(FreeformTaskTypeProposal),
+	diaryEntryIds: Type$2.Optional(Type$2.Array(Type$2.String({ format: "uuid" }))),
+	verification: Type$2.Optional(VerificationRecord)
+}, {
+	$id: "FreeformOutput",
+	additionalProperties: false
+});
+//#endregion
 //#region ../../libs/tasks/src/task-types/fulfill-brief.ts
 /**
 * `fulfill_brief` — produce a signed change against a coding brief.
@@ -4748,6 +4802,19 @@ function requireVerificationWhenCriteriaPresent(output, input) {
 * / claiming a task.
 */
 var BUILT_IN_TASK_TYPES = {
+	[FREEFORM_TYPE]: {
+		name: FREEFORM_TYPE,
+		inputSchema: FreeformInput,
+		outputSchema: FreeformOutput,
+		outputKind: "artifact",
+		resumable: true,
+		workspaceMode: "shared_mount",
+		workspaceScope: "session",
+		sessionScope: "correlation",
+		acceptsInputWorkspaceOverride: true,
+		requiresReferences: false,
+		validateOutput: requireVerificationWhenCriteriaPresent
+	},
 	[FULFILL_BRIEF_TYPE]: {
 		name: FULFILL_BRIEF_TYPE,
 		inputSchema: FulfillBriefInput,
@@ -4825,6 +4892,7 @@ var BUILT_IN_TASK_TYPES = {
 		resumable: true,
 		workspaceScope: "session",
 		sessionScope: "custom",
+		acceptsInputWorkspaceOverride: true,
 		requiresReferences: false,
 		validateOutput: validateRunEvalOutput
 	},
@@ -5784,6 +5852,13 @@ function taskTypeSessionScope(taskType) {
 	return getTaskTypeEntry(taskType)?.sessionScope ?? "none";
 }
 /**
+* Whether a task type accepts a proposer-supplied workspace mode via
+* `task.input.execution.workspace`. Unknown task types default to false.
+*/
+function taskTypeAcceptsInputWorkspaceOverride(taskType) {
+	return getTaskTypeEntry(taskType)?.acceptsInputWorkspaceOverride ?? false;
+}
+/**
 * Resolve the daemon-relevant execution policy declared by a task type.
 *
 * This is the single read path for "may this task reuse a warm session?" and
@@ -5796,6 +5871,7 @@ function getTaskExecutionPolicy(taskType) {
 		workspaceMode: taskTypeWorkspaceMode(taskType),
 		workspaceScope: taskTypeWorkspaceScope(taskType),
 		sessionScope: taskTypeSessionScope(taskType),
+		acceptsInputWorkspaceOverride: taskTypeAcceptsInputWorkspaceOverride(taskType),
 		usesSubagents: taskTypeUsesSubagents(taskType)
 	};
 }
@@ -6802,6 +6878,95 @@ function buildCuratePackUserPrompt(input, ctx) {
 	]);
 }
 //#endregion
+//#region ../../libs/agent-runtime/src/prompts/freeform.ts
+function buildFreeformUserPrompt(input, ctx) {
+	const header = [
+		"# Freeform Task Agent",
+		"",
+		"You are handling an exploratory MoltNet task that does not yet have a",
+		"more specific execution contract. Treat the brief as the source of truth,",
+		"use judgment, and keep the result useful enough for a human or another",
+		"agent to continue from it.",
+		"",
+		`Task id: \`${ctx.taskId}\``
+	].join("\n");
+	const expectedOutput = input.expectedOutput ?? "";
+	const constraints = input.constraints?.length ? input.constraints.map((constraint) => `- ${constraint}`).join("\n") : "";
+	const suggestedTaskType = input.suggestedTaskType ? [`The proposer suggested task type \`${input.suggestedTaskType}\`.`, "Use it as a hint, not as a contract."].join("\n") : "";
+	const workflow = [
+		"1. Clarify the real objective from the brief before acting.",
+		"2. Gather enough context to avoid guessing.",
+		"3. Complete the requested work when it is safe and bounded.",
+		"4. If the request reveals a recurring task shape, include a",
+		"   `proposedTaskType` in the final output with a concise rationale."
+	].join("\n");
+	return assembleTaskPrompt("freeform", [
+		{
+			id: "freeform.header",
+			source: "header",
+			body: header
+		},
+		{
+			id: "freeform.title",
+			source: "task_input",
+			header: "Title",
+			body: input.title ?? ""
+		},
+		{
+			id: "freeform.brief",
+			source: "task_input",
+			header: "Brief",
+			body: input.brief
+		},
+		{
+			id: "freeform.expected_output",
+			source: "task_input",
+			header: "Expected Output",
+			body: expectedOutput
+		},
+		{
+			id: "freeform.constraints",
+			source: "task_input",
+			header: "Constraints",
+			body: constraints
+		},
+		{
+			id: "freeform.suggested_task_type",
+			source: "task_input",
+			header: "Suggested Task Type",
+			body: suggestedTaskType
+		},
+		{
+			id: "freeform.workflow",
+			source: "static",
+			header: "Workflow",
+			body: workflow
+		},
+		{
+			id: "freeform.verification",
+			source: "verification",
+			body: buildSelfVerificationBlock(ctx.taskId)
+		},
+		{
+			id: "freeform.final_output",
+			source: "final_output",
+			body: buildFinalOutputBlock({
+				taskType: "freeform",
+				outputSchemaName: "FreeformOutput",
+				shapeSketch: [
+					"{",
+					"  \"summary\": \"<2-5 sentence result>\",",
+					"  \"artifacts\": [{ \"kind\": \"...\", \"title\": \"...\", \"description\": \"...\", \"body\": \"<inline content up to 64 KiB; preferred for textual output so it persists with the task>\", \"url\": \"...\", \"path\": \"<worktree-ephemeral; not persisted after completion>\" }],",
+					"  \"proposedTaskType\": { \"name\": \"...\", \"rationale\": \"...\", \"inputShape\": {}, \"outputShape\": {} },",
+					"  \"diaryEntryIds\": [\"...\"],",
+					"  \"verification\": <required iff input.successCriteria; see Self-verification>",
+					"}"
+				].join("\n")
+			})
+		}
+	]);
+}
+//#endregion
 //#region ../../libs/agent-runtime/src/prompts/fulfill-brief.ts
 /**
 * Build the first user-message prompt for a `fulfill_brief` task.
@@ -6851,7 +7016,11 @@ function buildFulfillBriefUserPrompt(input, ctx) {
 		"5. For every commit, create a signed diary entry first via",
 		"   `moltnet_create_entry` and embed its id in the commit trailer",
 		"   `MoltNet-Diary: <id>` (per the runtime instructor).",
-		"6. Push the branch and open a PR."
+		"6. Push the branch and open a PR — run `git push` and `gh pr create`",
+		"   IN the VM with your normal `bash` tool (use the",
+		"   `GH_TOKEN=$(moltnet github token …) gh …` form from the runtime",
+		"   instructor). Do NOT use `moltnet_host_exec` for this; it needs human",
+		"   approval that is unavailable in a headless run."
 	].join("\n");
 	return assembleTaskPrompt("fulfill_brief", [
 		{
@@ -7551,6 +7720,12 @@ function buildRunEvalUserPrompt(input, ctx) {
 */
 function buildTaskUserPrompt(task, ctx) {
 	switch (task.taskType) {
+		case FREEFORM_TYPE:
+			if (!Check(FreeformInput, task.input)) {
+				const errors = [...Errors(FreeformInput, task.input)];
+				throw new Error(`freeform input failed validation: ${JSON.stringify(errors.slice(0, 3))}`);
+			}
+			return buildFreeformUserPrompt(task.input, { taskId: ctx.taskId });
 		case FULFILL_BRIEF_TYPE:
 			if (!Check(FulfillBriefInput, task.input)) {
 				const errors = [...Errors(FulfillBriefInput, task.input)];
@@ -8636,16 +8811,16 @@ var client = createClient(createConfig({ baseUrl: "https://api.themolt.net" }));
 //#endregion
 //#region ../../libs/api-client/src/generated/sdk.gen.ts
 /**
-* Shallow liveness probe.
+* MoltNet network discovery document (RFC 8615 well-known URI). Returns network info, endpoints, capabilities, quickstart steps, and philosophy. No authentication required.
 */
-var getHealth = (options) => (options?.client ?? client).get({
-	url: "/health",
+var getNetworkInfo = (options) => (options?.client ?? client).get({
+	url: "/.well-known/moltnet.json",
 	...options
 });
 /**
-* List the authenticated agent's diaries.
+* Get the authenticated agent identity (requires bearer token).
 */
-var listDiaries = (options) => (options?.client ?? client).get({
+var getWhoami = (options) => (options?.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -8661,29 +8836,21 @@ var listDiaries = (options) => (options?.client ?? client).get({
 			type: "apiKey"
 		}
 	],
-	url: "/diaries",
+	url: "/agents/whoami",
 	...options
 });
 /**
-* Create a new diary.
+* Get an agent's public profile by key fingerprint (A1B2-C3D4-E5F6-G7H8).
 */
-var createDiary = (options) => (options.client ?? client).post({
-	security: [
-		{
-			scheme: "bearer",
-			type: "http"
-		},
-		{
-			name: "X-Moltnet-Session-Token",
-			type: "apiKey"
-		},
-		{
-			in: "cookie",
-			name: "ory_kratos_session",
-			type: "apiKey"
-		}
-	],
-	url: "/diaries",
+var getAgentProfile = (options) => (options.client ?? client).get({
+	url: "/agents/{fingerprint}",
+	...options
+});
+/**
+* Verify a signature belongs to the specified agent.
+*/
+var verifyAgentSignature = (options) => (options.client ?? client).post({
+	url: "/agents/{fingerprint}/verify",
 	...options,
 	headers: {
 		"Content-Type": "application/json",
@@ -8691,9 +8858,9 @@ var createDiary = (options) => (options.client ?? client).post({
 	}
 });
 /**
-* Delete a diary and cascade-delete its entries.
+* Rotate the OAuth2 client secret. Returns the new clientId/clientSecret pair. The old secret is invalidated immediately.
 */
-var deleteDiary = (options) => (options.client ?? client).delete({
+var rotateClientSecret = (options) => (options?.client ?? client).post({
 	security: [
 		{
 			scheme: "bearer",
@@ -8709,13 +8876,13 @@ var deleteDiary = (options) => (options.client ?? client).delete({
 			type: "apiKey"
 		}
 	],
-	url: "/diaries/{id}",
+	url: "/auth/rotate-secret",
 	...options
 });
 /**
-* Get a diary by ID.
+* Get the authenticated agent's cryptographic identity (keys, fingerprint).
 */
-var getDiary = (options) => (options.client ?? client).get({
+var getCryptoIdentity = (options) => (options?.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -8731,13 +8898,13 @@ var getDiary = (options) => (options.client ?? client).get({
 			type: "apiKey"
 		}
 	],
-	url: "/diaries/{id}",
+	url: "/crypto/identity",
 	...options
 });
 /**
-* Update diary name or visibility.
+* List signing requests for the authenticated agent.
 */
-var updateDiary = (options) => (options.client ?? client).patch({
+var listSigningRequests = (options) => (options?.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -8753,17 +8920,13 @@ var updateDiary = (options) => (options.client ?? client).patch({
 			type: "apiKey"
 		}
 	],
-	url: "/diaries/{id}",
-	...options,
-	headers: {
-		"Content-Type": "application/json",
-		...options.headers
-	}
+	url: "/crypto/signing-requests",
+	...options
 });
 /**
-* Revoke a writer or manager grant from a diary.
+* Create a signing request. The server generates a nonce and starts a DBOS workflow that waits for the agent to submit a signature.
 */
-var revokeDiaryGrant = (options) => (options.client ?? client).delete({
+var createSigningRequest = (options) => (options.client ?? client).post({
 	security: [
 		{
 			scheme: "bearer",
@@ -8779,7 +8942,7 @@ var revokeDiaryGrant = (options) => (options.client ?? client).delete({
 			type: "apiKey"
 		}
 	],
-	url: "/diaries/{id}/grants",
+	url: "/crypto/signing-requests",
 	...options,
 	headers: {
 		"Content-Type": "application/json",
@@ -8787,9 +8950,9 @@ var revokeDiaryGrant = (options) => (options.client ?? client).delete({
 	}
 });
 /**
-* List all per-diary grants (writers and managers).
+* Get a specific signing request by ID.
 */
-var listDiaryGrants = (options) => (options.client ?? client).get({
+var getSigningRequest = (options) => (options.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -8805,13 +8968,13 @@ var listDiaryGrants = (options) => (options.client ?? client).get({
 			type: "apiKey"
 		}
 	],
-	url: "/diaries/{id}/grants",
+	url: "/crypto/signing-requests/{id}",
 	...options
 });
 /**
-* Grant writer or manager access to a diary for an agent, human, or group.
+* Submit a signature for a signing request. The DBOS workflow verifies the signature and updates the request status.
 */
-var createDiaryGrant = (options) => (options.client ?? client).post({
+var submitSignature = (options) => (options.client ?? client).post({
 	security: [
 		{
 			scheme: "bearer",
@@ -8827,7 +8990,7 @@ var createDiaryGrant = (options) => (options.client ?? client).post({
 			type: "apiKey"
 		}
 	],
-	url: "/diaries/{id}/grants",
+	url: "/crypto/signing-requests/{id}/sign",
 	...options,
 	headers: {
 		"Content-Type": "application/json",
@@ -8835,25 +8998,10 @@ var createDiaryGrant = (options) => (options.client ?? client).post({
 	}
 });
 /**
-* Initiate a diary transfer to another team. Requires diary manage permission.
+* Verify an Ed25519 signature by looking up the signing request.
 */
-var initiateTransfer = (options) => (options.client ?? client).post({
-	security: [
-		{
-			scheme: "bearer",
-			type: "http"
-		},
-		{
-			name: "X-Moltnet-Session-Token",
-			type: "apiKey"
-		},
-		{
-			in: "cookie",
-			name: "ory_kratos_session",
-			type: "apiKey"
-		}
-	],
-	url: "/diaries/{id}/transfer",
+var verifyCryptoSignature = (options) => (options.client ?? client).post({
+	url: "/crypto/verify",
 	...options,
 	headers: {
 		"Content-Type": "application/json",
@@ -8861,9 +9009,9 @@ var initiateTransfer = (options) => (options.client ?? client).post({
 	}
 });
 /**
-* List pending transfers where the caller is destination team owner.
+* List the authenticated agent's diaries.
 */
-var listPendingTransfers = (options) => (options?.client ?? client).get({
+var listDiaries = (options) => (options?.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -8879,13 +9027,13 @@ var listPendingTransfers = (options) => (options?.client ?? client).get({
 			type: "apiKey"
 		}
 	],
-	url: "/transfers",
+	url: "/diaries",
 	...options
 });
 /**
-* Accept a pending diary transfer. Caller must be destination team owner.
+* Create a new diary.
 */
-var acceptTransfer = (options) => (options.client ?? client).post({
+var createDiary = (options) => (options.client ?? client).post({
 	security: [
 		{
 			scheme: "bearer",
@@ -8901,13 +9049,17 @@ var acceptTransfer = (options) => (options.client ?? client).post({
 			type: "apiKey"
 		}
 	],
-	url: "/transfers/{transferId}/accept",
-	...options
+	url: "/diaries",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
 });
 /**
-* Reject a pending diary transfer.
+* Search diary entries using hybrid search.
 */
-var rejectTransfer = (options) => (options.client ?? client).post({
+var searchDiary = (options) => (options?.client ?? client).post({
 	security: [
 		{
 			scheme: "bearer",
@@ -8923,8 +9075,12 @@ var rejectTransfer = (options) => (options.client ?? client).post({
 			type: "apiKey"
 		}
 	],
-	url: "/transfers/{transferId}/reject",
-	...options
+	url: "/diaries/search",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options?.headers
+	}
 });
 /**
 * List diary entries for a specific diary.
@@ -8997,9 +9153,9 @@ var listDiaryTags = (options) => (options.client ?? client).get({
 	...options
 });
 /**
-* Delete a diary entry.
+* Delete a diary and cascade-delete its entries.
 */
-var deleteDiaryEntryById = (options) => (options.client ?? client).delete({
+var deleteDiary = (options) => (options.client ?? client).delete({
 	security: [
 		{
 			scheme: "bearer",
@@ -9015,13 +9171,13 @@ var deleteDiaryEntryById = (options) => (options.client ?? client).delete({
 			type: "apiKey"
 		}
 	],
-	url: "/entries/{entryId}",
+	url: "/diaries/{id}",
 	...options
 });
 /**
-* Get a single diary entry by ID. Pass expand=relations to inline the relation graph up to `depth` hops. Traversal follows edges in both directions regardless of relation direction.
+* Get a diary by ID.
 */
-var getDiaryEntryById = (options) => (options.client ?? client).get({
+var getDiary = (options) => (options.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -9037,13 +9193,13 @@ var getDiaryEntryById = (options) => (options.client ?? client).get({
 			type: "apiKey"
 		}
 	],
-	url: "/entries/{entryId}",
+	url: "/diaries/{id}",
 	...options
 });
 /**
-* Update a diary entry (content, title, tags).
+* Update diary name or visibility.
 */
-var updateDiaryEntryById = (options) => (options.client ?? client).patch({
+var updateDiary = (options) => (options.client ?? client).patch({
 	security: [
 		{
 			scheme: "bearer",
@@ -9059,7 +9215,7 @@ var updateDiaryEntryById = (options) => (options.client ?? client).patch({
 			type: "apiKey"
 		}
 	],
-	url: "/entries/{entryId}",
+	url: "/diaries/{id}",
 	...options,
 	headers: {
 		"Content-Type": "application/json",
@@ -9067,9 +9223,9 @@ var updateDiaryEntryById = (options) => (options.client ?? client).patch({
 	}
 });
 /**
-* Verify the content signature of a diary entry. Returns whether the entry is signed, hash matches, and signature is valid.
+* Revoke a writer or manager grant from a diary.
 */
-var verifyDiaryEntryById = (options) => (options.client ?? client).get({
+var revokeDiaryGrant = (options) => (options.client ?? client).delete({
 	security: [
 		{
 			scheme: "bearer",
@@ -9085,13 +9241,17 @@ var verifyDiaryEntryById = (options) => (options.client ?? client).get({
 			type: "apiKey"
 		}
 	],
-	url: "/entries/{entryId}/verify",
-	...options
+	url: "/diaries/{id}/grants",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
 });
 /**
-* Search diary entries using hybrid search.
+* List all per-diary grants (writers and managers).
 */
-var searchDiary = (options) => (options?.client ?? client).post({
+var listDiaryGrants = (options) => (options.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -9107,17 +9267,39 @@ var searchDiary = (options) => (options?.client ?? client).post({
 			type: "apiKey"
 		}
 	],
-	url: "/diaries/search",
-	...options,
-	headers: {
+	url: "/diaries/{id}/grants",
+	...options
+});
+/**
+* Grant writer or manager access to a diary for an agent, human, or group.
+*/
+var createDiaryGrant = (options) => (options.client ?? client).post({
+	security: [
+		{
+			scheme: "bearer",
+			type: "http"
+		},
+		{
+			name: "X-Moltnet-Session-Token",
+			type: "apiKey"
+		},
+		{
+			in: "cookie",
+			name: "ory_kratos_session",
+			type: "apiKey"
+		}
+	],
+	url: "/diaries/{id}/grants",
+	...options,
+	headers: {
 		"Content-Type": "application/json",
-		...options?.headers
+		...options.headers
 	}
 });
 /**
-* Get a digest of recent diary entries.
+* List persisted context packs for a diary. Use `expand=entries` to include entry content.
 */
-var reflectDiary = (options) => (options.client ?? client).get({
+var listDiaryPacks = (options) => (options.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -9133,15 +9315,13 @@ var reflectDiary = (options) => (options.client ?? client).get({
 			type: "apiKey"
 		}
 	],
-	url: "/diaries/reflect",
+	url: "/diaries/{id}/packs",
 	...options
 });
 /**
-* [DEPRECATED] Server-side consolidation is obsolete. Compose consolidation suggestions client-side using diary search + clustering. Cluster semantically similar entries and return consolidation suggestions.
-*
-* @deprecated
+* Create and persist a custom context pack from an explicit entry selection.
 */
-var consolidateDiary = (options) => (options.client ?? client).post({
+var createDiaryCustomPack = (options) => (options.client ?? client).post({
 	security: [
 		{
 			scheme: "bearer",
@@ -9157,7 +9337,7 @@ var consolidateDiary = (options) => (options.client ?? client).post({
 			type: "apiKey"
 		}
 	],
-	url: "/diaries/{id}/consolidate",
+	url: "/diaries/{id}/packs",
 	...options,
 	headers: {
 		"Content-Type": "application/json",
@@ -9165,11 +9345,9 @@ var consolidateDiary = (options) => (options.client ?? client).post({
 	}
 });
 /**
-* [DEPRECATED] Server-side compilation is obsolete. Use POST /diaries/:id/packs to create custom packs from agent-side entry selection. Compile a token-budget-fitted context pack from diary entries.
-*
-* @deprecated
+* Preview a custom context pack from an explicit entry selection without persisting it.
 */
-var compileDiary = (options) => (options.client ?? client).post({
+var previewDiaryCustomPack = (options) => (options.client ?? client).post({
 	security: [
 		{
 			scheme: "bearer",
@@ -9185,7 +9363,7 @@ var compileDiary = (options) => (options.client ?? client).post({
 			type: "apiKey"
 		}
 	],
-	url: "/diaries/{id}/compile",
+	url: "/diaries/{id}/packs/preview",
 	...options,
 	headers: {
 		"Content-Type": "application/json",
@@ -9193,9 +9371,9 @@ var compileDiary = (options) => (options.client ?? client).post({
 	}
 });
 /**
-* Export the provenance graph for a persisted context pack by ID.
+* List rendered packs for a diary. Optionally filter by source pack ID or render method.
 */
-var getContextPackProvenanceById = (options) => (options.client ?? client).get({
+var listDiaryRenderedPacks = (options) => (options.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -9211,13 +9389,13 @@ var getContextPackProvenanceById = (options) => (options.client ?? client).get({
 			type: "apiKey"
 		}
 	],
-	url: "/packs/{id}/provenance",
+	url: "/diaries/{id}/rendered-packs",
 	...options
 });
 /**
-* Export the provenance graph for a persisted context pack by CID.
+* Initiate a diary transfer to another team. Requires diary manage permission.
 */
-var getContextPackProvenanceByCid = (options) => (options.client ?? client).get({
+var initiateTransfer = (options) => (options.client ?? client).post({
 	security: [
 		{
 			scheme: "bearer",
@@ -9233,13 +9411,17 @@ var getContextPackProvenanceByCid = (options) => (options.client ?? client).get(
 			type: "apiKey"
 		}
 	],
-	url: "/packs/by-cid/{cid}/provenance",
-	...options
+	url: "/diaries/{id}/transfer",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
 });
 /**
-* List persisted context packs across readable diaries, filtered by entry membership. Use `includeRendered=true` to include rendered descendants.
+* Delete a diary entry.
 */
-var listContextPacks = (options) => (options?.client ?? client).get({
+var deleteDiaryEntryById = (options) => (options.client ?? client).delete({
 	security: [
 		{
 			scheme: "bearer",
@@ -9255,13 +9437,13 @@ var listContextPacks = (options) => (options?.client ?? client).get({
 			type: "apiKey"
 		}
 	],
-	url: "/packs",
+	url: "/entries/{entryId}",
 	...options
 });
 /**
-* Get a persisted context pack by ID. Use `expand=entries` to include entry content.
+* Get a single diary entry by ID. Pass expand=relations to inline the relation graph up to `depth` hops. Traversal follows edges in both directions regardless of relation direction.
 */
-var getContextPackById = (options) => (options.client ?? client).get({
+var getDiaryEntryById = (options) => (options.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -9277,13 +9459,13 @@ var getContextPackById = (options) => (options.client ?? client).get({
 			type: "apiKey"
 		}
 	],
-	url: "/packs/{id}",
+	url: "/entries/{entryId}",
 	...options
 });
 /**
-* Update a context pack — pin/unpin or change expiration. Only the diary owner can manage packs.
+* Update a diary entry (content, title, tags).
 */
-var updateContextPack = (options) => (options.client ?? client).patch({
+var updateDiaryEntryById = (options) => (options.client ?? client).patch({
 	security: [
 		{
 			scheme: "bearer",
@@ -9299,7 +9481,7 @@ var updateContextPack = (options) => (options.client ?? client).patch({
 			type: "apiKey"
 		}
 	],
-	url: "/packs/{id}",
+	url: "/entries/{entryId}",
 	...options,
 	headers: {
 		"Content-Type": "application/json",
@@ -9307,9 +9489,9 @@ var updateContextPack = (options) => (options.client ?? client).patch({
 	}
 });
 /**
-* Preview a custom context pack from an explicit entry selection without persisting it.
+* Verify the content signature of a diary entry. Returns whether the entry is signed, hash matches, and signature is valid.
 */
-var previewDiaryCustomPack = (options) => (options.client ?? client).post({
+var verifyDiaryEntryById = (options) => (options.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -9325,17 +9507,27 @@ var previewDiaryCustomPack = (options) => (options.client ?? client).post({
 			type: "apiKey"
 		}
 	],
-	url: "/diaries/{id}/packs/preview",
-	...options,
-	headers: {
-		"Content-Type": "application/json",
-		...options.headers
-	}
+	url: "/entries/{entryId}/verify",
+	...options
 });
 /**
-* List persisted context packs for a diary. Use `expand=entries` to include entry content.
+* Shallow liveness probe.
 */
-var listDiaryPacks = (options) => (options.client ?? client).get({
+var getHealth = (options) => (options?.client ?? client).get({
+	url: "/health",
+	...options
+});
+/**
+* LLM-readable network summary (llmstxt.org format). Returns the same information as /.well-known/moltnet.json in plain-text markdown. No authentication required.
+*/
+var getLlmsTxt = (options) => (options?.client ?? client).get({
+	url: "/llms.txt",
+	...options
+});
+/**
+* List persisted context packs across readable diaries, filtered by entry membership. Use `includeRendered=true` to include rendered descendants.
+*/
+var listContextPacks = (options) => (options?.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -9351,13 +9543,13 @@ var listDiaryPacks = (options) => (options.client ?? client).get({
 			type: "apiKey"
 		}
 	],
-	url: "/diaries/{id}/packs",
+	url: "/packs",
 	...options
 });
 /**
-* Create and persist a custom context pack from an explicit entry selection.
+* Export the provenance graph for a persisted context pack by CID.
 */
-var createDiaryCustomPack = (options) => (options.client ?? client).post({
+var getContextPackProvenanceByCid = (options) => (options.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -9373,17 +9565,13 @@ var createDiaryCustomPack = (options) => (options.client ?? client).post({
 			type: "apiKey"
 		}
 	],
-	url: "/diaries/{id}/packs",
-	...options,
-	headers: {
-		"Content-Type": "application/json",
-		...options.headers
-	}
+	url: "/packs/by-cid/{cid}/provenance",
+	...options
 });
 /**
-* Preview a rendered pack from a source pack without persisting it.
+* Get a persisted context pack by ID. Use `expand=entries` to include entry content.
 */
-var previewRenderedPack = (options) => (options.client ?? client).post({
+var getContextPackById = (options) => (options.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -9399,17 +9587,13 @@ var previewRenderedPack = (options) => (options.client ?? client).post({
 			type: "apiKey"
 		}
 	],
-	url: "/packs/{id}/render/preview",
-	...options,
-	headers: {
-		"Content-Type": "application/json",
-		...options.headers
-	}
+	url: "/packs/{id}",
+	...options
 });
 /**
-* Render a source pack to structured markdown and persist the result as a new rendered pack with its own CID.
+* Update a context pack — pin/unpin or change expiration. Only the diary owner can manage packs.
 */
-var renderContextPack = (options) => (options.client ?? client).post({
+var updateContextPack = (options) => (options.client ?? client).patch({
 	security: [
 		{
 			scheme: "bearer",
@@ -9425,7 +9609,7 @@ var renderContextPack = (options) => (options.client ?? client).post({
 			type: "apiKey"
 		}
 	],
-	url: "/packs/{id}/render",
+	url: "/packs/{id}",
 	...options,
 	headers: {
 		"Content-Type": "application/json",
@@ -9433,9 +9617,9 @@ var renderContextPack = (options) => (options.client ?? client).post({
 	}
 });
 /**
-* Get the latest rendered pack for a source context pack.
+* Export the provenance graph for a persisted context pack by ID.
 */
-var getLatestRenderedPack = (options) => (options.client ?? client).get({
+var getContextPackProvenanceById = (options) => (options.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -9451,13 +9635,13 @@ var getLatestRenderedPack = (options) => (options.client ?? client).get({
 			type: "apiKey"
 		}
 	],
-	url: "/packs/{id}/rendered",
+	url: "/packs/{id}/provenance",
 	...options
 });
 /**
-* List rendered packs for a diary. Optionally filter by source pack ID or render method.
+* Render a source pack to structured markdown and persist the result as a new rendered pack with its own CID.
 */
-var listDiaryRenderedPacks = (options) => (options.client ?? client).get({
+var renderContextPack = (options) => (options.client ?? client).post({
 	security: [
 		{
 			scheme: "bearer",
@@ -9473,13 +9657,17 @@ var listDiaryRenderedPacks = (options) => (options.client ?? client).get({
 			type: "apiKey"
 		}
 	],
-	url: "/diaries/{id}/rendered-packs",
-	...options
+	url: "/packs/{id}/render",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
 });
 /**
-* Get a rendered pack by its ID.
+* Preview a rendered pack from a source pack without persisting it.
 */
-var getRenderedPackById = (options) => (options.client ?? client).get({
+var previewRenderedPack = (options) => (options.client ?? client).post({
 	security: [
 		{
 			scheme: "bearer",
@@ -9495,13 +9683,17 @@ var getRenderedPackById = (options) => (options.client ?? client).get({
 			type: "apiKey"
 		}
 	],
-	url: "/rendered-packs/{id}",
-	...options
+	url: "/packs/{id}/render/preview",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
 });
 /**
-* Update a rendered pack — pin/unpin or change expiration. Only the diary owner can manage packs.
+* Get the latest rendered pack for a source context pack.
 */
-var updateRenderedPack = (options) => (options.client ?? client).patch({
+var getLatestRenderedPack = (options) => (options.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -9517,25 +9709,49 @@ var updateRenderedPack = (options) => (options.client ?? client).patch({
 			type: "apiKey"
 		}
 	],
-	url: "/rendered-packs/{id}",
-	...options,
-	headers: {
-		"Content-Type": "application/json",
-		...options.headers
-	}
+	url: "/packs/{id}/rendered",
+	...options
 });
 /**
-* Get an agent's public profile by key fingerprint (A1B2-C3D4-E5F6-G7H8).
+* List all problem types used in API error responses (RFC 9457).
 */
-var getAgentProfile = (options) => (options.client ?? client).get({
-	url: "/agents/{fingerprint}",
+var listProblemTypes = (options) => (options?.client ?? client).get({
+	url: "/problems",
 	...options
 });
 /**
-* Verify a signature belongs to the specified agent.
+* Get details about a specific problem type (RFC 9457).
 */
-var verifyAgentSignature = (options) => (options.client ?? client).post({
-	url: "/agents/{fingerprint}/verify",
+var getProblemType = (options) => (options.client ?? client).get({
+	url: "/problems/{type}",
+	...options
+});
+/**
+* Get a single public diary entry by ID with author info. No authentication required.
+*/
+var getPublicEntry = (options) => (options.client ?? client).get({
+	url: "/public/entry/{id}",
+	...options
+});
+/**
+* Paginated feed of public diary entries, newest first. No authentication required.
+*/
+var getPublicFeed = (options) => (options?.client ?? client).get({
+	url: "/public/feed",
+	...options
+});
+/**
+* Semantic + full-text search across public diary entries. No authentication required.
+*/
+var searchPublicFeed = (options) => (options.client ?? client).get({
+	url: "/public/feed/search",
+	...options
+});
+/**
+* Start LeGreffier onboarding. Returns a workflowId and a GitHub App manifest form URL. No authentication required.
+*/
+var startLegreffierOnboarding = (options) => (options.client ?? client).post({
+	url: "/public/legreffier/start",
 	...options,
 	headers: {
 		"Content-Type": "application/json",
@@ -9543,32 +9759,17 @@ var verifyAgentSignature = (options) => (options.client ?? client).post({
 	}
 });
 /**
-* Get the authenticated agent identity (requires bearer token).
+* Poll LeGreffier onboarding status. No authentication required.
 */
-var getWhoami = (options) => (options?.client ?? client).get({
-	security: [
-		{
-			scheme: "bearer",
-			type: "http"
-		},
-		{
-			name: "X-Moltnet-Session-Token",
-			type: "apiKey"
-		},
-		{
-			in: "cookie",
-			name: "ory_kratos_session",
-			type: "apiKey"
-		}
-	],
-	url: "/agents/whoami",
+var getLegreffierOnboardingStatus = (options) => (options.client ?? client).get({
+	url: "/public/legreffier/status/{workflowId}",
 	...options
 });
 /**
-* Verify an Ed25519 signature by looking up the signing request.
+* Generate a recovery challenge for an agent to sign with their Ed25519 private key.
 */
-var verifyCryptoSignature = (options) => (options.client ?? client).post({
-	url: "/crypto/verify",
+var requestRecoveryChallenge = (options) => (options.client ?? client).post({
+	url: "/recovery/challenge",
 	...options,
 	headers: {
 		"Content-Type": "application/json",
@@ -9576,31 +9777,20 @@ var verifyCryptoSignature = (options) => (options.client ?? client).post({
 	}
 });
 /**
-* Get the authenticated agent's cryptographic identity (keys, fingerprint).
+* Verify a signed recovery challenge and return a Kratos recovery code.
 */
-var getCryptoIdentity = (options) => (options?.client ?? client).get({
-	security: [
-		{
-			scheme: "bearer",
-			type: "http"
-		},
-		{
-			name: "X-Moltnet-Session-Token",
-			type: "apiKey"
-		},
-		{
-			in: "cookie",
-			name: "ory_kratos_session",
-			type: "apiKey"
-		}
-	],
-	url: "/crypto/identity",
-	...options
+var verifyRecoveryChallenge = (options) => (options.client ?? client).post({
+	url: "/recovery/verify",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
 });
 /**
-* List signing requests for the authenticated agent.
+* Get a rendered pack by its ID.
 */
-var listSigningRequests = (options) => (options?.client ?? client).get({
+var getRenderedPackById = (options) => (options.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -9616,13 +9806,13 @@ var listSigningRequests = (options) => (options?.client ?? client).get({
 			type: "apiKey"
 		}
 	],
-	url: "/crypto/signing-requests",
+	url: "/rendered-packs/{id}",
 	...options
 });
 /**
-* Create a signing request. The server generates a nonce and starts a DBOS workflow that waits for the agent to submit a signature.
+* Update a rendered pack — pin/unpin or change expiration. Only the diary owner can manage packs.
 */
-var createSigningRequest = (options) => (options.client ?? client).post({
+var updateRenderedPack = (options) => (options.client ?? client).patch({
 	security: [
 		{
 			scheme: "bearer",
@@ -9638,7 +9828,7 @@ var createSigningRequest = (options) => (options.client ?? client).post({
 			type: "apiKey"
 		}
 	],
-	url: "/crypto/signing-requests",
+	url: "/rendered-packs/{id}",
 	...options,
 	headers: {
 		"Content-Type": "application/json",
@@ -9646,9 +9836,9 @@ var createSigningRequest = (options) => (options.client ?? client).post({
 	}
 });
 /**
-* Get a specific signing request by ID.
+* List tasks for a team with optional filters.
 */
-var getSigningRequest = (options) => (options.client ?? client).get({
+var listTasks = (options) => (options.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -9664,13 +9854,13 @@ var getSigningRequest = (options) => (options.client ?? client).get({
 			type: "apiKey"
 		}
 	],
-	url: "/crypto/signing-requests/{id}",
+	url: "/tasks",
 	...options
 });
 /**
-* Submit a signature for a signing request. The DBOS workflow verifies the signature and updates the request status.
+* Create and enqueue a new task.
 */
-var submitSignature = (options) => (options.client ?? client).post({
+var createTask = (options) => (options.client ?? client).post({
 	security: [
 		{
 			scheme: "bearer",
@@ -9686,29 +9876,7 @@ var submitSignature = (options) => (options.client ?? client).post({
 			type: "apiKey"
 		}
 	],
-	url: "/crypto/signing-requests/{id}/sign",
-	...options,
-	headers: {
-		"Content-Type": "application/json",
-		...options.headers
-	}
-});
-/**
-* Generate a recovery challenge for an agent to sign with their Ed25519 private key.
-*/
-var requestRecoveryChallenge = (options) => (options.client ?? client).post({
-	url: "/recovery/challenge",
-	...options,
-	headers: {
-		"Content-Type": "application/json",
-		...options.headers
-	}
-});
-/**
-* Verify a signed recovery challenge and return a Kratos recovery code.
-*/
-var verifyRecoveryChallenge = (options) => (options.client ?? client).post({
-	url: "/recovery/verify",
+	url: "/tasks",
 	...options,
 	headers: {
 		"Content-Type": "application/json",
@@ -9716,9 +9884,9 @@ var verifyRecoveryChallenge = (options) => (options.client ?? client).post({
 	}
 });
 /**
-* Rotate the OAuth2 client secret. Returns the new clientId/clientSecret pair. The old secret is invalidated immediately.
+* List built-in task types with their input schemas and CIDs. Consumers (UIs, MCP tools, agents) use this to render forms or validate inputs without hardcoding the registry.
 */
-var rotateClientSecret = (options) => (options?.client ?? client).post({
+var listTaskSchemas = (options) => (options?.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -9734,13 +9902,13 @@ var rotateClientSecret = (options) => (options?.client ?? client).post({
 			type: "apiKey"
 		}
 	],
-	url: "/auth/rotate-secret",
+	url: "/tasks/schemas",
 	...options
 });
 /**
-* List teams the caller belongs to.
+* Get a task by ID.
 */
-var listTeams = (options) => (options?.client ?? client).get({
+var getTask = (options) => (options.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -9756,13 +9924,13 @@ var listTeams = (options) => (options?.client ?? client).get({
 			type: "apiKey"
 		}
 	],
-	url: "/teams",
+	url: "/tasks/{id}",
 	...options
 });
 /**
-* Create a new project team. Caller becomes owner. If foundingMembers are provided, team starts in founding status and requires all owners to accept before becoming active.
+* List all attempts for a task.
 */
-var createTeam = (options) => (options.client ?? client).post({
+var listTaskAttempts = (options) => (options.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -9778,17 +9946,13 @@ var createTeam = (options) => (options.client ?? client).post({
 			type: "apiKey"
 		}
 	],
-	url: "/teams",
-	...options,
-	headers: {
-		"Content-Type": "application/json",
-		...options.headers
-	}
+	url: "/tasks/{id}/attempts",
+	...options
 });
 /**
-* Delete a team. Requires manage permission (owner only).
+* Mark an attempt as completed with output.
 */
-var deleteTeam = (options) => (options.client ?? client).delete({
+var completeTask = (options) => (options.client ?? client).post({
 	security: [
 		{
 			scheme: "bearer",
@@ -9804,13 +9968,17 @@ var deleteTeam = (options) => (options.client ?? client).delete({
 			type: "apiKey"
 		}
 	],
-	url: "/teams/{id}",
-	...options
+	url: "/tasks/{id}/attempts/{n}/complete",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
 });
 /**
-* Get team details. Requires team access.
+* Mark an attempt as failed with error details.
 */
-var getTeam = (options) => (options.client ?? client).get({
+var failTask = (options) => (options.client ?? client).post({
 	security: [
 		{
 			scheme: "bearer",
@@ -9826,13 +9994,17 @@ var getTeam = (options) => (options.client ?? client).get({
 			type: "apiKey"
 		}
 	],
-	url: "/teams/{id}",
-	...options
+	url: "/tasks/{id}/attempts/{n}/fail",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
 });
 /**
-* List team members. Requires team access.
+* Send a heartbeat to keep the attempt lease alive.
 */
-var listTeamMembers = (options) => (options.client ?? client).get({
+var taskHeartbeat = (options) => (options.client ?? client).post({
 	security: [
 		{
 			scheme: "bearer",
@@ -9848,13 +10020,17 @@ var listTeamMembers = (options) => (options.client ?? client).get({
 			type: "apiKey"
 		}
 	],
-	url: "/teams/{id}/members",
-	...options
+	url: "/tasks/{id}/attempts/{n}/heartbeat",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
 });
 /**
-* Remove a member. Requires manage_members permission.
+* List messages for a task attempt.
 */
-var removeTeamMember = (options) => (options.client ?? client).delete({
+var listTaskMessages = (options) => (options.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -9870,13 +10046,13 @@ var removeTeamMember = (options) => (options.client ?? client).delete({
 			type: "apiKey"
 		}
 	],
-	url: "/teams/{id}/members/{subjectId}",
+	url: "/tasks/{id}/attempts/{n}/messages",
 	...options
 });
 /**
-* Update a member role between member and manager. Requires manage_members permission.
+* Append messages to a task attempt.
 */
-var updateTeamMemberRole = (options) => (options.client ?? client).patch({
+var appendTaskMessages = (options) => (options.client ?? client).post({
 	security: [
 		{
 			scheme: "bearer",
@@ -9892,7 +10068,7 @@ var updateTeamMemberRole = (options) => (options.client ?? client).patch({
 			type: "apiKey"
 		}
 	],
-	url: "/teams/{id}/members/{subjectId}",
+	url: "/tasks/{id}/attempts/{n}/messages",
 	...options,
 	headers: {
 		"Content-Type": "application/json",
@@ -9900,9 +10076,9 @@ var updateTeamMemberRole = (options) => (options.client ?? client).patch({
 	}
 });
 /**
-* List invite codes. Requires manage_members permission.
+* Cancel a task.
 */
-var listTeamInvites = (options) => (options.client ?? client).get({
+var cancelTask = (options) => (options.client ?? client).post({
 	security: [
 		{
 			scheme: "bearer",
@@ -9918,13 +10094,17 @@ var listTeamInvites = (options) => (options.client ?? client).get({
 			type: "apiKey"
 		}
 	],
-	url: "/teams/{id}/invites",
-	...options
+	url: "/tasks/{id}/cancel",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
 });
 /**
-* Create an invite code. Requires manage_members permission.
+* Claim a queued task and start an attempt.
 */
-var createTeamInvite = (options) => (options.client ?? client).post({
+var claimTask = (options) => (options.client ?? client).post({
 	security: [
 		{
 			scheme: "bearer",
@@ -9940,7 +10120,7 @@ var createTeamInvite = (options) => (options.client ?? client).post({
 			type: "apiKey"
 		}
 	],
-	url: "/teams/{id}/invites",
+	url: "/tasks/{id}/claim",
 	...options,
 	headers: {
 		"Content-Type": "application/json",
@@ -9948,9 +10128,9 @@ var createTeamInvite = (options) => (options.client ?? client).post({
 	}
 });
 /**
-* Delete an invite code. Requires manage_members permission.
+* List teams the caller belongs to.
 */
-var deleteTeamInvite = (options) => (options.client ?? client).delete({
+var listTeams = (options) => (options?.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -9966,13 +10146,13 @@ var deleteTeamInvite = (options) => (options.client ?? client).delete({
 			type: "apiKey"
 		}
 	],
-	url: "/teams/{id}/invites/{inviteId}",
+	url: "/teams",
 	...options
 });
 /**
-* Join a team using an invite code.
+* Create a new project team. Caller becomes owner. If foundingMembers are provided, team starts in founding status and requires all owners to accept before becoming active.
 */
-var joinTeam = (options) => (options.client ?? client).post({
+var createTeam = (options) => (options.client ?? client).post({
 	security: [
 		{
 			scheme: "bearer",
@@ -9988,7 +10168,7 @@ var joinTeam = (options) => (options.client ?? client).post({
 			type: "apiKey"
 		}
 	],
-	url: "/teams/join",
+	url: "/teams",
 	...options,
 	headers: {
 		"Content-Type": "application/json",
@@ -9996,9 +10176,9 @@ var joinTeam = (options) => (options.client ?? client).post({
 	}
 });
 /**
-* Generate a single-use voucher code that another agent can use to register. Requires authentication. Max 5 active vouchers per agent.
+* Join a team using an invite code.
 */
-var issueVoucher = (options) => (options?.client ?? client).post({
+var joinTeam = (options) => (options.client ?? client).post({
 	security: [
 		{
 			scheme: "bearer",
@@ -10014,13 +10194,17 @@ var issueVoucher = (options) => (options?.client ?? client).post({
 			type: "apiKey"
 		}
 	],
-	url: "/vouch",
-	...options
+	url: "/teams/join",
+	...options,
+	headers: {
+		"Content-Type": "application/json",
+		...options.headers
+	}
 });
 /**
-* List your active (unredeemed, unexpired) voucher codes.
+* Delete a team. Requires manage permission (owner only).
 */
-var listActiveVouchers = (options) => (options?.client ?? client).get({
+var deleteTeam = (options) => (options.client ?? client).delete({
 	security: [
 		{
 			scheme: "bearer",
@@ -10036,73 +10220,13 @@ var listActiveVouchers = (options) => (options?.client ?? client).get({
 			type: "apiKey"
 		}
 	],
-	url: "/vouch/active",
-	...options
-});
-/**
-* Get the public web-of-trust graph. Each edge represents a redeemed voucher. Identified by key fingerprints (derived from public keys), not names.
-*/
-var getTrustGraph = (options) => (options?.client ?? client).get({
-	url: "/vouch/graph",
-	...options
-});
-/**
-* MoltNet network discovery document (RFC 8615 well-known URI). Returns network info, endpoints, capabilities, quickstart steps, and philosophy. No authentication required.
-*/
-var getNetworkInfo = (options) => (options?.client ?? client).get({
-	url: "/.well-known/moltnet.json",
-	...options
-});
-/**
-* LLM-readable network summary (llmstxt.org format). Returns the same information as /.well-known/moltnet.json in plain-text markdown. No authentication required.
-*/
-var getLlmsTxt = (options) => (options?.client ?? client).get({
-	url: "/llms.txt",
-	...options
-});
-/**
-* Paginated feed of public diary entries, newest first. No authentication required.
-*/
-var getPublicFeed = (options) => (options?.client ?? client).get({
-	url: "/public/feed",
-	...options
-});
-/**
-* Semantic + full-text search across public diary entries. No authentication required.
-*/
-var searchPublicFeed = (options) => (options.client ?? client).get({
-	url: "/public/feed/search",
-	...options
-});
-/**
-* Get a single public diary entry by ID with author info. No authentication required.
-*/
-var getPublicEntry = (options) => (options.client ?? client).get({
-	url: "/public/entry/{id}",
-	...options
-});
-/**
-* Start LeGreffier onboarding. Returns a workflowId and a GitHub App manifest form URL. No authentication required.
-*/
-var startLegreffierOnboarding = (options) => (options.client ?? client).post({
-	url: "/public/legreffier/start",
-	...options,
-	headers: {
-		"Content-Type": "application/json",
-		...options.headers
-	}
-});
-/**
-* Poll LeGreffier onboarding status. No authentication required.
-*/
-var getLegreffierOnboardingStatus = (options) => (options.client ?? client).get({
-	url: "/public/legreffier/status/{workflowId}",
+	url: "/teams/{id}",
 	...options
 });
 /**
-* List built-in task types with their input schemas and CIDs. Consumers (UIs, MCP tools, agents) use this to render forms or validate inputs without hardcoding the registry.
+* Get team details. Requires team access.
 */
-var listTaskSchemas = (options) => (options?.client ?? client).get({
+var getTeam = (options) => (options.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -10118,13 +10242,13 @@ var listTaskSchemas = (options) => (options?.client ?? client).get({
 			type: "apiKey"
 		}
 	],
-	url: "/tasks/schemas",
+	url: "/teams/{id}",
 	...options
 });
 /**
-* List tasks for a team with optional filters.
+* List invite codes. Requires manage_members permission.
 */
-var listTasks = (options) => (options.client ?? client).get({
+var listTeamInvites = (options) => (options.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -10140,13 +10264,13 @@ var listTasks = (options) => (options.client ?? client).get({
 			type: "apiKey"
 		}
 	],
-	url: "/tasks",
+	url: "/teams/{id}/invites",
 	...options
 });
 /**
-* Create and enqueue a new task.
+* Create an invite code. Requires manage_members permission.
 */
-var createTask = (options) => (options.client ?? client).post({
+var createTeamInvite = (options) => (options.client ?? client).post({
 	security: [
 		{
 			scheme: "bearer",
@@ -10162,7 +10286,7 @@ var createTask = (options) => (options.client ?? client).post({
 			type: "apiKey"
 		}
 	],
-	url: "/tasks",
+	url: "/teams/{id}/invites",
 	...options,
 	headers: {
 		"Content-Type": "application/json",
@@ -10170,9 +10294,9 @@ var createTask = (options) => (options.client ?? client).post({
 	}
 });
 /**
-* Get a task by ID.
+* Delete an invite code. Requires manage_members permission.
 */
-var getTask = (options) => (options.client ?? client).get({
+var deleteTeamInvite = (options) => (options.client ?? client).delete({
 	security: [
 		{
 			scheme: "bearer",
@@ -10188,13 +10312,13 @@ var getTask = (options) => (options.client ?? client).get({
 			type: "apiKey"
 		}
 	],
-	url: "/tasks/{id}",
+	url: "/teams/{id}/invites/{inviteId}",
 	...options
 });
 /**
-* Claim a queued task and start an attempt.
+* List team members. Requires team access.
 */
-var claimTask = (options) => (options.client ?? client).post({
+var listTeamMembers = (options) => (options.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -10210,17 +10334,13 @@ var claimTask = (options) => (options.client ?? client).post({
 			type: "apiKey"
 		}
 	],
-	url: "/tasks/{id}/claim",
-	...options,
-	headers: {
-		"Content-Type": "application/json",
-		...options.headers
-	}
+	url: "/teams/{id}/members",
+	...options
 });
 /**
-* Send a heartbeat to keep the attempt lease alive.
+* Remove a member. Requires manage_members permission.
 */
-var taskHeartbeat = (options) => (options.client ?? client).post({
+var removeTeamMember = (options) => (options.client ?? client).delete({
 	security: [
 		{
 			scheme: "bearer",
@@ -10236,17 +10356,13 @@ var taskHeartbeat = (options) => (options.client ?? client).post({
 			type: "apiKey"
 		}
 	],
-	url: "/tasks/{id}/attempts/{n}/heartbeat",
-	...options,
-	headers: {
-		"Content-Type": "application/json",
-		...options.headers
-	}
+	url: "/teams/{id}/members/{subjectId}",
+	...options
 });
 /**
-* Mark an attempt as completed with output.
+* Update a member role between member and manager. Requires manage_members permission.
 */
-var completeTask = (options) => (options.client ?? client).post({
+var updateTeamMemberRole = (options) => (options.client ?? client).patch({
 	security: [
 		{
 			scheme: "bearer",
@@ -10262,7 +10378,7 @@ var completeTask = (options) => (options.client ?? client).post({
 			type: "apiKey"
 		}
 	],
-	url: "/tasks/{id}/attempts/{n}/complete",
+	url: "/teams/{id}/members/{subjectId}",
 	...options,
 	headers: {
 		"Content-Type": "application/json",
@@ -10270,9 +10386,9 @@ var completeTask = (options) => (options.client ?? client).post({
 	}
 });
 /**
-* Mark an attempt as failed with error details.
+* List pending transfers where the caller is destination team owner.
 */
-var failTask = (options) => (options.client ?? client).post({
+var listPendingTransfers = (options) => (options?.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -10288,17 +10404,13 @@ var failTask = (options) => (options.client ?? client).post({
 			type: "apiKey"
 		}
 	],
-	url: "/tasks/{id}/attempts/{n}/fail",
-	...options,
-	headers: {
-		"Content-Type": "application/json",
-		...options.headers
-	}
+	url: "/transfers",
+	...options
 });
 /**
-* Cancel a task.
+* Accept a pending diary transfer. Caller must be destination team owner.
 */
-var cancelTask = (options) => (options.client ?? client).post({
+var acceptTransfer = (options) => (options.client ?? client).post({
 	security: [
 		{
 			scheme: "bearer",
@@ -10314,17 +10426,13 @@ var cancelTask = (options) => (options.client ?? client).post({
 			type: "apiKey"
 		}
 	],
-	url: "/tasks/{id}/cancel",
-	...options,
-	headers: {
-		"Content-Type": "application/json",
-		...options.headers
-	}
+	url: "/transfers/{transferId}/accept",
+	...options
 });
 /**
-* List all attempts for a task.
+* Reject a pending diary transfer.
 */
-var listTaskAttempts = (options) => (options.client ?? client).get({
+var rejectTransfer = (options) => (options.client ?? client).post({
 	security: [
 		{
 			scheme: "bearer",
@@ -10340,13 +10448,13 @@ var listTaskAttempts = (options) => (options.client ?? client).get({
 			type: "apiKey"
 		}
 	],
-	url: "/tasks/{id}/attempts",
+	url: "/transfers/{transferId}/reject",
 	...options
 });
 /**
-* List messages for a task attempt.
+* Generate a single-use voucher code that another agent can use to register. Requires authentication. Max 5 active vouchers per agent.
 */
-var listTaskMessages = (options) => (options.client ?? client).get({
+var issueVoucher = (options) => (options?.client ?? client).post({
 	security: [
 		{
 			scheme: "bearer",
@@ -10362,13 +10470,13 @@ var listTaskMessages = (options) => (options.client ?? client).get({
 			type: "apiKey"
 		}
 	],
-	url: "/tasks/{id}/attempts/{n}/messages",
+	url: "/vouch",
 	...options
 });
 /**
-* Append messages to a task attempt.
+* List your active (unredeemed, unexpired) voucher codes.
 */
-var appendTaskMessages = (options) => (options.client ?? client).post({
+var listActiveVouchers = (options) => (options?.client ?? client).get({
 	security: [
 		{
 			scheme: "bearer",
@@ -10384,25 +10492,14 @@ var appendTaskMessages = (options) => (options.client ?? client).post({
 			type: "apiKey"
 		}
 	],
-	url: "/tasks/{id}/attempts/{n}/messages",
-	...options,
-	headers: {
-		"Content-Type": "application/json",
-		...options.headers
-	}
-});
-/**
-* List all problem types used in API error responses (RFC 9457).
-*/
-var listProblemTypes = (options) => (options?.client ?? client).get({
-	url: "/problems",
+	url: "/vouch/active",
 	...options
 });
 /**
-* Get details about a specific problem type (RFC 9457).
+* Get the public web-of-trust graph. Each edge represents a redeemed voucher. Identified by key fingerprints (derived from public keys), not names.
 */
-var getProblemType = (options) => (options.client ?? client).get({
-	url: "/problems/{type}",
+var getTrustGraph = (options) => (options?.client ?? client).get({
+	url: "/vouch/graph",
 	...options
 });
 //#endregion
@@ -10668,22 +10765,6 @@ function createDiariesNamespace(context) {
 				path: { id }
 			}));
 		},
-		async consolidate(id, body) {
-			return unwrapResult(await consolidateDiary({
-				client,
-				auth,
-				path: { id },
-				body
-			}));
-		},
-		async compile(id, body) {
-			return unwrapResult(await compileDiary({
-				client,
-				auth,
-				path: { id },
-				body
-			}));
-		},
 		async tags(diaryId, query) {
 			return unwrapResult(await listDiaryTags({
 				client,
@@ -11755,13 +11836,6 @@ function createEntriesNamespace(context) {
 				body
 			}));
 		},
-		async reflect(query) {
-			return unwrapResult(await reflectDiary({
-				client,
-				auth,
-				query
-			}));
-		},
 		async verify(entryId) {
 			return unwrapResult(await verifyDiaryEntryById({
 				client,
@@ -15203,7 +15277,7 @@ function createMoltNetTools(config) {
 		defineTool({
 			name: "moltnet_host_exec",
 			label: "Run command on host (escape hatch — requires user approval)",
-			description: "Runs a command on the HOST machine, outside the sandbox VM. The user will be prompted to approve each invocation via a UI dialog — do NOT call this tool speculatively. Use ONLY when a sandboxed operation is impossible — e.g. `git push`, `gh pr create`.\n\nAllowed executables: git, gh, moltnet. Runs with a minimal env (PATH, HOME, GIT_CONFIG_GLOBAL, …); pass any additional vars via the `env` parameter (e.g. GH_TOKEN). Every invocation is logged as an auditable host execution.",
+			description: "Runs a command on the HOST machine, outside the sandbox VM. The user will be prompted to approve each invocation via a UI dialog, and in headless task runs there is no one to approve — so do NOT call this tool speculatively. Routine git and gh work — pushing branches, opening pull requests, etc. — runs INSIDE the VM via the normal `bash` tool, where your credentials are already injected; use that, not this escape hatch. Reserve this tool for the rare case that genuinely cannot run in the guest (e.g. reaching a host-only resource the VM has no path to).\n\nAllowed executables: git, gh, moltnet. Runs with a minimal env (PATH, HOME, GIT_CONFIG_GLOBAL, …); pass any additional vars via the `env` parameter (e.g. GH_TOKEN). Every invocation is logged as an auditable host execution.",
 			parameters: Type.Object({
 				executable: Type.String({ description: "Executable to run (git | gh | moltnet)" }),
 				args: Type.Array(Type.String(), { description: "Arguments to pass to the executable" }),
@@ -16277,6 +16351,11 @@ function buildRuntimeInstructor(ctx) {
 		"",
 		"- `git push` uses the gitconfig-configured credential helper and is not",
 		"  a `gh` call — it does not need `GH_TOKEN`.",
+		"- Run `git` and `gh` in the VM with your normal `bash` tool — your",
+		"  credentials are injected here, so they work in the guest. The",
+		"  `moltnet_host_exec` tool is a last-resort host escape-hatch that",
+		"  requires human approval and is unavailable in headless task runs;",
+		"  never use it for routine git/gh.",
 		"",
 		"## Diary discipline",
 		"",
@@ -17339,7 +17418,7 @@ async function executePiTask(claimedTask, reporter, opts) {
 					is_error: event.isError,
 					result: event.isError ? truncateForWire(event.result) : void 0
 				}));
-				if (event.isError) track(emitError("tool_call_error", describeToolErrorMessage(event.result), {
+				if (shouldEmitToolCallError(event)) track(emitError("tool_call_error", describeToolErrorMessage(event.result), {
 					tool: event.toolName,
 					result: truncateForWire(event.result)
 				}));
@@ -17591,6 +17670,28 @@ function summarizePayloadForLog(kind, payload) {
 	}
 }
 /**
+* Classify a `tool_execution_end` event for telemetry purposes.
+*
+* Bash subprocess non-zero exits are routine — agents deliberately probe
+* absent commands (e.g. `command -v docker` returning 127) and treat the
+* non-zero exit as data. Surfacing those as `tool_call_error` events floods
+* the message stream with spurious errors and makes a successful
+* negative-space probe look like a failing task.
+*
+* Reserve the `error` kind for genuine tool-machinery failures (transport,
+* MCP, malformed response). The `is_error` flag on `tool_call_end` still
+* records the non-zero exit, so consumers can distinguish ok vs. failed
+* bash calls without searching for a sibling error event.
+*
+* Bash timeouts remain handled separately by the cap-abort path; that
+* branch doesn't go through `tool_call_error`.
+*/
+function shouldEmitToolCallError(event) {
+	if (!event.isError) return false;
+	if (event.toolName === "bash") return false;
+	return true;
+}
+/**
 * Detect pi's bash-timeout error wrapper in a `tool_execution_end`
 * result. The bash tool surfaces a timeout as a structured tool result
 * `{ content: [{ type: 'text', text: '… Command timed out after N
@@ -18182,7 +18283,7 @@ function resolveTaskWorktreeBranch(task, workspaceMode) {
 	return `task/${slugifyAsciiLower(task.taskType, 60) || "task"}-${task.id.slice(0, 8)}`;
 }
 function resolveTaskWorkspaceMode(task, policy) {
-	if (task.taskType !== "run_eval") return policy.workspaceMode;
+	if (!policy.acceptsInputWorkspaceOverride) return policy.workspaceMode;
 	switch (typeof task.input.execution?.workspace === "string" ? task.input.execution.workspace : null) {
 		case "none": return "scratch_mount";
 		case "shared_mount": return "shared_mount";